33

In previous versions of Arduino, the limiting 8-bit microcontroller board, it seems that implementing HTTPS (not merely HTTP) was almost impossible. But the newer version of Arduino Due provides 32-bit ARM core - see spec here.

I tried to check several network libraries (libcurl, openssl, yaSSL), but I didn't find anyone that was already ported to work with Arduino Due.

OpenSSL is probably too heavy to be able to run on this processor, but I believe that yaSSL as an embedded library should be possible to do.

Do you have any information of a library that I can use to trigger HTTPS requests on Arduino Due?

13
  • 1
    Why not just compile OpenSSL for ARM?
    – user529758
    Apr 7, 2013 at 19:47
  • 1
    @H2CO3 - 96KB of RAM? Good luck.
    – Brett Hale
    Apr 7, 2013 at 19:48
  • @BrettHale Encryption-only parts with pure computation? Hash init tables put into the ROM or progmem?
    – user529758
    Apr 7, 2013 at 19:50
  • @H2CO3, you might get something like yaSSL to work, but Arduino development is still essentially poll-driven. It would still be a lot of work.
    – Brett Hale
    Apr 7, 2013 at 19:53
  • 2
    Check out this answer over at the security stack exchange. Following that, the only other lightweight library I know of is polarSSL
    – stormCloud
    Apr 9, 2013 at 18:55

3 Answers 3

20
+50

Unfortunately this is too long for a comment.

No out of the box solution

From what I have gathered, there is no straightforward solution for a webserver running on the Atmel SAM3X8E ARM Cortex-M3 CPU that outputs HTTPS out of the box. Texas Intstruments provides better options at the moment using their boards equipped with a Stellaris Microcontroller ARM Cortex-M3 CPU.

► Alternative

There are several options available that render cryptographic functions, based upon which one could lay out and implement a simple secure communication protocol that communicates with an intermediary device, which in turn facilitates Rapid Application Development and SSL.

This intermediary device, for instance an off-the-shelf 70$ Android smartphone that keeps your project mobile and connected, runs a service on a specified port which in turn communicates with Amazon SQS. Already available. This may sound ugly or tough, but is much easier than doing the programmatic groundwork for a webserver with full TLS 3 support on the Arduino. Given the proper motivation the latter may be easy, but not if one just wants a fast pragmatic solution to one's own project.

Cryptographic libraries

Discussions

Following is a list of discussions to get you started:

Many of these libraries would still need to be adapted, but community experts can help you with that fairly quickly.

Good luck! If you are at liberty to upload your final project to github then you just gained a thanks and a follower.

1
  • 1
    Another cryptographic library worthy of mention is cryptlib. According to the homepage, "cryptlib's highly portable nature means that it is also being used in a variety of custom embedded system environments including AMX, ChorusOS, eCos, FreeRTOS/OpenRTOS, uITRON, MQX, PalmOS, RTEMS, ThreadX, T-Kernel, uC/OS II, VDK, VxWorks, and XMK."
    – autistic
    Feb 20, 2017 at 4:21
7

IMHO Arduino (including the DUE) is the wrong tool for heavy and/or encrypted web based communication. I would strongly suggest to look for more appropriate hardware in the same size and price range. As soon you get into https you are close enough to also want a lot of the other stuff that real operating systems provide. With other words I suggest to go for something like the Raspi. Similar size and prize but way more powerful, especially it can run Linux. --> HTTPS becomes simple.

7

The big problem with https support on an arduino is the danger of overloading your processor which could make the project unviable.

Even embedded platform targetted solutions like PolarSSL can eat up too much memory and use too much processing power. Remember that even on the most streamlined implementations, SSL support is going to have to be generalized for wide adoption and will include components that you won't find necessary. There's also the question of which Certificate Authorities you will trust and how you will communicate with them for things like certificate revocation.

I would look instead towards a solution that isn't as broken on the surface for your needs. Something like CurveProtect, which is an implementation of CurveCP.

Of course, your decision will largely be based on what you want to do and how much time you want to spend figuring the problem out. PolarSSL has a footprint that can be as small as 30K (more typically close to 100K).

1
  • 2
    Exactly my point. SSL is very heavy on resources and already tricky on real OS platforms. If at all possible this is something that I would try to avoid on an embedded system. Your revocation point is also very valid. Key management for embedded systems is definitely not trivial. Actually it is never trivial no matter which platform. But embedded adds some more subtle twists.
    – Udo Klein
    Apr 14, 2013 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.