The Minimal Secure Transport Protocol

By Dipl. Ing.(BA) Frank Gerlach (frankgerlach.tai@gmx.de)

The MST protocol has been designed in order to create a building block for a more secure computing landscape. The main design objective has been simplicity, which directly translates into high security, because simple programs are also easy to review and even prove correct in a mathematic sense.

Which Assurances Are Provided By MST ?

Similar to SSL/TLS, MST assures that
  • messages are obfuscated
  • messages cannot be replayed by an attacker
  • messages cannot be modified by an attacker
  • messages cannot be constructed by an attacker
  • identical messages do not encrypt to identical ciphertext
  • Does MST Provide Asymmetric Cipher Functionality ?

    For the sake of simplicity (which translates into security), only symmetric ciphers (AES) are used. The transfer of symmetric keys is well understood even by novice users and it is possible to use tools such as GPG/PGP for the purpose of key dissemination.

    Better means of key dissemination can be realized upon request.

    Why not use existing Protocols like SSL/TLS or SSH ?

    These protocols are highly complex and consequently require complex library code in order to realize the protocols. OpenSSL is at 400k lines of code and had a large number of remotely exploitable bugs. Libraries of this size are very hard to review or prove correct. Even the "compact" TLS implementation "s2n" of Amazon still has 27000 lines of code.

    MST has less than 400 lines of code (not counting the AES cipher which is used for encrpytion and hashing). This easily allows for review and correctness proofs are economically possible.

    Licensing, Consulting

    MST is free for non-commercial use, but requires a license in other cases. Licenses start at $50 per CPU core. For more details, please send an email to frankgerlach.tai@gmx.de.

    Dipl. Ing.(BA) Frank Gerlach is also available for your consulting needs. I can help you from requirements analys to implementation and security assessments of your code and system setup.

    Datenschutz-Erklärung

    Impressum