Comparison of TLS implementations

From Wikipedia, the free encyclopedia
  (Redirected from Comparison of TLS Implementations)
Jump to: navigation, search

The Transport Layer Security (TLS) protocol provides the ability to secure communications across networks. This comparison of TLS implementations compares several of the most notable libraries. There are several TLS implementations which are free and open source software.

All comparison categories use the stable version of each implementation listed in the overview section. The comparison is limited to features that directly relate to the TLS protocol.

Overview[edit]

Implementation Developed by Open source Software license Copyright owner Latest stable version / release date Origin
Botan Jack Lloyd Yes Simplified BSD License Jack Lloyd 1.11.10 (December 10, 2014; 9 days ago (2014-12-10)[1]) [±] US (Vermont)
cryptlib Peter Gutmann Yes Sleepycat License and commercial license Peter Gutmann 3.4.2 (December 17, 2012; 2 years ago (2012-12-17) [2]) [±] NZ
CyaSSL wolfSSL Yes GPLv2, v3 and commercial license wolfSSL Inc. 3.3.0 (December 5, 2014; 14 days ago (2014-12-05)[3]) [±] US
GnuTLS GnuTLS project Yes LGPL Free Software Foundation 3.2.20 (November 10, 2014; 39 days ago (2014-11-10) [4]) [±]

3.1.28 (November 10, 2014; 39 days ago (2014-11-10) [5]) [±]

EU (Greece and Sweden)
MatrixSSL[6] PeerSec Networks Yes GPLv2 and commercial license PeerSec Networks 3.7.1 (December 4, 2014; 15 days ago (2014-12-04) [7]) [±] US
Network Security Services Mozilla, AOL, Red Hat, Sun, Oracle, Google and others Yes MPL 2.0 NSS contributors 3.17.3 (December 1, 2014; 18 days ago (2014-12-01)[8]) [±]

3.16.6 (October 13, 2014; 2 months ago (2014-10-13)[9]) [±]
3.16.2.3 (October 27, 2014; 53 days ago (2014-10-27)[10]) [±]

US
OpenSSL OpenSSL project Yes OpenSSL / SSLeay dual-license Eric Young, Tim Hudson, Sun, OpenSSL project, and others 1.0.1j (October 15, 2014; 2 months ago (2014-10-15)[11]) [±]

1.0.0o (October 15, 2014; 2 months ago (2014-10-15)[11]) [±]
0.9.8zc (October 15, 2014; 2 months ago (2014-10-15)[11]) [±]

Australia/EU
LibreSSL OpenBSD Project Yes Apache License 1.0, 4-clause BSD License, ISC License, and some are public domain Eric Young, Tim Hudson, Sun, OpenSSL project, OpenBSD Project, and others 2.1.2 (December 9, 2014; 10 days ago (2014-12-09) [12]) [±] Canada
PolarSSL Offspark Yes GPLv2 or higher and commercial license Brainspark B.V. (brainspark.nl) 1.3.9 (October 20, 2014; 60 days ago (2014-10-20) [13]) [±]

1.2.12 (October 24, 2014; 56 days ago (2014-10-24) [13]) [±]

EU (Netherlands)
RSA BSAFE RSA Security No[14] Proprietary RSA Security ? US
SChannel Microsoft No Proprietary Microsoft Inc. Windows 8.1 / 2013-11-13 US
Secure Transport Apple Inc. Yes APSL 2.0 Apple Inc. 55471.14 (OS X 10.9.2) / 2014-02-25 US
SharkSSL Realtimelogic LLC[15] No Proprietary Realtimelogic LLC 2.1 / 2014-01-12 US
JSSE Oracle Yes GPLv2 and commercial license Oracle JDK 8 / 2014-03-18 US
Bouncy Castle The Legion of the Bouncy Castle Inc. Yes MIT License Legion of the Bouncy Castle Inc. 1.51 (Java) (July 27, 2014; 4 months ago (2014-07-27) [16]) [±]

1.7 (C#) (April 7, 2011; 3 years ago (2011-04-07) [17]) [±]

Australia
Implementation Developed by Open source Software license Copyright owner Latest stable version / release date Origin

Protocol support[edit]

Several versions of the TLS protocol exist. SSL 2.0 is a deprecated[18] protocol version with significant weaknesses. SSL 3.0 (1996) and TLS 1.0 (1999) are successors with two weaknesses in CBC-padding that were explained in 2001 by Serge Vaudenay.[19] TLS 1.1 (2006) fixed only one of the problems, by switching to random IVs for CBC block ciphers, whereas the more problematic use of mac-pad-encrypt instead of the secure pad-mac-encrypt was ignored and is still present in TLS 1.2 today. A workaround for SSL 3.0 and TLS 1.0, roughly equivalent to random IVs from TLS 1.1, was widely adopted by many implementations in late 2011,[20] so from a security perspective, all existing version of TLS 1.0, 1.1 and 1.2 provide equivalent strength in the base protocol and are suitable for 128-bit security according to NIST SP800-57 up to at least 2030. In 2014, the POODLE vulnerability of SSL 3.0 was discovered, which makes SSL 3.0 insecure and no workaround exists other than abandoning SSL 3.0 completely.[21]

