3 ms·
I'm not a golang user, but I am curious, how hardened is the crypto/tls library? One of the reasons I use openssl is because I don't want a DIY crypto layer, I
by pfooti 10y ago
I'm not a golang user, but I am curious, how hardened is the crypto/tls library? One of the reasons I use openssl is because I don't want a DIY crypto layer, I want something a lot of people have banged on. I'd hate to move to a new server, just to find out it is susceptible to a whole new set of Ye Olde Underrun Bugges that openssl patched ages ago.
- pfg 10y agoThis was discussed on HN a couple of months ago[1] when Go fixed a carry propagation bug that affected crypto/tls. [1]: https://news.ycombinator.com/item?id=10897511 https://news.ycombinator.com/item?id=10897511
- Matt3o12_ 10y agoIt is maintained by Google and the whole go community since it is in the standard library. So, I think it is fairly secure (probably not as well tested as OpenSSL but the attack surface is smaller, bugs and security risks are still there, though). What is important is that the library is not hardware accelerated and it thus uses a software accelerated AES cipher. So, I think it is a bit slower, but you would really have to measure it yourself. Upgrading your Load balancer should not be that hard, though.
- vetinari 10y agoIt supports AES-NI on x64 architecture, if available.
- tagrun 10y agohttps://news.ycombinator.com/item?id=10901895 https://news.ycombinator.com/item?id=10901895