Hello razvi.david

Welcome to the wolfSSL Forums.

Could you tell us a bit about your project using wolfSSL?

Is the server restarted in between sessions?

You can observe a successful session ticket reuse using the examples.
<wolfssl>
./configure --enable-session-ticket && make

<server>
./examples/server/server -i

SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSL curve name is SECP256R1
Client message: hello wolfssl!
SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSL curve name is SECP256R1
Client message: hello wolfssl!
SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSL reused session
Client message: resuming wolfssl!

<client connects twice>
./examples/client/client -r

Session Ticket CB: ticketSz = 142, ctx = initial session
SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSL curve name is SECP256R1
I hear you fa shizzle!
Session Ticket CB: ticketSz = 142, ctx = resumed session
SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSL reused session
reused session id
 resumeI hear you fa shizzle!

Additionally, here is a TLS resume example:
https://github.com/wolfSSL/wolfssl-exam … s-resume.c

As for allowing the connection with a session ticket that is unrecognized, I believe that is supported. The server should just send a new session ticket. That would be the same if a session ticket expired.

Thanks,

Hi astc

Welcome to the wolfSSL forums.

Are you able to run the wolfCrypt tests on your platform? It's a good idea to verify the core cryptography first to be sure there is not some underlying problem.
https://github.com/wolfSSL/wolfssl/tree … crypt/test

Thanks,
Eric - wolfSSL Support

Hi Nikos,

Thanks for contacting wolfSSL Forums.

We are reviewing this and will post an update.

Thanks,
Eric @ wolfSSL Support

Hi kj3141

Please send an email to our support team so that this issue is properly tracked

support@wolfssl.com

Thanks,
Eric - wolfSSL Support

Great, increasing the stack got you past the first issue. Now the broker is sending an alert after the TLS client hello is sent:

wolfSSL (1): received record layer msg
wolfSSL (1): got ALERT!
wolfSSL (1): Alert type: handshake_failure
wolfSSL (0): wolfSSL error occurred, error = 40
wolfSSL (0): wolfSSL error occurred, error = -313

This could be because the broker expects some extension that the client is not sending, or there was not a mutually agreeable cipher suite or protocol version.

It might be easier to try connecting to a local broker (maybe mosquitto?) that you could more easily monitor the handshake using Wireshark.

Hi Keterna,

Welcome to the wolfSSL Forums! Yes, you are on the right track. You'll need to define HAVE_SECRET_CALLBACK to access the wolfSSL_set_tls13_secret_cb API.

Here is a client example that writes the shared secret to a log file, which can then be used to decrypt the packets in wrieshark:
https://github.com/wolfSSL/wolfssl-exam … nt-tls13.c

Here is the analogous server example:
https://github.com/wolfSSL/wolfssl-exam … er-tls13.c

Could you tell us a bit more about your project? Feel free to email support@wolfssl.com if you'd prefer a less public discussion.

Thanks,
Eric - wolfSSL Support

Come see us at Black Hat in Las Vegas August 9th & 10th, booth #2617!
https://www.blackhat.com/us-23/

Hi sricor,

I have responded to your ticket in our Zendesk portal. Thanks for sending that in.

Hello hakahane

Welcome to the wolfSSL forums. Thanks for bringing this to our attention! I've fixed it in
https://github.com/wolfSSL/wolfssl/pull/6532

Please give it a test and let us know if you find other issues.

Kind regards,
Eric - wolfSSL Support

Hi Alex,

The key parameter is not constant for the async state machine and in order to utilize the key's heap memory. So long as one hash verify operation completes before reusing the key, it can be reused.

Thanks,
Eric - wolfSSL Support

Hi wangzihao,

The --enable-fpecc option enables Fixed Point cache ECC. It is not required to use ecc_mul2add.

You do need to make the function public by adding -DWOLFSSL_PUBLIC_ECC_ADD_DBL to CFLAGS

Please keep these questions coming! We are happy to help others learn!

Thanks,
Eric

Hi avlec,

I recommend sending an email to our support team. It will be easier for us to make suggestions if we first gather your version and config information.

support@wolfssl.com

Thanks,
Eric

Hello cvinothkumar,

Thanks for joining the wolfSSL Forums. You'll want to use wc_PKCS12_parse to get the DER cert out of the bundle.
https://github.com/wolfSSL/wolfssl-exam … -example.c

Then you can retrieve the public key from the DER cert
https://github.com/wolfSSL/wolfssl-exam … m-certfile

Could you tell us a bit about your project?

Thanks,
Eric - wolfSSL Support