Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for ECC profiles #2398

Open
wants to merge 64 commits into
base: master
Choose a base branch
from
+7,559 −1,260
Open

Add support for ECC profiles #2398

Show file tree
Hide file tree
Changes from 56 commits
Commits
Show all changes
64 commits
Select commit Hold shift + click to select a range
294192f
Squash proto ecc (#1998)
mregen Nov 18, 2022
fd3fcd1
clean a few warning
mregen Nov 18, 2022
dee6088
Instantiate HMAC instance depending on provided algorithm.
mrsuciu Feb 13, 2023
b17271c
fix build
mregen Mar 13, 2023
d63925f
Added ApplicationCertificates XML tag (bcw compat)
mrsuciu Jun 27, 2023
5b1fe70
Use ListOfCertificateIdentifier for configuration
mrsuciu Aug 3, 2023
ab6d8fb
Use ApplicationCertificates tag
mrsuciu Aug 18, 2023
d23450d
Added new Interface AddSecurityConfiguration(
mrsuciu Sep 18, 2023
8fc81d3
Reenabled special cases in ValidateCertificateType
mrsuciu Sep 27, 2023
b1cd86e
Use KeySize property value if set under IsECSecureForProfile method
mrsuciu Sep 27, 2023
108f7ed
Check minimKeySize for ApplicationCertificates
mrsuciu Oct 3, 2023
9a25264
Keep and mark as obsolete ApplicationInstance methods for bacword compat
mrsuciu Oct 4, 2023
a2e0a4b
Fix CfgManager UpdateCertificate()
mrsuciu Oct 4, 2023
a0e4b0f
Added missing interface implementation
mrsuciu Oct 9, 2023
97b4c87
Added CertificateTypeString to improve visual appearance
mrsuciu Oct 9, 2023
9efe4a7
Commented ECCUtils code
mrsuciu Oct 10, 2023
a01d276
Corrected ConsoleRefClient Configuration
mrsuciu Oct 10, 2023
f165dee
net48 has null Oid values for Brainpool curves
mrsuciu Oct 11, 2023
0b6d74f
Merge branch 'workeccV1' of https://github.com/mrsuciu/UA-.NETStandar…
mrsuciu Oct 11, 2023
58f583b
Updated tests to new API
mrsuciu Oct 11, 2023
453ad95
Default certificate type for "old" style configuration is RsaSha256Ap…
mrsuciu Oct 12, 2023
11f3085
SemaphoreSlim is not reentrant => removed from ResetValidatedCertific…
mrsuciu Oct 12, 2023
48cce5c
Fixed loading of disposed cached certificates
mrsuciu Oct 16, 2023
1ada020
Modified projects to correctly use ECC_SUPPORT flag
mrsuciu Oct 20, 2023
c7ebfe1
Handle EphemerousKey from Server side
mrsuciu Oct 20, 2023
e62ad97
Added minimal test
mrsuciu Oct 20, 2023
1a8ab07
Added UserIdentityToken Encypt/Decrypt functionality
mrsuciu Nov 9, 2023
0ed43b9
Preserve key material in UserIdentityToken encryption/decription
mrsuciu Nov 10, 2023
f41f10a
Removed ECC support from NETSTANDARD2_0 (introduced bu UserIdentityEn…
mrsuciu Nov 15, 2023
c6a10d7
Added UserIdentity encryption positive roundtrip unit tests
mrsuciu Nov 15, 2023
57a79fb
Propagated clientIssuerCertificates to UserIdentityToken encryption
mrsuciu Nov 16, 2023
f37a392
Save the userTokenSecurityPolicyUri per Session (needed in reconnect)
mrsuciu Nov 16, 2023
2c4d446
Added FindUserTokenPolicy methods which support providing tokenSecuri…
mrsuciu Nov 21, 2023
7f00e7a
Added eccServerEphemeralKeu to saved session secrets
mrsuciu Nov 23, 2023
fd2bae7
Merged conflicts and addapted code
mrsuciu Nov 23, 2023
89be8d6
Addapt code to merge changes
mrsuciu Nov 23, 2023
8beb595
Added ReentrantSlimSemaphore
mrsuciu Nov 24, 2023
1e579b1
Added EccProfiles.md
mrsuciu Nov 27, 2023
0146322
merge master
mregen Dec 20, 2023
d1aa4e9
improve project setup for ECC
mregen Dec 20, 2023
0fc78b0
Merge with master
mrsuciu Jan 12, 2024
f009283
Merge remote-tracking branch 'origin/master' into ecc_support
mregen Feb 11, 2024
c500a6d
merge master
mregen Feb 14, 2024
46e17f8
merge master
mregen Feb 27, 2024
870dbc7
fix build
mregen Feb 27, 2024
145bfdd
Merge remote-tracking branch 'origin/master' into ecc_support
mregen Mar 11, 2024
1447154
Removed unused code and corrected some
mrsuciu Mar 15, 2024
5506269
ECC cert fixes
mregen Mar 15, 2024
d737c52
fix when app cert can not be loaded due to lack of trust or CRL
mregen Mar 15, 2024
0d03fa0
fix a merge conflict (includes releaxed validator for cert loading)
mregen Mar 15, 2024
ba26d64
fix semaphore hang
mregen Mar 15, 2024
3306aa9
fix CertificateTypes Provider & CertificateFactory
romanett Mar 31, 2024
84873bf
client session assync initialize
mrsuciu Apr 2, 2024
5fdc79d
Deprecated Utils.Nonce
mrsuciu Apr 2, 2024
058cb96
Simplify Nonce.CreateNonce method, added NonceTests UnitTest
mrsuciu Apr 4, 2024
55c97b0
Removed #if ECC_SUPPORT conditional compilation statements related to…
mrsuciu Apr 4, 2024
5760ac7
Move async code out of the constructor
mrsuciu Apr 19, 2024
a3d1469
Implemented SetECDsaPublicKey, ReentrantSemaphoreSlim removed
mrsuciu May 17, 2024
7bcce20
Merge with latest master
mrsuciu May 21, 2024
c53858e
Added MaxChannelCount of 100 to ServerFixture
mrsuciu May 22, 2024
303c7b1
Set version 1.5.375-ECC-preview
mrsuciu May 22, 2024
2f4aef0
Removed ECDsaCng validation for ECDsa (OS platform dependent)
mrsuciu May 24, 2024
cff0414
fix CreateNonce function for invalid input data
romanett May 24, 2024
c1a9fd2
ignore test on OSX
romanett May 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion Applications/ClientControls.Net4/UA Client Controls.csproj
View file
Open in desktop
Expand Up @@ -1054,4 +1054,4 @@
<PreBuildEvent>
</PreBuildEvent>
</PropertyGroup>
</Project>
</Project>
2 changes: 1 addition & 1 deletion Applications/ConsoleReferenceClient/Program.cs
View file
Open in desktop
Expand Up @@ -159,7 +159,7 @@ public static async Task Main(string[] args)
}

// check the application certificate.
bool haveAppCertificate = await application.CheckApplicationInstanceCertificate(false, minimumKeySize: 0).ConfigureAwait(false);
bool haveAppCertificate = await application.CheckApplicationInstanceCertificates(false).ConfigureAwait(false);
if (!haveAppCertificate)
{
throw new ErrorExitException("Application instance certificate invalid!", ExitCode.ErrorCertificate);
Expand Down
45 changes: 38 additions & 7 deletions Applications/ConsoleReferenceClient/Quickstarts.ReferenceClient.Config.xml
View file
Open in desktop
Expand Up @@ -12,13 +12,44 @@
<SecurityConfiguration>

<!-- Where the application instance certificate is stored (MachineDefault) -->
<ApplicationCertificate>
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<SubjectName>CN=Console Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
</ApplicationCertificate>

<!-- Where the issuer certificate are stored (certificate authorities) -->
<ApplicationCertificates>
<CertificateIdentifier>
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>RsaSha256</CertificateTypeString>
</CertificateIdentifier>
<CertificateIdentifier>
<!-- <TypeId>NistP256</TypeId> -->
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>NistP256</CertificateTypeString>
</CertificateIdentifier>
<CertificateIdentifier>
<!-- <TypeId>NistP384</TypeId> -->
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<SubjectName>CN=Quickstart Reference client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>NistP384</CertificateTypeString>
</CertificateIdentifier>
<CertificateIdentifier>
<!-- <TypeId>BrainpoolP256r1</TypeId> -->
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>BrainpoolP256r1</CertificateTypeString>
</CertificateIdentifier>
<CertificateIdentifier>
<!-- <TypeId>BrainpoolP384r1</TypeId> -->
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>BrainpoolP384r1</CertificateTypeString>
</CertificateIdentifier>
</ApplicationCertificates>

