Skip to content

Encryption and Security#

AES70-3 (OCP.1) defines an optional secure TCP transport for control connections: TLS with pre-shared keys (PSK), advertised in DNS-SD as _ocasec._tcp. That service has been part of AES70-3 since the 2015 edition and remains in later revisions (including AES70-3-2018 and AES70-3-2024). Device-side key handling for that mode is specified by OcaSecurityManager in AES70-2 (class ID 1.3.2). Certificate-based TLS is not part of that AES70-3 mode.

libaes70 provides helpers for TLS-PSK and certificate-based TLS (including mutual TLS) that wrap OpenSSL. OpenSSL itself is not included; you link it separately. See OpenSSL TLS for layering, contexts, and examples, and Third-party libraries for how these integrations relate to libaes70.

The same layering is also available with Mbed TLS (aes70::mbedtls). See Mbed TLS. Features and APIs are similar but not identical; Mbed TLS is often preferred on embedded targets.

You can still secure connections outside the library when that fits your deployment:

  • Use a TLS proxy between devices and controllers.
  • Rely on network-level security appropriate to your environment.
  • Use other mature cryptographic libraries or tunnels.

Secretstream#

examples/secretstream is a helper that integrates libsodium’s Secretstream API for encrypting AES70 traffic with a shared key. libsodium is not included with libaes70. The implementation is production-ready for deployments that prefer that approach; TLS (as documented in openssl.md) is the more common choice in networked AV systems. For TLS helpers see openssl.md and mbedtls.md.