Software:s2n
 | |
| Original author(s) | Colm MacCárthaigh |
|---|---|
| Developer(s) | Amazon Web Services |
| Written in | C99 |
| Operating system | Cross-platform |
| Type | Security library |
| License | Apache License 2.0 |
| Website | github |
s2n is an open-source C99 implementation of the Transport Layer Security (TLS) protocol developed by Amazon Web Services (AWS) and released in 2015. It was developed to ensure the code—about 6,000 lines long—would be easier to review than that of OpenSSL—with 500,000 lines, 70,000 of which are involved in processing TLS.[1][2]
History
s2n was released on June 30, 2015 on GitHub. AWS said that the name "s2n" stand for signal to noise as a nod "to the almost magical act of encryption—disguising meaningful signals, like your critical data, as seemingly random noise".[1] It has been the subject of several external reviews as well as penetration testing.[3]
It was reportedly vulnerable to Lucky Thirteen attack. In response, Amazon's s2n team said it would remove CBC-mode cipher suites and take code from BoringSSL to replace its own CBC-mode decryption.[4] An AWS Security Blog Post said that it did not impact Amazon, AWS, or its customers because they had never been used in a production environment.[5]
In February 2017, Amazon announced that s2n was now handling 100% of SSL traffic for Amazon S3.[6]
Features
TLS extensions
Common TLS extensions supported by this software are Server Name Indication, Application-Layer Protocol Negotiation, and Online Certificate Status Protocol.
Cryptography
s2n supports the main ciphers in use today, such as AES in CBC and GCM modes, 3DES and RC4. It also provides support for perfect forward secrecy through Diffie–Hellman or Elliptic-curve Diffie–Hellman ephemeral keys.
Weaker ciphers and key exchange modes are disabled by default.[3]
Language bindings
The language bindings below were not developed by AWS:[7]
See also
References
- ↑ 1.0 1.1 Schmidt, Steve (30 June 2015). "Introducing s2n, a New Open Source TLS Implementation". AWS Security Blog. https://aws.amazon.com/blogs/security/introducing-s2n-a-new-open-source-tls-implementation/.
- ↑ Killalea, Tom (March 2021). "A Second Conversation with Werner Vogels". Communications of the ACM 64 (3): 50–57. doi:10.1145/3434232. https://cacm.acm.org/magazines/2021/3/250706-a-second-conversation-with-werner-vogels/fulltext. Retrieved 23 March 2021.
- ↑ 3.0 3.1 aws/s2n-tls: an implementation of the TLS/SSL protocols, on GitHub
- ↑ Chirgwin, Richard (21 August 2018). "TLS developers should ditch 'pseudo constant time' crypto processing". The Register. https://www.theregister.com/2018/08/21/tls_developers_should_ditch_pseudo_constant_time_crypto_processing/.
- ↑ MacCarthaigh, Colm (24 November 2015). "s2n and Lucky 13". AWS Security Blog. https://aws.amazon.com/blogs/security/s2n-and-lucky-13/.
- ↑ Schmidt, Steve (23 February 2017). "s2n Is Now Handling 100 Percent of SSL Traffic for Amazon S3". AWS Security Blog. https://aws.amazon.com/blogs/security/s2n-is-now-handling-100-percent-of-of-ssl-traffic-for-amazon-s3/.
- ↑ "Language Bindings for s2n-tls". Amazon Web Services. https://github.com/aws/s2n-tls/blob/main/docs/BINDINGS.md.
 |  |
