Skip to content

Secure channel enhancements 2025 11 #3408

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
opcfoundation-org wants to merge 17 commits into
base: master
Choose a base branch
from
Open

Secure channel enhancements 2025 11 #3408

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
688e2b8
merged security changes
mrsuciu Nov 19, 2025
45b07a2
Tailor SecurityPolicyUri for format expected in s_securityPolicyUriTo…
mrsuciu Nov 20, 2025
cfbebe7
Enhance security policy handling and key computation logic
mrsuciu Nov 21, 2025
0477aba
Merge remote-tracking branch 'mr/eccSecurityChangesMerge'
randy-armstrong Nov 21, 2025
d0c6321
Merge SecurityEnhancements.
randy-armstrong Nov 26, 2025
a579c62
Add support for SessionTransferToken. Removed obsolete SoftwareCertif…
randy-armstrong Nov 27, 2025
e1dd311
Fix NonceLength for None.
randy-armstrong Nov 27, 2025
9ecf7c9
Add support for RSA_DH, more fixes from IOP testings.
randy-armstrong Dec 8, 2025
1ca156c
Finish implementation of SecureChannelEnhancements.
randy-armstrong Dec 11, 2025
a17b881
Merge branch 'master' of https://github.com/OPCFoundation/UA-.NETStan…
randy-armstrong Dec 11, 2025
5dfb991
Merge branch 'master' into secure-channel-enhancements-2025-11
randy-armstrong Dec 11, 2025
67f4b4b
Rename EccUtils.cs to CryptoUtils.cs
randy-armstrong Dec 11, 2025
8528e7a
Address feedback from reviewers.
randy-armstrong Dec 18, 2025
387ad76
Fix CoPilot flagged spelling errors.
randy-armstrong Dec 18, 2025
ee70b5d
Merge branch 'master' into secure-channel-enhancements-2025-11
randy-armstrong Dec 18, 2025
6153098
Rename EccUtils to CryptoUtils
randy-armstrong Dec 18, 2025
dc0b110
Fix unit tests.
randy-armstrong Dec 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 28 additions & 3 deletions Applications/ConsoleReferenceClient/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,23 @@ public static class Program
/// <exception cref="ErrorExitException"></exception>
public static async Task Main(string[] args)
{
//foreach (var group in Enum.GetValues(typeof(RSADiffieHellmanGroup)))
//{
Copy link
Collaborator

@marcschier marcschier Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove

// var alice = RSADiffieHellman.Create((RSADiffieHellmanGroup)group);
// var bob = RSADiffieHellman.Create((RSADiffieHellmanGroup)group);

// var aliceNonce = alice.GetNonce();
// var bobNonce = bob.GetNonce();

// var bobAtAlice = RSADiffieHellman.Create(bobNonce);
// var aliceAtBob = RSADiffieHellman.Create(aliceNonce);

// var secret1 = alice.DeriveRawSecretAgreement(bobAtAlice);
// CryptoTrace.WriteLine(CryptoTrace.KeyToString(secret1));
// var secret2 = bob.DeriveRawSecretAgreement(aliceAtBob);
// CryptoTrace.WriteLine(CryptoTrace.KeyToString(secret2));
//}

Console.WriteLine("OPC UA Console Reference Client");

Console.WriteLine(
Expand All @@ -75,8 +92,8 @@ public static async Task Main(string[] args)
byte[] userpassword = null;
string userCertificateThumbprint = null;
byte[] userCertificatePassword = null;
bool logConsole = false;
bool appLog = false;
bool logConsole = true;
bool appLog = true;
bool fileLog = false;
bool renewCertificate = false;
bool loadTypes = false;
Expand Down Expand Up @@ -333,7 +350,7 @@ public static async Task Main(string[] args)
logConsole,
fileLog,
appLog,
LogLevel.Information);
LogLevel.Warning);

// delete old certificate
if (renewCertificate)
Expand Down Expand Up @@ -370,6 +387,14 @@ await application.DeleteApplicationInstanceCertificateAsync()
CancellationToken ct = quitCTS.Token;
ManualResetEvent quitEvent = ConsoleUtils.CtrlCHandler(quitCTS);

