目次

last update: 2024/04

FreeRTOS用BSPパッケージ
第5章: セキュリティ機能の評価
評価ボード:RX72N Envision Kit




emSecure:不正改造・不正量産を防ぐセキュリティゲートウェイ

テストサンプル

Demo Sample Application Folder:

Application
 └ _Exclude
     ├ SECURE  ....... emSecureライブラリのデモサンプル
Sample説明
SECURE_RSA_Bench_PerformanceRSA鍵のデジタル署名を使用してメッセージのSign・Verifyパフォーマンスを確認します

関連設定ファイル(emSecure):

Config
 |- SECURE_ECDSA_Conf.h  ....... ECDSAライブラリのコンフィグレーション設定
 |- SECURE_RSA_Conf.h  ......... RSAライブラリのコンフィグレーション設定
 |- Keys       ................. テスト用鍵データ設定ファイル
     |- SECURE_ECDSA_xxxx.h
     |- SECURE_RSA_xxxx.h

emSecure:ビルド・動作確認方法

プロジェクト設定では「\Application\_Exclude\SECURE」フォルダはビルド対象外に設定しています。

「SECURE_RSA_Bench_Performance.c」テストサンプルファイルをビルド対象設定の「\Application」フォルダ下にコピーします。
プロジェクトを再ビルドし、評価ボードに接続してデバッグセッションを開始します。
デバッガのIOコンソールのログ画面から結果を確認します。

テストレポート(emSecure)

Sample: SECURE_RSA_Bench_Performance

Debug IO Console:

SEGGER Software Evaluation Sample
Eval Board: RX72N Envision Kit
Base: FreeRTOS V10.0.0
------------------------------------------------

(c) 2014-2018 SEGGER Microcontroller GmbH    www.segger.com
emSecure-RSA Performance Benchmark compiled Apr  3 2024 15:39:28

Compiler: CC-RX V3.05.00
System:   Processor speed             = 240.000 MHz
Config:   CRYPTO_VERSION              = 24001 [2.40a]
Config:   SECURE_RSA_VERSION          = 24600 [2.46]
Config:   CRYPTO_MPI_BITS_PER_LIMB    = 32
Config:   SECURE_RSA_MAX_KEY_LENGTH   = 2048 bits
Config:   SECURE_RSA_HASH_FUNCTION    = SHA1
Config:   SECURE_RSA_SIGNATURE_SCHEME = PSS

Sign/Verify Performance
=======================

+----------+----------+----------+----------+
|  Modulus |  Message |     Sign |   Verify |
|    /bits |   /bytes |      /ms |      /ms |
+----------+----------+----------+----------+
|      512 |        0 |    10.89 |     0.74 |
|      512 |     1024 |    11.04 |     0.93 |
|      512 |   102400 |    28.42 |    18.35 |
+----------+----------+----------+----------+
|     1024 |        0 |    57.83 |     2.07 |
|     1024 |     1024 |    57.94 |     2.26 |
|     1024 |   102400 |    75.29 |    19.67 |
+----------+----------+----------+----------+
|     2048 |        0 |   364.67 |     7.78 |
|     2048 |     1024 |   364.00 |     7.94 |
|     2048 |   102400 |   382.00 |    25.33 |
+----------+----------+----------+----------+

Benchmark complete

STOP.

emSSL:SSL/TLSセキュア通信

テストサンプル

SSL Application Folder:

Application
 └ _Exclude
     ├ SSL  ....... emSSLライブラリのデモサンプル
Sample説明
SSL_OS_Scan指定WEBサーバー対応の暗号スイートをスキャンして結果を表示します
SSL_OS_SimpleWebClientSSLクライアントから指定WEBサーバーに接続します
SSL_OS_SimpleWebServer簡単なセキュアWEBサーバー(HTTPS)を実装します

関連設定ファイル(emSSL):

