Qualys Security Advisory – LibreSSL

Re:Qualys Security Advisory – LibreSSL by smt88 on Monday October 19, 2015 @06:05AM (#10412010)

I've always assumed LibreSSL was just a first step toward a secure implementation. I always thought that it made sense to try to fork/fix OpenSSL at first, but eventually move to a non-C implementation. I still think that will happen.

[ Parent | on HN ]

Re:Qualys Security Advisory – LibreSSL by masklinn on Monday October 19, 2015 @06:28AM (#10412073)

> I've always assumed LibreSSL was just a first step toward a secure implementation. I always thought that it made sense to try to fork/fix OpenSSL at first, but eventually move to a non-C implementation.

Yes and no.

No in that LibreSSL aims to be mostly drop-in compatible with OpenSSL (modulo deprecations/removals) and OpenSSL has a very complex API exposing lots of internal gunk to the user, so moving to a non-C implementation may not be possible at all.

Yes because there's a related `libtls`[0] project which aims to define more abstracted API (with the reference implementation being done on top of libressl). As POC, tedu has/had an implementation of the API using golang's TLS stack[1], and noted that you could build the same on e.g. the OCaml/Mirage TLS stack[2]. If `libtls` fulfils its promises, it would become much easier to swap TLS stack and indeed move to non-C implementations.

[0] http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man3/... HN discussion: https://news.ycombinator.com/item?id=8572029 (some comments may not apply anymore IIRC the discussion was the initial API which has been extended since)

[1] http://www.tedunangst.com/flak/post/goreSSL

[2] https://mirage.io/blog/introducing-ocaml-tls

[ Parent | on HN ]