[2022.10.31] The Secure Socket API: TLS as an Operating System Service

Abstract

SSL/TLS libraries are notoriously hard for developers to use, leaving system administrators at the mercy of buggy and vulnerable applications. We explore the use of the standard POSIX socket API as a vehicle for a simpli- fied TLS API, while also giving administrators the abil- ity to control applications and tailor TLS configuration to their needs. We first assess OpenSSL and its uses in open source software, recommending how this function- ality should be accommodated within the POSIX API. We then propose the Secure Socket API (SSA), a min- imalist TLS API built using existing network functions and find that it can be employed by existing network applications by modifications requiring as little as one line of code. We next describe a prototype SSA imple- mentation that leverages network system calls to provide privilege separation and support for other programming languages. We end with a discussion of the benefits and limitations of the SSA and our accompanying implemen- tation, noting avenues for future work.

Paper

The Secure Socket API TLS as an Operating System Service.pdf

Summary

The Secure Socket API - TLS as an Operating System Service_summaryBySangwonLim.pdf