目次

last update: 2024/04

embOS RTOS用BSPパッケージ
第6章: セキュリティ機能の評価
評価ボード:RX72N Envision Kit




emSecure:不正改造・不正量産を防ぐセキュリティゲートウェイ

テストサンプル

Demo Sample Application Folder:

Application
 └ _Exclude
     ├ SECURE  ....... emSecureライブラリのデモサンプル
Sample説明
SECURE_RSA_Bench_PerformanceRSA鍵のデジタル署名を使用してメッセージのSign・Verifyパフォーマンスを確認します

関連設定ファイル(emSecure):

Config
 |- SECURE_ECDSA_Conf.h  ....... ECDSAライブラリのコンフィグレーション設定
 |- SECURE_RSA_Conf.h  ......... RSAライブラリのコンフィグレーション設定
 |- Keys       ................. テスト用鍵データ設定ファイル
     |- SECURE_ECDSA_xxxx.h
     |- SECURE_RSA_xxxx.h

emSecure:ビルド・動作確認方法

プロジェクト設定では「\Application\_Exclude\SECURE」フォルダはビルド対象外に設定しています。以下のどちらかの方法で動作確認を行うサンプルアプリケーションを選択します。

  1. 「SECURE_RSA_Bench_Performance.c」テストサンプルファイルをビルド対象設定の「\Application」フォルダ下にコピーします。
  2. 「SECURE_RSA_Bench_Performance.c」テストサンプルファイルの「ビルド対象外」設定を解除します。

プロジェクトを再ビルドし、評価ボードに接続してデバッグセッションを開始します。
デバッガのIOコンソールのログ画面から結果を確認します。

テストレポート(emSecure)

Sample: SECURE_RSA_Bench_Performance

Debug IO Console:

SEGGER Software Evaluation Sample
Eval Board: RX72N Envision Kit
RTOS: SEGGER embOS
----------------------------------------------

(c) 2014-2018 SEGGER Microcontroller GmbH    www.segger.com
emSecure-RSA Performance Benchmark compiled Mar 26 2024 11:12:34

Compiler: Cannot be identified
System:   Processor speed             = 240.000 MHz
Config:   CRYPTO_VERSION              = 24001 [2.40a]
Config:   SECURE_RSA_VERSION          = 24600 [2.46]
Config:   CRYPTO_MPI_BITS_PER_LIMB    = 32
Config:   SECURE_RSA_MAX_KEY_LENGTH   = 2048 bits
Config:   SECURE_RSA_HASH_FUNCTION    = SHA1
Config:   SECURE_RSA_SIGNATURE_SCHEME = PSS

Sign/Verify Performance
=======================

+----------+----------+----------+----------+
|  Modulus |  Message |     Sign |   Verify |
|    /bits |   /bytes |      /ms |      /ms |
+----------+----------+----------+----------+
|      512 |        0 |    11.11 |     0.74 |
|      512 |     1024 |    11.25 |     0.93 |
|      512 |   102400 |    28.30 |    17.98 |
+----------+----------+----------+----------+
|     1024 |        0 |    57.47 |     2.04 |
|     1024 |     1024 |    57.61 |     2.23 |
|     1024 |   102400 |    74.63 |    19.29 |
+----------+----------+----------+----------+
|     2048 |        0 |   358.82 |     7.63 |
|     2048 |     1024 |   358.31 |     7.79 |
|     2048 |   102400 |   375.55 |    24.83 |
+----------+----------+----------+----------+

Benchmark complete

STOP.


emSSL:SSL/TLSセキュア通信

テストサンプル

SSL Application Folder:

Application
 └ _Exclude
     ├ SSL  ....... emSSLライブラリのデモサンプル
Sample説明
SSL_OS_Scan指定WEBサーバー対応の暗号スイートをスキャンして結果を表示します
SSL_OS_SimpleWebClientSSLクライアントから指定WEBサーバーに接続します
SSL_OS_SimpleWebServer簡単なセキュアWEBサーバー(HTTPS)を実装します

