On 11/15/2010 6:07 AM, Paul Ruizendaal wrote:

>
> The most popular API is that of OpenSSL: other implementations tend to use
> that API as to be an easy substitute. OpenSSL is a big package (1MB
> binary), a smaller choice is yassl (GPL, 200KB binary):
> http://www.yassl.com/
> I guess running the existing FB wire protocol over TLS would fix a lot of
> concerns. Assuming NimbusDB can't use GPL, yassl sell source code licenses
> for $5,000.
>

There's a licensing problem with yassl and Firebird. Yassl is GPL with
a FOSS exclusion, but the FOSS exclusion is the MySQL / Oracle FOSS
exclusion, which has an explicit list of acceptable FOSS licenses.
Needless to say, neither the IDPL or the IPL are listed. Maybe you
could talk to Larry Ellison about including Firebird...

As for NimbusDB, I think I'm happy with the client sending a session key
encrypted with the hash of the password. No additional round trips, no
expensive RSA encryption, decryption, no man in the middle issue, though
I'm still pondering the issue.

As I see it, TLS requires that connections be established without shared
secrets, hence session keys passed through a pkcs and certificates to
avoid MITM attacks. SRP doesn't assume a secure channel and has an
internal pkcs. SRP under TLS, I think, is overkill, and way too much
computation to establish a database connection, particularly if there
were an equally secure alternative.

As I've said, I'd rather security be cheap and used than too expensive
to use.