开源SSLv3协议栈-MatrixSSL
2014-04-21 09:04:24 
阿炯
MatrixSSL是针对小型应用程序和设备设计的嵌入式、开放源码SSLv3协议栈(商业版支持TLS协议)。它减少了将SSL整合进嵌入式工程的复杂性，使用一个简单的API和安全层，用户可以很容易地将MatrixSSL整合到它们的应用程序。采用C语言开发并在GPL协议下授权。
Matrixssl使用工业界标准的加密算法(RC4、DES3、AES、RSA)和协议，它确保用户获得一个编译不到50K(Openssl需要1M左右)的提供强大和可靠安全解决方案的库函数，并具有可插拔密码套件、算法和可移植性强等特点，可以方便定制密码套件和算法以及平滑地向多平台移植，非常适合在资源受限的嵌入式环境中使用。
MatrixSSL is an embedded SSL and TLS implementation designed for small footprint applications and devices. Available is a fully supported, commercial version as well as an open source version that is available for download. MatrixSSL allows secure management of remote devices. Several secure embedded Web servers also use MatrixSSL for their encryption layer.
Features
50KB total footprint with crypto provider
SSL 3.0 and TLS 1.0, 1.1 and 1.2 server and client support
Included crypto library - RSA, ECC, 3DES, AES, ARC4, SHA1, SHA2, MD5
Assembly language optimizations for Intel, ARM and MIPS
Cipher Suites - RC4-MD5, RC4-SHA, DES-CBC3-SHA, AES128-SHA, AES256-SHA
Session re-keying and cipher renegotiation
Full support for session resumption/caching
Server Name Indication and Stateless Session Tickets
Server and client X.509 certificate chain authentication
Parsing of X.509 .pem and ASN.1 DER certificate formats
PKCS#1.5, PKCS#5 PKCS#8 and PKCS#12 support for key formatting
Certificate Revocation List (CRL) support
SSH command line support
DTLS support
Fully cross platform, portable codebase; minimum use of system calls
Pluggable cipher suite interface
Pluggable crypto provider interface
Pluggable operating system and malloc interface
TCP/IP optional
Multithreading optional
Only a handful of external APIs, all non-blocking
Example client and server code included
Clean, heavily commented code in portable C
User and developer documentation Included with commercial license
最新版本：3.6
此版本更新内容如下：
TLS 1.2 客户端和服务器
ECC, DH 和 ephemeral 密钥交换
Pre-Shared Key (PSK), AES-GCM, SEED 和 IDEA ciphers
SHA2 (256, 384, and 512 bit) hashes and HMAC
Server Name Indication (SNI), Stateless Session Ticket 和 Truncated HMAC 扩展
Intel assembly and AES-NI acceleration
一些从商业产品开源过来的特性
现仅有 SSH 和 DTLS 是商业化的
安全修复：certificate parsing is much more strict, and several length underflow issues were fixed as a result of multiple external code audits
官方主页：http://www.matrixssl.org/