Welcome to the wolfSSL Forums!

2014-06-03 05:24:29

i use method wolfTLSv1_2_client_method , when handshake finished ,it returned "decrypt_error",who know why?

2014-05-26 03:10:09

i tested the client example project ,when i change the method to method = wolfSSLv3_client_method(), wolfSSL_connect return fail ,when i change it to method = wolfTLSv1_2_client_method(); it works ! so ,who know why?

2014-05-26 01:24:45

here is source code ,who know why?

wolfSSL_Init();
client->data.ctx = SSL_CTX_new(wolfSSLv3_client_method());

if (wolfSSL_CTX_set_cipher_list(client->data.ctx, cipherList) != SSL_SUCCESS)
{
uart_printf( "set cipher error" );
}

base64decode( host_root_ca_buffer , &lengh , lock_rev_buffer);
ret = wolfSSL_CTX_use_certificate_buffer(client->data.ctx,lock_rev_buffer, lengh, SSL_FILETYPE_PEM);

base64decode( host_root_key_buffer , &lengh , lock_rev_buffer);
ret = wolfSSL_CTX_use_PrivateKey_buffer(client->data.ctx,lock_rev_buffer, lengh , SSL_FILETYPE_PEM );

client->data.ssl = SSL_new(client->data.ctx);

client->data.bio = wolfSSL_BIO_new_socket((int)client->connection,0);

wolfSSL_set_bio(client->data.ssl, client->data.bio, client->data.bio);
wolfSSL_CTX_set_verify(client->data.ctx, SSL_VERIFY_NONE, 0);
SSL_set_connect_state(client->data.ssl);
///// wolfSSL_set_group_messages(client->data.ssl);

// client_ssl_handshake(client->data.ssl);

if (wolfSSL_negotiate(client->data.ssl) != SSL_SUCCESS)
{
BIO_free(client->data.bio);
SSL_CTX_free(client->data.ctx);
SSL_free(client->data.ssl);
return LOCKDOWN_STATUS_START_SESSION_FAILED;

}

2014-05-20 00:39:58

i want to change the openssl code to wolfssl embedded ssl,who can help me?

lockdownd_error_t lockdownd_gen_pair_cert_for_udid(const char *udid, key_data_t public_key, key_data_t *odevice_cert,
key_data_t * ohost_cert, key_data_t * oroot_cert)
{
if (!public_key.data || !odevice_cert || !ohost_cert || !oroot_cert)
return LOCKDOWN_E_INVALID_ARG;

lockdownd_error_t ret = LOCKDOWN_E_UNKNOWN_ERROR;
userpref_error_t uret = USERPREF_E_UNKNOWN_ERROR;

///个人理解下面这一段代码是将 public 方式转换成 rsa 方式
BIO *membio = BIO_new_mem_buf(public_key.data, public_key.size);
RSA *pubkey = NULL;
if (!PEM_read_bio_RSAPublicKey(membio, &pubkey, NULL, NULL)) {
debug_info("Could not read public key");
}
BIO_free(membio);

/* now generate certificates */
key_data_t root_privkey, host_privkey;
key_data_t root_cert, host_cert;
X509* dev_cert;

root_cert.data = NULL;
root_cert.size = 0;
host_cert.data = NULL;
host_cert.size = 0;

dev_cert = X509_new();

root_privkey.data = NULL;
root_privkey.size = 0;
host_privkey.data = NULL;
host_privkey.size = 0;

//// 下面这一部分是根据X509的方式添加信息
uret = userpref_device_record_get_keys_and_certs(udid, &root_privkey, &root_cert, &host_privkey, &host_cert);
if (USERPREF_E_SUCCESS == uret) {
/* generate device certificate */
//// 串号
ASN1_INTEGER* sn = ASN1_INTEGER_new();
ASN1_INTEGER_set(sn, 0);
X509_set_serialNumber( dev_cert , sn );
ASN1_INTEGER_free(sn);
/////版本号
X509_set_version(dev_cert, 2);
////x509V3 扩展信息
X509_EXTENSION* ext;
if (!(ext = X509V3_EXT_conf_nid(NULL, NULL, NID_basic_constraints, (char*)"critical,CA:FALSE"))) {
debug_info("ERROR: X509V3_EXT_conf_nid failed??for Basic Constraints");
}
X509_add_ext(dev_cert, ext, -1);
X509_EXTENSION_free(ext);

////当前时间往后10年时间
ASN1_TIME* asn1time = ASN1_TIME_new();
ASN1_TIME_set(asn1time, time(NULL));
X509_set_notBefore(dev_cert, asn1time);
ASN1_TIME_set(asn1time, time(NULL) + (60 * 60 * 24 * 365 * 10));
X509_set_notAfter(dev_cert, asn1time);
ASN1_TIME_free(asn1time);

BIO* membp;

X509* rootCert = NULL;
membp = BIO_new_mem_buf(root_cert.data, root_cert.size);
PEM_read_bio_X509(membp, &rootCert, NULL, NULL);
BIO_free(membp);
if (!rootCert) {
debug_info("Could not read RootCertificate");
} else {
debug_info("RootCertificate loaded");
EVP_PKEY* pkey = EVP_PKEY_new();
EVP_PKEY_assign_RSA(pkey, pubkey);
X509_set_pubkey(dev_cert, pkey);
EVP_PKEY_free(pkey);
X509_free(rootCert);
}

