79-556: OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping, and identify the party at the other end. It is widely used by Internet servers , including the majority of HTTPS websites . OpenSSL contains an open-source implementation of the SSL and TLS protocols. The core library , written in the C programming language , implements basic cryptographic functions and provides various utility functions. Wrappers allowing
158-414: A library is a collection of resources that is leveraged during software development to implement a computer program . Historically, a library consisted of subroutines (generally called functions today). The concept now includes other forms of executable code including classes and non-executable data including images and text . It can also refer to a collection of source code . For example,
237-533: A man-in-the-middle attack against any future communications. The vulnerability might also reveal unencrypted parts of other users' sensitive requests and responses, including session cookies and passwords, which might allow attackers to hijack the identity of another user of the service. At its disclosure on April 7, 2014, around 17% or half a million of the Internet's secure web servers certified by trusted authorities were believed to have been vulnerable to
316-402: A modular fashion. When writing code that uses a library, a programmer only needs to know high-level information such as what items it contains at and how to use the items – not all of the internal details of the library. Libraries can use other libraries resulting in a hierarchy of libraries in a program. A library of executable code has a well-defined interface by which the functionality
395-741: A 4-clause BSD License . As the OpenSSL License was Apache License 1.0, but not Apache License 2.0, it requires the phrase "this product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit" to appear in advertising material and any redistributions (Sections 3 and 6 of the OpenSSL License). Due to this restriction, the OpenSSL License and the Apache License 1.0 are incompatible with
474-468: A Communication Pool (COMPOOL), roughly a library of header files. Another major contributor to the modern library concept came in the form of the subprogram innovation of FORTRAN . FORTRAN subprograms can be compiled independently of each other, but the compiler lacked a linker . So prior to the introduction of modules in Fortran-90, type checking between FORTRAN subprograms was impossible. By
553-455: A budget of less than $ 1 million USD per year and relies primarily on donations. Development of TLS 1.3 was sponsored by Akamai . OpenSSL supports a number of different cryptographic algorithms: ( Perfect forward secrecy is supported using elliptic curve Diffie–Hellman since version 1.0.) FIPS 140 is a U.S. Federal program for the testing and certification of cryptographic modules. An early FIPS 140-1 certificate for OpenSSL's FOM 1.0
632-504: A bug where certain ASN.1 sequences triggered a large number of recursions on Windows machines, discovered on November 4, 2003. Windows could not handle large recursions correctly, so OpenSSL would crash as a result. Being able to send arbitrary large numbers of ASN.1 sequences would cause OpenSSL to crash as a result. When creating a handshake, the client could send an incorrectly formatted ClientHello message, leading to OpenSSL parsing more than
711-545: A contributor's own patents. This license requires the preservation of the copyright notice and disclaimer . The Apache License is permissive ; unlike copyleft licenses, it does not require a derivative work of the software, or modifications to the original, to be distributed using the same license. It still requires application of the same license to all unmodified parts. In every licensed file, original copyright, patent, trademark, and attribution notices must be preserved (excluding notices that do not pertain to any part of
790-515: A display generated by the derivative works (wherever such third-party notices normally appear). The contents of the NOTICE file do not modify the license, as they are for informational purposes only, and adding more attribution notices as addenda to the NOTICE text is permissible, provided that these notices cannot be understood as modifying the license. Modifications may have appropriate copyright notices, and may provide different license terms for
869-559: A feature called smart linking whereby the linker is aware of or integrated with the compiler, such that the linker knows how external references are used, and code in a library that is never actually used , even though internally referenced, can be discarded from the compiled application. For example, a program that only uses integers for arithmetic, or does no arithmetic operations at all, can exclude floating-point library routines. This smart-linking feature can lead to smaller application file sizes and reduced memory usage. Some references in
SECTION 10
#1732780556668948-619: A maintainer of the Debian distribution applied a patch to Debian's variant of the OpenSSL suite, which inadvertently broke its random number generator by limiting the overall number of private keys it could generate to 32,768. The broken version was included in the Debian release of September 17, 2006 (version 0.9.8c-1), also compromising other Debian-based distributions, for example Ubuntu . Ready-to-use exploits are easily available. The error
