Slashdot Mirror

← Back to Stories (view on slashdot.org)

Amazon's New SSL/TLS Implementation In 6,000 Lines of Code

Posted by Soulskill on from the simplify-condense-and-shorten dept.

bmearns writes: Amazon has announced a new library called "s2n," an open source implementation of SSL/TLS, the cryptographic security protocols behind HTTPS, SSH, SFTP, secure SMTP, and many others. Weighing in at about 6k lines of code, it's just a little more than 1% the size of OpenSSL, which is really good news in terms of security auditing and testing. OpenSSL isn't going away, and Amazon has made clear that they will continue to support it. Notably, s2n does not provide all the additional cryptographic functions that OpenSSL provides in libcrypto, it only provides the SSL/TLS functions. Further more, it implements a relatively small subset of SSL/TLS features compared to OpenSSL.

17 of 107 comments (clear)

  1. Re:Too much code by halivar · · Score: 5, Funny

    Good news, everyone! We have a new code volunteer. Armchair code experts always know best.

  2. SSH / SFTP are /not/ powered by SSL/TLS by TerraFrost · · Score: 5, Informative

    The story summary got it wrong - SSH uses it's own distinct protocol to establish an encrypted connection and SFTP is a subsystem of SSH.

  3. Good idea by msobkow · · Score: 4, Interesting

    Standards have a notorious habit of becoming bloated with rarely used features that never do get properly tested. Rethinking what is actually useful and needed is great for pruning code and handling the majority of use cases. Sure there will be edge cases it can't handle, but that's the whole point: they're edge cases that most programmers aren't going to need to use.

    --
    I do not fail; I succeed at finding out what does not work.
    1. Re:Good idea by ThePhilips · · Score: 3

      From security perspective, the small code base is an advantage of its own.

      Support for limited subset of encryption protocols is also a benefit of its own. E.g. OpenSSL still supports MD5 hashes and would happily use them if one forgets to blacklist them.

      --
      All hope abandon ye who enter here.
    2. Re:Good idea by Aethedor · · Score: 2

      Agree. It's better to build something rock solid which supports only 80% of all use cases than to end up with something big and bloated that handles every thinkable use case. Yes, the ultimate thing is to have something rock solid that supports everything, but that's an utopia.

      --
      It doesn't have to be like this. All we need to do is make sure we keep talking.
  4. Compile errors by Aethedor · · Score: 3, Insightful

    ... which is really good news in terms of security auditing and testing.

    Good, then start debugging. Because I got compile errors on both Linux and MacOS X.

    --
    It doesn't have to be like this. All we need to do is make sure we keep talking.
    1. Re:Compile errors by behrooz0az · · Score: 2

      Same here, but in some weird way the '.so' file is there and a header file which has a 'duplicate function' in it named 's2n_shutdown', maybe they wanted to make sure it shuts down.
      btw I'm making a .net wrapper at https://github.com/Behrooz-Amo...
      only a few hours spent figuring this thing out/coding, any help is appreciated people.

      --
      Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
  5. Very much unfinished by Lumpio- · · Score: 5, Informative

    Did anybody notice that it doesn't, for example, do client mode at all yet? Or it does, but it doesn't implement cert validation at all which makes it useless as a client at the moment and therefore client mode is disabled. That along with delegating all the actual crypto to other libraries means the entire thing doesn't actually *do* much. No wonder it's only 6kLOC.

  6. NULL cipher by snsh · · Score: 2

    Does it support SSLv2 and weak ciphers like NULL? or is it hardened out of the box?

  7. Just a wrapper around OpenSSL functions by punman · · Score: 5, Informative

    Summary is misleading at best. A brief inspection of the source code reveals this is still using OpenSSL's crypto functions. So you're not getting 6k lines of source code to replace OpenSSL, as the summary implies. You're getting 6k worth of wrapper code that still uses OpenSSL and needs to be linked against OpenSSL libraries.

  8. This isn't as good as it sounds by jonwil · · Score: 4, Insightful

    Ok so firstly it still uses large chunks of OpenSSL (all the crypto stuff) and is still vulnerable to any security holes in that stuff. So its no good on that score.
    Also, it disables DHE (which is supposed to be good for ensuring forward secrecy) claiming its a "security risk" (to be fair, maybe there is some security flaw with DHE that I haven't read about yet and that is why its turned off)
    Oh and it still supports horridly broken things like RC4, 3DES, SSLv3 and TLS1.0 (all of which contain known unfixable security flaws making them unsuitable going forward)

    1. Re:This isn't as good as it sounds by chihowa · · Score: 2

      Well, here's a good place to start. RC4 has a number of vulnerabilities and while each of them can be mitigated to a certain extent (changing keys, discarding the beginning of streams, etc), the confidence is low that implemented systems will successfully avoid all of them and not open up new vulnerabilities in the process.

      --
      If you want a vision of the future, imagine a youtube comments section scrolling - forever.
  9. Apples and oranges by QuietLagoon · · Score: 4, Insightful

    ... it's just a little more than 1% the size of OpenSSL...Notably, s2n does not provide all the additional cryptographic functions that OpenSSL provides in libcrypto, it only provides the SSL/TLS functions....

    So then, aren't size comparisons between OpenSSL and s2n at best useless, and at worst intentionally misleading?

    1. Re:Apples and oranges by swillden · · Score: 2

      ... it's just a little more than 1% the size of OpenSSL...Notably, s2n does not provide all the additional cryptographic functions that OpenSSL provides in libcrypto, it only provides the SSL/TLS functions....

      So then, aren't size comparisons between OpenSSL and s2n at best useless, and at worst intentionally misleading?

      No, but this particular comparison is. Besides all of the stuff s2n doesn't provide, s2n actually uses OpenSSL's libcrypto to provide the implementations of all of its crypto algorithm. A useful comparison could be made between OpenSSL's TLS layer and s2n, with some caveats listing the TLS features s2n doesn't provide.

      Note that none of this means that s2n doesn't have value. If you don't need the other OpenSSL features, it's a lot less code to audit.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
  10. Re:Too much code by Anonymous Coward · · Score: 3, Funny

    One line of code, ten thousand characters long, use only internal default variables, would look like an artistic mural done in ascii art and the guy who wrote it would have no idea what it does.

    *sigh* I love perl. One of the world first write only languages.

  11. Re:Too much code by mellon · · Score: 2

    Huh. Never see ITS TECO, have you?

  12. The bad news by backslashdot · · Score: 2

    6000 lines of code, that's the good news. The bad news is that it's written in perl and makes heavy use of regular expressions.