Wednesday, April 16, 2014
Open SSL spring cleaning
Changes so far to OpenSSL 1.0.1g since the 11th include:
- Splitting up libcrypto and libssl build directories
- Fixing a use-after-free bug
- Removal of ancient MacOS, Netware, OS/2, VMS and Windows build junk
- Removal of “bugs” directory, benchmarks, INSTALL files, and shared library goo for lame platforms
- Removal of most (all?) backend engines, some of which didn’t even have appropriate licensing
- Ripping out some windows-specific cruft
- Removal of various wrappers for things like sockets, snprintf, opendir, etc. to actually expose real return values
- KNF of most C files
- Removal of weak entropy additions
- Removal of all heartbeat functionality which resulted in Heartbleed SINCE MARCH 2012
99% BAD HARDWARE WEEK: No problem if you change your Open SSL passwords now. All remained stored in OUR servers. Hehehe. What about added entropy and opened passwords at open SSL ? Well, nice confidence catch.
Here is a brief history of Intel's randomness.
The EFF SSL Observatory is a project to investigate the certificates used to secure all of the sites encrypted with HTTPS on the Web.