-
@kobit I've created a separate branch
new_connectors
which provides classes implementing TLS 1.3 support using OpenSSL. This code is in our repository but guarded with#if canImport(OpenSSL)
(the same thing as#ifdef
in C, which means they will be available only if someone using our library would link it to OpenSSL implementation (but that is not a requirement to have a working TigaseSwift library). In this case, OpenSSL is an optional dependency. Is that OK? (from the licensing point of view)If so, I would like to do the same thing with TigaseSwiftOMEMO which uses OpenSSL but we've kept this implementation in our clients while it would be better to keep it in
TigaseSwiftOMEMO
. -
@kobit Just so you would know. Due to restrictions made by Apple on iOS, I'm not able to bundle OpenSSL (optionally) with TigaseSwift, so I've moved TLS 1.3 support for the new connector to the client-side (BeagleIM for now). The old connector is still not TLS 1.3 capable and the new one has no TLS support unless TLS implementation is provided what is done by the client in our use cases.
-
@kobit There will be 2 possible approaches:
- use an older connector (default) which has TLS support (only 1.2) and which is deprecated but still provided by Apple
- use a newer connector which does not have TLS support at all
In the second case, the developer of the app would need to provide TLS implementation on its own (we could provide - I think - source code for TLS implementation based on OpenSSL).
In the first case, TLS is provided out of the box but only for TLS <= 1.2 but it is still possible to use this connector with TLS 1.3 if proper implementation would be provided.
Type |
Task
|
Priority |
Normal
|
Assignee |
Current API from Apple does not provide TLS 1.3. It would be nice to have as it reduces the number of roundtrips before the connection is established which is useful for slow connections (or if the server is abroad). It would help, ie. with connecting to
tigase.org
as a single roundtrip takes around 150-200ms from Europe.It would be good to consider the usage of
Network.framework
for that and usage of OpenSSL as we are already using it in our clients for OMEMO.