4 ms·
> If we don’t want UBs, why not just use a TLS written in Java or C# or some other safe language? Of course that’s a fine idea! But we’ll have to somehow shoeho
by diafygi 11y ago
> If we don’t want UBs, why not just use a TLS written in Java or C# or some other safe language? Of course that’s a fine idea! But we’ll have to somehow shoehorn a Java runtime onto those embedded processors with ~64 KB of RAM where PolarSSL / mbed TLS run.
Would this be a good use case for Rust? Are there any Rust TLS projects that are credible?
- aroch 11y agoA couple people have attempted re-implementations of OpenSSL's TLS functions (with API compat) in Rust. As far as I know, all of these are stalled / abandoned. It is too hard for one individual to do it, especially when that individual isn't a security pro. Mostly Rust uses libraries that wrap OpenSSL and attempt to do some verification of "safeness" before passing to OpenSSL
- viraptor 11y agoI don't think that anyone (unless it's a sponsored team effort) will implement tls in Rust for a long time. At least not as pure-rust library. Before you even touch the tls layer you need: asn1, x509, crypto, network libs. Out of those, only crypto and network libs exist and are fairly young. Asn1 and x509 are slightly insane and will require months of development on their own. (and that's before you even get into useful extensions everyone wants, like ocsp) What's good though is that someone writing pure-rust-tls in a year or two can start with implementation that ignores anything below TLS1.2 and save a lot of code and scope for errors that way.
- aroch 11y agoI once looked at making a toy ASN.1 parser for project...and quickly decided my time and sanity were best spent elsewhere
- xorcist 11y agoI find that comment amusing. Wasn't it Tomcat or some other high profile Java project that exhibited behaviour with security implications identical with Heartbleed, shortly after?
- wolf550e 11y agoDo you means this? https://www.smacktls.com/#skip https://www.smacktls.com/#skip