- mbed-tls - lists.trustedfirmware.org

FW: How to map PSA method to openssl method

by Gyorgy Szing

Hi, Can you please help Jun to find an answer to is question? (See below.) /George ---------- Forwarded message --------- 发件人： Jun Nie <jun.nie(a)linaro.org> Date: 2021年6月7日周一下午2:31 Subject: How to map PSA method to openssl method To: <mbed-tls(a)lists.trustedfirmware.org> Hi, I want to sign a data on PC with openssl, and verifiy it with PSA-RoT on board. Does anybody know how to map PSA method to openssl method? Such as: psa_sign_hash(key_handle, PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_SHA_256), hash, hash_len, sig, sizeof(sig), sig_len); Regards, Jun

3 years, 3 months

1
0
0 0

Re: [mbed-tls] mbedtls_ssl_set_bio hangs

by Gilles Peskine

Hi Ron, The code you've shown so far only consists of setup functions that populate fields in the configuration structure, then in the context structure. Communication has not started yet. mbedtls_ssl_set_bio in particular is a very simple setter function. Where does the code actually hang? Have some messages already been exchanged on the network at that point? Can you get a stack trace? Best regards, -- Gilles Peskine Mbed TLS developer On 08/06/2021 02:30, Ron Eggler via mbed-tls wrote: > > On 2021-06-07 5:00 p.m., Ron Eggler via mbed-tls wrote: >> Hi, >> >> >> i'm in the process of wrioting an FTPS client for a system running on >> uCOS. >> >> I've been able to setup the control channel fine and working on >> setting up the data channel for a simple list command execution. >> >> It seems like I seem able to setup everything fine but the call to >> mbedtls_ssl_set_bio() hangs even though I set it to execute the >> timeout function like: >> >> mbedtls_ssl_set_bio( &ssl_d, >> &data_fd, >> mbedtls_tls_send, >> NULL, >> mbedtls_tls_recv_timeout); >> >> Where the mbed_tls_recv_timeout looks like: >> >> https://pastebin.com/Jw3iLc0x >> >> The current connection uses ipv4, i.e. the select () branch is >> active. I never see the timed out message. Any idea what may be going >> on here? >> >> Thank you, >> >> Ron >> > A bit more detail: as for what comes before the mbedtls_ssl_set_bio() > call: > > ret = mbedtls_ssl_config_defaults(&conf_d, > MBEDTLS_SSL_IS_CLIENT, > MBEDTLS_SSL_TRANSPORT_STREAM, > MBEDTLS_SSL_PRESET_DEFAULT); > > mbedtls_ssl_conf_authmode( &conf_d, MBEDTLS_SSL_VERIFY_OPTIONAL); > mbedtls_ssl_conf_ca_chain( &conf_d, &cacert_d, NULL ); > mbedtls_ssl_conf_rng(&conf_d, mbedtls_ctr_drbg_random, &ctr_drbg_d ); > mbedtls_ssl_conf_dbg(&conf_d, mydebug, stdout); > ret = mbedtls_ssl_conf_own_cert( &conf_d, &clicert_d, &pkey_d); > > ret = mbedtls_ssl_setup( &ssl_d, &conf_d ); > > mbedtls_ssl_set_bio( &ssl_d, > &data_fd, > mbedtls_tls_send, > NULL, > mbedtls_tls_recv_timeout); >