TLS 1.2 (2008) is the latest published version of the base protocol, introducing a means to identify the hash used for digital signatures. While permitting the use of stronger hash functions for digital signatures in the future (rsa,sha256/sha384/sha512) over the SSL 3.0 conservative choice (rsa,sha1+md5), the TLS 1.2 protocol change inadvertently and substantially weakened the default digital signatures and provides (rsa,sha1) and even (rsa,md5).[22]

Datagram Transport Layer Security (DTLS or Datagram TLS) 1.0 is a modification of TLS 1.1 for a packet-oriented transport layer, where packet loss and packet reordering have to be tolerated. The revision DTLS 1.2 based on TLS 1.2 was published in January 2012[23]

Note that there are known vulnerabilities in SSL 2.0 and SSL 3.0. With the exception of the predictable IVs (for which an easy workaround exists) all currently known vulnerabilities affect all version of TLS 1.0/1.1/1.2 alike.[24]

Implementation SSL 2.0 (insecure)[25] SSL 3.0 (insecure)[26] TLS 1.0[27] TLS 1.1[28] TLS 1.2[29] DTLS 1.0[30] DTLS 1.2[23]
Botan No[a] Disabled by default[31] Yes Yes Yes Beta Beta
cryptlib No Enabled by default Yes Yes Yes No No
CyaSSL No Enabled by default Yes Yes Yes Yes Yes
GnuTLS No[a] Enabled by default Yes Yes Yes Yes Yes
MatrixSSL No[a] Disabled by default at compile time[32] Yes Yes Yes Yes Yes
NSS Disabled by default[a] Enabled by default Yes Yes[33] Yes[34] Yes[33] Yes[35]
OpenSSL Enabled by default Enabled by default Yes Yes[36] Yes[36] Yes Beta[37]
LibreSSL No Disabled by default[38] Yes Yes[36] Yes[36] Yes No
PolarSSL No[a] Enabled by default Yes Yes Yes No No
SChannel XP / 2003[39] Disabled by default in MSIE 7 Enabled by default Enabled by default in MSIE 7 No No No No
SChannel Vista / 2008[40] Disabled by default Enabled by default Yes No No No No
SChannel 7 / 2008R2[41] Disabled by default Enabled by default Yes Enabled by default in MSIE 11 Enabled by default in MSIE 11 Yes[42] Yes[42]
SChannel 8 / 2012[41] Disabled by default Enabled by default Yes Disabled by default Disabled by default Yes Yes
SChannel 8.1 / 2012R2, 10 Technical Preview[41] Disabled by default Enabled by default Yes Yes Yes Yes Yes
Secure Transport OS X 10.2-10.7 / iOS 1-4 Yes Yes Yes No No No No
Secure Transport OS X 10.8-10.10 / iOS 5-8 No[b] Yes Yes Yes[b] Yes[b] Yes[b] No
SharkSSL No Enabled by default Yes Yes Yes No No
JSSE No[a] Enabled by default Yes Yes Yes No No
Implementation SSL 2.0 (insecure) SSL 3.0 (insecure) TLS 1.0 TLS 1.1 TLS 1.2 DTLS 1.0 DTLS 1.2
  1. ^ SSL 2.0 client hello is supported even though SSL 2.0 is not supported or is disabled because of the backward compatibilities.
  2. ^ Secure Transport: SSL 2.0 was discontinued in OS X 10.8. TLS 1.1, 1.2 and DTLS are available on iOS 5.0 and later, and OS X 10.8 and later.[43]

NSA Suite B Cryptography[edit]

Required components for NSA Suite B Cryptography (RFC 6460) are:

Per CNSSP-15, the 256-bit elliptic curve (specified in FIPS 186-2), SHA-256, and AES with 128-bit keys are sufficient for protecting classified information up to the Secret level, while the 384-bit elliptic curve (specified in FIPS 186-2), SHA-384, and AES with 256-bit keys are necessary for the protection of Top Secret information.