Config
 |- SSL_Conf.h  ........ SSLコンフィグレーション設定ファイル(マクロ定義)
 |- SSL_X_Config.c  .... SSLコンフィグレーション設定ファイル(初期化設定)
 |- IO
 |   |- SSL_ConfigIO.c  ..... デバッグコンソールIOインターフェース設定ファイル
 |
 |- OS
     |- libFreeRT_OSLayer_RXv3_L.lib  ..... OSインターフェース設定ファイル

BSP
 |- Setup
     |- SSL_X_TrustedCerts.c  .... テスト用ルート証明書データ(バイナリ)

emSSL:ビルド・動作確認方法

プロジェクト設定では「\Application\_Exclude\SSL」フォルダはビルド対象外に設定しています。

「\_Exclude\SSL」フォルダ下の動作確認を行うテストサンプルファイルをビルド対象設定の「\Application」フォルダ下にコピーします。
プロジェクトを再ビルドし、評価ボードに接続してデバッグセッションを開始します。
デバッガのIOコンソールのログ画面から結果を確認します。

テストレポート(emSSL)

Sample: SSL_OS_Scan

File: SSL_OS_Scan.c (サーバーIPアドレス設定)

#define HOST         "www.google.co.jp"
#define PORT         443

Debug IO Console:

2:024 IP_Task - DHCPc: Sending Request.
2:033 IP_Task - DHCPc: IFace 0: Using IP: 192.168.1.12, Mask: 255.255.255.0, GW: 192.168.1.1.
2:052 MAIN_TASK - Scanning cipher suites on www.google.co.jp:443
2:078 MAIN_TASK - C008  TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA         Received Handshake Failure alert
2:340 MAIN_TASK - C009  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA          TLS 1.2   204 ms processing,    57 ms socket,   261 ms total
2:352 MAIN_TASK - C023  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256       Received Handshake Failure alert
2:368 MAIN_TASK - C0AC  TLS_ECDHE_ECDSA_WITH_AES_128_CCM              Received Handshake Failure alert
2:379 MAIN_TASK - C0AE  TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8            Received Handshake Failure alert
2:639 MAIN_TASK - C02B  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256       TLS 1.2   205 ms processing,    54 ms socket,   259 ms total
2:898 MAIN_TASK - C00A  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA          TLS 1.2   205 ms processing,    53 ms socket,   258 ms total
2:911 MAIN_TASK - C024  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384       Received Handshake Failure alert
2:923 MAIN_TASK - C0AD  TLS_ECDHE_ECDSA_WITH_AES_256_CCM              Received Handshake Failure alert
2:935 MAIN_TASK - C0AF  TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8            Received Handshake Failure alert
3:198 MAIN_TASK - C02C  TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384       TLS 1.2   205 ms processing,    57 ms socket,   262 ms total
3:211 MAIN_TASK - C048  TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256      Received Handshake Failure alert
3:233 MAIN_TASK - C05C  TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256      Received Handshake Failure alert
3:257 MAIN_TASK - C049  TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384      Received Handshake Failure alert
3:272 MAIN_TASK - C05D  TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384      Received Handshake Failure alert
3:285 MAIN_TASK - C072  TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256  Received Handshake Failure alert
3:308 MAIN_TASK - C086  TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256  Received Handshake Failure alert
3:323 MAIN_TASK - C073  TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384  Received Handshake Failure alert
3:338 MAIN_TASK - C087  TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384  Received Handshake Failure alert
3:356 MAIN_TASK - C007  TLS_ECDHE_ECDSA_WITH_RC4_128_SHA              Received Handshake Failure alert
3:613 MAIN_TASK - CCA9  TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS 1.2   202 ms processing,    54 ms socket,   256 ms total
3:624 MAIN_TASK - C012  TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA           Received Handshake Failure alert
3:830 MAIN_TASK - C013  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA            TLS 1.2   150 ms processing,    55 ms socket,   205 ms total
3:844 MAIN_TASK - C027  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256         Received Handshake Failure alert
4:048 MAIN_TASK - C02F  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256         TLS 1.2   148 ms processing,    55 ms socket,   203 ms total