関連設定ファイル(emSSL):

Config
 |- SSL_Conf.h  ........ SSLコンフィグレーション設定ファイル(マクロ定義)
 |- SSL_X_Config.c  .... SSLコンフィグレーション設定ファイル(初期化設定)
 |- IO
 |   |- SSL_ConfigIO.c  ..... デバッグコンソールIOインターフェース設定ファイル
 |
 |- OS
     |- lib_embOSLayer_RXv3_L.lib  ..... OSインターフェース設定ファイル

BSP
 |- Setup
     |- SSL_X_TrustedCerts.c  .... テスト用ルート証明書データ(バイナリ)

emSSL:ビルド・動作確認方法

プロジェクト設定では「\Application\_Exclude\SSL」フォルダはビルド対象外に設定しています。以下のどちらかの方法で動作確認を行うサンプルアプリケーションを選択します。

  1. 「\_Exclude\SSL」フォルダ下の対象テストサンプルファイルをビルド対象設定の「\Application」フォルダ下にコピーします。
  2. 「\_Exclude\SSL」フォルダ下の対象テストサンプルファイルのみ「ビルド対象外」の設定を解除します。

プロジェクトを再ビルドし、評価ボードに接続してデバッグセッションを開始します。
デバッガのIOコンソールのログ画面から結果を確認します。

テストレポート(emSSL)

Sample: SSL_OS_Scan

File: SSL_OS_Scan.c (サーバーIPアドレス設定)

#define HOST         "www.google.co.jp"
#define PORT         443

Debug IO Console:

4:026 IP_Task - DHCPc: Sending Request.
4:045 IP_Task - DHCPc: IFace 0: Using IP: 192.168.1.12, Mask: 255.255.255.0, GW: 192.168.1.1.
4:049 ScanTask - Scanning cipher suites on www.google.co.jp:443
4:083 ScanTask - C008  TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA         Received Handshake Failure alert
4:368 ScanTask - C009  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA          TLS 1.2   229 ms processing,    55 ms socket,   284 ms total
4:380 ScanTask - C023  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256       Received Handshake Failure alert
4:394 ScanTask - C0AC  TLS_ECDHE_ECDSA_WITH_AES_128_CCM              Received Handshake Failure alert
4:410 ScanTask - C0AE  TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8            Received Handshake Failure alert
4:695 ScanTask - C02B  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256       TLS 1.2   228 ms processing,    55 ms socket,   283 ms total
4:981 ScanTask - C00A  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA          TLS 1.2   233 ms processing,    51 ms socket,   284 ms total
4:998 ScanTask - C024  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384       Received Handshake Failure alert
5:012 ScanTask - C0AD  TLS_ECDHE_ECDSA_WITH_AES_256_CCM              Received Handshake Failure alert
5:030 ScanTask - C0AF  TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8            Received Handshake Failure alert
5:323 ScanTask - C02C  TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384       TLS 1.2   231 ms processing,    61 ms socket,   292 ms total
5:336 ScanTask - C048  TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256      Received Handshake Failure alert
5:347 ScanTask - C05C  TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256      Received Handshake Failure alert
5:360 ScanTask - C049  TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384      Received Handshake Failure alert
5:373 ScanTask - C05D  TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384      Received Handshake Failure alert
5:388 ScanTask - C072  TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256  Received Handshake Failure alert
5:403 ScanTask - C086  TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256  Received Handshake Failure alert
5:416 ScanTask - C073  TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384  Received Handshake Failure alert
5:428 ScanTask - C087  TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384  Received Handshake Failure alert
5:440 ScanTask - C007  TLS_ECDHE_ECDSA_WITH_RC4_128_SHA              Received Handshake Failure alert
5:726 ScanTask - CCA9  TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS 1.2   230 ms processing,    55 ms socket,   285 ms total
5:743 ScanTask - C012  TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA           Received Handshake Failure alert
5:964 ScanTask - C013  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA            TLS 1.2   161 ms processing,    59 ms socket,   220 ms total
5:981 ScanTask - C027  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256         Received Handshake Failure alert
6:200 ScanTask - C02F  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256         TLS 1.2   159 ms processing,    58 ms socket,   217 ms total
6:418 ScanTask - C014  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA            TLS 1.2   159 ms processing,    57 ms socket,   216 ms total
6:429 ScanTask - C028  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384         Received Handshake Failure alert
6:646 ScanTask - C030  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384         TLS 1.2   160 ms processing,    56 ms socket,   216 ms total
6:660 ScanTask - C04C  TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256        Received Handshake Failure alert
6:677 ScanTask - C060  TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256        Received Handshake Failure alert
6:694 ScanTask - C04D  TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384        Received Handshake Failure alert
6:712 ScanTask - C061  TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384        Received Handshake Failure alert
6:728 ScanTask - C076  TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256    Received Handshake Failure alert
6:743 ScanTask - C08A  TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256    Received Handshake Failure alert
6:756 ScanTask - C077  TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384    Received Handshake Failure alert
6:767 ScanTask - C08B  TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384    Received Handshake Failure alert
6:781 ScanTask - C011  TLS_ECDHE_RSA_WITH_RC4_128_SHA                Received Handshake Failure alert
6:997 ScanTask - CCA8  TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256   TLS 1.2   157 ms processing,    58 ms socket,   215 ms total
7:009 ScanTask - C002  TLS_ECDH_ECDSA_WITH_RC4_128_SHA               Received Handshake Failure alert
7:021 ScanTask - C003  TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA          Received Handshake Failure alert
7:041 ScanTask - C004  TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA           Received Handshake Failure alert
7:054 ScanTask - C025  TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256        Received Handshake Failure alert
7:074 ScanTask - C02D  TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256        Received Handshake Failure alert
7:094 ScanTask - C005  TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA           Received Handshake Failure alert
