paho.mqtt.python TLS-PSK

Hi, How do I configure TLS-PSK for use with paho.mqtt.python? tls_set does not have arguments for PSK options.

Dec 17 '19 11:12 ebm539

You can try SSLContext() API derivated from sspsk package, see https://github.com/drbild/sslpsk/issues/19 in some way like this:

context = SSLPSKContext(ssl.PROTOCOL_TLS)
context.set_ciphers('PSK')
context.psk = (b'1234', bytes("1234", encoding="utf-8"))
client.tls_set_context(context)

It works for me with an additional patch for sslpsk to work with python3.8

Jul 23 '20 19:07 gennadykr

Hello @gennadykr could you share your patch to sslpsk? I tried this and drbild/sslpsk#19 with https://github.com/autinerd/sslpsk2 which works with 3.8, but no success.

Oct 08 '20 10:10 pavel-ch

Hello @pavel-ch , this is not a patch but steps how I use this. I change sslpsk just to let it work with python 3.8. Then I place the code suggested in drbild/sslpsk#19 in my script file.

Dockerfile part:

FROM ubuntu
RUN apt-get update \
    && apt-get install --assume-yes --no-install-recommends \
    python3 python3-pip python3-venv \
    build-essential libssl-dev python3-dev \
    && apt-get clean

requirements part

sslpsk
paho-mqtt

Another Dockerfile part

RUN sed -i "s|sys.version_info >= (3, 5)|sys.version_info == (3, 5)|g" \
    /usr/local/lib/python3.8/dist-packages/sslpsk/sslpsk.py

A Python script parts

import:

import paho.mqtt.client as mqtt
import ssl
from sslpsk.sslpsk import _ssl_set_psk_server_callback, _ssl_set_psk_client_callback

drbild/sslpsk#19 part with SSLPSKContext re-definition
using this SSLPSKContex:

context = SSLPSKContext(ssl.PROTOCOL_TLS)
context.set_ciphers('PSK')
context.psk = (b'1234', bytes("1234", encoding="utf-8"))
client = mqtt.Client(...)
client.tls_set_context(context)

Oct 08 '20 14:10 gennadykr

Hello Gennady thank you, this looks like an equivalent of what I did with sslpsk2. I was getting ssl3 handshake error, maybe I am wrong with setting psk. How your mosquitto (I guess you use it) config and psk files look like? How it corresponds with psk tuple? Thanks.

Oct 08 '20 15:10 pavel-ch

No, I didn't check it with mosquitto server. But I saw handshake problems and this is the reason I added context.set_ciphers('PSK') and tried to work with the more recent Python - otherwise it was unable to find PSK ciphers and failed with a handshake. What kind of ssl error did you see? Missed ciphers lead to TLSV1_ALERT_INSUFFICIENT_SECURITY error. I used print(context.get_ciphers()) to check presence of PSK ciphers.

Oct 08 '20 16:10 gennadykr

I am getting [SSL: SSLV3_ALERT_ILLEGAL_PARAMETER] sslv3 alert illegal parameter (_ssl.c:1108) when I have the mosquitto configured to 1234:1234 in mosquitto.psk file (identificatio:psk format), or [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1108) when mosquitto is not configured 'properly' I must look into the handshake, no clue why SSLV3 is chosen. print(context.get_ciphers()) returns a lot of ciphers: [{'id': 50336514, 'name': 'TLS_AES_256_GCM_SHA384', 'protocol': 'TLSv1.3', 'description': 'TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-gcm', 'digest': None, 'kea': 'kx-any', 'auth': 'auth-any'}, {'id': 50336515, 'name': 'TLS_CHACHA20_POLY1305_SHA256', 'protocol': 'TLSv1.3', 'description': 'TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-any', 'auth': 'auth-any'}, {'id': 50336513, 'name': 'TLS_AES_128_GCM_SHA256', 'protocol': 'TLSv1.3', 'description': 'TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-gcm', 'digest': None, 'kea': 'kx-any', 'auth': 'auth-any'}, {'id': 50331821, 'name': 'RSA-PSK-AES256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'RSA-PSK-AES256-GCM-SHA384 TLSv1.2 Kx=RSAPSK Au=RSA Enc=AESGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-gcm', 'digest': None, 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331819, 'name': 'DHE-PSK-AES256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'DHE-PSK-AES256-GCM-SHA384 TLSv1.2 Kx=DHEPSK Au=PSK Enc=AESGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-gcm', 'digest': None, 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50384046, 'name': 'RSA-PSK-CHACHA20-POLY1305', 'protocol': 'TLSv1.2', 'description': 'RSA-PSK-CHACHA20-POLY1305 TLSv1.2 Kx=RSAPSK Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50384045, 'name': 'DHE-PSK-CHACHA20-POLY1305', 'protocol': 'TLSv1.2', 'description': 'DHE-PSK-CHACHA20-POLY1305 TLSv1.2 Kx=DHEPSK Au=PSK Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50384044, 'name': 'ECDHE-PSK-CHACHA20-POLY1305', 'protocol': 'TLSv1.2', 'description': 'ECDHE-PSK-CHACHA20-POLY1305 TLSv1.2 Kx=ECDHEPSK Au=PSK Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50380971, 'name': 'DHE-PSK-AES256-CCM8', 'protocol': 'TLSv1.2', 'description': 'DHE-PSK-AES256-CCM8 TLSv1.2 Kx=DHEPSK Au=PSK Enc=AESCCM8(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-ccm', 'digest': None, 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50380967, 'name': 'DHE-PSK-AES256-CCM', 'protocol': 'TLSv1.2', 'description': 'DHE-PSK-AES256-CCM TLSv1.2 Kx=DHEPSK Au=PSK Enc=AESCCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-ccm', 'digest': None, 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50380911, 'name': 'RSA-PSK-ARIA256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'RSA-PSK-ARIA256-GCM-SHA384 TLSv1.2 Kx=RSAPSK Au=RSA Enc=ARIAGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aria-256-gcm', 'digest': None, 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50380909, 'name': 'DHE-PSK-ARIA256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'DHE-PSK-ARIA256-GCM-SHA384 TLSv1.2 Kx=DHEPSK Au=PSK Enc=ARIAGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aria-256-gcm', 'digest': None, 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331817, 'name': 'PSK-AES256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'PSK-AES256-GCM-SHA384 TLSv1.2 Kx=PSK Au=PSK Enc=AESGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-gcm', 'digest': None, 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50384043, 'name': 'PSK-CHACHA20-POLY1305', 'protocol': 'TLSv1.2', 'description': 'PSK-CHACHA20-POLY1305 TLSv1.2 Kx=PSK Au=PSK Enc=CHACHA20/POLY1305(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'chacha20-poly1305', 'digest': None, 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50380969, 'name': 'PSK-AES256-CCM8', 'protocol': 'TLSv1.2', 'description': 'PSK-AES256-CCM8 TLSv1.2 Kx=PSK Au=PSK Enc=AESCCM8(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-ccm', 'digest': None, 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50380965, 'name': 'PSK-AES256-CCM', 'protocol': 'TLSv1.2', 'description': 'PSK-AES256-CCM TLSv1.2 Kx=PSK Au=PSK Enc=AESCCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aes-256-ccm', 'digest': None, 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50380907, 'name': 'PSK-ARIA256-GCM-SHA384', 'protocol': 'TLSv1.2', 'description': 'PSK-ARIA256-GCM-SHA384 TLSv1.2 Kx=PSK Au=PSK Enc=ARIAGCM(256) Mac=AEAD', 'strength_bits': 256, 'alg_bits': 256, 'aead': True, 'symmetric': 'aria-256-gcm', 'digest': None, 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50331820, 'name': 'RSA-PSK-AES128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'RSA-PSK-AES128-GCM-SHA256 TLSv1.2 Kx=RSAPSK Au=RSA Enc=AESGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-gcm', 'digest': None, 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331818, 'name': 'DHE-PSK-AES128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'DHE-PSK-AES128-GCM-SHA256 TLSv1.2 Kx=DHEPSK Au=PSK Enc=AESGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-gcm', 'digest': None, 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50380970, 'name': 'DHE-PSK-AES128-CCM8', 'protocol': 'TLSv1.2', 'description': 'DHE-PSK-AES128-CCM8 TLSv1.2 Kx=DHEPSK Au=PSK Enc=AESCCM8(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-ccm', 'digest': None, 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50380966, 'name': 'DHE-PSK-AES128-CCM', 'protocol': 'TLSv1.2', 'description': 'DHE-PSK-AES128-CCM TLSv1.2 Kx=DHEPSK Au=PSK Enc=AESCCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-ccm', 'digest': None, 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50380910, 'name': 'RSA-PSK-ARIA128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'RSA-PSK-ARIA128-GCM-SHA256 TLSv1.2 Kx=RSAPSK Au=RSA Enc=ARIAGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aria-128-gcm', 'digest': None, 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50380908, 'name': 'DHE-PSK-ARIA128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'DHE-PSK-ARIA128-GCM-SHA256 TLSv1.2 Kx=DHEPSK Au=PSK Enc=ARIAGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aria-128-gcm', 'digest': None, 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331816, 'name': 'PSK-AES128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'PSK-AES128-GCM-SHA256 TLSv1.2 Kx=PSK Au=PSK Enc=AESGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-gcm', 'digest': None, 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50380968, 'name': 'PSK-AES128-CCM8', 'protocol': 'TLSv1.2', 'description': 'PSK-AES128-CCM8 TLSv1.2 Kx=PSK Au=PSK Enc=AESCCM8(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-ccm', 'digest': None, 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50380964, 'name': 'PSK-AES128-CCM', 'protocol': 'TLSv1.2', 'description': 'PSK-AES128-CCM TLSv1.2 Kx=PSK Au=PSK Enc=AESCCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aes-128-ccm', 'digest': None, 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50380906, 'name': 'PSK-ARIA128-GCM-SHA256', 'protocol': 'TLSv1.2', 'description': 'PSK-ARIA128-GCM-SHA256 TLSv1.2 Kx=PSK Au=PSK Enc=ARIAGCM(128) Mac=AEAD', 'strength_bits': 128, 'alg_bits': 128, 'aead': True, 'symmetric': 'aria-128-gcm', 'digest': None, 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50380856, 'name': 'ECDHE-PSK-AES256-CBC-SHA384', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-AES256-CBC-SHA384 TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha384', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50380854, 'name': 'ECDHE-PSK-AES256-CBC-SHA', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-AES256-CBC-SHA TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50331831, 'name': 'RSA-PSK-AES256-CBC-SHA384', 'protocol': 'TLSv1.0', 'description': 'RSA-PSK-AES256-CBC-SHA384 TLSv1 Kx=RSAPSK Au=RSA Enc=AES(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha384', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331827, 'name': 'DHE-PSK-AES256-CBC-SHA384', 'protocol': 'TLSv1.0', 'description': 'DHE-PSK-AES256-CBC-SHA384 TLSv1 Kx=DHEPSK Au=PSK Enc=AES(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha384', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331797, 'name': 'RSA-PSK-AES256-CBC-SHA', 'protocol': 'SSLv3', 'description': 