4:249 MAIN_TASK - C014  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA            TLS 1.2   149 ms processing,    51 ms socket,   200 ms total
4:271 MAIN_TASK - C028  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384         Received Handshake Failure alert
4:481 MAIN_TASK - C030  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384         TLS 1.2   150 ms processing,    59 ms socket,   209 ms total
4:492 MAIN_TASK - C04C  TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256        Received Handshake Failure alert
4:505 MAIN_TASK - C060  TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256        Received Handshake Failure alert
4:521 MAIN_TASK - C04D  TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384        Received Handshake Failure alert
4:533 MAIN_TASK - C061  TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384        Received Handshake Failure alert
4:548 MAIN_TASK - C076  TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256    Received Handshake Failure alert
4:566 MAIN_TASK - C08A  TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256    Received Handshake Failure alert
4:582 MAIN_TASK - C077  TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384    Received Handshake Failure alert
4:593 MAIN_TASK - C08B  TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384    Received Handshake Failure alert
4:608 MAIN_TASK - C011  TLS_ECDHE_RSA_WITH_RC4_128_SHA                Received Handshake Failure alert
4:826 MAIN_TASK - CCA8  TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256   TLS 1.2   149 ms processing,    68 ms socket,   217 ms total
4:848 MAIN_TASK - C002  TLS_ECDH_ECDSA_WITH_RC4_128_SHA               Received Handshake Failure alert
4:863 MAIN_TASK - C003  TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA          Received Handshake Failure alert
4:878 MAIN_TASK - C004  TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA           Received Handshake Failure alert
4:893 MAIN_TASK - C025  TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256        Received Handshake Failure alert
4:906 MAIN_TASK - C02D  TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256        Received Handshake Failure alert
4:918 MAIN_TASK - C005  TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA           Received Handshake Failure alert
4:932 MAIN_TASK - C026  TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384        Received Handshake Failure alert
4:948 MAIN_TASK - C02E  TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384        Received Handshake Failure alert
4:961 MAIN_TASK - C04A  TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256       Received Handshake Failure alert
4:979 MAIN_TASK - C05E  TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256       Received Handshake Failure alert
4:994 MAIN_TASK - C04B  TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384       Received Handshake Failure alert
5:010 MAIN_TASK - C05F  TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384       Received Handshake Failure alert
5:025 MAIN_TASK - C074  TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256   Received Handshake Failure alert
5:037 MAIN_TASK - C088  TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256   Received Handshake Failure alert
5:047 MAIN_TASK - C075  TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384   Received Handshake Failure alert
5:068 MAIN_TASK - C089  TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384   Received Handshake Failure alert
5:082 MAIN_TASK - C00D  TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA            Received Handshake Failure alert
5:094 MAIN_TASK - C00E  TLS_ECDH_RSA_WITH_AES_128_CBC_SHA             Received Handshake Failure alert
5:107 MAIN_TASK - C029  TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256          Received Handshake Failure alert
5:118 MAIN_TASK - C031  TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256          Received Handshake Failure alert
