OpenSSL Audit

#1

Post by practicalswift » Wed, Mar 11, 2015, 11:26 PM UTC

OpenSSL Audit
cryptoservices.github.io

Re: OpenSSL Audit

#2

Post by AceJohnny2 » Thu, Mar 12, 2015, 12:23 AM UTC

Key point: "we expect the preliminary results to start coming out towards the beginning of the Summer after we coordinate with the OpenSSL team."

Re: OpenSSL Audit

#3

Post by eyeareque » Thu, Mar 12, 2015, 12:32 AM UTC

AceJohnny2 wrote: post #2

Key point: "we expect the preliminary results to start coming out towards the beginning of the Summer after we coordinate with the OpenSSL team."

Makes sense. OpenSSL needs time to develop fixes.

Re: OpenSSL Audit

#4

Post by some_furry » Thu, Mar 12, 2015, 12:34 AM UTC

AceJohnny2 wrote: post #2

Key point: "we expect the preliminary results to start coming out towards the beginning of the Summer after we coordinate with the OpenSSL team."

If they're waiting until the summer to publish the preliminary results, this means they probably found some exploitable bugs.

This is an exciting development.

Re: OpenSSL Audit

#5

Post by Aldo_MX » Thu, Mar 12, 2015, 12:49 AM UTC

AceJohnny2 wrote: post #2

Key point: "we expect the preliminary results to start coming out towards the beginning of the Summer after we coordinate with the OpenSSL team."

Hopefully this translates to fixing OpenSSL before disclosing the bug(s)

Re: OpenSSL Audit

#6

Post by damm » Thu, Mar 12, 2015, 12:49 AM UTC

It's a very sad thing that the world depends on a library that has been virtually unmaintained for years.

Re: OpenSSL Audit

#7

Post by [deleted] » Thu, Mar 12, 2015, 12:55 AM UTC

damm wrote: post #6

It's a very sad thing that the world depends on a library that has been virtually unmaintained for years.

[deleted]

Re: OpenSSL Audit

#8

Post by josephg » Thu, Mar 12, 2015, 1:11 AM UTC

Speaking of OpenSSL, what state are the competing libraries in at the moment? I'd love a version of OpenSSL without all the potentially-insecure legacy code given all the problems its had.

Are there decent implementations of OpenSSL in more secure languages like Rust?

Re: OpenSSL Audit

#9

Post by guelo » Thu, Mar 12, 2015, 1:20 AM UTC

Code review as marketing. Good idea.

Re: OpenSSL Audit

#10

Post by gecko » Thu, Mar 12, 2015, 1:27 AM UTC

josephg wrote: post #8

Speaking of OpenSSL, what state are the competing libraries in at the moment? I'd love a version of OpenSSL without all the potentially-insecure legacy code given all the problems its had. Are there decent implementations of OpenSSL in more secure languages like Rust?

F# has a proven implementation, but I doubt that's what you're after. OCaml is also getting one for Mirage, but I don't know its status, and it won't be proven correct.