<!-- Where the issuer certificate are stored (certificate authorities) -->
<TrustedIssuerCertificates>
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/issuer</StorePath>
Expand Down
93 changes: 80 additions & 13 deletions Applications/ConsoleReferenceServer/Quickstarts.ReferenceServer.Config.xml
View file
Open in desktop
Expand Up @@ -4,19 +4,52 @@
xmlns:ua="http://opcfoundation.org/UA/2008/02/Types.xsd"
xmlns="http://opcfoundation.org/UA/SDK/Configuration.xsd"
>
<!-- xsi:schemaLocation="http://opcfoundation.org/UA/SDK/Configuration.xsd ./Configuration.xsd" -->
<ApplicationName>Quickstart Reference Server</ApplicationName>
<ApplicationUri>urn:localhost:UA:Quickstarts:ReferenceServer</ApplicationUri>
<ProductUri>uri:opcfoundation.org:Quickstarts:ReferenceServer</ProductUri>
<ApplicationType>Server_0</ApplicationType>

<SecurityConfiguration>
<!-- Which certificate types are supported -->
<ApplicationCertificates>
<CertificateIdentifier>
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Server, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>RsaSha256</CertificateTypeString>
</CertificateIdentifier>
<CertificateIdentifier>
<!-- <TypeId>NistP256</TypeId> -->
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Server, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>NistP256</CertificateTypeString>
</CertificateIdentifier>
<CertificateIdentifier>
<!-- <TypeId>NistP384</TypeId> -->
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Server, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>NistP384</CertificateTypeString>
</CertificateIdentifier>
<CertificateIdentifier>
<!-- <TypeId>BrainpoolP256r1</TypeId> -->
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Server, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>BrainpoolP256r1</CertificateTypeString>
</CertificateIdentifier>
<CertificateIdentifier>
<!-- <TypeId>BrainpoolP384r1</TypeId> -->
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Server, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>BrainpoolP384r1</CertificateTypeString>
</CertificateIdentifier>
</ApplicationCertificates>

<!-- Where the application instance certificate is stored (MachineDefault) -->
<ApplicationCertificate>
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Server, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
</ApplicationCertificate>
<!-- Where the other application certificates are stored -->

<!-- Where the issuer certificate are stored (certificate authorities) -->
<TrustedIssuerCertificates>
Expand Down Expand Up @@ -45,6 +78,7 @@
<RejectSHA1SignedCertificates>true</RejectSHA1SignedCertificates>
<RejectUnknownRevocationStatus>true</RejectUnknownRevocationStatus>
<MinimumCertificateKeySize>2048</MinimumCertificateKeySize>
<MinimumECCertificateKeySize>256</MinimumECCertificateKeySize>
<AddAppCertToTrustedStore>false</AddAppCertToTrustedStore>
<SendCertificateChain>true</SendCertificateChain>

