I am using mbedtls_x509write_csr_set_subject_name API from mbedtls to set the subject name.
I wanted to set the arbitrary old value in my certificate for e.g.
ffeBgt9jDHhBwPDANgtT7R/1.3.6.1.4.1.37244.2.1=FFF2/1.3.6.1.4.1.37244.2.2=8001
In this case ffeBgt9jDHhBwPDANgtT7R is the CN
And 1.3.6.1.4.1.37244.2.1 is an arbitrary OID which has a value of FFF2 similar to the second arbitrary OID.
I am able to do this through openssl commands, but while doing it through mbedtls, when I pass it as a string then mbedtls considers the whole string as CN which Is not my intention.
Please fine the asn1 parsing of the CSR as below
CSR generated through mbedtls:
18:d=5 hl=2 l= 3 prim: OBJECT :commonName
23:d=5 hl=2 l= 76 prim: UTF8STRING :ffeBgt9jDHhBwPDANgtT7R/1.3.7.1.4.1.37466.2.1=FFF2+1.3.7.1.4.1.37466.2.2=8001
101:d=3 hl=2 l= 11 cons: SET
103:d=4 hl=2 l= 9 cons: SEQUENCE
Target CSR ( done thorough openssl):
14:d=4 hl=2 l= 29 cons: SEQUENCE
16:d=5 hl=2 l= 3 prim: OBJECT :commonName
21:d=5 hl=2 l= 22 prim: UTF8STRING :ffeBgt9jDHhBwPDANgtT7R
45:d=3 hl=2 l= 20 cons: SET
47:d=4 hl=2 l= 18 cons: SEQUENCE
49:d=5 hl=2 l= 10 prim: OBJECT :1.3.7.1.4.1.37466.2.1
61:d=5 hl=2 l= 4 prim: UTF8STRING :FFF2
67:d=3 hl=2 l= 20 cons: SET
69:d=4 hl=2 l= 18 cons: SEQUENCE
71:d=5 hl=2 l= 10 prim: OBJECT :1.3.7.1.4.1.37466.2.2
83:d=5 hl=2 l= 4 prim: UTF8STRING :8001
89:d=2 hl=2 l= 89 cons: SEQUENCE
91:d=3 hl=2 l= 19 cons: SEQUENCE
93:d=4 hl=2 l= 7 prim: OBJECT :id-ecPublicKey
102:d=4 hl=2 l= 8 prim: OBJECT :prime256v1
Am I missing something here? Do I need to provide the CN in a different way to get the intended result?
I found an open issue https://github.com/Mbed-TLS/mbedtls/issues/4886, could it be related to this?
Any help would be appreciated.
Thanks and Regards,
Aditya
Hi All,
A gentle reminder that the Asia-Europe timezone-friendly MBed TLS Tech
forum is next *Monday, Dec 5 at 10:00am UK time*. Invite details can be
found on the online calendar here
<https://www.trustedfirmware.org/meetings/>.
As usual, if anyone has any topics, please let Dave Rodgman, cc'd, know. :)
Best regards,
Don Harbin
TrustedFirmware Community Manager
don.harbin(a)linaro.org
Hi All,
Mbed TLS is planning to move to a new code style by the end of this year. The proposed new style is currently being discussed in the GitHub pull request:
https://github.com/Mbed-TLS/mbedtls/pull/6591
If you have any feedback on this new style, or you think we should tweak it, feel free to comment on the pull request. We will take your thoughts into account when we decide on the final style.
Discussions will continue until the evening of THIS FRIDAY (UK time).
Many thanks,
David Horstmann for the Mbed TLS Team
Hi All,
A gentle reminder that the US-Europe timezone-friendly MBed TLS Tech forum
is next Monday at 4:30 PM UK time. Invite details can be found on the
online calendar here <https://www.trustedfirmware.org/meetings/>.
If you have any topics, please let Dave Rodgman know. :)
Best regards,
Don Harbin
TrustedFirmware Community Manager
don.harbin(a)linaro.org
Hello everyone,
We observed a strange behavior in the mbedTLS client, when client authentication is requested by the TLS server. This behavior was observed in the newer version 3.0.0 as well as in older versions.
The scenario is the following: The server selects a ciphersuite e.g. ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 and sends a CertificateRequest message that only includes the ecdsa_secp256r1_sha256 signature algorithm.
However, the mbedTLS client simply ignores the requested hash function and uses ecdsa_secp256r1_sha384 for the signature in the ClientVerify.
Then, the server complains since the signature does not match with the requested signature algorithm and sends a handshake failure.
It seems that mbedTLS does not store the requested signature algorithms/hash function from the CertificateRequest and always uses the hash function from the selected ciphersuite.
In the ssl_write_certificate_verify function, we find the following comment:
/*
* digitally-signed struct {
* opaque handshake_messages[handshake_messages_length];
* };
*
* Taking shortcut here. We assume that the server always allows the
* PRF Hash function and has sent it in the allowed signature
* algorithms list received in the Certificate Request message.
*
* Until we encounter a server that does not, we will take this
* shortcut.
