• State TI Thinks Resolved
  • Locked Locked
  • Replies 3 replies
  • Answers 2 answers
  • Subscribers 40 subscribers
  • Views 591 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

LAUNCHCC3220MODASF: TLS extension and properties

Roman Jordan
Expert 2091 points

Part Number: LAUNCHCC3220MODASF

Hello,

my module acts as an HTML server and uses a self-signed certificate and the corresponding key.

To check the TLS exntesions of the connection I used the following command:

$ openssl s_client -connect 10.123.45.1:8443 -tls1_2 -tlsextdebug

CONNECTED(00000004)
Can't use SSL_get_servername
  ...

---
No client certificate CA names sent
---
SSL handshake has read 1037 bytes and written 536 bytes
Verification error: unable to verify the first certificate
---
New, SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : AES256-SHA

  ...

The output from openssl shows that no TLS extensions such as the following are active:

* TLS server extension "renegotiation info"
* TLS server extension "EC point formats"
* TLS server extension "session ticket"
* TLS server extension "extended master secret"

1. The TI documentation contains information on how to restrict the cipher suites used and the TLS version used.
But where can I find information about the TLS extensions used?

2. Is it possible to enable TLS extensions, e.g. the TLS server extension "extended master secret"?

3. Are there any changes regarding the TLS extensions in the different versions of the NWP firmware file/service packs?

4. The output also states Secure Renegotiation is NOT supported.
Does this mean that insecure renegotiation is supported?
When I check it with R in openssl, the CC3220 module closes the connection.
So I assume that no kind of TLS renegotiation is not supported.
Am I right?


Many thanks and best regards,
Roman

  • 0
    TI__Guru 63006 points

    the only configurations supported can be found in "netapp.h" (for sl_NetAppSet):

        - For SL_NETAPP_HTTP_SERVER_ID
        - SL_NETAPP_HTTP_PRIMARY_PORT_NUMBER
        - SL_NETAPP_HTTP_AUTH_CHECK
        - SL_NETAPP_HTTP_AUTH_NAME
        - SL_NETAPP_HTTP_AUTH_PASSWORD
        - SL_NETAPP_HTTP_AUTH_REALM
        - SL_NETAPP_HTTP_ROM_PAGES_ACCESS
        - SL_NETAPP_HTTP_SECONDARY_PORT_NUMBER
        - SL_NETAPP_HTTP_SECONDARY_PORT_ENABLE
        - SL_NETAPP_HTTP_PRIMARY_PORT_SECURITY_MODE
        - SL_NETAPP_HTTP_PRIVATE_KEY_FILENAME
        - SL_NETAPP_HTTP_DEVICE_CERTIFICATE_FILENAME
        - SL_NETAPP_HTTP_CA_CERTIFICATE_FILE_NAME
        - SL_NETAPP_HTTP_TEMP_REGISTER_MDNS_SERVICE_NAME
        - SL_NETAPP_HTTP_TEMP_UNREGISTER_MDNS_SERVICE_NAME
        - SL_NETAPP_HTTP_TIMEOUT

    The extensions cannot be updated.

    You can always use the HTTP server from the SDK (i.e. server implemented on the host on top of the sl_socket) which can provide more flexibility.

    Other HTTP server implementations over sl_socket are also possible.

  • 0 in reply to Kobi Leibovitch
    Expert 2091 points

    Hello Kobi,

    many thanks for your answer.

    I have also found the HTTP configuration settings. Most of it are taken account after the connection is already established.

    What I am looking for are the properties of the TLS connection, things like the negotiating the TLS version use, the cipher suites and the poss

    Can you please answer the other questions too? I am a newbie in that basic network protocols and have to evaluate it.

    1. The TI documentation contains information on how to restrict the cipher suites used and the TLS version used.
    But where can I find information about the TLS extensions used?
    Are there any TLS extenstions enabled by default?

    2. Is it possible to enable TLS extensions, e.g. the TLS server extension "extended master secret"?

    Kobi Leibovitch said:
    The extensions cannot be updated.

    3. Are there any changes regarding the TLS extensions in the different versions of the NWP firmware file/service packs?
    I couldn't find detailed NWP firmware release notes and also no information about possible changes.

    4. The openssl output shown above also states Secure Renegotiation is NOT supported.
    Does this mean that insecure renegotiation is supported?
    When I check it with R in openssl, the CC3220 module closes the connection.
    So I assume that no kind of TLS renegotiation is not supported.
    Am I right?

    Best wishes and many thanks in advance,
    Roman

  • 0 in reply to Roman Jordan
    TI__Guru 63006 points

    The answer for all the questions is that it is not supported with the internal TLS (or HTTPS) stack implemented in the NWP (ROM) firmware.

    You can always use an external (i.e. on the host) TLS stack over the SimpleLink TCP sockets (e.g. SDK7.10 provides an MQTT Client example that works on top of mbedTLS to demonstrate the use of TLS1.3, since the internal stack supports up to TLS1.2).