From bfb0b39460cc3473db10a8aee597e6d87cca34c7 Mon Sep 17 00:00:00 2001
From: JonathanWitthoeft <jonw@gridconnect.com>
Date: Wed, 26 Apr 2023 10:24:12 -0500
Subject: [PATCH 1/3] Bug Fix: mbedtls_ecdsa_verify_restartable fails with
 ECDSA_SIGN_ALT

When ECDSA_SIGN_ALT but not ECDSA_VERIFY_ALT, mbedtls_ecdsa_can_do was not being defined causing mbedtls_ecdsa_verify_restartable to always fail

Signed-off-by: JonathanWitthoeft <jonw@gridconnect.com>
---
 library/ecdsa.c | 31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/library/ecdsa.c b/library/ecdsa.c
index 3ede933b4901..5cfed082abec 100644
--- a/library/ecdsa.c
+++ b/library/ecdsa.c
@@ -240,6 +240,24 @@ static int derive_mpi(const mbedtls_ecp_group *grp, mbedtls_mpi *x,
 }
 #endif /* ECDSA_DETERMINISTIC || !ECDSA_SIGN_ALT || !ECDSA_VERIFY_ALT */
 
+#if !defined(MBEDTLS_ECDSA_SIGN_ALT)     || \
+    !defined(MBEDTLS_ECDSA_VERIFY_ALT)
+
+int mbedtls_ecdsa_can_do(mbedtls_ecp_group_id gid)
+{
+    switch (gid) {
+#ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
+        case MBEDTLS_ECP_DP_CURVE25519: return 0;
+#endif
+#ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
+        case MBEDTLS_ECP_DP_CURVE448: return 0;
+#endif
+        default: return 1;
+    }
+}
+
+#endif /* !ECDSA_SIGN_ALT || !ECDSA_VERIFY_ALT */
+
 #if !defined(MBEDTLS_ECDSA_SIGN_ALT)
 /*
  * Compute ECDSA signature of a hashed message (SEC1 4.1.3)
@@ -379,19 +397,6 @@ static int ecdsa_sign_restartable(mbedtls_ecp_group *grp,
     return ret;
 }
 
-int mbedtls_ecdsa_can_do(mbedtls_ecp_group_id gid)
-{
-    switch (gid) {
-#ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
-        case MBEDTLS_ECP_DP_CURVE25519: return 0;
-#endif
-#ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
-        case MBEDTLS_ECP_DP_CURVE448: return 0;
-#endif
-        default: return 1;
-    }
-}
-
 /*
  * Compute ECDSA signature of a hashed message
  */

From 930679a1d7f7a2cdafd1901d43f4ca2b426737e8 Mon Sep 17 00:00:00 2001
From: JonathanWitthoeft <jonw@gridconnect.com>
Date: Wed, 26 Apr 2023 16:06:42 -0500
Subject: [PATCH 2/3] Make mbedtls_ecdsa_can_do definition unconditional

Signed-off-by: JonathanWitthoeft <jonw@gridconnect.com>
---
 ChangeLog.d/mbedtls_ecdsa_can_do-unconditional-define.txt | 4 ++++
 library/ecdsa.c                                           | 5 -----
 2 files changed, 4 insertions(+), 5 deletions(-)
 create mode 100644 ChangeLog.d/mbedtls_ecdsa_can_do-unconditional-define.txt

diff --git a/ChangeLog.d/mbedtls_ecdsa_can_do-unconditional-define.txt b/ChangeLog.d/mbedtls_ecdsa_can_do-unconditional-define.txt
new file mode 100644
index 000000000000..fe420ac05acb
--- /dev/null
+++ b/ChangeLog.d/mbedtls_ecdsa_can_do-unconditional-define.txt
@@ -0,0 +1,4 @@
+Bugfix
+   * Removes !ECDSA_SIGN_ALT condition around mbedtls_ecdsa_can_do 
+     definition, so that mbedtls_ecdsa_verify_restartable will not 
+     automatically fail.
diff --git a/library/ecdsa.c b/library/ecdsa.c
index 5cfed082abec..2fcb2fbc019e 100644
--- a/library/ecdsa.c
+++ b/library/ecdsa.c
@@ -240,9 +240,6 @@ static int derive_mpi(const mbedtls_ecp_group *grp, mbedtls_mpi *x,
 }
 #endif /* ECDSA_DETERMINISTIC || !ECDSA_SIGN_ALT || !ECDSA_VERIFY_ALT */
 
-#if !defined(MBEDTLS_ECDSA_SIGN_ALT)     || \
-    !defined(MBEDTLS_ECDSA_VERIFY_ALT)
-
 int mbedtls_ecdsa_can_do(mbedtls_ecp_group_id gid)
 {
     switch (gid) {
@@ -256,8 +253,6 @@ int mbedtls_ecdsa_can_do(mbedtls_ecp_group_id gid)
     }
 }
 
-#endif /* !ECDSA_SIGN_ALT || !ECDSA_VERIFY_ALT */
-
 #if !defined(MBEDTLS_ECDSA_SIGN_ALT)
 /*
  * Compute ECDSA signature of a hashed message (SEC1 4.1.3)

From 3ead877b6889698668fed6d94df5e93e64ac859d Mon Sep 17 00:00:00 2001
From: JonathanWitthoeft <jonw@gridconnect.com>
Date: Wed, 26 Apr 2023 16:17:12 -0500
Subject: [PATCH 3/3] Adjust ChangeLog

Signed-off-by: JonathanWitthoeft <jonw@gridconnect.com>
---
 ChangeLog.d/mbedtls_ecdsa_can_do-unconditional-define.txt | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/ChangeLog.d/mbedtls_ecdsa_can_do-unconditional-define.txt b/ChangeLog.d/mbedtls_ecdsa_can_do-unconditional-define.txt
index fe420ac05acb..22e8adbc58c1 100644
--- a/ChangeLog.d/mbedtls_ecdsa_can_do-unconditional-define.txt
+++ b/ChangeLog.d/mbedtls_ecdsa_can_do-unconditional-define.txt
@@ -1,4 +1,3 @@
 Bugfix
-   * Removes !ECDSA_SIGN_ALT condition around mbedtls_ecdsa_can_do 
-     definition, so that mbedtls_ecdsa_verify_restartable will not 
-     automatically fail.
+   * Fix an error when MBEDTLS_ECDSA_SIGN_ALT is defined but not
+     MBEDTLS_ECDSA_VERIFY_ALT, causing ecdsa verify to fail. Fixes #7498.