Expand Down Expand Up @@ -96,14 +130,11 @@
</AlternateBaseAddresses>
-->
<SecurityPolicies>
<!-- the first policy is used for the https endpoint -->
<ServerSecurityPolicy>
<SecurityMode>SignAndEncrypt_3</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256</SecurityPolicyUri>
</ServerSecurityPolicy>
<ServerSecurityPolicy>
<SecurityMode>None_1</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#None</SecurityPolicyUri>
</ServerSecurityPolicy>
<ServerSecurityPolicy>
<SecurityMode>Sign_2</SecurityMode>
<SecurityPolicyUri></SecurityPolicyUri>
Expand All @@ -112,7 +143,43 @@
<SecurityMode>SignAndEncrypt_3</SecurityMode>
<SecurityPolicyUri></SecurityPolicyUri>
</ServerSecurityPolicy>
<!-- deprecated security policies for reference only
<ServerSecurityPolicy>
<SecurityMode>Sign_2</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256</SecurityPolicyUri>
</ServerSecurityPolicy>
<ServerSecurityPolicy>
<SecurityMode>Sign_2</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP384</SecurityPolicyUri>
</ServerSecurityPolicy>
<ServerSecurityPolicy>
<SecurityMode>Sign_2</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP256r1</SecurityPolicyUri>
</ServerSecurityPolicy>
<ServerSecurityPolicy>
<SecurityMode>Sign_2</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP384r1</SecurityPolicyUri>
</ServerSecurityPolicy>
<ServerSecurityPolicy>
<SecurityMode>SignAndEncrypt_3</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256</SecurityPolicyUri>
</ServerSecurityPolicy>
<ServerSecurityPolicy>
<SecurityMode>SignAndEncrypt_3</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP384</SecurityPolicyUri>
</ServerSecurityPolicy>
<ServerSecurityPolicy>
<SecurityMode>SignAndEncrypt_3</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP256r1</SecurityPolicyUri>
</ServerSecurityPolicy>
<ServerSecurityPolicy>
<SecurityMode>SignAndEncrypt_3</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP384r1</SecurityPolicyUri>
</ServerSecurityPolicy>
<ServerSecurityPolicy>
<SecurityMode>None_1</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#None</SecurityPolicyUri>
</ServerSecurityPolicy>
<!-- deprecated security policies for reference only -->
<ServerSecurityPolicy>
<SecurityMode>Sign_2</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic256</SecurityPolicyUri>
Expand All @@ -129,7 +196,7 @@
<SecurityMode>SignAndEncrypt_3</SecurityMode>
<SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15</SecurityPolicyUri>
</ServerSecurityPolicy>
-->
<!-- -->
</SecurityPolicies>

<MinRequestThreadCount>5</MinRequestThreadCount>
Expand Down Expand Up @@ -239,7 +306,7 @@
</SupportedPrivateKeyFormats>
<MaxTrustListSize>0</MaxTrustListSize>
<MultiCastDnsEnabled>false</MultiCastDnsEnabled>

<!-- Reverse connection parameters for aggregation server sample -->
<!--
<ReverseConnect>
Expand Down
2 changes: 1 addition & 1 deletion Applications/ConsoleReferenceServer/UAServer.cs
View file
Open in desktop
Expand Up @@ -101,7 +101,7 @@ public async Task CheckCertificateAsync(bool renewCertificate)
}

// check the application certificate.
bool haveAppCertificate = await m_application.CheckApplicationInstanceCertificate(false, minimumKeySize: 0).ConfigureAwait(false);
bool haveAppCertificate = await m_application.CheckApplicationInstanceCertificates(false).ConfigureAwait(false);
if (!haveAppCertificate)
{
throw new ErrorExitException("Application instance certificate invalid!");
Expand Down
2 changes: 1 addition & 1 deletion Applications/ReferenceClient/Program.cs
View file
Open in desktop
Expand Up @@ -60,7 +60,7 @@ static void Main()
application.LoadApplicationConfiguration(false).Wait();

// check the application certificate.
var certOK = application.CheckApplicationInstanceCertificate(false, 0).Result;
var certOK = application.CheckApplicationInstanceCertificates(false).Result;
if (!certOK)
{
throw new Exception("Application instance certificate invalid!");
Expand Down
2 changes: 1 addition & 1 deletion Applications/ReferenceServer/Program.cs
View file
Open in desktop
Expand Up @@ -66,7 +66,7 @@ static void Main()
SerilogTraceLogger.Create(loggerConfiguration, config);

// check the application certificate.
bool certOk = application.CheckApplicationInstanceCertificate(false, 0).Result;
bool certOk = application.CheckApplicationInstanceCertificates(false).Result;
if (!certOk)
{
throw new Exception("Application instance certificate invalid!");
Expand Down
2 changes: 1 addition & 1 deletion Applications/ServerControls.Net4/UA Server Controls.csproj
View file
Open in desktop
Expand Up @@ -170,4 +170,4 @@
<PostBuildEvent>
</PostBuildEvent>
</PropertyGroup>
</Project>
</Project>