Implementation TLS 1.2 Suite B
Botan Yes
cryptlib Yes
CyaSSL Yes
GnuTLS Yes
NSS No[44]
MatrixSSL Yes
OpenSSL Beta[37]
LibreSSL No
PolarSSL Yes
SChannel Yes[45]
Secure Transport No
SharkSSL Yes
JSSE Yes[46]
Implementation TLS 1.2 Suite B

Certifications[edit]

Implementation FIPS 140-1, FIPS 140-2[47] Common Criteria
Level 1 Level 2
Botan[48]
cryptlib[49]
CyaSSL In process
GnuTLS[50]
MatrixSSL[51] SafeZone FIPS Cryptographic Module: 1.0.3 and 1.0.3A (#1931)
NSS[52] Network Security Services: 3.2.2 (#247)
Network Security Services Cryptographic Module: 3.11.4 (#815), 3.12.4 (#1278), 3.12.9.1 (#1837)
Netscape Security Module: 1 (#7[notes 1]), 1.01 (#47[notes 2])
Network Security Services: 3.2.2 (#248[notes 3])
Network Security Services Cryptographic Module: 3.11.4 (#814[notes 4]), 3.12.4 (#1279, #1280[notes 5])
OpenSSL[53] OpenSSL FIPS Object Module: 1.0 (#624), 1.1.1 (#733), 1.1.2 (#918), 1.2, 1.2.1, 1.2.2, 1.2.3 or 1.2.4 (#1051)
2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7 or 2.0.8 (#1747)
LibreSSL
PolarSSL[54]
SChannel[55] Cryptographic modules in Windows NT 4.0, 95, 95, 2000, XP, Server 2003, CE 5, CE 6, Mobile 6.x, Vista, Server 2008, 7, Server 2008 R2, 8, Server 2012, RT, Surface, Phone 8
See details on Microsoft FIPS 140 Validated Cryptographic Modules
Secure Transport Apple FIPS Cryptographic Module: 1.0 (OS X 10.6, #1514), 1.1 (OS X 10.7, #1701)
Apple OS X CoreCrypto Module / CoreCrypto Kernel Module: 3.0 (OS X 10.8, #1964, #1956), 4.0 (OS X 10.9, #2015, #2016)
Apple iOS CoreCrypto Module / CoreCrypto Kernel Module: 3.0 (iOS 6, #1963, #1944), 4.0 (iOS 7 , #2020, #2021)
SharkSSL
JSSE
Implementation Level 1 Level 2 Common Criteria
FIPS 140-1, FIPS 140-2
  1. ^ with Sun Sparc 5 w/ Sun Solaris v 2.4SE (ITSEC-rated)
  2. ^ with Sun Ultra-5 w/ Sun Trusted Solaris version 2.5.1 (ITSEC-rated)
  3. ^ with Solaris v8.0 with AdminSuite 3.0.1 as specified in UK IT SEC CC Report No. P148 EAL4 on a SUN SPARC Ultra-1
  4. ^ with these platforms; Red Hat Enterprise Linux Version 4 Update 1 AS on IBM xSeries 336 with Intel Xeon CPU, Trusted Solaris 8 4/01 on Sun Blade 2500 Workstation with UltraSPARC IIIi CPU
  5. ^ with these platforms; Red Hat Enterprise Linux v5 running on an IBM System x3550, Red Hat Enterprise Linux v5 running on an HP ProLiant DL145, Sun Solaris 10 5/08 running on a Sun SunBlade 2000 workstation, Sun Solaris 10 5/08 running on a Sun W2100z workstation

Key exchange algorithms (certificate-only)[edit]

This section lists the certificate verification functionality available in the various implementations.

Implementation RSA[29] RSA-EXPORT (insecure)[29] DHE-RSA (forward secrecy)[29] DHE-DSS (forward secrecy)[29] ECDH-ECDSA[56] ECDHE-ECDSA (forward secrecy)[56] ECDH-RSA[56] ECDHE-RSA (forward secrecy)[56] GOST R 34.10-94 / 34.10-2001[57]
Botan Yes No Yes Yes No Yes No Yes No
cryptlib Yes No Yes Yes No Yes No No No
CyaSSL Yes No Yes No Yes Yes Yes Yes No
GnuTLS Yes No Yes Yes No Yes No Yes No
MatrixSSL Yes No Yes No Yes Yes Yes Yes No
NSS Yes Disabled by default Client side only[58] Client side only[58] Yes Yes Yes Yes No[59][60]
OpenSSL Yes Yes Yes Yes Yes Yes Yes Yes Yes[61]
LibreSSL Yes Yes Yes Yes Yes Yes Yes Yes Yes
PolarSSL Yes No Yes No Yes Yes Yes Yes No
SChannel XP/2003 Yes Yes No Max 1024 bit No No No No No[62]
SChannel Vista/2008 Yes disabled by default No Max 1024 bit No Yes No Yes No[62]
SChannel 7/2008R2, 8/2012, 8.1/2012R2 Yes disabled by default AES_GCM only
1024bits only[63][64][65]
Max 1024 bit No Yes No except AES_GCM No[62]
SChannel 10 Technical Preview Yes disabled by default AES_GCM only
1024bits only
Max 1024 bit No Yes No Yes No[62]
Secure Transport Yes No Yes Yes Yes Yes Yes Yes No
SharkSSL Yes No Yes No Yes Yes Yes Yes No
JSSE Yes Disabled by default Max 2048 bit Max 2048 bit Yes Yes Yes Yes No[66]
Implementation RSA RSA EXPORT (insecure) DHE-RSA (forward secrecy) DHE-DSS (forward secrecy) ECDH-ECDSA ECDHE-ECDSA (forward secrecy) ECDH-RSA ECDHE-RSA (forward secrecy) GOST R 34.10-94 / 34.10-2001

