Hacker News Reader

Comment by blitmap | Hacker News Reader

I don't have much familiarity with OpenSSL and crypto scares me away from reading the sources. I wish someone could give a full run-down of everything that is in OpenSSL, an overview. You hear all the time about it being bloated and supporting too many things. I wish I better understood that. It's why people turn to wolfssl and mbedtls, right?

Smaller projects that aim for minimalism and robustness probably suffer from a lack of peer review with a more niche community backing them. Trade-offs trade-offs. I also wish I understood where they compete:

OpenSSL <-> WolfSSL <-> mbedtls

View on HN

There is a fascinating and funny talk by Bob Beck from OpenBSD on the first 30 days after forking OpenSSL. One of the things he addresses is the scary code and how is prevents community involvement. He also talks a great deal about all that stuff that's not really relevant anymore and how much they removed from the LibreSSL source code.

Apparently the crypto modules are pretty well made according to the OpenBSD developers.

LibreSSL: The first 30 days, and what the Future Holds: https://www.youtube.com/watch?v=oM6S7FEUfkU

> It's why people turn to wolfssl and mbedtls, right?

I tried to use a single algorithm from OpenSSL for an embedded project and seems like it needs hacking for all the dependencies to be met. I gave up. With mbedTLS it was done within a minute (simpler to build and read IMO).

There aren't many differences between mbedTLS and WolfSSL. Both are small libraries designed for embedded use. The latter supports TLS 1.3.

Today OpenSSL probably has the best support for hardware acceleration and secure elements.

I had not considered that it may have support for hardware accelerated crypto.

The documentation already has an overview: https://www.openssl.org/docs/manmaster/man7/

That goes a long way, thank you :-) One of the other comments was saying OpenSSL probably has the best support for secure elements (hardware accelerated crypto?).

don't forget BearSSL[1]!

[1]: https://bearssl.org

Reply on news.ycombinator.com