Imported from previous forum
hello all,
I am looking for documentation about fix encryption. I looked in specifications,application note but i can’t find the FIX APPLICATION- security protocole.
Is PGP-DES-MD5 still used or does everyone use SSL now?
What are the cipher suites generally supported by fix engines?
Are there standard implementations or example of implementation of FIX encryption either using PGP or SSL? where is are they?
thanks for answering.
[ original email was from Ryan Pierce - rpierce@taltrade.com ]
> I am looking for documentation about fix encryption. I looked in specifications,application note but i can’t find the FIX APPLICATION- security protocole.
The only thing written at present is a very old note describing PGP-DES-MD5, located in Specifications / App Notes.
There’s also a document I wrote, under Working Groups / Encryption in the archive section, that is a PowerPoint which illustrates the current work of the Encryption working group.
> Is PGP-DES-MD5 still used or does everyone use SSL now?
PGP-DES-MD5 is still in use. The Encryption Working Group was charged initially with standardizing upon SSLv3 and/or TLS (or similar technology) to provide point to point session security.
> What are the cipher suites generally supported by fix engines?
To be honest, I’d like to know. One of the deliverables of the Encryption working group is an app note that likely will need to make recommendations regarding this. So I’m very interested in knowing what’s in use now.
> Are there standard implementations or example of implementation of FIX encryption either using PGP or SSL? where is are they?
Morgan Stanley posted an implementation of PGP-DES-MD5 that many firms use.
The Encryption Working Group archive also contains something called “Poppy” which is an SSL-encrypting proxy for FIX sessions. From what I’ve heard, this project has been abandoned, and that the open-source product stunnel could be used instead. I’d be interested in knowing if any firms are using stunnel to proxy FIX sessions.
It is my goal to get the Encryption Working Group kickstarted in the 4Q of this year, preferably producing an app note by year end, hopefully sooner.
[ original email was from Ian Orford - ian.orford@drkw.com ]
From my experience with different engines that use different third party packages to implement the algorithms used in the PGP-DES-MD5 algorithm, its incredibly hard to get two independant engines to work.
In order to overcome this, I’ve implemented a SSL pipe using the JSSE package in Java that sits outside, and is therefore independant and invisible to the engine.
We’ve successfully used this pipe to establish a TLSv1 socket using SSL_RSA_WITH_RC4_128_SHA. This wasn’t too difficult to do.
hello,
thank you for your documentation it has been very useful.
>Morgan Stanley posted an implementation of PGP-DES-MD5 that many firms use.
do you know where i can find the Morgan Stanley implementation of PGP-DES-MD5
>The Encryption Working Group archive also contains something called “Poppy” which is an SSL-encrypting proxy for >FIX sessions. From what I’ve heard, this project has been abandoned, and that the open-source product stunnel could >be used instead.
and the open-source product stunnel?
thank you for answering.
sarah besnainou