- mbed-tls - lists.trustedfirmware.org

by Gilles Peskine

Hi Nick, A TLS stack in 6kB of RAM sounds impressive, congratulations! We'd certainly be interested in all the improvements you can contribute. The process is documented in CONTRIBUTING.md (https://github.com/ARMmbed/mbedtls/blob/development/CONTRIBUTING.md). I just need to warn you that the limiting factor is reviewers' time. For a significant contribution, it may take a while before the Mbed TLS team can look at it in detail. Small patches are usually easier than large ones: if something only takes half an hour to review, someone will probably do it when they're stuck on some other task. If a review takes several days, it needs to be scheduled. It would probably be better to discuss the general nature of the changes on this mailing list first. Is a new compilation option needed? Is an API change needed? What is the risk that the change might break existing code? How is the new code tested? etc. Which version of Mbed TLS have you been using? We've made a few changes that are of interest to low-memory platforms recently, such as the option MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH to resize SSL buffers after the handshake (new in 2.22). I don't know what the issue with the incoming SSL packet header length could be. If you could give precise steps to reproduce the issue, this would be very helpful. Eventually we'd want to construct a test in tests/ssl-opt.sh for this. -- Gilles Peskine Mbed TLS developer On 17/07/2020 21:00, Nick Setzer via mbed-tls wrote: > > Hi, I have been working with Mbed TLS for the last 6 months in an > extremely low memory use case. This library has been an absolute joy > to work with because of how flexible it is. I have an interesting use > case with how little RAM I have to work with (around 6kb on one > microprocessor) and I have made some changes that I thought would be > of interest. I'm not sure if I should submit them as a single > changeset or a set of changes. I'll describe the changes and if there > is interest I can clean them up for submission. > > The first change that I made was for a scenario with two > microprocessors communicating over a UART. I was already using TLS > offloading so that the private key was on one processor (with only 6kb > of RAM free) and the SSL context stored on the other. I required > generating a CSR and thus made some changes to the CSR code to be able > to generate the CSR using a similar private key offloading strategy. > > I found an issue with downloading firmware for OTA from openssl web > servers. This is a little tricky to describe. The server was not > responsive to requests for reducing the max fragment length, which > forced me to use MBEDTLS_SSL_MAX_CONTENT_LEN set to 16384. But I > needed to have multiple ssl sessions open for other activities and did > not have enough RAM to hold multiple large buffers. I have made a set > of changes to allow setting the content length when the ssl context is > initialized, as well as setting different IN and OUT content lengths > to save memory. This change allowed me to set up one session with 16kb > for the IN content length, and then 4kb for OUT content length, while > a second session could use 2kb for a total of 24kb instead of 64kb. > > Related to the openssl issue, I found that the incoming ssl packet > header length can sometimes be 8 or 16 bytes larger than expected > depending on which AES method is selected. I'm not actually sure what > the best way to solve this is. One way may be to change > MBEDTLS_SSL_HEADER_LEN from 13 to 29 bytes. However I ended up solving > it by adding 16 to both MBEDTLS_SSL_IN_BUFFER_LEN and > MBEDTLS_SSL_OUT_BUFFER_LEN. This way I could handle the larger ssl > header as well as receive the content body. > > If these three changes sound interesting I can start work on cleaning > up the code to be less specific to my company and then submit the > changes. Also I would like to know if there is any process I should be > following when submitting these changes. > > Thanks, > > Nick Setzer > SimpliSafe, Inc. > 294 Washington Street, 9th Floor > Boston, MA 02108 >

6 years, 3 months

1
0
0 0

Re: [mbed-tls] SSH client sample

by Gilles Peskine

Hi Christie, Libssh2 (https://github.com/libssh2/libssh2) supports Mbed TLS. I've never used it or investigated it, so I can't vouch for it, I just know that it's there. -- Gilles Peskine Mbed TLS developer On 21/07/2020 18:40, Christie Su via mbed-tls wrote: > > Hi, > > ï¿½ > > I am using FRDM-K64F with LWIP+mbedTLS for our control system. Now, I > want to develop the SSH client(or telnet 22) to access my SSH server. > > ï¿½ > > Could you give me some indications how to do it? Or do you have any > sample project? > > ï¿½ > > Thanks, > > ï¿½ > > Christie > >

