Hi all
The new TrustedFirmware.org security incident process is now live. This process is described here:
https://developer.trustedfirmware.org/w/collaboration/security_center/repor…
Initially the process will be used for the following projects: TF-A, TF-M, OP-TEE and Mbed TLS. The security documentation for each project will be updated soon to reflect this change.
If you are part of an organization that believes it should receive security vulnerability information before it is made public then please ask your relevant colleagues to register as Trusted Stakeholders as described here:
https://developer.trustedfirmware.org/w/collaboration/security_center/trust…
Note we prefer individuals in each organization to coordinate their registration requests with each other and to provide us with an email alias managed by your organization instead of us managing a long list of individual addresses.
Best regards
Dan.
(on behalf of the TrustedFirmware.org security team)
The TLS protocol has many options. A TLS connection starts with a
handshake whose role is mostly for the client and the server to agree on
these options. The ciphersuite is one of these options. It determines
which cryptographic primitives will be used for the various security
properties (data confidentiality, data integrity, server authentication,
etc.).
A ciphersuite mismatch, or more generally a mismatch of some option of
the protocol, or a certificate mismatch, would normally result in the
dissatisfied party closing the connection. For a ciphersuite mismatch,
the server should send an alert "handshake failure". For a certificate
mismatch, there are several alerts ("bad certificate", "certificate
expired", etc.).
The first tool to turn to when debugging a TLS connection is Wireshark.
Compare a failing connection with a successful connection with similar
settings (preferably to the same server). Keep in mind that there can be
many legitimate differences, so the first difference might not be the
source of the problem. You can try connecting with
programs/ssl/ssl_client2 from the mbedtls source tree with different
sets of options.
For some background on how a TLS connection should work, I suggest
starting with Wikipedia, then
https://security.stackexchange.com/questions/20803/how-does-ssl-tls-work
and https://tls.ulfheim.net/ (The Illustrated TLS Connection — note that
while it's a very good explanation, it's for a specific choice of
ciphersuite and other options).
--
Gilles Peskine
Mbed TLS developer
On 29/06/2020 03:02, Thompson, Jeff via mbed-tls wrote:
> Another baby step in discovering what's happening. The last message
> from the server tells the client to change ciphersuites. I don't even
> know what a ciohersuite actually is—something like RSA, AES, or
> DES?—never mind how to change mine, though I have seen the list; my,
> what a lot of conditionals it has.
>
> So, am I still dealing with a certificate issue? Where do I go from here?
>
> Get Outlook for Android <https://aka.ms/ghei36>
>
> ------------------------------------------------------------------------
> *From:* mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> on
> behalf of Thompson, Jeff via mbed-tls <mbed-tls(a)lists.trustedfirmware.org>
> *Sent:* Friday, June 26, 2020 12:52:27 PM
> *To:* mbed-tls(a)lists.trustedfirmware.org
> <mbed-tls(a)lists.trustedfirmware.org>
> *Subject:* Re: [mbed-tls] Choosing a cipher
>
>
> A little progress. I figured out where—ssl_encrypt_buf() in
> ssl_tls.c—to output the name of the offending ciphersuite, which is
> included in all 3 of the preconfigure Google Cloud SSL policies.
>
>
>
> So what’s going on here? Why should the mbedTLS client wait forever
> for 5 bytes it will never get, stalling the connection, instead timing
> out or otherwise detecting an error it could return?
>
>
>
> I’m totally at a loss for what to do with this, other than looking for
> a commercially supported alternative, which I don’t think would be
> received very well by my manager.
>
>
>
> *Jeff Thompson* | Senior Electrical Engineer-Firmware
> +1 704 752 6513 x1394
> www.invue.com
>
>
>
> *From:* Thompson, Jeff
> *Sent:* Friday, June 26, 2020 09:40
> *To:* mbed-tls(a)lists.trustedfirmware.org
> *Subject:* Choosing a cipher
>
>
>
> The TLS handshake between my device and ghs.googlehosted.com gets
> stalled when the server sends the device a Change Cipher Spec
> message—the device waits forever, wanting 5 more bytes. From what I
> Google’d, I need to change the cipher suite I’m using. How do I know
> which cipher the server doesn’t like (so I can avoid that in future),
> and which one I should be using—there are scores of these available in
> the config file, though some of them clearly should not be used, as
> they are commented that way..
