{"action":"created","issue":{"url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/208","labels_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/208/labels{/name}","comments_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/208/comments","events_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/208/events","html_url":"https://github.com/ARMmbed/mbedtls/issues/208","id":91236353,"number":208,"title":"server hello not sending Elliptic Curves and signature alg?","user":{"login":"cuteqt","id":6575025,"avatar_url":"https://avatars.githubusercontent.com/u/6575025?v=3","gravatar_id":"","url":"https://api.github.com/users/cuteqt","html_url":"https://github.com/cuteqt","followers_url":"https://api.github.com/users/cuteqt/followers","following_url":"https://api.github.com/users/cuteqt/following{/other_user}","gists_url":"https://api.github.com/users/cuteqt/gists{/gist_id}","starred_url":"https://api.github.com/users/cuteqt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cuteqt/subscriptions","organizations_url":"https://api.github.com/users/cuteqt/orgs","repos_url":"https://api.github.com/users/cuteqt/repos","events_url":"https://api.github.com/users/cuteqt/events{/privacy}","received_events_url":"https://api.github.com/users/cuteqt/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-06-26T12:19:54Z","updated_at":"2015-06-26T13:31:44Z","closed_at":"2015-06-26T13:31:44Z","body":"I first posted in the support forum,hmm, but seems that forum is not very active. So i post it here again.\r\n\r\nI noticed that mbedtls accepts the client hello extension for Elliptic Curves and signature algorithms and properly setup internally. However it doesn't send it back as \"server hello extension\". This seems to be a bug. According to RFC, the agreed alg should be sent back to the client. Could you please check it out?\r\n\r\n--------------------------------------------------------------------\r\n \r\nI'm trying to implement the missing functions myself. And found another problem. In the code, cli_exts is defined as int, which is not a good idea to hold all client extension values. For example, if you bit-or both TLS_EXT_SUPPORTED_ELLIPTIC_CURVES and TLS_EXT_SIG_ALG, you get 15, which is b1111. Then b1111 & TLS_EXT_SUPPORTED_POINT_FORMAT you get true too!\r\n\r\nso far this problem is not visible, since in code we only save client ext status for TLS_EXT_SUPPORTED_POINT_FORMAT, but no any other status. If you want to add other server hello extensions too, then you will see this problem.\r\n"},"comment":{"url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/comments/115688081","html_url":"https://github.com/ARMmbed/mbedtls/issues/208#issuecomment-115688081","issue_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/208","id":115688081,"user":{"login":"mpg","id":60640,"avatar_url":"https://avatars.githubusercontent.com/u/60640?v=3","gravatar_id":"","url":"https://api.github.com/users/mpg","html_url":"https://github.com/mpg","followers_url":"https://api.github.com/users/mpg/followers","following_url":"https://api.github.com/users/mpg/following{/other_user}","gists_url":"https://api.github.com/users/mpg/gists{/gist_id}","starred_url":"https://api.github.com/users/mpg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpg/subscriptions","organizations_url":"https://api.github.com/users/mpg/orgs","repos_url":"https://api.github.com/users/mpg/repos","events_url":"https://api.github.com/users/mpg/events{/privacy}","received_events_url":"https://api.github.com/users/mpg/received_events","type":"User","site_admin":false},"created_at":"2015-06-26T13:31:44Z","updated_at":"2015-06-26T13:31:44Z","body":"Sorry for not replying on the forum. I usually rely on email notifications to monitor it, but they were broken for some time so I missed your message. Thanks for posting again here, and for you interest in our code.\r\n\r\nRegarding the supported elliptic curves extension: RFC 4492, which defines ECC support for TLS, does not define such an extension for ServerHello. (Compare the first sentence of section 5.1 and 5.2: two ClientHello extensions vs a ServerHello extension.) This departs from the usual practice of having the server echo the extension to indicate it understood it, but in that case I guess the reasoning of the RFC is that the server's choice of ciphersuite (and its ServerKeyExchange message) is enough to indicate it understood the extension and has a curve in common, and which one.\r\n\r\n(There is arguably a problem in the RFC, as if client authentication is required, the server has no way to indicate the list of curves in supports for the client certificate. This issue is well-know in the IETF and should be addressed in TLS 1.3.)\r\n\r\nRegarding the signature algorithms extension, RF 5246 is pretty explicit: \"Servers MUST NOT send this extension.  TLS servers MUST support receiving this extension.\" (section 7.4.1.4.1, page 46).\r\n\r\nSo I believe our behaviour with these extension is fully compliant with the relevant standards.\r\n\r\nRegarding `cli_exts`, there is a catch: we do not bit-OR the values of the extensions themselves (eg `TLS_EXT_SUPPORTED_POINT_FORMAT`, but a flag that is specific to this purpose (eg `TLS_EXT_SUPPORTED_POINT_FORMAT_PRESENT`.\r\n\r\nI'm closing this ticket as I believe there is no issue here, but please feel free to re-open it if I forgot or misunderstood something."}}