Hi Nevilshute,

It sounds like you were able to resolve it by enabling the Hash security peripheral in the Cube MX tool? Let me know if you have any other issues or questions.

Thanks,
David Garske, wolfSSL

Hi Vitus,

The last argument to `wc_EccPublicKeyToDer` is "with_AlgCurve" is a flag for when to include a header that has the Algorithm and Curve information". You should have it set to 1. Also you are not checking the return code from wc_EccPublicKeyDecode in the "verify" function.

You might find the wolfcrypt/test/test.c examples for `crypto_ecc_verify` and `crypto_ecc_sign` helpful. Those are around line 21646.

Thanks,
David Garske, wolfSSL

Hi buoy,

I am not aware of any Microblaze cross compile efforts.

Try something like this:

./configure --host=aarch64 CC=mb-g++ --disable-filesystem --disable-shared --disable-examples --disable-crypttests --prefix=[installdir]
make
make install

We have a few Xilinx examples located here:
https://github.com/wolfSSL/wolfssl-examples/pull/155
https://github.com/wolfSSL/wolfssl/tree … /XilinxSDK

Thanks,
David Garske, wolfSSL

Hi Petr,

Thanks for the report and I suspect you are correct about this issue. I will investigate and provide some feedback shortly.

Thanks,
David Garske, wolfSSL

Hi vysocan76,

You might try adding `STM32_HAL_V2` to see if that will help.

Also you might try adding SP ECC support (WOLFSSL_HAVE_SP_ECC). If you are using ECDHE it will improve handshake time.

Can you tell me what cipher suite TLS is using?

If you are using USE_FAST_MATH with TFM_ARM that will be faster than normal math. And the SP WOLFSSL_SP_ARM_CORTEX_M_ASM is several times faster than that.

There is a good article https://www.wolfssl.com/user-generated- … wlib-nano/ that might help.

Thanks,
David Garske, wolfSSL

Hi ykuz,

It would help if you could point me to or share your code with me.

Make sure your header includes "#include <wolfssl/wolfcrypt/types.h>" which includes visibility.h. Take a look at wolfssl/wolfcrypt/visilbility.h and make sure you define BUILDING_WOLFSSL and HAVE_VISIBILITY.

Thanks,
David Garske, wolfSSL

Hi wnqu,

Please make sure you include <wolfssl/options.h> prior to any other wolfSSL headers in your application. I am guessing that will resolve this. If not make sure you change the link to "-lwolfssl".

Thanks,
David Garske, wolfSSL

Hi AnMu5962,

Try adding "--disable-filesystem" to disable support for the file system. Cross compiling for a ARM armv7e with arm-none-eabi does not include STDIO file system support.

Thanks,
David Garske, wolfSSL

Hi Octopus01,

We have some good TLS examples here:
https://github.com/wolfSSL/wolfssl-exam … master/tls

The certificate is missing all the subject information (like common name). I suspect this certificate does not meet the requirements for TLS mutual auth. How did you generate this certificate?

Thanks,
David Garske, wolfSSL

Hi RyVel,

My first guess is a FIPS boundary check hash issue. If HAVE_FIPS (--enable-fips=v2) is set you must update the fips boundary hash in fips_test.c. See https://www.wolfssl.com/docs/fips-ready-user-guide/

Using a test seed won't cause this error, however a failure with the DRBG such as SHA256 returning FIPS_NOT_ALLOWED_E would.

Please review the FIPS ready user guide and let us know if that doesn't resolve it.

Thanks,
David Garske, wolfSSL

Hi Scott,

We have several CSR generation and signing examples here:
https://github.com/wolfSSL/wolfssl-exam … er/certgen

The device would have a copy of the CA certificate (public info) to define as "trusted" to validate the peer.

A device would either have a key provisioned at factory or generate one and then generate a CSR for signing by a CA. A certificate is based on a key either RSA or ECC typically. During a TLS connection the certificate is presented and the key associated with it signs data to validate they own the key.

On the CA signing side we have some good scripts here:
https://github.com/wolfSSL/wolfTPM/blob … certreq.sh

Let me know if you have any issues or questions.

Thanks,
David Garske, wolfSSL

Hi j3ll3,

I found a couple things.

1. The wolfSSL example server will not load the "-A v2g_root.cert.pem" if "-d" is provided. Without the CA loaded it will not be able to setup an OCSP certificate request.

2. Looks like you will need to load the -A as a chain for now. Two PEM's combined with Int CA -> Root CA. I put up a fix for this issue here:
https://github.com/wolfSSL/wolfssl/pull/3299

3. The example/server/server loads internal OCSP certificates for testing that may throw off your test. Feel free to comment out that section for testing. https://github.com/wolfSSL/wolfssl/blob … er.c#L2065

Here is the tests I ran that worked:

openssl ocsp -index index.txt -port 8080 -rsigner ocsp_root.cert.pem -rkey ocsp_root.key.pem -CA v2g_root.cert.pem -text -ndays 7

./examples/server/server -c cpo_sub_1.cert.pem -k cpo_sub_1.key.pem -A v2g_root.cert.pem -b -o
openssl s_server -cert cpo_sub_1.cert.pem -key cpo_sub_1.key.pem -CAfile v2g_root.cert.pem -accept 11111 -status_verbose

./examples/client/client -A v2g_root.cert.pem -x -W 3

Thanks,
David Garske, wolfSSL