Hi windsp,

wolfSSL embedded SSL currently provides two functions for loading public/private ECC keys into the ecc_key structure:

int ecc_import_x963(const byte* in, word32 inLen, ecc_key* key);
int ecc_import_private_key(const byte* priv, word32 privSz, const byte* pub, word32 pubSz, ecc_key* key);

The first function imports a public ECC key in X9.63 format into the specified ecc_key structure.
The second function imports both the public key in X9.63 format and the private key in RAW format into the specified ecc_key structure.

Best Regards,
Chris

Hi pcu,

Yes, using session resumption will improve the performance of consecutive connections from the same client.

Have you run the CTaoCrypt benchmarks in your environment?  Looking at CyaSSL performance, this is usually one of the best metrics to compare.  You can find the CTaoCrypt benchmarks in the <cyassl_root>/ctaocrypt/benchmark/benchmark.c file.

With the benchmark.c file, if you will be using your own main() or driver function, you can define NO_MAIN_DRIVER.  You can also define BENCH_EMBEDDED to reduce the benchmark data sizes, making it more reasonable to use on an embedded device.

For the public key benchmarks, if you don't have a file system available, you can define either USE_CERT_BUFFERS_1024 or USE_CERT_BUFFERS_2048 which will use the certificate buffers located in the <cyassl/certs_test.h> header instead of files.

Best Regards,
Chris

Hi cache,

Can you clarify if you are using the client or server, and what endpoint you are trying to connect to?  Also, I'm guessing you are referring to the examples from our SSL Tutorial?

Thanks,
Chris

Hi Yvan,

Glad you got it figured out!  For future reference, which file did you need to comment out the "#include <time.h>" statement?

Thanks,
Chris

Hi Bill,

By default, wolfSSL will use a BSD-style socket API, but as you mentioned with the use of the custom wolfSSL I/O callback mechanism, wolfSSL can be used without sockets.  We have several users using wolfSSL without sockets - instead using us over alternative transport mediums such as serial links or memory buffers.

The wolfSSL_set_fd() function isn't required when using custom I/O callbacks.  SSL related functions such as wolfSSL_connect(), wolfSSL_accept(), wolfSSL_read(), wolfSSL_write(), etc. take a WOLFSSL session object as a parameter.  wolfSSL embedded SSL handles managing the state of the handshake/connection internally.

Hopefully this helps make things a little clearer.

Best Regards,
Chris

Hi p,

Thanks for sending over the file.  I'm looking into it and will get back to you shortly.

Best Regards,
Chris

Hi,

wolfSSL should be able to be compiled with LPCxpresso and Code Red toolchain by following the instructions located in Section 2.4 of the wolfSSL Manual (http://yassl.com/yaSSL/Docs-cyassl-manu … yassl.html).

When building for FreeRTOS, the "FREERTOS" define will need to be uncommented in <cyassl_root>/cyassl/ctaocrypt/settings.h.

Best Regards,
Chris

Hi,

Can you attach (or PM/email) the certificate file in question?

Thanks,
Chris

Hi,

We now have version 2.9.0 released, which may warrant an upgrade - so you are working with the most current version.

Can you verify that your settings.h file from both version match up for the sections which are enabled?

Thanks,
Chris

Hi,

Yes, the equivalent function for ECC keys to convert from ecc_key to DER-encoded buffer is:

int ecc_export_x963(ecc_key* key, byte* out, word32* outLen);

Where

key = input ecc_key
out = output buffer to hold DER-encoded representation of "key"
outLen = in/out variable specifying size of input buffer then size of DER-encoded key upon function success

Possible return values include:

MP_OKAY upon function success
ECC_BAD_ARG_E if invalid input arguments are given
BUFFER_E if buffer is not large enough

Best Regards,
Chris

Hi Eric,

You should be able to extract the public key from a DER-encoded X.509 certificate into an RsaKey structure using something similar to this:

int ret;
int derCertSz;
byte derCert[4096];

FILE* file;
RsaKey pubKey;
word32 idx = 0;
DecodedCert cert;

/* open and read DER-formatted cert into buffer */
file = fopen("./client-cert.der", "rb");
if (!file)
    // error reading file

derCertSz = fread(derCert, 1, sizeof(derCert), file);
fclose(file);

/* initialize DecodedCert with DER cert */
InitDecodedCert(&cert, derCert, derCertSz, 0);
ret = ParseCert(&cert, CERT_TYPE, NO_VERIFY, 0);
if (ret != 0)
    // ParseCert failed

/* extract the public key from the cert */
InitRsaKey(&pubKey, 0);
idx = 0;
ret = RsaPublicKeyDecode(cert.publicKey, &idx, &pubKey, cert.pubKeySize);
if (ret != 0)
    // RsaPublicKeyDecode failed

In order to use the InitDecodedCert() and ParseCert() functions, you'll need to add the WOLFSSL_TEST_CERT define to the wolfSSL preprocessor flags (C_EXTRA_FLAGS) when compiling the library, and then to your application ones as well.

After doing the above, you'll have an RsaKey structure containing the public key which you can then use with the RSA functions.

Hope this helps.

Best Regards,
Chris