I have a server application that is using Winsock2.0 for client communication, this application is a service. The client is also a Windows desktop application and performs few operations. For example

  1. Client app can login with service using username and password.
  2. Send and also receive data from that service.

There are few requirement from NIST/DoD to make them PK-enabled what are the options to enable it and how?


It seems to me that there are three major options:

  1. Add TLS on top of Winsock using SChannel;
  2. Enable IPsec using WSASetSocketSecurity - you probably need to understand quite a bit about IPsec before using this option;
  3. Tunnel your connection to the server using any kind of protocol (SSH and TLS are probably the ones most used).

What you don't want to do is to attempt and create your own transport security.

NIST basically publishes a set of requirements to make sure your system is secure. It seems to me that you can use any of the three options to implement FIPS security. You can of course always screw up security even if you use any of these options.

If you are unsure on how to proceed, you should think about buying a device that performs full SSL offloading. That would be a special form of option (3) of course.

  • Instead of configuring the ip-sec in application if I enable the windows IP sec between server and client machine then it will enough to support DoD pk-enabled? – user2724058 Sep 11 '15 at 10:47
  • Possibly, if you apply X509 certificates. It seems to me that you are however in desperate need for expert advice. In the end you need to secure your systems. You can ask many questions here, but "how to secure my systems" is not one of them. Encrypting the communication between client and server is a means to an end. – Maarten Bodewes Sep 11 '15 at 10:56
  • the thing is in case of web application the HTTPS supports pk enabled. But in case of desktop server and client communication, we need to add something like TLS but not sure how to handle the certificate thing and encryption stuff might be some open source not sure :( – user2724058 Sep 11 '15 at 11:04
  • You do know that HTTPS is HTTP over TLS right? The whole authentication thing is the same for both. You'll probably need client authentication though. But mainly you need an expert on site. – Maarten Bodewes Sep 11 '15 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.