1 Reply by okba.zoueghi

(7 replies, posted in wolfSSL)

Hi,

I am using the functions provided in wolfssl/test.h as callbacks, namely, myRsaSign and myRsaVerify.
I am using TLSv1.2 and the cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256.

I printed the input buffer given to the RSA sign callback and I expect to find ECDH public key as input. However, I don't see the ECDH public in the input.

the data before the signature:

"30 51 30 0D 06 09 60 86 48 01 65 03 04 02 03 05 00 04 40 E7 49 BF 62 C1 24 26 C1 DE 43 D9 BC 95 1A BD 73 F0 CA A3 35 DC 71 E0 FA 4D C2 86 4B 38 97 91 1D 4F 1F C2 07 8E BC 21 44 FE AA 4B 8E 20 4C 7B 63 28 0C 62 81 92 05 DE 48 4B 34 6B 91 39 77 94 BE"

The data after the signature:

"C2 38 81 EC D8 97 B0 21 5B C0 99 0F 2A 6F F5 77 29 0E F2 26 66 F5 2E 99 68 DC 64 9D C4 B0 DB 91 A6 49 ED BC B2 1C 90 F6 C5 12 A0 D8 F1 A9 21 11 FB 07 DD F6 E6 9C FF A3 5F DC F7 B8 DB 48 03 86 3C 5A 14 55 79 E8 D4 49 7C 0B 01 0A 6E 71 E0 87 A9 A7 82 9B 8D D4 77 EF 15 9A A1 3D C7 9F 35 A8 2A BE B2 47 60 23 76 D0 88 CC EF 81 7C 89 B4 8F B7 D9 DE 44 1D 39 24 26 0E BB BF A0 3B 97 F8 AB EB F3 AB 2C 4D B7 B5 5B F3 27 D1 9D 9E B4 CD 42 D4 66 57 47 21 33 F6 F2 B0 84 FD FC 28 57 B1 A3 D0 0A 84 70 06 6E 30 40 9A 36 60 FD 12 62 22 23 64 CA B7 3F 7D E8 5C C2 FC F1 99 7A 29 80 11 A2 7C DD 57 5B 5D 48 CF 1D 9D 11 EF A4 8D F7 B3 1E A8 A8 EB D7 3C 81 CE DF DF 1C C3 13 16 D0 41 BE 0F 4F C9 02 23 86 8F F5 BE 84 D2 8D 6D 93 71 12 38 8D 65 B2 CD 6F 97 1A 85 F9 A8 B3 6B 00 28 CE"

As shown in the figure below, the printed signature is the same as the signature in the server key exchange and this is of course obvious. What I don't understand, What is the input? shouldn't it be the ECDH public key?

Best regards,
Okba

Go to forum: wolfSSL

2 Reply by okba.zoueghi

(7 replies, posted in wolfSSL)

Hi Eric,

Yes exactly, I am willing to use WolfSSL in conjunction with a HSM.
Therefore, I would like to setup the RSA callbacks and use my HSM for RSA signatures.
Could you please answer my question about what the callbacks shall do exactly?

Thanks in advance,
Okba

Go to forum: wolfSSL

3 Topic by okba.zoueghi

(7 replies, posted in wolfSSL)

Hi,

As specified in rfc5246 (TLS v1.2) for signature calculation and verification, the RSASSA-PKCS1-v1_5 signature scheme is used.
I would like to use my own RSA callbacks for for signing and verifiying, however, the role of the callbacks is not clear and confusing for me.

This is what I think that the callbacks shall do:

For the RSA sign callback:
1- encode the message -> EM = EMSA-PKCS1-V1_5-ENCODE (M) with [M -> the message], [EM -> the encoded message]
2- sign the encoded message

For the RSA verify callback:
1- decrypt the signature which will result on the encoded message (EM)
(The role of the verify callback function is to only decrypt the signature? shall it decode the decrypted signature?)

After the verify callback is called, I think another wolfssl function is called to do the following:
1- encode the received message EM' = EMSA-PKCS1-V1_5-ENCODE (M)
2- compare EM' with EM and succeed if EM' is equal to EM

Is my understanding correct? what shall the RSA callbacks do exactly?

Thanks in advance,
Okba

Go to forum: wolfSSL

4 Topic by okba.zoueghi

(1 replies, posted in wolfSSL)

Hi,

I would like to use my own RSA verify function instead of the built-in one.
A way to do this a to use set the callback function using wolfSSL_CTX_SetRsaVerifyCb().

I don't understand well what exactly is the return value as well as the parameter char ** out as this not specified in the documentation.

typedef int (*CallbackRsaVerify)(WOLFSSL* ssl,

unsigned char* sig, unsigned int sigSz,

unsigned char** out, const unsigned char* keyDer,

unsigned int keySz, void* ctx);

What I understand is :

- The parameter out  is a pointer on pointer of the decrypted signature (in other words the hash)
- The return value is the size of the decrypted signature (the size of the hash)

Is my understanding correct? otherwise, what do the parameters represent?

Thanks in advance,
Okba

Go to forum: wolfSSL

5 Reply by okba.zoueghi

(9 replies, posted in wolfSSL)

Hi,

Thank you for the clarification.

You still haven't answered my question about DTLS, is there a function that allows to use downgrade for DTLS?

I would like to configure an endpoint to use the highest DTLS version from DTLSv1.1 and DTLSv1.2.

Thanks in advance.
Best regards,
Okba

Go to forum: wolfSSL

6 Reply by okba.zoueghi

(9 replies, posted in wolfSSL)

Hi Kaleb,

Thanks for your reply.

You can find the documentation of the function wolfSSLv23_server_method() in the link below, it says that the endpoint using it selects the highest TLS version up to TLSv1.2.
https://www.wolfssl.com/doxygen/group__ … b367b1f4c0

Is there a similar function for DTLS? I would like to configure an endpoint to select the highest DTLS version from DTLSv1.1 and DTLSv1.2.

Best regards,
Okba

Go to forum: wolfSSL

7 Topic by okba.zoueghi

(9 replies, posted in wolfSSL)

Hi,

I would like to configure a server to support TLSv1.1 as the min version and TLSv1.3 as the max version.

In this way, if a client supports one of the following versions, it can establish a secure connection with the server:
- TLSv1.1
- TLSv1.2
- TLSv1.3

However, I don't find within the WolfSSL API a function which allows this. I find the function wolfSSLv23_server_method() which allows using the highest TLS version up to TLSv1.2. Therefore TLSv1.3 will not be used if a client supports it.

My question is, is there a method to configure an endpoint (server or client) to use the highest TLS version from the following versions:
- TLSv1.1
- TLSv1.2
- TLSv1.3

The same question for DTLS, how to configure an endpoint to use the highest DTLS version from the following versions:
- DTLSv1.1
- DTLSv1.2

Go to forum: wolfSSL