>
>
>
> *Jeff Thompson* | Senior Electrical Engineer-Firmware
> +1 704 752 6513 x1394
> www.invue.com
>
>
>
>
Hi Jeff,
There is a specification document for the TLS 1.2 handshake (RFC 5246: https://tools.ietf.org/html/rfc5246) that I think might help finding out what is going on. There is a graph depicting the handshake on page 37 which I think can be particularly useful.
Regards,
Janos
From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> on behalf of "Thompson, Jeff via mbed-tls" <mbed-tls(a)lists.trustedfirmware.org>
Reply to: "Thompson, Jeff" <JeffThompson(a)invue.com>
Date: Monday, 29 June 2020 at 02:02
To: "mbed-tls(a)lists.trustedfirmware.org" <mbed-tls(a)lists.trustedfirmware.org>
Subject: Re: [mbed-tls] Choosing a cipher
Another baby step in discovering what's happening. The last message from the server tells the client to change ciphersuites. I don't even know what a ciohersuite actually is—something like RSA, AES, or DES?—never mind how to change mine, though I have seen the list; my, what a lot of conditionals it has.
So, am I still dealing with a certificate issue? Where do I go from here?
Get Outlook for Android<https://aka.ms/ghei36>
________________________________
From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> on behalf of Thompson, Jeff via mbed-tls <mbed-tls(a)lists.trustedfirmware.org>
Sent: Friday, June 26, 2020 12:52:27 PM
To: mbed-tls(a)lists.trustedfirmware.org <mbed-tls(a)lists.trustedfirmware.org>
Subject: Re: [mbed-tls] Choosing a cipher
A little progress. I figured out where—ssl_encrypt_buf() in ssl_tls.c—to output the name of the offending ciphersuite, which is included in all 3 of the preconfigure Google Cloud SSL policies.
So what’s going on here? Why should the mbedTLS client wait forever for 5 bytes it will never get, stalling the connection, instead timing out or otherwise detecting an error it could return?
I’m totally at a loss for what to do with this, other than looking for a commercially supported alternative, which I don’t think would be received very well by my manager.
Jeff Thompson | Senior Electrical Engineer-Firmware
+1 704 752 6513 x1394
www.invue.com
[cid:image001.gif@01D64DFD.447A03C0]
From: Thompson, Jeff
Sent: Friday, June 26, 2020 09:40
To: mbed-tls(a)lists.trustedfirmware.org
Subject: Choosing a cipher
The TLS handshake between my device and ghs.googlehosted.com gets stalled when the server sends the device a Change Cipher Spec message—the device waits forever, wanting 5 more bytes. From what I Google’d, I need to change the cipher suite I’m using. How do I know which cipher the server doesn’t like (so I can avoid that in future), and which one I should be using—there are scores of these available in the config file, though some of them clearly should not be used, as they are commented that way..
Jeff Thompson | Senior Electrical Engineer-Firmware
+1 704 752 6513 x1394
www.invue.com
[cid:image001.gif@01D64DFD.447A03C0]
Another baby step in discovering what's happening. The last message from the server tells the client to change ciphersuites. I don't even know what a ciohersuite actually is—something like RSA, AES, or DES?—never mind how to change mine, though I have seen the list; my, what a lot of conditionals it has.
So, am I still dealing with a certificate issue? Where do I go from here?
Get Outlook for Android<https://aka.ms/ghei36>
________________________________
From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> on behalf of Thompson, Jeff via mbed-tls <mbed-tls(a)lists.trustedfirmware.org>
Sent: Friday, June 26, 2020 12:52:27 PM
To: mbed-tls(a)lists.trustedfirmware.org <mbed-tls(a)lists.trustedfirmware.org>
Subject: Re: [mbed-tls] Choosing a cipher
A little progress. I figured out where—ssl_encrypt_buf() in ssl_tls.c—to output the name of the offending ciphersuite, which is included in all 3 of the preconfigure Google Cloud SSL policies.
So what’s going on here? Why should the mbedTLS client wait forever for 5 bytes it will never get, stalling the connection, instead timing out or otherwise detecting an error it could return?
I’m totally at a loss for what to do with this, other than looking for a commercially supported alternative, which I don’t think would be received very well by my manager.
