Introduction
98
SWRU455A – February 2017 – Revised March 2017
Copyright © 2017, Texas Instruments Incorporated
Secure Socket
7.1
Introduction
The SimpleLink device provides a secured socket layer using the SSL and TLS protocols (both referenced
as SSL in this document), which are cryptographic protocols designed to provide communications security
over a TCP connection. For common systems, the SSL is a layer on top of the transport layer. To simplify
the use, the SSL is embedded into the BSD layer in the SimpleLink device. SSL operations are easily
done by using the BSD commands with unique parameters and options. The SimpleLink device supports
up to six SSL sockets connected at a time. The SSL uses separate execution environment by design, to
better secure the keys and flows in the SimpleLink device. Hardware accelerators are used to offload the
MCU in arithmetic calculation of cryptography algorithms.
7.2
Key Features
lists the key features of the secure socket.
Table 7-1. Key Features
Key Features
Description
Client
Server
SSL server
Open SSL servers and accept up to six peers (six is the
maximum SSL connections, it depends on how many clients are
connected).
SSL client
Open SSL client and connect up to six peers (six is the
maximum SSL connections, it depends on how many servers
are connected).
Certificates
Support certificates and root CAs according to x509 standard.
√
√
BSD commands
The SSL layer is embedded into the BSD commands to ease the
usage.
√
√
Server verification
Support full chain of trust verification while the SimpleLink
device is in client mode.
√
N/A
Domain verification
Support domain verification in client mode, to help against MITM
attack.
√
X
Client verification
Support client authentication, both in server mode to
authenticate a client that is trying to connect to the server, and in
client mode, when a remote server is asking for client certificate.
N/A
√
Time and Date verification
Support time and date verification of server/client cert according
to the time and date configured in the SimpleLink device.
√
X
Cryptography
Support the following cryptographic algorithms –
RC4,AES|GCM|CBC,CHACHA20,SHA1|256|384|512,MD5,POLY
1305,RSA,DHE,ECDSA,ECDHE.
√
√
STARTTLS
Start SSL handshake on a regular TCP socket. Usually used for
SMTP on port 587.
√
√
ALPN
Support Application Layer Protocol Names List; this is a limited
list with HTTP1.1 and H2 drafts.
√
X
DER/PEM file formats
Certificate files and keys can be programmed to the file system
in either DER or PEM formats. Certificate chain must be in PEM
format. Certificate chain is only available in server mode.
√
√
Trusted root-certificate catalog
Mechanism to determine if a root CA is known and trusted by TI
or if a certificate is revoked.
√
X
7.3
Opening a Secure Socket
This section provides information on how to establish secured socket session with BSD API. A secured
socket is a TCP socket, which encrypts and decrypts data. The BSD flow is the same as regular TCP
socket BSD, excluding specific secured socket options.
There are two ways to open secured socket:
•
sl_Socket(SL_AF_INET, SL_SOCK_STREAM, SL_SEC_SOCKET) – This command opens a secured
socket. The first two parameters are typical TCP socket parameters, and the last parameter enables
the security. After the socket has been created, it is possible to use the standard *BSD commands
(sl_Close, sl_Listen, sl_Accept, sl_Bind, sl_SetSockOpt, and so forth).