Hello,
I am just trying to use the MQTT client provided by TI.
My code looks like this:
#define CLIENT_NUM_SECURE_FILES 4
char *Mqtt_Client_secure_files[CLIENT_NUM_SECURE_FILES] = {"key.pem","cert.pem","cacert.crt", NULL};
MQTTClient_ConnParams Mqtt_ClientCtx =
{
MQTTCLIENT_NETCONN_URL | MQTTCLIENT_NETCONN_SEC,
SERVER_ADDRESS, //SERVER_ADDRESS,
SECURED_PORT_NUMBER, // PORT_NUMBER
SLNETSOCK_SEC_METHOD_TLSV1_2,
SLNETSOCK_SEC_CIPHER_FULL_LIST,
CLIENT_NUM_SECURE_FILES,
Mqtt_Client_secure_files
};
When I try to call MQTTClient_connect(), I am getting error -751, which corresponds to a SL_ERROR_BSD_ESEC_ECC_CURVE_ERROR (-751L) /* Bad ECC Curve */
My certificate is generated with secp256r1, which I would like to use. Below, there is a communication between the device and mqtt broker.
Client Hello
Transport Layer Security
TLSv1.2 Record Layer: Handshake Protocol: Client Hello
Content Type: Handshake (22)
Version: TLS 1.2 (0x0303)
Length: 113
Handshake Protocol: Client Hello
Handshake Type: Client Hello (1)
Length: 109
Version: TLS 1.2 (0x0303)
Random: 4f7ad9fde5ac9a81c601ea9f9cdd2d16b753d9c78e2d8964…
Session ID Length: 0
Cipher Suites Length: 46
Cipher Suites (23 suites)
Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005)
Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004)
Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
Cipher Suite: TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xc011)
Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c)
Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
Cipher Suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x009e)
Cipher Suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x009f)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc14)
Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc13)
Cipher Suite: TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc15)
Compression Methods Length: 1
Compression Methods (1 method)
Extensions Length: 22
Extension: signature_algorithms (len=18)
Server hello
Transport Layer Security
TLSv1.2 Record Layer: Handshake Protocol: Multiple Handshake Messages
Content Type: Handshake (22)
Version: TLS 1.2 (0x0303)
Length: 3945
Handshake Protocol: Server Hello
Handshake Type: Server Hello (2)
Length: 70
Version: TLS 1.2 (0x0303)
Random: 5d5149adb65aebc8ba4141a9107d24f77351ef3c2ea1f2dc…
Session ID Length: 32
Session ID: b01600006a33c59c0a4b7c632ffa0fa8a8b6bce19872828b…
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
Compression Method: null (0)
Handshake Protocol: Certificate
Handshake Type: Certificate (11)
Length: 3535
Certificates Length: 3532
Certificates (3532 bytes)
Handshake Protocol: Server Key Exchange
Handshake Type: Server Key Exchange (12)
Length: 296
EC Diffie-Hellman Server Params
Curve Type: named_curve (0x03)
Named Curve: x25519 (0x001d)
Pubkey Length: 32
Pubkey: 4c653138ad3b343d4891d4035085527875972b609b0c4462…
Signature Algorithm: rsa_pkcs1_sha1 (0x0201)
Signature Length: 256
Signature: 6634fe74ecfa7ab26196a5782ae30eba374ba5dc95d3e884…
Handshake Protocol: Certificate Request
Handshake Protocol: Server Hello Done
Then the CC3220 calls (FIN, ACK) and returns the error. I believe, the main issue is Named Curve: x25519 from the Server Hello. I tried a different client on different platform, but using same certificates and I can see, that different platform is having in the Client Hello some sort of supported curves.
Extension: supported_groups (len=18)
Type: supported_groups (10)
Length: 18
Supported Groups List Length: 16
Supported Groups (8 groups)
Supported Group: secp256r1 (0x0017)
.....
Is it possible to set something similar on CC3220? Or do you think there is another issue in that?
Thanks for the ideas!