Tag Archives: MSL

Message Security Layer

.idea Add IntelliJ IDEA project files. 3 months ago
.settings Merge branch ‘BurpExtender’ 11 days ago
src Fixing bug in MslControl.js, SynchronizedClock#getTime. Now using thi… 2 days ago
.classpath Remove duplicate examples build path from Eclipse project. 8 days ago
.gitignore Add test-output to .gitignore. 12 days ago
.project Add Gradle build files and Eclipse Gradle integration. 20 days ago
README.md Add mention of external review. 23 hours ago
build.gradle Burp example requires the test classes to compile. 8 days ago
findbugs-exclude.xml Exclude charset findbugs from Burp code; there is no way to extract t… 8 days ago
java2js_regexes.rtf Initial commit of Java and JavaScript MSL stacks and unit tests. 4 months ago
msl.iml Integration Tests 18 days ago
overview-public.html Point Javadoc overview HTML to GitHub documentation. a month ago
overview.html Point Javadoc overview HTML to GitHub documentation. a month ago
settings.gradle Add Gradle build files and Eclipse Gradle integration. 20 days ago

Message Security Layer (MSL) is an extensible and flexible secure messaging protocol that can be used to transport data between two or more communicating entities. Data may also be associated with specific users, and treated as confidential or non-replayable if so desired.


The MSL Protocol provides a complete description of the protocol and implementation requirements. TheConfiguration Guide presents some common client and server MSL configurations. The protocol and configuration guide were reviewed by an external security firm. No issues were identified.

The set of public interfaces and classes an application must implement and use is documented in thePublic Javadoc. Documentation on all of the code, including internal classes and private methods, can be found in the full Javadoc.

For questions and support please contact Wesley Miaw directly. Bugs and feature requests should be filed in the Issue Tracker.

Third-Party Libraries

The Java MSL code base requires the org.json and Bouncy Castle libraries. The unit tests require JUnit 4and the integration tests require TestNG.

The JavaScript MSL code base includes some third-party libraries within the lib/ directory, most notably the Clarinet parser. The jsrsasign and crypto-js libraries are currently included but are planned for removal.

All third-party libraries are subject to their respective license agreements.

Getting Started

To build an application that uses MSL for communication, you must read through and understand the MSL Protocol. This is necessary because unlike other security protocols and libraries, you must make choices about how to secure your communication and authenticate your entities and users. The Configuration Guide can help you make those decisions.

The application interface to the MSL stack is MslControl. The application configuration for a single MSL network is an instance of MslContext. Your application may participate in multiple MSL networks and therefore have multiple instances of MslContext but only one MslControl should be used. Message-specific configuration, such as the user or security properties of that message, are specified in individual instances of MessageContext.


The Java MSL code base includes project files for Eclipse and IntelliJ IDEA.

An example server is provided under src/examples/java/server/. The Eclipse project is a web project that can be deployed onto a Tomcat server. The example server is a J2EE servlet that will respond to requests from the example JavaScript client. The example server MSL configuration is specific to this server and should not be used to configure your application, but it can be used as the basis for doing so.

You may need to install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files to use cryptographic keys above a certain size.


The JavaScript MSL code base assumes a JavaScript execution environment that supports the latestWeb Crypto API specification. If you are using a web browser you may need to enable experimental features or feature flags to enable Web Crypto.

  • Chrome Browser 37+
    For earlier versions: chrome://flags/#enable-experimental-web-platform-features
    On Linux libnss 3.16.2+ must be separately installed.
  • Firefox 34+
    For earlier versions: about:config dom.webcrypto.enabled
  • Internet Explorer 11+
  • Safari 8+

Your browser may not support all Web Crypto API algorithms, key sizes, and features. If you encounter a problem with a Web Crypto operation please check the release notes for your browser version to determine if it supports what you are trying to do.

To include the JavaScript MSL stack in your JavaScript application you must include all of the MSL JavaScript source files required by your MSL configuration. An example list of the required source files can be found in src/test/javascript/msltests.html.

An example client is provided under src/examples/javascript/client/. The example client is a web page that will send requests to the example Java server. The example client MSL configuration is specific to this client and should not be used to configure your appplication, but it can be used as the basis for doing so.


Copyright 2014 Netflix, Inc.

Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License at


Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.