11. June 2024

[dimakuv]

Agenda

(please write your proposed agenda items in comments under this discussion)

• No agenda items, the meeting was about misc opens

Woju: mbedTLS will remove some features in v4.0

• Remove DES Mbed-TLS/mbedtls#9164: "DES (including 3DES)"
• How to implement a custom RSA-based mechanism Mbed-TLS/TF-PSA-Crypto#104: "custom RSA mechanisms"
• How to implement a custom ECC-based mechanism Mbed-TLS/TF-PSA-Crypto#102: "custom ECC mechanisms"
• Importing partial RSA private keys Mbed-TLS/TF-PSA-Crypto#105: "RSA private key import"
• How to partially accelerate ECC Mbed-TLS/TF-PSA-Crypto#103: "partial ECC acceleration"
• Remove the dynamic SE interface in 4.0 Mbed-TLS/mbedtls#8151: "dynamic secure element drivers"
• Remove static ECDH cipher suites Mbed-TLS/mbedtls#9201: "static ECDH cipher suites"
• Remove CBC cipher suites Mbed-TLS/mbedtls#9202: "CBC cipher suites"
• Remove support for the RSA-decryption key exchange in TLS 1.2 Mbed-TLS/mbedtls#8170: "RSA decryption cipher suites"

Only the last item affects us: we use MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256. Or not? What's the difference between MBEDTLS_KEY_EXCHANGE_PSK (that our cipher uses) and MBEDTLS_KEY_EXCHANGE_RSA_PSK (that will be removed)?

• TODO(Dmitrii): Ask some Intel crypto expert first. Then can also ask in the GitHub issue of mbedTLS.

Michal and Mariusz: detect places where we forget to check errors at compile-time

ITL folks want to detect more errors/detect mismatches in errors at compile-time. Hence PRs like #1900.

Mona: update from CCS'2024

Mona attended this conference: https://www.confidentialcomputingsummit.com/, presenting among other things Gramine with a TDX backend (https://github.com/gramineproject/gramine-tdx).

An interesting TDX-related project from Google, Project Oak: https://www.youtube.com/watch?v=VjA92zzBRXg&ab_channel=EdgelessSystems

Misc

Woju: no updates on the new machines.