#
# faq.sdf    - this is it - the first thing that people are going to
#            see when they connect to the WWW version of the documentation
#
# 22-Dec-95 tjh    fixed a few errors with URL refs
# 21-Dec-95 tjh    took out all the old stuff so that it's more current
# ................ given all the changes that have occured
# ................ - updated to new SDF release standards 
# 10-Dec-95 tjh    apache details added
# 31-Oct-95 tjh    more background information for those who came in late
# 15-Sep-95 tjh    finally updated this to reflect the current state of 
# ................ SSLeay - 0.4.5
# 07-Jul-95 tjh    more mirrors and included modification date
# 02-Jul-95 tjh    reworded some of the stuff about certificates thanks
# ................ to feedback from anonymous people :-)
# 30-Jun-95 tjh    more stuff in it based on last weeks worth of email
# ................ questions as more people find out about SSLeay
# 26-Jun-95 tjh    pieced this together out of thin air 
#
# Tim Hudson
# tjh@mincom.oz.au
#
#

!include "tjh.sdc"

!insert AUTOTAG_FILE
!insert AUTOTAG_PHRASES

!define COMPANY_NAME "Tim Hudson and Eric Young"
!export COMPANY_NAME

!if ONLINE
!define DOC_NAME     "SSLeay and SSLapps FAQ"
!define DOC_AUTHOR   "{{[jump=\"mailto:eay@mincom.oz.au\"]E A Young	eay@mincom.oz.au}}"
!define DOC_AUTHOR2  "{{[jump=\"mailto:tjh@mincom.oz.au\"]T J Hudson	tjh@mincom.oz.au}}"
!define DOC_TYPE     ""
!define DOC_STATUS   ""
!else
!define DOC_PROJECT  "SSLeay"
!define DOC_NAME     "SSLeay and SSLapps FAQ"
!define DOC_TYPE     "FAQ"
!define DOC_STATUS   "Draft"
!define DOC_AUTHOR   "E A Young 	eay@mincom.oz.au"
!define DOC_AUTHOR2  "T J Hudson	tjh@mincom.oz.au"
!endif
!define DOC_DISTRIBUTION ""
!define DOC_CODE     ""
!define DOC_CODE_VERSION     ""

!if ONLINE
!insert NON_MINCOM_BUILD_TITLE
!else
!insert NON_MINCOM_BUILD_TITLE
!endif

# wipe out the status stuff ... don't want a () 
dStat:

H1: What is this stuff?

FAQ last updated {{[[MODIFIED_SHORT]].}} 

{{SSLeay}} is a free implementation of Netscape's Secure Socket Layer - the
software encryption protocol behind the Netsite Secure Server and the 
Netscape Browser.

This implementation was coded from scratch using
only the publically available documentation of
the various protocols 
by {{B:Eric Young}} {{EMAIL:eay@mincom.oz.au}}.

The initial prompting to tackle an {{SSL}} implementation, the
alpha testing, {{SSL}} developer (i.e. Eric) hassling, and documentation was 
done by {{B:Tim Hudson}} {{EMAIL:tjh@mincom.oz.au}}.

This implementation has been used 
by {{B:Tim Hudson}} {{EMAIL:tjh@mincom.oz.au}}
to add {{SSL}} 
support to the following:

* telnet (server and client) [now called {{SSLtelnet}}]
* ftp (server and client) [now called {{SSLftp}}]
* NCSA Mosaic 2.5 
* NCSA Mosaic 2.6b1
* NCSA Mosaic 2.6b2
* NCSA httpd 1.3 

The following applications are also now available based on the
earlier work with input from others:

* NCSA httpd 1.4.2

#
# the following are not yet complete and are hence not
# in the printed or online documentation --tjh
#
# * CERN httpd 3.0

The follow are available with certain distribution restrictions:

* Apache

{{SSLeay}} supports the following encryption algorithms:

* DES
* RSA
* RC4
* IDEA

This documentation is 
Copyright {{B:Tim Hudson}} {{EMAIL:tjh@mincom.oz.au}}
See the COPYRIGHT file for the usage and redistribution restrictions.

:Note: a nicely formatted postscript version of this document is
included in the file SSLeay.doc-{{version}}.tar.gz (in the same
directory as the {{SSLeay}} source).