Jeff Thompson | Senior Electrical Engineer-Firmware
+1 704 752 6513 x1394
www.invue.com
[cid:image001.gif@01D64BB6.03781220]
From: Thompson, Jeff
Sent: Friday, June 26, 2020 09:40
To: mbed-tls(a)lists.trustedfirmware.org
Subject: Choosing a cipher
The TLS handshake between my device and ghs.googlehosted.com gets stalled when the server sends the device a Change Cipher Spec message—the device waits forever, wanting 5 more bytes. From what I Google’d, I need to change the cipher suite I’m using. How do I know which cipher the server doesn’t like (so I can avoid that in future), and which one I should be using—there are scores of these available in the config file, though some of them clearly should not be used, as they are commented that way..
Jeff Thompson | Senior Electrical Engineer-Firmware
+1 704 752 6513 x1394
www.invue.com
[cid:image001.gif@01D64BB6.03781220]
The TLS handshake between my device and ghs.googlehosted.com gets stalled when the server sends the device a Change Cipher Spec message-the device waits forever, wanting 5 more bytes. From what I Google'd, I need to change the cipher suite I'm using. How do I know which cipher the server doesn't like (so I can avoid that in future), and which one I should be using-there are scores of these available in the config file, though some of them clearly should not be used, as they are commented that way..
Jeff Thompson | Senior Electrical Engineer-Firmware
+1 704 752 6513 x1394
www.invue.com
[cid:image001.gif@01D64B9D.863E3220]
Much thanks to Manuel and Gilles for helping me get this far!
I'm trying to connect to endpoint hosted by Google for IoT devices. The handshake appears to progress through certificate verification and key exchange, encrypts a payload and then times out waiting for 5 expected bytes. I've attached the last part of the mbedTLS output generated with DEBUG_LEVEL 5 (the entrie thing is too big to include here). I'm sure the problem is either my code, network configuration, or somewhere else on my end. Can anyone give me a clue as to what might be wrong?
The starting point for attempting the connection is https_client_tls_xchg(), found in the attached snippet from the example httpsclient.c file as I've modified it.
FWIW, I'm using mbedTLS 2.13.1 running on an MIMXRT1062DVJ6A with MCUXpresso SDK 2.6.2. My HTTPS client is based on NXPs example project lwip_httpscli_mbedtls_freertos.
Thanks,
Jeff Thompson | Senior Electrical Engineer-Firmware
+1 704 752 6513 x1394
www.invue.com
[cid:image001.gif@01D64AE1.D6CB8F10]
[I assume you meant to reply to the list.]
If you don't have a filesystem, call mbedtls_x509_crt_parse instead of
mbedtls_x509_crt_parse_file.
To save static data size, you may want to store the data in binary form
instead of base64. To do this:
1. Split the PEM file into individual certificates.
2. Convert each file to DER (you can use programs/util/pem2der, but you
need to split the file first, because it only converts the first PEM chunk).
3. Convert each binary file to a C unsigned char array literal.
4. In your code, call mbedtls_x509_crt_parse_der in a loop over the array.
Your code might look something like this:
const uint8_t cert1_der[] = {0x30, …};
const uint8_t cert2_der[] = {0x30, …};
…
const struct {const uint8_t *data; size_t size;} root_certs_der = {
{cert1_der, sizeof(cert1_der)},
…
};
…
mbedtls_x509_crt roots;
mbedtls_x509_crt_init(&roots);
for (i = 0; i < sizeof(root_certs_der)/sizeof(root_certs_der[0]); i++)
mbedtls_x509_crt_parse_der(&roots, root_certs_der[i].data,
root_certs_der[i].size);
Best regards,
--
Gilles Peskine
Mbed TLS developer
On 23/06/2020 23:31, Thompson, Jeff wrote:
> I did see that function, but it assumes a file system, doesn't it? I'm not using one, and that would be a really big change to make this late in the development cycle, if I can avoid it. I can program the PEM file into flash memory, where it can be addressed, for reading only, just like ROM. Is there a way to use it like that?
>
> Jeff Thompson | Senior Electrical Engineer-Firmware
> +1 704 752 6513 x1394
> www.invue.com
> -----Original Message-----
> From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> On Behalf Of Gilles Peskine via mbed-tls
> Sent: Tuesday, June 23, 2020 4:38 PM
> To: mbed-tls(a)lists.trustedfirmware.org
> Subject: Re: [mbed-tls] Working with a PEM file
>
> Hi Jeff,
>
> Don't modify or use the certificates in certs.c. The certificates in the certs module are only intended for testing and they will be moved from the library to the test code soon. They are never used automatically and should never be used outside of tests.