Key exchange algorithms (alternative key-exchanges)[edit]

Implementation SRP[67] SRP-DSS[67] SRP-RSA[67] PSK-RSA[68] PSK[68] DHE-PSK (forward secrecy)[68] ECDHE-PSK (forward secrecy)[69] DH-ANON[29] (insecure) ECDH-ANON[56] (insecure)
Botan Yes Yes Yes No Yes Yes Yes Yes Yes
cryptlib No No No No Yes Yes No No No
CyaSSL No No No No Yes No No[70] No No
GnuTLS Yes Yes Yes Yes Yes Yes Yes Disabled by default Disabled by default
MatrixSSL No No No No Yes Yes No Yes No
NSS No[71] No[71] No[71] No[72] No[72] No[72] No[72] Disabled by default Disabled by default[73]
OpenSSL Yes Yes Yes No Yes No No Yes Yes
LibreSSL No[74] No[74] No[74] No No No No Yes Yes
PolarSSL No No No Yes Yes Yes Yes No No
SChannel No No No No No No No No No
Secure Transport No No No No No No No Yes Yes
SharkSSL No No No No Yes No No No No
JSSE No No No No No No No Disabled by default in Java 8 Disabled by default in Java 8
Implementation SRP SRP-DSS SRP-RSA PSK-RSA PSK DHE-PSK (forward secrecy) ECDHE-PSK (forward secrecy) DH-ANON (insecure) ECDH-ANON (insecure)

Certificate verification methods[edit]

Implementation Application-defined PKIX path validation[29] CRL[75] OCSP[76] DANE (DNSSEC)[29] Trust on First Use (TOFU)
Botan Yes Yes Yes Yes No No
cryptlib Unknown Yes Unknown Unknown No No
CyaSSL Yes Yes Yes Yes No No
GnuTLS Yes Yes Yes Yes Yes Yes
MatrixSSL Yes Yes Yes No No No
NSS Yes Yes Yes Yes No[77] No
OpenSSL Yes Yes Yes Yes No No
LibreSSL Yes Yes Yes Yes No No
PolarSSL Yes Yes Yes Unknown No No
SChannel Unknown Yes Yes[78] Yes[78] No No
Secure Transport Yes Yes Yes Yes No No
SharkSSL Yes Yes No No No No
JSSE Yes Yes Yes Yes No No
Implementation Application-defined PKIX CRL OCSP DANE TOFU

Encryption algorithms[edit]

