• Registered: 2019-04-02
  • Posts: 2

Topic: MQX RTCS secure HTTP Server fails in VerifyServerSuite

Hi,
I'm working with MQX OS and trying to setup a secure HTTP Server with TLSv1.2 (HTTP Server is working fine).
I enabled the SSL definition and added the ssl_params with path to server-cert and and server-key.
I opened the FREESCALE_MQX and WOLFSSL_USER_SETTINGS definition in wolfssl\wolfcrypt\settings.h.
In user_settings.h :
#undef NO_RSA
#undef  NO_INLINE
#define NO_WRITEV
#define NO_MAIN_DRIVER
#define NO_OLD_TLS

also added "config-Crypt.h" from wolfssl\IDE\MDK5-ARM\Conf and enabled almost all algorithms.

I have two problems:
1. in InitSuites these are the only suites enabled for tls1_2:

BUILD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
BUILD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
BUILD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
BUILD_TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256

How can I get more Cipher suites?

2. After getting Client Hello I got fail in VerifyServerSuite
this is the reason:

if (ssl->options.haveNTRU)
            haveRSA = 0;

How can I overcome the haveRSA issue?

I will appreciate any help.
Thanks in advance.

Share

  • From: Mobile, AL
  • Registered: 2013-12-11
  • Posts: 352

Re: MQX RTCS secure HTTP Server fails in VerifyServerSuite

Hello @Benon

Thank you for contacting wolfSSL support. Could you post the actual settings header file you are using?

Thanks,
Eric
wolfSSL Support

embhorn's Website

Share

  • Registered: 2019-04-02
  • Posts: 2

Re: MQX RTCS secure HTTP Server fails in VerifyServerSuite

Hi Eric,

I fixed it ,
In settings.h under #ifdef FREESCALE_COMMON I had a #undef HAVE_ECC, and a comment on #define HAVE_ECC (probably something I did and forgot while testing)
Also I created new Self Signed cert and key, and HTTPS works.

Regarding my second question about NTRU, is it a must for RSA Suites?

Thanks a lot,
Ben

Share

  • From: Mobile, AL
  • Registered: 2013-12-11
  • Posts: 352

Re: MQX RTCS secure HTTP Server fails in VerifyServerSuite

Hi Ben,

That's great news on the config settings!

The cipher suites we support are static NTRU ones. So what we currently support is an option of RSA or NTRU, but not both. The use of both at the same time can only be done currently with QSH, which is an extension to add some random data to the pms using NTRU.

More about QSH:
https://www.wolfssl.com/quantum-safe-wolfssl-2/

Kind regards,
Eric
wolfSSL Support

embhorn's Website

Share