'RSA-PSK-AES256-CBC-SHA SSLv3 Kx=RSAPSK Au=RSA Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331793, 'name': 'DHE-PSK-AES256-CBC-SHA', 'protocol': 'SSLv3', 'description': 'DHE-PSK-AES256-CBC-SHA SSLv3 Kx=DHEPSK Au=PSK Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50380955, 'name': 'ECDHE-PSK-CAMELLIA256-SHA384', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-CAMELLIA256-SHA384 TLSv1 Kx=ECDHEPSK Au=PSK Enc=Camellia(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'camellia-256-cbc', 'digest': 'sha384', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50380953, 'name': 'RSA-PSK-CAMELLIA256-SHA384', 'protocol': 'TLSv1.0', 'description': 'RSA-PSK-CAMELLIA256-SHA384 TLSv1 Kx=RSAPSK Au=RSA Enc=Camellia(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'camellia-256-cbc', 'digest': 'sha384', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50380951, 'name': 'DHE-PSK-CAMELLIA256-SHA384', 'protocol': 'TLSv1.0', 'description': 'DHE-PSK-CAMELLIA256-SHA384 TLSv1 Kx=DHEPSK Au=PSK Enc=Camellia(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'camellia-256-cbc', 'digest': 'sha384', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331823, 'name': 'PSK-AES256-CBC-SHA384', 'protocol': 'TLSv1.0', 'description': 'PSK-AES256-CBC-SHA384 TLSv1 Kx=PSK Au=PSK Enc=AES(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha384', 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50331789, 'name': 'PSK-AES256-CBC-SHA', 'protocol': 'SSLv3', 'description': 'PSK-AES256-CBC-SHA SSLv3 Kx=PSK Au=PSK Enc=AES(256) Mac=SHA1', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'aes-256-cbc', 'digest': 'sha1', 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50380949, 'name': 'PSK-CAMELLIA256-SHA384', 'protocol': 'TLSv1.0', 'description': 'PSK-CAMELLIA256-SHA384 TLSv1 Kx=PSK Au=PSK Enc=Camellia(256) Mac=SHA384', 'strength_bits': 256, 'alg_bits': 256, 'aead': False, 'symmetric': 'camellia-256-cbc', 'digest': 'sha384', 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50380855, 'name': 'ECDHE-PSK-AES128-CBC-SHA256', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha256', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50380853, 'name': 'ECDHE-PSK-AES128-CBC-SHA', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-AES128-CBC-SHA TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50331830, 'name': 'RSA-PSK-AES128-CBC-SHA256', 'protocol': 'TLSv1.0', 'description': 'RSA-PSK-AES128-CBC-SHA256 TLSv1 Kx=RSAPSK Au=RSA Enc=AES(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha256', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331826, 'name': 'DHE-PSK-AES128-CBC-SHA256', 'protocol': 'TLSv1.0', 'description': 'DHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=DHEPSK Au=PSK Enc=AES(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha256', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331796, 'name': 'RSA-PSK-AES128-CBC-SHA', 'protocol': 'SSLv3', 'description': 'RSA-PSK-AES128-CBC-SHA SSLv3 Kx=RSAPSK Au=RSA Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331792, 'name': 'DHE-PSK-AES128-CBC-SHA', 'protocol': 'SSLv3', 'description': 'DHE-PSK-AES128-CBC-SHA SSLv3 Kx=DHEPSK Au=PSK Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50380954, 'name': 'ECDHE-PSK-CAMELLIA128-SHA256', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-CAMELLIA128-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK Enc=Camellia(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'camellia-128-cbc', 'digest': 'sha256', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50380952, 'name': 'RSA-PSK-CAMELLIA128-SHA256', 'protocol': 'TLSv1.0', 'description': 'RSA-PSK-CAMELLIA128-SHA256 TLSv1 Kx=RSAPSK Au=RSA Enc=Camellia(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'camellia-128-cbc', 'digest': 'sha256', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50380950, 'name': 'DHE-PSK-CAMELLIA128-SHA256', 'protocol': 'TLSv1.0', 'description': 'DHE-PSK-CAMELLIA128-SHA256 TLSv1 Kx=DHEPSK Au=PSK Enc=Camellia(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'camellia-128-cbc', 'digest': 'sha256', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331822, 'name': 'PSK-AES128-CBC-SHA256', 'protocol': 'TLSv1.0', 'description': 'PSK-AES128-CBC-SHA256 TLSv1 Kx=PSK Au=PSK Enc=AES(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha256', 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50331788, 'name': 'PSK-AES128-CBC-SHA', 'protocol': 'SSLv3', 'description': 'PSK-AES128-CBC-SHA SSLv3 Kx=PSK Au=PSK Enc=AES(128) Mac=SHA1', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'aes-128-cbc', 'digest': 'sha1', 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50380948, 'name': 'PSK-CAMELLIA128-SHA256', 'protocol': 'TLSv1.0', 'description': 'PSK-CAMELLIA128-SHA256 TLSv1 Kx=PSK Au=PSK Enc=Camellia(128) Mac=SHA256', 'strength_bits': 128, 'alg_bits': 128, 'aead': False, 'symmetric': 'camellia-128-cbc', 'digest': 'sha256', 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50380859, 'name': 'ECDHE-PSK-NULL-SHA384', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-NULL-SHA384 TLSv1 Kx=ECDHEPSK Au=PSK Enc=None Mac=SHA384', 'strength_bits': 0, 'alg_bits': 0, 'aead': False, 'symmetric': None, 'digest': 'sha384', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50380858, 'name': 'ECDHE-PSK-NULL-SHA256', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-NULL-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK Enc=None Mac=SHA256', 'strength_bits': 0, 'alg_bits': 0, 'aead': False, 'symmetric': None, 'digest': 'sha256', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50380857, 'name': 'ECDHE-PSK-NULL-SHA', 'protocol': 'TLSv1.0', 'description': 'ECDHE-PSK-NULL-SHA TLSv1 Kx=ECDHEPSK Au=PSK Enc=None Mac=SHA1', 'strength_bits': 0, 'alg_bits': 0, 'aead': False, 'symmetric': None, 'digest': 'sha1', 'kea': 'kx-ecdhe-psk', 'auth': 'auth-psk'}, {'id': 50331833, 'name': 'RSA-PSK-NULL-SHA384', 'protocol': 'TLSv1.0', 'description': 'RSA-PSK-NULL-SHA384 TLSv1 Kx=RSAPSK Au=RSA Enc=None Mac=SHA384', 'strength_bits': 0, 'alg_bits': 0, 'aead': False, 'symmetric': None, 'digest': 'sha384', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331832, 'name': 'RSA-PSK-NULL-SHA256', 'protocol': 'TLSv1.0', 'description': 'RSA-PSK-NULL-SHA256 TLSv1 Kx=RSAPSK Au=RSA Enc=None Mac=SHA256', 'strength_bits': 0, 'alg_bits': 0, 'aead': False, 'symmetric': None, 'digest': 'sha256', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331829, 'name': 'DHE-PSK-NULL-SHA384', 'protocol': 'TLSv1.0', 'description': 'DHE-PSK-NULL-SHA384 TLSv1 Kx=DHEPSK Au=PSK Enc=None Mac=SHA384', 'strength_bits': 0, 'alg_bits': 0, 'aead': False, 'symmetric': None, 'digest': 'sha384', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331828, 'name': 'DHE-PSK-NULL-SHA256', 'protocol': 'TLSv1.0', 'description': 'DHE-PSK-NULL-SHA256 TLSv1 Kx=DHEPSK Au=PSK Enc=None Mac=SHA256', 'strength_bits': 0, 'alg_bits': 0, 'aead': False, 'symmetric': None, 'digest': 'sha256', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331694, 'name': 'RSA-PSK-NULL-SHA', 'protocol': 'SSLv3', 'description': 'RSA-PSK-NULL-SHA SSLv3 Kx=RSAPSK Au=RSA Enc=None Mac=SHA1', 'strength_bits': 0, 'alg_bits': 0, 'aead': False, 'symmetric': None, 'digest': 'sha1', 'kea': 'kx-rsa-psk', 'auth': 'auth-rsa'}, {'id': 50331693, 'name': 'DHE-PSK-NULL-SHA', 'protocol': 'SSLv3', 'description': 'DHE-PSK-NULL-SHA SSLv3 Kx=DHEPSK Au=PSK Enc=None Mac=SHA1', 'strength_bits': 0, 'alg_bits': 0, 'aead': False, 'symmetric': None, 'digest': 'sha1', 'kea': 'kx-dhe-psk', 'auth': 'auth-psk'}, {'id': 50331825, 'name': 'PSK-NULL-SHA384', 'protocol': 'TLSv1.0', 'description': 'PSK-NULL-SHA384 TLSv1 Kx=PSK Au=PSK Enc=None Mac=SHA384', 'strength_bits': 0, 'alg_bits': 0, 'aead': False, 'symmetric': None, 'digest': 'sha384', 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50331824, 'name': 'PSK-NULL-SHA256', 'protocol': 'TLSv1.0', 'description': 'PSK-NULL-SHA256 TLSv1 Kx=PSK Au=PSK Enc=None Mac=SHA256', 'strength_bits': 0, 'alg_bits': 0, 'aead': False, 'symmetric': None, 'digest': 'sha256', 'kea': 'kx-psk', 'auth': 'auth-psk'}, {'id': 50331692, 'name': 'PSK-NULL-SHA', 'protocol': 'SSLv3', 'description': 'PSK-NULL-SHA SSLv3 Kx=PSK Au=PSK Enc=None Mac=SHA1', 'strength_bits': 0, 'alg_bits': 0, 'aead': False, 'symmetric': None, 'digest': 'sha1', 'kea': 'kx-psk', 'auth': 'auth-psk'}]

