mbedTLS

Sakar Pudasaini
Real Time Solutions Pvt. Ltd.
 TLS
• Transport Layer Security
• Cryptographic protocol to provide
communications security over network
• Uses both asymmetric and symmetric
encryption
TLS Handshake
 mbedTLS over lwIP
• Default network module of mbedTLS works on
Windows and Unix systems that implement the
BSD sockets API
• Changes are necessary to run mbedTLS over lwIP
• On esp SDK, required files were supplied on the
folder “esp-open-rtos/extras/mbedtls/” as
net_lwip.c and component.mk
• These file override net.c or net_socket.c on “esp-
open-rtos/extras/mbedtls/mbedtls/library/”
 Requirements for TLS Connection
• CA certificate is required for signature
verification of server certificate which can be
retrieved using following command
openssl s_client -showcerts -connect “WEB
SERVER”:”PORT” </dev/null
• The CA certificate is the last certificate in the
chain output by the server.
 Selecting Cipher Suites
• Modifications required on “esp-open-
rtos/extras/mbedtls/mbedtls/include/mbedtls
/config.h”
• Cipher Modes can be enabled or disabled by
un/commenting
#define MBEDTLS_CIPHER_MODE_XXX
• Key Exchange Methods can be enabled or
disabled by un/commenting
#define MBEDTLS_KEY_EXCHANGE_XXX
 Selecting Cipher Suites
• Block Cipher can be enabled or disabled by
un/commenting
#define MBEDTLS_XXX_C
XXX can be AES, ARC4, CAMELLIA, DES etc.
• Hashing function can be enabled or disabled
by un/commenting
• #define MBEDTLS_XXX_c
XXX can be SHA1, SHA256 , SHA512
 Selecting Cipher Suites
• OR manually enter required cipher suites on
#define MBEDTLS_SSL_CIPHERSUITES xxx,…
• xxx can be
MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_G
CM_SHA256
MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GC
M_SHA256
MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_G
CM_SHA384
etc.
Steps in TLS connection using mbedTLS
• Initialize the RNG and session data
• Initialize the certificates
• Setup Stuff
• Handshake
• Verify the server certificate
• Write the GET request
• Read the HTTP response
Steps in TLS connection using mbedTLS
• An example program in “esp-open-
rtos/examples/http_get_mbedtls” illustrates
all the steps and the used functions are well
documented
Thank You!