H1: What's New

* Lots of things have changed since the last version of this 
FAQ was {{released}}. The company that we work for now has an 
official RSA certificate from Verisign - in the process 
{{SSLeay}} has been changed to be able to generate 
the {{Certificate Request}} in a form that {{Verisign}} can process.

* There are now a number of different companies and individuals 
running secure web servers based on {{SSLeay}}.

* Netscape have released a browser with configurable CA support

* Verisign have changed their policy on issuing certificates such that
certificates will only be issued for use with {{B:registered}} 
applications (and {{SSLeay}} doesn't fit in any of their current 
categories).

* Eric's finally got the {{SSLeay-0.5}} release together which has involved
changes in the {{API}} and has also tightened lots of the code. There
are also hand-tweaked assembler versions for a number of platforms of
the key routines.

* {{SSLeay}} now {{supports}} Microsoft Windows 3.1 as a series 
of {{DLL}}s (this stuff really is pre-alpha at the moment - but 
at least the majority of the "interesting" work has been done). Note 
that this is being updated to the new {{SSLeay-0.5}} release at the
moment before being generally released again.

* Eric's left for 11 {{B:weeks}} of long overdue (computer-less) holiday

* Apache-SSL is now freely available

H1: Is this legal?

That is one of the {{B:hard}} questions on which there is as yet no
clear answer. You need to read quite a bit of information (see
the RAMBLINGS file in the {{SSLeay}} source distribution) to draw
your own conclusions - and then go and talk to a lawyer. Again
this document is my {{B:opinion}} and as such should be treated
in that light - reality could be quite different to how I 
happen to see things :-).

In short:
* outside the USA there should be no problems
* inside the USA RSA hold patents over the "RSA" algorithms, however if 
you use {{RSAREF}} (which {{SSLeay}} can link to) then 
non-commercial use is {{B:possibly}} okay.
* IDEA may be a problem inside Europe and RC4 inside the USA; both can 
be removed with a simple compile-time option

H1: What does it cost?

{{B:Nothing}}. The package itself is {{B:free}}. There are a couple of 
minor conditions which are outlined clearly in the {{COPYRIGHT}} file in the
source distribution. In short - attribution is mandatory, and no 
publically available version of this code can have a different license.

H1: Can I use it in a commercial product?

{{B:Yes}}. Free of charge. Read the license carefully (see the
{{COPYRIGHT}} file in the {{SSLeay}} source distribution).

H1: What documentation is there?

At present the documentation from a programmer's point of view is fairly
light and you really need to work through the same code that is included
in the library itself and have a look at how the patches are put 
together. It is fairly straight forward to add {{SSL}} support to an
existing application.

Most of the issues that need to be considered if you are going to start
using {{SSL}} either as an end user or as a developer are covered in 
the documentation - certainly there needs to be more work done on this 
documentation; however reading the documentation should answer most 
questions (and raise quite a few more too).

Eric has finally been hassled into starting documentation on the
library itself ... see the {{doc}} directory in the {{SSLeay}} 
distribution. This documentation will be turned into a more verbose
manual over then next few months.

The {{best}} starting point is to look at example code ... either in
the sample client and server program included with {{SSLeay}} or in
any of the patched applications - the structure of each of the 
applications internally is quite similar.

H1: Where is it?

Sources for the library and the applications can be found in the
following locations:

.
{{URL:ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL}} - source + documentation
.
{{URL:ftp://ftp.psy.uq.oz.au/pub/Crypto/SSLapps}} - SSL applications
.
{{URL:ftp://ftp.bond.edu.au/pub/Crypto/SSLapps}} - SSL applications

The {{SSLeay Programmer Reference}} is located at 
.
{{URL:http://www.psy.uq.oz.au/~ftp/Crypto/}} - online documentation
.
{{URL:http://www.bond.edu.au/External/Misc/Crypto/}} - online documentation

:Note: the {{SSLeay Programmer Reference}} is in the process of being
updated to {{SSLeay-0.5}} so what is there doesn't exactly match 
the current version.

H1: Will Netscape talk to NCSA httpd with your patches?

This (believe it or not) has been the most commonly asked question
so far.  

The whole dependence on RSA (actually now {{Verisign}}) 
for certificates is because Netscape 
browsers at release 1.x do not allow the user to configure {{B:which}} 
Certifying Authorities are trusted and {{B:only}} trust four hardcoded 
CAs. 