7:109 ScanTask - C026  TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384        Received Handshake Failure alert
7:124 ScanTask - C02E  TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384        Received Handshake Failure alert
7:136 ScanTask - C04A  TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256       Received Handshake Failure alert
7:150 ScanTask - C05E  TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256       Received Handshake Failure alert
7:165 ScanTask - C04B  TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384       Received Handshake Failure alert
7:184 ScanTask - C05F  TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384       Received Handshake Failure alert
7:201 ScanTask - C074  TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256   Received Handshake Failure alert
7:217 ScanTask - C088  TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256   Received Handshake Failure alert
7:235 ScanTask - C075  TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384   Received Handshake Failure alert
7:250 ScanTask - C089  TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384   Received Handshake Failure alert
7:262 ScanTask - C00D  TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA            Received Handshake Failure alert
7:273 ScanTask - C00E  TLS_ECDH_RSA_WITH_AES_128_CBC_SHA             Received Handshake Failure alert
7:287 ScanTask - C029  TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256          Received Handshake Failure alert
7:303 ScanTask - C031  TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256          Received Handshake Failure alert
7:320 ScanTask - C00F  TLS_ECDH_RSA_WITH_AES_256_CBC_SHA             Received Handshake Failure alert
7:338 ScanTask - C02A  TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384          Received Handshake Failure alert
7:356 ScanTask - C032  TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384          Received Handshake Failure alert
7:371 ScanTask - C04E  TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256         Received Handshake Failure alert
7:387 ScanTask - C062  TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256         Received Handshake Failure alert
7:401 ScanTask - C04F  TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384         Received Handshake Failure alert
7:414 ScanTask - C063  TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384         Received Handshake Failure alert
7:427 ScanTask - C078  TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256     Received Handshake Failure alert
7:439 ScanTask - C08C  TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256     Received Handshake Failure alert
7:453 ScanTask - C079  TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384     Received Handshake Failure alert
7:467 ScanTask - C08D  TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384     Received Handshake Failure alert
7:481 ScanTask - C00C  TLS_ECDH_RSA_WITH_RC4_128_SHA                 Received Handshake Failure alert
7:587 ScanTask - 000A  TLS_RSA_WITH_3DES_EDE_CBC_SHA                 TLS 1.2    50 ms processing,    55 ms socket,   105 ms total
7:599 ScanTask - 0096  TLS_RSA_WITH_SEED_CBC_SHA                     Received Handshake Failure alert
7:711 ScanTask - 002F  TLS_RSA_WITH_AES_128_CBC_SHA                  TLS 1.2    50 ms processing,    61 ms socket,   111 ms total
7:727 ScanTask - 003C  TLS_RSA_WITH_AES_128_CBC_SHA256               Received Handshake Failure alert
7:743 ScanTask - C09C  TLS_RSA_WITH_AES_128_CCM                      Received Handshake Failure alert
7:854 ScanTask - 009C  TLS_RSA_WITH_AES_128_GCM_SHA256               TLS 1.2    50 ms processing,    60 ms socket,   110 ms total
7:959 ScanTask - 0035  TLS_RSA_WITH_AES_256_CBC_SHA                  TLS 1.2    51 ms processing,    53 ms socket,   104 ms total
7:974 ScanTask - 003D  TLS_RSA_WITH_AES_256_CBC_SHA256               Received Handshake Failure alert
7:988 ScanTask - C09D  TLS_RSA_WITH_AES_256_CCM                      Received Handshake Failure alert
8:096 ScanTask - 009D  TLS_RSA_WITH_AES_256_GCM_SHA384               TLS 1.2    53 ms processing,    54 ms socket,   107 ms total
8:111 ScanTask - 0041  TLS_RSA_WITH_CAMELLIA_128_CBC_SHA             Received Handshake Failure alert
8:131 ScanTask - 0084  TLS_RSA_WITH_CAMELLIA_256_CBC_SHA             Received Handshake Failure alert
8:146 ScanTask - 00BA  TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256          Received Handshake Failure alert
8:162 ScanTask - 00C0  TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256          Received Handshake Failure alert
8:174 ScanTask - C07A  TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256          Received Handshake Failure alert
8:187 ScanTask - C07B  TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384          Received Handshake Failure alert
8:200 ScanTask - C03C  TLS_RSA_WITH_ARIA_128_CBC_SHA256              Received Handshake Failure alert
8:215 ScanTask - C03D  TLS_RSA_WITH_ARIA_256_CBC_SHA384              Received Handshake Failure alert
8:234 ScanTask - C050  TLS_RSA_WITH_ARIA_128_GCM_SHA256              Received Handshake Failure alert
8:248 ScanTask - C051  TLS_RSA_WITH_ARIA_256_GCM_SHA384              Received Handshake Failure alert
8:278 ScanTask - 0004  TLS_RSA_WITH_RC4_128_MD5                      Received Handshake Failure alert
8:295 ScanTask - 0005  TLS_RSA_WITH_RC4_128_SHA                      Received Handshake Failure alert
8:296 ScanTask - 
15 common cipher suites out of 92 tested

