Hacker News Reader

> 5. People poo poo any alternative to OpenSSL because it's not 100% feature complete and besides the best crypto people are already working on OpenSSL so what do these schmucks know?

Here's a strategy:

Take OpenSSL, remove a bunch of stuff that almost nobody needs, rearrange the code to make it clearer. You will get BoringSSL.

Take the BoringSSL code, remove more stuff that people outside of Google generally don't need. Temporarily remove the X.509 code and the TLS code so that you can remove even more stuff.

Next, write bindings for the remaining code for a safe language like Rust, so that the replacement X.509 and TLS code can be written in the safer language, while still using the OpenSSL crypto code.

Then, write the new X.509 code, focusing on what really is needed and ignoring all the extra cruft that was added to X.509 but which doesn't actually improve security.

Then, over time, refactor the the language bindings so more code is written in the safe language and less code is written in C, with the goal of almost all the code that isn't implementing directly crypto algorithms being in the safe language.

Then, add a good, clean TLS implementation in the safe language, that focuses on the good parts of TLS, and that avoids all the legacy cruft that makes TLS seem complicated.

I've been doing an experiment along these lines. I've open sourced two parts so far:

1. https://github.com/briansmith/ring 2. https://github.com/briansmith/webpki

It is a big project, but I am pretty sure it is going to succeed.

> 6. Someone points out that in higher level languages it's hard to write code that is resistant against timing attacks. The discussion dies.

This doesn't matter, because the code that should be resistant to timing attacks should be written in assembly language or a language specially designed for that purpose (that doesn't exist yet) anyway. High-level languages have ways of accessing code written in assembly language.

Anyway, my point is that all these things are solvable.

Rust has some compiler plugin magic that can help you write code resistant to timing attacks.

> This doesn't matter, because the code that should be resistant to timing attacks should be written in assembly language

This would put you right back into buffer overflow territory...

It's unfortunate, but the approach would hopefully be to write the smallest possible primitives in assembly and then use a safer language for the rest of the code that either doesn't need constant time guarantees, or gets those guarantees by building on the primitives. This means that verification against these sort of basic attacks can be focused on a much smaller amount of code, rather than every single location in the whole code-base that manipulates memory (as in C). (And, one can go a step further: extract assembly from some higher-level language/DSL designed to create constant time code.)

In any case, the code in question for this post doesn't seem to be written to be timing sensitive.

Don't forget these functional alternatives to OpenSSL:

1. OCaml-TLS (https://github.com/mirleft/ocaml-tls) [1]

2. miTLS (http://www.mitls.org/wsgi/home)

3. s2n (https://github.com/awslabs/s2n)

[1] Home of the epic Bitcoin Pinata! http://ownme.ipredator.se/

Don't forget:

https://hackage.haskell.org/package/tls

Hey, I'm not anti-unit-testing! I just think a TDD reimplementation of OpenSSL is a silly idea.