3 ms·
OpenSSL also had 8 vulnerabilities in 2012 -- http://www.openssl.org/news/vulnerabilities.html http://www.openssl.org/news/vulnerabilities.html.
by dchest 15y ago
OpenSSL also had 8 vulnerabilities in 2012 -- http://www.openssl.org/news/vulnerabilities.html http://www.openssl.org/news/vulnerabilities.html.
- kragen 15y agoMaybe this is the place to plug http://nacl.cr.yp.to/ http://nacl.cr.yp.to/, by at least one author who has an excellent track record of shipping software with very few vulnerabilities. And who discovered the S-Box cache timing vulnerability mentioned upthread. If you have the freedom to invent your own encrypted network protocol, instead of having to be backwards-compatible with SSL or SSH, you should seriously consider NaCl as an alternative.
- dchest 15y agoPlus, in NaCl there's a work-in-progress implementation of CurveCP protocol http://curvecp.org/ http://curvecp.org/, which works over UDP and seem to be a good fit for something like mosh.