News for hackers. Stuff that matters.

A comment on An Empirical Study of Vulnerabilities in Cryptographic Libraries. Parent comment

Re:An Empirical Study of Vulnerabilities in Cryptographic Li... by tptacek on Sunday July 25, 2021 @12:45PM (#27950626)
If someone in the 2000s had thought "I don't like C and I don't like OpenSSL so I'm going to write my own Ada SSL/TLS", we would have yet another implementation of Bleichenbacher's RSA error oracle. It is not actually that easy to put a safe TLS implementation together; you need to study the TLS protocol and implementation vulnerabilities, and they're not all assembled in one nice place.
[ Parent | on HN ]
Re:An Empirical Study of Vulnerabilities in Cryptographic Li... by mjw1007 on Sunday July 25, 2021 @01:38PM (#27951199)
Non-rhetorical question: do you think that would have been likely to cause the hypothetical implementor more or less pain, over the next decade or so, than OpenSSL's buffer overflows?
[ Parent | on HN ]
Re:An Empirical Study of Vulnerabilities in Cryptographic Li... by tptacek on Sunday July 25, 2021 @09:25PM (#27954533)
It depends on the window of time you choose, but if the window is "in the last 10 years", then I'd say cryptographic mistakes are likely to cause more pain than OpenSSL memory corruption vulnerabilities. Any other C library, with less scrutiny, and it'd be the other way around.
[ Parent | on HN ]