1027-496: A major version number to avoid a conflict with one of OpenSSL's modules. Version 3.0.0 was the first to use the Apache License . As of May 2019, the OpenSSL management committee consisted of seven people and there are seventeen developers with commit access (many of whom are also part of the OpenSSL management committee). There are only two full-time employees (fellows) and the remainder are volunteers. The project has
1106-505: A new library, Tink, based on BoringSSL. Among developers communities, OpenSSL is often cited for introducing API compatibility breakage with each new major version, which requires software adaptations that tend to delay new version adoptions. This, combined with the fact that previous releases are generally maintained for no more than two years after a new major one is released tends to force some vendors to anticipate software migrations very early while still having little time left to update to
1185-428: A new release, sometimes at the risk of losing some compatibility with existing software or risking regressions. While long-term support (LTS) releases are maintained for 5 years, accumulated delays in release time frames tend to force operating system vendors to stay on the last supported release longer, leaving less margin when the new version is available. For example OpenSSL 3.0 was initially expected for Q4 2019 and
1264-399: A precaution. This vulnerability ( CVE - 2015-0291 ) allows anyone to take a certificate, read its contents and modify it accurately to abuse the vulnerability causing a certificate to crash a client or server. If a client connects to an OpenSSL 1.0.2 server and renegotiates with an invalid signature algorithms extension, a null-pointer dereference occurs. This can cause a DoS attack against
1343-436: A program are loaded from individual shared objects into memory at load time or runtime , rather than being copied by a linker when it creates a single monolithic executable file for the program. Shared libraries can be statically linked during compile-time, meaning that references to the library modules are resolved and the modules are allocated memory when the executable file is created. But often linking of shared libraries
1422-466: A program could use a library to indirectly make system calls instead of making those system calls directly in the program. A library can be used by multiple, independent consumers (programs and other libraries). This differs from resources defined in a program which can usually only be used by that program. When a consumer uses a library resource, it gains the value of the library without having to implement it itself. Libraries encourage code reuse in
1501-589: A program or library module are stored in a relative or symbolic form which cannot be resolved until all code and libraries are assigned final static addresses. Relocation is the process of adjusting these references, and is done either by the linker or the loader . In general, relocation cannot be done to individual libraries themselves because the addresses in memory may vary depending on the program using them and other libraries they are combined with. Position-independent code avoids references to absolute addresses and therefore does not require relocation. When linking
1580-538: A specially crafted handshake to force the use of weak keying material. Successful exploitation could lead to a security bypass condition where an attacker could gain access to potentially sensitive information. The attack can only be performed between a vulnerable client and server. OpenSSL clients are vulnerable in all versions of OpenSSL before the versions 0.9.8za, 1.0.0m and 1.0.1h. Servers are only known to be vulnerable in OpenSSL 1.0.1 and 1.0.2-beta1. Users of OpenSSL servers earlier than 1.0.1 are advised to upgrade as
1659-407: A suffix of .a ( archive , static library) or of .so (shared object, dynamically linked library). Some systems might have multiple names for a dynamically linked library. These names typically share the same prefix and have different suffixes indicating the version number. Most of the names are names for symbolic links to the latest version. For example, on some systems libfoo.so.2 would be
SECTION 20
#17327805566681738-440: Is created (static linking), or whenever the program is used at runtime (dynamic linking). The references being resolved may be addresses for jumps and other routine calls. They may be in the main program, or in one module depending upon another. They are resolved into fixed or relocatable addresses (from a common base) by allocating runtime memory for the memory segments of each module referenced. Some programming languages use
1817-413: Is invoked. For example, in C , a library function is invoked via C's normal function call capability. The linker generates code to call a function via the library mechanism if the function is available from a library instead of from the program itself. The functions of a library can be connected to the invoking program at different program lifecycle phases . If the code of the library is accessed during
