The sorry state of OpenSSL usability

Post by nagvx » Thu, Dec 28, 2017, 9:54 PM UTC

jamesfisher wrote: post #30

gbrown_ wrote: post #22

> there literally isn’t any documentation of LibreSSL. This is plain wrong, it's particularly annoying as a great deal of effort has been put into updating the documentation [1]. > Instead, you just have to read the OpenSSL docs, and just hope the behavior is roughly the same. I'll give the author the benefit of the doubt and assume they refer the "OpenSSL docs" as naming hasn't been changed, as opposed to looking at…

Maybe I'm missing something - could you link me to the docs on http://www.libressl.org/ ? I expected a big link saying "Docs", but I don't see one. I've also tried a Google search for the docs[1], without success. [1]: https://www.google.co.uk/search?q=site%3Alibressl.org+docume...

Post by mort96 » Thu, Dec 28, 2017, 11:18 PM UTC

nagvx wrote: post #32

jamesfisher wrote: post #30

Earlier quoted context omitted.

Maybe I'm missing something - could you link me to the docs on http://www.libressl.org/ ? I expected a big link saying "Docs", but I don't see one. I've also tried a Google search for the docs[1], without success. [1]: https://www.google.co.uk/search?q=site%3Alibressl.org+docume...

The section on http://www.libressl.org/ that starts with: "LibreSSL releases contain several parts" lists said parts, with links to manpages for those parts. For example: https://man.openbsd.org/openssl

Post by tptacek » Fri, Dec 29, 2017, 12:43 AM UTC

pvg wrote: post #35

tptacek wrote: post #10

The usability points in this post are very well taken, but I'd push back on "we're told not to roll our own crypto but instead to use OpenSSL", since the first part of that claim is true but the second is emphatically not.

The second part is a direct consequence of how malleable and easy to misinterpret the first part is. It's a 'usability' problem of its own.

Post by [deleted] » Fri, Dec 29, 2017, 12:49 AM UTC

gbrown_ wrote: post #22

> there literally isn’t any documentation of LibreSSL. This is plain wrong, it's particularly annoying as a great deal of effort has been put into updating the documentation [1]. > Instead, you just have to read the OpenSSL docs, and just hope the behavior is roughly the same. I'll give the author the benefit of the doubt and assume they refer the "OpenSSL docs" as naming hasn't been changed, as opposed to looking at…

Post by pvg » Fri, Dec 29, 2017, 1:59 AM UTC

tptacek wrote: post #36

pvg wrote: post #35

Earlier quoted context omitted.

The second part is a direct consequence of how malleable and easy to misinterpret the first part is. It's a 'usability' problem of its own.

I see where you're coming from and there's obviously some truth to it, but even an exceptionally well-documented OpenSSL with carefully thought-out command line UX would still be dangerous just by dint of what OpenSSL (as in, the "openssl" CLI) sets out to do, which is to provide an interface to low-level cryptography.