3 years, 3 months

1
0
0 0

Re: [mbed-tls] mbedtls_ssl_set_bio hangs

by Ron Eggler

On 2021-06-07 5:00 p.m., Ron Eggler via mbed-tls wrote: > Hi, > > > i'm in the process of wrioting an FTPS client for a system running on > uCOS. > > I've been able to setup the control channel fine and working on > setting up the data channel for a simple list command execution. > > It seems like I seem able to setup everything fine but the call to > mbedtls_ssl_set_bio() hangs even though I set it to execute the > timeout function like: > > mbedtls_ssl_set_bio( &ssl_d, > &data_fd, > mbedtls_tls_send, > NULL, > mbedtls_tls_recv_timeout); > > Where the mbed_tls_recv_timeout looks like: > > https://pastebin.com/Jw3iLc0x > > The current connection uses ipv4, i.e. the select () branch is active. > I never see the timed out message. Any idea what may be going on here? > > Thank you, > > Ron > A bit more detail: as for what comes before the mbedtls_ssl_set_bio() call: ret = mbedtls_ssl_config_defaults(&conf_d, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT); mbedtls_ssl_conf_authmode( &conf_d, MBEDTLS_SSL_VERIFY_OPTIONAL); mbedtls_ssl_conf_ca_chain( &conf_d, &cacert_d, NULL ); mbedtls_ssl_conf_rng(&conf_d, mbedtls_ctr_drbg_random, &ctr_drbg_d ); mbedtls_ssl_conf_dbg(&conf_d, mydebug, stdout); ret = mbedtls_ssl_conf_own_cert( &conf_d, &clicert_d, &pkey_d); ret = mbedtls_ssl_setup( &ssl_d, &conf_d ); mbedtls_ssl_set_bio( &ssl_d, &data_fd, mbedtls_tls_send, NULL, mbedtls_tls_recv_timeout);

3 years, 3 months

1
0
0 0

mbedtls_ssl_set_bio hangs

by Ron Eggler

Hi, i'm in the process of wrioting an FTPS client for a system running on uCOS. I've been able to setup the control channel fine and working on setting up the data channel for a simple list command execution. It seems like I seem able to setup everything fine but the call to mbedtls_ssl_set_bio() hangs even though I set it to execute the timeout function like: mbedtls_ssl_set_bio( &ssl_d, &data_fd, mbedtls_tls_send, NULL, mbedtls_tls_recv_timeout); Where the mbed_tls_recv_timeout looks like: https://pastebin.com/Jw3iLc0x The current connection uses ipv4, i.e. the select () branch is active. I never see the timed out message. Any idea what may be going on here? Thank you, Ron

3 years, 3 months

1
0
0 0

Re: [mbed-tls] Signing without explicit private key

by Gilles Peskine

Hi Stefano, The pk module has limited support for opaque RSA keys, by using the RSA_ALT functionality (https://tls.mbed.org/kb/cryptography/use-external-rsa-private-key <https://tls.mbed.org/kb/cryptography/use-external-rsa-private-key>). There's no support for opaque EC keys. For a TLS server, you can use the asynchronous callback feature to use an opaque key. See https://tls.mbed.org/kb/how-to/ssl_async <https://tls.mbed.org/kb/how-to/ssl_async> The PSA crypto API supports opaque keys. On the application side, you need to use functions like psa_asymmetric_sign instead of mbedtls_pk_sign. On the hardware side, you need to implement a secure element driver for your crypto chip. Driver support is work in progress, and documentation and tooling are still sparse. The driver specifications are in https://github.com/ARMmbed/mbedtls/tree/development/docs/proposed <https://github.com/ARMmbed/mbedtls/tree/development/docs/proposed> . To add driver support, you currently need to edit library/psa_crypto_driver_wrappers.c and replace calls to the test driver by calls to your real driver. Best regards, -- Gilles Peskine Mbed TLS developer and PSA Crypto architect On 03/06/2021 17:20, stefano664 via mbed-tls wrote: > Hi all, > I'm using mbedTLS libraries with an OPTIGA cryptochip. At the > moment, when I call the sign function: > > err = mbedtls_pk_sign(&priv_key, MBEDTLS_MD_SHA384, hash, 0, sign, > &olen, mbedtls_ctr_drbg_random, &ctr_drbg); > > I need to pass it a valid private key else if it isn't used, because > alternative sign routine use the one into cryptochip. > > It is possible to avoid passing this key? > > Best regards, > Stefano Mologni >

3 years, 3 months

1
0
0 0

Re: [mbed-tls] Request for Support [Issue : Webserver handshake failing with self-signed certificate]

