Qualys Security Advisory – LibreSSL

Re:Qualys Security Advisory – LibreSSL by 0x01 on Monday October 19, 2015 @08:31AM (#10412432)

Apologies. I should have referenced Lua 5.3 instead as it has both integer and bitwise operator support. This should satisfy the concerns regarding crypto implementation.

As for the space considerations, I have two ways to reason this:

* Wouldn't it only take up 1x414K? If you create luaSSL as a drop in replacement to OpenSSL, you'd only need one copy in your filesystem, just as you only have one OpenSSL.

* Even if you bloat your binary sizes by 414K per executable, isn't it worth it to go from "yes, it could be unsafe, we'll never know... let's wait for the next CVE" to 100% guaranteed no memory faults EVER? Nothing is free, and this could be a cheap price to pay for the guarantee of memory safety, and the implications that come with it.

Edit: wording

[ Parent | on HN ]

Re:Qualys Security Advisory – LibreSSL by acveilleux on Monday October 19, 2015 @12:59PM (#10414131)

For crypto-primitives, you usually want them to be constant-time. This is basically impossible to do in an interpreter or a JIT, indeed optimizing compilers can and will optimize contant-time operations out so inline assembly is commonly used.

[ Parent | on HN ]

Re:Qualys Security Advisory – LibreSSL by 0x01 on Monday October 26, 2015 @11:53AM (#10452214)

Thank you for the info!

[ Parent | on HN ]