1896-430: Is performed during the creation of an executable or another object file, it is known as static linking or early binding . In this case, the linking is usually done by a linker , but may also be done by the compiler . A static library , also known as an archive , is one intended to be statically linked. Originally, only static libraries existed. Static linking must be performed when any modules are recompiled. All of
1975-500: Is postponed until they are loaded. Although originally pioneered in the 1960s, dynamic linking did not reach the most commonly-used operating systems until the late 1980s. It was generally available in some form in most operating systems by the early 1990s. During this same period, object-oriented programming (OOP) was becoming a significant part of the programming landscape. OOP with runtime binding requires additional information that traditional libraries do not supply. In addition to
2054-706: The Apache HTTP Server . Its initial license was essentially the same as the original 4-clause BSD license , with only the names of the organizations changed, and with an additional clause forbidding derivative works from bearing the Apache name. In July 1999, the Berkeley Software Distribution accepted the argument put to it by the Free Software Foundation and retired their advertising clause (clause 3) to form
2133-609: The GNU GPL . Some GPL developers have added an OpenSSL exception to their licenses that specifically permits using OpenSSL with their system. GNU Wget and climm both use such exceptions. Some packages (like Deluge ) explicitly modify the GPL license by adding an extra section at the beginning of the license documenting the exception. Other packages use the LGPL -licensed GnuTLS , BSD -licensed Botan , or MPL -licensed NSS , which perform
2212-595: The LibreSSL fork circa 2016. In April 2014 in the wake of Heartbleed , members of the OpenBSD project forked OpenSSL starting with the 1.0.1g branch, to create a project named LibreSSL . In the first week of pruning the OpenSSL's codebase , more than 90,000 lines of C code had been removed from the fork. In June 2014, Google announced its own fork of OpenSSL dubbed BoringSSL. Google plans to co-operate with OpenSSL and LibreSSL developers. Google has since developed
2291-554: The QUIC transport layer was being worked on to support the third version of the HTTP protocol, it was proposed to use TLS to provide security, and identified that some adaptations to TLS libraries would be needed. Such modifications were brought to BoringSSL which was the library being primarily used by QUIC developers by then, and later ported to other libraries. A port of this work was quickly proposed to OpenSSL. While some discussion started
2370-588: The UNIX world, which uses different file extensions, when linking against .LIB file in Windows one must first know if it is a regular static library or an import library. In the latter case, a .DLL file must be present at runtime. Apache License The Apache License is a permissive free software license written by the Apache Software Foundation (ASF). It allows users to use
2449-663: The 1.0.2 architecture as 'end of life' or 'EOL', effective December 31, 2019, despite objections that it was the only version of OpenSSL that was currently available with support for FIPS mode. As a result of the EOL, many users were unable to properly deploy the FOM 2.0 and fell out of compliance because they did not secure extended support for the 1.0.2 architecture, although the FOM itself remained validated for eight months further. The FIPS Object Module 2.0 remained FIPS 140-2 validated in several formats until September 1, 2020, when NIST deprecated
OpenSSL - Misplaced Pages Continue
2528-573: The Apache License with the LLVM exception is used, then it is compatible with GPLv2. In October 2012, 8,708 projects located at SourceForge.net were available under the terms of the Apache License. In a blog post from May 2008, Google mentioned that over 25% of the nearly 100,000 projects then hosted on Google Code were using the Apache License, including the Android operating system . As of 2015 , according to Black Duck Software and GitHub ,
2607-534: The Apache license is the third most popular license in the FOSS domain after MIT License and GPLv2 . The OpenBSD project does not consider the Apache License 2.0 to be an acceptable free license because of its patent provisions. The OpenBSD policy believes that when the license forces one to give up a legal right that one otherwise has, that license is no longer free. Moreover, the project objects to involving contract law with copyright law, stating "...Copyright law
2686-587: The CMVP Implementation Under Test List, which reflected an official engagement with a testing lab to proceed with a FIPS 140-2 validation. This resulted in a slew of certifications in the following months. OpenSSL was dual-licensed under the OpenSSL License and the SSLeay License, which means that the terms of either licenses can be used. The OpenSSL License is Apache License 1.0 and SSLeay License bears some similarity to
