網絡安全服務(Network Security Services, NSS)是一套為網絡安全服務而設計的庫
支持支持安全的客戶端和
服務器應用程序。使用NSS構建的應用程序可以支持SSL v2
和v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509
v3證書和其他安全標准。
如果需要命令行工具，請安裝nss-tools包
操作NSS證書和密鑰數據庫。
開源加密庫
經過驗證的應用程序安全體系結構
如果您想為您的應用程序添加對SSL、S/MIME或其他互聯網安全標准的支持，您可以使用網絡安全服務(NSS)來實現所有的安全特性。NSS提供了AOL、Red Hat、谷歌和其他公司在各種產品中使用的加密庫的完整開源實現，包括以下內容:
Mozilla產品，包括Firefox、Thunderbird、SeaMonkey和Firefox OS。
美國在線即時通訊(AIM)
開源客戶端應用程序，如Evolution、Pidgin、Apache OpenOffice和LibreOffice。
Red Hat的服務器產品包括:Red Hat Directory Server、Red Hat Certificate System和Apache web服務器的mod_nss SSL模塊。
Oracle(原Sun Java企業系統)的服務器產品，包括Oracle通信消息傳遞服務器和Oracle目錄服務器企業版。
SUSE Linux Enterprise Server支持NSS, Apache web服務器支持mod_nss SSL模塊。
NSS包括一個框架，開發人員和原始設備制造商可以提供補丁，如匯編代碼，以優化其平台上的性能。NSS 3。x已經在18個平台上獲得了認證。
有關NSS的更多詳細信息，請參閱wiki.mozilla.org和NSS FAQ。
在Mozilla CVS樹中可以找到NSS的Java接口的源代碼。具體操作請參見Java網絡安全服務。
NSS使用了Netscape可移植運行時(NSPR)，這是一個平台中立的開源API，用於系統功能，旨在促進跨平台開發。和NSS一樣，NSPR也在多種產品中經受過考驗。更多信息，請參閱NSPR項目頁面。
互操作性和開放標准部分
您可以使用NSS在您的應用程序中支持一系列的安全標准，包括以下內容:
SSL v3。安全套接字層(SSL)協議允許在客戶端和服務器之間進行相互身份驗證，並建立經過身份驗證和加密的連接。
TLS v1.3 (RFC pending)， TLS v1.2 (RFC 5246)， TLS v1.1 (RFC 4346)， TLS v1 (RFC 2246)。來自IETF的替代SSL的傳輸層安全(TLS)協議。
PKCS # 1。管理基於RSA算法的公鑰密碼學實現的標准。
PKCS # 3。管理Diffie-Hellman密鑰協議實現的RSA標准。
PKCS # 5。管理基於密碼的密碼學的RSA標准，例如加密用於存儲的私鑰。
PKCS # 7。管理密碼學在數據上的應用的RSA標准，例如數字簽名和數字信封。
PKCS # 8。管理私有密鑰的存儲和加密的RSA標准。
PKCS # 9。管理所選屬性類型的RSA標准，包括與PKCS #7、PKCS #8和PKCS #10一起使用的屬性類型。
PKCS # 10。管理證書請求語法的RSA標准。
PKCS # 11。RSA標准管理與加密令牌(如硬件加速器和智能卡)的通信，並允許應用程序獨立於特定的算法和實現。
PKCS # 12。管理用於存儲或傳輸私鑰、證書和其他秘密材料的格式的RSA標准。
S/MIME (RFC 2311和RFC 2633)。IETF消息規范(基於流行的Internet MIME標准)，它提供了一種一致的方式來發送和接收經過簽名和加密的MIME數據。
v3。國際電信聯盟管理用於公開密鑰密碼學認證的證書格式的標准。
OCSP (RFC 2560)。在線證書狀態協議OCSP (Online Certificate Status Protocol)對證書的有效性進行實時確認。
PKIX證書和CRL配置文件(rfc3280)。IETF的公開密鑰基礎設施(X.509)工作組(在PKIX中為人所知)正在開發的Internet公開密鑰基礎設施四部分標准的第一部分。
RSA、DSA、ECDSA、Diffie-Hellman、EC Diffie-Hellman、AES、三重DES、DES、RC2、RC4、SHA-1、SHA-256、SHA-384、SHA-512、MD2、MD5、HMAC:用於公開密鑰和對稱密鑰密碼學的常用加密算法。
FIPS 186-2偽隨機數生成器。
詳細信息請參見加密技術。
FIPS 140驗證和NISCC測試部分
NSS軟件加密模塊已經過三次驗證，在安全級別1和2上符合FIPS 140。有關更多信息，請參閱NSS FIPS頁面(或此頁面)。
NSS庫通過了NISCC TLS/SSL和S/MIME測試套件(160萬個無效輸入數據的測試用例)。
完整的軟件開發工具包
除了庫和api之外，NSS還提供了調試、診斷、證書和密鑰管理、加密模塊管理以及其他開發任務所需的安全工具。
NSS附帶了一組廣泛且不斷增長的文檔，包括介紹材料、API參考、命令行工具的手冊頁和示例代碼。
NSS庫通過了NISCC TLS/SSL和S/MIME測試套件(160萬個無效輸入數據的測試用例)。
完整的軟件開發工具包
除了庫和api之外，NSS還提供了調試、診斷、證書和密鑰管理、加密模塊管理以及其他開發任務所需的安全工具。
NSS附帶了一組廣泛且不斷增長的文檔，包括介紹材料、API參考、命令行工具的手冊頁和示例代碼。
NSS可以作為源庫和共享(動態)庫。每個NSS版本都與以前的版本向后兼容，允許NSS用戶升級到新的NSS共享庫，而無需重新編譯或重新鏈接他們的應用程序。
開源許可和分發部分
NSS在Mozilla公共許可證(版本2)下可用。最新的源代碼可以從https://www.mozilla.org及其鏡像站點在全球范圍內免費獲得。
Open Source Crypto Libraries
Proven Application Security ArchitectureSection
If you want to add support for SSL, S/MIME, or other Internet security standards to your application, you can use Network Security Services (NSS) to implement all your security features. NSS provides a complete open-source implementation of the crypto libraries used by AOL, Red Hat, Google, and other companies in a variety of products, including the following:
- Mozilla products, including Firefox, Thunderbird, SeaMonkey, and Firefox OS.
