TPF : Support : Maintenance TPF : Support : Maintenance
SUBJECT: APAR NUMBER: PJ27863
REFERENCE: AREA: TCP/IP APPLICATION LAYER
SEGMENT: IBMPAL40 - RELEASE: TPF4 (Copy)
SEGMENT: SPPGML40 - RELEASE: TPF4 (Macro)
Pre-requisite APARs are:
FOR SEGMENT IBMPAL40 (Copy) - REL TPF4
PJ13514 PJ13496 PJ13560 PJ14078
PJ14282 PJ14557 PJ14444
PJ14722 PJ14805 PJ14858 PJ13562
PJ14605 PJ15324 PJ14437
PJ15585 PJ16213 PJ15454 PJ16331
PJ17568 PJ14737 PJ14947
PJ17852 PJ17912 PJ17292 PJ15728
PJ19689 PJ19949 PJ19966
PJ19938 PJ19272 PJ19727 PJ21044
PJ20777 PJ21167 PJ20974
PJ21596 PJ21584 PJ21592 PJ21791
PJ20388 PJ22079 PJ21706
PJ22208 PJ17689 PJ21709 PJ22389
PJ22925 PJ21701 PJ22975
PJ22434 PJ23178 PJ23180 PJ22937
PJ23336 PJ22843 PJ23430
PJ23434 PJ23338 PJ21693 PJ23297
PJ21694 PJ21708 PJ24147
PJ23931 PJ23923 PJ24344 PJ24472
PJ23620 PJ24525PJ24530PJ24563PJ24626 PJ23984 PJ24845PJ24912PJ25084PJ25094PJ25098PJ25089PJ25158PJ25261PJ25277PJ25266PJ25207
PJ23981 PJ25075PJ25375PJ25379PJ25442PJ25425PJ25632PJ25444PJ25589PJ25703PJ25720PJ25684PJ25332PJ25760PJ25781PJ25780PJ25953PJ25982PJ25983PJ25981PJ26125PJ25880PJ26150PJ26187PJ26161PJ26188PJ26174PJ26350PJ26365PJ26366PJ26283PJ26384PJ26516PJ26468PJ26575PJ26577PJ26534PJ26685PJ26683PJ26713PJ26600PJ26581PJ26693PJ26686PJ26707PJ26782PJ26781PJ26864PJ26892PJ27023PJ27028 PJ21337 PJ26904PJ26890PJ27079PJ27095PJ27073PJ27197PJ27246PJ27305PJ27231PJ27277PJ27387PJ27383PJ27083PJ27268PJ27333PJ27214PJ27393PJ27422PJ27469PJ27430PJ27636PJ27491PJ27647PJ27484PJ27530PJ27627PJ27650PJ27617PJ27686PJ27634PJ27804PJ27784PJ27786PJ27847PJ27951
FOR SEGMENT SPPGML40 (Macro) - REL TPF4
PJ13509 PJ13579 PJ14357 PJ14282
PJ14858 PJ14605 PJ14437
PJ16213 PJ15454 PJ14737 PJ14947
PJ17852 PJ17912 PJ15728
PJ19734 PJ19949 PJ19966 PJ19938
PJ19866 PJ21121 PJ21044
PJ20777 PJ21167 PJ21596 PJ21584
PJ21592 PJ21791 PJ20388
PJ21953 PJ22079 PJ22088 PJ22098
PJ21706 PJ22170 PJ21709
PJ22389 PJ21452 PJ21906 PJ21701
PJ21705 PJ23148 PJ23128
PJ22434 PJ23178 PJ23180 PJ23318
PJ22937 PJ23312 PJ22843
PJ23430 PJ23434 PJ23338 PJ21693
PJ23297 PJ21694 PJ21708
PJ24035 PJ23931 PJ23923 PJ23922
PJ24344 PJ24025 PJ24472
PJ23620 PJ23526 PJ24525PJ24530PJ24563PJ24548PJ24622
PJ24468 PJ23984 PJ24771PJ24845PJ25084PJ25094PJ25098PJ25089PJ25158PJ25240PJ25277PJ25266PJ25207PJ25174
PJ23981 PJ25075PJ25375PJ25379PJ25491PJ25199PJ25425PJ25632PJ25614PJ25589PJ25703PJ25720PJ25332PJ25760PJ25763PJ25781PJ25780PJ25817PJ25982PJ25983PJ25981PJ26125PJ25880PJ26150PJ26187PJ26008PJ26156PJ26161PJ26188PJ26174PJ26270PJ26337PJ26374PJ26366PJ26283PJ25761PJ26515PJ26575PJ26577PJ26534PJ26683PJ26522PJ26713PJ26600PJ26581PJ26666PJ26693PJ26686PJ26809PJ26707PJ26864PJ26892PJ26746PJ26793PJ26841PJ26887PJ26967PJ27023PJ27028 PJ21337
PJ26904PJ26890PJ27079PJ26895PJ27156PJ27095PJ27197PJ27246PJ27305PJ27345PJ27231PJ27277PJ27351PJ27387PJ27328PJ27383PJ27083PJ27299PJ27302PJ27268PJ27333PJ27214PJ27393PJ27422PJ27180PJ27469PJ27094PJ27430PJ27636PJ27380PJ27491PJ27647PJ27714PJ27484PJ27530PJ27627PJ27650PJ27617PJ27686PJ27634PJ27804PJ27746PJ27784PJ27865PJ27894PJ27786PJ27847PJ27951
To be applied in the order listed for each segment.
