CC3100: Slow tls connection establishment

Hi Aleks,

Do you have uploaded latest ServicePack inside CC3100 device? Be aware TLS/SSL connection establishing time depends on opposite side as well. You should use Wireshark or other network sniffer do determine if culprit is a CC100 device.

Jan

Hi Jan,

I am attaching wireshark part for the https with google - appx 1.3 seconds taken for entire handshake. What is interesting is 1 sec taken for 18th packet. Do you see something from the wireshark that can be help me with connection time reduction?

As for SP I am having the version 1.3.0.

Regards,

Aleks 

Hi Aleks,

You should check at server responses what cipher suite was was negotiated. Cumulative response time from sever side is around 180ms, from this reason  you cannot expect lower connection time. I think your issue is due to negotiated cipher suite or missing ServicePack inside device.

It looks that you complete forgotten that you need to upload ServicePack into device. ServicePack for CC3100 devices is separate from SDK and need to be uploaded into serial flash using Uniflash software or host API for filesystem. Latest ServicePack (1.0.1.14-2.12.2.8) can be downloaded from CC3100 SDK webpage. You can use latest ServicePack (1.0.1.15-2.13.0.2) for CC3200 which can be downloaded from CC3200 SDK webpage. ServiecPack for CC3200 is compatible with CC3100 device.

Jan

Hi Jan,

As per your suggestion, I have downloaded newest version of SP, used host API and burnt it. Here is the output:

This is a CC3100R device
NWP 2.10.0.0
MAC 31.1.5.0.2
PHY 1.0.3.37

Openning ServicePack file
Programming ServicePack file

Closing ServicePack file
ServicePack successfuly programmed

Restarting CC3100... simplelink stop
shutdown commands
simplelink start

This is a CC3100R device
NWP 2.12.2.8
MAC 31.1.5.0.10
PHY 1.0.3.37

Unfortunately, this didn't solve my problem (still similar results). 

As for your suggestion about cipher suit - how can use information about used cipher suit on the CC3100?

I mean, for some private https servers, I can "negotiate" with admins to use proper cipher suit, but what about publicly available servers?

Regards,

Aleks   

Hi Aleks,

Both sides needs to negotiate cipher suite and selected cipher suite you can see at "Server Hello" packet. At secured socket settings (socket options) you can mask particular cipher suites. But public server are not under your control and with masked cipher suites you will not be able connect likely. If public server requires ECDHE cipher suites you have not much options. You can try to determine what are supported cipher suites and set lowest cipher suite at CC3100. But if something change at server side at the future, you have a problem...

Jan

Hi Jan,

Certainly, negotiation is what will happen, I tried with methods and masks from the very first beginning. When I asked for cipher suits usage, I thought on some fine tuning. So, with methods and masks everything is the same, even worse if I try to connect to the servers that use sha256ECDSA as a signature algorithm. In this case it takes appx 4 seconds to connect to it. Are there any results, that you can share with me, about average tls connection establishment time for different signature algorithms? 

Regards,

Aleks

Hi Aleks,

I am not aware about any document than you stated above.

I don't see much opportunity to some "fine tuning" of cipher suites because this depends on opposite side which is not under your control. You have options "slow establishing of connection" or "no connection". Not much to choice here... In case of server is under your full control, it make sense play with cipher suites settings at CC3100 side.

Jan