I am designing a Point2Point encryption system. I've checked the WhatsApp's protocal. But our devices are Raspberry Pi so WhatsApp's protocal is too heavy. We 'd like to use a PSK (pre shared key) method. I've checked TLS which provides many ciphersuites and also PSK one.

But in programming, I need to configure every device as server and client at same time*(Cause I dont know which device will invoke the communication). Is it a possible way?

Or I need to do it in a lower level way?Like first, Exchange public key ,then generating shared secrect then generateing shared key and so on.......

1 Answer 1


TLS is just a protected channel between two communication peers, usually on top of TCP. It does not matter if such a peer is either client, server or even both at the same time (but not with the same peer). And it also does not matter for the roles in the TLS handshake in which direction the TCP connection was established.

For example, in FTPS the TCP connection for the data transfer can be created either from client to FTP server (passive mode) or FTP server to client (active mode), whereas the TLS handshake on top of the TCP connection is always initiated by the client, so that the server certificate can be used for authentication in order to protect against man-in-the-middle. That is, sometimes it's in the same direction as the TCP connection (passive) and sometimes not (active mode).

Another example is SIPS (VoIP), where a SIP device is both client (for initiating calls) and server (for receiving calls). In case of SIPS, the direction of TCP connection and TLS handshake match. Authentication is usually done for both client and server (i.e. mutual), where each provides the certificate matching the device. And, if the roles switch, the same certificates will be used: if A calls B then B's certificate is used as server certificate and A's as client certificate. If B calls A then A's certificate is used as server certificate and B's as client certificate. And, in the case of a SIP proxy, the same system can even be both SIPS client to some servers and SIPS server to some clients at the same time.

Thus, it is no problem to use P2P architectures like SIPS together with TLS. And one can also use certificates in such a setup as long as each node has a clear address or other identifier which can be used as subject of the certificate and then checked during the certificate validation. This way, a PKI can be used for a more scalable trust model compared to PSK or SRP.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .