1 Reply by eyal

(10 replies, posted in wolfCrypt)

OK, I retest all the process and now I can say that the case is solved for me!

I found out that on my device, if the cert is too big then there is some memory problems that cause the TLS to fail.

I created a shorter cert by removing some of the DN elements and make the others shorter (Like it actually was created with the openssl in the first time - no email and CN with only 2 letters) and with this wolf cert and key the device was able to establish a TLS connection with AWS IOT.

Thanks for the responsive support,

Eyal

Go to forum: wolfCrypt

2 Reply by eyal

(10 replies, posted in wolfCrypt)

Thank you again David, now all the elements seems to fit to each other and I was able to upload the CSR to AWS IOT and signing a cert for my key.

But, from some reason I'm not succeed to establish a TLS connection with the AWS thing while when I use the openssl pair I am.

I try to run openssl req -in wolf_ecc.csr -text -noout and compare the csr-s with no significant differences.

I'll try again tomorrow from fresh but I wanted to ask you if you can think of any thing I'm doing wrong here that can cause that different behavior?

Thanks,

Eyal

Go to forum: wolfCrypt

3 Reply by eyal

(10 replies, posted in wolfCrypt)

Hi David,

I have now a full working code that creat the ECC key and a CSR based on it, but, the CSR looks broken, when I try to use it it is identify as corrupted or as an incorrect format.

I do this in the code:

    ecc_key key;
    wc_ecc_init(&key);

    WC_RNG rng;
    wc_InitRng(&rng);

//    wc_ecc_make_key(&rng, 32, &key); // initialize 32 byte ecc key
    wc_ecc_make_key_ex(&rng, 32, &key,ECC_SECP256R1); // initialize 32 byte ecc key
    #define FOURK_BUF 4096
    byte  der[FOURK_BUF];
    int  derSz = wc_EccKeyToDer(&key, der, FOURK_BUF);
    byte pem[4096];
    memset(pem,0,sizeof(pem));
    int  pemSz = wc_DerToPem(der, derSz, pem, sizeof(pem),ECC_PRIVATEKEY_TYPE);
    printf("%s",pem);
    Cert req;
    wc_InitCert(&req);
    strncpy(req.subject.country, "US", CTC_NAME_SIZE);
    strncpy(req.subject.state, "OR", CTC_NAME_SIZE);
    strncpy(req.subject.locality, "Portland", CTC_NAME_SIZE);
    strncpy(req.subject.org, "yaSSL", CTC_NAME_SIZE);
    strncpy(req.subject.unit, "Development", CTC_NAME_SIZE);
    strncpy(req.subject.commonName, "www.wolfssl.com", CTC_NAME_SIZE);
    strncpy(req.subject.email, "info@wolfssl.com", CTC_NAME_SIZE);
    derSz = wc_MakeCertReq(&req, der, FOURK_BUF, NULL, &key);
    pemSz = wc_DerToPem(der, derSz, pem, sizeof(pem),CERTREQ_TYPE);
    printf("%s",pem);

And this is the key\csr pair I get:

-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIG1ceBb5bj3YhpfCuxBB+tW8x/L1OK852gN5EijIoRHDoAoGCCqGSM49
AwEHoUQDQgAEwH2T6dZ6N+Vim7EKGRorUSZb+GIPXRDpXHPHJV+qxp7i7gOClDvg
oQagUCoB/llEaXTFzOzmmGVM+sakTYsByA==
-----END EC PRIVATE KEY-----

-----BEGIN CERTIFICATE REQUEST-----
MIHxAgECMIGOMQswCQYDVQQGEwJVUzELMAkGA1UECAwCT1IxETAPBgNVBAcMCFBv
cnRsYW5kMQ4wDAYDVQQKDAV5YVNTTDEUMBIGA1UECwwLRGV2ZWxvcG1lbnQxGDAW
BgNVBAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xm
c3NsLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMB9k+nWejflYpuxChka
K1EmW/hiD10Q6VxzxyVfqsae4u4DgpQ74KEGoFAqAf5ZRGl0xczs5phlTPrGpE2L
AcigAA==
-----END CERTIFICATE REQUEST-----

I tested it both on my target server that refuse the CSR and on https://www.sslshopper.com/csr-decoder.html the gave an error message -

We were unable to decode this CSR. It may be corrupt or in an incorrect format.

