Re: bouncycastle pskserver error

You said you ran PSKTlsClientTest against the TlsServerTest code. I
tested this here and it worked fine (after changing address, port,
psk_identity, psk). You could also begin with TlsPSKProtocolTest as a
working client/server test.

Also, for me your test negotiates
TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 (which uses TlsAEADCipher),
not a block cipher (TlsBlockCipher), so I guess you have made other
changes which you did not mention; this makes it difficult to know what
the issue is.

'useExplicitIV' should be (and is) true for both TLS 1.1 and TLS 1.2, so
no, your understanding is not correct. Even so, it is very strange if
setting it to false makes your test work. I suggest you double-check
your test results.

If you're still seeing the error, please post the complete test classes
you are using.

Regards,
Pete Dettman


On 3/5/19 10:01 pm, kiranmayi boyapati wrote:
> Hi,
> 
> Yes we changed the PSK identities to match on both sides. When i run it
> in debug mode, i figured out that in "TlsBlockCipher" class
> "useExplicitIV" flag is becoming true which should be false for TLS1.2
> as i understand.
> 
> If i change that parameter to false in the class and run the test,
> client is successfully connecting to the server.
> 
> When i dive deep to understand under what conditions the flag will be
> true - found that for TLS 1.1 it should be true, but i am using TLS 1.2
> still it is set to true.
> 
> Can some one help me to verify if my understanding is correct?
> 
> kiran
> 
> On Fri, May 3, 2019 at 5:02 PM Peter Dettman
> <[email protected] <mailto:[email protected]>>
> wrote:
> 
>     Presumably you need to modify the psk_identity/psk in PSKTlsClientTest
>     to match the (only) configured PSK for MockPSKTlsServer (see the inner
>     class MyIdentityManager in MockPSKTlsServer).
> 
>     PSKTlsClientTest changes (lines 38-39):
> 
>             String psk_identity = "client";
>             byte[] psk = new byte[16];
> 
>     Regards,
>     Pete Dettman
> 
>     On 3/5/19 4:29 pm, Sukawanth psr wrote:
>     > I am trying to write PSKServer to use PSK ciphers in bouncycastle.
>     >
>     > Attached is the PSK server we wrote. And we are using
>     > org.bouncycastle.tls.test.PSKTlsClientTest as client for testing.
>     >
>     > I see below error while tls handshake.
>     >
>     > I am using 1.6.1 version.
>     >
>     > org.bouncycastle.tls.TlsFatalAlert: bad_record_mac(20)
>