TPM support for using the public key with TLS examples #210
Conversation
README.md
Outdated
| @@ -693,7 +693,7 @@ PKCS7 Container Verified (using software) | |||
|
|
|||
| ### TPM TLS Client Example | |||
|
|
|||
| The wolfSSL TLS client requires loading a private key for mutual authentication. We load a "fake" private key and use the `myTpmCheckKey` callback to check for fake key to use the TPM instead. | |||
| The wolfSSL TLS client requires loading a public key to indicate mutual authentication is sued. The crypto callback uses the TPM for the private key signing. | |||
examples/tls/tls_client.c
Outdated
| if (wolfSSL_CTX_use_PrivateKey_buffer(ctx, DUMMY_RSA_KEY, | ||
| sizeof(DUMMY_RSA_KEY), WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) { | ||
| printf("Failed to set key!\r\n"); | ||
| /* TLS client (mutual auth) requires a public key loaded */ |
There was a problem hiding this comment.
The API is for using a private key, so this comment "LOOKS" like a mistake. Can we add something to say that we're doing this on purpose? Something like "Even though this is API is for a private key, ....."
examples/tls/tls_client.c
Outdated
| if (wolfSSL_CTX_use_PrivateKey_buffer(ctx, DUMMY_ECC_KEY, | ||
| sizeof(DUMMY_ECC_KEY), WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) { | ||
| printf("Failed to set key!\r\n"); | ||
| /* TLS client (mutual auth) requires a public key loaded */ |
There was a problem hiding this comment.
The API is for using a private key, so this comment "LOOKS" like a mistake. Can we add something to say that we're doing this on purpose? Something like "Even though this is API is for a private key, ....."
examples/tls/tls_server.c
Outdated
| WOLFSSL_FILETYPE_ASN1) | ||
| != WOLFSSL_SUCCESS) { | ||
| printf("Failed to set key!\r\n"); | ||
| /* TLS client (mutual auth) requires a public key loaded */ |
There was a problem hiding this comment.
The API is for using a private key, so this comment "LOOKS" like a mistake. Can we add something to say that we're doing this on purpose? Something like "Even though this is API is for a private key, ....."
examples/tls/tls_server.c
Outdated
| if (wolfSSL_CTX_use_PrivateKey_buffer(ctx, DUMMY_ECC_KEY, | ||
| sizeof(DUMMY_ECC_KEY), WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) { | ||
| printf("Failed to set key!\r\n"); | ||
| /* TLS client (mutual auth) requires a public key loaded */ |
There was a problem hiding this comment.
The API is for using a private key, so this comment "LOOKS" like a mistake. Can we add something to say that we're doing this on purpose? Something like "Even though this is API is for a private key, ....."
… `wolfSSL_CTX_use_PrivateKey_buffer` API.
Eliminates the "dummy" key workaround logic and
CheckWolfKeyCallbackFunc.Requires: