2

I am facing an issue with TLS handshake. I am using the following ciphersuit with client authentication. MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

What I am trying to do is use a smart card to sign the payloads of previous messages. So I store the private key in the smartcard in order to sign.

Now when I dont use the smartcard, the TLS handshake is working. So to start the discussion I have the following query:

Q. What is the role of client's private key in TLS handshake under client authentication scenario? Is it only used to sign or anything else as well?

Thanks for your help.

Improve this question

1 Answer 1

Reset to default
3

The private key of the client certificate is only needed during the SSL handshake to prove that the client owns the certificate. This proof is done by the client creating a signature over previous handshake messages using its private key and sending this signature inside the CertificateVerify message. This signature can be verified by the server using the public key from the clients certificate the client has send before in the Certificate message.
See Wikipedia: Client authenticated TLS handshake for more details.

Improve this answer
4
  • Thanks for the reply. So can I say that the client private key has no role in the following states: CLIENT_CHANGE_CIPHER_SPEC and CLIENT_FINISHED ? after sending the certificate verify packet
    – Jain
    Oct 27, 2016 at 5:07
  • @Jain: as far as I know the private key of the client certificate is only used once during the handshake to create the CertificateVerify message, i.e. not also needed to create ChangeCipherSpec or Finished.
    – Steffen Ullrich
    Oct 27, 2016 at 5:14
  • Thank you. in that case what could be the reason of the handshake failing when I try to sign using the smartcard since I have kept the private key in it. Any pointers? Thanks in advance.
    – Jain
    Oct 27, 2016 at 5:27
  • @Jain: I have no pointers. But as far as I know smartcard interfaces are a complex thing and just because the smartcard works with one application does not mean it works with another application, especially if the underlying libraries differ or the purpose the smartcard is used for differs.
    – Steffen Ullrich
    Oct 27, 2016 at 5:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .