From 2f232bf192f52f29f543a635bd692200543f2f18 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 4 Apr 2002 13:06:33 +0000 Subject: *** empty log message *** --- doc/tex/ciphers.tex | 6 +++--- doc/tex/handshake.tex | 40 +++++++++++++++++++++++++--------------- doc/tex/translayer.tex | 2 +- 3 files changed, 29 insertions(+), 19 deletions(-) diff --git a/doc/tex/ciphers.tex b/doc/tex/ciphers.tex index 1632193e87..60894e1ac2 100644 --- a/doc/tex/ciphers.tex +++ b/doc/tex/ciphers.tex @@ -4,7 +4,7 @@ Confidentiality is provided by using block encryption algorithms like {\bf 3DES} {\bf AES\footnote{AES or Advanced Encryption Standard is actually the RIJNDAEL algorithm. This is the algorithm that will replace DES.}}, or stream algorithms like {\bf ARCFOUR\footnote{ARCFOUR is a compatible -algorithm with RSA's RC4 algorithm.}} See \hyperref{fig:ciphers}{figure }{}{fig:ciphers} for a complete list. +algorithm with RSA's RC4 algorithm, which is considered as a trade secret.}} See \hyperref{fig:ciphers}{figure }{}{fig:ciphers} for a complete list. Ciphers are encryption algorithms that use a single (secret) key to encrypt and decrypt data. Block algorithms in TLS also provide protection against statistical analysis of the data. \gnutls{} makes use of this property @@ -23,8 +23,8 @@ encryption (EDE). Has 64 bits block size and is used in CBC mode. ARCFOUR & ARCFOUR is a fast stream cipher. \\ \hline -AES\_CBC & AES or RIJNDAEL is the block cipher algorithm that replaces the old -(and insecure\footnote{due to small key length}) DES algorithm. Has +AES\_CBC & AES or RIJNDAEL is the block cipher algorithm that replaces +the old DES algorithm. Has 128 bits block size and is used in CBC mode. This is not officially supported in TLS. \\ diff --git a/doc/tex/handshake.tex b/doc/tex/handshake.tex index 9e43ac7648..c10f63009f 100644 --- a/doc/tex/handshake.tex +++ b/doc/tex/handshake.tex @@ -39,6 +39,7 @@ feature of the {\bf TLS} protocol which allows a client to connect to a server, after a successful handshake, without the expensive calculations (by using the previously established keys). \gnutls{} supports this feature, and the example \hyperref{resume client}{resume client (see Section }{)}{resume-example} illustrates a typical use of it (This is a modification of the simple client example). +\par Servers only need to use the \hyperref{gnutls\_db\_set\_name()}{gnutls\_db\_set\_name() (see Section }{)}{gnutls_db_set_name} function if they want to use the gdbm backend to store sessions. @@ -53,12 +54,16 @@ The resuming capability (mostly in the server side) is one of the problems of a implementations. The problem is that all threads must share information in order to be able to resume sessions. The gnutls approach is, in case of a client, to leave all the burden of resuming to the client (ie. copy and keep the -nesessary parameters). See \hyperref{gnutls\_session\_get\_data()} -{gnutls\_session\_get\_data() on section }{}{gnutls_session_get_data}, -\hyperref{gnutls\_session\_get\_id()} -{gnutls\_session\_get\_id() on section }{}{gnutls_session_get_id} and -\hyperref{gnutls\_session\_set\_data()} -{gnutls\_session\_set\_data() on section }{}{gnutls_session_set_data}. +nesessary parameters). See the functions: +\begin{itemize} +\item \hyperref{gnutls\_session\_get\_data()} +{gnutls\_session\_get\_data() on section }{}{gnutls_session_get_data} +\item \hyperref{gnutls\_session\_get\_id()} +{gnutls\_session\_get\_id() on section }{}{gnutls_session_get_id} +\item \hyperref{gnutls\_session\_set\_data()} +{gnutls\_session\_set\_data() on section }{}{gnutls_session_set_data} +\end{itemize} + \par The server side is different. Here the server only specifies a DB file, using @@ -71,15 +76,20 @@ only one thread can write at a time. The current behaviour of gnutls is not to block to wait for the DB to be ready for writing, but continue the process normally (and do not save the parameters). \par - \gnutls{} also provides callback functions such as: -\hyperref{gnutls\_db\_set\_remove\_function()}{gnutls\_db\_set\_remove\_function() (see Section }{)} -{gnutls_db_set_remove_function}, -\hyperref{gnutls\_db\_set\_store\_function()}{gnutls\_db\_set\_store\_function() (see Section }{)} -{gnutls_db_set_store_function}, \\ -\hyperref{gnutls\_db\_set\_retrieve\_function()}{gnutls\_db\_set\_retrieve\_function() (see Section }{) -}{gnutls_db_set_retrieve_function} and -\hyperref{gnutls\_db\_set\_ptr()}{gnutls\_db\_set\_ptr() (see Section }{)} -{gnutls_db_set_ptr}. +The default behaviour is not efficient in servers where many connections +per second arrive. Thus + \gnutls{} provides the following callback functions: +\begin{itemize} +\item \hyperref{gnutls\_db\_set\_remove\_function()}{gnutls\_db\_set\_remove\_function() (see Section }{)} +{gnutls_db_set_remove_function} +\item \hyperref{gnutls\_db\_set\_store\_function()}{gnutls\_db\_set\_store\_function() (see Section }{)} +{gnutls_db_set_store_function} +\item \hyperref{gnutls\_db\_set\_retrieve\_function()}{gnutls\_db\_set\_retrieve\_function() (see Section }{) +}{gnutls_db_set_retrieve_function} +\item \hyperref{gnutls\_db\_set\_ptr()}{gnutls\_db\_set\_ptr() (see Section }{)} +{gnutls_db_set_ptr} +\end{itemize} + These callback functions are required in order to use a session storage method, other than the default gdbm backend. \par diff --git a/doc/tex/translayer.tex b/doc/tex/translayer.tex index 44f529f9af..067dec0bb7 100644 --- a/doc/tex/translayer.tex +++ b/doc/tex/translayer.tex @@ -6,7 +6,7 @@ use the functions: \item \printfunc{gnutls_transport_set_push_func}{gnutls\_transport\_set\_push\_func()} \item \printfunc{gnutls_transport_set_pull_func}{gnutls\_transport\_set\_pull\_func()} \end{itemize} -These functions accept a functions as a parameter. The given functions will +These functions accept a function as a parameter. The given functions will be used by gnutls to send and receive data. These functions should return -1 on error and should set errno appropriately. \gnutls{} supports EINTR and EAGAIN errno values. These values are -- cgit v1.2.1