July 2022 - mbed-tls - lists.trustedfirmware.org

What is the URL to access the Mbed TLS knowledge base?

by Max Peng

Hi mbed-tls Team, I notice that https://tls.mbed.org has been directed to https://www.trustedfirmware.org/projects/mbed-tls/. However, I does not see any link to the old Mbed TLS knowledge base. It is a good resource for learning Mbed TLS. What is the URL to access it? Thanks, Max Peng

8 months, 3 weeks

2
2
0 0

State of documentation

by Tim Becker

Hi all, it feels like the state of documentation has deteriorated since the last time I've used mbedtls (a couple of months ago). I'm not sure if the google index hasn't fully been updated yet, or I don't understand the new structure of the docs or ... Also, is this the proper forum to make suggestions? Should I raise an issue on Github? 1.) a lot of previously linked, useful information now redirects here: https://www.trustedfirmware.org/projects/mbed-tls/ which (please excuse my frankness) feels like an utterly useless abomination that only marketing people could love. - Some examples of previously useful links: from the wiki ( https://developer.trustedfirmware.org/w/mbed-tls/) : > Old Mbed TLS website > Documentation: Mbed TLS API Reference; Knowledge base; Dev corner all redirect to trustedfirmware.org ! As do nearly all the links in https://github.com/Mbed-TLS/mbedtls/blob/development/SUPPORT.md 2.) there is no longer an doxygen generated API documentation anywhere only. I could generate it myself, but then I'd need to get and install Doxygen, figure how to use it, etc. It would be great if this were restored. It can't be that expensive to host :) Anyway, it feels like I've been running around for hours trying to find _anything_ useful, but I just realized everything is redirected to trustedfirmware.org ... Is there any way to still access the old, useful docs? Thanks & sorry that this post is so negative, -tim

8 months, 3 weeks

6
8
0 0

TLS Handshake failure while connecting to mqtt broker from device

by urvi＠milltech.in

Hello Sir/Madam, I am developing TI's EFM32 series micro controller based IOT device. This device will connect to mqtt broker and publish/ subscribes to/from data. In my application, I am trying to connect to AWS using mbedtls library over lwIP (no rtos mode). While my device is in debug mode (i.e. JTAG programmer connected) then it gets connected to AWS successfully. But when I remove JTAG programmer and operate device in normal running mode, then it failed to get connect to broker (i.e. AWS). I observe following errors occured while performing TLS handshaking stage: SSL - The connection indicated an EOF X509 - Certificate verification failed, e.g. CRL, CA or signatur SSL - Processing of the ServerHello handshake message failed

8 months, 3 weeks

1
0
0 0

Setup to test and debug a single funciton.

by Victor Micó

Hi all, First of all apologies if this is not the right place for this topic. For my master thesis I am using the mbedtls library to analyze it using side channel analysis. My objective was to use it as a starting point to analyze the resistance of different exponentiation algorithms. With this objective I am trying to set up a environment where I can call the function "mbedtls_mpi_exp_mod" https://github.com/Mbed-TLS/mbedtls/blob/f5b7082f6e8af72868966b6ea99eae228f… and debug it. I have been trying for at least two weeks but I couldn't be able to succeed. I believe that when If I can get a debugging environment for that function I will be able to adapt it and use other exponentiation algorithms such as the Left-to-right k-ary (HAC 14.82). I am using VScode and the code is located in WLS Ubuntu 20.04. So far I been able to compile the full library and run all the tests. Anyone here could give mean indication on how to set up the environment to debug this function? Thanks! Victor.

8 months, 3 weeks

1
0
0 0

Looking for information regarding the long-term support of the MbedTls library.

by heinrich.mueller＠g-ushin.com

Hello, Currently, we are evaluating the MbedLib to be eventually used in small and midsized automotive ECUs. * Since we have to follow the UNECE Regulation R155, R156, and ISO/SAE 21434 I need some information regarding the long-term support of the library and how the communication of bugs is organized? * I also do not understand the involvement and responsibility of ARM company? * Furthermore, I'm not sure if I understood the terms PSA and MbedTls and their mutual dependencies as well as the technical meaning? I checked the web for I but did not find anything about it yet. It would be just great if somebody can give me some hints or links to the information I am looking for. Regards Heico

8 months, 4 weeks

2
1
0 0

How to secure two simultaneous sockets?

by Fred Wedemeier

I have an application using mbedTls 2.9.0 that's been running successfully for a few years. It secures connections for the AWS MQTT broker, for https GET/PUT transfers, and for SSL/TLS email servers - But only one secure connection at a time. I need to add support for an FTPS client. This requires opening/securing a control channel on port 21, then opening/securing a second port for data transfer. Opening/securing the control channel works as expected. Then, when the client calls connect() for the data transfer socket, the server log shows messages indicating it is preparing for a TLS handshake. Now, here's where I may be missing something... The client calls the same code as for the control connection: Allocates a second mbedtls_ssl_context, mbedtls_ssl_config, mbedtls_x509_crt, et.al, and calls some mbedtls_ssl_*() functions which were copy/pasted from example code several years ago. The server name and root cert are the same. I think the only difference in the second negotiation is the underlying socket descriptor allocated by the IP stack for the data channel. When mbedtls_ssl_handshake() is called, both the filezilla log and client log show a successful handshake. The filezilla log then shows it trying to establish yet another secure data connection, which fails, and reports "TLS session of data connection not resumed." Questions: -- Is the above sequence correct for opening and securing a second connection? -- In searching through ssl.h I see mbedtls_ssl_get_session() and mbedtls_ssl_set_session(). Are these relevant to the situation? I cannot tell from their one-sentence descriptions.

