Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I asked this already on Stack Overflow, here. I was told I might find answers here.

share|improve this question
    
Cisco ios or Macintosh ios? (only one really makes sense, but i'm still going to ask the question). –  Ormis May 13 '11 at 20:09

2 Answers 2

Two things:

  • you get more control over the encryption options. If you need to control or inspect the certificate exchange in ways not permitted by CFNetwork, you must drop to OpenSSL.
  • OpenSSL is cross-platform, so you may already have code that works with it.
share|improve this answer

(Perhaps slightly off-topic). I'm not sure about iOS, but on OSX, CFStream, CFNetwork and so on allow the application to use a private key in the KeyChain without ever gaining access to its content. For example, if you have to authenticate to a site with a client certificate, it's the OS/Keychain layer that will deal with the signature using the private key, and then pass the TLS "handle" to the application.

In a sense, it makes the keys more secure, as the users don't need to trust the application as much: even if it uses your private key when you allow it to, it will never be able to make a copy of it (and perhaps send it to a rogue site). (Note that this depends on various configuration options, of course, as you are also able to give the content of the private key to the application if required, and allowed by the user).

As far as I know, OpenSSL isn't integrated with the OS in this manner (so the application process has to be able to get hold of the private key if it wants to use it).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.