Unfortunately this still uses libcrypto from OpenSSL. This isn't a fully self-contained implementation of TLS.
Nobody is particularly worried about libcrypto. There would be little point in reimplementing it's functionality.
They aren't?
Introducing s2n, a New Open-Source TLS Implementation
21–30 of 104 posts
Re: Introducing s2n, a New Open-Source TLS Implementation
#22> s2n is short for “signal to noise” Anyone else think this was a contraction of the a11y, i18n, a16z or f6s variety?
Here are your options: sawn scan seen sewn shin shun sign skin soon sown span spin spun stun swan "Yeh, we're not vulnerable, because we've been using the swan library"
"Sign" was the first one that came to my mind.
Re: Introducing s2n, a New Open-Source TLS Implementation
#23Unfortunately this still uses libcrypto from OpenSSL. This isn't a fully self-contained implementation of TLS.
Nobody is particularly worried about libcrypto. There would be little point in reimplementing it's functionality.
libcrypto includes the OpenSSL ASN.1 code, which is worrying as all hell, e.g.: https://git.openssl.org/?p=openssl.git;a=blob;f=crypto/asn1/...
Or any file in that directory.
Re: Introducing s2n, a New Open-Source TLS Implementation
#24If I counted right: OCaml TLS: ~4400 LoC OCaml X509: ~1550 LoC OCaml ASN1: ~1400 LoC OCaml nocrypto: ~5250 LoC Total ~12600 LoC but you get a fully self-contained implementation, having only some crypto code in C and the rest as pure OCaml: https://mirage.io/blog/why-ocaml-tls https://mirage.io/blog/announcing-mirage-25-release
The bitcoin piñata recently ended, and they wrote a blog post about it: https://mirage.io/blog/bitcoin-pinata-results
It's interesting, but isn't 10BTC($2500) prize too low to tell us anything about how secure is this ?
Re: Introducing s2n, a New Open-Source TLS Implementation
#25Unfortunately this still uses libcrypto from OpenSSL. This isn't a fully self-contained implementation of TLS.
It also supports other libraries. From the README.md:
"Today s2n supports OpenSSL, LibreSSL, BoringSSL".
Re: Introducing s2n, a New Open-Source TLS Implementation
#26Re: Introducing s2n, a New Open-Source TLS Implementation
#27If I counted right: OCaml TLS: ~4400 LoC OCaml X509: ~1550 LoC OCaml ASN1: ~1400 LoC OCaml nocrypto: ~5250 LoC Total ~12600 LoC but you get a fully self-contained implementation, having only some crypto code in C and the rest as pure OCaml: https://mirage.io/blog/why-ocaml-tls https://mirage.io/blog/announcing-mirage-25-release
A small aside: Haskell has a native TLS implementation as well http://hackage.haskell.org/package/tls
I think the dream is there for many but as other comments have pointed out, getting to the battle tested level of OpenSSL is really really hard.
Re: Introducing s2n, a New Open-Source TLS Implementation
#28Earlier quoted context omitted.
The bitcoin piñata recently ended, and they wrote a blog post about it: https://mirage.io/blog/bitcoin-pinata-results
It's interesting, but isn't 10BTC($2500) prize too low to tell us anything about how secure is this ?
Agreed. I think they offered the bounty with that expectation. A quote form their blog:
"[...] security bounties can be a very effective way to show the presence of vulnerabilities, but they are hopelessly inadequate for showing their absence."
Re: Introducing s2n, a New Open-Source TLS Implementation
#29I hope libcurl supports this soon.
Re: Introducing s2n, a New Open-Source TLS Implementation
#30Earlier quoted context omitted.
Nobody is particularly worried about libcrypto. There would be little point in reimplementing it's functionality.
libcrypto includes the OpenSSL ASN.1 code, which is worrying as all hell, e.g.: https://git.openssl.org/?p=openssl.git;a=blob;f=crypto/asn1/... Or any file in that directory.
Oh man, that code is just horrible. No comments on some of the functions, no comments on the input parameters and return values pretty much throughout.
I really thought OpenSSL was in a much better shape.