Tls 1.2

[gpauk]

Hi..
I have an app that works well, based from the barebonetls server example.

It works fine with Tls1.3, except that I now have a client that can at best manage tls 1.2

If I connect from openssl with:

openssl s_client -no_tls1_3 -tlsextdebug 192.168.1.107:10443

I get a handshake error "Missing supported ciphersuite"

I found 2 instances where the code seemed to want tls1.3 only,:

`.LocalFeatures = ucsTlsSupportTls13

For Each vElem In pvTlsGetSortedCipherSuites(ucsTlsSupportTls13)
cCipherPrefs.Add cCipherPrefs.Count, "#" & vElem
Next
`
in mdTlsThunks module.

I altered those to "ucsTlsSupportAll"

I now get the error:

"Received fatal alert. Unsupported expension"

So I may or may not be on the right track!

Any advice on how to get it to work with openssl tls1.2 would be greatly appreciated!

Thanks!

[wqweto]

The typo in the error message is hilarious :)) and I'll fix it ASAP

Unfortunately thunks based backend does not support TLS 1.2 in server mode (only client)

It's only native OS based one that supports older protocol versions but lacks TLS 1.3 support on anything but latest Win10 releases (not tested)

So currently there is not much that can be done short of impl TLS 1.2 server mode in thunks backend which is not trivial.

[gpauk]

Yes - recent java is fine.
The client in question though is on a raspberry pi zero - and java 8 is the most recent one that is supported on the arm 6 cpu on that.

It's an IoT application - needs a small low power cpu.

However - your modified internal version (samples\tlssockettest), not the barebone tls version, does connect ok!

It works rather differently from the thunks version - I just need to sort the way to send data from server to client indexed by Client.ID rather than the index in the barebone tls...

Thanks again!

[wqweto]

I see what's going on. The TlsSocketTest sample is using different TLS backend: mdTlsNative.

This backend is using OS provided SChannel library for TLS implementation so it supports older versions of the protocol (TLS 1.0 and TLS 1.1) too.

All TLS backend modules (mdTlsNative, mdTlsThunks and mdTlsSodium) are source compatible so that these can be easily swapped if needed but differ in supported protocol features. Also mdTlsNative depends on Windows version so no TLS 1.2 on XP for instance.

Btw, there is Project2.vbp project files in the BareboneTls folder which references mdTlsNative already for testing puposes. Project3.vbp references mdTlsSodium while Project4.vbp uses a "stub protocol" (empty implementation) just to be able to measure backend modules footprint on final executable by comparing all projects compile output size to the "stub protocol" minimal one.

[gpauk]

Thanks for that - I'll have a longer look at the backend modules. Having got mdtlsthunks running (before having to support the rpi client) I hadn't really looked properly at the others. I'll spend some more time on it!

[gpauk]

Thanks - yes, project2 is a great help! Apologies for missing it before!

[wqweto]

Unfortunately thunks based backend does not support TLS 1.2 in server mode (only client)

It's only native OS based one that supports older protocol versions but lacks TLS 1.3 support on anything but latest Win10 releases (not tested)

So currently there is not much that can be done short of impl TLS 1.2 server mode in thunks backend which is not trivial.

JFYI, I found some time (bit the bullet) and recent VB6+thunks backend supports client and server mode for both TLS 1.3 and (legacy) TLS 1.2 incl. in the Barebones sample.

[gpauk]

Hi... Great - thanks! Graham

…

____________________________________________ From: wqweto/VbAsyncSocket Sent: 18 November 2021 08:49 To: wqweto/VbAsyncSocket ***@***.***> Subject: Re: [wqweto/VbAsyncSocket] Tls 1.2 (Discussion #20) Unfortunately thunks based backend does not support TLS 1.2 in server mode (only client) It's only native OS based one that supports older protocol versions but lacks TLS 1.3 support on anything but latest Win10 releases (not tested) So currently there is not much that can be done short of impl TLS 1.2 server mode in thunks backend which is not trivial. JFYI, I found some time (bit the bullet) and recent VB6+thunks backend supports client and server mode for both TLS 1.3 and (legacy) TLS 1.2 incl. in the Barebones sample. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android.