Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing s2n, a New Open-Source TLS Implementation

blogs.aws.amazon.com

Post reply on HN
Print view View original

31–40 of 104 posts

Re: Introducing s2n, a New Open-Source TLS Implementation

#31

Post by pquerna »

agazso wrote: post #5

Can you use this library without having to use its IO capabilities? My biggest issue with OpenSSL is that it also tries to do IO, but does it in a not too well-performing and non cross-platform way.

https://github.com/awslabs/s2n/blob/master/docs/USAGE-GUIDE....

Looks like currently you must set a file descriptor (though the docs mention the possibility of using a pipe). Once an FD is set, you do control pulling/pushing data to s2n.

Can you elaborate more on "not too well-performing"?

Re: Introducing s2n, a New Open-Source TLS Implementation

#32

Post by McElroy »

DanWaterworth wrote: post #13
nailer wrote: post #10

> s2n is short for “signal to noise” Anyone else think this was a contraction of the a11y, i18n, a16z or f6s variety?

Here are your options: sawn scan seen sewn shin shun sign skin soon sown span spin spun stun swan "Yeh, we're not vulnerable, because we've been using the swan library"

Corresponding marketing names and slogans for vulns:

Woodchipper, Bad-scan, NSA has seen your secrets, Hands sewn together, Shin kicker, shunned2death, Sign fail, Skin flogger, Too soon, SownPwn, Span Wham, Spinning in place, Spun out of control, Stunned, Birdcatcher

Re: Introducing s2n, a New Open-Source TLS Implementation

#34

Post by [deleted] »

imaginenore wrote: post #30
alricb wrote: post #23

Earlier quoted context omitted.

libcrypto includes the OpenSSL ASN.1 code, which is worrying as all hell, e.g.: https://git.openssl.org/?p=openssl.git;a=blob;f=crypto/asn1/... Or any file in that directory.

Oh man, that code is just horrible. No comments on some of the functions, no comments on the input parameters and return values pretty much throughout. I really thought OpenSSL was in a much better shape.

[deleted]

Re: Introducing s2n, a New Open-Source TLS Implementation

#35

Post by avsm »

minthd wrote: post #24
reycharles wrote: post #20

Earlier quoted context omitted.

The bitcoin piñata recently ended, and they wrote a blog post about it: https://mirage.io/blog/bitcoin-pinata-results

It's interesting, but isn't 10BTC($2500) prize too low to tell us anything about how secure is this ?

Sadly, we're not so flush with cash that we can significantly up the prize, which was itself a donation from the user community. It was quite amusing when some kind users donated Bitcoins into the piñata though :-)

We really like the idea of continuing the self-service security bounties, irrespective of their size. One of the nice things about unikernels is that it makes it easy to link in logic like this -- in a conventional OS, it would mean faffing around with kernel modules in order to safely seal the Bitcoins away, whereas here it's just normal high-level language code.

Incidentally, we're working on exposing a C interface to the OCaml TLS stack so that it can be used as a normal shared library as well. The approach is to use the OCaml Ctypes library (which is normally used to bind to C libraries from OCaml), but deploy it in inverted mode. This means that we expose a C ABI from OCaml code instead.

See https://github.com/yallop/ocaml-ctypes-inverted-stubs-exampl... for an example that exposes a C parsing interface to the OCaml XMLM library. The TLS stack isn't much more complex, but is pending us looking into libtls that are easier to expose than OpenSSL's. The s2n release here is thus nice and timely...

Re: Introducing s2n, a New Open-Source TLS Implementation

#37

Post by bodyfour »

agazso wrote: post #5

Can you use this library without having to use its IO capabilities? My biggest issue with OpenSSL is that it also tries to do IO, but does it in a not too well-performing and non cross-platform way.

At least with OpenSSL you can implement your own BIO objects and do the I/O yourself if you want/need to. It's not the cleanest or best-documented interface in the world, but it's certainly usable.

Re: Introducing s2n, a New Open-Source TLS Implementation

#38

Post by cperciva »

richm44 wrote: post #8

Note that this library is currently only providing server functionality, and doesn't do certificate validation (in fact it appears to not do any of the X.509 parts of SSL/TLS). It's certainly interesting, but one of the reasons it's so small is that it's missing critical functionality for many use cases.

I think that's kind of the point. If your web server's TLS stack is trying to validate client certificates, you're doing it wrong.

Re: Introducing s2n, a New Open-Source TLS Implementation

#39

Post by richm44 »

cperciva wrote: post #38
richm44 wrote: post #8

Note that this library is currently only providing server functionality, and doesn't do certificate validation (in fact it appears to not do any of the X.509 parts of SSL/TLS). It's certainly interesting, but one of the reasons it's so small is that it's missing critical functionality for many use cases.

I think that's kind of the point. If your web server's TLS stack is trying to validate client certificates, you're doing it wrong.

There's nothing wrong with client certs (other than insane complexity). However ultimately s2n is likely to need to support operation as a client too at which point things like certificate validation etc. will be needed and the amount of code will increase.
Post reply on HN