https://github.com/aws/s2n-tls Skip to content Toggle navigation Sign up * Product + Actions Automate any workflow + Packages Host and manage packages + Security Find and fix vulnerabilities + Codespaces Instant dev environments + Copilot Write better code with AI + Code review Manage code changes + Issues Plan and track work + Discussions Collaborate outside of code Explore + All features + Documentation + GitHub Skills + Blog * Solutions For + Enterprise + Teams + Startups + Education By Solution + CI/CD & Automation + DevOps + DevSecOps Resources + Learning Pathways + White papers, Ebooks, Webinars + Customer Stories + Partners * Open Source + GitHub Sponsors Fund open source developers + The ReadME Project GitHub community articles Repositories + Topics + Trending + Collections * Pricing Search or jump to... Search code, repositories, users, issues, pull requests... Search [ ] Clear Search syntax tips Provide feedback We read every piece of feedback, and take your input very seriously. [ ] [ ] Include my email address so I can be contacted Cancel Submit feedback Saved searches Use saved searches to filter your results more quickly Name [ ] Query [ ] To see all available qualifiers, see our documentation. Cancel Create saved search Sign in Sign up You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert {{ message }} aws / s2n-tls Public * Notifications * Fork 708 * Star 4.3k An implementation of the TLS/SSL protocols aws.github.io/s2n-tls/doxygen/s2n_8h.html License Apache-2.0 license 4.3k stars 708 forks Activity Star Notifications * Code * Issues 438 * Pull requests 31 * Actions * Projects 3 * Security * Insights Additional navigation options * Code * Issues * Pull requests * Actions * Projects * Security * Insights aws/s2n-tls This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. main Switch branches/tags [ ] Branches Tags Could not load branches Nothing to show {{ refName }} default View all branches Could not load tags Nothing to show {{ refName }} default View all tags Name already in use A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch? Cancel Create 22 branches 111 tags Code * Local * Codespaces * Clone HTTPS GitHub CLI [https://github.com/a] Use Git or checkout with SVN using the web URL. [gh repo clone aws/s2] Work fast with our official CLI. Learn more about the CLI. * Open with GitHub Desktop * Download ZIP Sign In Required Please sign in to use Codespaces. Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Launching Xcode If nothing happens, download Xcode and try again. Launching Visual Studio Code Your codespace will open once ready. There was a problem preparing your codespace, please try again. Latest commit @lrstewart lrstewart Add basic "security rules" (#4298) ... 965bde2 Dec 2, 2023 Add basic "security rules" (#4298) 965bde2 Git stats * 4,579 commits Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time .github test: Bump cross-platform actions to pull in fix for flaky BSD (#4278 ) November 10, 2023 13:09 api Add API to retrieve the supported groups for a security policy (#4273 ) November 13, 2023 15:23 bin fix(s2nd): parse psk given to s2nd non-destructively (#4006) May 15, 2023 16:36 bindings/rust Remove s2n's internal Kyber512 implementation, and rely on AWS-LC for... November 24, 2023 11:23 cmake add 32 bit cross-compile toolchain (#3924) April 19, 2023 13:01 codebuild Bump AWS-LC version to v1.17.4 (#4303) November 30, 2023 08:39 compliance Remove s2n's internal Kyber512 implementation, and rely on AWS-LC for... November 24, 2023 11:23 coverage fuzz test coverage reporting February 17, 2020 05:51 crypto Remove s2n's internal Kyber512 implementation, and rely on AWS-LC for... November 24, 2023 11:23 docker-images tests: delete integv1 code (#3685) December 5, 2022 15:54 docs docs: remove extra security policy item (#4248) October 19, 2023 01:11 error Clean up selecting a signature algorithm (#4285) November 29, 2023 00:16 lib Remove s2n's internal Kyber512 implementation, and rely on AWS-LC for... November 24, 2023 11:23 libcrypto-build Nitpick usage guide links (#3133) November 29, 2021 15:44 nix Add asan support to cmake/nix (#4194) September 19, 2023 11:03 scram ci: typos config file (#4021) June 5, 2023 18:01 scripts feat: add s2n_strerror_source API (#4209) September 21, 2023 16:35 stuffer Add basic "security rules" (#4298) December 1, 2023 17:56 tests Add basic "security rules" (#4298) December 1, 2023 17:56 tls Add basic "security rules" (#4298) December 1, 2023 17:56 utils Remove s2n's internal Kyber512 implementation, and rely on AWS-LC for... November 24, 2023 11:23 .clang-format Clang-format tests/unit/s2n_[t-z].