Implementation Block cipher with mode of operation Stream cipher None
AES GCM
[79]
AES CCM
[80]
AES CBC Camellia GCM
[81]
Camellia CBC
[82]
ARIA GCM
[83]
ARIA CBC
[83]
SEED CBC
[84]
3DES EDE CBC GOST 28147-89 CNT
(proposed)
[57][n 1]
RC4-128
(insecure)
[n 2]
ChaCha20-Poly1305
(proposed)
[85][n 1]
ChaCha20
(proposed)
[86][n 1]
Null
(insecure)
[n 3]
Botan Yes Yes Yes Yes Yes No No Yes Yes No Disabled by default[31] Yes[87] No Disabled by Default
cryptlib Yes No Yes No No No No No Yes No Yes No No Disabled by Default
CyaSSL Yes Yes Yes No Yes No No No Yes No Yes Yes No Disabled by Default
GnuTLS Yes No Yes Yes Yes No No No Yes No Yes No No Disabled by Default
MatrixSSL Yes No Yes No No No No Yes Yes No Yes No No Disabled by Default
NSS Yes[88] No Yes No[89] Yes[90] No No Yes[91] Yes No[59][60] Lowest priority[92][93] Partial[97] No Disabled by Default
OpenSSL Yes [36] No Yes No Yes No No Yes Yes Yes[61] Yes Partial[98] No Disabled by Default
LibreSSL Yes [36] No Yes No Yes No No Yes Yes Yes Yes Yes No Disabled by Default
PolarSSL Yes Yes [99] Yes Yes Yes No No No Yes No Lowest priority[100] No No Disabled by default at compile time
SChannel XP/2003 No No 2003 only[101] No No No No No Yes No[62] Yes No No Disabled by Default
SChannel Vista/2008 No No Yes No No No No No Yes No[62] Yes No No Disabled by Default
SChannel 7/2008R2, 8/2012 except ECDHE_RSA
[63][64]
No Yes No No No No No Yes No[62] Lowest priority[64][n 4] No No Disabled by Default
SChannel 8.1/2012R2 except ECDHE_RSA
[65]
No Yes No No No No No Yes No[62] Disabled except as a fallback[n 5][103][104] No No Disabled by Default
Schannel 10 Technical Preview[105] Yes No Yes No No No No No Yes No[62] Disabled except as a fallback[n 5] No No Disabled by Default
Secure Transport Yes Yes Yes No No No No No Yes No Yes No No Disabled by Default
SharkSSL Yes Yes Yes No No No No No Yes No Disabled by default Yes No Disabled by default
JSSE Yes No Yes No No No No No Yes No[66] Yes No No Disabled by Default
Implementation AES GCM AES CCM AES CBC Camellia GCM Camellia CBC ARIA GCM ARIA CBC SEED CBC 3DES EDE CBC GOST 28147-89 CNT
(proposed)
RC4-128
(insecure)
ChaCha20-Poly1305
(proposed)
ChaCha20
(proposed)
Null
(insecure)
Block cipher with mode of operation Stream cipher None
Notes
  1. ^ a b c This algorithm is not defined yet as TLS cipher suites in RFCs, is proposed in drafts.
  2. ^ The RC4 attacks weaken or break RC4 used in SSL/TLS.
  3. ^ authentication only, no encryption
  4. ^ RC4 can be disabled except as a fallback (Only when no cipher suites with other than RC4 is available, cipher suites with RC4 will be used as a fallback.)[102]
  5. ^ a b Only when no cipher suites with other than RC4 is available, cipher suites with RC4 will be used as a fallback.

Obsolete algorithms[edit]

Implementation Block cipher with mode of operation Stream cipher
IDEA CBC
[n 1]
DES CBC
(insecure)
[n 1]
DES-40 CBC
(EXPORT, insecure)
[n 2]
RC2-40 CBC
(EXPORT, insecure)
[n 2]
RC4-40
(EXPORT, insecure)
[n 3][n 2]
Botan No No No Disabled by Default No
cryptlib No Disabled by default Disabled by default Disabled by default No
CyaSSL No No No No No
GnuTLS No No No No No
MatrixSSL Yes No No No No
NSS Yes Disabled by default Disabled by default Disabled by default Disabled by default
OpenSSL Yes Yes Yes Yes Yes
LibreSSL Yes Yes Yes Yes Yes
PolarSSL No Disabled by default at compile time No No No
SChannel XP/2003 No yes yes Yes yes
SChannel Vista/2008 No Disabled by default Disabled by default Disabled by default Disabled by default
SChannel 7/2008R2, 8/2012 No Disabled by default Disabled by default Disabled by default Disabled by default
SChannel 8.1/2012R2 No Disabled by default Disabled by default Disabled by default Disabled by default
Schannel 10 Technical Preview[105] No Disabled by default Disabled by default Disabled by default Disabled by default
Secure Transport Yes Yes Disabled by default Disabled by default Disabled by default
SharkSSL No Disabled by default No No No
JSSE No Disabled by default Disabled by default No Disabled by default [107]
Implementation IDEA CBC DES CBC
(insecure)
DES-40 CBC
(EXPORT, insecure)
RC2-40 CBC
(EXPORT, insecure)
RC4-40
(EXPORT, insecure)
Block cipher with mode of operation Stream cipher
Notes
  1. ^ a b IDEA and DES have been removed from TLS 1.2.[106]
  2. ^ a b c 40 bits strength of cipher suites were designed to operate at reduced key lengths in order to comply with US regulations about the export of cryptographic software containing certain strong encryption algorithms (see Export of cryptography from the United States). These weak suites are forbidden in TLS 1.1 and later.
  3. ^ The RC4 attacks weaken or break RC4 used in SSL/TLS.

Supported elliptic curves[edit]

This section lists the supported elliptic curves by each implementation.