The Netscape Navigator starting with release 2.x (beta) supports 
user configurable CAs. If the user connects to service that is using
a certificate that is not signed by one of the hardcoded CAs then 
the user is asked if they want to add it to the list of trusted
CAs. This basically means that the security trust policy is now in
the hands of the {{B:user}}.

So in summary: for the old version of the Netscape Navigator (v1.x)
the answer is rather simple: yes {{B:if and only if}} you have
a certificate signed by {{Verisign}} or Netscape (which cost $US200-$US300). 
This has been tested by quite a few people (including myself now) and 
does indeed work. For the new versions (v2.x) this is no longer
a "problem".

H2: Will Verisign issue certificates for use with non-Netscape {{SSL}} servers

This is really an unknown. If you are inside the USA, and you have
linked with the {{RSAglue}} (and hence are using "RSA Software") and you 
are not charging for use of the software (hence you don't come under 
the commercial license requirements as {{B:I}} interpret it) then you 
{{should}} be able to get a certificate from Verisign - as I {{think}} that 
this meets all their license requirements. If you are going to 
do this then I suggest that you carefully read the license that 
comes with {{B:RSAREF}}.

:Note: like the rest of this document - this is not a {{B:legal}} opinion 
and is only {{B:my}} view of things.

As soon as I have an {{B:official}} statement from RSA (or {{Verisign}}) 
on their views of this issue, I'll update this section of the 
document. I am interested in feedback from those who contact RSA (or
{{Verisign}}) to see what their actual response is to using {{SSLeay}}.

:Note: {{Verisign}} (who are now responsible for generating and managing
the signing of certificates on behalf of RSA) have changed their policy
such that {{SSLeay}}-based applications do not meet their requirements
(at the moment) for them to issue certificates.

H2: Can you legally use an existing RSA certificate?

If you already have a certificate from RSA can you (legally) use 
it with an {{SSLeay}}-ized httpd? This {{B:may}} be okay if you have 
linked with {{RSAREF}}. Outside of the USA this isn't an issue as far
as I am aware. However if you want the Netscape browser to work
in secure mode then you will still need an RSA or Netscape 
signed certificate for your {{B:server}}.

You really {{B:should}} read the details of the process 
that {{Alex Tang}} {{EMAIL:altitude@cic.net}} has been through
if you are {{"blessed"}} with being inside the USA. This is 
detailed at {{URL:http://petrified.cic.net/~altitude/ssl/ssl.saga.html}} 
and makes quite "interesting reading".

H1: Will NCSA Mosaic talk to Netsite secure servers with your patches?

The patches to Mosaic were done so that there is {{B:no}} checking of
the certificate of the server such that Mosaic will connect and work
with {{B:any}} of the existing Netsite secure servers without a problem.
This however is probably {{B:not}} the policy you should run if you are
planning on issuing credit card transactions - the client {{B:should}}
have some form of security verification procedure in place where it
checks the server against a trusted list before handing over any
important information.

Exactly how the whole certificate management and authorisation process 
is going to work on a {{B:global}} basis is really unknown at this stage.

H1: How can I help with this stuff?

Rather simply put, we {{B:need}} people who are prepared to contribute
to the effort under the same conditions that we work (which is simply
attribution is mandatory but everything generated is totally {{B:free}}
otherwise) so that we have a wider supported set of applications. If
you do add {{SSL}} support to an application please drop us a line (and
the patches if at all possible).

However if you wish to send donations of almost any form, neither 
of us will say no and it may influence what we work on next and
how quickly things are done.

If you have access to a Unix varient that we do not and you are
well connected (bandwidth-wise) and don't mind a little extra load
then we can speed up the spread of the {{SSL}} applications (the library
itself is {{B:very}} portable - it's the applications (at the moment) 
that are significantly less so. 

Also {{B:join}} the {{EMAIL:ssl-users@mincom.oz.au}} mailing list (send 
email to {{EMAIL:ssl-users-request@mincom.oz.au}}
for instructions for using the {{majordomo}} varient that manages 
this list - which in short are send mail to {{EMAIL:factotum@mincom.oz.au}} 
with a message body of {{subscribe ssl-users}}).

H1: List of downloadable files

For those who like to drive everything via {{WWW}} browsers here is
a list of those things you might want to grab - always be aware that
this document lags behind what is actually sitting on the ftp servers.