8 months, 4 weeks

1
0
0 0

How to use just RSA algorithm in the tls library with stm32

by arman_ilmak＠yahoo.com

Hi I just needed to use rsa.c but its a little complicated. Can anyone help me or give me any document about how i can use it without use of tls. I just saw a doc on tls.mbed.org but the site is not working anymore.

8 months, 4 weeks

1
0
0 0

psa_crypto_init() asks for entropy even it is not needed for every use case

by heinrich.mueller＠g-ushin.com

Hello, currently, I am evaluating the mbed-tls. I already created some smaller demos regarding AES and RSA. I do so on a PC with cygwin and with Keil micro vision for a NXP S32K144. One demo is just validating some data with a signature and an existing public key. Here is the point that puzzles me a bit. As far as I understand this cybersecurity stuff entropy is not needed for the above use case. Some of my colleagues would agree with me. Once psa_crypto_init() is called on a target NXP S32K144 the function returns PSA_ERROR_INSUFFICIENT_ENTROPY. So far so good https://os.mbed.com/docs/mbed-os/v6.15/porting/entropy-sources.html gives the hints on how to handle this in general but I did not find any information on how to disable the "request for entropy" in a save way once your use case does not need any new secrets. Can you give me a hint why psa_crypto_init() is implemented that way? It may also be that I still have a conceptual understanding problem!? Regards Heico

8 months, 4 weeks

2
2
0 0

*_ALT vs PSA for HW crypto and upstreaming

by mathieu.rondonneau＠broadcom.com

Hi mbed-tls Team, PSA crypto API for HW acceleration seems pretty new. Question1: is there some reference code or project I could poke around to see how it is being used? Currently I have added (locally) a set of driver to make use of our HW crypto using the *_ALT way (the old way?) and for what I understand, the PSA API is the "new way" to do things. But It is still unclear how vendor do upstream there HW acceleration drivers. If this part is kept in another repo, then the mbedTLS build does not have any "hooks" to pull-in the vendor specific code to build the mbedTLS library with. The current implementation seems to be agnostic to any vendor specific HW so I am wondering if there is a "standard" way for vendor to upstream their mbedTLS HW acceleration code that would be built as part of mbedTLS library. I have posted a similar thread to the "issue" ticket of the mbedtls repo for reference: https://github.com/Mbed-TLS/mbedtls/issues/5975 Thanks for any feedback/pointers/ideas. Regards, -Mathieu

9 months

3
2
0 0

LWIP/MbedTLS - any idea if SPI SRAM (block-accessible RAM) could be used for buffers?

by Peter

Hi All, My target has 128k SRAM which has about 60k spare, and 64k CCM which is allocated whole to FreeRTOS stacks etc (its private heap, memory model #4). I am running a simplified HTTP server (for local config etc), which uses fairly minimal RAM (a few k), and an HTTPS/TLS client which uses about 50k (for its private heap). So if both of the above are running concurrently, there is only ~10k RAM left, but it does work, but when TLS is doing its handshake/negotiation (which on a 168MHz 32F417 takes 2-3 seconds) the HTTP server temporarily hangs. Investigating this, it appears that LWIP is running out of buffers during TLS and is rejecting incoming packets. I don't really want to change the CPU to the next one up which has another 64k RAM, because a) I have stock of the 417 and this took about a year to get, b) the design is rock solid and I don't want to tempt fate (there is a lot of subtle hardware usage e.g. DAC ADC DMA timers) even though in theory it should be just alternate function pin changes, c) some versions of the product may not need TLS at all. I have an option of an 8 megabyte SPI-attached RAM https://www.eevblog.com/forum/microcontrollers/lyontek-ly68l6400-8-megabyte… which does work and is not bad at $3 (there are cheaper 128kbyte versions too), but obviously cannot be addressed as normal RAM. The ESP32 can do that but the 32F4 can't. Does anyone know enough about the internals of MbedTLS, or even LWIP, to know whether the memory usage structure lends itself to this kind of "overlay" memory? One can read or write say 1k bytes in 400us, in my target (21MHz SPI with DMA). Obviously this would be horribly inefficient for a byte at a time emulation but perhaps one can switch buffers in and out... Thank you in advance. If somebody knows of a concrete route, I am happy to pay for the time. Regards, Peter

9 months

1
0
0 0

2023

2022

2021

2020

mbed-tls July 2022