[HN Gopher] S2n-TLS - A C99 implementation of the TLS/SSL protocol
       ___________________________________________________________________
        
       S2n-TLS - A C99 implementation of the TLS/SSL protocol
        
       Author : belter
       Score  : 42 points
       Date   : 2023-12-03 16:34 UTC (6 hours ago)
        
 (HTM) web link (github.com)
 (TXT) w3m dump (github.com)
        
       | doomrobo wrote:
       | Clarification: this still has dependencies. For example, it
       | requires one of "OpenSSL (versions 1.0.2, 1.1.1 and 3.0.x),
       | LibreSSL, BoringSSL, AWS-LC, and the Apple Common Crypto
       | framework to perform the underlying cryptographic operations"
        
         | t3rra wrote:
         | it says "it supports" but not "it requires" in README
        
           | zamadatix wrote:
           | It seems to support multiple options but requires you pick at
           | least one of them. https://github.com/aws/s2n-tls/blob/main/d
           | ocs/BUILD.md#build...
           | 
           | AWS-LC is the recommended option of the supported choices,
           | there doesn't seem to be a "built-in" type choice.
        
       | jedisct1 wrote:
       | S2N is great, clean, actively maintained, and even has
       | experimental support for post-quantum key exchange (compatible
       | with BoringSSL and the Zig standard library).
       | 
       | Other very nice TLS implementations in C/C++:
       | 
       | - Facebook Fizz: https://github.com/facebookincubator/fizz
       | 
       | - PicoTLS: https://github.com/h2o/picotls
        
       | westurner wrote:
       | "Continuous formal verification of Amazon s2n" (2018)
       | https://link.springer.com/chapter/10.1007/978-3-319-96142-2_...
       | 
       | https://scholar.google.com/scholar?cites=2686812922904040715...
       | 
       | But formal methods (and TLA+ for distributed computation) don't
       | eliminate side channels.
        
         | quotemstr wrote:
         | > But formal methods (and TLA+ for distributed computation)
         | don't eliminate side channels.
         | 
         | True, but they eliminate whole classes of attack. I'm normally
         | aghast at people writing new code in plain C, but _formally
         | verified_ plain C counts as a whole other and better paradigm
         | to me.
        
       ___________________________________________________________________
       (page generated 2023-12-03 23:01 UTC)