search

aws-amplify / aws-sdk-ios

AWS SDK for iOS. For more information, see our web site:
https://aws-amplify.github.io/docs
Other
1.68k stars 885 forks source link

Not support ECDSA cipher suite for aws-sdk-ios #905

Open Cyan-pactera opened 6 years ago

Cyan-pactera commented 6 years ago

In principle,ECDSA cipher suite is supported in AWS IoT Elliptic Curve Cryptography and Forward Secrecy Support in AWS IoT Security and Identity for AWS IoT

TLS Cipher Suite Support

AWS IoT supports the following cipher suites:

ECDHE-ECDSA-AES128-GCM-SHA256 (recommended) ECDHE-RSA-AES128-GCM-SHA256 (recommended) ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-ECDSA-AES128-SHA ECDHE-RSA-AES128-SHA ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-ECDSA-AES256-SHA AES128-GCM-SHA256 AES128-SHA256 AES128-SHA AES256-GCM-SHA384 AES256-SHA256 AES256-SHA​

But in aws-sdk-ios, all certificates save as RSA type.It only support RSA.

[keyPairAttr setObject:(id)kSecAttrKeyTypeRSA forKey:(id)kSecAttrKeyType]; This operation execute in "AWSIoTKeychain.m"

While importing p12 that contains ecdsa key by importIdentityFromPKCS12Data:passPhrase:certificateId: method, it will return YES, but validity verification will always failed when we try to connect to server. By the way, verification is private method.

mutablealligator commented 6 years ago

Thank you @Cyan-pactera for reporting to us. Sorry for the inconvenience caused. As you pointed out, the SDK only supports RSA for key exchange though the IoT service supports ECDSA. We will take it as a feature request to support the different cipher suites that AWS IoT supports in the TLS connection.

Manasi-Bhandare-Bose commented 6 years ago

any timeline on this?

scb01 commented 6 years ago

@Manasi-Bhandare-Bose

I don't have a specific timeline that I can share at this point. This is in our backlog and waiting for prioritization. I will post back on this thread or through a general forum announcement when I have an update.

alperenguclu commented 5 years ago

@cbommas @kvasukib Is there any update about this issue?