Oct 08 '20 21:10 pavel-ch

[SSL: SSLV3_ALERT_ILLEGAL_PARAMETER] sslv3 alert illegal parameter (_ssl.c:1108

^ Is the result of client using incorrect psk. Remember to supply psk as byte array, eg. bytes.fromhex("10ab45ce");

Mar 16 '21 06:03 rousku

Hi @rousku, how can I add identity? Thanks!

Jan 05 '22 15:01 rjma30

Hi all!

May I have any pointers on how to achieve the proposed in this issue?

I have tried to follow @gennadykr and @pavel-ch steps using sspsk2. However I'm getting this error on my client when attempting the connection:

File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/ssl.py", line 1341, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:997)

The broker is a Mosquitto 2.0.14 running in a docker container from the official image, which reports this when the connection is attempted:

1658538579: OpenSSL Error[0]: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher

To isolate the problem, I decided to test the broker with:

mosquitto_sub --psk-identity MyDevice --psk 1234 -h localhost -p 8883 -t TestTopic -u MyUser -P MyUserPassword -i TheReceiver
mosquitto_pub --psk-identity MyDevice --psk 1234 -h localhost -p 8883 -t TestTopic -u MyUser -P MyUserPassword -m Hello -i TheSender

The above successfully worked with a psk file that has this content:

MyDevice:1234

Then my problem should be arround my client. My development environment is based on a Intel macOS 12.5 with openssl@3 via brew and sspsk2 installed using ARCHFLAGS="-arch x86_64" pip3 install sslpsk2 otherwise pip complained about an unsupported achitecture.

print(context.get_ciphers()) provides plenty of PSK ciphers, so I guess my setup is not the problem.

What other tests should I perform?

Jul 23 '22 03:07 maovidal

This morning I had published the code I'm using to test the implementation. It is not working yet and any help would be much appreciated.

Here it is: https://github.com/maovidal/paho_sslpsk2_demo/blob/main/paho_sslpsk2_demo.py

Jul 23 '22 15:07 maovidal

Any news ? There is a working example ? I am using @maovidal example but it do not work. On mosquitto broker I get:

OpenSSL Error[0]: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter

Feb 28 '23 20:02 pat1

setting TLS version:

     context = SSLPSKContext(ssl.PROTOCOL_TLSv1_2)

it works!

Mar 01 '23 15:03 pat1

references about use of TLSv1_2 for PSK in mosquitto: https://github.com/eclipse/mosquitto/commit/ea371564e7bc6e4402ff2a80b768b649644b18f2 https://www.eclipse.org/lists/mosquitto-dev/msg02722.html

Mar 06 '23 11:03 pat1

Closing this as it appears you found a solution; if questions remain please reopen with details.

Dec 24 '23 21:12 MattBrittan

paho.mqtt.python paho.mqtt.python copied to clipboard

TLS-PSK

paho.mqtt.python
paho.mqtt.python copied to clipboard