- mbed-tls - lists.trustedfirmware.org

Re: [mbed-tls] Request for Support [Issue : Webserver handshake failing with self-signed certificate]

by Gilles Peskine

Hi Selin, A possible problem could be a misconfigured random generator. However this is purely speculation. Can you get a stack trace? Finding the root cause requires finding where mbedtls_mpi_cmp_mpi is called. Please note that Mbed TLS 2.16.3 has known bugs and vulnerabilities. You should upgrade to the latest bug-fixing version of the 2.16 branch, 2.16.10. -- Gilles Peskine Mbed TLS developer On 20/05/2021 13:06, Selin Chris via mbed-tls wrote: > > Hi, > > Thank you for adding me to the mbed-tls mailing list. > > We have created a self-signed certificate with ECC key of > MBEDTLS_ECP_DP_SECP256R1 type, since it is a self-signed certificate > after we send the certificate to chrome from our web server it shows > not trusted and goes to the page where we need to manually proceed > with the acceptance of the certificate to allow further communication. > After this we again have to perform handshake for which we need to > prepare the server key exchange, while preparing the server key > exchange we notice that it is infinitely calling the > mbedtls_mpi_cmp_mpi() function in bignum.c and the execution is not > able to proceed hereafter. Sometimes we also see that when executing > ssl_prepare_server_key_exchange() function in ssl_srv.c we find > ciphersuite_info pointer as null and the program goes into data panic > due to that. We have checked our stacks and not seen any sign of > corruption. > > The mbedtls version that we are using is mbedtls-2.16.3. > Please find the attached wireshark trace during this scenario. The IP > 192.168.2.67 corresponds to our webserver and 192.168.2.100 the pc > with the browser. > > Please let us know the root-cause of the issue and the actions to be > taken to fix this - can you please expedite as this is a blocking > issue in our project. > > Thanks for the support. > > Regards, > Selin. > > >

5 years, 4 months

1
0
0 0

Request for Support [Issue : Webserver handshake failing with self-signed certificate]

by Selin Chris

Hi, Thank you for adding me to the mbed-tls mailing list. We have created a self-signed certificate with ECC key of MBEDTLS_ECP_DP_SECP256R1 type, since it is a self-signed certificate after we send the certificate to chrome from our web server it shows not trusted and goes to the page where we need to manually proceed with the acceptance of the certificate to allow further communication. After this we again have to perform handshake for which we need to prepare the server key exchange, while preparing the server key exchange we notice that it is infinitely calling the mbedtls_mpi_cmp_mpi() function in bignum.c and the execution is not able to proceed hereafter. Sometimes we also see that when executing ssl_prepare_server_key_exchange() function in ssl_srv.c we find ciphersuite_info pointer as null and the program goes into data panic due to that. We have checked our stacks and not seen any sign of corruption. The mbedtls version that we are using is mbedtls-2.16.3. Please find the attached wireshark trace during this scenario. The IP 192.168.2.67 corresponds to our webserver and 192.168.2.100 the pc with the browser. Please let us know the root-cause of the issue and the actions to be taken to fix this - can you please expedite as this is a blocking issue in our project. Thanks for the support. Regards, Selin.

5 years, 4 months

1
0
0 0

Re: [mbed-tls] Query for TLS 1.3

by Shebu Varghese Kuriakose

Hi Manoj, As you might have seen, TLS1.3 prototype is available in github https://github.com/hannestschofenig/mbedtls/tree/tls13-prototype The project is working on reviewing the prototype and upstreaming parts of it to Mbed TLS. The currently open pull requests to Mbed TLS project can be found here: https://github.com/ARMmbed/mbedtls/labels/MPS%20%2F%20TLS%201.3 Some of the outstanding work is captured here - https://github.com/ARMmbed/mbedtls/projects/2#column-12964476 If possible, please test the TLS1.3 prototype and let know if you have any feedback. Also welcome to review any patches. 1. Expected date for release of MbedTLS with TLS 1.3 support? A subset of TLS 1.3 features is aimed to be available around the last quarter of 2021. TLS1.3 support in Mbed TLS at that point would be limited for TLS (no DTLS), Client side and ECDHE. There won't be support for server side, PSK and 0-RTT in this initial version. Note the last quarter target is based on high level task estimations and can change based on progress made in the coming months. You can use the prototype above in the interim for prototyping/development purposes. It is not expected to be integrated on production platforms though. 1. Is MbedTLS with TLS 1.3 support available under paid subscription? No, there is no paid offerings in Mbed TLS project. Mbed TLS project is an open source community project under trustedfirmware.org (https://www.trustedfirmware.org/) and is available to use under the open source license (Refer license section - https://github.com/ARMmbed/mbedtls). 1. Process for paid subscription (if point #2 applicable) Not Applicable Regards, Shebu From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org<mailto:mbed-tls-bounces@lists.trustedfirmware.org>> On Behalf Of Manoj Srivastava via mbed-tls Sent: Monday, May 17, 2021 8:57 PM To: mbed-tls(a)lists.trustedfirmware.org<mailto:mbed-tls@lists.trustedfirmware.org> Subject: [mbed-tls] Query for TLS 1.3 Hello, I am using mbedTLS for TLS support. I am looking for TLS 1.3 support for PSK only mode. I have checked source code online but didn't get TLS 1.3 PSK only code. I found all prototype code only. Can you please highlight the repository if the same is available ? In case fixed code for TLS 1.3 for PSK only mode is not available then can please answer followings: 1. Expected date for release of MbedTLS with TLS 1.3 support? 2. Is MbedTLS with TLS 1.3 support available under paid subscription? 3. Process for paid subscription (if point #2 applicable) Best Regards, Manoj Srivastava

