How to implement TLS encryption with client authentication between a Java application and a C/C++ client

Question

I have a Java Swing application which needs to communicate with a C/C++ application through sockets. The data travels as XML documents. In order to secure this communication I initially thought of using Asymmetric Encryption but then it was reinventing the wheel. So I thought of using TLS(v1.2) which solves most of the problems encountered during implementing encryption on our own. I would also like to authenticate client as well, ie, two way authentication. Any pointers or leads as to how to go about this? I have read JSSE reference guide but some how I am still confused.

Answer 1

TLS and SSL are not related to the programming language that you use on client or server of the communication.

It is only a protocol.

You can use this protocol with any language.

Answer 2

Yes, every side of the communication channel will have to support SSL/TLS. There are several possibilities/libraries to do it in C/C++, it all depends on the platform (windows, unix, whatnot). So it is not really possible to answer your question fully. You have to have an idea in advance what kind of applications would need to communicate with your java application.

As for "backward/forward compatibility": if the C/C++ code sticks to some widely used TLS implementation you will probably have not many of these issues. You can tweak your java side with some system properties or some additional code to resolve them.