2765-545: The Historical List, although some FIPS validated modules with replacement compatibility avoided the deprecation, such as BoringCrypto from Google and CryptoComply from SafeLogic. The OpenSSL Management Committee announced a change in the versioning scheme. Due to this change, the major number of the next major version would have been doubled, since the OpenSSL FIPS module already occupied this number. Therefore
2844-625: The Work." Through an in terrorem clause, if the user sues anyone alleging that the software or a contribution within it constitutes patent infringement, any such patent licenses for that work are terminated. The Apache Software Foundation and the Free Software Foundation agree that the Apache License 2.0 is a free software license , compatible with the GNU General Public License (GPL) version 3, meaning that code under GPLv3 and Apache License 2.0 can be combined, as long as
2923-495: The alternative QuicTLS fork, or seek for alternative solutions. Finally Rich Salz, co-founder of the QuicTLS fork, announced his interest in seeing an Apache project forked from QuicTLS. As of 25 February 2023 there is still no QUIC-compatible long-term supported TLS library available by default in operating systems without requiring end-users to rebuild it themselves from sources. Library (computing) In computer science ,
3002-406: The application's memory with every heartbeat ( CVE - 2014-0160 ). By reading the memory of the web server, attackers could access sensitive data, including the server's private key . This could allow attackers to decode earlier eavesdropped communications if the encryption protocol used does not ensure perfect forward secrecy . Knowledge of the private key could also allow an attacker to mount
3081-469: The attack. However, Heartbleed can affect both the server and client. The CCS Injection Vulnerability ( CVE - 2014-0224 ) is a security bypass vulnerability that results from a weakness in OpenSSL methods used for keying material. This vulnerability can be exploited through the use of a man-in-the-middle attack, where an attacker may be able to decrypt and modify traffic in transit. A remote unauthenticated attacker could exploit this vulnerability by using
3160-514: The build of the invoking program, then the library is called a static library . An alternative is to build the program executable to be separate from the library file. The library functions are connected after the executable is started, either at load-time or runtime . In this case, the library is called a dynamic library . Most compiled languages have a standard library , although programmers can also create their own custom libraries. Most modern software systems provide libraries that implement
3239-732: The contents of memory that came after the ClientHello. When using Basic Input/Output (BIO) or FILE based functions to read untrusted DER format data, OpenSSL is vulnerable. This vulnerability was discovered on April 19, 2012, and was assigned the CVE identifier CVE - 2012-2110 . While not directly affecting the SSL/TLS code of OpenSSL, any application that was using ASN.1 functions (particularly d2i_X509 and d2i_PKCS12) were also not affected. In handling CBC cipher-suites in SSL, TLS, and DTLS, OpenSSL
OpenSSL - Misplaced Pages Continue
3318-474: The decision was made to skip the OpenSSL 2.0 version number and continue with OpenSSL 3.0 . OpenSSL 3.0 restored FIPS mode and underwent FIPS 140-2 testing, but with significant delays: The effort was first kicked off in 2016 with support from SafeLogic and further support from Oracle in 2017, but the process has been challenging. On October 20, 2020, the OpenSSL FIPS Provider 3.0 was added to
3397-556: The dependencies to external libraries in build configuration files (such as a Maven Pom in Java). Another library technique uses completely separate executables (often in some lightweight form) and calls them using a remote procedure call (RPC) over a network to another computer. This maximizes operating system re-use: the code needed to support the library is the same code being used to provide application support and security for every other program. Additionally, such systems do not require
3476-417: The derivative works). In every licensed file changed, a notification must be added stating that changes have been made to that file. If a NOTICE text file is included as part of the distribution of the original work, then derivative works must include a readable copy of these notices within a NOTICE text file distributed as part of the derivative works, within the source form or documentation, or within
3555-424: The end of the message. Assigned the identifier CVE - 2011-0014 by the CVE project, this affected all OpenSSL versions 0.9.8h to 0.9.8q and OpenSSL 1.0.0 to 1.0.0c. Since the parsing could lead to a read on an incorrect memory address, it was possible for the attacker to cause a DoS . It was also possible that some applications expose the contents of parsed OCSP extensions, leading to an attacker being able to read
3634-532: The engine would have a library of its own." In 1947 Goldstine and von Neumann speculated that it would be useful to create a "library" of subroutines for their work on the IAS machine , an early computer that was not yet operational at that time. They envisioned a physical library of magnetic wire recordings , with each wire storing reusable computer code. Inspired by von Neumann, Wilkes and his team constructed EDSAC . A filing cabinet of punched tape held
