Secure Socket API: An Easy-To-use TLS Extension to BSD Sockets

The Secure Socket API uses the standard POSIX socket API to create a vastly simplified TLS API. This has several advantages:

• Easy development of TLS to create secure clients and servers. You can integrate TLS with your application with 5-15 lines of code versus thousands when using OpenSSL directly. We have ported the library so that in addition to C/C++ you can use the SSA with Python, PHP, and Go.
• Centralized control of all TLS configuration for system administrators and OS vendors. Administrators can tailor TLS configuration to their needs, for example by whitelisting only secure cipher suites or requiring TLS 1.2 and above.
• Simple patching of vulnerable applications. If an application dynamically loads an SSL library, you can port the application to the SSA, without modifying its code.

This paper explores using the POSIX socket API as a vehicle for a simplified TLS API, while also giving system administrators the ability to control applications and tailor TLS configuration to their needs. We first assess OpenSSL and its uses in open source software, recommending how this functionality should be accommodated within the POSIX API. We then propose the Secure Socket API (SSA), a minimalist TLS API built using existing network functions and find that it can be employed by existing network applications by modifications requiring as little as one line of code. We next describe a prototype SSA implementation that leverages network system calls to provide privilege separation and support for other programming languages. We end with a discussion of the benefits and limitations of the SSA and our accompanying implementation, noting avenues for future work.

Mark O'Neill, Scott Heidbrink, Jordan Whitehead, Tanner Perdue, Luke Dickinson, Torstein Collett, Nick Bonner, Kent Seamons, and Daniel Zappala, The Secure Socket API: TLS as an Operating System Service , USENIX Security, August 2018

This paper provides an analysis of contemporary usage of OpenSSL across 410 Linux applications. The results of this study informed our design of the Secure Socket API.

Heidbrink, Scott Jared, A Large-Scale Analysis of How OpenSSL Is Used in Open-Source Software , Master's Thesis, Brigham Young University, 2018.