*\.c and enforce in CI (#3679) December 9, 2022 13:42 .git-blame-ignore-revs Clang format cleanup (#3767) January 18, 2023 10:16 .gitignore Run integv2 tests with nix (#3824) February 27, 2023 12:40 .gitmodules Remove litani submodule and update CBMC starter kit to 2.5 (#3385) July 12, 2022 18:44 CMakeLists.txt Remove s2n's internal Kyber512 implementation, and rely on AWS-LC for... November 24, 2023 11:23 LICENSE Remove s2n's internal Kyber512 implementation, and rely on AWS-LC for... November 24, 2023 11:23 Makefile Remove s2n's internal Kyber512 implementation, and rely on AWS-LC for... November 24, 2023 11:23 NOTICE Adding license headers to a few files and adding a LICENSE and NOTICE... February 4, 2015 14:03 README.md ci: add mainline coverage job (#4288) November 16, 2023 13:59 VERSIONING.rst docs: add a Semver document (#2268) May 7, 2021 14:47 flake.lock nix devShell with aws-lc (#4028) June 6, 2023 16:26 flake.nix Update nix corretto; make it platform aware. (#4043) June 14, 2023 18:36 s2n.mk Remove s2n's internal Kyber512 implementation, and rely on AWS-LC for... November 24, 2023 11:23 View code [ ] Quickstart for Ubuntu Have a Question? Documentation Using s2n-tls s2n-tls features s2n-tls safety mechanisms Small and auditable code base Static analysis, fuzz-testing and penetration testing Unit tests and end-to-end testing Erase on read Built-in memory protection Minimalist feature adoption Compartmentalized random number generation Modularized encryption Timing blinding Table based state-machines C safety Security issue notifications Contributing to s2n-tls Language Bindings for s2n-tls README.md s2n s2n-tls is a C99 implementation of the TLS/SSL protocols that is designed to be simple, small, fast, and with security as a priority. It is released and licensed under the Apache License 2.0. s2n-tls is short for "signal to noise" and is a nod to the almost magical act of encryption -- disguising meaningful signals, like your critical data, as seemingly random noise. -- s2n-tls announcement Build Status Apache 2 License C99 Github forks Github stars Join the chat at https://gitter.im/awslabs/s2n Quickstart for Ubuntu # clone s2n-tls git clone https://github.com/aws/s2n-tls.git cd s2n-tls # install build dependencies sudo apt update sudo apt install cmake # install a libcrypto sudo apt install libssl-dev # build s2n-tls cmake . -Bbuild \ -DCMAKE_BUILD_TYPE=Release \ -DCMAKE_INSTALL_PREFIX=./s2n-tls-install cmake --build build -j $(nproc) CTEST_PARALLEL_LEVEL=$(nproc) ctest --test-dir build cmake --install build See the s2n-tls build documentation for further guidance on building s2n-tls for your platform. Have a Question? If you have any questions about Submitting PR's, Opening Issues, s2n-tls API usage, or something similar, we have a public chatroom available here to answer your questions: https://gitter.im/awslabs/ s2n Otherwise, if you think you might have found a security impacting issue, please instead follow our Security Notification Process. Documentation s2n-tls uses Doxygen to document its public API. The latest s2n-tls documentation can be found on GitHub pages. The Usage Guide explains how different TLS features can be configured and used. Documentation for older versions or branches of s2n-tls can be generated locally. To generate the documentation, install doxygen and run doxygen docs/doxygen/Doxyfile. The doxygen documentation can now be found at docs/doxygen/output/html/index.html. Doxygen installation instructions are available at the Doxygen webpage. Using s2n-tls The s2n-tls I/O APIs are designed to be intuitive to developers familiar with the widely-used POSIX I/O APIs, and s2n-tls supports blocking, non-blocking, and full-duplex I/O. Additionally there are no locks or mutexes within s2n-tls. /* Create a server mode connection handle */ struct s2n_connection *conn = s2n_connection_new(S2N_SERVER); if (conn == NULL) { ... error ... } /* Associate a connection with a file descriptor */ if (s2n_connection_set_fd(conn, fd) < 0) { ... error ... } /* Negotiate the TLS handshake */ s2n_blocked_status blocked; if (s2n_negotiate(conn, &blocked) < 0) { ... error ... } /* Write data to the connection */ int bytes_written; bytes_written = s2n_send(conn, "Hello World", sizeof("Hello World"), &blocked); For details on building the s2n-tls library and how to use s2n-tls in an application you are developing, see the usage guide. s2n-tls features s2n-tls implements SSLv3, TLS1.0, TLS1.1, TLS1.2, and TLS1.3. For encryption, s2n-tls supports 128-bit and 256-bit AES in the CBC and GCM modes, ChaCha20, 3DES, and RC4. For forward secrecy, s2n-tls supports both DHE and ECDHE. s2n-tls also supports the Server Name Indicator (SNI), Application-Layer Protocol Negotiation (ALPN), and Online Certificate Status Protocol (OCSP) TLS extensions. SSLv3, RC4, 3DES, and DHE are each disabled by default for security reasons. As it can be difficult to keep track of which encryption algorithms and protocols are best to use, s2n-tls features a simple API to use the latest "default" set of preferences. If you prefer to remain on a specific version for backwards compatibility, that is also supported. /* Use the latest s2n-tls "default" set of ciphersuite and protocol preferences */ s2n_config_set_cipher_preferences(config, "default"); /* Use a specific set of preferences, update when you're ready */ s2n_config_set_cipher_preferences(config, "20150306") s2n-tls safety mechanisms