#TODO: put some direct stuff in here once things have slowed down a bit ;-)

* {{URL:ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/}} - {{SSLeay}} source
* {{URL:ftp://ftp.psy.uq.oz.au/pub/Crypto/SSLapps/}} - {{SSL}} applications

H1: SSLeay Programmer Reference

Details (and some replication of bits of this document) can 
be found {{[jump="ssl.html"] >here< }}.

H1: Who can I email to if I have problems?

Well, as this in an unpaid effort there is {{B:no}} guarantee of 
support (you get what you pay for :-); however there is a mailing
list which has those people subscribed to it who are interested 
in {{SSLeay}} and it's furthur development.

Join the {{EMAIL:ssl-users@mincom.oz.au}} mailing list (send email 
to {{EMAIL:ssl-users-request@mincom.oz.au}} for instructions for 
using the {{majordomo}} varient that manages this list - which in 
short are send mail to {{EMAIL:factotum@mincom.oz.au}} with a message 
body of {{subscribe ssl-users}}).

H1: How do I contact Eric and Tim?

Eric Young {{EMAIL:eay@mincom.oz.au}}

Tim Hudson {{EMAIL:tjh@mincom.oz.au}}

Or to get hold of {{B:both}} of us (which is probably the "right"
thing to do for most questions) use {{EMAIL:ssleay@mincom.oz.au}}

Eric concentrates on the library side of thing and Tim (me) has
done all the applications and documentation; however it is better 
to contact {{B:both}} of us unless it's a really specific question 
as we do know what each other is working on and work different hours
(and have different opinions on some things too :-) and take holidays
at different times.

H1: Mirror sites

If you are outside of the USA and not covered by legal restrictions on
the export and import of encryption technology then drop us a line 
if you are prepared to mirror the {{SSLeay}} distribution and you will
be added to this list.

Andreas Bogk {{EMAIL:bogk@inf.fu-berlin.de}} 
mirrors the SSLeay distribution (updated every 24 hours) in 
the following location:

* {{URL:ftp://ftp.wildpark.com/pub/Crypto/SSL/}}
* {{URL:ftp://ftp.wildpark.com/pub/Crypto/SSLapps/}}

Christoph Martin {{EMAIL:christoph.martin@uni-mainz.de}} 
mirrors the {{SSLeay distribution}} (updated every 24 hours) in 
the following location:

* {{URL:ftp://ftp.uni-mainz.de/pub/internet/security/ssl}}
* {{URL:ftp://ftp.uni-mainz.de/pub/internet/security/ssl/SSL}}
* {{URL:ftp://ftp.uni-mainz.de/pub/internet/security/ssl/SSLapps}}

The German CERT server in Hamburg

* {{URL:ftp://ftp.cert.dfn.de/pub/tools/crypt/sslapps}}
* {{URL:ftp://ftp.cert.dfn.de/pub/tools/crypt/ssleay}}

For those close to Finland

Panu Rissanen {{EMAIL:bande@nic.funet.fi}} mirrors {{SSLeay}} updated 
biweekly at:

* {{URL:ftp://ftp.funet.fi/pub/crypt/mirrors/ftp.psy.uq.oz.au/}}

Sites in Sweeden

* {{URL:ftp://ftp.sunet.se/ftp/pub/security/tools/crypt/ssleay}}
* {{URL:http://ftp.sunet.se/ftp/pub/security/tools/crypt/sslapps}}

Tein Yuan {{EMAIL:tyuan@beta.wsl.sinica.edu.tw}} mirrors {{SSLeay}} related 
stuff at:

* phi.sinica.edu.tw:/pub/security/SSL

#Sites in Africa
#
#Johan Eksteen <johan@dent.mikom.csir.co.za>
#skeleton.mikom.csir.co.za

Sites in Korea

Lee, Ho-sun {{EMAIL:ahmlhs@cair.kaist.ac.kr}} mirrors {{SSLeay}}
related stuff at:

* {{URL:ftp://FTP.kaist.ac.kr/pub/WWW/Security/Crypto/}}

Sites in Japan

Takahiro Kiuchi {{EMAIL:kiuchi@rick.epistat.m.u-tokyo.ac.jp}} mirrors
{{SSLeay}} related stuff at:

* {{URL:ftp://ftp.epistat.m.u-tokyo.ac.jp/pub/Crypto}}

Sites in the UK

Steve Kennedy {{EMAIL:steve@gbnet.net}} mirrors {{SSLeay}} updated
daily at:

* {{URL:ftp://ftp.gbnet.net/pub/security/Crypto}}


H1: Microsoft Windows ...

