Introducing s2n, a New Open-Source TLS Implementation • Hacker News Board

Re: Introducing s2n, a New Open-Source TLS Implementation

#61

Post by yellowapple » Tue, Jun 30, 2015, 6:12 PM UTC

> As a result of this, we’ve found that it is easier to review s2n; we have already completed three external security evaluations and penetration tests on s2n, a practice we will be continuing.

"Our pill has been clinically tested."

What were the results?

Re: Introducing s2n, a New Open-Source TLS Implementation

#62

Post by kvb » Tue, Jun 30, 2015, 6:17 PM UTC

How does this compare to miTLS[1]?

[1] - http://www.mitls.org/wsgi/home

Re: Introducing s2n, a New Open-Source TLS Implementation

#63

Post by Tepix » Tue, Jun 30, 2015, 6:29 PM UTC

cperciva wrote: post #58

marcosdumay wrote: post #54

Earlier quoted context omitted.

No, sorry. The insane complexity is on the requirements. If you need client certs, anything you do to satisfy the need will be at least as complex.

Yes, but 99.999% of web servers don't need client certs.

Source?

Re: Introducing s2n, a New Open-Source TLS Implementation

#64

Post by JoachimSchipper » Tue, Jun 30, 2015, 6:45 PM UTC

marcosdumay wrote: post #54

cperciva wrote: post #41

Earlier quoted context omitted.

Insane complexity is exactly why supporting client certs is a bad idea.

No, sorry. The insane complexity is on the requirements. If you need client certs, anything you do to satisfy the need will be at least as complex.

Eh, just dumping X509 for something easier-to-parse would cut out a huge chunk of code. Being compatible is hard, but we stick with what we have because of switching cost, not because it's the best we can do.

Re: Introducing s2n, a New Open-Source TLS Implementation

#65

Post by frik » Tue, Jun 30, 2015, 7:01 PM UTC

edwintorok wrote: post #19

If I counted right: OCaml TLS: ~4400 LoC OCaml X509: ~1550 LoC OCaml ASN1: ~1400 LoC OCaml nocrypto: ~5250 LoC Total ~12600 LoC but you get a fully self-contained implementation, having only some crypto code in C and the rest as pure OCaml: https://mirage.io/blog/why-ocaml-tls https://mirage.io/blog/announcing-mirage-25-release

Github says: C 98.2%, Makefile 1.8% https://github.com/awslabs/s2n

Where is the OCaml source / repo?

Re: Introducing s2n, a New Open-Source TLS Implementation

#66

Post by amirmc » Tue, Jun 30, 2015, 7:12 PM UTC

frik wrote: post #65

edwintorok wrote: post #19

If I counted right: OCaml TLS: ~4400 LoC OCaml X509: ~1550 LoC OCaml ASN1: ~1400 LoC OCaml nocrypto: ~5250 LoC Total ~12600 LoC but you get a fully self-contained implementation, having only some crypto code in C and the rest as pure OCaml: https://mirage.io/blog/why-ocaml-tls https://mirage.io/blog/announcing-mirage-25-release

Github says: C 98.2%, Makefile 1.8% https://github.com/awslabs/s2n Where is the OCaml source / repo?

edwintorok is comparing s2n with the OCaml-TLS stack. See the links at the end of his comment (and the one below)

https://github.com/mirleft

Re: Introducing s2n, a New Open-Source TLS Implementation

#67

Post by __david__ » Tue, Jun 30, 2015, 7:26 PM UTC

cperciva wrote: post #57

lmm wrote: post #56

Earlier quoted context omitted.

For a library that wants to be ubiquitous (and therefore wants to be cross-platform) it's a bug. Can I expect this to build cleanly on GNU/kFreeBSD, or windows SUA? If it were autotools I would.

Standards-compliant C is more portable than autotools. Autotools is a workaround for non-portable code.

That's a nice ideal, but reality is that it's really easy to need POSIX APIs and then you're firmly in autotools land. That said, I don't like autotools because it encourages #ifdef style nonsense, but not using it requires a lot more thought and more than a little rolling-your-own code and techniques.

Re: Introducing s2n, a New Open-Source TLS Implementation

#68

Post by Natsu » Tue, Jun 30, 2015, 7:29 PM UTC

Tepix wrote: post #63

cperciva wrote: post #58

Earlier quoted context omitted.

Yes, but 99.999% of web servers don't need client certs.

Source?

Other than the government, nobody trying to do client certs actually runs the CA that issues them that I've seen. Instead, they trust some random set of commercial CAs, ignorant of the fact that openssl s_client -connect will dump out that list to any passer-by. I've even seen them trusting the "domain control validated only" certs, without any indication of "maybe this is a bad idea, because anyone who can buy a cert can auth to us because we don't even check."

So for every case I've seen, they'd have been ahead to issue credentials themselves and just skip client certs.

Re: Introducing s2n, a New Open-Source TLS Implementation

#69

Post by tedunangst » Tue, Jun 30, 2015, 7:30 PM UTC

Tepix wrote: post #63

cperciva wrote: post #58

Earlier quoted context omitted.

Yes, but 99.999% of web servers don't need client certs.

Source?

99.999% of web servers.

Re: Introducing s2n, a New Open-Source TLS Implementation

#70

Post by aaronbrethorst » Tue, Jun 30, 2015, 7:32 PM UTC

Tepix wrote: post #63

cperciva wrote: post #58

Earlier quoted context omitted.

Yes, but 99.999% of web servers don't need client certs.

Source?

I think cperciva's opinion is a sufficiently valid source on this sort of issue, which is probably why you're being down voted.