4 ms·
OpenSSL is rather inscrutable. They've actually been doing great work on the code and I'd say it's pretty secure now. But the documentation is still a mess. I r
by guidovranken 9y ago
OpenSSL is rather inscrutable. They've actually been doing great work on the code and I'd say it's pretty secure now. But the documentation is still a mess. I recently had to resort to inferring the correct way to do something with OpenSSL by looking at how OpenSSL itself deals with that particular task + extensive testing, because documentation on certain operations appeared to be absent. No bueno.
- dom0 9y agoI audited once whether an application was using nonces the correct way with libcrypto of OpenSSL. Suffice to say, that wasn't documented at all (I think it still isn't); in the end I dug through the implementation and wrote my own tests as well. Seems to be more common than I thought. And why would you document that? It's not like it's one of the most common implementation mistakes to handle IVs incorrectly.
- baby 9y ago> They've actually been doing great work on the code It still is nowhere near readable.
- dom0 9y agoTo this day I have no idea where the EVP factories are defined (the symbols aren't in the tree)... I suspect that they are probably automatically generated, but I haven't found a separate script that does it, so it might be some CPP stuff in some well-hidden file.