Zilog EZ80F91AZA User Manual download pdf (Page 57)

UM020107-1211 SSL Configuration

ZTP Network Security SSL Plug-In

User Manual

asymmetric key exchange/agreement algorithm) that the subject of the certificate is in pos-

session of the private key corresponding to the public key in the certificate, then the certif-

icate recipient can be relatively certain that it is communicating with the entity to which

the certificate was issued.

When the SSL client and the server establish a session using Ephemeral Diffie-Hellman

parameters (or temporary RSA keys), these parameters are also digitally signed by the

SSL server. If the client verifies the signature on these parameters, it can be relatively cer-

tain that the parameters were created by the SSL server and not an attacker attempting to

trick the client to use bogus parameters which the attacker can decode.

By default, the ZTP Network Security SSL Plug-In will attempt to verify all digital signa-

tures. However, this verification can require the execution of many public key algorithms

which take considerable CPU bandwidth. At the customer’s discretion, verification of dig-

ital signatures can be disabled. The customer is advised that doing so will lower the over-

all security of the system. However, in applications requiring faster session establishment

times, disabling the verification of digital signatures could be a viable option.

Disabling Signature Verification

Digital signature verification is controlled by the value of the SSL_VerifySignatures

configuration variable located in the

ssl_conf.c configuration file. The default setting

is shown in the following code fragment:

SSL_BOOL SSL_VerifySignatures = TRUE;

Disabling signature verification is useful only for SSL clients. SSL servers in the ZTP Net-

work Security SSL Plug-In will always generate signatures when required, regardless of

the setting of the

SSL_VerifySignatures variable. In addition, because client authenti-

cation is not supported, SSL servers in this implementation will never verify a client signa-

ture.

Limitations

Because the ZTP Network Security SSL Plug-In only supports a limited set of crypto-

graphic operations, it can only verify (and generate) digital signatures that use these sup-

ported algorithms. A digital signature requires the use of a digest algorithm and a public

key signature algorithm. This implementation supports two digest algorithms (MD5 and

SHA1) and two signature algorithms (RSA and DSA). Therefore, the only digital signa-

ture algorithms that can be supported are:

•

MD5 with RSA encryption

•

SHA1 with RSA encryption

•

SHA1 with DSA

Note:

1 2 ... 52 53 54 55 56 57 58 59 60 61 62 ... 78 79

Comments to this Manuals

No comments

Zilog EZ80F91AZA User Manual Page 57

Comments to this Manuals

Related products and manuals for Sensors Zilog EZ80F91AZA