// insert security tester.
var tester = new SecurityTestClient.RunTest(config, telemetry);
Copy link
Collaborator

@marcschier marcschier Dec 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Put behind a command line argument? And into the UAClient?


if (await tester.RunAsync(quitEvent, ct).ConfigureAwait(false))
{
return;
}

var userIdentity = new UserIdentity();

// set user identity of type username/pw
Expand Down
24 changes: 12 additions & 12 deletions Applications/ConsoleReferenceClient/Quickstarts.ReferenceClient.Config.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,53 +13,53 @@
<ApplicationCertificates>
<CertificateIdentifier>
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<StorePath>./pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>RsaSha256</CertificateTypeString>
</CertificateIdentifier>
<CertificateIdentifier>
<!-- <TypeId>NistP256</TypeId> -->
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<StorePath>./pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>NistP256</CertificateTypeString>
</CertificateIdentifier>
<CertificateIdentifier>
<!-- <TypeId>NistP384</TypeId> -->
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<StorePath>./pki/own</StorePath>
<SubjectName>CN=Quickstart Reference client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>NistP384</CertificateTypeString>
</CertificateIdentifier>
<CertificateIdentifier>
<!-- <TypeId>BrainpoolP256r1</TypeId> -->
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<StorePath>./pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>BrainpoolP256r1</CertificateTypeString>
</CertificateIdentifier>
<CertificateIdentifier>
<!-- <TypeId>BrainpoolP384r1</TypeId> -->
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
<StorePath>./pki/own</StorePath>
<SubjectName>CN=Quickstart Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
<CertificateTypeString>BrainpoolP384r1</CertificateTypeString>
</CertificateIdentifier>
</ApplicationCertificates>
<!-- Where the issuer certificate are stored (certificate authorities) -->
<TrustedIssuerCertificates>
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/issuer</StorePath>
<StorePath>./pki/issuer</StorePath>
</TrustedIssuerCertificates>
<!-- Where the trust list is stored -->
<TrustedPeerCertificates>
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/trusted</StorePath>
<StorePath>./pki/trusted</StorePath>
</TrustedPeerCertificates>
<!-- The directory used to store invalid certificates for later review by the administrator. -->
<RejectedCertificateStore>
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/rejected</StorePath>
<StorePath>./pki/rejected</StorePath>
</RejectedCertificateStore>
<MaxRejectedCertificates>5</MaxRejectedCertificates>
<!-- WARNING: The following setting (to automatically accept untrusted certificates) should be used
Expand All @@ -75,12 +75,12 @@
<!-- Where the User issers list is stored-->
<UserIssuerCertificates>
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/userIssuer</StorePath>
<StorePath>./pki/userIssuer</StorePath>
</UserIssuerCertificates>
<!-- Where the User trust list is stored-->
<TrustedUserCertificates>
<StoreType>Directory</StoreType>
<StorePath>%LocalApplicationData%/OPC Foundation/pki/trustedUser</StorePath>
<StorePath>./pki/trustedUser</StorePath>
</TrustedUserCertificates>
</SecurityConfiguration>
<TransportConfigurations></TransportConfigurations>
Expand All @@ -92,7 +92,7 @@
<MaxMessageSize>4194304</MaxMessageSize>
<MaxBufferSize>65535</MaxBufferSize>
<ChannelLifetime>300000</ChannelLifetime>
<SecurityTokenLifetime>3600000</SecurityTokenLifetime>
<SecurityTokenLifetime>30000</SecurityTokenLifetime>
</TransportQuotas>
<ClientConfiguration>
<DefaultSessionTimeout>60000</DefaultSessionTimeout>
Expand Down Expand Up @@ -120,7 +120,7 @@
</ClientConfiguration>
<Extensions></Extensions>
<TraceConfiguration>
<OutputFilePath>%LocalApplicationData%/OPC Foundation/Logs/Quickstarts.ReferenceClient.log.txt</OutputFilePath>
<OutputFilePath>./Logs/Quickstarts.ReferenceClient.log.txt</OutputFilePath>
<DeleteOnLoad>true</DeleteOnLoad>
<!-- Show Only Errors -->
<!-- <TraceMasks>1</TraceMasks> -->
Expand Down
Loading
Loading