When I took the above key and used openssl like this:

OpenSSL req -new -config my_config.cnf -key wolf_ecc_key.pem -out wolf_ecc.csr

The wolf_ecc.csr format was OK in both cases, that is, on my target server and the csr-decoder.

Any idea what I did wrong?

Thanks,

Eyal

Go to forum: wolfCrypt

4 Reply by eyal

(10 replies, posted in wolfCrypt)

Thank again David,

Your detailed answers brought me very fast to a stage where my project is built with wolfcrypt and I'm able to create the ECC key I needed.

I'm not sure about the output but when I used openssl to create the key on my Windows machine I used this command:

OpenSSL ecparam -out my_ec_key.pem -name prime256v1 –genkey

And I got keys that look like this:

-----BEGIN EC PARAMETERS-----
BggqhkjOPQMBBw==
-----END EC PARAMETERS-----
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIO1rlKJE/b1DDQsi6ESqePmNjxrqbc7Dg/GlJtZviz+EoAoGCCqGSM49
AwEHoUQDQgAE/DuVorKIGfByjKMiT+SJtRRMHwnsh5jofFtIBIm4J0VnR3hjw4Fw
CeYOQBdDIGpuDr8y2IvJWeLTz51gz0pWwQ==
-----END EC PRIVATE KEY-----

With wolfcrypt I use this:

ecc_key key;
wc_ecc_init(&key);

WC_RNG rng;
wc_InitRng(&rng);

wc_ecc_make_key(&rng, 32, &key); // initialize 32 byte ecc key
#define FOURK_BUF 4096
byte  der[FOURK_BUF];
int  derSz = wc_EccKeyToDer(&key, der, FOURK_BUF);
byte pem[4096];
int  pemSz = wc_DerToPem(der, derSz, pem, sizeof(pem),ECC_PRIVATEKEY_TYPE);

And I get a key that look like this:

-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIG1ceBb5bj3YhpfCuxBB+tW8x/L1OK852gN5EijIoRHDoAoGCCqGSM49
AwEHoUQDQgAEwH2T6dZ6N+Vim7EKGRorUSZb+GIPXRDpXHPHJV+qxp7i7gOClDvg
oQagUCoB/llEaXTFzOzmmGVM+sakTYsByA==
-----END EC PRIVATE KEY-----

I see that the EC PARAMETERS part is missing, how can I produce it?
Also, does the prime256v1 is the same as calling wc_ecc_make_key with 32?

Thanks
Eyal

Go to forum: wolfCrypt

5 Reply by eyal

(10 replies, posted in wolfCrypt)

Thank you David for your answer,

I added wolfcrypt files to my stm32401 project and after straggling with the defines I finally succeed to build the project.

Since I don't have HW RGN on the 401 I have to use an alternative function, I'm missing the definition of custom_rand_generate_block(unsigned char* output, unsigned int sz);

Where is the description of it? Does it return a block of random numbers of size sz?
Do you have an example of such implementation?

Thanks,

Eyal

Go to forum: wolfCrypt

6 Topic by eyal

(10 replies, posted in wolfCrypt)

Hello,
I downloaded the package and try to evaluate it. My target is ST Nucleo F401RE, I'm using a STM32F401 with Freertos and I want to generate an ECC private key and a CSR based on it.
There is no RNG on the 401.
What is the minimum set of sources I need for that?
Is there any close example to this need?
Thanks,
Eyal

Go to forum: wolfCrypt