• Registered: 2015-05-13
  • Posts: 2

Topic: WolfSSL for ARM Cortex M0+

Hi, I have a simple bare-metal application running webserver + smtp client. My device has 256KB Flash and 32KB SRAM. I am using UIP TCP/IP stack and have no hardware ecryption. In order to send emails I need, to my best understanding, TLS handshake. With this regard I wonder if incorporating WolSSL in my application is feasable:

1.Can anyone help me with estimating the minimum size of the TLS library I will have to use? SRAM is probably my most limited resource.


2. From reading online, I understand 16Kbyte(!) TLS buffer size must be used unless "both sides support the max_fragment_length SSL extension". I tried to figure out if this is absolutely required for secure smtp email via gmail/yahoo but didnt find any useful data. does anyone have any info regarding to this issue?


3.Is there any documented use of Wolf/cyaSSL with UIP stack?


4.If not, Is there any guide which can help me figuring out what are the required steps to get my device to perform TLS handshake with smtp server, using only the required parts of wolSSL, such that the memory footprint is minimal? Performance tradeoff is not an issue.


Any help will be welcome!!
cheers
-Matan

Share

  • From: Bozeman, MT
  • Registered: 2010-10-20
  • Posts: 650

Re: WolfSSL for ARM Cortex M0+

Hi Matan,

1.Can anyone help me with estimating the minimum size of the TLS library I will have to use? SRAM is probably my most limited resource.

The typical footprint size of wolfSSL with an embedded optimized compiler is around 60kB of Flash.  The smallest embedded SSL build we have done to date is our "LeanPSK" build which came in at around 21kB of Flash.  This was a very stripped down version of the library - supporting only TLS 1.2, pre-shared keys, and SHA256.

RAM usage is between 1-36kB per SSL/TLS session, as outlined in the attached Resource Use document.

2. From reading online, I understand 16Kbyte(!) TLS buffer size must be used unless "both sides support the max_fragment_length SSL extension". I tried to figure out if this is absolutely required for secure smtp email via gmail/yahoo but didnt find any useful data. does anyone have any info regarding to this issue?

Your understanding of the TLS Max Fragment Length extension is correct - the client can request that a smaller TLS maximum fragment length be used, but if the server doesn't support that extension, it is ignored.

The SSL/TLS spec defines the maximum possible record size to be 16kB, which makes reducing it challenging unless you have the ability to use the above extension.

3.Is there any documented use of Wolf/cyaSSL with UIP stack?

We have had people use us with the uIP stack, but haven't used it in house before to my knowledge.  We have a I/O abstraction layer that allows you to write your own Input and Output callbacks.  This would allow you to run wolfSSL over any transport medium you choose.

4.If not, Is there any guide which can help me figuring out what are the required steps to get my device to perform TLS handshake with smtp server, using only the required parts of wolSSL, such that the memory footprint is minimal? Performance tradeoff is not an issue.

The Resource Use document should be helpful, as well as taking a look into our LeanPSK build.  Do you know if there are certain cipher suites and protocols you need to use?

Best Regards,
Chris

Post's attachments

wolfssl_resource_use.pdf 220.04 kb, 8 downloads since 2015-05-14 

You don't have the permssions to download the attachments of this post.
https://www.wolfssl.com

chrisc's Website

Share

  • Registered: 2015-05-13
  • Posts: 2

Re: WolfSSL for ARM Cortex M0+

Hi chris,
Thank you for your very detailed reply..!

All I want to do is be able to send email from my application. I understand that SMTP is the way to go. Since SMTP without authentication is no longer an option (port 25 frequently blocked etc) I need to do TLS handshake. Specifically, I am aiming to send emails from gmail accounts to gmail accounts (easiest for me for now) by connecting to SMTP server on port 587. Since I am a complete beginner in this field, I am not even shure what I need for that..

If I get it correctly, email providers do not support cipher suit negotiation, but I have no experoence so if you know something else please do tell.

I do not know if email providers support smaller TLS fragment length. Tried to find online but didn't yet.

Anyway - I think I can handle either 60KB or 21KB on flash.
I can also handle one 16KB TLS buffer. Im am worried wether or not I must have 16KB X2 buffers (one for Tx, one for Rx) allocated for racords. If so, isn't 32KB RAM prohibitively small?

Thanks for the link!
-Matan

Share

  • From: Bozeman, MT
  • Registered: 2010-10-20
  • Posts: 650

Re: WolfSSL for ARM Cortex M0+

Hi Matan,

By default, wolfSSL has an Input and Output buffer that are 5 bytes.  These grow and shrink using dynamic memory as SSL/TLS records are received or sent - growing up to a maximum of 16kB each.

If your application is only going to be doing one simultaneous read or write over SSL, you will only be using a maximum of 16kB.  If you will have two threads, both doing SSL/TLS, and may be doing a read and write at the same time, you could potentially get up to 32kB at a time.

Unfortunately, I don't have much experience with SMTP.  A while back, we did have a open source user integrate CyaSSL (now wolfSSL) into ssmtp.  His code can be found here:

https://github.com/tony2001/ssmtp

Best Regards,
Chris

https://www.wolfssl.com

chrisc's Website

Share