>
> The easiest way to set these root certificates is to pass the file to mbedtls_x509_crt_parse_file(). This gives you an object that represents the certificates and you can use those as the trusted CAs for certificate verification through the X.509 or TLS API.
>
> Your code might look like this (error checking and rest of the code
> omitted):
>
> mbedtls_x509_crt roots; // head of the list of trusted CAs mbedtls_x509_crt_init(&roots); mbedtls_x509_crt_parse_file(&roots, "roots.pem"); … // Verify that there is a chain of trust from a certificate to one of the trusted CAs mbedtls_x509_crt_verify(&crt_to_verify, &roots, NULL, NULL, &flags, NULL, NULL); … // Use the trusted CAs for a TLS connection mbedtls_ssl_conf_ca_chain(&ssl_config, roots, NULL); … // Once the certificates are no longer used anywhere mbedtls_x509_crt_free(&roots);
>
>
> Best regards,
>
> --
> Gilles Peskine
> Mbed TLS developer
>
> On 23/06/2020 21:38, Thompson, Jeff via mbed-tls wrote:
>> I’ve downloaded https://pki.goog/roots.pem and want to use the
>> certificates in it with mbedTLS. Is there some documentation that
>> tells me how to do this?
>>
>>
>>
>> The certs.c file only contains only a handful of certs, while the PEM
>> file has nearly 40. How do I know which one to use for what purpose?
>> The certs.c file has these certificate char[]’s:
>>
>>
>>
>> mbedtls_test_ca_crt_ec
>>
>> mbedtls_test_srv_crt_ec
>>
>> mbedtls_test_cli_crt_ec
>>
>> mbedtls_test_ca_crt_rsa
>>
>> mbedtls_test_ca_crt_rsa
>>
>> mbedtls_test_srv_crt_rsa
>>
>> mbedtls_test_cli_crt_rsa
>>
>>
>>
>> I’m reasonably sure I don’t need to replace mbedtls_test_cli_crt_ec
>> and mbedtls_test_cli_crt_rsa, since I am not using a client
>> certificate. But I’m not at all sure about whether I need to replace
>> the 3 **_ca_crt_** certs, the 2 **_srv_crt_** certs, or all 5. And, if
>> so, using which certs from the PEM file to replace which certs in
>> certs.c?. How do I figure out what to do here? I’ve never dealt with
>> cloud communication like this before, so please pardon my ignorance;
>> I’m eager to learn, but overwhelmed by so much that is new to me.
>>
>>
>>
>> Thanks,
>>
>>
>>
>> *Jeff Thompson* | Senior Electrical Engineer-Firmware
>> +1 704 752 6513 x1394
>> www.invue.com
>>
>>
>>
>>
>
> --
> mbed-tls mailing list
> mbed-tls(a)lists.trustedfirmware.org
> https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls
Hi Jeff,
Don't modify or use the certificates in certs.c. The certificates in the
certs module are only intended for testing and they will be moved from
the library to the test code soon. They are never used automatically and
should never be used outside of tests.
The easiest way to set these root certificates is to pass the file to
mbedtls_x509_crt_parse_file(). This gives you an object that represents
the certificates and you can use those as the trusted CAs for
certificate verification through the X.509 or TLS API.
Your code might look like this (error checking and rest of the code
omitted):
mbedtls_x509_crt roots; // head of the list of trusted CAs
mbedtls_x509_crt_init(&roots);
mbedtls_x509_crt_parse_file(&roots, "roots.pem");
…
// Verify that there is a chain of trust from a certificate to one of
the trusted CAs
mbedtls_x509_crt_verify(&crt_to_verify, &roots, NULL, NULL, &flags,
NULL, NULL);
…
// Use the trusted CAs for a TLS connection
mbedtls_ssl_conf_ca_chain(&ssl_config, roots, NULL);
…
// Once the certificates are no longer used anywhere
mbedtls_x509_crt_free(&roots);
Best regards,
--
Gilles Peskine
Mbed TLS developer
On 23/06/2020 21:38, Thompson, Jeff via mbed-tls wrote:
>
> I’ve downloaded https://pki.goog/roots.pem and want to use the
> certificates in it with mbedTLS. Is there some documentation that
> tells me how to do this?