*
* Reason: Otherwise we should have running hashes for SHA512 and
* SHA224 in order to satisfy 'weird' needs from the server
* side.
*/
Is this a known problem and is there any fix available?
Cheers,
Simon Nachtigall
Hi All,
A gentle reminder that the Asia-Europe timezone-friendly MBed TLS Tech
forum is next *Monday, Nov 7 at 10:00am UK time*. Invite details can be
found on the online calendar here
<https://www.trustedfirmware.org/meetings/>.
If you have any topics, please let Dave Rodgman, cc'd, know. :)
Best regards,
Don Harbin
TrustedFirmware Community Manager
don.harbin(a)linaro.org
Hi all,
I'd like to know if there is some way to retrieve the currently available number of bytes of application data without calling mbedtls_ssl_read()?
I'm writing a "TLS socket" for higher layers to use and would like to notify them when new application data is available, tell them how much it is, but leave it up to them when and how much to retrieve.
I'd like to prevent having to buffer all application data inside my TLS socket, because that would mean copying it once from mbedtls' buffer to my socket and then again from there to the application whenever it actually requests the data.
After a quick look into the sources, it seems like, if at all, this might be possible for single records. But all related fields are private and I could not find any API for this.
Issue #551 [1] seems related, but is more about peeking into the application data, while I would be fine with knowing just the size of available application data.
Thanks for any hints on how I could achieve this.
Best regards,
Jan
[1] https://github.com/Mbed-TLS/mbedtls/issues/551
________________________________
This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.
Hello,
Summary: I am soliciting feedback about builds of Mbed TLS where *there
is both a PSA implementation and the built-in software implementation of
the same algorithm, by design, *and the PSA implementation isn't just
calling the built-in implementation because the two have different
characteristics, each desirable in some context. Please read this
message if you are doing this or considering it. Feel free to ignore
otherwise.
For example, both MBEDTLS_SHA256_C and MBEDTLS_PSA_ACCEL_ALG_SHA_256 are
enabled, so that calls to mbedtls_md_xxx() use the software
implementation and calls to psa_hash_xxx() use the hardware accelerator
via the PSA driver. And this is deliberate: there is a reason why
mbedtls_md_xxx() must not call the PSA driver.
In most cases, this is not desirable: if there's an accelerator, why not
use it? And we're working to allow getting rid of the software
implementation in more and more cases. Ultimately, PSA will be the only
crypto interface in Mbed TLS, so all interfaces to calculate SHA-256
will go through psa_hash_xxx() and therefore will dispatch the call to
the driver if there is one. This will be an API break, since it will
require calling psa_crypto_init() before performing any cryptography.
Currently we are planning to introduce this requirement in Mbed TLS 4.0.
But it is currently possible to have dual algorithm support, and I can
think of unusual cases where it might desirable.
Scenario 1, with accelerator drivers: there is a driver, but it can only
be used after some initialization. The application needs to use the
algorithm before calling psa_crypto_init(), so it calls the legacy
interface. After psa_crypto_init() has been called, the application
would like to use the driver as much as possible. A typical use case is
a bootloader which wants to verify a signature before initializing the
random generator, so it calls mbedtls_md_xxx() and mbedtls_rsa_xxx().
Scenario 1 is clearly desirable, and for that we have a planned
solution, which is staged initialization. The bootloader will be able to
(1) initialize drivers, (2) perform a hash calculation, (3) initialize
the keystore, (4) verify a signature, all without initializing the RNG.
We won't make psa_crypto_init() mandatory until this feature is implemented.
Scenario 2: with a cryptography service. This is a build of Mbed TLS
with MBEDTLS_PSA_CRYPTO_CLIENT, so all psa_xxx() calls call the service.
But, for some reason, there is also a local implementation of some
cryptography algorithms. So you can call mbedtls_md() to calculate a
hash even before the connection to the service has been established. Or
maybe you want to call mbedtls_md() for short messages and
psa_hash_compute() for long messages, because the crypto service has a
faster implementation but the communication overhead offsets the gain
for short messages.
We are currently working on improving support for PSA drivers, and in
particular, saving code size by eliminating more unnecessary code when a
driver is present, and increasing the set of APIs that benefit from
drivers. The obvious way to do that is to make all cryptography calls
(especially from X.509 and TLS) go via the PSA interface, but we can't
do that yet due to the need to have initialized the keystore and RNG. We
are considering routing /certain/ crypto calls via PSA, in a way that
would break scenario 2, and would also break scenario 1 in some cases,
but not for hashes or signature verification.
If, for example, in Mbed TLS 3.4, mbedtls_md() starts calling
psa_hash_(), would this break your code? Are you in scenario 1, scenario
2, or some other variant I haven't thought of?
If so, *please reply to this message and let us know what your needs
are*. Feel free to reply to me in private if you don't want to discuss
this publicly (I won't share directly outside Arm, but the eventual
design might leak information about the unusual scenario).
If we don't hear objections, there is a chance that a future Mbed TLS
3.x will break scenarios 1 and 2. If we do hear objections, we'll work
to keep the current behavior or arrange a migration path.
Best regards,
--
Gilles Peskine
Mbed TLS developer