by Gilles Peskine

Hi Selin, Another thing to check is that the stack is large enough. Stack overflows can sometimes cause weird behavior. Other than that, I'm afraid I can't think of a reason why there would be an infinite loop involving mbedtls_mpi_cmp_mpi. To go further, I think you need to trace the program in a debugger, figure out what arguments are being passed to the functions, and where the infinite loop is. Best regards, -- Gilles Peskine Mbed TLS developer On 26/05/2021 10:24, Selin Chris via mbed-tls wrote: > Hi Gilles, > > Thanks for the quick reply. > > I migrated to version 2.16, and I have seen the same issue is still > there. Moreover, we have reseeded the RNG, still issue is there. > > > > I created a client and it's working fine, it's able to handshake and > send data to the server. Only problem is server communication where > control is going in infinite loop while creating server key exchange. > As you asked for the call stack of the loop, I am attaching the call > stack with this mail. > > Please support us. > > > > Thank you. > > > Regards, > > Selin. > > > > On Fri, May 21, 2021 at 5:30 PM > <mbed-tls-request(a)lists.trustedfirmware.org > <mailto:mbed-tls-request@lists.trustedfirmware.org>> wrote: > > Send mbed-tls mailing list submissions to > mbed-tls(a)lists.trustedfirmware.org > <mailto:mbed-tls@lists.trustedfirmware.org> > > To subscribe or unsubscribe via the World Wide Web, visit > > https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls > <https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls> > or, via email, send a message with subject or body 'help' to > mbed-tls-request(a)lists.trustedfirmware.org > <mailto:mbed-tls-request@lists.trustedfirmware.org> > > You can reach the person managing the list at > mbed-tls-owner(a)lists.trustedfirmware.org > <mailto:mbed-tls-owner@lists.trustedfirmware.org> > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of mbed-tls digest..." > > > Today's Topics: > > 1. Re: Request for Support [Issue : Webserver handshake failing > with self-signed certificate] (Gilles Peskine) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 20 May 2021 15:13:54 +0200 > From: Gilles Peskine <gilles.peskine(a)arm.com > <mailto:gilles.peskine@arm.com>> > To: mbed-tls(a)lists.trustedfirmware.org > <mailto:mbed-tls@lists.trustedfirmware.org> > Subject: Re: [mbed-tls] Request for Support [Issue : Webserver > handshake failing with self-signed certificate] > Message-ID: <93c3cd71-bdc1-c3ec-4bbc-89ff995a8444(a)arm.com > <mailto:93c3cd71-bdc1-c3ec-4bbc-89ff995a8444@arm.com>> > Content-Type: text/plain; charset=utf-8 > > Hi Selin, > > A possible problem could be a misconfigured random generator. However > this is purely speculation. Can you get a stack trace? Finding the > root > cause requires finding where mbedtls_mpi_cmp_mpi is called. > > Please note that Mbed TLS 2.16.3 has known bugs and > vulnerabilities. You > should upgrade to the latest bug-fixing version of the 2.16 > branch, 2.16.10. > > -- > Gilles Peskine > Mbed TLS developer > > On 20/05/2021 13:06, Selin Chris via mbed-tls wrote: > > > > Hi, > > > > Thank you for adding me to the mbed-tls mailing list. > > > > We have created a self-signed certificate with ECC key of > > MBEDTLS_ECP_DP_SECP256R1 type, since it is a self-signed certificate > > after we send the certificate to chrome from our web server it shows > > not trusted and goes to the page where we need to manually proceed > > with the acceptance of the certificate to allow further > communication. > > After this we again have to perform handshake for which we need to > > prepare the server key exchange, while preparing the server key > > exchange we notice that it is infinitely calling the > > mbedtls_mpi_cmp_mpi() function in bignum.c and the execution is not > > able to proceed hereafter. Sometimes we also see that when executing > > ssl_prepare_server_key_exchange() function in ssl_srv.c we find > > ciphersuite_info pointer as null and the program goes into data > panic > > due to that. We have checked our stacks and not seen any sign of > > corruption. > > > > The mbedtls version that we are using is mbedtls-2.16.3. > > Please find the attached wireshark trace during this scenario. > The IP > > 192.168.2.67 corresponds to our webserver and 192.168.2.100 the pc > > with the browser. > > > > Please let us know the root-cause of the issue and the actions to be > > taken to fix this - can you please expedite as this is a blocking > > issue in our project. > > > > Thanks for the support. > > > > Regards, > > Selin. > > > > > > > > > > ------------------------------ > > Subject: Digest Footer > > mbed-tls mailing list > mbed-tls(a)lists.trustedfirmware.org > <mailto:mbed-tls@lists.trustedfirmware.org> > https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls > <https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls> > > > ------------------------------ > > End of mbed-tls Digest, Vol 15, Issue 8 > *************************************** > >

3 years, 3 months

1
0
0 0

How to map PSA method to openssl method

by Jun Nie

Hi, I want to sign a data on PC with openssl, and verifiy it with PSA-RoT on board. Does anybody know how to map PSA method to openssl method? Such as: psa_sign_hash(key_handle, PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_SHA_256), hash, hash_len, sig, sizeof(sig), sig_len); Regards, Jun