5:130 MAIN_TASK - C00F  TLS_ECDH_RSA_WITH_AES_256_CBC_SHA             Received Handshake Failure alert
5:142 MAIN_TASK - C02A  TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384          Received Handshake Failure alert
5:154 MAIN_TASK - C032  TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384          Received Handshake Failure alert
5:165 MAIN_TASK - C04E  TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256         Received Handshake Failure alert
5:181 MAIN_TASK - C062  TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256         Received Handshake Failure alert
5:194 MAIN_TASK - C04F  TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384         Received Handshake Failure alert
5:206 MAIN_TASK - C063  TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384         Received Handshake Failure alert
5:221 MAIN_TASK - C078  TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256     Received Handshake Failure alert
5:240 MAIN_TASK - C08C  TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256     Received Handshake Failure alert
5:255 MAIN_TASK - C079  TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384     Received Handshake Failure alert
5:270 MAIN_TASK - C08D  TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384     Received Handshake Failure alert
5:298 MAIN_TASK - C00C  TLS_ECDH_RSA_WITH_RC4_128_SHA                 Received Handshake Failure alert
5:409 MAIN_TASK - 000A  TLS_RSA_WITH_3DES_EDE_CBC_SHA                 TLS 1.2    55 ms processing,    55 ms socket,   110 ms total
5:421 MAIN_TASK - 0096  TLS_RSA_WITH_SEED_CBC_SHA                     Received Handshake Failure alert
5:530 MAIN_TASK - 002F  TLS_RSA_WITH_AES_128_CBC_SHA                  TLS 1.2    53 ms processing,    55 ms socket,   108 ms total
5:546 MAIN_TASK - 003C  TLS_RSA_WITH_AES_128_CBC_SHA256               Received Handshake Failure alert
5:558 MAIN_TASK - C09C  TLS_RSA_WITH_AES_128_CCM                      Received Handshake Failure alert
5:682 MAIN_TASK - 009C  TLS_RSA_WITH_AES_128_GCM_SHA256               TLS 1.2    53 ms processing,    70 ms socket,   123 ms total
5:796 MAIN_TASK - 0035  TLS_RSA_WITH_AES_256_CBC_SHA                  TLS 1.2    54 ms processing,    59 ms socket,   113 ms total
5:819 MAIN_TASK - 003D  TLS_RSA_WITH_AES_256_CBC_SHA256               Received Handshake Failure alert
5:844 MAIN_TASK - C09D  TLS_RSA_WITH_AES_256_CCM                      Received Handshake Failure alert
5:964 MAIN_TASK - 009D  TLS_RSA_WITH_AES_256_GCM_SHA384               TLS 1.2    55 ms processing,    64 ms socket,   119 ms total
5:980 MAIN_TASK - 0041  TLS_RSA_WITH_CAMELLIA_128_CBC_SHA             Received Handshake Failure alert
5:995 MAIN_TASK - 0084  TLS_RSA_WITH_CAMELLIA_256_CBC_SHA             Received Handshake Failure alert
6:020 MAIN_TASK - 00BA  TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256          Received Handshake Failure alert
6:043 MAIN_TASK - 00C0  TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256          Received Handshake Failure alert
6:059 MAIN_TASK - C07A  TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256          Received Handshake Failure alert
6:081 MAIN_TASK - C07B  TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384          Received Handshake Failure alert
6:097 MAIN_TASK - C03C  TLS_RSA_WITH_ARIA_128_CBC_SHA256              Received Handshake Failure alert
6:109 MAIN_TASK - C03D  TLS_RSA_WITH_ARIA_256_CBC_SHA384              Received Handshake Failure alert
6:121 MAIN_TASK - C050  TLS_RSA_WITH_ARIA_128_GCM_SHA256              Received Handshake Failure alert
6:138 MAIN_TASK - C051  TLS_RSA_WITH_ARIA_256_GCM_SHA384              Received Handshake Failure alert
6:153 MAIN_TASK - 0004  TLS_RSA_WITH_RC4_128_MD5                      Received Handshake Failure alert
6:169 MAIN_TASK - 0005  TLS_RSA_WITH_RC4_128_SHA                      Received Handshake Failure alert
6:171 MAIN_TASK - 
15 common cipher suites out of 92 tested

