arduino/esp8266
1
0
Fork 0
mirror of https://github.com/esp8266/Arduino.git synced 2025-06-15 00:02:49 +03:00
Code Activity

Allow cipher specification for BearSSL (#5151)

Browse Source 
* Allow cipher specification for BearSSL

BearSSL has many more ciphers than axTLS, but they are more compute intensive
and slower.  Add an option to use only the same, limited security, axTLS ciphers
as well as allow users to specify any suite of ciphers they want using standard
BearSSL formats.

Fixes #5110

* Rename methods to avoid axtls references.

* Allow std::vector to set a list of allowed ciphers

For C++ afficionados, allow std::vectors to be passed in to the setCipher()
routine.

The BearSSL object will now keep a copy of any set ciphers and free on object
destruction.  These custom lists should normally only be 1-4 entries long, so it
is not expected to be a memory hog having this extra copy.
This commit is contained in:
Earle F. Philhower, III
2018-09-21 07:47:20 -07:00
committed by Develo
parent 1a44f79a9e
commit cc284bb533
3 changed files with 78 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
libraries/ESP8266WiFi/examples/BearSSL_Validation/BearSSL_Validation.ino
View File

@ -193,6 +193,32 @@ BearSSL does verify the notValidBefore/After fields.
fetchURL(&client, host, port, path);
}
void fetchFaster() {
Serial.printf(R"EOF(
The ciphers used to set up the SSL connection can be configured to
only support faster but less secure ciphers. If you care about security
you won't want to do this. If you need to maximize battery life, these
may make sense
)EOF");
BearSSL::WiFiClientSecure client;
client.setInsecure();
uint32_t now = millis();
fetchURL(&client, host, port, path);
uint32_t delta = millis() - now;
client.setInsecure();
client.setCiphersLessSecure();
now = millis();
fetchURL(&client, host, port, path);
uint32_t delta2 = millis() - now;
std::vector<uint16_t> myCustomList = { BR_TLS_RSA_WITH_AES_256_CBC_SHA256, BR_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, BR_TLS_RSA_WITH_3DES_EDE_CBC_SHA };
client.setInsecure();
client.setCiphers(myCustomList);
now = millis();
fetchURL(&client, host, port, path);
uint32_t delta3 = millis() - now;
Serial.printf("Using more secure: %dms\nUsing less secure ciphers: %dms\nUsing custom cipher list: %dms\n", delta, delta2, delta3);
}
void setup() {
Serial.begin(115200);
Serial.println();
@ -220,6 +246,7 @@ void setup() {
fetchSelfSigned();
fetchKnownKey();
fetchCertAuthority();
fetchFaster();
}