Hi noahh0123,

Try setting the RNG for the RsaKey using:
int wc_RsaSetRNG(RsaKey* key, WC_RNG* rng)

See the following:
https://github.com/wolfSSL/wolfssl-exam … h-sign-rsa
https://www.wolfssl.com/forums/topic111 … -data.html

David Garske, wolfSSL

Hi burakkirazli,

Thanks for letting us know the fix was due to not having XREALLOC / realloc implemented correctly when using the normal math.

David Garske, wolfSSL

Hi bsda_dev,

I compared the generated wolfssl/options.h using ./configure and ./configure --enable-tls13 and the resulting build option differences are:

#define WOLFSSL_TLS13
#define HAVE_TLS_EXTENSIONS
#define HAVE_SUPPORTED_CURVES
#define WC_RSA_PSS
#define HAVE_HKDF

I am surprised that server method would work and allow TLSv1.2, since it should not allow downgrade unless you are using the wolfSSLv23_server_method. Please also share your Wireshark trace. If you want to submit directly to our support email support@wolfssl.com and reference this forum post.

Thanks,
David Garske, wolfSSL

Hi burakkirazli,

See "Date BEFORE check failed" message above. The -150 error (from wolfssl/wolfcrypt/error-crypt.h) "ASN_BEFORE_DATE_E  = -150,  /* ASN date error, current date before */".

Your RTC time is not setup properly, so the certificate date check is failing. Here are the possible solutions:

1. Setup your RTC correctly via the XTIME macros. Example here: https://github.com/wolfSSL/wolfssl/blob … ngs.h#L449

2. Override the date error in the verify callback (see this example: https://github.com/wolfSSL/wolfssl/blob … t.h#L1721)

3. Disable all certificate date checking by disabling NO_ASN_TIME. Do note that this will allow expired certificates to be used.

Thanks,
David Garske, wolfSSL

Hi burakkirazli,

Thanks for your report. I pushed a fix into PR 135 here (https://github.com/wolfSSL/wolfMQTT/pull/135). Please give it a try and let me know if this works.

Thanks,
David Garske, wolfSSL

Hi Cookie,

Have you seen our simple TLS examples in our wolfssl-examples repo?
https://github.com/wolfSSL/wolfssl-exam … master/tls

The -345 NO_PEER_CERT error indicates the peer did not present a certificate. See the wolfSSL_CTX_set_verify API for setting the verify options for the peer certificate.

Thanks,
David Garske, wolfSSL

Thanks,
David Garske, wolfSSL

Hi Kvkhekale,

Also make sure you have the arm-none-eabi-gcc-8.3.1/bin directory in your path.

Thanks,
David Garske, wolfSSL

Hi i.fedotov,

The PIC32MZ does not allow two hardware hashing operations to happen at the same time. We have two versions of the hardware crypto. Some of the TLS operations required overlapping update/final. Make sure you do not have WOLFSSL_PIC32MZ_LARGE_HASH defined.

1. Enabled with WOLFSSL_PIC32MZ_LARGE_HASH, which enables direct update/finish calls to hardware.

2. Caches updates and only uses hardware on final.

You can see this code in wolfcrypt/src/port/pic32/pic32mz-crypt.c. In Harmony sources its in HarmonyFramework/crypt/src.

Let me know if that makes a difference for you or not. If not please let me know the cipher suite and TLS version being used. If possible also enable debugging using DEBUG_WOLFSSL and calling wolfSSL_Debugging_ON();.

Thanks,
David Garske, wolfSSL

Hi naveen,

Our wolfSSL/wolfCrypt library does not have any references to "getcwd". Can you provide additional details as to where you are seeing that error? It sounds like a C stdlib issue with the ardupilot project and your compiler.

Thanks,
David Garske, wolfSSL

Hi EricDOS,

How are you measuring the code size? If you are just looking at the shared DLL size that has overhead for symbols, which aren't there in a static build. Also most of the size optimization occurs at link-time with the final application. Try using --disable-shared and use the static library with your application.

Can you tell us more about the target and application? We have many options for tuning, but it helps to know the CPU and RTOS.

The fast math library should be about the same size, but it uses stack for math variables instead of heap. The fast math library also support assembly optimizations.

You might also check our --enable-leantls option in ./configure.ac, which has many additional options for reducing code size. See https://github.com/wolfSSL/wolfssl/blob … re.ac#L637

You can find a good reference document here:
https://github.com/wolfSSL/wolfssl/tree … ng-options

If you are looking to boost performance you can try our `--enable-sp=small` option, which provides optimized code for specific keys and curve. This will not reduce code size.

Thanks,
David Garske, wolfSSL

Hi harish.reddy,

There is not enough data there to determine that information. Typically the AES GCM IV is 12 bytes. Typically the AES GCM Auth Tag is 16 bytes. Typically the AES GCM Encrypted data is a multiple of block size (16 bytes).

https://github.com/wolfSSL/wolfssl/blob … aes.h#L110

Thanks,
David Garske, wolfSSL