How to specify TLS key exchange groups with NWProtocolTLS.Options

Question

Created Sep ’23

Replies 1

Boosts 0

Participants 2

I am trying to establish a TLS 1.3 connection to a server that only accepts the SECP256R1 and FFDHE2048 TLS key share groups using the following code but the server is failing the TLS handshake because my client is not using a supported key exchange group. How do I specify which TLS key exchange group my client should use during the handshake?

let tlsOptions = NWProtocolTLS.Options()
        if let secIdentity = getSecIdentity(),
           let identity = sec_identity_create(secIdentity) {
            sec_protocol_options_set_min_tls_protocol_version(
                tlsOptions.securityProtocolOptions, .TLSv13)
            sec_protocol_options_set_local_identity(
                tlsOptions.securityProtocolOptions, identity)
        }
        
        let tlsParams = NWParameters(tls: tlsOptions, tcp: .init())
        let endpoint = NWEndpoint.hostPort(host: NWEndpoint.Host(host), port: NWEndpoint.Port(port))
        let nwConnection = NWConnection(to: endpoint, using: tlsParams)
        nwConnection.stateUpdateHandler = stateDidChange(to:)
        nwConnection.start(queue: queue)

Thanks!

Boost

Answer 1

Systems Engineer OP

Apple

Sep ’23

How do I specify which TLS key exchange group my client should use during the handshake?

There is no public API to set the supported groups in the client hello. I would open an enhancement request to expose a public API for this. Please post your feedback ID here.

There is a default list of supported groups that is used to build the client hello and SECP256R1 is in this group so I'm confused as to why this is not working. To check the supported groups in use, take a packet trace on your Mac, you will probably see groups similar to what I am seeing:

Supported Groups (5 groups)
    Supported Group: Reserved (GREASE) (0xcaca)
    Supported Group: x25519 (0x001d)
    Supported Group: secp256r1 (0x0017)
    Supported Group: secp384r1 (0x0018)
    Supported Group: secp521r1 (0x0019)

0