ABSTRACT OF PROBLEM
___________________
Secure Sockets Layer (SSL) support for TPF.
COMMENTS ON PROBLEM
___________________
SSL enables socket applications using the TCP protocol to commu-
nicate in a secure manner over the TCP/IP network. After the
TCP connection is started, applications use the SSL APIs to
establish an SSL session over that TCP connection, and
optionally verify each other's identity using digital certif-
icates. Public key cryptography is used to exchange a secret
key between the client and server applications when the SSL
session is started. After the SSL connection is started, the
applications use the SSL_write and SSL_read APIs to exchange
data over the SSL session. The SSL layer encrypts the data
before it is sent to the network and the remote node's SSL layer
decrypts the data before passing it to the remote application.
The secret key created when the SSL session started is used to
encrypt and decrypt data messages using symmetric key
cryptography. Messages flowing over an SSL session include a
message digest, which allows the remote node's SSL layer to
detect if the contents of a message have been altered.
SOLUTION
________
OpenSSL version 0.9.6 has been ported to TPF.
OpenSSL is Open Source code that includes many SSL APIs and an
extensive cryptography library written by Eric Young.
OpenSSL information is available at www.openssl.org.
TPF has made only minor modifications to the ported code, spe-
cifically enabling time slicing in the encryption/decryption and
message digest routines.
The object code and source code for SSL support for TPF are
included in this APAR. You must use the code shipped by TPF
rather than the code that is available for downloading from the
OpenSSL website because the code on the OpenSSL website does not
contain the TPF modifications.
SSL support on TPF includes support for the following:
o SSL version 2 and SSL version 3 protocols
o Transport Layer Security (TLS) version 1 protocol, which is
defined by RFC 2246
o Rivest-Shamir-Adleman (RSA) public key cryptography
o RC2, RC4, DES, and Triple-DES ciphers
o MD5 and SHA message digest algorithms
o Client and server authentication using digital certificates
o Single and chained certificate
1
If your TPF SSL application needs a certificate, meaning the
remote application will validate the identity of your TPF appli-
cation, do the following:
1. Create an RSA public/private key pair and certificate
request offline using any SSL toolkit.
For example, you can do this using the OpenSSL code running
on a secure workstation.
Some SSL toolkits, including OpenSSL, allow you to password
protect the private key so that the key is not in the clear
when the file containing the private key is displayed.
2. Send the certificate request to your certificate authority
(CA). The CA will create and sign the certificate, then
send the certificate back to you.
3. Transfer the file containing the private key and the file
containing the certificate to your TPF system using FTP or
TFTP.
If your TPF SSL application will validate the identify of the
remote application, do the following:
1. Transfer the files containing the certificates of the CAs
that you trust to TPF using FTP or TFTP.
2. Optionally, transfer the files containing certificate revo-
cation lists (CRLs) to TPF using FTP or TFTP. CRLs contain
the list of certificates that have been revoked.
DEPENDENCIES
____________
Related Segments Affected By This APAR.
_______________________________________
Segments to be assembled or compiled:
None.
Segments to be link edited:
None.
Load Modules to be loaded:
CSSL, CRYP, CRY1 and CRY2.
Migration Considerations
========================
See TPF Migration guide.
-- END APAR PJ27863
Download file(s):
Login once to access server, leave window open, then
click on link(s) below.
SourceBinary