3713-536: The filename for the second major interface revision of the dynamically linked library libfoo . The .la files sometimes found in the library directories are libtool archives, not usable by the system as such. The system inherits static library conventions from BSD , with the library stored in a .a file, and can use .so -style dynamically linked libraries (with the .dylib suffix instead). Most libraries in macOS, however, consist of "frameworks", placed inside special directories called " bundles " which wrap
3792-417: The inefficient use of locks in frequent low-level operations, citing slowdowns from 80 to 400 times. The OpenSSL team has created a meta-issue to try to centralize reports of such massive performance regressions. About half of these reporters indicate the impossibility for them to upgrade to 3.0 from earlier versions, adding to the trouble caused by the limited support time left on previous version 1.1.1. While
3871-439: The instantiated objects residing only in memory (although potentially able to be made persistent in separate files). In others, like Smalltalk , the class libraries are merely the starting point for a system image that includes the entire state of the environment, classes and all instantiated objects. Today most class libraries are stored in a package repository (such as Maven Central for Java). Client code explicitly declare
3950-958: The library to exist on the same machine, but can forward the requests over the network. However, such an approach means that every library call requires a considerable amount of overhead. RPC calls are much more expensive than calling a shared library that has already been loaded on the same machine. This approach is commonly used in a distributed architecture that makes heavy use of such remote calls, notably client-server systems and application servers such as Enterprise JavaBeans . Code generation libraries are high-level APIs that can generate or transform byte code for Java . They are used by aspect-oriented programming , some data access frameworks, and for testing to generate dynamic proxy objects. They also are used to intercept field access. The system stores libfoo.a and libfoo.so files in directories such as /lib , /usr/lib or /usr/local/lib . The filenames always start with lib , and end with
4029-463: The library's required files and metadata. For example, a framework called MyFramework would be implemented in a bundle called MyFramework.framework , with MyFramework.framework/MyFramework being either the dynamically linked library file or being a symlink to the dynamically linked library file in MyFramework.framework/Versions/Current/MyFramework . Dynamic-link libraries usually have
SECTION 50
#17327805566684108-501: The majority of the system services. Such libraries have organized the services which a modern application requires. As such, most code used by modern applications is provided in these system libraries. The idea of a computer library dates back to the first computers created by Charles Babbage . An 1888 paper on his Analytical Engine suggested that computer operations could be punched on separate cards from numerical input. If these operation punch cards were saved for reuse then "by degrees
4187-528: The mid 1960s, copy and macro libraries for assemblers were common. Starting with the popularity of the IBM System/360 , libraries containing other types of text elements, e.g., system parameters, also became common. In IBM's OS/360 and its successors this is called a partitioned data set . The first object-oriented programming language, Simula , developed in 1965, supported adding classes to libraries via its compiler. Libraries are important in
4266-566: The modifications. Unless explicitly stated otherwise, any contributions submitted by a licensee to a licensor will be under the terms of the license without any terms and conditions, but this does not preclude any separate agreements with the licensor regarding these contributions. The Apache License 2.0 attempts to forestall potential patent litigation in Section 3. The user is granted a patent license from each contributor to "make, have made, use, offer to sell, sell, import, and otherwise transfer
4345-488: The modules required by a program are sometimes statically linked and copied into the executable file. This process, and the resulting stand-alone file, is known as a static build of the program. A static build may not need any further relocation if virtual memory is used and no address space layout randomization is desired. A shared library or shared object is a file that is intended to be shared by executable files and further shared object files . Modules used by
4424-472: The names and entry points of the code located within, they also require a list of the objects they depend on. This is a side-effect of one of OOP's core concepts, inheritance, which means that parts of the complete definition of any method may be in different places. This is more than simply listing that one library requires the services of another: in a true OOP system, the libraries themselves may not be known at compile time , and vary from system to system. At
