Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use basic BearSSL ciphers on low memory boards #1810

Merged
merged 2 commits into from
Jul 12, 2019

Conversation

Niek
Copy link
Contributor

@Niek Niek commented Jul 5, 2019

See: https://github.com/esp8266/Arduino/blob/8b1af68e3f996592c4b152e793cde81de4b8957d/libraries/ESP8266WiFi/src/WiFiClientSecureBearSSL.cpp#L725-L854

With this flag enabled, BearSSL is compiled with only these 4 ciphers:

TLS_RSA_WITH_AES_128_CBC_SHA256 / AES128-SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256 / AES256-SHA256
TLS_RSA_WITH_AES_128_CBC_SHA / AES128-SHA
TLS_RSA_WITH_AES_256_CBC_SHA / AES256-SHA

Setting this build flag saves around 45.5KB in build size, which is very significant on low memory boards. I think it would be nice to enable this by default on the 512KB/1MB boards.

I did some quick checks and most (if not all) SSL server support these ciphers. To check a site, try: nmap --script ssl-enum-ciphers -p 443 google.com

@Niek
Copy link
Contributor Author

Niek commented Jul 9, 2019

Maybe it also makes sense to define BEARSSL_BASIC in addition to BEARSSL_SSL_BASIC.

@mcspr
Copy link
Collaborator

mcspr commented Jul 9, 2019

Maybe as a comment block / separate variable in [common]? Not default, but a general recommendation

@Niek
Copy link
Contributor Author

Niek commented Jul 10, 2019

Makes sense - done!

@mcspr mcspr merged commit a8f602a into xoseperez:dev Jul 12, 2019
@Niek Niek deleted the bearssl-reduce-mem branch July 15, 2019 08:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants