Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I want to develop network client and server with GnuTLS. I have several options: x509, PSK, SRP or PGP? Which of these methods are considered most secure and which of them are not recommended for applications which need high level of network communication security?
Best Wishes
It depends on who will be using your client (real users, or a daemon/cronjob of some sort) and what kind of interoperability with other software you need.
For most purposes, X509v3 certificates are the way to go. They are by far the most widely used and implemented way of authenticating on top of SSL/TLS and have the best interoperability. PSK, SRP and PGP are rather exotic choices in the context of SSL/TLS.
If you need client authentication, and using certificates for client authentication does not work well for your scenario because non-technical users need to be able to use it, then SRP is the safest choice for password based authentication over SSL/TLS.
Using PGP is conceptually equivalent to X509v3 certificates but less interoperable. Unless you already have a PGP based PKI deployed in your environment, using PGP would not be the best choice.
PSK is the most limited choice and is only suitable if you must avoid public key computations on your client because of severe CPU/memory constraints, which is most likely not the case.