1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
@node Introduction to GnuTLS
@chapter Introduction to GnuTLS
In brief @acronym{GnuTLS} can be described as a library which offers an API
to access secure communication protocols. These protocols provide
privacy over insecure lines, and were designed to prevent
eavesdropping, tampering, or message forgery.
Technically @acronym{GnuTLS} is a portable ANSI C based library which
implements the protocols ranging from SSL 3.0 to TLS 1.2 (see @ref{Introduction to TLS},
for a detailed description of the protocols), accompanied
with the required framework for authentication and public key
infrastructure. Important features of the @acronym{GnuTLS} library
include:
@itemize
@item Support for TLS 1.2, TLS 1.1, TLS 1.0 and SSL 3.0 protocols.
@item Support for Datagram TLS 1.0.
@item Support for handling and verification of @acronym{X.509} and @acronym{OpenPGP} certificates.
@item Support for password authentication using @acronym{TLS-SRP}.
@item Support for keyed authentication using @acronym{TLS-PSK}.
@item Support for TPM, @acronym{PKCS} #11 tokens and smart-cards.
@end itemize
The @acronym{GnuTLS} library consists of three independent parts, namely the ``TLS
protocol part'', the ``Certificate part'', and the ``Cryptographic
back-end'' part. The ``TLS protocol part'' is the actual protocol
implementation, and is entirely implemented within the
@acronym{GnuTLS} library. The ``Certificate part'' consists of the
certificate parsing, and verification functions and it uses
functionality from the
libtasn1@footnote{@url{http://www.gnu.org/software/libtasn1/}} library.
The ``Cryptographic back-end'' is provided by the nettle@footnote{@url{http://www.lysator.liu.se/~nisse/nettle/}}
library.
@menu
* Downloading and installing::
* Document overview::
@end menu
@node Downloading and installing
@section Downloading and installing
@cindex installation
@cindex download
GnuTLS is available for download at:
@url{http://www.gnutls.org/download.html}
GnuTLS uses a development cycle where even minor version numbers
indicate a stable release and a odd minor version number indicate a
development release. For example, GnuTLS 1.6.3 denote a stable
release since 6 is even, and GnuTLS 1.7.11 denote a development
release since 7 is odd.
GnuTLS depends on Libnettle, and you will need to install it
before installing GnuTLS. Libnettle is available from
@url{http://www.lysator.liu.se/~nisse/nettle/}.
Don't forget to verify the cryptographic signature after downloading
source code packages.
The package is then extracted, configured and built like many other
packages that use Autoconf. For detailed information on configuring
and building it, refer to the @file{INSTALL} file that is part of the
distribution archive. Typically you invoke @code{./configure} and
then @code{make check install}. There are a number of compile-time
parameters, as discussed below.
The compression library, libz, as well as p11-kit are a optional dependencies.
You can get libz from @url{http://www.zlib.net/} and p11-kit from @url{http://p11-glue.freedesktop.org/}.
The X.509 part of GnuTLS needs ASN.1 functionality, from a library
called libtasn1. A copy of libtasn1 is included in GnuTLS. If you
want to install it separately (e.g., to make it possibly to use
libtasn1 in other programs), you can get it from
@url{http://www.gnu.org/software/gnutls/download.html}.
A few @code{configure} options may be relevant, summarized below.
They disable or enable particular features,
to create a smaller library with only the required features.
Note however, that although a smaller library is generated, the
included programs are not guarranteed to compile if some of these
options are given.
@verbatim
--disable-srp-authentication
--disable-psk-authentication
--disable-anon-authentication
--disable-extra-pki
--disable-openpgp-authentication
--disable-openssl-compatibility
--disable-libdane
--without-p11-kit
--without-tpm
--disable-dtls-srtp-support
@end verbatim
For the complete list, refer to the output from @code{configure --help}.
@node Document overview
@section Overview
In this document we present an overview of the supported security protocols in @ref{Introduction to TLS}, and
continue by providing more information on the certificate authentication in @ref{Certificate authentication},
and shared-key as well anonymous authentication in @ref{Shared-key and anonymous authentication}. We
elaborate on certificate authentication by demonstrating advanced usage of the API in @ref{More on certificate authentication}.
The core of the TLS library is presented in @ref{How to use GnuTLS in applications} and example
applications are listed in @ref{GnuTLS application examples}.
In @ref{Other included programs} the usage of few included programs that
may assist debugging is presented. The last chapter is @ref{Internal architecture of GnuTLS} that
provides a short introduction to GnuTLS' internal architecture.
|
