Anybody have any input/feedback on this.
I've been given the task of researching how to send a 'secure' email using SSL on an embedded system with very limited RAM and Flash ROM. The email is very vague in nature, so security is not really needed at all. We have it working great with a non secured port (like 25 or 26). So, I've been asked to investigate if this is possible on our system. Many servers are not allowing unsecured port emails any longer, which has led me to this research.
There are several 3rd party vendors that offer SSL libraries, but the code space and RAM required is much larger than we can handle. Their code handles the multitude of cipher suites, which we don't necessarily need, and probably a lot of other stuff that we don't need either.
I don't know how minimal you can get as far as what is needed to send a 'secure email' on port 587 or 465. Really, I just need to send the email on those ports with no security needed. But, that is probably not possible. So, my initial questions are:
- It believe you do have to use a cipher suite, as NULL suites are not supported on many servers. Do you have to receive certificates whether you validate them or not. I'm trying to cut down on overhead and non needed code space.
- If you do have to use a cipher, is there a universal cipher that all servers must support?
- How do you know which ciphers require minimum overhead to get the job done?
Any other feedback would be appreciated, as I'm sure there are other factors I may need to consider.