2

We are looking for a free SSL/TLS library for our embedded project, which is not compatible with GPL.

Our project is a non-profit project, therefore paying hefty sums for a proprietary SSL/TLS library is out of question. On the other hand, using a GPL'd library also does not work because a substantial part of the functionality of the application depends on an external 3rd party library provided to us for free, but which is incompatible with GPL. We are allowed to use the code and distribute the results with this 3rd party library in object code form, but we cannot make the application available under GPL, as we do not control the copyright of this library.

The project is planned to use a Cortex M3 or M4 ARM as its host. This means a limited set of resources are available for the communicational stack. So far we have tested our idea with FreeRTOS & lwIP (both are compatible with our license scheme), but the operational version has to provide encryption for the TCP traffic. Speed is not critical, as only management traffic has to go through the network.

We have checked the options available, but it seems that every SSL/TLS project intended to be used on a resource-limited platform is either proprietary with non-negligible licensing costs or is only available for use with GPL'd projects.

2

OpenSSL is available under the Apache license and the 4-clause BSD license.

Both are permissive licenses which allow use in products licensed under other conditions.

Although I am not sure if it compiles on ARM. Also, it has a rather bad security track record for a library as security-critical as this (the well-known Heartbleed vulnerability wasn't the only problem it ever had).

| improve this answer | |
  • Do you have any data about the footprint of OpenSSL on MCUs? I have serious doubts about the feasibility of stripping down OpenSSL to fit into <64k SRAM & <128..256k code. – Laszlo Valko Jun 15 '15 at 21:46
  • The only software that has no vulnerabilities published is the one nobody cares about. – Hubert Kario Nov 28 '19 at 1:17
0

As it turned out, PolarSSL has been acquired by ARM, and they changed the primary licensing to Apache license. The project was also renamed to mbed TLS. According to its wikipedia page, it is suitable for MCU usage (RAM usage can fit into 64KB).

This seems a perfect fit for our requirements.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.