Security-57031.1.35.tar.gz

[apple/security.git] / Security / libsecurity_ssl / README

diff --git a/Security/libsecurity_ssl/README b/Security/libsecurity_ssl/README
new file mode 100644 (file)
index 0000000..3be86f2
--- /dev/null
+++ b/Security/libsecurity_ssl/README
@@ -0,0 +1,45 @@
+                     SecureTransport notes
+                       14 Feb 2002 dmitch
+
+-- Server-side cert usage and configuration is highly application dependent. 
+
+   -- Although the use of server-initiated key exchange is optional under
+      the SSL3 spec, Netscape browsers (4.61 through 4.75) will not tolerate
+         this operation unless an exportable cipher is selected. The current 
+         configuration of the library will attempt to perform server-initiated
+         key exchange if and only if the app has specified an encryption 
+         certificate via SSLSetEncryptionCertificate(). Thus, in a config
+         which is required to work with Netscape browsers, if non-export
+         (i.e., strong) ciphers are to be supported, encryption certs
+         must NOT be specified, and the server cert specified in SSLSetCertificate()
+         must be capable of both signing and encryption. This applies to the underlying
+         keys as well. 
+         
+   -- On top of that, even in a situation where Netscape will allow a server-
+      initiated key exchange (export cipher, app specifies both kinds of certs),
+         Netscape will abort if the *signing-only* cert (specified in 
+         SSLSetCertificate()) is not capable of encryption! In this case that cert
+         is never even used for encryption. But that is the real world. 
+       
+         Thus, to work with Netscape browsers with export-grade ciphers, the main
+         signing cert still has to be capable of encryption, even if the app specifies
+         a separate encryption cert. 
+         
+   -- The SSL_SERVER_KEYEXCH_HACK flag, in sslBuildFlags.h, was previously used
+      to work around the above-mentioned Netscape bug; when this flag is true,
+         server-initiated key exchange is only performed if an encrypting cert is
+         specified AND an export-grade cipher is selected. The current config has
+         this flag set false. 
+         
+   -- SSL2 server-side operation requires the presence of a cert and key which is 
+      capable of encryption (not signing). One cert, specified in SSLSetCertificate(),
+         can support both SSL2 and SSL3 if and only if it is capable of both signing
+         and encryption.
+         
+-- Server mode operation with IE is fully functional and reliable. There is a 
+   bug in IE which is worked around in SSLEncodeServerHello(), in hdskhelo.c.
+   See comments there. Tested with IE 5.0 on OS 9 and 5.1.3 on OS X.  
+   
+-- Server untested with Windows clients. 
+
+