Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing s2n, a New Open-Source TLS Implementation

blogs.aws.amazon.com

Post reply on HN
Print view View original

51–60 of 104 posts

Re: Introducing s2n, a New Open-Source TLS Implementation

#51

Post by wbond »

edwintorok wrote: post #19

If I counted right: OCaml TLS: ~4400 LoC OCaml X509: ~1550 LoC OCaml ASN1: ~1400 LoC OCaml nocrypto: ~5250 LoC Total ~12600 LoC but you get a fully self-contained implementation, having only some crypto code in C and the rest as pure OCaml: https://mirage.io/blog/why-ocaml-tls https://mirage.io/blog/announcing-mirage-25-release

Also note that s2n links with OpenSSL (or LibreSSL, BoringSSL) for the ciphers and ASN.1 functionality.

At first I was really surprised/impressed/worried that they managed to pull off an ASN.1 parser in C along with TLS is just 6,000 lines of code. Alas, they did not.

So, when they mention the 500,000 lines of OpenSSL, they are probably actually using a good 20,000+ of it for ASN.1 and all of the ciphers.

Yay marketing!

Re: Introducing s2n, a New Open-Source TLS Implementation

#54

Post by marcosdumay »

cperciva wrote: post #41
richm44 wrote: post #39

Earlier quoted context omitted.

There's nothing wrong with client certs (other than insane complexity). However ultimately s2n is likely to need to support operation as a client too at which point things like certificate validation etc. will be needed and the amount of code will increase.

Insane complexity is exactly why supporting client certs is a bad idea.

No, sorry. The insane complexity is on the requirements. If you need client certs, anything you do to satisfy the need will be at least as complex.

Re: Introducing s2n, a New Open-Source TLS Implementation

#55

Post by amirmc »

minthd wrote: post #24
reycharles wrote: post #20

Earlier quoted context omitted.

The bitcoin piñata recently ended, and they wrote a blog post about it: https://mirage.io/blog/bitcoin-pinata-results

It's interesting, but isn't 10BTC($2500) prize too low to tell us anything about how secure is this ?

> It's interesting, but isn't 10BTC($2500) prize too low to tell us anything about how secure is this ?

No amount of prize money can ever really tell you how secure something is. We knew this before we announced it (see background at [1]).

[1] http://amirchaudhry.com/bitcoin-pinata/

Re: Introducing s2n, a New Open-Source TLS Implementation

#56

Post by lmm »

cperciva wrote: post #40
[deleted] wrote: post #33

[deleted]

Just in case you're serious: Not using autotools is a feature, not a bug.

For a library that wants to be ubiquitous (and therefore wants to be cross-platform) it's a bug. Can I expect this to build cleanly on GNU/kFreeBSD, or windows SUA? If it were autotools I would.

Re: Introducing s2n, a New Open-Source TLS Implementation

#57

Post by cperciva »

lmm wrote: post #56
cperciva wrote: post #40

Earlier quoted context omitted.

Just in case you're serious: Not using autotools is a feature, not a bug.

For a library that wants to be ubiquitous (and therefore wants to be cross-platform) it's a bug. Can I expect this to build cleanly on GNU/kFreeBSD, or windows SUA? If it were autotools I would.

Standards-compliant C is more portable than autotools. Autotools is a workaround for non-portable code.

Re: Introducing s2n, a New Open-Source TLS Implementation

#58

Post by cperciva »

marcosdumay wrote: post #54
cperciva wrote: post #41

Earlier quoted context omitted.

Insane complexity is exactly why supporting client certs is a bad idea.

No, sorry. The insane complexity is on the requirements. If you need client certs, anything you do to satisfy the need will be at least as complex.

Yes, but 99.999% of web servers don't need client certs.

Re: Introducing s2n, a New Open-Source TLS Implementation

#59

Post by hga »

wbond wrote: post #51
edwintorok wrote: post #19

If I counted right: OCaml TLS: ~4400 LoC OCaml X509: ~1550 LoC OCaml ASN1: ~1400 LoC OCaml nocrypto: ~5250 LoC Total ~12600 LoC but you get a fully self-contained implementation, having only some crypto code in C and the rest as pure OCaml: https://mirage.io/blog/why-ocaml-tls https://mirage.io/blog/announcing-mirage-25-release

Also note that s2n links with OpenSSL (or LibreSSL, BoringSSL) for the ciphers and ASN.1 functionality. At first I was really surprised/impressed/worried that they managed to pull off an ASN.1 parser in C along with TLS is just 6,000 lines of code. Alas, they did not. So, when they mention the 500,000 lines of OpenSSL, they are probably actually using a good 20,000+ of it for ASN.1 and all of the ciphers. Yay marketi…

I think you're being unfair, for they say OpenSSL "contains more than 500,000 lines of code with at least 70,000 of those involved in processing TLS." And the next and last LOC reference is to their s2n, and it's entirely fair to say 6,000 LOC is qualitatively better than "at least 70,000", especially with all the focus, which they cite, on SSL/TLS protocol and implementation bugs.

Re: Introducing s2n, a New Open-Source TLS Implementation

#60

Post by indutny »

agazso wrote: post #5

Can you use this library without having to use its IO capabilities? My biggest issue with OpenSSL is that it also tries to do IO, but does it in a not too well-performing and non cross-platform way.

You can use OpenSSL without IO APIs. Just use SSL_set_bio ;)
Post reply on HN