1

When setting up the security for business to business API integration. We are discussion 2 option

  • Mutual TLS with IP Filtering
  • TLS with a Shared secret and IP Filtering.

Which is the more secure approach and what makes the potential difference?

My understanding is, either way, the initial connection secures the data then the shared secret or the second certificate confirms the identity (to an extent).

Are there any potential benefits either way? It seems Mutual TLS can be more challenging to implement. The only benefit I can think of with the Mutual TLS is the potential for the certificate to expire and be revoked.

I'm trying to understand the difference in the potential attacks.

Improve this question

1 Answer 1

Reset to default
2

Both can be secure, so potential attacks are not the main thing here.

The differences are in identity- and key management.

With PSK (pre-shared key) you just get a key ID for the client, not a certificate with X.500 attributes such as common name. So to identify the identity you need to link already known information to the key ID.

With PSK you share a secret key between client and server. But if there are multiple clients or multiple servers then you need to share keys between a lot of entities. With certificates - or rather, the public key infrastructure (PKI or PKIX) created using certificates - you just need to have one secret (or rather private) key per entity. The public key can be trusted if it is part of a certificate in a certificate chain, so the public keys don't need to be distributed either.

As you've already indicated there are a lot of other key management options for certificates.

One disadvantage of using certs is that the server cert is usually required to include the server name, and the connection may not be established on differently named hosts.

For business to business I'd certainly go for the client / server authentication using certificates. This is the most common and most flexible option. Be sure to trust only those certificates that you require (and not all certificates that are trusted by a default trust store).

Improve this answer
1
  • TLS server cert can support multiple names using SAN. For example the current cert for Stack has 25 entries, many of them wildcards, covering I believe about 400 server names. You do need to know/decide these names, at least all but the leftmost label, at cert issuance time, and can't later change without reissuing.
    – dave_thompson_085
    Apr 27, 2018 at 5:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .