Authors Julio Loayza Meneses, Angèle Bossuat
Category Cryptography
Tags audit, OSTIF, TLS, cryptography, vulnerability, mbedtls, software, 2026
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
Introduction
Mbed TLS is a widely deployed open-source TLS, DTLS, and X.509 library maintained by Trusted Firmware, targeting constrained and embedded environments. It is used as the cryptographic backbone of products across the IoT, automotive, and industrial sectors, and forms the TLS layer for projects such as the Trusted Firmware family.
Version 4.0 represents the most significant architectural change in the project's history.
The cryptographic layer has been extracted into a standalone library, TF-PSA-Crypto, which implements the PSA Cryptography API v1.2 as specified by Arm.
The Mbed TLS repository now consumes TF-PSA-Crypto as a submodule, and the configuration space has been split across two header files: mbedtls_config.h for the TLS and X.509 options, and psa/crypto_config.h for the cryptographic
primitives.
All RNG callbacks have been removed in favor of a mandatory call to psa_crypto_init() before any operation.
The Open Source Technology Improvement Fund (OSTIF) commissioned Quarkslab to perform a security audit of this new architecture.
Scope
The primary objectives of this audit are:
-
Architectural transition review. Assess the security implications of the Mbed TLS 3.x to 4.0 split, focusing on the trust boundary between the TLS layer and TF-PSA-Crypto, the correctness of the PSA API integration, and whether the removal of the legacy crypto paths introduces new attack surface.
-
PSA API usage correctness. Verify that key attributes (usage flags, permitted algorithms, lifetimes) are correctly set and enforced throughout the TLS and X.509 code paths, and that the mandatory
psa_crypto_init()dependency is properly documented and enforced. -
Memory safety. Identify memory corruption vulnerabilities in the SSL/DTLS context management (in particular, session serialization and resumption), the X.509 parsing subsystem, and the PSA key store.
-
Default configuration posture. Review the security of the default build configuration, including enabled cipher suites, protocol versions, key exchange algorithms, and compile-time options that may expose users to risk without explicit opt-in.
-
Protocol compliance. Identify deviations from the TLS 1.2 (RFC 5246), TLS 1.3 (RFC 8446), and DTLS specifications that have security consequences.
The engagement covers:
- Mbed TLS at commit
0fe989b6b514192783c469039edd325fd0989806. - TF-PSA-Crypto (integrated submodule) at commit
29160dd877d29658279fd683b2ae57b320ddcf09.
The complete technical report, including our findings and recommendations, is available in Quarkslab's public reports repository.
Findings
The table below summarizes the findings of the audit. A total of 5 vulnerabilities were identified: 1 of high severity, 1 of low severity, and 3 informational ones.
| ID | Title | Severity | Perimeter |
|---|---|---|---|
| HIGH-1 | CID Buffer Overflow in `mbedtls_ssl_context_load()` | High | `library/ssl_tls.c:5002` |
| LOW-4 | `mbedtls_pk_verify()` accepts BER-encoded signatures | Low | `tf-psa-crypto/extras/pk.c` |
| INFO-2 | No Anti-Replay Protection for TLS 1.3 0-RTT Early Data | Info | `include/mbedtls/ssl.h:5166` |
| INFO-3 | Mismatch in CMAC cipher support between the documentation and the implementation. | Info | TF-PSA-Crypto documentation |
| INFO-5 | `compat.sh` DTLS 1.2 tests fail on the `mbedtls-test` Docker image due to IPv6 `localhost` resolution | Info | mbedtls-test Docker images, `compat.sh` |
Note: All relevant findings have since been resolved.
Conclusion
The audit identified a few vulnerabilities with only two non-informational ones, and the auditors were overall very satisfied with the quality of the product in general, and this version's changes in particular.
The high and low vulnerabilities are related to a heap buffer overflow and potential signature malleability, respectively, with the second one being identified thanks to the integration of integration of Project Wycheproof test vectors into the test suite.
An informational finding documents the absence of any anti-replay protection for TLS 1.3 0-RTT early data, a known limitation that is currently not surfaced in the public-facing documentation in a way that prevents inadvertent misuse. Auditors have proposed improvements to the existing fuzzing harnesses and corpora, along with an integration of the #anv test suite into the CI/CD pipeline.
We would like to thank the Mbed TLS maintainers for their responsiveness and collaboration throughout the audit process, as well as the OSTIF team for their continuous support.
Further details can be found in our report.