0

Anybody have any input/feedback on this.

I've been given the task of researching how to send a 'secure' email using SSL on an embedded system with very limited RAM and Flash ROM. The email is very vague in nature, so security is not really needed at all. We have it working great with a non secured port (like 25 or 26). So, I've been asked to investigate if this is possible on our system. Many servers are not allowing unsecured port emails any longer, which has led me to this research.

There are several 3rd party vendors that offer SSL libraries, but the code space and RAM required is much larger than we can handle. Their code handles the multitude of cipher suites, which we don't necessarily need, and probably a lot of other stuff that we don't need either.

I don't know how minimal you can get as far as what is needed to send a 'secure email' on port 587 or 465. Really, I just need to send the email on those ports with no security needed. But, that is probably not possible. So, my initial questions are:

  1. It believe you do have to use a cipher suite, as NULL suites are not supported on many servers. Do you have to receive certificates whether you validate them or not. I'm trying to cut down on overhead and non needed code space.
  2. If you do have to use a cipher, is there a universal cipher that all servers must support?
  3. How do you know which ciphers require minimum overhead to get the job done?

Any other feedback would be appreciated, as I'm sure there are other factors I may need to consider.

Thanks.

Sutton

  • Did you try to download the openssl source and disable/enable what you want? The Configure script brings a lot of features for enable/disable on compile time – camp0 Feb 8 at 15:25
  • I don't think that disabling ciphersuit will reduce the size of the resulting binaries much: most of the code is not actually in the algorithm themselves but in all the code around them which you can't removed easily. Furthermore, it's not as simple as "keep this that options and it will work": SSL/TLS support (in particular in SMTP) is VERY varied and the less options you support, the less servers you'll be able to work with. – Stephane Feb 8 at 15:48
  • Is this an internal network, or are the devices on the public internet? If it’s a private network, consider sending the messages to a proxy server and having the proxy do SSL to the SMTP server. – John Deters Feb 8 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.