Chrome: From NSS to OpenSSL
docs.google.com
Chrome: From NSS to OpenSSL
1–10 of 77 posts
Re: Chrome: From NSS to OpenSSL
#2Can't they use Sodium instead?
http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-...
Re: Chrome: From NSS to OpenSSL
#3Can't they use Sodium instead? http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-...
Sodium does not implement TLS.
Re: Chrome: From NSS to OpenSSL
#4And here is compulsory email thread explaining some context:
https://groups.google.com/forum/?_escaped_fragment_=msg/mozi...
> Strange that "PKCS#11 support" is listed as a "con" for NSS
> It was not accidental that it was listed under "Con", nor do I see ENGINE_pkcs11 as a "Pro"
Re: Chrome: From NSS to OpenSSL
#5It may actually be a good thing if Chrome migrates to OpenSSL. With their resources, perhaps they can do some testing to see if there are any more vulnerabilities out there. At the very least, their continued eye on the project should help it be more secure going forward.
Re: Chrome: From NSS to OpenSSL
#6It may actually be a good thing if Chrome migrates to OpenSSL. With their resources, perhaps they can do some testing to see if there are any more vulnerabilities out there. At the very least, their continued eye on the project should help it be more secure going forward.
Those were my thoughts exactly, I think OpenSSL just needs a bit of care and refactoring (possibly a lot depending on which blogs you read) for which they need devs and resources, both of which google has.
Re: Chrome: From NSS to OpenSSL
#7Unless Google is going to clean OpenSSL up along the way, I don't see any immediate benefit.
Re: Chrome: From NSS to OpenSSL
#8Unless Google is going to clean OpenSSL up along the way, I don't see any immediate benefit.
AFAIK Heartbleed was found during one of Googles code-reviews of OpenSSL.
Re: Chrome: From NSS to OpenSSL
#9It may actually be a good thing if Chrome migrates to OpenSSL. With their resources, perhaps they can do some testing to see if there are any more vulnerabilities out there. At the very least, their continued eye on the project should help it be more secure going forward.
Actually I think the Heartbleed vulnerability was most probably found because of this migration, as it was found by Neel Mehta of Google (and the Codenomicon guys). The date of this draft is 2014-01-26, so it makes sense, that the OpenSSL code is evaluated by the security team before the migration.
Re: Chrome: From NSS to OpenSSL
#10On Debian Chromium 33.0.1750.152-1 seems to be using GnuTLS, I didn't know that the official Chrome used NSS:
$ ldd /usr/lib/chromium/chromium|grep -E tls\|ssl
libgnutls.so.28 => /usr/lib/x86_64-linux-gnu/libgnutls.so.28 (0x00007fbae0878000)