search

Synss / python-mbedtls

Cryptographic library with an mbed TLS back end
MIT License
79 stars 28 forks source link

Set DH params on Server.py #114

Closed raztibi closed 3 months ago

raztibi commented 4 months ago

I didnt manage to find a solution for this, how can - Set DH params on Server.py ? when I try to use cipher suites with DHE - I get this message - "ssl_srv.c:3266: no DH parameters set" I now that in mbedtls.pk there is DHServer but I cant configure it with DTLSConfiguration. I'm sorry if its beginner question. Thanks in advance.

Synss commented 3 months ago

Sorry for not answering earlier. I seem to have been missing a few notifications recently.

Anyway, I am currently spending all the time I have for this library on porting to mbedtls 3+ so I won't take any feature request for the time being.

I would, however, accept pull requests providing the style follows the style of the library.

Synss commented 3 months ago

s/completed/not planned/

sorry for the noise

raztibi commented 3 months ago

I'm not sure you understand my question. I'm asking if there is a way to add DH parameters to Server,py

Synss commented 3 months ago

Indeed, I don’t understand your question. As you wrote above, DH is supported with DHServer. The latter cannot be configured with DTLSConfiguration.

You could still use server.py with DHE cipher suites but the DH parameters are not accessible/configurable.

Both this library and upstream mbedtls are libraries that let you write your application. I wouldn’t recommend anyone to use the example server and client as is.

I hope this is clearer.

raztibi commented 3 months ago

if I create my own server for DTLS handshake, how can I access the DH parameters using this library, the handshake provided by your library support it or do I need to alter the source code to use DH params. again sorry for beginner question

Synss commented 3 months ago

Does https://www.rfc-editor.org/rfc/rfc5246#section-8.1.2 answer your question? In any case, I unfortunately don’t have time to provide support here. I would really appreciate if you would move this discussion to https://security.stackexchange.com/