SSL / TLS

Contents

• Introduction
• Related books
• Related sites
• APIs that implement SSL / TLS
• SSL Benchmarks
• Event-driven SSL API proposal

Introduction

Secure web servers, and many other kinds of servers that want to protect data from prying eyes during transmission, often use the Secure Socket Layer (SSL) originally developed by Netscape. It is now also known as the Transport Layer Security protocol (TLS), defined by the draft Internet standard RFC2246.

SSL, or more specifically, the RSA public-key cryptographic operations usually used to exchange the session key at the start of a connection, is computationally intensive. It takes far more CPU time to establish an SSL connection than a normal connection.

This page lists products and sources of information of interest to programmers trying to implement SSL in their software. I'm just learning about this stuff myself, and these are the notes I'm making as I go.

Related books

• SSL and TLS, by Eric Rescorla [author's page, publisher's page, Amazon.com] - the best book on SSL. Clear and informative. Includes OpenSSL examples. 500 pages. Read it now!
• SSL and TLS Essentials, by Stephen Thomas [publisher's page, Amazon.com] - was the only good book on SSL until Rescorla's book came out. 200 pages. Thin but informative. (Out of print but still cheap used as of 2012.)

Related sites

• My page about hardware SSL accelerators
• Open Directory : Computers: Security: Internet: SSL-TLS

APIs that implement SSL/TLS

• OpenSSL - the leading open source SSL implementation.
  See also the short OpenSSL tutorial at www.darkspell.com/gadgets/ssl.

• Mozilla's NSS SSL/TLS API
  These guys invented SSL, they have an open source implementation, dual-licensed under MPL and GPL, and maintain discussion groups on the subject.

• Peter Gutmann's Cryptlib -- open source, free for noncommercial use

• JDK 1.4
  Sun's JDK 1.4 comes with SSL support (not just https support) built in.

• PureTLS -- a free Java-only implementation of SSLv3 and TLSv1.

• IAIK offers several products:
  • JCE -- an independent reimplementation of Sun's JCE (javax.crypto) (commercial; free for noncommercial use)
  • iSaSiLK -- an SSL layer on top of JCE (commercial; free for noncommercial use)
  • an LGPL'd PKCS-11 wrapper library (LGPL)

• PKCS-11 from RSA. LGPL'd implementation available. In PKCS-11 lingo, an SSL accelerator is called a "hardware token". Go figure.

• CDSA
  CDSA ("Common Data Security Architecture") is an all-singing, all-dancing standardized cryptography API backed by Intel and IBM, among others. CDSA has a specification document and will have a compliance test suite, so theoretically, anyone can write a CDSA library and check to see whether they've done it properly; that alone makes me trust it more than any Microsoft "standard" I know of. (If you think I'm being too hard on Microsoft here, show me a conformance test suite for the win32 api, and I'll eat my words.)
  • Open Group's security page - info and newsletter about CDSA and related standards
  • Open Group's CDSA standards page - you can view the full definition of the CDSA API online for free here
  • http://www.cdsasecurity.com - an umbrella site. Offline at the moment; check the cached copy at google.com
  • Intel's security page - Intel's implementation of CDSA is said to be moving to "open source", but the licensing terms are not yet known
  • IBM KeyWorks - IBM's implementation of CDSA (see also here)

• Certicom's SSL Plus - a commercial package that supports many operating systems, including Linux, and at least one hardware accelerator (the Rainbow Cryptoswift).

• RSA's BSAFE BHAPI (not open source)

SSL Benchmarks

In April, 2001, Coradiant published a SSL benchmark comparing a hand-coded highly optimized version of RSA for Itanium to an unoptimized off-the-shelf generic RSA compiled for UltraSparc III. (Gee, that's a fair test.) The original URL doesn't work anymore, but Google saved a copy.

Last Real Update: 25 Sept 2001
Last Minor Update: 4 Sept 2012 (!)
Copyright 2000-2012, Dan Kegel
[Return to kegel.com]