mbedtls

> How much code actually uses unions this way? I see this change caused Mbed-TLS to start failing its test suite when compiled with GCC 15: https://github.com/Mbed-TLS/mbedtls/issues/9814 (kinda scary since it's a security library). Hopefully other projects with less rigorous test suites aren't using {0} in that way. The Github issue mentions that Clang tried a similar optimization a while ago and backed it out after user complaints, so maybe the same thing will happen with GCC.

It's work in progress: https://github.com/Mbed-TLS/mbedtls/blob/development/docs/ar... Newer version have okay-ish support, I'd guess the next OpenWRT release will have it again.

I used mbedTLS a while ago when implementing my own HTTPS server from scratch. I had no particular crypto or TLS knowledge, though I did know about ciphers, hashes and certificates from a high level. Between the docs[1][2] and the examples[3] I was up and running using my own IO stack in a couple of evenings. If I had used the IO stack from the library it would have been very easy. Another couple of evenings and I had it integrated with Windows' certificate store. In the end it wasn't very difficult to implement, but it was a bit more of a challenge figuring out the documentation and how it related to mbedTLS. Definitely a rewarding experience, gave me some nice insights into the plumbing. edit: Note, not trying to argue replacing libcurl is a weekend project! [1]: https://mbed-tls.readthedocs.io/projects/api/en/latest/ [2]: https://mbed-

I was looking into this some years back when I was considering building a high-availability IRC bouncer that can pass the TLS IRC connections around with this. There isn't anything out of the box that I could find, but there was some discussion/prototyping around adding an API for exporting all the necessary key material and metadata to the mbedtls API. With that it would have been "relatively" "easy" to do the TLS bits :) See https://github.com/Mbed-TLS/mbedtls/issues/3141 and linked ML posts.

If you want to see a real implemention of arbitrary sized integer math, mbedTLS is a great example: https://github.com/ARMmbed/mbedtls/blob/development/library/... All of the ECC code in that library relies on this code, which can be accelerated by dedicated hardware. Here is multi-precision multiplication: https://github.com/ARMmbed/mbedtls/blob/f1eb4257823ae4c3b3ac...

That was absolutely fantastic. It’d be a pleasure to see a version for 1.3, but not all Maintained SSL libraries implement it yet, https://github.com/ARMmbed/mbedtls/issues/508 mbedTLS tls for example appears not to have it landed. This is one library often used in IoT environments

Yes - it's part of ARM Holdings from November 2014. https://github.com/ARMmbed/mbedtls "Arm welcomes feedback on the design of the API. If you think something could be improved, please open an issue on our Github repository. Alternatively, if you prefer to provide your feedback privately, please email us at mbed-crypto@arm.com. All feedback received by email is treated confidentially."

mbedtls is a bit annoying at first but the windows build process is less painful than openssl. ```powershell New-Item "temp" -ItemType "directory" -Force $client = New-Object System.Net.WebClient $client.DownloadFile("https://github.com/ARMmbed/mbedtls/archive/mbedtls-master.zi..., "temp\C:\temp\mbedtls-master.zip") Expand-Archive -Path C:\temp\mbedtls-master.zip -DestinationPath C:\temp\; Move-Item C:\temp\mbedtls-mbedtls-master\ C:\mbedtls\ MSBuild.exe C:\mbedtls\visualc\VS2010\mbedTLS.sln /p:Configuration=Release /p:Platform=x64 MSBuild.exe C:\mbedtls\visualc\VS2010\mbedTLS.sln /p:Configuration=Release /p:Platform=Win32 ```

ARM mbed TLS [1], Amazon S2N [2], nginx [3] have a super consistent code style throughout and are prime examples of how C application programming should be done (in my opinion). [1] https://github.com/ARMmbed/mbedtls [2] https://github.com/awslabs/s2n [3] https://github.com/nginx/nginx

Just posting the last few I've added to my github list. https://github.com/x64dbg/x64dbg https://github.com/ARMmbed/mbedtls https://github.com/ch11ng/exwm https://github.com/DexterLagan/lsh https://github.com/hellerve/programming-talks#creative-codin... https://github.com/zulip/zulip/ https://github.com/TechnologyClassroom/SetupNotes/tree/maste... https://github.com/ocornut/imgui https://github.com/alseambusher/crontab-ui https://github.com/fyhertz/libstreaming https://github.com/OCSInventory-NG/OCSInventory-Server https://github.com/OCSInventory-NG/UnixAgent https://github.com/su8/pinky-bar https://github.com/jakewmeyer/Geo https://github.com/sevagas/swap_digger https://github.com/gavinlyonsrepo/bashmultitool https://github.com/joereynolds/salutem https://github.com/jarun/ddgr

Insecurity of things... by default, the connection is insecure [1][2] and unencrypted. But at least they're starting to move in the right direction [3], if you have a commercial license. [1] https://docs.mbed.com/docs/mbed-client-guide/en/latest/Howto... [2] https://docs.mbed.com/docs/mbed-client-guide/en/latest/api/c... [3] https://github.com/ARMmbed/mbedtls *edit: formatting

It's funny how in issue #1 users are asking for DTLS. I'm pretty sure this is what's finally going to get implemented and probably will appear in mbed OS soon too. https://github.com/polarssl/polarssl/issues/1 http://mbed.org/technology/os/

Oh, there is a link for the bug. Sorry, my bad. Yes, Privacy Enhanced Mail is not part of the verified PolarSSL configuration. And the bug at https://github.com/polarssl/polarssl/issues/83 is definitely the sort of bug Frama-C would “not shut up” about, as Regehr puts it. The warning will only occur where the buffer overflow eventually happens, and it may be more or less pleasant to go back from the site of the buffer overflow to the bug in the fashion of http://blog.frama-c.com/index.php?post/2014/02/23/CVE-2013-5... , but Frama-C's value analysis is designed to reliably find this bug and not shut up about it.

I've been looking into what options exist and what their pros and cons are for switching LuaSec from OpenSSL to something else (mostly in the context of Prosody's TLS support). These are my pros and cons so far, but it's a pretty specific application, so not all points may be important for others. Pros: * PolarSSL seems to be very clear code, well modularized and a much more sane API than OpenSSL. * Supports setting cipher orders by TLS version. * Cipher support is good (all the new ECC and SHA2 stuff is included), but it doesn't support SSLv2 or EXP ciphers (I'm counting this as a "pro", though). Cons: * Not quite as much support for working with X509 certificates. It parses the extension fields it knows about, but if you want to know more than those, you'll have to dig into ASN.1 yourself. * Related to the previous point: I couldn't fin

(stolen from the amazing prosody guys): https://github.com/polarssl/polarssl/issues/84