LibreSSL: More Than 30 Days Later

I&#x27;ve said this before, but kudos to the OpenBSD Project for shouldering a disproportionate share of the burden of maintaining core bits of our libre&#x2F;open infrastructure. I can&#x27;t think of anyone in tech who has not benefited mightily from OpenSSH and who will not benefit mightily from LibreSSL.<p>This article is a good reminder for me to get off my arse and cut my meager grad-student checks to the EFF and OpenBSD project.

Among the good and bad stories this year, so far, LibreSSL is the good story of the year.<p>Also happy to hear a bit about the ressl API. To me it sounds like a focused, high-level API that makes it easy to get right and hard to get wrong. So kind of like NaCl. It&#x27;s clearly the future -- look at the huge amount of software being written for Sodium now, for example. It&#x27;s huge.

&gt; In particular, we answer the question &quot;What would the user like to do?&quot; and not &quot;What does the TLS protocol allow the user to do?&quot;<p>This makes me think of the laudable approach taken by the developers for the Cryptography library for python. Expose functions to users with <i>sane and safe</i> settings to users, and provide the abilities to override the defaults if you really must (but in such a manner that it&#x27;s extremely clear that you&#x27;re stepping into dangerous territory)

Interesting and quick work. The story of the libcrypto SRP glass house makes me feel like a little kid who just heard a ghost story.<p>Is OpenSSL being notified of security bugs you all find in your pairing down process?

It&#x27;s pretty surprising that they are using CVS for a new project

There is some agonizing done over the rewrite culminating in the need for a redesign of the API. I&#x27;ve wondered why there wasn&#x27;t a light-weight library that simply implemented the <i>smallest</i> number of protocols to delivered the necessary components for a secure <i>HTTPS</i> connection. You&#x27;d have some other library for other protocols, but this one should have the feature of being as light-weight (and small) as possible. Wouldn&#x27;t that be the cyphersuite of choice for most hosting facilities?

Off-topic, but the markup of that page is really interesting. I&#x27;ve never seen someone do this before:<p>&lt;h1&gt;LibreSSL: More Than 30 Days Later&lt;&#x2F;h1&gt; Ted Unangst&lt;p&gt; tedu@openbsd.org&lt;p&gt;<p>LibreSSL was officially announced to the world just about exactly five months ago. Bob spoke at BSDCan about the first 30 days. For those who weren&#x27;t there, I&#x27;ll quickly rehash some of that material. Also, it&#x27;s always best to start at the beginning, but then I&#x27;ll try to focus on some new material and updates.<p>&lt;h1&gt;openssl&lt;&#x2F;h1&gt;

It kinda bugs me when time-sensitive articles (like those about software) are published without a date on them. The article does not mention a date when it was written, I assume it was recently. It mentions &quot;2014-09-09 FreeBSD advisory&quot;, and the date today is 2014-09-28, so September 2014 is a good bet.

&gt; Look at all the points where memory is allocated, and then make sure it is freed, exactly one time, no more, no less.<p>C is clearly the wrong language for something this security critical if that&#x27;s where your bugs are. C++ solved this many years ago.

So...<p>* it&#x27;s broken on other platforms<p>* they broke features in their releases (no QA&#x2F;testing?)<p>* they&#x27;re making a new API based on requirements of their own programs that doesn&#x27;t provide many of the OpenSSL features.<p>* they&#x27;re using CVS, no public code reviews available. There&#x27;s no evidence some of the changes were reviewed by someone other than who made the commit. (OpenSSL now does reviews)<p>* no public audit available.<p>* they have some hateful note about hipsters on their web page as an excuse after 5 months to not make it readable. So unprofessional it hurts.<p>* Most changes were done five months ago, with not much at all done for two months.<p>* The test&#x2F; directory has very few changes at all. No extra tests have been added.<p>* I can&#x27;t find a release plan, architecture documentation, or any documentation a serious software project should have. (OpenSSL is working on these though)<p>Finally... their official distribution website doesn&#x27;t use SSL. That&#x27;s a major security issue of the face palm variety.<p>Not. Inspiring. Confidence.<p>The OpenSSL project on the other hand has been doing some good work. Please see the projects road map from July to see what they are changing. <a href="https://www.openssl.org/about/roadmap.html" rel="nofollow">https:&#x2F;&#x2F;www.openssl.org&#x2F;about&#x2F;roadmap.html</a>