0

I have developed a multithreaded server/client python application, my next goal is to encrypt the traffic between both parties but I can't tell where should I invest all my research energy in

Using SSL/TLS has a warning that is really not that easy to achieve proper encryption

This question has an answer but it is vulnerable to man in the middle attack

What is the proper way to secure a TCP connection without using third-party software/services

Improve this question
5
  • You might want to consider running your python script under Flask. Flask provides a framework that makes it simple for your script to run as a server and accept incoming connections from remote clients, optionally over https with SSL/TLS. It can also be scaled, to accept multiple simultaneous connections. See fullstackpython.com/flask.html for more info. Commented Feb 23, 2022 at 22:08
  • 1
    It's not that difficult. Just read the security considerations, they aren't that extensive. Or as @mti2935 said, run it behind Flask or another framework that can take care of TLS for you. Commented Feb 23, 2022 at 22:09
  • isn't flask a webapp programming framework which uses http, my goal is to use tcp only connection Commented Feb 23, 2022 at 22:16
  • Thanks for the clarification. It seems that my answer below may not be an option for you either, being that you are in a Windows environment. In light of all of the above, you might want to reconsider using Python’s ssl library. The warnings that you referenced (as far as servers are concerned) mostly pertain to disabling weak TLS protocols and ciphersuites, as @ThoriumBR mentioned. These are things that would need to be addressed with any TLS implementation... Commented Feb 24, 2022 at 14:11
  • ...You’ll need to design the script to be multi-threaded (in order to handle multiple simultaneous incoming connections), but it sounds like you’ve already done that. Just be sure to take into account the recommendations in the ‘multi-processing‘ section of the page that you referenced, pertaining to OpenSSL’s CSPRNG. Commented Feb 24, 2022 at 14:11

1 Answer 1

Reset to default
1

You might want to consider using Erwin Hoffmann's ucspi-ssl sslserver.

sslserver listens for incoming TCP connections on a designated port. Upon receiving an incoming connection from a client, sslserver negotiates a SSL/TLS session with the client, then spawns a child program that interacts with the client. Requests sent from the client are piped as input to the child program through STDIN, and output written by the child program to STDOUT are piped as a response back to the client. sslserver is capable of handling multiple simultaneous connections, as it will spawn a separate instance of the child program for each incoming connection from a client - so you don't need to implement multi-threading in the child program.

See https://www.fehcom.de/ipnet/ucspi-ssl.html for more info. For information on how to get up and running with ucspi-ssl sslserver, see https://github.com/meixler/installing-configuring-and-running-ucspi-ssl-sslserver (fd, I am the author).

Improve this answer
2
  • Does it support windows environments? Commented Feb 24, 2022 at 6:29
  • I believe it's for *nix only. Commented Feb 24, 2022 at 10:46

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.