Sample: SSL_OS_SimpleWebClient

HOST: https://www.segger.com/emssl-testpage.php

Debug IO Console:

2:024 IP_Task - DHCPc: Sending Request.
2:033 IP_Task - DHCPc: IFace 0: Using IP: 192.168.1.12, Mask: 255.255.255.0, GW: 192.168.1.1.
3:711 MAIN_TASK - Data: HTTP/1.1 200 OK..date: Wed, 03 Apr 2024 07:01:15 GMT..server: Apache..vary: Accept-Encoding..x-xss-protection: 1; mode=block..x-content-type-options: nosniff..x-ua-compatible: IE=edge..content-type: text/html; charset=UTF-8..strict-transport-security: max
3:712 MAIN_TASK - Data: -age=31536000; includeSubDomains; preload;..connection: close....Welcome to www.segger.com/emssl-testpage.php!...Successfully connected via SSL...Current date is 2024-04-03...Current time is 09:01:15..
3:714 MAIN_TASK - Data received, socket closed: done

Sample: SSL_OS_SimpleWebServer

Debug IO Console:

2:024 IP_Task - DHCPc: Sending Request.
2:034 IP_Task - DHCPc: IFace 0: Using IP: 192.168.1.12, Mask: 255.255.255.0, GW: 192.168.1.1.
2:053 MAIN_TASK - Awaiting connection
58:956 MAIN_TASK - Connection made, attempting to upgrade to secure
59:123 MAIN_TASK - Session is now secured, cipher suite follows
59:124 MAIN_TASK - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
59:131 MAIN_TASK - Session closed
59:132 MAIN_TASK - Awaiting connection

PC WebServer: https://192.168.1.12

emSSL WebServer

emSSH:SSH セキュアログイン

テストサンプル

SSH(Server) Application Folder: → \Application\_Exclude\SSH

Application
 └ _Exclude
     ├ SSH  ....... emSSHライブラリのデモサンプル
Sample説明
SSH_SCP_FS_ServerSSH SCPサーバーのデモサンプル(ファイルシステムが必要です)
SSH_Shell1SSHサーバー実装方法を示す簡単なサンプル(入力文字データをECHOします)
SSH_Shell6複数クライアント接続をサポートするSSHサーバーの実装事例

関連設定ファイル(emSSH):

Config
 |- SSH_Conf.h  ........ SSHコンフィグレーション設定ファイル(マクロ定義)
 |- SSH_X_Config.c  .... SSHコンフィグレーション設定ファイル(初期化設定)
 |- IO
 |   |- SSH_ConfigIO.c  ..... デバッグコンソールIOインターフェース設定ファイル
 |
 |- OS
 |   |- libFreeRT_OSLayer_RXv3_L.lib  ..... OSインターフェース設定ファイル
 |
 |- Keys   .................. テスト用鍵データ設定ファイル
     |- SSH_ServerKeys_DSA.c
     |- SSH_ServerKeys_ECDSA.c
     |- SSH_ServerKeys_EdDSA.c
     |- SSH_ServerKeys_RSA.c

emSSH:ビルド・動作確認方法

プロジェクト設定では「\Application\_Exclude\SSH」フォルダはビルド対象外に設定しています。

「\_Exclude\SSH」フォルダ下の動作確認を行うテストサンプルファイルをビルド対象設定の「\Application」フォルダ下にコピーします。
プロジェクトを再ビルドし、評価ボードに接続してデバッグセッションを開始します。
デバッガのIOコンソールのログ画面から結果を確認します。

テスト環境の設定:

評価ボードのLANポートをテスト用パソコンに接続して、TCP/IPネットワーク通信が正常にできることを確認してください。

PC Setup

テストレポート(emSSH)

Sample: SSH_Shell1 (Echo Test)

Debug IO Console:

4:024 IP_Task - DHCPc: Sending Request.
4:034 IP_Task - DHCPc: IFace 0: Using IP: 192.168.1.12, Mask: 255.255.255.0, GW: 192.168.1.1.

emSSH V2.54 - Shell1 compiled Apr  3 2024 16:19:18
Copyright (c) 2015-2021 SEGGER Microcontroller GmbH    www.segger.com

PC TeraTerm SSH Client (User name: anon / Password: 無し):

emSSH Client TeraTerm

Windows MS-DOSプロンプトからの確認の場合:

emSSH Client Cmdline
前の章

MODBUS通信(TCP、RS232経由)

次の章

暗号・サイファーライブラリ