Topic: Optimal wolfSSL configuration for DTLS 1.3 on STM32U575 MCU

Reposted from STM32 forum: https://community.st.com/t5/stm32-mcus- … rue#M60536

Hello,

I am using STM32U575CGU6 MCU and want to use wolfSSL library with minimal flash consumption. My application intends to used DTLS 1.3 and no TLS use case is foreseen.



Note: The wolfSSL library version used is 5.7.6.



Kindly support me with following issues,

1. How can I correctly configure DTLS 1.3. It seems that the DTLS1.3 implementation is not available and the library configured over the tool just supports DTLS 1.2.

2. While using DTLS, I have to also necessarily configure TLS 1.3 and TLS 1.2 to compile the code. This increases the overall code memory. Can this be avoided? Am I missing some configuration step here.

3. (Answered) The video- " https://www.youtube.com/watch?v=pUd2HEfBp3w " explains "How to use wolfSSL software expansion for STM32Cube". However, the downloaded pack does not provide any ,ready to use ,.ioc sample file for wolfSSL tests (for NUCLEO-U575ZI-Q board).  Where can I find this?

4. The " https://github.com/wolfSSL/wolfssl/blob … t_conf.ftl " and the generated "\wolfSSL\wolfSSL.I-CUBE-wolfSSL_conf.h" file have some discrepancies. For example, there is an additional "WOLF_CONF_TLS12" in the generated header file. Why do I see this difference, when using the same version?


Thanks.

Share

Re: Optimal wolfSSL configuration for DTLS 1.3 on STM32U575 MCU

Hi Chinmay,

Thanks for your interest in our DTLS v1.3 support.

1) You are correct, the build configuration options and template for the ST Cube Pack do not yet have DTLS v1.3.
The configuration template comes from: https://github.com/wolfSSL/wolfssl/blob … t_conf.ftl

For now you can manually add:

#define WOLFSSL_DTLS
#define WOLFSSL_DTLS13

We will work on adding DTLS v1.3 to the template.

2) The DTLS v1.3 code requires DTLS and TLS v1.3 code (for now). Are you seeing an issue with code size? I have logged this as a feature request.

4) The option WOLF_CONF_TLS12 comes from the pack "STM32CubeMX/wolfSSL.I-CUBE-wolfSSL.5.7.6_Configs.xml" file. The GUI generates an option for this: `<Argument AddressOf="false" Comment="WOLF_CONF_TLS12" GenericType="simple" Name="WOLF_CONF_TLS12" OptimizationCondition="equal"/>`.

Thanks,
David Garske, wolfSSL

Share

Re: Optimal wolfSSL configuration for DTLS 1.3 on STM32U575 MCU

Hello David,

1. Along with WOLFSSL_DTLS13, I also added defined WOLFSSL_SEND_HRR_COOKIE . In this manner I was able to disable WOLF_CONF_TLS12 from the configuration.

2. Yes. In the debug mode the library consumes approximately 285KB and 171KB in release mode. Could this be optimized ? Please find the configuration that I am using below,

/* Includes ------------------------------------------------------------------*/

/**
    MiddleWare name : wolfSSL.I-CUBE-wolfSSL.5.7.6
    MiddleWare fileName : wolfSSL.I-CUBE-wolfSSL_conf.h
    MiddleWare version :
*/
/*---------- WOLF_CONF_DEBUG -----------*/
#define WOLF_CONF_DEBUG      0