Implementation Arbitrary prime curves[108] Arbitrary char2 curves sect163k1 (1) sect163r1 (2) sect163r2 (3) sect193r1 (4) sect193r2 (5) sect233k1 (6) sect233r1 (7) sect239k1 (8) sect283k1 (9) sect283r1 (10) sect409k1 (11) sect409r1 (12) sect571k1 (13) sect571r1 (14)
Botan No No No No No No No No No No No No No No No No
CyaSSL No No No No No No No No No No No No No No No No
GnuTLS No No No No No No No No No No No No No No No No
MatrixSSL No No No No No No No No No No No No No No No No
NSS No No Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
OpenSSL No No Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
LibreSSL No No Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
PolarSSL No No No No No No No No No No No No No No No No
SChannel Vista/2008, 7/2008R2, 8/2012, 8.1/2012R2, 10 Technical Preview No No No No No No No No No No No No No No No No
Secure Transport No No No No No No No No No No No No No No No No
SharkSSL No No No No No No No No No No No No No No No No
JSSE No No Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Implementation Arbitrary prime curves Arbitrary char2 curves sect163k1 sect163r1 sect163r2 sect193r1 sect193r2 sect233k1 sect233r1 sect239k1 sect283k1 sect283r1 sect409k1 sect409r1 sect571k1 sect571r1
Implementation secp160k1 (15) secp160r1 (16) secp160r2 (17) secp192k1 (18) secp192r1 prime192v1 (19) secp224k1 (20) secp224r1 (21) secp256k1 (22) secp256r1 prime256v1 (23) secp384r1 (24) secp521r1 (25) brainpoolP256r1 (26) brainpoolP384r1 (27) brainpoolP512r1 (28)
Botan Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
CyaSSL No Yes No No Yes No Yes No Yes Yes Yes No No No
GnuTLS No No No No Yes No Yes No Yes Yes Yes No No No
MatrixSSL No No No No Yes No Yes No Yes Yes Yes No No No
NSS Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No[109] No[109] No[109]
OpenSSL Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Beta[37][110][111] Beta[37][110][111] Beta[37][110][111]
LibreSSL Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes[110][111] Yes[110][111] Yes[110][111]
PolarSSL No No No Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
SChannel Vista/2008, 7/2008R2, 8/2012, 8.1/2012R2, 10 Technical Preview No No No No No No No No Yes Yes Yes No No No
Secure Transport No No No No Yes No No No Yes No Yes No No No
SharkSSL No No No No Yes No Yes No Yes Yes Yes No No No
JSSE Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No No No
Implementation secp160k1 secp160r1 secp160r2 secp192k1 secp192r1 prime192v1 secp224k1 secp224r1 secp256k1 secp256r1 prime256v1 secp384r1 secp521r1 brainpoolP256r1 brainpoolP384r1 brainpoolP512r1

Data integrity[edit]

Implementation HMAC-MD5 HMAC-SHA1 HMAC-SHA256/384 AEAD GOST 28147-89 IMIT[57] GOST R 34.11-94[57]
Botan Yes Yes Yes Yes No No
cryptlib Yes Yes Yes Yes No No
CyaSSL Yes Yes Yes Yes No No
GnuTLS Yes Yes Yes Yes No No
MatrixSSL Yes Yes Yes Yes No No
NSS Yes Yes Yes Yes No[59][60] No[59][60]
OpenSSL Yes Yes Yes Yes Yes[61] Yes[61]
LibreSSL Yes Yes Yes Yes Yes Yes
PolarSSL Yes Yes Yes Yes No No
SChannel XP/2003, Vista/2008 Yes Yes XP SP3, 2003 SP2 via hotfix[112] No No[62] No[62]
SChannel 7/2008R2, 8/2012, 8.1/2012R2 Yes Yes Yes except ECDHE_RSA[63][64][65] No[62] No[62]
SChannel 10 Technical Preview Yes Yes Yes Yes[105] No[62] No[62]
Secure Transport Yes Yes Yes Yes No No
SharkSSL Yes Yes Yes Yes No No
JSSE Yes Yes Yes Yes No[66] No[66]
Implementation HMAC-MD5 HMAC-SHA1 HMAC-SHA256/384 AEAD GOST 28147-89 MAC GOST R 34.11-94

Compression[edit]

Note the CRIME security exploit takes advantage of TLS compression, so conservative implementations do not enable compression at the TLS level. HTTP compression is unrelated and unaffected by this exploit, but is exploited by the related BREACH attack.

Implementation DEFLATE[113]
(insecure)
Botan No
cryptlib No
CyaSSL Disabled by default
GnuTLS Disabled by default
MatrixSSL Disabled by default
NSS Disabled by default
OpenSSL Yes
LibreSSL No
PolarSSL Disabled by default
SChannel No
Secure Transport No
SharkSSL No
JSSE No
Implementation DEFLATE

Extensions[edit]

In this section the extensions each implementation supports are listed. Note that the Secure Renegotiation extension is critical for HTTPS client security[citation needed]. TLS clients not implementing it are vulnerable to attacks, irrespective of whether the client implements TLS renegotiation.

