Slashdot Mirror
Amazon's New SSL/TLS Implementation In 6,000 Lines of Code
bmearns writes: Amazon has announced a new library called "s2n," an open source implementation of SSL/TLS, the cryptographic security protocols behind HTTPS, SSH, SFTP, secure SMTP, and many others. Weighing in at about 6k lines of code, it's just a little more than 1% the size of OpenSSL, which is really good news in terms of security auditing and testing. OpenSSL isn't going away, and Amazon has made clear that they will continue to support it. Notably, s2n does not provide all the additional cryptographic functions that OpenSSL provides in libcrypto, it only provides the SSL/TLS functions. Further more, it implements a relatively small subset of SSL/TLS features compared to OpenSSL.
Will they deliver it to me by drone?
Good news, everyone! We have a new code volunteer. Armchair code experts always know best.
The story summary got it wrong - SSH uses it's own distinct protocol to establish an encrypted connection and SFTP is a subsystem of SSH.
Standards have a notorious habit of becoming bloated with rarely used features that never do get properly tested. Rethinking what is actually useful and needed is great for pruning code and handling the majority of use cases. Sure there will be edge cases it can't handle, but that's the whole point: they're edge cases that most programmers aren't going to need to use.
I do not fail; I succeed at finding out what does not work.
Seems like it might be useful in embedded systems, but I don't see any mention of that in any of the articles.
Finally, a quality implementation implemented and backed by a real company. I've had enough of these freelance pet projects get over adopted and used by millions, only to cause some of the worst security breaches in the internet ever!
Good, then start debugging. Because I got compile errors on both Linux and MacOS X.
It doesn't have to be like this. All we need to do is make sure we keep talking.
It does, from README file:br/ s2n has been structured so that different encryption libraries may be used. Today s2n supports OpenSSL, LibreSSL, BoringSSL, and the Apple Common Crypto framework to perform the underlying cryptographic operations.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
Did anybody notice that it doesn't, for example, do client mode at all yet? Or it does, but it doesn't implement cert validation at all which makes it useless as a client at the moment and therefore client mode is disabled. That along with delegating all the actual crypto to other libraries means the entire thing doesn't actually *do* much. No wonder it's only 6kLOC.
30+ words? Bad. Restart if over 10 words.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Does it support SSLv2 and weak ciphers like NULL? or is it hardened out of the box?
Fewer lines means easier to audit once someone gets down to it, though.
Summary is misleading at best. A brief inspection of the source code reveals this is still using OpenSSL's crypto functions. So you're not getting 6k lines of source code to replace OpenSSL, as the summary implies. You're getting 6k worth of wrapper code that still uses OpenSSL and needs to be linked against OpenSSL libraries.
Ok so firstly it still uses large chunks of OpenSSL (all the crypto stuff) and is still vulnerable to any security holes in that stuff. So its no good on that score.
Also, it disables DHE (which is supposed to be good for ensuring forward secrecy) claiming its a "security risk" (to be fair, maybe there is some security flaw with DHE that I haven't read about yet and that is why its turned off)
Oh and it still supports horridly broken things like RC4, 3DES, SSLv3 and TLS1.0 (all of which contain known unfixable security flaws making them unsuitable going forward)
Depends, they could easily have made 6000 Perl one-liners.
Lines of code is really a bad metric. If you have 6000 lines written by a team of bad programmer (which is typical for startups) vs 6,000,000 by a set of really good programmers makes a huge difference.
Custom electronics and digital signage for your business: www.evcircuits.com
... it's just a little more than 1% the size of OpenSSL...Notably, s2n does not provide all the additional cryptographic functions that OpenSSL provides in libcrypto, it only provides the SSL/TLS functions....
So then, aren't size comparisons between OpenSSL and s2n at best useless, and at worst intentionally misleading?
One line of code, ten thousand characters long, use only internal default variables, would look like an artistic mural done in ascii art and the guy who wrote it would have no idea what it does.
*sigh* I love perl. One of the world first write only languages.
Huh. Never see ITS TECO, have you?
6,000 lines of code that DO NOT replace OpenSSL. Only partially replace. A sub-set.
But then how are you going to do Inversion of Control (TM)?
Peter predicted that you would "deliberately forget" creation 2000 years ago...
In that case, you better try mbed TLS (former PolarSSL). Has been tested and audited more times than this untested new comer. And it has full support for everything that is needed. mbed TLS makes every new attempt to implement an SSL / TLS library obsolete immediately.
It doesn't have to be like this. All we need to do is make sure we keep talking.
Notably, s2n does not provide all the additional cryptographic functions that OpenSSL provides in libcrypto, it only provides the SSL/TLS functions. Further more, it implements a relatively small subset of SSL/TLS features compared to OpenSSL.
This is the kind of really important detail that is often left out of summaries and winds up making my eye twitch. Thanks OP and/or editors for rising above the common dross.
Stop-Prism.org: Opt Out of Surveillance
6000 lines of code, that's the good news. The bad news is that it's written in perl and makes heavy use of regular expressions.
And I thought APL was hard to read. (One of my math professors used APL.)
Don't try to out wierd me, three-eyes. I get stranger things than you, free with my breakfast cereal. --Zaphod Beeblebr
In a past life one of my co-workers wrote an APL interpreter. It put the terminal into graphics mode to generate the funky APL character set.
They can take my LifeAlert pendant when they pry it from my cold dead fingers.
Please. APL or go home bitches!
https://en.wikipedia.org/wiki/...
its not much of anything:
https://github.com/awslabs/s2n...
contains #include <openssl/...>
Yes, that makes perfect sense - because nothing good was ever accomplished in anything other than 1000 lines of easy-to-read C (an oxymoron if ever I've heard it)
Specialist Mac support for creative pros, Melbourne
use Net::SSL;
DONE!
King Frosty is going to be awfully mad. Two of you, perhaps only miles apart, angry and basement bound and never the twain shall meet. You two could don your favorite superhero outfits and meet in the alley but that seems unlikely. It is unfortunate, it would make an interesting documentary.
"So long and thanks for all the fish."
That is generally what happens when you compare line counts for code on top of a framework against stuff written in other languages.
If I mod you up, it doesn't necessarily mean I agree with what you've said, sorry.
If it implements all the REQUIRED features, then it is TLS.
sub f{($f)=@_;print"$f(q{$f});";}f(q{sub f{($f)=@_;print"$f(q{$f});";}f});