PDF Version

TCP/IP Products


smxSSL™

Strong security protection for networked embedded devices

Secure Socket Layer (SSL) provides seamless data security services that offer protection for TCP/IP protocols such as HTTP and SMTP and that can also be used to protect proprietary socket applications.

smxSSL is a small footprint embedded SSL implementation that provides client- and server-based secure communications for network sessions. smxSSL is integrated with the SMX RTOS and the smxNS TCP/IP stack to simplify application development. smxSSL provides C APIs for integration of either client or server SSL components into an embedded application. These highly efficient, robust, and small footprint implementations offer the core services required to protect critical computing resources across open communication networks while avoiding the substantial overhead of enterprise SSL (e.g. Open SSL) solutions. The protocol implementation is lightweight and fast and can be migrated to other operating systems and networking stacks with ease. The publicly available cryptographic libraries shipped with smxSSL have been used in thousands of embedded systems and provide secure and robust protection for sensitive data and control information.

smxSSL provides core SSLv3 Server and Client capabilities in a small, efficient implementation that targets the most common embedded SSL needs without the unnecessary overhead of features more suitable for enterprise applications. This product is sold in two forms – smxSSLs, which contains the base SSL library and the SSL server-specific APIs, and smxSSLc, which contains the base SSL library plus the SSL client-specific APIs.

smxSSL provides:

• A modular, easily extensible, configurable cryptographic library.
• Session resumption with configurable session cache.
• Multiple SSL servers.
• Key length configuration to optimize library size.
• Simple, straightforward application programming interface.

These are explained below.

smxSSL supports a modular and easily extensible cryptographic library that, by default, incorporates the following cryptographic algorithms:

• RSA Key Exchange
• AES symmetric cipher (128-bit keys)
• 3DES symmetric cipher (168-bit keys)
• ARC4 symmetric cipher (128, 56, and 40-bit keys)
• SHA-1 hash
• MD5 hash

These algorithms are supported in the following combinations (called cipher suites):

• SSL_RSA_WITH_AES_128_CBC_SHA
• SSL_RSA_WITH_3DES_EDE_CBC_SHA
• SSL_RSA_WITH_RC4_128_MD5
• SSL_RSA_WITH_RC4_128_SHA
• SSL_RSA_EXPORT1024_WITH_RC4_56_MD5
• SSL_RSA_EXPORT1024_WITH_RC4_56_SHA
• SSL_RSA_EXPORT_WITH_RC4_40_MD5

smxSSL provides configuration macros which permit disabling the AES and 3DES cipher algorithms when they are not in use, thus reducing memory requirements.

Additional cryptographic algorithms can be added without making changes to the core SSL implementation, by introducing the modules for them into the library and extending the tables that define available functions.

smxSSLs supports session resumption, which allows frequently connecting clients to submit their previously used SSL Session IDs. When smxSSLs finds a Session ID in the session cache, the computationally-intensive operation related to RSA Key Exchange is bypassed, leading to quicker connection times for frequent clients (web browsers using HTTP, for example).

The session cache size can be adjusted to fine tune library memory use vs. system performance.

smxSSLs is designed to protect multiple resources within a single application. It does this by implementing multiple smxSSLs servers, each with its own cache. Each smxSSLs server manages a unique certificate (including public/private key pair) allowing multiple clients to authenticate individual services from a single application. In order to maintain control over memory use, server cache sizes can be adjusted.

Longer key lengths effectively strengthen cryptographic algorithms, but they do so at the expense of increased memory and processing time. Each time a client connects to a server, the client and the server exchange secure messages to establish a secret key. Once the key exchange completes, symmetric cipher algorithms encrypt and decrypt data using key lengths as noted in the supported list of algorithms. However, as previously noted, the length of the key significantly effects memory requirements for system caches and dynamic memory allocation, and also significantly effects computation time for cryptographic functions. For this reason, the largest expected key length can be specified, allowing the system to balance memory use and performance vs. an acceptable level of security.

API for configuring and managing smxSSL servers and connections. The API works with any reliable transport provided by the calling application to perform data transfer. The API also provides functions for library management and private key translation.

ltrxSSLSystemConfig(time, seed)
ltrxSSLServerConfig(handle, certificate, certificate_size, key, key_size)
ltrxSSLServerConfigRelease(handle)

trxSSLAccept(handle, configuration)
ltrxSSLClose(handle)
ltrxSSLConnect(handle, callback, ciphers, num_ciphers)
ltrxSSLConnectionGet(handle, socket, transport, timeout, buffer, size)
ltrxSSLReconnect(handle, callback, id, ciphers, num_ciphers)

ltrxSSLSend(connection, buffer, size)
ltrxSSLBufferedSend(connection, buffer, size)
ltrxSSLRecv(connection, buffer, size)

smxSSL was designed to be small and efficient with configurable options to optimize memory requirements with regard to features and performance.

smxSSL was designed to be small and efficient with configurable options to optimize memory requirements with regard to features and performance.

Memory requirements depend upon configurations, as follows:

In the minimum configuration, a 512-bit library does not include additional Server, Connection, or Session cache objects nor the AES and 3DES Ciphers. When disabling debugging, the library saves an additional 2K of memory because a buffer shared by the AES and 3DES ciphers with debugging is no longer required:

As the maximum key length grows, the memory requirements increase for certain items, as shown in the following table. Storage for the RSA private key and certificate must grow to include the longer bit length and the application-supplied SSL handshake buffer must also grow so it is large enough to handle the SSL handshake. Items not shown in this list are not affected by maximum key length:

The stack space and heap requirements are also related to key size. These figures represent maximum measured additional stack and heap requirements for the smxSSLs HTTPS and echo server demonstrations. These figures do not include the total used by SMX and smxNS.

The SSL client demo in ssldemo.c has the following memory requirements when compiled for an ARM9 processor using IAR Workbench 5.2. These values are the incremental additional memory required when SSL client support is added to a base network build. Note that in this build, the task stack is allocated out of the heap, so R.W. Data plus Heap yields the incremental RAM requirement.

For more information

• Access the manual.