>
>
>
> The certs.c file only contains only a handful of certs, while the PEM
> file has nearly 40. How do I know which one to use for what purpose?
> The certs.c file has these certificate char[]’s:
>
>
>
> mbedtls_test_ca_crt_ec
>
> mbedtls_test_srv_crt_ec
>
> mbedtls_test_cli_crt_ec
>
> mbedtls_test_ca_crt_rsa
>
> mbedtls_test_ca_crt_rsa
>
> mbedtls_test_srv_crt_rsa
>
> mbedtls_test_cli_crt_rsa
>
>
>
> I’m reasonably sure I don’t need to replace mbedtls_test_cli_crt_ec
> and mbedtls_test_cli_crt_rsa, since I am not using a client
> certificate. But I’m not at all sure about whether I need to replace
> the 3 **_ca_crt_** certs, the 2 **_srv_crt_** certs, or all 5. And, if
> so, using which certs from the PEM file to replace which certs in
> certs.c?. How do I figure out what to do here? I’ve never dealt with
> cloud communication like this before, so please pardon my ignorance;
> I’m eager to learn, but overwhelmed by so much that is new to me.
>
>
>
> Thanks,
>
>
>
> *Jeff Thompson* | Senior Electrical Engineer-Firmware
> +1 704 752 6513 x1394
> www.invue.com
>
>
>
>
I've downloaded https://pki.goog/roots.pem and want to use the certificates in it with mbedTLS. Is there some documentation that tells me how to do this?
The certs.c file only contains only a handful of certs, while the PEM file has nearly 40. How do I know which one to use for what purpose? The certs.c file has these certificate char[]'s:
mbedtls_test_ca_crt_ec
mbedtls_test_srv_crt_ec
mbedtls_test_cli_crt_ec
mbedtls_test_ca_crt_rsa
mbedtls_test_ca_crt_rsa
mbedtls_test_srv_crt_rsa
mbedtls_test_cli_crt_rsa
I'm reasonably sure I don't need to replace mbedtls_test_cli_crt_ec and mbedtls_test_cli_crt_rsa, since I am not using a client certificate. But I'm not at all sure about whether I need to replace the 3 *_ca_crt_* certs, the 2 *_srv_crt_* certs, or all 5. And, if so, using which certs from the PEM file to replace which certs in certs.c?. How do I figure out what to do here? I've never dealt with cloud communication like this before, so please pardon my ignorance; I'm eager to learn, but overwhelmed by so much that is new to me.
Thanks,
Jeff Thompson | Senior Electrical Engineer-Firmware
+1 704 752 6513 x1394
www.invue.com
[cid:image001.gif@01D64974.02162CD0]
Hi Jeff,
if you don't want to provision a client certificate in your TLS client, all you have to do is to not call `mbedtls_ssl_conf_own_cert()` in your client code. Then the library will send an empty certificate list as required by the standard.
Actually in the example code you have, if you look at the second and third argument in the call to `mbedtls_ssl_conf_own_cert()`, you should be able to remove all references to those arguments, and end up with a functional example without client certificates.
Also, you might want to have a look at this example from our source, which is a simple client without client-side certificates: https://github.com/ARMmbed/mbedtls/blob/development/programs/ssl/ssl_client…
Hope that helps,
Manuel.
________________________________
From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> on behalf of Thompson, Jeff via mbed-tls <mbed-tls(a)lists.trustedfirmware.org>
Sent: 22 June 2020 16:03
To: 'mbed-tls(a)lists.trustedfirmware.org' <mbed-tls(a)lists.trustedfirmware.org>
Subject: [mbed-tls] Using mbed without a client certificate
I'm usiing:
#define MBEDTLS_VERSION_NUMBER 0x020D0100
#define MBEDTLS_VERSION_STRING "2.13.1"
#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.13.1"
According to RFC5246:
If no suitable certificate is available,
the client MUST send a certificate message containing no
certificates. That is, the certificate_list structure has a
length of zero.
How do I do this with mbedTLS? The example code I have has certificates in it and calls mbedtls_x509_crt_parse(), which wants a list of certificates and will reject a zero-length list.
Jeff Thompson | Senior Electrical Engineer-Firmware
+1 704 752 6513 x1394
www.invue.com
[cid:image001.gif@01D64864.692FAD30]
