Subject: Query: OpenSSL compatibility with LK-SCTP Transport.

From: sandeep kandula <[email-masked]>
Date: Mon, 1 Aug 2011 12:43:37 +0530

Hi All,

I’m a new baby to open source world. Please forgive me, if I posted this
query to a wrong mailing list.

Here is my query. Currently I have a proprietary application which uses
LKSCTP (Open source SCTP implementation) stack. And I’m planning use the
“Transport Layer Security” for the SCTP transport provided by the LKSCTP
community, as suggested by RFC 3436. (http://www.ietf.org/rfc/rfc3436.txt)

Can somebody help me regarding this, by answering following quires?

1.    Can I use TLS (Transport Layer Security) with LKSCTP, without losing
any of my SCTP features? If “No” What are SCTP features I cannot use with
TLS.
2.    Is OPENSSL is correct choice for this? If “No” Why cannot I use
OpenSSL for this? Do you have any other suggestion please help me.
3.    What are the limitations if I use the TLS for my application through
SCTP transport?

Please let me know if you have any suggestion or more information regarding
the same.
Thanks in advance for your help.

-- 
Regards,
Sandeep.

---

From: Michael Tüxen <[email-masked]>
Date: Mon, 1 Aug 2011 10:12:41 +0200

On Aug 1, 2011, at 9:13 AM, sandeep kandula wrote:

> 
> Hi All,
> 
> I’m a new baby to open source world. Please forgive me, if I posted this query to a wrong mailing list.
> 
> Here is my query. Currently I have a proprietary application which uses LKSCTP (Open source SCTP implementation) stack. And I’m planning use the “Transport Layer Security” for the SCTP transport provided by the LKSCTP community, as suggested by RFC 3436. (http://www.ietf.org/rfc/rfc3436.txt)
> 
> 1.    Can I use TLS (Transport Layer Security) with LKSCTP, without losing any of my SCTP features? If “No” What are SCTP features I cannot use with TLS.
You can not use unordered delivery and PR-SCTP. Since OpenSSL does require a 1-to-1 relation
between SSL objects and BIOs, there is no easy way to use OpenSSL to realize TLS/SCTP.
To overcome this limitations you can use DTLS/SCTP, which is specified in
http://tools.ietf.org/html/rfc6083
and you can get an implementation for OpenSSL from
http://sctp.fh-muenster.de/dtls-patches.html
(at the table called 'Features' almost at the bottom of the page)
I supports recent versions of FreeBSD and LKSCTP in on a 3.0 kernel. You need a patch
for the netinet/sctp.h file, which I can send you privately.

I hope this clarifies also your other questions.

Best regards
Michael
> 2.    Is OPENSSL is correct choice for this? If “No” Why cannot I use OpenSSL for this? Do you have any other suggestion please help me.
> 3.    What are the limitations if I use the TLS for my application through SCTP transport? 
> 
> Please let me know if you have any suggestion or more information regarding the same.