Introducing s2n, a New Open-Source TLS Implementation • Hacker News Board

Re: Introducing s2n, a New Open-Source TLS Implementation

#11

Post by xvilka » Tue, Jun 30, 2015, 12:10 PM UTC

I wonder why do implement SSLv3 in the new product, while others already deprecating and removing it?

Re: Introducing s2n, a New Open-Source TLS Implementation

#12

Post by andruby » Tue, Jun 30, 2015, 12:14 PM UTC

xvilka wrote: post #11

I wonder why do implement SSLv3 in the new product, while others already deprecating and removing it?

Amazon uses this library on all their AWS api's. They probably still need to support SSLv3.

Re: Introducing s2n, a New Open-Source TLS Implementation

#13

Post by DanWaterworth » Tue, Jun 30, 2015, 12:16 PM UTC

nailer wrote: post #10

> s2n is short for “signal to noise” Anyone else think this was a contraction of the a11y, i18n, a16z or f6s variety?

Here are your options:

sawn scan seen sewn shin shun sign skin soon sown span spin spun stun swan

"Yeh, we're not vulnerable, because we've been using the swan library"

Re: Introducing s2n, a New Open-Source TLS Implementation

#14

Post by geertj » Tue, Jun 30, 2015, 12:20 PM UTC

Unfortunately this still uses libcrypto from OpenSSL. This isn't a fully self-contained implementation of TLS.

Re: Introducing s2n, a New Open-Source TLS Implementation

#15

Post by zymhan » Tue, Jun 30, 2015, 12:27 PM UTC

I wonder if they will include it in Amazon Linux at some point.

Re: Introducing s2n, a New Open-Source TLS Implementation

#16

Post by eddyg » Tue, Jun 30, 2015, 12:33 PM UTC

nailer wrote: post #10

> s2n is short for “signal to noise” Anyone else think this was a contraction of the a11y, i18n, a16z or f6s variety?

TIL that the technical term for those is "numeronyms"[1].

[1] https://en.wikipedia.org/wiki/Numeronym

Re: Introducing s2n, a New Open-Source TLS Implementation

#17

Post by tyho » Tue, Jun 30, 2015, 12:48 PM UTC

andruby wrote: post #12

xvilka wrote: post #11

I wonder why do implement SSLv3 in the new product, while others already deprecating and removing it?

Amazon uses this library on all their AWS api's. They probably still need to support SSLv3.

Plus it is disabled by default along with rc4 and DBE.

Re: Introducing s2n, a New Open-Source TLS Implementation

#18

Post by tyho » Tue, Jun 30, 2015, 12:49 PM UTC

geertj wrote: post #14

Unfortunately this still uses libcrypto from OpenSSL. This isn't a fully self-contained implementation of TLS.

Nobody is particularly worried about libcrypto. There would be little point in reimplementing it's functionality.

Re: Introducing s2n, a New Open-Source TLS Implementation

#19

Post by edwintorok » Tue, Jun 30, 2015, 12:53 PM UTC

If I counted right:

  OCaml TLS: ~4400 LoC
  OCaml X509: ~1550 LoC
  OCaml ASN1: ~1400 LoC
  OCaml nocrypto: ~5250 LoC

Total ~12600 LoC but you get a fully self-contained implementation, having only some crypto code in C and the rest as pure OCaml:

https://mirage.io/blog/why-ocaml-tls https://mirage.io/blog/announcing-mirage-25-release

Re: Introducing s2n, a New Open-Source TLS Implementation

#20

Post by reycharles » Tue, Jun 30, 2015, 1:14 PM UTC

edwintorok wrote: post #19

If I counted right: OCaml TLS: ~4400 LoC OCaml X509: ~1550 LoC OCaml ASN1: ~1400 LoC OCaml nocrypto: ~5250 LoC Total ~12600 LoC but you get a fully self-contained implementation, having only some crypto code in C and the rest as pure OCaml: https://mirage.io/blog/why-ocaml-tls https://mirage.io/blog/announcing-mirage-25-release

The bitcoin piñata recently ended, and they wrote a blog post about it: https://mirage.io/blog/bitcoin-pinata-results