s2n-tls

s2n-tls is a C99 implementation of the TLS/SSL protocols that is designed to be simple, small, fast, and with security as a priority. It is released and licensed under the Apache License 2.0. s2n-tls is short for "signal to noise" and is a nod to the almost magical act of encryption — disguising meaningful signals, like your critical data, as seemingly random noise. -- s2n-tls announcement Quickstart for Ubuntu # clone s2n-tls git clone https://github.com/aws/s2n-tls.git cd s2n-tls # install build dependencies sudo apt update sudo apt install cmake # install a libcrypto sudo apt install libssl-dev # build s2n-tls cmake . -Bbuild \ -DCMAKE_BUILD_TYPE=Release \ -DCMAKE_INSTALL_PREFIX=./s2n-tls-install cmake --build build -j $(nproc) CTEST_PARALLEL_LEVEL=$(nproc) ctest --test-dir build cmake --install build See the s2n-tls build documentation for further guidance on building s2n-tls for your platform. Have a Question? If you think you might have found a security impacting issue, please follow our Security Notification Process. See our Security Reporting Policy for additional guidance on issues considered in-scope for our threat model. If you have any questions about submitting PRs, s2n-tls API usage, or something similar, please open an issue. Documentation s2n-tls uses Doxygen to document its public API. The latest s2n-tls documentation can be found on GitHub pages. The Usage Guide explains how different TLS features can be configured and used. s2n-tls Rust bindings docs can be found here. Documentation for older versions or branches of s2n-tls can be generated locally. To generate the documentation, install doxygen and run doxygen docs/doxygen/Doxyfile. The doxygen documentation can now be found at docs/doxygen/output/html/index.html. Doxygen installation instructions are available at the Doxygen webpage. Platform Support We’ve listed the distributions and platforms under two tiers: Tier 1 platforms are guaranteed to build, run, and pass tests in CI. Tier 2 platforms are guaranteed to build and we'll address issues opened against them, but they aren't currently running in our CI and are not actively reviewed with every commit. If you use a platform not listed below and would like to request (or help!) add it to our CI, please open an issue for discussion. Tier 1 Distribution in CI Platforms Ubuntu18, Ubuntu24** x86_64 Ubuntu22 x86_64, i686 AL2, AL2023** x86_64, aarch64 NixOS x86_64, aarch64 OpenBSD 7.4 x86_64 FreeBSD latest x86_64 OSX latest aarch64 Windows (MSYS2 / MinGW)* x86_64 **Work in Progress *Windows is supported through the MSYS2 environment with a MinGW toolchain (UCRT64, MINGW64, and CLANG64). The MSVC toolchain is not supported. On Windows, AWS-LC is the only supported libcrypto. Some POSIX-specific features (such as kTLS) are not available on Windows. See the build documentation for details. Tier 2 Distribution not in CI Platforms Fedora Core 34-36 x86_64, aarch64 Ubuntu14/16/20 x86_64, aarch64 Ubuntu18/22/24 aarch64 OSX 12-14 x86_64 These distribution lists are not exhaustive and missing tooling or a missing supported libcrypto library could prevent a successful build. Using s2n-tls The s2n-tls I/O APIs are designed to be intuitive to developers familiar with the widely-used POSIX I/O APIs, and s2n-tls supports blocking, non-blocking, and full-duplex I/O. Additionally there are no locks or mutexes within s2n-tls. /* Create a server mode connection handle */ struct s2n_connection *conn = s2n_connection_new(S2N_SERVER); if (conn == NULL) { ... error ... } /* Associate a connection with a file descriptor */ if (s2n_connection_set_fd(conn, fd) < 0) { ... error ... } /* Negotiate the TLS handshake */ s2n_blocked_status blocked; if (s2n_negotiate(conn, &blocked) < 0) { ... error ... } /* Write data to the connection */ int bytes_written; bytes_written = s2n_send(conn, "Hello World", sizeof("Hello World"), &blocked); For details on building the s2n-tls library and how to use s2n-tls in an application you are developing, see the Usage Guide. s2n-tls features s2n-tls implements SSLv3, TLS1.0, TLS1.1, TLS1.2, and TLS1.3. For encryption, s2n-tls supports 128-bit and 256-bit AES in the CBC and GCM modes, ChaCha20, 3DES, and RC4. For forward secrecy, s2n-tls supports both DHE and ECDHE. s2n-tls also supports the Server Name Indicator (SNI), Application-Layer Protocol Negotiation (ALPN), and Online Certificate Status Protocol (OCSP) TLS extensions. SSLv3, RC4, 3DES, and DHE are each disabled by default for security reasons. As it can be difficult to keep track of which encryption algorithms and protocols are best to use, s2n-tls features a simple API to use the latest "default" set of preferences. If you prefer to remain on a specific version for backwards compatibility, that is also supported. /* Use the latest s2n-tls "default" set of ciphersuite and protocol preferences */ s2n_config_set_cipher_preferences(config, "default"); /* Use a specific set of preferences, update when you're ready */ s2n_config_set_cipher_preferences(config, "20150306") s2n-tls safety mechanisms Internally s2n-tls takes a systematic approach to data protection and includes several mechanisms designed to improve safety. Auditable code base s2n-tls's code is structured and written with a focus on reviewability. All s2n-tls code is subject to code review, and we plan to complete security evaluations of s2n-tls on an annual basis. To date there have been two external code-level reviews of s2n-tls, including one by a commercial security vendor. s2n-tls has also been shared with some trusted members of the broader cryptography, security, and Open Source communities. Any issues discovered are always recorded in the s2n-tls issue tracker. Static analysis, fuzz-testing and penetration testing In addition to code reviews, s2n-tls is subject to regular static analysis, fuzz-testing, and penetration testing. Several penetration tests have occurred, in