6 years, 3 months

1
0
0 0

Problem with decrypt aes 128 in ecb mode. HELP ME!

by dany_banik2000＠yahoo.com

I developed a server application that obtains the data from a dht11 sensor, I encrypt it with aes 128 and publish it on the server. The client application makes a request to the server, and I would like to decrypt the answer. When I want to display decrypted message, it shows garbage The message retrieved from the server is in hex. I think that must to convert hex in binary, but i don’t know how can do it…

6 years, 3 months

1
0
0 0

SSH client sample

by Christie Su

Hi, I am using FRDM-K64F with LWIP+mbedTLS for our control system. Now, I want to develop the SSH client(or telnet 22) to access my SSH server. Could you give me some indications how to do it? Or do you have any sample project? Thanks, Christie

6 years, 3 months

1
0
0 0

patches for low memory

by Nick Setzer

Hi, I have been working with Mbed TLS for the last 6 months in an extremely low memory use case. This library has been an absolute joy to work with because of how flexible it is. I have an interesting use case with how little RAM I have to work with (around 6kb on one microprocessor) and I have made some changes that I thought would be of interest. I'm not sure if I should submit them as a single changeset or a set of changes. I'll describe the changes and if there is interest I can clean them up for submission. The first change that I made was for a scenario with two microprocessors communicating over a UART. I was already using TLS offloading so that the private key was on one processor (with only 6kb of RAM free) and the SSL context stored on the other. I required generating a CSR and thus made some changes to the CSR code to be able to generate the CSR using a similar private key offloading strategy. I found an issue with downloading firmware for OTA from openssl web servers. This is a little tricky to describe. The server was not responsive to requests for reducing the max fragment length, which forced me to use MBEDTLS_SSL_MAX_CONTENT_LEN set to 16384. But I needed to have multiple ssl sessions open for other activities and did not have enough RAM to hold multiple large buffers. I have made a set of changes to allow setting the content length when the ssl context is initialized, as well as setting different IN and OUT content lengths to save memory. This change allowed me to set up one session with 16kb for the IN content length, and then 4kb for OUT content length, while a second session could use 2kb for a total of 24kb instead of 64kb. Related to the openssl issue, I found that the incoming ssl packet header length can sometimes be 8 or 16 bytes larger than expected depending on which AES method is selected. I'm not actually sure what the best way to solve this is. One way may be to change MBEDTLS_SSL_HEADER_LEN from 13 to 29 bytes. However I ended up solving it by adding 16 to both MBEDTLS_SSL_IN_BUFFER_LEN and MBEDTLS_SSL_OUT_BUFFER_LEN. This way I could handle the larger ssl header as well as receive the content body. If these three changes sound interesting I can start work on cleaning up the code to be less specific to my company and then submit the changes. Also I would like to know if there is any process I should be following when submitting these changes. Thanks, Nick Setzer SimpliSafe, Inc. 294 Washington Street, 9th Floor Boston, MA 02108

