3 ms·
OpenSSL's crypto code isn't all that bad as long as you're not worried about side channel attacks. Most of their remote code execution bugs have been in protoc
by cperciva 10y ago
OpenSSL's crypto code isn't all that bad as long as you're not worried about side channel attacks. Most of their remote code execution bugs have been in protocol code.
- cyphar 10y ago> OpenSSL's crypto code isn't all that bad as long as you're not worried about side channel attacks. I consider "horrible API that makes it basically impossible to write safe code" to be a security vulnerability. Not to mention that OpenSSL's example code actually had security vulnerabilities (they didn't check the return value from one of the IV routines, whish means that you could end up using a shorter key than you expected).