4 ms·
OpenSSL itself is highly configurable, so I think it would be better to pare it down to a minimal build that is both secure and compatible with all widely deplo
by mwcampbell 13y ago
OpenSSL itself is highly configurable, so I think it would be better to pare it down to a minimal build that is both secure and compatible with all widely deployed TLS implementations.
- x0x0 13y agoime, it's much harder to write, understand, test, and debug #include soup
- midas007 13y agoNot really. There are only a handful of features that are necessary. Furthermore, JEOS-like minimal systems should only enable features that are absolutely necessary. Minimalism means a smaller attack surface.
- midas007 13y agoI do this already on OSX, and even submitted a patch to allow Ruby to run without OpenSSL engine support. [0] How I compile OpenSSL. [1] [0] https://bugs.ruby-lang.org/issues/9714 https://bugs.ruby-lang.org/issues/9714 [1] ( export CONFIGURE_OPTS='no-hw no-rdrand no-sctp no-md4 no-mdc2 no-rc4 no-fips no-engine' \ brew install https://gist.github.com/steakknife/8228264/raw/openssl.rb )
- mwcampbell 13y agoThat looks like a good start, but can we drop even more? DES? Camellia? IDEA? MD5?
- midas007 13y agoGood start my ass, you haven't actually tried any of your "suggestions," have you? no-md5 doesn't currently work: "_EVP_md5", referenced from ... no-des doesn't currently work either, the following test fails the build: enveloped content test streaming S/MIME format, 3 recipients: generation error