/*---------- WOLF_CONF_WOLFCRYPT_ONLY -----------*/
#define WOLF_CONF_WOLFCRYPT_ONLY      0

/*---------- WOLF_CONF_TLS13 -----------*/
#define WOLF_CONF_TLS13      1

/*---------- WOLF_CONF_TLS12 -----------*/
#define WOLF_CONF_TLS12      0

/*---------- WOLF_CONF_DTLS -----------*/
#define WOLF_CONF_DTLS      1

/*---------- WOLF_CONF_MATH -----------*/
#define WOLF_CONF_MATH      3

/*---------- WOLF_CONF_RTOS -----------*/
#define WOLF_CONF_RTOS      1

/*---------- WOLF_CONF_RNG -----------*/
#define WOLF_CONF_RNG      1

/*---------- WOLF_CONF_RSA -----------*/
#define WOLF_CONF_RSA      1

/*---------- WOLF_CONF_ECC -----------*/
#define WOLF_CONF_ECC      0

/*---------- WOLF_CONF_DH -----------*/
#define WOLF_CONF_DH      1

/*---------- WOLF_CONF_AESGCM -----------*/
#define WOLF_CONF_AESGCM      1

/*---------- WOLF_CONF_AESCBC -----------*/
#define WOLF_CONF_AESCBC      0

/*---------- WOLF_CONF_CHAPOLY -----------*/
#define WOLF_CONF_CHAPOLY      1

/*---------- WOLF_CONF_EDCURVE25519 -----------*/
#define WOLF_CONF_EDCURVE25519      0

/*---------- WOLF_CONF_MD5 -----------*/
#define WOLF_CONF_MD5      0

/*---------- WOLF_CONF_SHA1 -----------*/
#define WOLF_CONF_SHA1      0

/*---------- WOLF_CONF_SHA2_224 -----------*/
#define WOLF_CONF_SHA2_224      0

/*---------- WOLF_CONF_SHA2_256 -----------*/
#define WOLF_CONF_SHA2_256      1

/*---------- WOLF_CONF_SHA2_384 -----------*/
#define WOLF_CONF_SHA2_384      0

/*---------- WOLF_CONF_SHA2_512 -----------*/
#define WOLF_CONF_SHA2_512      0

/*---------- WOLF_CONF_SHA3 -----------*/
#define WOLF_CONF_SHA3      0

/*---------- WOLF_CONF_PSK -----------*/
#define WOLF_CONF_PSK      1

/*---------- WOLF_CONF_PWDBASED -----------*/
#define WOLF_CONF_PWDBASED      0

/*---------- WOLF_CONF_KEEP_PEER_CERT -----------*/
#define WOLF_CONF_KEEP_PEER_CERT      0

/*---------- WOLF_CONF_BASE64_ENCODE -----------*/
#define WOLF_CONF_BASE64_ENCODE      0

/*---------- WOLF_CONF_OPENSSL_EXTRA -----------*/
#define WOLF_CONF_OPENSSL_EXTRA      0

/*---------- WOLF_CONF_TEST -----------*/
#define WOLF_CONF_TEST      0

/*---------- WOLF_CONF_KYBER -----------*/
#define WOLF_CONF_KYBER      0

/*---------- WOLF_CONF_ARMASM -----------*/
#define WOLF_CONF_ARMASM      0

/*---------- WOLF_CONF_IO -----------*/
#define WOLF_CONF_IO      1

/*---------- WOLF_CONF_RESUMPTION -----------*/
#define WOLF_CONF_RESUMPTION      0

/*---------- WOLF_CONF_TPM -----------*/
#define WOLF_CONF_TPM      0

/*---------- WOLF_CONF_PK -----------*/
#define WOLF_CONF_PK      0

/* ------------------------------------------------------------------------- */

Note: WOLFSSL_DTLS13 and WOLFSSL_SEND_HRR_COOKIE are defined.

3. Thanks for the clarification.

Best regards,
Chinmay

Share

Re: Optimal wolfSSL configuration for DTLS 1.3 on STM32U575 MCU

Hi Chinmay,

I implemented some of your feedback in this PR: https://github.com/wolfSSL/wolfssl/pull/8488

In the background we will look at ways to reduce the code size for DTLS v1.3 only.

If you are only a server or client you can use the NO_WOLFSSL_SERVER and NO_WOLFSSL_CLIENT options to reduce code size.

Thanks,
David Garske, wolfSSL

Share