Hi Scoobi_FreeBSD,

If you define single threaded it just means you will not use the same WOLFSSL_CTX or WOLFSSL object from more than one thread at a time. You could have separate instances of those for multiple threads at the same time.

For the uITRON4 build issues I will have to defer to another engineer.

Thanks,
David Garske, wolfSSL

Hi srihari,

Looks like "rl_fs.h" is for the file system and is not part of wolfSSL.

If you do not have that support in your platform then define "NO_FILESYSTEM" to disable it.

Thanks,
David Garske, wolfSSL

Hi Scoobi_FreeBSD,

See our "More Downloads" page. https://www.wolfssl.com/download/downloadMoreForm.php
Microchip_ATECC_Demos.zip

You are correct that `WOLFSSL_ATMEL` is specific to the ASF and you are not required to set `WOLFSSL_ATMEL` to use the ATECC508A/608A code.

#if defined(WOLFSSL_ATMEL) || defined(WOLFSSL_ATECC508A) || \
    defined(WOLFSSL_ATECC608A) || defined(WOLFSSL_ATECC_PKCB)

Thanks,
David Garske, wolfSSL

Hi akhi_gangwar,

That sounds like a stack issue. The fast math option uses stack for the math variables. Setting the FP_MAX_BITS to 8192 is correct (double max key size). But you'll also need to make sure your task or linker script increases the allowed / reserved stack space. By disabling fast math it uses heap. The normal math is slower because of the extra malloc/free calls.

You might also try using our single precision small math option with these options:

#define WOLFSSL_SP
#define WOLFSSL_SP_SMALL      /* use smaller version of code */
#define WOLFSSL_HAVE_SP_RSA
#define WOLFSSL_HAVE_SP_DH
#define WOLFSSL_HAVE_SP_ECC
#define WOLFSSL_SP_4096       /* enable 4096-bit */
//#define WOLFSSL_SP_MATH     /* only SP math - eliminates integer/tfm math code, so only standard curves/key sizes are supported */
//#define WOLFSSL_SP_ASM      /* enable the assembly speedup */
//#define WOLFSSL_SP_ARM_CORTEX_M_ASM /* optional cortex-m speedups */

Thanks,
David Garske, wolfSSL

Hi rahila_shams,

The difference between DH and ECC is the asymmetric algorithm used for securely deriving a shared secret. If DH is disabled only ECDH(E) cipher suites are available.

For setting the build option I recommend using our user_settings.h and WOLFSSL_USER_SETTINGS to define NO_DH. See our first FAQ item here: https://www.wolfssl.com/docs/frequently … r_wolfSSL?

Thanks,
David Garske, wolfSSL

Hi sergiop,

Thanks for this report. I will setup a test case for this and validate. I would expect that sequence of openssl compatibility calls to work.

Also we have an example for setting up a TLS proxy with native wolfSSL API's. I'm emailing you that example.

Thanks,
David Garske, wolfSSL

Hi torntrousers,

Looks like your Arduino doesn't have "time.h" support.

You have a couple options:

1. Disable ASN time support using "NO_ASN_TIME"

2. Override the time support. See this example:
https://github.com/wolfSSL/wolfssl/blob … ngs.h#L452
https://github.com/wolfSSL/wolfssl/blob … main.c#L32

Thanks,
David Garske, wolfSSL

Hi he1n,

Yes. See `WOLFSSL_SSLKEYLOGFILE` define to output master secret used by Wireshark logging to file. Defaults to sslkeylog.log, but can be overridden using `WOLFSSL_SSLKEYLOGFILE_OUTPUT`.

1. Build wolfSSL using:
./configure CFLAGS="-DSHOW_SECRETS -DWOLFSSL_SSLKEYLOGFILE"

2. By default it outputs to a file named "sslkeylog.log" using this Wireshark Pre-Master-Secret Format:
CLIENT_RANDOM <clientrandom> <mastersecret>

3. You can tell Wireshark where to find the key file via Edit→Preferences→Protocols→SSL→(Pre)-Master-Secret log filename.

Key logging feature was added in PR 1873 (https://github.com/wolfSSL/wolfssl/pull/1873)
Commit: https://github.com/wolfSSL/wolfssl/pull … dd532b587b

You will get a compiler warning for this feature because it should never be used in production. Here is the PR with those details:
https://github.com/wolfSSL/wolfssl/pull/2053

The #warning can be ignored as error using ./configure CFLAGS="-W#warnings".

Thanks,
David Garske, wolfSSL

Hi weaver4,

You need to use the `--with-sysroot=` with your ./configure. Do some google searches for "undefined reference to `__fdelt_chk'" and you'll see some tips.

For example this cross-compile for a HiFive Unleashed board running Linux:

./configure --host=riscv64 \
    CC="/home/davidgarske/GitHub/freedom-u-sdk/work/buildroot_initramfs/host/bin/riscv64-sifive-linux-gnu-gcc" \
    --with-sysroot="/home/davidgarske/GitHub/freedom-u-sdk/work/buildroot_initramfs_sysroot/" \
    --disable-shared \
    --enable-sp \
    CFLAGS="-mabi=lp64d -march=rv64imafdc"
make

You can see the use of `--with-sysroot=`.

The sysroot is required because you are cross-compiling to an ARM system running Linux. If you want to cross-compile for bare-metal.

If you want to use a custom Makefile see example here:
https://github.com/wolfSSL/wolfssl/tree … DE/GCC-ARM

Or you can use CMake with an experimental PR here:
https://github.com/wolfSSL/wolfssl/pull/2746

Thanks,
David Garske, wolfSSL

Hi akhi_gangwar,

I see now that you are using the TI hardware acceleration in ti-aes.c. Have you tried running without the hardware acceleration? For that you'd just not define `WOLFSSL_TI_CRYPT`.

I will have another engineer who's worked on the TI parts review this report. It could be there is a new issue with tm4c129encpdt  and `AesAlign16`.

Also I cannot see where -1014 would be generated from the ecc_test, is it possible to share the stack information for the error or enable logging with DEBUG_WOLFSSL and wolfSSL_Debugging_ON()?

Thanks,
David Garske, wolfSSL

Hi akhi_gangwar,

The next operation is the "processing server hello done", which uses decryption. Have you run the wolfCrypt test yet to validate your platform's individual algorithms?

Here is an example for calling wolfcrypt/test/test.c:
https://github.com/wolfSSL/wolfssl/blob … est_main.c

Have you made sure your thread has enough stack space? Depending on the build options and cipher suite you may need up to 30KB in of stack space. You can reduce the stack requirement using build options like `WOLFSSL_SMALL_STACK` and `ALT_ECC_SIZE`. Here is a useful list I put together:
https://github.com/wolfSSL/wolfssl/tree … ng-options

Thanks,
David Garske, wolfSSL

Thanks,
David Garske, wolfSSL

Hi akhi_gangwar,

The error -188 means a certificate could not be validated to a trusted peer. The TLS Peer is sending 4 certificates and some of these are not validating. By default wolfSSL expects all provided certificates get validated. My guess is you are loading an intermediate CA and not the root CA. You can either load the correct root CA or you can add our `WOLFSSL_ALT_CERT_CHAINS` build option. This option only requires the peer's provided certificate matches to a loaded/trusted cert.

Also you can load PEM files directly using SSL_FILETYPE_PEM.

Thanks,
David Garske, wolfSSL