On iOS, what's the benefit of OpenSSL over using CFStream, CFNetwork etc. for secure sockets?

Question

I asked this already on Stack Overflow, here. I was told I might find answers here.

Answer 1

Two things:

• you get more control over the encryption options. If you need to control or inspect the certificate exchange in ways not permitted by CFNetwork, you must drop to OpenSSL.
• OpenSSL is cross-platform, so you may already have code that works with it.

Answer 2

(Perhaps slightly off-topic). I'm not sure about iOS, but on OSX, CFStream, CFNetwork and so on allow the application to use a private key in the KeyChain without ever gaining access to its content. For example, if you have to authenticate to a site with a client certificate, it's the OS/Keychain layer that will deal with the signature using the private key, and then pass the TLS "handle" to the application.

In a sense, it makes the keys more secure, as the users don't need to trust the application as much: even if it uses your private key when you allow it to, it will never be able to make a copy of it (and perhaps send it to a rogue site). (Note that this depends on various configuration options, of course, as you are also able to give the content of the private key to the application if required, and allowed by the user).

As far as I know, OpenSSL isn't integrated with the OS in this manner (so the application process has to be able to get hold of the private key if it wants to use it).