6 years, 3 months

1
0
0 0

Re: [mbed-tls] [Mbed-tls-announce] Force push on the master branch

by Scott Branden

Although this particular change doesn't affect me - rewriting history is a bad idea. Why not simply commit a revert back to a cleaner point on "master" branch and then commit the new changes you want from there? Then history is not lost on master branch. Or, with the BLM movement some repos are stopping use of master branch. github seems to be encourage it going forware: https://www.zdnet.com/article/github-to-replace-master-with-alternative-ter… So another option: stop using "master" branch. You could even create a tag/rename and then delete the branch name to avoid any confusions. History won't be rewritten then, just a little "hidden". And start using a new "main" branch. You can push you entire commit series there without revering anything on master branch. Regards, Scott -----Original Message----- From: Mbed-tls-announce [mailto:mbed-tls-announce-bounces@lists.trustedfirmware.org] On Behalf Of Janos Follath via Mbed-tls-announce Sent: Thursday, July 16, 2020 4:09 AM To: mbed-tls-announce(a)lists.trustedfirmware.org Cc: nd <nd(a)arm.com> Subject: [Mbed-tls-announce] Force push on the master branch Hi All, The master branch used to track the latest development release. This changed in early 2019 after the 2.16 LTS branch was released. Around this time the cryptography library of Mbed TLS was moved to a separate repository and since then it was used as a submodule. This was one of the main reasons behind the decision to keep master pointing to the 2.16 LTS releases. Recently we have merged the cryptography library back into Mbed TLS. We don't have any reasons any more to keep master tracking the 2.16 LTS release. Therefore we intend to update master to the latest development release. This will happen on 3rd August. The update will involve a force push, which can be disruptive to those users who take Mbed TLS from master. We would like to give such users enough time to adapt to this change. If you are relying on the master branch in a way that this force push affects you, please let us know on the developer mailing list<https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls> and we will do our best to accommodate your needs. Thanks and regards, Janos (on behalf of the Mbed TLS maintainer team) -- Mbed-tls-announce mailing list Mbed-tls-announce(a)lists.trustedfirmware.org https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls-announce

6 years, 3 months

1
0
0 0

[Mbed-tls-announce] Force push on the master branch

by Janos Follath via Mbed-tls-announce

Hi All, The master branch used to track the latest development release. This changed in early 2019 after the 2.16 LTS branch was released. Around this time the cryptography library of Mbed TLS was moved to a separate repository and since then it was used as a submodule. This was one of the main reasons behind the decision to keep master pointing to the 2.16 LTS releases. Recently we have merged the cryptography library back into Mbed TLS. We don't have any reasons any more to keep master tracking the 2.16 LTS release. Therefore we intend to update master to the latest development release. This will happen on 3rd August. The update will involve a force push, which can be disruptive to those users who take Mbed TLS from master. We would like to give such users enough time to adapt to this change. If you are relying on the master branch in a way that this force push affects you, please let us know on the developer mailing list<https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls> and we will do our best to accommodate your needs. Thanks and regards, Janos (on behalf of the Mbed TLS maintainer team) -- Mbed-tls-announce mailing list Mbed-tls-announce(a)lists.trustedfirmware.org https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls-announce

6 years, 3 months

1
0
0 0

Re: [mbed-tls] Upgrading from 2.13.1.to ??.??.??

by Manuel Pegourie-Gonnard

Hi Jeff, > Given the age of the version of mbedTLS I’m using, which is 2.13.1, plus the recent security alert, I think I need to upgrade the version of mbedTLS we have. The question is, which version to use? Indeed upgrading to a maintained branch is very recommended! There are currently two actively maintained branches you could use: * 2.16.x, which is our latest LTS branch, currently at 2.16.7. As an LTS branch, it only receives bug fixes and security updates, so it's pretty stable. In particular, since it doesn't receive any new feature, its footprint (code size) should remain mostly stable as well. * 2.x.y, released from the development branch, currently at 2.23.0. This is the branch where new features land. Both of these have full API compatibility with 2.13.1. We take great care not to break API compatibility between major releases - we haven't broken it since Mbed TLS 2.0.0 (release 2015-07-13), and the next release to break API compatibility with be 3.0.0 (now planned for early 2021). Until then, upgrading should be a simple matter of replacing the mbedtls directory in your source tree with the version of your choice, then rebuilding your project. (Moreover in the LTS branches we actually try maintain ABI compatibility as far as possible - that is, unless there's a security issue that can only be fixed by changing the ABI.) Mbed TLS is designed bo be quite modular an integrate with the OS and networking stack via user-provided hooks and compile-time configuration (`include/mbedtls/config.h`). I'm not sure how the integration with LwIP and FreeRTOS was done by your MCU vendor, but I suggest you check: * is the mbedtls directory in your source tree identical to our upstream release? If yes, you should be able to just replace it with the release of your choice and things should work. * otherwise, what's the nature of the differences: are filed shuffled to a different directory structure? is the build system different? has the `mbedtls/config.h` file been modified? have other files been modified (which ideally really shouldn't be necessary)? In that case, you'll probably need to apply the same changes to the upgraded version of Mbed TLS. Hopefully the differences if any will be small, and otherwise perhaps you MCU vendor can provide documentation about it. So I can't really say for this specific integration, but in principle upgrading Mbed TLS should be really painless - precisely so that people can upgrade easily in case of security fixes. Hope this helps, and let us know how it went! Regards, Manuel. ________________________________ From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> on behalf of Thompson, Jeff via mbed-tls <mbed-tls(a)lists.trustedfirmware.org> Sent: 14 July 2020 22:11 To: mbed-tls(a)lists.trustedfirmware.org <mbed-tls(a)lists.trustedfirmware.org> Subject: [mbed-tls] Upgrading from 2.13.1.to ??.??.?? Given the age of the version of mbedTLS I’m using, which is 2.13.1, plus the recent security alert, I think I need to upgrade the version of mbedTLS we have. The question is, which version to use? Because we got mbedTLS as example code from the MCU vendor, it was already integrated with lwIP and FreeRTOS. I’m sure this will not be a trivial effort, but I do need to present my management with some idea of the time it could take. Does anyone have a rough estimate of what to expect? I’m thinking on the order of 2 to 4 weeks for someone who is an experienced C programmer, but unfamiliar with either mbedTLS or lwIP. Or is that a pipe dream, with the actual time being closer to 3 or 4 months? Jeff Thompson | Senior Electrical Engineer-Firmware +1 704 752 6513 x1394 www.invue.com [cid:image001.gif@01D659E2.BE6C0700]