Implementation Secure
Renegotiation[114]
Server Name
Indication[115]
ALPN[116] Certificate Status
Request
[115]
OpenPGP[117] Supplemental Data[118] Session Ticket[119] Keying Material Exporter[120] Maximum Fragment Length[115] Truncated HMAC[115] TLS FALLBACK SCSV[121] Encrypt-then-MAC[122]
Botan Yes Yes No No No No Yes Yes Yes No Yes[123] No
cryptlib Yes Yes No No No Yes No No No[124] No No No
CyaSSL Yes Yes No No No No Yes No Yes Yes No No
GnuTLS Yes Yes Yes Yes Yes Yes Yes Yes Yes No No No
MatrixSSL Yes Yes Yes No No No Yes No Yes Yes No No
NSS Yes Yes Yes Yes No[125] No Yes Yes No No Yes[126] No[127]
OpenSSL Yes Yes Beta[37] Yes No No? Yes Yes? No No Yes[128] No
LibreSSL Yes Yes No Yes No No? Yes Yes? No No No No
PolarSSL Yes Yes Yes No No No Yes No Yes Yes No No
SChannel XP/2003 No No No No No Yes No No No No No No
SChannel Vista/2008 Yes Yes No No No Yes No No No No No No
SChannel 7/2008R2 Yes Yes No Yes No Yes No No No No No No
SChannel 8/2012 Yes Yes No Yes No Yes Client side only[129] No No No No No
SChannel 8.1/2012R2, 10 Technical Preview Yes Yes Yes Yes No Yes Yes[129] No No No No No
Secure Transport Yes Yes Unknown No No Yes No No No No No No
SharkSSL Yes No No No No No No No No No No No
JSSE Yes Yes[46] Unknown No No No No No No No No No
Implementation Secure Renegotiation Server Name Indication ALPN Certificate Status Request OpenPGP Supplemental Data Session Ticket Keying Material Exporter Maximum Fragment Length Truncated HMAC TLS FALLBACK SCSV Encrypt-then-MAC

Assisted cryptography[edit]

This section lists the known ability of an implementation to take advantage of CPU instruction sets that optimize encryption, or utilize system specific devices that allow access to underlying cryptographic hardware for acceleration or for data separation.

Implementation PKCS #11 device Intel AES-NI VIA PadLock STM32F2 Cavium NITROX Freescale CAU/mmCAU ARMv8-A Microchip PIC32MZ
Botan No Yes No No No No No No
cryptlib Yes No Yes No No No No No
CyaSSL No Yes No Yes Yes Yes No Yes
GnuTLS Yes Yes Yes No No No No No
MatrixSSL Yes Yes No No No No No No
NSS Yes[130] Yes[131] No[132] No No No No No
OpenSSL No Yes Yes No Yes No No No
LibreSSL No Yes Yes No Yes No No No
PolarSSL Yes Yes[133] Yes No No No No No
SChannel No Yes No No No No No No
Secure Transport No No No No No No Yes No
SharkSSL No No No Yes No Yes No No
JSSE Yes Yes[134] No No No No No No
Implementation PKCS #11 device Intel AES-NI VIA PadLock STM32F2 Cavium NITROX Freescale CAU/mmCAU ARMv8-A Microchip PIC32MZ

System-specific backends[edit]

This section lists the ability of an implementation to take advantage of the available operating system specific backends, or even the backends provided by another implementation.

Implementation /dev/crypto Windows CSP CommonCrypto OpenSSL engine
Botan No No No No
cryptlib No No No No
CyaSSL No Partial No No
GnuTLS Yes No No No
MatrixSSL No No Yes Yes
NSS No No No No
OpenSSL Yes No No Yes
LibreSSL Yes No No Yes
PolarSSL No No No No
SChannel No Yes No No
Secure Transport No No Yes No
SharkSSL No No No No
JSSE No Yes No No
Implementation /dev/crypto Windows CSP CommonCrypto OpenSSL engine

Cryptographic module/token support[edit]

Implementation TPM support Hardware token support Objects identified via
Botan No No
cryptlib No PKCS11 User-defined label
CyaSSL No No
GnuTLS Yes PKCS11 PKCS #11 URLs[135]
MatrixSSL No PKCS11
NSS No PKCS11
OpenSSL Yes PKCS11 (via 3rd party module) Custom method
LibreSSL Yes PKCS11 (via 3rd party module) Custom method
PolarSSL No PKCS11 (via libpkcs11-helper) or standard hooks Custom method
SChannel No Microsoft CryptoAPI UUID, User-defined label
Secure Transport
SharkSSL No No
JSSE No PKCS11 Java Cryptography Architecture/
Java Cryptography Extension
Implementation TPM support Hardware token support Objects identified via

Code dependencies[edit]

