Hacker News Reader

Comment by wilsonthewhale | Hacker News Reader

Is LibreSSL affected?

LibreSSL was not among the 9 libraries tested.

Nevertheless, it is likely that LibreSSL has not replaced yet this part of complex code inherited from OpenSSL. In that case, LibreSSL would also be vulnerable.

I guess it's not, as it doesn't support TLSv1.3 yet: https://news.ycombinator.com/item?id=19113106

As others have mentioned, TLS 1.3 is not yet supported. But a little bit of context for that decision as of early last year.

https://github.com/libressl-portable/portable/issues/228#iss...

We will support 1.3 once the standard is firmed up and finalized (i.e. ceases to be coopted by vendors making changes to allow for people to continue to run moribund middle boxes that can't recognize a new protocol on the wire) Since there is effectively nothing wrong with TLS 1.2 with a sanely chosen cipher suite today, we believe a clean careful implementation is more beneficial than early adoption.

So there's no rush on the part of the developers to support it. Skimming the commits on that git mirror we can see 1.3 related commits started hitting late last year.

Good question. The paper is here[1] but there is no mention of LibreSSL.

1: https://eprint.iacr.org/2018/1173

Strange. LibreSSL a fairly well-known implementation compared to something like BearSSL (which I had not heard of until today). Does anyone have any ideas on why LibreSSL was not mentioned?

It's not really independent. It's a major fork of OpenSSL, but at the end of the day, it's a fork of OpenSSL.

Probably. It's basically OpenSSL, with pieces removed. I don't think they've had time to rototill the majority of it.

Reply on news.ycombinator.com