OpenSSL will release a high-severity issue fix on 25th

Re:OpenSSL will release a high-severity issue fix on 25th by tptacek on Monday March 22, 2021 @07:40PM (#26549016)

I like Ring but I don't think there's a lot of evidence that Rust's type system has effectively prevented cryptography errors, either in protocol state machines or in primitive implementations.

The challenge in avoiding cryptography mistakes is that you have to understand the errors before you can avoid them. Short of formal analysis with provers, I don't think there's a level of programming rigor that gets you away from most (maybe any?) of the last 10-15 years of (say) {TLS,JWT} bugs.

[ Parent | on HN ]

Re:OpenSSL will release a high-severity issue fix on 25th by bluejekyll on Monday March 22, 2021 @10:52PM (#26550470)

I look forward to discussing that on the 25th when we have more information.

Evidence of this nature will always be difficult, though, since it’s very difficult to prove a negative. We can only prove that some specific issue hasn’t yet occurred.

[ Parent | on HN ]