|
Information Security
< Previous Next >
re: documentation about fix encryption
Ryan Pierce / Townsend Analytics Ltd. / Archipelago LLC
31 Jul 2002 1:04PM ET> I am looking for documentation about fix encryption. I looked in specifications,application note but i can't find the FIX APPLICATION- security protocole.
The only thing written at present is a very old note describing PGP-DES-MD5, located in Specifications / App Notes.
There's also a document I wrote, under Working Groups / Encryption in the archive section, that is a PowerPoint which illustrates the current work of the Encryption working group.
> Is PGP-DES-MD5 still used or does everyone use SSL now?
PGP-DES-MD5 is still in use. The Encryption Working Group was charged initially with standardizing upon SSLv3 and/or TLS (or similar technology) to provide point to point session security.
> What are the cipher suites generally supported by fix engines?
To be honest, I'd like to know. One of the deliverables of the Encryption working group is an app note that likely will need to make recommendations regarding this. So I'm very interested in knowing what's in use now.
> Are there standard implementations or example of implementation of FIX encryption either using PGP or SSL? where is are they?
Morgan Stanley posted an implementation of PGP-DES-MD5 that many firms use.
The Encryption Working Group archive also contains something called "Poppy" which is an SSL-encrypting proxy for FIX sessions. From what I've heard, this project has been abandoned, and that the open-source product stunnel could be used instead. I'd be interested in knowing if any firms are using stunnel to proxy FIX sessions.
It is my goal to get the Encryption Working Group kickstarted in the 4Q of this year, preferably producing an app note by year end, hopefully sooner.
re: documentation about fix encryption
Ryan Pierce / Townsend Analytics Ltd. / Archipelago LLC 31 Jul 2002 1:04PM ET
|