3 years, 3 months

1
0
0 0

Re: [mbed-tls] NV_SEED read working and write not working

by Janos Follath

Hi Gopi, FN_NV_SEED_WR supposed to be called the first time the entropy context is used to retrieve some entropy. This is tracked by the `initial_entropy_run` member in the `mbedtls_entropy_context` structure (on the initial run it is zero, non-zero otherwise). FN_NV_SEED_WR not being called might mean that your “Entropy” variable hasn’t been properly initialised or that it has been used before the callbacks are set. Please note that Mbed TLS 2.16.2 has known bugs and vulnerabilities. You should upgrade to the latest bug-fixing version of the 2.16 branch, 2.16.10. Best regards, Janos (Mbed TLS developer) From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> on behalf of Subramanian Gopi Krishnan via mbed-tls <mbed-tls(a)lists.trustedfirmware.org> Date: Friday, 4 June 2021 at 05:50 To: mbed-tls(a)lists.trustedfirmware.org <mbed-tls(a)lists.trustedfirmware.org> Cc: T V LIJIN (EXT) <lijin.tv(a)kone.com> Subject: Re: [mbed-tls] NV_SEED read working and write not working Hi, I am working on a embedded platform, that does not has any entropy source except system ticks. To improve the randomness, I am trying to utilize NV_SEED operations. The version of mbedtls version 2.16.2 is being used. Configuration file I have enabled: #define MBEDTLS_ENTROPY_NV_SEED #define MBEDTLS_PLATFORM_NV_SEED_ALT After initializing and before seeding random number generator, I assign functions of nv seed read and write to platform seeding function as below. if( r = mbedtls_platform_set_nv_seed(FN_NV_SEED_RD, FN_NV_SEED_WR) ) { return( r ); } if( r = mbedtls_ctr_drbg_seed( &CtrDrbg, mbedtls_entropy_func, &Entropy, (const unsigned char *) u8SeedingString, (size_t)Length ) ) { return ( r ); } Later functions to generate random and free context. While running, I could see only the FN_NV_SEED_RD function is getting called. And, FN_NV_SEED_WR function is not getting called. I tried to add some print statements in mbedtls library function, mbedtls_entropy_update_nv_seed(). But it looks like, this function was never called by the library. 1. Anything else to be done? 2. someone could help me ensure NV_SEED is properly incorporated 3. How to trace the issue. Thanks, Gopi Krishnan

3 years, 3 months

2
1
0 0

NV_SEED read working and write not working

by Subramanian Gopi Krishnan

Hi, I am working on a embedded platform, that does not has any entropy source except system ticks. To improve the randomness, I am trying to utilize NV_SEED operations. Configuration file I have enabled: #define MBEDTLS_ENTROPY_NV_SEED #define MBEDTLS_PLATFORM_NV_SEED_ALT After initializing and before seeding random number generator, I assign functions of nv seed read and write to platform seeding function as below. if( r = mbedtls_platform_set_nv_seed(FN_NV_SEED_RD, FN_NV_SEED_WR) ) { return( r ); } if( r = mbedtls_ctr_drbg_seed( &CtrDrbg, mbedtls_entropy_func, &Entropy, (const unsigned char *) u8SeedingString, (size_t)Length ) ) { return ( r ); } Later functions to generate random and free context. While running, I could see only the FN_NV_SEED_RD function is getting called. And, FN_NV_SEED_WR function is not getting called. Could anyone suggest how to trace the issue. I do not have debugger on for my platform. I could debug only with print statements. Thanks, Gopi Krishnan

3 years, 3 months

1
1
0 0

Signing without explicit private key

by stefano664

Hi all, I'm using mbedTLS libraries with an OPTIGA cryptochip. At the moment, when I call the sign function: err = mbedtls_pk_sign(&priv_key, MBEDTLS_MD_SHA384, hash, 0, sign, &olen, mbedtls_ctr_drbg_random, &ctr_drbg); I need to pass it a valid private key else if it isn't used, because alternative sign routine use the one into cryptochip. It is possible to avoid passing this key? Best regards, Stefano Mologni

3 years, 3 months

1
0
0 0

2024

2023

2022

2021

2020

mbed-tls