3

I want to secure the communication of an embedded device that is connected to a host via USB. At the moment I'm considering using the openssl library. I can use it on the embedded device and on the host (win/linux). Is it possible to use USB endpoints instead of sockets to establish a secure SSL connection via USB using openssl?

closed as off-topic by Steffen Ullrich, M'vy, Xiong Chiamiov, forest, schroeder Mar 1 '18 at 15:22

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    I'm voting to close this question as off-topic because it is a programming question and would thus be on-topic on stackoverflow.com. Only, it shows no previous research and thus I don't recommend a move. Hint to the OP: OpenSSL can do every part of SSL with memory buffers instead of file descriptors. Search for openssl memory bio ssl and you will find examples. – Steffen Ullrich Feb 28 '18 at 8:26
  • @SteffenUllrich Thank you very much for the hint. This is already enough for me to keep working! – tzippy Feb 28 '18 at 8:28
2

Edit: Sorry I misread our question. Yes, it is possible to switch the Transport Layer. You can just switch the send/read functions of the Transport Layer (TCP) with whatever you want. However, you have to keep the Server/Client structure. Also, your Transport layer has to be reliable (as explained below) or you have to use DTLS.


Even if this might not be the scope of Information Security, i'll answer anyway, because I am working on a very similar topic on my bachelor thesis. I do not use OpenSSL or GNUTLS because their memory footstep is too big for my application.

Take a look at the Comparison of TLS Libraries on Wikipedia. There is a table for portability concers where the column No OS might be interesting for you. Since I also compared libraries for myself, here the results:

I compared

First up: If you search for a free Open Source implementation which is not GPL licenced, mbedTLS is what you are looking for. With its Apache licence u can use it for Closed Source projects without any hassle.

GuardTLS is not very exciting imo, they are not very active GitHub on either. The WolfSSL team is very active on GitHub and the product looks very promising. The mbedTLS GitHub repository is much more endorsed by the community, though. I went for mbedTLS in the end. It always depends on your needs though.

One last hint: If your transport layer is not reliable (packets out of order or packet loss), then you need to use DTLS (TLS for datagram protocols). All of the above libraries support DTLS.

  • 1
    How does this answer the question if it is possible to establish a SSL-connection over USB? – Eelke Feb 28 '18 at 15:28
  • No problem. If you have further questions, go ahead :) – MemAllox Mar 1 '18 at 8:40
  • @MemAllox Hey, thanks again! I have another question that I'd like to ask you. Maybe you could hit me up in chat? – tzippy Mar 23 '18 at 9:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.