5 years, 4 months

1
0
0 0

Query for TLS 1.3

by Manoj Srivastava

Hello, I am using mbedTLS for TLS support. I am looking for TLS 1.3 support for PSK only mode. I have checked source code online but didn't get TLS 1.3 PSK only code. I found all prototype code only. Can you please highlight the repository if the same is available ? In case fixed code for TLS 1.3 for PSK only mode is not available then can please answer followings: 1. Expected date for release of MbedTLS with TLS 1.3 support? 2. Is MbedTLS with TLS 1.3 support available under paid subscription? 3. Process for paid subscription (if point #2 applicable) Best Regards, Manoj Srivastava

5 years, 5 months

1
0
0 0

Re: [mbed-tls] Support for ECDH key generation with Curve25519

by brian_d＠tutanota.com

Hi, thanks a lot for the fast reply and sorry for my late answer but I did a lot of tests in order to solve the problem (I never had success on compute shared function when "talking" with another peer). Yes, you're right, no need to modify anything. The issue was that mbedtls uses ecp point coordinates in big endian format while the other peer bytes were intended to be in little endian format. After reversing the bytes before compute shared everything worked! Thank you, have a nice day! Brian 3 mag 2021, 21:53 da mbed-tls(a)lists.trustedfirmware.org: > Hi Brian, > > It's not clear to me what you're trying to do. Mbed TLS supports > Curve25519 arithmetic for X25519, accessible through the > mbedtls_ecdh_xxx interface. If you want to use Curve25519 for some other > purpose, this may or may not be supported via direct access to the > mbedtls_ecp_xxx interface. The curve arithmetic code only supports > predefined groups, it does not support changing the generator without > patching the library. > > For Curve25519, the generator is the point (X,Z)=(9,1). Isn't this the > generator you want? > > Best regards, > > -- > Gilles Peskine > Mbed TLS developer > > On 30/04/2021 17:39, Brian via mbed-tls wrote: > >> Hi all, >> I'm trying to set the generator g to a value of 9 for the Curve25519 with mbedtls_ecp_gen_key function. However I cannot find any way to accomplish that. >> Could anyone help me? >> Thank you, have a nice day,Brian >> > > -- > mbed-tls mailing list > mbed-tls(a)lists.trustedfirmware.org > https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls >

5 years, 5 months

1
0
0 0

Not sure if the TLS implementation is correct or not

by Younes Boulahya

Please see these 2 stackoverflow posts: Implementing TLS over HTTP in STM32F303RC using W5500 <https://stackoverflow.com/questions/67522903/implementing-tls-over-http-in-…> HTTPS Handshake Debugging <https://stackoverflow.com/questions/67534996/https-handshake-debugging> In short I have implemented mbedtls over an HTTP Client but I am not sure if it's working or not, when I debug using wireshark I can see the handshake and the encrypted data sent to the server, but I don't see any records added to mysql database. [image: 1.PNG]

5 years, 5 months

1
0
0 0

mbedTLS -entropy source issue

by Pandurangan, Devi

Hi, I'm trying to integrate NXPs secure element SE050 into an application running on MSP432E401Y chip. I was able to successfully integrate their middleware(Plug and trust) on a baremetal project with mbedTLS enabled. It seems on this baremetal project, entropy_source (from entropy_alt.c) is not working. And this has a knock on effect on mbedtls_ctr_drbg_seed function which fails and takes the entire project down with it. Also, from the sole example given in the Simplelink SDK (tcpechotls), I see that mbedtls is used in a project with RTOS enabled. Should I try integrating this code in an RTOS based project and check? Has anyone worked on this ? Thanks, Devi Pandurangan Lead Engineer - Embedded Software Armstrong Fluid Technology #59, "Hampapura Mane" 3rd Main, Margosa Road, Malleswaram, Bangalore, Karnataka, 560 003, India T : +91-80-49063555<tel:+91-80-49063555> | F : +91-80-23343535 www.armstrongfluidtechnology.com [cid:image001.jpg@01D741AF.326E2340]<http://www.armstrongfluidtechnology.com/> [cid:image002.jpg@01D741AF.326E2340]<http://twitter.com/ArmstrongFT_UK> [cid:image003.jpg@01D741AF.326E2340]<http://plus.google.com/+Armstrongfluidtechnology> [cid:image004.jpg@01D741AF.326E2340]<http://www.linkedin.com/company/armstrong-fluid-technology> [cid:image005.jpg@01D741AF.326E2340]<http://www.youtube.com/user/ArmstrongFT> [cid:image006.jpg@01D741AF.326E2340]<https://www.facebook.com/ArmstrongFluidTechnology/> [cid:image007.jpg@01D741AF.326E2340]<https://www.flickr.com/photos/armstrongintegrated/collections/> DISCLAIMER: This email and any attachments are sent in confidence, subject to applicable legal privilege and upon the basis that the recipient will conduct appropriate checks. If you have received this email in error, please send it back to us and immediately and permanently delete it: you are strictly prohibited from using, copying or disclosing it or any information contained in it or in any attachment. Internet communications are not secure and Armstrong Design Private Limited is not responsible for their abuse by third parties, nor for any alteration or corruption in transmission, nor for any damage or loss caused by any virus or other defect. Armstrong Fluid Technology is a trading name of Armstrong Design Private Limited, #59, First Floor, 3rd Main Margosa Road, Malleswaram, Bangalore, 560 003, India registered in India company no. 029120KA2004PTC034014.