6 years, 3 months

1
0
0 0

Upgrading from 2.13.1.to ??.??.??

by Thompson, Jeff

Given the age of the version of mbedTLS I'm using, which is 2.13.1, plus the recent security alert, I think I need to upgrade the version of mbedTLS we have. The question is, which version to use? Because we got mbedTLS as example code from the MCU vendor, it was already integrated with lwIP and FreeRTOS. I'm sure this will not be a trivial effort, but I do need to present my management with some idea of the time it could take. Does anyone have a rough estimate of what to expect? I'm thinking on the order of 2 to 4 weeks for someone who is an experienced C programmer, but unfamiliar with either mbedTLS or lwIP. Or is that a pipe dream, with the actual time being closer to 3 or 4 months? Jeff Thompson | Senior Electrical Engineer-Firmware +1 704 752 6513 x1394 www.invue.com [cid:image001.gif@01D659E2.BE6C0700]

6 years, 3 months

1
0
0 0

Re: [mbed-tls] mbed-tls canonical repository (trustedfirmware.org git empty)

by Shebu Varghese Kuriakose

Hi Matt. You are right - https://git.trustedfirmware.org/tls/mbed-tls.git seem to be empty. As part of Mbed TLS transitioning to trustedfirmware.org community project in March’20, a mirror of https://github.com/ARMmbed/mbedtls.git was created in the above trustedfirmware.org git. Yes, all the development is still carrying on in https://github.com/ARMmbed/mbedtls.git and the plan is to move the development of MbedTLS to trustedfirmware.org repository itself a bit later on. The trustedfirmware.org Mbed TLS mirror repository seem to have moved to https://git.trustedfirmware.org/mirror/mbed-tls.git/. Regards, Shebu From: mbed-tls <mbed-tls-bounces(a)lists.trustedfirmware.org> On Behalf Of Matt Walker via mbed-tls Sent: Wednesday, July 8, 2020 8:34 PM To: mbed-tls(a)lists.trustedfirmware.org Subject: [mbed-tls] mbed-tls canonical repository (trustedfirmware.org git empty) Hi; For a while I've had a couple of projects pulling in mbed-tls from the trustedfirmware.org<http://trustedfirmware.org> git repository at https://git.trustedfirmware.org/tls/mbed-tls.git However, I just attempted to clone from that repository again only to discover it's now empty! I've searched around and I can't find any messaging on why this would be the case, so it's either an accident or my search foo is failing me. It looks like the majority of development for mbed-tls is still happening on github at https://github.com/ARMmbed/mbedtls.git but I'd rather point my upstream to the canonical location. Is this a temporary outage, or should github be considered the origin of all things mbed-tls? Thanks, Matt Walker

6 years, 3 months

2
1
0 0

2026

2025

2024

2023

2022

2021

2020

mbed-tls