- AOL Instant Messenger (AIM)
- Open source client applications such as Evolution, Pidgin, Apache OpenOffice, and LibreOffice.
- Server products from Red Hat: Red Hat Directory Server, Red Hat Certificate System, and the mod_nss SSL module for the Apache web server.
- Server products from Oracle (formerly Sun Java Enterprise System), including Oracle Communications Messaging Server and Oracle Directory Server Enterprise Edition.
- SUSE Linux Enterprise Server supports NSS and the mod_nss SSL module for the Apache web server.
NSS includes a framework to which developers and OEMs can contribute patches, such as assembler code, to optimize performance on their platforms. NSS 3.x has been certified on 18 platforms.
For more detailed information about NSS, see wiki.mozilla.org and NSS FAQ.
Source code for a Java interface to NSS is available in the Mozilla CVS tree. For details, see Network Security Services for Java.
NSS makes use of Netscape Portable Runtime (NSPR), a platform-neutral open-source API for system functions designed to facilitate cross-platform development. Like NSS, NSPR has been battle-tested in multiple products. For more information, see the NSPR Project Page.
Interoperability and Open StandardsSection
You can use NSS to support a range of security standards in your application, including the following:
- SSL v3. The Secure Sockets Layer (SSL) protocol allows mutual authentication between a client and server and the establishment of an authenticated and encrypted connection.
- TLS v1.3 (RFC pending), TLS v1.2 (RFC 5246), TLS v1.1 (RFC 4346), TLS v1 (RFC 2246). The Transport Layer Security (TLS) protocol from the IETF that supersedes SSL.
- PKCS #1. RSA standard that governs implementation of public-key cryptography based on the RSA algorithm.
- PKCS #3. RSA standard that governs implementation of Diffie-Hellman key agreement.
- PKCS #5. RSA standard that governs password-based cryptography, for example to encrypt private keys for storage.
- PKCS #7. RSA standard that governs the application of cryptography to data, for example digital signatures and digital envelopes.
- PKCS #8. RSA standard that governs the storage and encryption of private keys.
- PKCS #9. RSA standard that governs selected attribute types, including those used with PKCS #7, PKCS #8, and PKCS #10.
- PKCS #10. RSA standard that governs the syntax for certificate requests.
- PKCS #11. RSA standard that governs communication with cryptographic tokens (such as hardware accelerators and smart cards) and permits application independence from specific algorithms and implementations.
- PKCS #12. RSA standard that governs the format used to store or transport private keys, certificates, and other secret material.
- S/MIME (RFC 2311 and RFC 2633). IETF message specification (based on the popular Internet MIME standard) that provides a consistent way to send and receive signed and encrypted MIME data.
- X.509 v3. ITU standard that governs the format of certificates used for authentication in public-key cryptography.
- OCSP (RFC 2560). The Online Certificate Status Protocol (OCSP) governs real-time confirmation of certificate validity.
- PKIX Certificate and CRL Profile (RFC 3280). The first part of the four-part standard under development by the Public-Key Infrastructure (X.509) working group of the IETF (known at PKIX) for a public-key infrastructure for the Internet.
- RSA, DSA, ECDSA, Diffie-Hellman, EC Diffie-Hellman, AES, Triple DES, DES, RC2, RC4, SHA-1, SHA-256, SHA-384, SHA-512, MD2, MD5, HMAC: Common cryptographic algorithms used in public-key and symmetric-key cryptography.
- FIPS 186-2 pseudorandom number generator.
For complete details, see Encryption Technologies.
FIPS 140 Validation and NISCC TestingSection
The NSS software crypto module has been validated three times for conformance to FIPS 140 at Security Levels 1 and 2. For more information, see the NSS FIPS page (Or this one).
The NSS libraries passed the NISCC TLS/SSL and S/MIME test suites (1.6 million test cases of invalid input data).
Complete Software Development KitSection
In addition to libraries and APIs, NSS provides security tools required for debugging, diagnostics, certificate and key management, cryptography module management, and other development tasks.
NSS comes with an extensive and growing set of documentation, including introductory material, API references, man pages for command-line tools, and sample code.
NSS is available as source and shared (dynamic) libraries. Every NSS release is backward compatible with previous releases, allowing NSS users to upgrade to the new NSS shared libraries without recompiling or relinking their applications.
Open-Source Licensing and DistributionSection
NSS is available under the Mozilla Public License, version 2. The latest source code is available for free worldwide from https://www.mozilla.org and its mirror sites.