4503-405: The new 3-clause BSD license. In 2000, Apache did likewise and created the Apache License 1.1, in which derived products are no longer required to include attribution in their advertising materials, only in their documentation. Individual packages licensed under the 1.1 version may have used different wording due to varying requirements for attribution or mark identification, but the binding terms were
4582-430: The program linking or binding process, which resolves references known as links or symbols to library modules. The linking process is usually automatically done by a linker or binder program that searches a set of libraries and other modules in a given order. Usually it is not considered an error if a link target can be found multiple times in a given set of libraries. Linking may be done when an executable file
4661-538: The project as QuicTLS and support these patches on top of the OpenSSL code in order to unblock QUIC development. This action was generally welcome by the community. Finally after OpenSSL 3.0 was finally released, the QUIC patch set was reconsidered and decided against, causing tens to hundreds of reactions of disappointment among the community. The pull request was closed, while users felt the need to publicly express their disappointment, or beg operating system vendors to support
4740-541: The resulting software is licensed under the GPLv3. The Free Software Foundation considers all versions of the Apache License to be incompatible with the previous GPL versions 1 and 2. Furthermore, it considers Apache License versions before 2.0 incompatible with GPLv3. Because of version 2.0's patent license requirements, the Free Software Foundation recommends it over other non-copyleft licenses. If
4819-424: The rough OOP equivalent of older types of code libraries. They contain classes , which describe characteristics and define actions ( methods ) that involve objects. Class libraries are used to create instances , or objects with their characteristics set to specific values. In some OOP languages, like Java , the distinction is clear, with the classes often contained in library files (like Java's JAR file format ) and
SECTION 60
#17327805566684898-596: The same day, it quickly stalled and was first blocked on license considerations, then kept on hold once these concerns were cleared. Finally 10 months later the OpenSSL Management Committee announced on a blog post that this patch set would not be adopted for 3.0 on the fear that the API would change over time. Finally more than one year after planned release of 3.0 which was still not coming, a team of volunteers from Akamai and Microsoft decided to fork
4977-504: The same task. OpenSSL announced in August 2015 that it would require most contributors to sign a Contributor License Agreement (CLA), and that OpenSSL would eventually be relicensed under the terms of Apache License 2.0 . This process commenced in March 2017, and was complete in 2018. On 7 September 2021, OpenSSL 3.0.0 was released under the Apache License 2.0. OpenSSL 0.9.6k has
5056-424: The same time many developers worked on the idea of multi-tier programs, in which a "display" running on a desktop computer would use the services of a mainframe or minicomputer for data storage or processing. For instance, a program on a GUI-based computer would send messages to a minicomputer to return small samples of a huge dataset for display. Remote procedure calls (RPC) already handled these tasks, but there
5135-492: The same. In January 2004, ASF decided to depart from the BSD model and produced the Apache License 2.0. The stated goals of the license included making it easier for non-ASF projects to use, improving compatibility with GPL -based software, allowing the license to be included by reference instead of listed in every file, clarifying the license on contributions, and requiring a patent license on contributions that necessarily infringe
5214-473: The server. A Stanford Security researcher, David Ramos, had a private exploit and presented it to the OpenSSL team, which then patched the issue. OpenSSL classified the bug as a high-severity issue, noting version 1.0.2 was found vulnerable. This vulnerability ( CVE - 2016-0701 ) allows, when some particular circumstances are met, to recover the OpenSSL server's private Diffie–Hellman key. An Adobe System Security researcher, Antonio Sanso, privately reported
5293-562: The software for any purpose, to distribute it, to modify it, and to distribute modified versions of the software under the terms of the license, without concern for royalties . The ASF and its projects release their software products under the Apache License. The license is also used by many non-ASF projects. Beginning in 1995, the Apache Group (later the Apache Software Foundation) released successive versions of
5372-528: The status of the "next big thing" in the programming world. There were a number of efforts to create systems that would run across platforms, and companies competed to try to get developers locked into their own system. Examples include IBM 's System Object Model (SOM/DSOM), Sun Microsystems ' Distributed Objects Everywhere (DOE), NeXT 's Portable Distributed Objects (PDO), Digital 's ObjectBroker , Microsoft's Component Object Model (COM/DCOM), and any number of CORBA -based systems. Class libraries are