5 years, 5 months

1
0
0 0

Re: [mbed-tls] URGENT PLEASE

by Frank Bergmann

Hello Younes, I assume that you recently joined the list here. In that case: Please welcome! Since ole times of Usenet it is a common behaviour to first subscribe a list/channel and listen to the posts. After some time write your own first email to the list, introduce yourself quickly and write about your problem. But please do never start with an email carrying "URGENT" in subject. This is not politely. See, the people maintaining this list do this without any fees. The spent their time to answer questions "from the community" for free. And they do it well! Hence please avoid galopping in here. ;-) You want https and sftp implementations, which are layer 7 and actually mostly on a different/higher layer then mbed TLS. And they are not trivial - there is NO SIMPLE implementation! Please compare it to projects like e.g. Apache or OpenSSH: The people required months/years to get an implementation. Regarding the C code you sent: Obviously it is at least partly coming from STM and it has a size of more than 50 KiB. Why did you sent that? This is not just a code snippet of a few lines. Did you actually expect that anyone would analyze it? Maybe someone is on this list who knows the code and can give you some hints. But don't expect a "working example of https and sftp". Hence my personal answer: - Basic examples like "client" and "server" are already provided by mbed TLS! You just need to extend them with https and sftp protocol. - If you want to use a SIMPLE implementation then please use Python or Java/Groovy. Because then you don't need to know most of the technical details of https and sftp. - If you are looking for many "working examples" of code then you should also think about using a lib like OpenSSL which is mostly used. And please be politely. Please remember that the people here are giving support for free. Great support for free. cheers, Frank On 03.05.21 21:11, Younes Boulahya via mbed-tls wrote: > I am using STM32F303RCT6 and W5500, I want to upgrade to HTTPS and > SFTP, but I can't find any working example that I can use, can you > provide me a simple one PLEASE, of both HTTPS and SFTP. > > I attach my current c code, thank you so much 🌷 > -- Frank Bergmann, Pödinghauser Str. 5, D-32051 Herford, Tel. +49-5221-9249753 SAP Hybris & Linux LPIC-3, E-Mail tx2014(a)tuxad.de, USt-IdNr DE237314606 http://tdyn.de/freel -- Redirect to profile at freelancermap http://www.gulp.de/freiberufler/2HNKY2YHW.html -- Profile at GULP

5 years, 5 months

1
0
0 0

Re: [mbed-tls] Support for ECDH key generation with Curve25519

by Gilles Peskine

Hi Brian, It's not clear to me what you're trying to do. Mbed TLS supports Curve25519 arithmetic for X25519, accessible through the mbedtls_ecdh_xxx interface. If you want to use Curve25519 for some other purpose, this may or may not be supported via direct access to the mbedtls_ecp_xxx interface. The curve arithmetic code only supports predefined groups, it does not support changing the generator without patching the library. For Curve25519, the generator is the point (X,Z)=(9,1). Isn't this the generator you want? Best regards, -- Gilles Peskine Mbed TLS developer On 30/04/2021 17:39, Brian via mbed-tls wrote: > Hi all, > I'm trying to set the generator g to a value of 9 for the Curve25519 with mbedtls_ecp_gen_key function. However I cannot find any way to accomplish that. > Could anyone help me? > Thank you, have a nice day,Brian

5 years, 5 months

1
0
0 0

URGENT PLEASE

by Younes Boulahya

<mbed-tls(a)lists.trustedfirmware.org>I am using STM32F303RCT6 and W5500, I want to upgrade to HTTPS and SFTP, but I can't find any working example that I can use, can you provide me a simple one PLEASE, of both HTTPS and SFTP. I attach my current c code, thank you so much 🌷

5 years, 5 months

1
0
0 0

2026

2025

2024

2023

2022

2021

2020

mbed-tls