Sample: SSL_OS_SimpleWebClient

HOST: https://www.segger.com/emssl-testpage.php

Debug IO Console:

4:025 IP_Task - DHCPc: Sending Request.
4:035 IP_Task - DHCPc: IFace 0: Using IP: 192.168.1.12, Mask: 255.255.255.0, GW: 192.168.1.1.
5:218 ClientTask - Data: HTTP/1.1 200 OK..date: Tue, 26 Mar 2024 04:24:04 GMT..server: Apache..vary: Accept-Encoding..x-xss-protection: 1; mode=block..x-content-type-options: nosniff..x-ua-compatible: IE=edge..content-type: text/html; charset=UTF-8..strict-transport-security: max
5:220 ClientTask - Data: -age=31536000; includeSubDomains; preload;..connection: close....Welcome to www.segger.com/emssl-testpage.php!...Successfully connected via SSL...Current date is 2024-03-26...Current time is 05:24:04..
5:221 ClientTask - Data received, socket closed: done

Sample: SSL_OS_SimpleWebServer

Debug IO Console:

4:025 IP_Task - DHCPc: Sending Request.
4:034 IP_Task - DHCPc: IFace 0: Using IP: 192.168.1.12, Mask: 255.255.255.0, GW: 192.168.1.1.
4:050 WebServerTask - Awaiting connection
114:943 WebServerTask - Connection made, attempting to upgrade to secure
115:136 WebServerTask - Session is now secured, cipher suite follows
115:137 WebServerTask - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
115:155 WebServerTask - Session closed
115:156 WebServerTask - Awaiting connection

PC WebServer: https://192.168.1.12

emSSL WebServer

emSSH:SSH セキュアログイン

テストサンプル

SSH(Server) Application Folder: → \Application\_Exclude\SSH

Application
 └ _Exclude
     ├ SSH  ....... emSSHライブラリのデモサンプル
Sample説明
SSH_SCP_FS_ServerSSH SCPサーバーのデモサンプル(ファイルシステムが必要です)
SSH_Shell1SSHサーバー実装方法を示す簡単なサンプル(入力文字データをECHOします)
SSH_Shell6複数クライアント接続をサポートするSSHサーバーの実装事例

関連設定ファイル(emSSH):

Config
 |- SSH_Conf.h  ........ SSHコンフィグレーション設定ファイル(マクロ定義)
 |- SSH_X_Config.c  .... SSHコンフィグレーション設定ファイル(初期化設定)
 |- IO
 |   |- SSH_ConfigIO.c  ..... デバッグコンソールIOインターフェース設定ファイル
 |
 |- OS
 |   |- lib_embOSLayer_RXv3_L.lib  ..... OSインターフェース設定ファイル
 |
 |- Keys   .................. テスト用鍵データ設定ファイル
     |- SSH_ServerKeys_DSA.c
     |- SSH_ServerKeys_ECDSA.c
     |- SSH_ServerKeys_EdDSA.c
     |- SSH_ServerKeys_RSA.c

emSSH:ビルド・動作確認方法

プロジェクト設定では「\Application\_Exclude\SSH」フォルダはビルド対象外に設定しています。以下のどちらかの方法で動作確認を行うサンプルアプリケーションを選択します。

  1. 「\_Exclude\SSH」フォルダ下の対象テストサンプルファイルをビルド対象設定の「\Application」フォルダ下にコピーします。
  2. 「\_Exclude\SSH」フォルダ下の対象テストサンプルファイルのみ「ビルド対象外」の設定を解除します。

プロジェクトを再ビルドし、評価ボードに接続してデバッグセッションを開始します。
デバッガのIOコンソールのログ画面から結果を確認します。

テスト環境の設定:

評価ボードのLANポートをテスト用パソコンに接続して、TCP/IPネットワーク通信が正常にできることを確認してください。

PC Setup

テストレポート(emSSH)

Sample: SSH_Shell1 (Echo Test)

Debug IO Console:

4:025 IP_Task - DHCPc: Sending Request.
4:034 IP_Task - DHCPc: IFace 0: Using IP: 192.168.1.12, Mask: 255.255.255.0, GW: 192.168.1.1.

emSSH V2.54 - Shell1 compiled Mar 26 2024 13:58:10
Copyright (c) 2015-2021 SEGGER Microcontroller GmbH    www.segger.com

PC TeraTerm SSH Client (User name: anon / Password: 無し):

emSSH Client TeraTerm

Windows MS-DOSプロンプトからの確認の場合:

emSSH Client Cmdline
前の章

TCP/IPネットワーク通信

次の章

暗号・サイファーライブラリ