5451-521: The subroutine library for this computer. Programs for EDSAC consisted of a main program and a sequence of subroutines copied from the subroutine library. In 1951 the team published the first textbook on programming, The Preparation of Programs for an Electronic Digital Computer , which detailed the creation and the purpose of the library. COBOL included "primitive capabilities for a library system" in 1959, but Jean Sammet described them as "inadequate library facilities" in retrospect. JOVIAL has
5530-475: The suffix *.DLL , although other file name extensions may identify specific-purpose dynamically linked libraries, e.g. *.OCX for OLE libraries. The interface revisions are either encoded in the file names, or abstracted away using COM-object interfaces. Depending on how they are compiled, *.LIB files can be either static libraries or representations of dynamically linkable libraries needed only during compilation, known as " import libraries ". Unlike in
5609-645: The usage of FIPS 186-2 for Digital Signature Standard and designated all non-compliant modules as 'Historical'. This designation includes a caution to federal agencies that they should not include the module in any new procurements. All three of the OpenSSL validations were included in the deprecation – the OpenSSL FIPS Object Module (certificate #1747), OpenSSL FIPS Object Module SE (certificate #2398), and OpenSSL FIPS Object Module RE (certificate #2473). Many 'private label' OpenSSL-based validations and clones created by consultants were also moved to
5688-502: The use of the OpenSSL library in a variety of computer languages are available. The OpenSSL Software Foundation (OSF) represents the OpenSSL project in most legal capacities including contributor license agreements, managing donations, and so on. OpenSSL Software Services (OSS) also represents the OpenSSL project for support contracts. OpenSSL is available for most Unix-like operating systems (including Linux , macOS , and BSD ), Microsoft Windows and OpenVMS . The OpenSSL project
5767-425: The vulnerability. OpenSSL classified the bug as a high-severity issue, noting only version 1.0.2 was found vulnerable. In 2009, after frustrations with the original OpenSSL API, Marco Peereboom, an OpenBSD developer at the time, forked the original API by creating Agglomerated SSL (assl), which reuses OpenSSL API under the hood, but provides a much simpler external interface. It has since been deprecated in light of
5846-522: Was finally issued 21 months later without extending the expected end of support for previously supported version 1.1.1, and this despite the significant changes that required adaptations to existing software. The reduced support delay of version 1.1.1 mentioned above causes further concerns to users whose workloads are sensitive to performance. Some time after general availability of 3.0, some users started to report serious performance regressions affecting this version in multi-threaded environments, many citing
5925-519: Was found vulnerable to a timing attack during the MAC processing. Nadhem Alfardan and Kenny Paterson discovered the problem, and published their findings on February 5, 2013. The vulnerability was assigned the CVE identifier CVE - 2013-0169 . OpenSSL's pseudo- random number generator acquires entropy using complex programming methods. To keep the Valgrind analysis tool from issuing associated warnings,
6004-477: Was founded in 1998 to provide a free set of encryption tools for the code used on the Internet. It is based on a fork of SSLeay by Eric Andrew Young and Tim Hudson, which unofficially ended development on December 17, 1998, when Young and Hudson both went to work for RSA Security . The initial founding members were Mark Cox, Ralf Engelschall, Stephen Henson, Ben Laurie , and Paul Sutton. In 2018 OpenSSL version numbering skipped from 1.1.1 to 3.0.0, omitting 2 as
6083-467: Was no standard RPC system. Soon the majority of the minicomputer and mainframe vendors instigated projects to combine the two, producing an OOP library format that could be used anywhere. Such systems were known as object libraries , or distributed objects , if they supported remote access (not all did). Microsoft's COM is an example of such a system for local use. DCOM, a modified version of COM, supports remote access. For some time object libraries held
6162-546: Was reported by Debian on May 13, 2008. On the Debian ;4.0 distribution (etch), these problems were fixed in version 0.9.8c-4etch3, while fixes for the Debian 5.0 distribution (lenny) were provided in version 0.9.8g-9. OpenSSL versions 1.0.1 through 1.0.1f have a severe memory handling bug in their implementation of the TLS Heartbeat Extension that could be used to reveal up to 64 KB of
6241-512: Was revoked in July 2006 "when questions were raised about the validated module's interaction with outside software." The module was re-certified in February 2007 before giving way to FIPS 140-2. OpenSSL 1.0.2 supported the use of the OpenSSL FIPS Object Module (FOM), which was built to deliver FIPS approved algorithms in a FIPS 140-2 validated environment. OpenSSL controversially decided to categorize
#667332