How does zeromq work together with SSL?

sockets ssl zeromq
newtogit picture newtogit · Mar 22, 2011 · Viewed 12.4k times · Source

I am considerung to use zeromq as messaging layer between my applications. At least in some cases I want the communication to be secure and I am thinking about SSL.

Is there some standard way how to ssl-enable zeromq? As far as I understand it doesn't support it out of the box.

It would be nice if I just had a parameter when connnecting to a socket (bool: useSsl) :)

Any ideas?

Answer

Jason picture Jason · Nov 7, 2013

Understanding that this is not really an answer to your question, I'm going to be encrypting the messages directly with RSA, before sending them with 0mq.

In the absence of a more integrated encryption method that is fully tested and implemented in my platform of choice, that's what I'm going with. 0mq just recently released version 4, which has encryption baked in, but it's still considered experimental and isn't fully supported by the language bindings.

Encrypting the message, rather than the connection, seems to provide the simplest upgrade path, and the difference for our purposes are pretty much just semantics given how we'd have to implement encryption currently, today.

Edit: I know more about encryption now than I did when I wrote this, RSA is not an appropriate choice for encrypting message data. Use AES, either with manually sharing keys (this is our approach for the short term) or implementing a key sharing scheme as in Jim Miller's answer... but beware if you take the latter approach, designing and implementing a key-sharing scheme securely is hard. Way harder than you'd think. You can implement SSL/TLS directly (using message BIOs), and others have done so, it's also not simple but at least know that the SSL scheme is industry standard and therefore meets a minimum security requirement.

In short, before the Elliptic Curve crypto baked into ZMQ 4 is considered reliable and becomes standard, the "accepted solution" would be to implement SSL/TLS over the connection manually, and failing that, use AES 128 or 256 with a secure key sharing mechanism (key sharing is where RSA would appropriately be used).

Related questions

Turn a simple socket into an SSL socket

I wrote simple C programs, which are using sockets ('client' and 'server'). (UNIX/Linux usage) The server side simply creates a socket: sockfd = socket(AF_INET, SOCK_STREAM, 0); And then binds it to sockaddr: bind(sockfd, (struct sockaddr *) &serv_…

Read More
Failed: Error in connection establishment: net::ERR_CONNECTION_REFUSED

I try to connect with socket to my server. My server is running server socket with Rachet on port 8080. I try to run this code: <script> try{ conn = new WebSocket('wss://localhost:8080'); conn.onclose = function (e) { //checkUser(); } …

Read More
How much overhead does SSL impose?

I know there's no single hard-and-fast answer, but is there a generic order-of-magnitude estimate approximation for the encryption overhead of SSL versus unencrypted socket communication? I'm talking only about the comm processing and wire time, not counting application-level processing. Update …

Read More