<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
I have seen this done for hardware acceleration; where the crypto chip can do everything except the handshake.
<div class="">(In fact, this mechanism protected at least one device that I know of from the Heartbleed debacle, since the hardware crypto did not understand the record type.)<br class="">
<div class=""><br class="">
</div>
<div class="">Look at how the kernel handles TLS, and how the keys are extracted from OpenSSL:</div>
<div class=""><br class="">
</div>
<div class=""><a href="https://github.com/torvalds/linux/blob/master/Documentation/networking/tls.txt" class="">https://github.com/torvalds/linux/blob/master/Documentation/networking/tls.txt</a></div>
<div class=""><a href="https://github.com/openssl/openssl/pull/5253" class="">https://github.com/openssl/openssl/pull/5253</a></div>
<div class=""><br class="">
<div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">--</div>
<div class="">-Todd Short</div>
<div class="">// <a href="mailto:tshort@akamai.com" class="">tshort@akamai.com</a></div>
<div class="">// "One if by land, two if by sea, three if by the Internet."</div>
</div>
</div>
</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">On Nov 14, 2018, at 11:28 AM, Viktor Dukhovni <<a href="mailto:openssl-users@dukhovni.org" class="">openssl-users@dukhovni.org</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class=""><br class="">
<br class="">
<blockquote type="cite" class="">On Nov 14, 2018, at 6:54 AM, Hemant Ranvir <<a href="mailto:hemantranvir@gmail.com" class="">hemantranvir@gmail.com</a>> wrote:<br class="">
<br class="">
My main goal here is to use openssl for initial handshake sequence. Once the connection is established between server and client, decrypt the incoming message (this time not using the openssl api but rather by using the decrypt AES function implemented earlier)<br class="">
</blockquote>
<br class="">
This makes no sense, because TLS does not just emit a simple CBC encrypted stream<br class="">
after performing the handshake. So you can't do that. Use SSL_read()/SSL_write,<br class="">
and let the library do the message decryption/encryption for you. When done use<br class="">
SSL_shutdown() to cleanly terminate the stream, and depending on the application<br class="">
protocol, make wait for the peer's SSL_shutdown() in turn to avoid truncation<br class="">
attacks where completion of the stream is not implied by the higher level protocol.<br class="">
<br class="">
-- <br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>Viktor.<br class="">
<br class="">
-- <br class="">
openssl-users mailing list<br class="">
To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" class="">
https://mta.openssl.org/mailman/listinfo/openssl-users</a><br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</body>
</html>