Specifications

Symmetric Ciphers

	AES128-SHA
	AES256-SHA
	RC4-SHA
	RC4-MD5

Asymmetric Ciphers

	RSA 512/1024/2048/4096 bit encryption/decryption.
	RSA signing/verification

Digests

	SHA1
	MD5
	MD2
	HMAC-SHA1
	HMAC-MD5

RNG

	/dev/urandom on Linux.
	Microsoft's crypto interfaces on Win32.
	Alternatively a custom implementation seeded by the private key and other variables.

SSL Protocol Features

	TLSv1.0 (also supports the v23 client hello).
	Session resumption on both client and server (number of sessions is run- time configurable).
	Session renegotiation (instantiated via an API call on either the client or the server).
	Integrity checking on packet sizes, handshake types.
	Two threading models: a SSL_CTX instance can support many SSL connections in a single thread - and multiple threads can have one SSL_CTX context each (the default); and a SSL_CTX instance can have an individual thread for each SSL connection (via a configuration change allowing mutexing).
	Partial openssl API compatibility via a wrapper (compile-time configurable).

Certificate/Key Support

	X.509 certificate support. No v3 extensions are supported.
	Self-signed v1 certificates can be generated given a private key.
	PEM private keys can be decrypted with AES128 or AES256 ciphers.
	Server peer verification (can choose between automatic verification, or verification after the handshake).
	Client peer verification on the server (handshake is terminated immediately on failure).
	Certificate chaining - the number of certificates is compile- time configurable individually on both client/server.
	CA certificate store size is compile-time configurable.
	PKCS#8, PKCS#12 key/certificates supported (PBE-SHA1-RC4-128 encryption only, with a single key).

Supported Platforms

	Linux (32/64 bit)
	Win32 (VC6.0/VC7.0/VC8.0)
	Solaris
	Cygwin

Supported Language Bindings (with sample code for each)

	C
	C#
	VB.NET
	Java
	Perl
	Lua

Web Server Specifications

	Small footprint.
	CGI 1.1 capable (optional protection using chroot() and a uid/gid change).
	Basic authentication (via a .htpasswd file).
	Can allow/deny SSL access on particular directories (via a .htaccess file).
	Directories/files can be denied access (via a .htaccess file).
	Lua and Lua Pages are now supported.

Speed/Performance

Here is a graph generated by JMeter showing some various modes with 16 threads looping 10 times on the HTTP test page (using a 1024bit RSA public key and compiled with VC7.0 on a Win32 platform):

The first figure is normal HTTP, followed by three cipher modes, and then skeleton mode. Note that these performance times are very subjective, and are just shown as a simple guide. Each environment will give different results - e.g. the following is the same test performed on AMD64 Linux (with the same hardware)::

But what it does show that using SSL gives almost an order of magnitude decrease in performance compared to normal HTTP.

For public key encryption times, see the blog.

Home | Specifications | F.A.Q. | axTLS API | Contact Us