Add support for TLS 1.3 (#82)
Closed
Andrzej Wójcik (Tigase) opened 4 years ago

Current API from Apple does not provide TLS 1.3. It would be nice to have as it reduces the number of roundtrips before the connection is established which is useful for slow connections (or if the server is abroad). It would help, ie. with connecting to tigase.org as a single roundtrip takes around 150-200ms from Europe.

It would be good to consider the usage of Network.framework for that and usage of OpenSSL as we are already using it in our clients for OMEMO.

Andrzej Wójcik (Tigase) commented 4 years ago

@kobit I've created a separate branch new_connectors which provides classes implementing TLS 1.3 support using OpenSSL. This code is in our repository but guarded with #if canImport(OpenSSL) (the same thing as #ifdef in C, which means they will be available only if someone using our library would link it to OpenSSL implementation (but that is not a requirement to have a working TigaseSwift library). In this case, OpenSSL is an optional dependency. Is that OK? (from the licensing point of view)

If so, I would like to do the same thing with TigaseSwiftOMEMO which uses OpenSSL but we've kept this implementation in our clients while it would be better to keep it in TigaseSwiftOMEMO.

Andrzej Wójcik (Tigase) commented 4 years ago

@kobit Just so you would know. Due to restrictions made by Apple on iOS, I'm not able to bundle OpenSSL (optionally) with TigaseSwift, so I've moved TLS 1.3 support for the new connector to the client-side (BeagleIM for now). The old connector is still not TLS 1.3 capable and the new one has no TLS support unless TLS implementation is provided what is done by the client in our use cases.

Artur Hefczyc commented 4 years ago

Thank you for update.

So, I understand that the TLS 1.3 would not be part of the library but it would be part of the client app, right? So, if somebody would develop own app based on our library, he would take care of the this part himself?

Andrzej Wójcik (Tigase) commented 4 years ago

@kobit There will be 2 possible approaches:

  1. use an older connector (default) which has TLS support (only 1.2) and which is deprecated but still provided by Apple
  2. use a newer connector which does not have TLS support at all

In the second case, the developer of the app would need to provide TLS implementation on its own (we could provide - I think - source code for TLS implementation based on OpenSSL).

In the first case, TLS is provided out of the box but only for TLS <= 1.2 but it is still possible to use this connector with TLS 1.3 if proper implementation would be provided.

Artur Hefczyc commented 4 years ago

I understand. I think that using TLS 1.3 is the way to go and to make it a part of the client itself.

issue 1 of 1
Type
Task
Priority
Normal
Assignee
Issue Votes (0)
Watchers (0)
Reference
tigase/_libraries/Martin#82
Please wait...
Page is in error, reload to recover