X509V3_CTX ctx;
X509V3_set_ctx_nodb(&ctx);
X509V3_set_ctx(&ctx, NULL, dev_cert, NULL, NULL, 0);

if (!(ext = X509V3_EXT_conf_nid(NULL, &ctx, NID_subject_key_identifier, (char*)"hash"))) {
debug_info("ERROR: X509V3_EXT_conf_nid failed for Subject Key identifier");
}
X509_add_ext(dev_cert, ext, -1);
X509_EXTENSION_free(ext);
if (!(ext = X509V3_EXT_conf_nid(NULL, NULL, NID_key_usage, (char*)"critical,digitalSignature,keyEncipherment"))) {
debug_info("ERROR: X509V3_EXT_conf_nid failed for Key Usage");
}
X509_add_ext(dev_cert, ext, -1);
X509_EXTENSION_free(ext);

EVP_PKEY* rootPriv = NULL;
membp = BIO_new_mem_buf(root_privkey.data, root_privkey.size);
PEM_read_bio_PrivateKey(membp, &rootPriv, NULL, NULL);
BIO_free(membp);
if (!rootPriv) {
debug_info("Could not read RootPrivateKey");
} else {
debug_info("RootPrivateKey loaded");
if (X509_sign(dev_cert, rootPriv, EVP_sha1())) {
ret = LOCKDOWN_E_SUCCESS;
} else {
debug_info("signing failed");
}
EVP_PKEY_free(rootPriv);
}

if (LOCKDOWN_E_SUCCESS == ret) {
/* if everything went well, export in PEM format */
key_data_t pem_root_cert = { NULL, 0 };
key_data_t pem_host_cert = { NULL, 0 };

uret = userpref_device_record_get_certs_as_pem(udid, &pem_root_cert, &pem_host_cert, NULL);
if (USERPREF_E_SUCCESS == uret) {
/* copy buffer for output */
membp = BIO_new(BIO_s_mem());
if (membp && PEM_write_bio_X509(membp, dev_cert) > 0) {
void *datap;
odevice_cert->size = BIO_get_mem_data(membp, &datap);
odevice_cert->data = malloc(odevice_cert->size);
memcpy(odevice_cert->data, datap, odevice_cert->size);
}
if (membp)
BIO_free(membp);

ohost_cert->data = malloc(pem_host_cert.size);
memcpy(ohost_cert->data, pem_host_cert.data, pem_host_cert.size);
ohost_cert->size = pem_host_cert.size;

oroot_cert->data = malloc(pem_root_cert.size);
memcpy(oroot_cert->data, pem_root_cert.data, pem_root_cert.size);
oroot_cert->size = pem_root_cert.size;

free(pem_root_cert.data);
free(pem_host_cert.data);
}
}
}
X509V3_EXT_cleanup();
X509_free(dev_cert);

switch(uret) {
case USERPREF_E_INVALID_ARG:
ret = LOCKDOWN_E_INVALID_ARG;
break;
case USERPREF_E_INVALID_CONF:
ret = LOCKDOWN_E_INVALID_CONF;
break;
case USERPREF_E_SSL_ERROR:
ret = LOCKDOWN_E_SSL_ERROR;
default:
break;
}

if (root_cert.data)
free(root_cert.data);
if (host_cert.data)
free(host_cert.data);
if (root_privkey.data)
free(root_privkey.data);
if (host_privkey.data)
free(host_privkey.data);

return ret;
}

2014-05-17 03:40:52

how i can decode a public key using function RsaPublicKeyDecode(const byte* input, word32* inOutIdx, RsaKey* key,word32 inSz) ?

2014-05-16 23:01:29

it works like this :
use this public key:

to create a CERTIFICATE like this :

and how i can use cyassl embedded SSL to do this ?

2014-05-16 22:56:11

i got the server's public key like this :
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBANA0SPVdEgBMCBo4WMeKl6lEM8swJsu+8Rq0usMkdcq8GxsD445x+EtF
+Dmalx6rSR5M7mNARLdsALd2pr3HVLuSSe4bCC26u1PBsOVeszhEzdr7NWiGy3bI
fW6ddTCt0VMC75PrsVmCB2oavp8GKI09Y0TsegxiM6MN6bj33eJtAgMBAAE=
-----END RSA PUBLIC KEY-----

and how to pair with the server?

2014-05-16 22:49:32

i have a public key like this:
-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBANA0SPVdEgBMCBo4WMeKl6lEM8swJsu+8Rq0usMkdcq8GxsD445x+EtF
+Dmalx6rSR5M7mNARLdsALd2pr3HVLuSSe4bCC26u1PBsOVeszhEzdr7NWiGy3bI
fW6ddTCt0VMC75PrsVmCB2oavp8GKI09Y0TsegxiM6MN6bj33eJtAgMBAAE=
-----END RSA PUBLIC KEY-----

how to creat a ca with this public key ?

Welcome to the wolfSSL Forums!

Search options

Posts found: 8

1 Topic by zhbn 2014-06-03 05:24:29

Topic: decrypt_error? (1 replies, posted in wolfSSL)

2 Reply by zhbn 2014-05-26 03:10:09

Re: SendClientKeyExchange fail (2 replies, posted in wolfSSL)

3 Topic by zhbn 2014-05-26 01:24:45

Topic: SendClientKeyExchange fail (2 replies, posted in wolfSSL)

4 Topic by zhbn 2014-05-20 00:39:58

Topic: my god,who can help me? (1 replies, posted in wolfSSL)

5 Topic by zhbn 2014-05-17 03:40:52

Topic: how to make decode the public key (1 replies, posted in wolfSSL)

6 Topic by zhbn 2014-05-16 23:01:29

Topic: i read a openssl code ? (1 replies, posted in wolfSSL)

7 Topic by zhbn 2014-05-16 22:56:11

Topic: i got the server's public key (1 replies, posted in wolfSSL)

8 Topic by zhbn 2014-05-16 22:49:32

Topic: how to make a ca with a public key (1 replies, posted in wolfSSL)

Posts found: 8