Internally s2n-tls takes a systematic approach to data protection and includes several mechanisms designed to improve safety. Small and auditable code base Ignoring tests, blank lines and comments, s2n-tls is about 6,000 lines of code. s2n's code is also structured and written with a focus on reviewability. All s2n-tls code is subject to code review, and we plan to complete security evaluations of s2n-tls on an annual basis. To date there have been two external code-level reviews of s2n-tls, including one by a commercial security vendor. s2n-tls has also been shared with some trusted members of the broader cryptography, security, and Open Source communities. Any issues discovered are always recorded in the s2n-tls issue tracker. Static analysis, fuzz-testing and penetration testing In addition to code reviews, s2n-tls is subject to regular static analysis, fuzz-testing, and penetration testing. Several penetration tests have occurred, including two by commercial vendors. Unit tests and end-to-end testing s2n-tls includes positive and negative unit tests and end-to-end test cases. Unit test coverage can be viewed here. Note that this represents unit coverage for a particular build. Since that build won't necessarily support all s2n-tls features, test coverage may be artificially lowered. Erase on read s2n-tls encrypts or erases plaintext data as quickly as possible. For example, decrypted data buffers are erased as they are read by the application. Built-in memory protection s2n-tls uses operating system features to protect data from being swapped to disk or appearing in core dumps. Minimalist feature adoption s2n-tls avoids implementing rarely used options and extensions, as well as features with a history of triggering protocol-level vulnerabilities. For example there is no support for session renegotiation or DTLS. Compartmentalized random number generation The security of TLS and its associated encryption algorithms depends upon secure random number generation. s2n-tls provides every thread with two separate random number generators. One for "public" randomly generated data that may appear in the clear, and one for "private" data that should remain secret. This approach lessens the risk of potential predictability weaknesses in random number generation algorithms from leaking information across contexts. Modularized encryption s2n-tls has been structured so that different encryption libraries may be used. Today s2n-tls supports OpenSSL (versions 1.0.2, 1.1.1 and 3.0.x), LibreSSL, BoringSSL, AWS-LC, and the Apple Common Crypto framework to perform the underlying cryptographic operations. Timing blinding s2n-tls includes structured support for blinding time-based side-channels that may leak sensitive data. For example, if s2n-tls fails to parse a TLS record or handshake message, s2n-tls will add a randomized delay of between 10 and 30 seconds, granular to nanoseconds, before responding. This raises the complexity of real-world timing side-channel attacks by a factor of at least tens of trillions. Table based state-machines s2n-tls uses simple tables to drive the TLS/SSL state machines, making it difficult for invalid out-of-order states to arise. C safety s2n-tls is written in C, but makes light use of standard C library functions and wraps all memory handling, string handling, and serialization in systematic boundary-enforcing checks. Security issue notifications If you discover a potential security issue in s2n-tls we ask that you notify AWS Security via our vulnerability reporting page. Please do not create a public github issue. If you package or distribute s2n-tls, or use s2n-tls as part of a large multi-user service, you may be eligible for pre-notification of future s2n-tls releases. Please contact s2n-pre-notification@amazon.com. Contributing to s2n-tls If you are interested in contributing to s2n-tls, please see our development guide. Language Bindings for s2n-tls See our language bindings list for language bindings for s2n-tls that we're aware of. About An implementation of the TLS/SSL protocols aws.github.io/s2n-tls/doxygen/s2n_8h.html Topics c tls ssl cryptography crypto encryption c99 s2n Resources Readme License Apache-2.0 license Code of conduct Code of conduct Security policy Security policy Activity Stars 4.3k stars Watchers 176 watching Forks 708 forks Report repository Releases 104 Release: v1.3.56 Latest Nov 1, 2023 + 103 releases Packages 0 No packages published Used by 130 * @yixinin * @qiaopengjun5162 * @CorneliusCornbread * @Zhou-Pixel * @altonen * @zlx2019 * @SamKenX-Hub-Community * @justsmth + 122 Contributors 183 * @sam8979 * @lrstewart * @colmmacc * @raycoll * @alexw91 * @jldodds * @dougch * @baldwinmatt * @maddeleine * @goatgoose * @andrewhop * @zz85 * @alexeblee * @camshaft + 169 contributors Languages * C 84.8% * Python 4.3% * Rust 3.9% * Makefile 3.4% * Shell 2.2% * C++ 0.4% * Other 1.0% Footer (c) 2023 GitHub, Inc. Footer navigation * Terms * Privacy * Security * Status * Docs * Contact You can't perform that action at this time.