CC3220SF: Security Feature || Public and private Keys

Hi Sabeeh

From the document it seems like this public and private key pair is something that we flash. Is my understanding correct? And if this is true then all the device flashed with same image will have same public and private key pair, is that right?

Yes your understanding is correct. 

Do CC3220SF chip not have inbuilt private and public keys? What I mean to ask is, they do not have unique keys embedded in them at the time of factory production? and the only way to write keys is that we flash image using uniflash?

For general purpose cryptographic operations, you can create public-private keys on the device itself. See section 17.1 of the NWP guide for more information. 

For enterprise connections, they will have to be flashed in via uniflash. 

I have 1 more query here.

What happens if I flash my certificate, but afterwards do an OTA update of the package which does not contain that certificate? Will the certificate remain in the memory and accessible to us?

We were thinking of using "TLS/SSL client" certificate. But in our application we have multiple device. So if we flash individual certificate for each device then should the OTA update also contain same? Please suggest how we can manage that.

Hi,

If you do OTA update which will not contain updated certificate, then there will stay previous certificate (e.g. programmed during production). This is same for any other file inside sFlash filesystem.

Jan

Hi

We want to keep the certificates in the device for future use and not right now. We can still use http(unsecured protocol) right, that is along with certificates in the device?

Hi,

Yes, sure. This is your choice only.

Jan

Hi Jan,

Can we bypass server authentication and use only client authentication?

Hi,

I am not expert to OTA code, but please read swra510 at chapter 4.1.1.

Jan

I am not asking about OTA, but instead normal data exchange between server and device.

https://www.ti.com/lit/ug/swpu332a/swpu332a.pdf?ts=1643124591839&ref_url=https%253A%252F%252Fwww.ti.com%252Fproduct%252FCC3220S

Here you can see that first server authentication is there and then client authentication is done. Also client authentication is mentioned as optional.
Currently we are not using neither client nor server authentication. So I am wondering if I only want to use client authentication(while not using server authentication) can I do this?

Hi,

This depends on your server configuration whether want to authenticate client. You have public key (certificate) inside server and client CC3220 have own private key. Using public key can server determine if client have proper private key.

Jan

Hi Jan,

From your reply I think you didn't get my question yet.

Let me ask again. Can I use only client authentication without using server authentication? Please refer to below modified diagram.

Hi,

I think your question is not related to CC32xx devices but how TLS/SSL works. I am not expert at this regard. I think server certificate need to be send to client always. I think this is part of TLS specification. Then is up to client (at your case CC32xx) if want to validate this certificate. For example in case of CC32xx device, error code SL_ERROR_BSD_ESECSNOVERIFY will be returned if CC32xx is not able to validate server, from sl_Connect() API. Client authentication is up to your server.

Jan

Hi Jan,

I am using below sequence right now where it looks like we are not using server authentication while regular data get or post operation. Please consider the fact that we are having server certificate in file system already in this case.

HTTPClient_extSecParams httpClientSecParams;

httpClientSecParams.rootCa = NULL;//"ca.der";
httpClientSecParams.clientCert = NULL;
httpClientSecParams.privateKey = NULL;

ret = HTTPClient_connect(httpClientHandle,hostname,&httpClientSecParams,0);

I am just wondering what happens if we try to use client cert only. How will the SDK behave(will httpconnect work or not)? I cannot check at my end as I do not have client certificate right now or anytime soon, that's why I am asking for the behavior of SDK here.

Hi,

How do you expect that client authentication will work without private key? You need to have secret inside device to which can be authenticated. This is not about CC32xx device itself, but basic principles how asymmetric cryptography works.

What issue do you have with client certificate? Why you not use self-signed certificate for your testing?

Jan