What changed in OpenSSL after heartbleed

#1

Post by gnu » Fri, Jul 17, 2020, 4:07 PM UTC

What changed in OpenSSL after heartbleed
arxiv.org

Re: What changed in OpenSSL after heartbleed

#2

Post by caiobegotti » Fri, Jul 17, 2020, 4:35 PM UTC

For random reasons I can't read the full article but I wonder if they discuss the impact of LibreSSL on OpenSSL itself. Would anyone who moved to LibreSSL actually look back to OpenSSL today in 2020? Honest question as I'm not a crypto professional myself.

Re: What changed in OpenSSL after heartbleed

#3

Post by icefo » Fri, Jul 17, 2020, 4:40 PM UTC

This made me think of BoringSSL and LibreSSL again.

Looking up on Wikipedia it seems that LibreSSL is focused on OpenBSD and removed lots of legacy code. BoringSSL (Google) got renamed to Tink but I couldn't not find much more.

It's sad to see that duplication of effort but it's also the force of open source

Re: What changed in OpenSSL after heartbleed

#4

Post by easterncalculus » Fri, Jul 17, 2020, 4:40 PM UTC

I'm glad there have been changes to the project. Heartbleed was certainly bad, but I personally never understood getting behind LibreSSL. Seeing one bad vulnerability from an established project and immediately jumping ship to a brand new one with less eyes and reputation seemed hasty to me.

Re: What changed in OpenSSL after heartbleed

#5

Post by not2b » Fri, Jul 17, 2020, 4:41 PM UTC

caiobegotti wrote: post #2

For random reasons I can't read the full article but I wonder if they discuss the impact of LibreSSL on OpenSSL itself. Would anyone who moved to LibreSSL actually look back to OpenSSL today in 2020? Honest question as I'm not a crypto professional myself.

It's just a PDF link. The paper mentions the existence of LibreSSL but that is pretty much it; the focus of the paper is on the extensive efforts to improve OpenSSL.

Re: What changed in OpenSSL after heartbleed

#6

Post by kzrdude » Fri, Jul 17, 2020, 4:42 PM UTC

easterncalculus wrote: post #4

I'm glad there have been changes to the project. Heartbleed was certainly bad, but I personally never understood getting behind LibreSSL. Seeing one bad vulnerability from an established project and immediately jumping ship to a brand new one with less eyes and reputation seemed hasty to me.

Eyes doesn't make a project, but the development process

Re: What changed in OpenSSL after heartbleed

#7

Post by zdw » Fri, Jul 17, 2020, 4:44 PM UTC

I'd be more interested in a comparison in the strategies used to harden the codebase in the forks like BoringSSL and LibreSSL, and how well those strategies have panned out.

There has historically been some crowing from the LibreSSL crowd about how their work avoided CVE's later discovered in OpenSSL: https://undeadly.org/cgi?action=article&sid=20150319145126

Re: What changed in OpenSSL after heartbleed

#8

Post by not2b » Fri, Jul 17, 2020, 4:45 PM UTC

icefo wrote: post #3

This made me think of BoringSSL and LibreSSL again. Looking up on Wikipedia it seems that LibreSSL is focused on OpenBSD and removed lots of legacy code. BoringSSL (Google) got renamed to Tink but I couldn't not find much more. It's sad to see that duplication of effort but it's also the force of open source

The paper points to data showing that OpenSSL is still the dominant SSL implementation on the net, so it's the one that matters.

Re: What changed in OpenSSL after heartbleed

#9

Post by zdw » Fri, Jul 17, 2020, 4:47 PM UTC

icefo wrote: post #3

This made me think of BoringSSL and LibreSSL again. Looking up on Wikipedia it seems that LibreSSL is focused on OpenBSD and removed lots of legacy code. BoringSSL (Google) got renamed to Tink but I couldn't not find much more. It's sad to see that duplication of effort but it's also the force of open source

OpenSSL recently changed licenses to Apache 2.0, which is a unacceptable in some of the BSDs, which made the LibreSSL fork more valuable from a licensing perspective for them.

Tink isn't really a rename, but an API wrapper to prevent misuse that happens to use BoringSSL internally.

Re: What changed in OpenSSL after heartbleed

#10

Post by Rafert » Fri, Jul 17, 2020, 4:49 PM UTC

icefo wrote: post #3

This made me think of BoringSSL and LibreSSL again. Looking up on Wikipedia it seems that LibreSSL is focused on OpenBSD and removed lots of legacy code. BoringSSL (Google) got renamed to Tink but I couldn't not find much more. It's sad to see that duplication of effort but it's also the force of open source

BoringSSL is still alive, Tink is something completely separate.