Client Hello and Server Hello should include ECC extensions only when negotiating an elliptic curve ciphersuite

[milenamil]

Description

• Type: Bug
• Priority: Major

---

Bug

OS
NA

mbed TLS build:
2.6.0
OS version: NA
Configuration: Any config that supports both EC and non-EC ciphersuites

Peer device TLS stack and version
BouncyCastle, others

Expected behavior
Client Hello and Server Hello should respect the RFC 4492.

The relevant Client Hello behavior is described in section 4:
"The client MUST NOT include these extensions in the ClientHello message if it does not propose any ECC cipher suites."

The relevant Server Hello behavior is described in section 5.2:
"When this extension is sent:
The Supported Point Formats Extension is included in a ServerHello
message in response to a ClientHello message containing the Supported
Point Formats Extension when negotiating an ECC cipher suite."

Actual behavior
The client incorrectly sends ECC extensions in the Client Hello, under the following conditions:

• elliptic curve support is compiled in (e.g., MBEDTLS_ECDH_C)
• the client SSL config includes only non-ECC ciphersuites

The server incorrectly sends the ECC extension in the Server Hello, under the following conditions:

• elliptic curve support is compiled in (e.g., MBEDTLS_ECDH_C)
• the client peer sends the ECC extensions in its Hello
• the negotiated ciphersuite does not use ECC
  The server behavior results in a terminated handshake with a BouncyCastle client (Fatal Alert, illegal parameter), since BouncyCastle has fairly strict checks for the Server Hello extensions.

On the client side, the extensions are sent unconditionally if any ECC key exchange is compiled in (MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, or MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED). They should be sent only if one of the proposed ciphersuites uses ECC.

The situation is similar on the server side - the ECC extension is sent if any ECC key exchange is compiled in and the client sent ECC extensions. The extension should be sent only if the negotiated ciphersuite uses ECC.

Steps to reproduce
See above.

[RonEld]

Hi @milenamil Thank you for reporting this!
I believe you are correct, and we will look into this

[ciarmcom]

ARM Internal Ref: IOTSSL-1857

[RonEld]

@milenamil Could you confirm if #1378 fixes your issue?