mbedtls entropy generation (nv_seed) - amazon-web-services

I am using mbedtls as TLS library for amazon FreeRTOS running on my hardware(SAM4E).
The library has been ported and I am using nv_seed method to generate random numbers. I am reading and writing the 32Bit data to EEPROM.
I was getting the TLS handshake failure(hang). After debugging, I found out that the numbers saved and read from EEPROM is same all the time and that is the reason for handshake failure.
I cannot generate random numbers using hardware as I do not have dedicated TRNG. So, I have to make the seeding work somehow.

Related

real time audio processing in C++

I want to produce software that reads raw audio from an external audio interface (Focusrite Scarlett 2i2) and processes it in C++ before returning it to the interface for playback. I currently run Windows 8 and was wondering how to do this with minimum latency?
I've spent a while looking into (boost) ASIO but the documentation seems fairly poor. I've also been considering OpenCL but I've been told it would most likely have higher latency. Ideally I'd like to be able to just access the Focusrite driver directly.
I'm sorry that this is such an open question but I've been having some trouble finding educational materiel on Audio Programming, other than just manipulating the audio when provided by a third party plug in design suite such as RackAFX. I'd also be grateful if anyone could recommend some reading on low level stuff like this.
You can get very low latency by communicating directly with the Focuswrite ASIO driver (this is totally different than boost ASIO). To work with this you'll need to register and download the ASIO SDK from Steinberg. Within the API download there is a Visual C++ sample project called hostsample which is a good starting point and there is pretty good documentation about the buffering process that is used by ASIO.
ASIO uses double buffering. Your application is able to choose a buffer size within the limits of the driver. For each input channel and each output channel, 2 buffers of that size are created. While the driver is playing from and recording to one set of buffers your program is reading from and writing to the other set. If your program was performing a simple loopback then it would have access to the input 1 buffer period after it was recorded, would write directly to the output buffer which would be played out on the next period so there would be 2 buffer periods of latency. You'll need to experiment to find the smallest buffer size you can tolerate without glitches and this will give you the lowest latency. And of course the signal processing code will need to be optimized well enough to keep up. A 64 sample (1.3 ms # 48kHz) is not unheard of.

C program for large file encryption/decryption using asymmetric keys

I am stuck on this problem where I need to do a encrypt-decrypt on a large file (>5MB) using asymmetric key with the help of OpenSSL.
Below is a brief description of my requirement:-
I have a device running with Linux on it.
The device can download a firmware image/patch from a server.
The image/patch in the server will be encrypted using a public key which will be already shared to them.
Once the image is downloaded, the device needs to verify its authenticity by decrypting it using the private key.
The target device will use OpenSSL libraries built and installed on it for decryption.
Along with this the target device needs to verify the signature of the firmware image/patch downloaded.
I have found a number of different ways of doing it on the Internet. The most appealing way to me is using OpenSSL S/MIME encrypt/decrypt. But I didn't find a suitable library/tool for doing this using C programming language. All the examples that I've found were mostly using a console application.
There were some sample C programs but those were not doing the encryption and decryption using asymmetric keys; they used a random 128 bit key and IV instead.
Could anyone please help me by providing some examples.
Do not forget that OpenSSL is open-source. If you want to see the source code of "openssl smime" command than you need to take a look at apps/smime.c file in openssl source code.

Openssl vs. Opentnl

While searching the web looking for a networking library I came across the two and I began reading what the were about. Correct me if I am wrong but my understanding is that Opentnl is for sending stuff between a client and a server while Openssl is for securing that connection. In the case that this conclusion is correct, would it be possible to use the two in Union? ( With some work implementing of course.)
Sure, it is possible. You can use the encryption API in OpenSSL and build your own encrypted data to communicate via the Torque Net lib. It isn't something you can just plug in, and isn't as simple as the TCP socket stuff in OpenSSL, but I've done something similar to write a UDP based VPN with SSLeay (predecessor to OpenSSL). As an example, you can initialize a "session" of your own using RSA, then encrypt/decrypt from a buffer with AES (or some other algorithm that has hardware support for least latency).
I don't actually know much about TNL, it may already include some encryption support. I'd check that first.

