Amazon's s2n project
reddit / BSD

----------------------------------------------------------------------
Bceverly · 2015-08-10 16:43

For those who are unfamiliar with the project
(https://github.com/awslabs/s2n), Amazon has built a new
implementation of SSL3/TLS1.x from the ground up. It is very small in
terms of LOC (in the neighborhood of 6,000) so it is much easier to
audit than LibreSSL or OpenSSL.

It isn't meant to be a drop in replacement for OpenSSL from my quick
scan of the code; however I am wondering if any of the BSDs have
active work to consider it as a replacement for the older libraries
(similar to what has happened with unbound, httpd, OpenNTPD, etc.)

----------------------------------------------------------------------
Bceverly · 2015-08-10 16:53

For those wondering, the licensing on this is Apache v2...

----------------------------------------------------------------------
X-Istence · 2015-08-10 17:13

It still uses OpenSSL or LibreSSL for the actual crypto, which means
while the TLS aspect of it is easier to audit, you still need to audit
the actual crypto part too, and that's a huge mess.

----------------------------------------------------------------------
Bceverly · 2015-08-10 17:43

I see what you mean (http://www.scmagazineuk.com/amazon-launches-open-
source-tls-implementation-s2n/article/424360/).

I wonder how difficult it would be to extract just the crypto code
from OpenSSL in a standalone lib?

----------------------------------------------------------------------
BumpitySnook · 2015-08-10 18:00

The problem is that extracting it does not fix the mess.

----------------------------------------------------------------------
ben_bai · 2015-08-20 17:51

I think it already is. Open-/LibreSSL consists of openssl(1), libssl
and libcrypto.

Plus I heard that the crypto is good. "Just" the SSL/TLS layer had/has
it's problems.