Wednesday, April 16, 2014

Open SSL spring cleaning

Changes so far to OpenSSL 1.0.1g since the 11th include:
  • Splitting up libcrypto and libssl build directories
  • Fixing a use-after-free bug
  • Removal of ancient MacOS, Netware, OS/2, VMS and Windows build junk
  • Removal of “bugs” directory, benchmarks, INSTALL files, and shared library goo for lame platforms
  • Removal of most (all?) backend engines, some of which didn’t even have appropriate licensing
  • Ripping out some windows-specific cruft
  • Removal of various wrappers for things like sockets, snprintf, opendir, etc. to actually expose real return values
  • KNF of most C files
  • Removal of weak entropy additions
  • Removal of all heartbeat functionality which resulted in Heartbleed SINCE MARCH 2012
99% BAD HARDWARE WEEK: No problem if you change your Open SSL passwords now. All remained stored in OUR servers. Hehehe. What about added entropy and opened passwords at open SSL ? Well, nice confidence catch.
 Here is a brief history of Intel's randomness.

 The EFF SSL Observatory is a project to investigate the certificates used to secure all of the sites encrypted with HTTPS on the Web.

Comments: Post a Comment

<< Home

This page is powered by Blogger. Isn't yours?