C++ Microphone Input As A Random Seed

I am currently playing around with some cryptography (RSA Public Key, in this case) and in order to generate a random key I need a random input. I figured the microphone would be a good source for relatively unreplicatable data. Is there any way to read the raw data out of a microphone in a way that can be used as to seed srand? Is there a better way to get a purely random seed and if so how would I do it?
I am running Windows 8 on a laptop with a built in mic and I am using the g++ compiler.
Do not try to get seed from hardware yourself. The OS knows a lot more than you about how to get quality randomness.
On Linux, the correct way is to read /dev/urandom (not /dev/random; it is actually worthless)
On Windows, Google indicates that you should use the CryptGenRandom function.

Adding SSL support to existing TCP & UDP code?

Here's my question.
Right now I have a Linux server application (written using C++ - gcc) that communicates with a Windows C++ client application (Visual Studio 9, Qt 4.5.)
What is the very easiest way to add SSL support to both sides in order to secure the communication, without completely gutting the existing protocol?
It's a VOIP application that uses a combination of UDP and TCP to initially set up the connection and do port tunneling stuff, and then uses UDP for the streaming data.
I've had lots of problems in the past with creating the security certificates from scratch that were necessary to get this stuff working.
Existing working example code would be ideal.
Thank you!
SSL is very complex, so you're going to want to use a library.
There are several options, such as Keyczar, Botan, cryptlib, etc. Each and every one of those libraries (or the libraries suggested by others, such as Boost.Asio or OpenSSL) will have sample code for this.
Answering your second question (how to integrate a library into existing code without causing too much pain): it's going to depend on your current code. If you already have simple functions that call the Winsock or socket methods to send/receive ints, strings, etc. then you just need to rewrite the guts of those functions. And, of course, change the code that sets up the socket to begin with.
On the other hand, if you're calling the Winsock/socket functions directly then you'll probably want to write functions that have similar semantics but send the data encrypted, and replace your Winsock calls with those functions.
However, you may want to consider switching to something like Google Protocol Buffers or Apache Thrift (a.k.a. Facebook Thrift). Google's Protocol Buffers documentation says, "Prior to protocol buffers, there was a format for requests and responses that used hand marshalling/unmarshalling of requests and responses, and that supported a number of versions of the protocol. This resulted in some very ugly code. ..."
You're currently in the hand marshalling/unmarshalling phase. It can work, and in fact a project I work on does use this method. But it is a lot nicer to leave that to a library; especially a library that has already given some thought to updating the software in the future.
If you go this route you'll set up your network connections with an SSL library, and then you'll push your Thrift/Protocol Buffer data over those connections. That's it. It does involve extensive refactoring, but you'll end up with less code to maintain. When we introduced Protocol Buffers into the codebase of that project I mentioned, we were able to get rid of about 300 lines of marshalling/demarshalling code.
I recommend to use GnuTLS on both the client and the server side, only for the TCP connection. Forget about the UDP data for now. The GnuTLS documentation has example code for writing both clients and servers. Please understand that at least the server side (typically the TCP responder) needs to have a certificate; the client side can work with anonymous identification (although there is even an example without server certificate, using only DH key exchange - which would allow man-in-the-middle attacks).
In general, it is likely that you will have to understand the principles of SSL, no matter what library you use. Library alternatives are OpenSSL (both Unix and Windows), and SChannel (only Windows).
Have you tried the SSL support in Boost.Asio or ACE? Both use OpenSSL under-the-hood, and provide similar abstractions for TCP, UDP and SSL. Sample code is available in both the Boost.Asio and ACE distributions.
One thing you may need to keep in mind is that SSL is record-oriented instead of the stream-oriented (both TCP and UDP). This may affect how you multiplex events since you must, for example, read the full SSL record before you can call a read operation complete.
To help handle this with no changes to the application yo may want to look at the stunnel project (http://www.stunnel.org/). I don't think that it will handle the UDP for you though.
The yaSSL and CyaSSL embedded SSL/TLS libraries have worked well for me in the past. Being targeted at embedded systems, they are optimized for both speed and size. yaSSL is written in C++ and CyaSSL is written in C. In comparison, CyaSSL can be up to 20 times smaller than OpenSSL.
Both support the most current industry standards (up to TLS 1.2), offer some cool features such as stream ciphers, and are dual licensed under the GPLv2 and a commercial license (if you need commercial support).
They have an SSL tutorial which touches on adding CyaSSL into your pre-existing code as well: http://www.yassl.com/yaSSL/Docs-cyassl-manual-11-ssl-tutorial.html
Product Page: http://yassl.com/yaSSL/Products.html
Regards,
Chris