3 ms·
As a non-crypto-nerd: How viable is it to make a “safe” OpenSSL, which just doesn’t support all the cipher modes (?) that the HN crowd would mock me for acciden
by mwint 4y ago
As a non-crypto-nerd: How viable is it to make a “safe” OpenSSL, which just doesn’t support all the cipher modes (?) that the HN crowd would mock me for accidentally using?
- woodruffw 4y agoThe modes of operation aren't the main reason people use OpenSSL; it's the support for all the gnarly (and less gnarly) protocols and wire formats that show up when doing applied cryptography. Progress is being made on replacing OpenSSL in a lot of contexts (specifically, the RustCrypto[1] folks are doing excellent work and so is cryptography[2]), but there are still plenty of areas where OpenSSL is needed to compose the mostly algebraic cryptography with the right wire format. Edit: I forgot to mention rustls[3], which uses ring[4] under the hood. [1]: https://github.com/RustCrypto https://github.com/RustCrypto [2]: https://github.com/pyca/cryptography https://github.com/pyca/cryptography [3]: https://github.com/rustls/rustls https://github.com/rustls/rustls [4]: https://github.com/briansmith/ring https://github.com/briansmith/ring
- westurner 4y agoOpenSSL > Forks: https://en.wikipedia.org/wiki/OpenSSL#Forks https://en.wikipedia.org/wiki/OpenSSL#Forks TLS 1.3 specifies which curves and ciphers: https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3 https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1... (IDK what the TLS (and FIPS) PQ Algo versioning plans are: 1.4, 2.0?) Mozilla [Open]SSL Config generator: https://ssl-config.mozilla.org/ https://ssl-config.mozilla.org/