Is there a Windows version of {{SSLeay}} and the applications to go with it? 
The answer is that the {{technical}} port is complete and has been released
as a separate distribution of files for building using {{Borland C++ 4.0}}.

Again, if you wish to help with this continuing effort (and are also
a competant MS Windows programmer) then send 
email to {{EMAIL:tjh@mincom.oz.au}}.

H1: Other information

.
{{[jump="ssl"]SSLeay Programmer Reference}}
.
{{[jump="certs"]Certificate Handling Interface}}

And for porting notes for the following applications:

.
{{[jump="mosaic"]NCSA Mosaic 2.5}}
.
{{[jump="telnet"]SRA Telnet - SSLtelnet & SSLftp}}
.
{{[jump="httpd"]NCSA HTTPD 1.3}}
.

H1: Other SSL-enabled applications

4.4BSD-Lite telnet (NEtelnet) patches done by Christoph Martin 
{{EMAIL:christoph.martin@uni-mainz.de}}
are located at:

# * {{URL:ftp://ftp.uni-mainz.de/pub/internet/security/ssl/BSD.SSLapps/BSD.SSLtelnet-0.3.tar.gz}}
* {{URL:ftp://ftp.uni-mainz.de/pub/internet/security/ssl/SSL-MZapps}}

:Note: Christoph and myself are in the process of merging our code to
get back to having a single version of the source.

H1: SSL Protocol Reference Information

The {{SSL Protocol Specification}} is detailed at {{URL:http://home.netscape.com/newsref/std/SSL.html}}

{{SSLRef}} (The Netscape Reference Implementation of SSL) is 
located at {{URL:http://home.netscape.com/newsref/std/sslref.html}}

# I'm being really nice by including details of the netscape mailing
# list here so it's easy to subscribe and give feedback :-)
There is also a mailing list for discussion of {{SSL}} run by Netscape at
{{EMAIL:ssl-talk@netscape.com}}. You can join this list by sending mail to
{{EMAIL:ssl-talk-request@netscape.com}} with {{subscribe}} as the
subject line or the message body.

H1: Apache with SSL support

The first fully functional version of {{Apache}} with {{SSL}} support
was implemented by Ben Laurie {{EMAIL:ben@algroup.co.uk}}. This server
is probably the {{B:best}} choice at the moment if you are looking for
a commercial-strength {{SSL}} capable WWW server. 

* {{URL:ftp://ftp.ox.ac.uk/pub/crypto/SSL/}}

#Ben Laurie                  Phone: +44 (181) 994 6435
#Freelance Consultant        Fax:   +44 (181) 994 6472
#and Technical Director      Email: ben@algroup.co.uk
#A.L. Digital Ltd,           URL: http://www.algroup.co.uk
#London, England.

H2: Inside the USA

#Sameer Parekh					Voice:   510-601-9777
#Community ConneXion				FAX:     510-601-9734
#The Internet Privacy Provider			Dialin:  510-658-6376
#http://www.c2.org/ (or login as "guest")		sameer@c2.org

{{Apache-SSL}} is available within the USA for commercial and
non-commercial use from {{Community ConneXion}}. See
{{URL:http://www.c2.org/apachessl/}} for more information. 
:Note: this release is built against {{RSAREF}}.

H1: Other Reference Information

A rather extensive list of cryptographic material is maintained at
{{URL:http://www.cs.hut.fi/crypto/}} and a handy 
list of publically available software is available 
directly at {{URL:http://www.cs.hut.fi/crypto/software.html}}.

H1: PGP Public Keys

If you happen to wish to send non-plaintext email then the following is
the PGP key for {{EMAIL:tjh@mincom.oz.au}}. (And yes I do know that the
key size is {{B:small}}).

E:-----BEGIN PGP PUBLIC KEY BLOCK-----
E:Version: 2.6
E:
E:mQBNAi/oJncAAAECAMaa9ZLFog0U3Lbxm3slZyKBdWR1+ob2EjELGT3JZFrLB6ry
E:RUyTq+PcniHEuPYNFZpK9bFd8udSMlNNMFtWXIUABRG0HVRpbSBIdWRzb24gPHRq
E:aEBtaW5jb20ub3ouYXU+
E:=Jzye
E:-----END PGP PUBLIC KEY BLOCK-----

