Security: HTTPS, WSS, PFS and E2EE with Phoenix framework

Chat & Discussions Wikis
, ,
1

At start some definitions:

  1. HTTPS (is a protocol for secure communication over a computer network which is widely used on the Internet) - see HTTPS Wikipedia article
  2. WSS (secured WebSocket protocol) - see WebSocket Wikipedia article
  3. PFS (is a property of secure communication protocols in which compromise of long-term keys does not compromise past session keys) - see Perfect Forward Secrecy Wikipedia article.
  4. E2EE (a cryptographic paradigm involving uninterrupted protection of data traveling between two communicating parties) - see End-to-end encryption Wikipedia article

Summary:

  1. HTTPS, WSS protocols can be set in configuration
  2. PFS can be set in configuration too and need more attention (ciphers, SSL version)
  3. E2EE - to setup this we need choose algorithm(s) to generate, export, import, encrypt and decrypt for Web Cryptography API; time between generate new keys depends on what is used in application

Helpful sources:

  1. Mozilla wiki article describes SSL configuration and splits it by client support.
  2. SSL configuration could be set in standard nginx way or in cowboy/phoenix configuration.
  3. An examples of using Web Cryptography API
2 Likes