Implementing SSL

Question

Hi All,

I have been tasked with implementing TLS/SSL onto an in-house webserver framework. I was wondering if anyone could point me to some good example code that they know of?

I am particularly interested in using GSS API (Microsoft's Security Support Provider Interface (SSPI)). Failing that, Crypto++, I can't use any other type of open source library.

Many Thanks!

EDIT: To clarify: Crypto++ is the only open source library I can use. Not my restriction, but one I have to comply with.

EDIT2: Just to add, I am coding in C++

Answer 1

You honestly can't use OpenSSL? Is this a FIPS issue? If so, OpenSSL's FIPS 140-2 module 1.2 is available as of November of 2008.

UPDATE: If OpenSSL can't be used as a library, you can still read the source to learn. Depending on the strictness of your requirements, you may need to do this cleanroom-style.

UPDATE 2: Here's the latest (I think) TLS spec. Using this in conjunction with the OpenSSL source should help you figure out how to do the negotiation, etc. You can then use Crypto++ to perform the actual crypto you've negotiated. I'd still suggest trying to avoid implementing this by hand if you can possibly get OpenSSL OK'd. Without knowing why it was outlawed in the first place, I can't help you with that, though.

Answer 2

I was hoping to use an off-the-shelf library or API (like the examples mentioned) rather than reverse engineer a whole library.

Answer 3

If you're exclusively on Windows, SSPI provides support for SSL as well as other security protocols. It essentially provides you with the tokens you need to send between client and server to establish the secure connection, and thereafter enables encryption of data. This article gives an overview, but you should refer to the MS docs.

Not sure if there is an equivalent for other platforms. There is GSSAPI, which is similar to SSPI, however I'm not aware of SSL implementations underneath that (usually it's used for access to Kerberos). Not saying they don't exist, I've just not come across them.