• State
  • Locked Locked
  • Replies 4 replies
  • Subscribers 35 subscribers
  • Views 1339 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

How do I specify a cipher list for TLS1.2 connections using TI-RTOS and wolfSSL on TM4C129?

Tom Kuestersteffen38
Prodigy 40 points

Other Parts Discussed in Thread: EK-TM4C129EXL

I am using a TI EK-TM4C129EXL eval board to test communication with our cloud server application.  I’ve been trying to port the default application that came with it (called secure_iot) to hit against our cloud hosted endpoints to no avail.

 

I’ve captured the network traffic using wireshark and see that the “Client Hello” packet from the eval board lists 4 ciphers.  Our cloud server doesn’t allow any of these 4 ciphers so it closes the socket on receipt of the client hello.

 

I’ve tried using the wolfSSL_CTX_set_cipher_list() command at various places prior calling ServerConnect() but it always sends the same 4 ciphers.  It appears as if maybe somewhere in the TI-RTOS/wolfSSL integration that it overrides whatever I do.

 

What is the recommended way to specify a cipher list using wolfSSL and TI-RTOS (and it’s HTTP Client APIs)?

 

Is there a way to change the default cipher list for wolfSSL?

  • 0
    TI__Guru**** 244510 points
    Hello Tom

    I have notified my colleague who is the SME on crypto.

    Regards
    Amit
  • 0 in reply to Amit Ashara
    TI__Mastermind 22640 points

    Hello Tom,

    As you are seeing the issue during SSL handshake, I want to confirm if you generated a new certificate.h file that contains the relevant public to communicate with the server. This might not be the issue but will be required later anyhow, to successfully complete the handshake.

    If communicating with a server other than Exosite, a new "certificate.h" file has to be generated and placed in the same path as "cloud_task.c". The steps needed to generate a "certificate.h" file to communicate with Exosite server are documented in the Readme.txt file under section "Certificate generation".

    The steps to generate a "certificate.h" file for a different server are very similar, but listing them here.

    1. Download the certificate from the Certificate Authority website, used by the cloud server, in .pem format.

    2. Rename this downloaded file to "ca_cert.pem".

    3. Generate the "certificate.h", from the downloaded certificate, using the following command:

     <xdctools_dir>/xs --xdcpath=<tirtos_dir>/packages ti.net.tools.gencertbuf --certs "ca_cert.pem"

        where,

             <xdctools_dir> is XDC tools installation directory path. By default it is located in c:/ti/

             <tirtos_dir> is TI-RTOS installation directory path.

    Sai

  • 0 in reply to Sai Reddy
    Prodigy 40 points

    I'm not getting to the certificate validation stage yet - but I do understand that I will need to use a different certificate file.

    My cloud server doesn't accept any of the 4 cipher suites presented in the "Client Hello" so it closes the socket as soon as it is received.  The secure_iot project (and/or my build of WolfSSL per the instructions on the TI website) defaults to advertising the following ciphers on the Client Hello: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA.

    I've tried calling wolfSSL_CTX_set_cipher_list(ctx, "ECDHE-RSA-AES256-GCM-SHA384") after the call to wolfSSL_CTX_new(wolfTLSv1_2_client_method()) and it returns 0 (no error) but it still advertises the same 4 cipher suites.  I've also tried calling it other places before the ServerConnect() call with no luck.

    How does a wolfSSL context (ctx) get tied to a HTTP client handle (cli)?

    How can I make the Client Hello advertise other cipher suites so I can try and find one that is accepted by our cloud server?

  • 0 in reply to Tom Kuestersteffen38
    TI__Genius 10825 points

    Tom,

    As noted in the Building wolfSSL libraries section, only a subset of cipher suites are enabled by default in the WolfSSL libraries. To enable the other ciphers that are required for your applications, update the settings in <wolfssl_dir>/wolfssl/wolfcrypt/settings.h under WOLFSSL_TIRTOS define. You can find the various build defines in this manual.


    For "ECDHE-RSA-AES256-GCM-SHA384", define the following macros in settings.h and rebuild the wolfSSL library.

    #define HAVE_AESGCM

    #define HAVE_ECC

    #define WOLFSSL_SHA384

    Hope this helps.

    Vikram