ECDHE-PSK mbedTLS example?

Question

I'm trying to figure out how to use mbedTLS (formerly PolarSSL) to perform ECDHE-PSK encryption between two peers. Unfortunately, there isn't any article/documentation whatsoever on APIs that I need to use?

Answer 1

ECDHE-PSK is a key exchange method used in TLS. You should first have a look at the mbed TLS TLS tutorial.

Then you need to configure the pre-shared key on both ends. This usually involves using mbedtls_ssl_conf_psk() client-side and, though the same function could in theory be used server-side too if you only expect to communicate with a single client, in practice most of the time you'll want to use mbedtls_ssl_conf_psk_cb() to set up a callback function that will select the appropriate pre-shared key for each client.

You also need to adjust the list of allowed ciphersuites. This can be done at runtime using mbedtls_ssl_conf_ciphersuites(). Alternatively, if you know you'll only use ECDHE-PSK, you can customize your build to disable all other key exchanges, which will also minimize your footprint.

Finally, you can find fully working examples of doing TLS with various ciphersuites, including based on ECDHE-PSK in the mbed TLS distribution as ssl_client2.c and ssl_server2.c. You can check how the functions mentioned above are used in the examples, and in particular you'll find an example of server-side PSK callback.