Implementation Dependencies Optional
dependencies
Botan C++11 sqlite, zlib (compression), bzip2 (compression), liblzma (compression)
CyaSSL None libc, zlib (compression)
GnuTLS libc
nettle
gmp
zlib (compression)
p11-kit (PKCS #11)
trousers (TPM)
MatrixSSL none zlib (compression)
MatrixSSL-open libc or newlib
NSS libc
libnspr4
libsoftokn3
libplc4
libplds4
zlib (compression)
OpenSSL libc zlib (compression)
PolarSSL libc libpkcs11-helper (PKCS #11)
zlib (compression)
SharkSSL None
JSSE Java
Implementation Dependencies Optional
dependencies

Development environment[edit]

Implementation Namespace Build tools API manual Crypto back-end OpenSSL compatibility Layer[clarify]
Botan Botan::TLS Makefile Sphinx Included (monolithic) No
cryptlib crypt* makefile, MSVC project workspaces Programmers reference manual (PDF), architecture design manual (PDF) Included (monolithic) No
CyaSSL CyaSSL_*

SSL_*

Autoconf, automake, libtool, MSVC project workspaces, XCode projects, CodeWarrior projects, MPLAB X projects, Keil, IAR, Clang, GCC Manual and API Reference (HTML, PDF) Included (monolithic) Yes (about 10% of API)
GnuTLS gnutls_* Autoconf, automake, libtool Manual and API reference (HTML, PDF) External, libnettle Yes (limited)
MatrixSSL matrixSsl_*

ps*

Makefile, MSVC project workspaces, Xcode projects for Mac OS X and iOS API Reference (PDF), Integration Guide Included (pluggable) Yes (Subset: SSL_read, SSL_write, etc.)
NSS CERT_*

SEC_*
SECKEY_*
NSS_*
PK11_*
SSL_*
...

Makefile Manual (HTML) Included, PKCS#11 based[136] Yes (separate package called nss_compat_ossl[137])
OpenSSL SSL_*

SHA1_*
MD5_*
EVP_*
...

Makefile Man pages Included (monolithic) N/A
PolarSSL ssl_*

sha1_*
md5_*
x509parse_*
...

Makefile, CMake, MSVC project workspaces API Reference + High Level and Module Level Documentation (HTML) Included (monolithic) No
SharkSSL SharkSsl* Makefile (online) HTML Manual and API Reference Included (monolithic) No
JSSE javax.net.ssl Makefile API Reference (HTML) +

Java SE 8

Java Cryptography Architecture/
Java Cryptography Extension
No
Implementation Namespace Build tools API manual Crypto back-end OpenSSL compatibility layer

Portability concerns[edit]

Implementation Platform requirements Network requirements Thread safety Random seed Able to cross-compile No OS (bare metal) Supported operating systems
Botan C++11 None Thread-safe Platform-dependent Yes Most Windows and POSIX systems
cryptlib C89 POSIX send() and recv(). API to supply your own replacement Thread-safe Platform-dependent, including hardware sources Yes Yes AMX, BeOS, ChorusOS, DOS, eCOS, FreeRTOS/OpenRTOS, uItron, MVS, OS/2, Palm OS, QNX Neutrino, RTEMS, Tandem NonStop, ThreadX, uC/OS II, Unix (AIX, FreeBSD, HPUX, Linux, OS X, Solaris, etc.), VDK, VM/CMS, VxWorks, Win16, Win32, Win64, WinCE/PocketPC/etc, XMK
CyaSSL C89 POSIX send() and recv(). API to supply your own replacement. Thread-safe, needs mutex hooks if PThreads or WinThreads not available, can be turned off Random seed set through CTaoCrypt Yes Yes Win32/64, Linux, Mac OS X, Solaris, ThreadX, VxWorks, FreeBSD, NetBSD, OpenBSD, embedded Linux, Haiku, OpenWRT, iPhone (iOS), Android, Nintendo Wii and Gamecube through DevKitPro, QNX, MontaVista, OpenCL, NonStop, TRON/ITRON/µITRON, Micrium's µC OS, FreeRTOS, SafeRTOS, Freescale MQX, Nucleus, TinyOS, HP/UX, Keil RTX, TI-RTOS
GnuTLS C89 POSIX send() and recv(). API to supply your own replacement. Thread-safe, needs custom mutex hooks if neither POSIX nor Windows threads are available. Platform dependent Yes No Generally any POSIX platforms or Windows, commonly tested platforms include GNU/Linux, Win32/64, Mac OS X, Solaris, OpenWRT, FreeBSD, NetBSD, OpenBSD.
MatrixSSL C89 None Thread-safe Platform dependent Yes Yes All
NSS C89, NSPR[138] NSPR[138] PR_Send() and PR_Recv(). API to supply your own replacement. Thread-safe Platform dependent[139] Yes (but cumbersome) No AIX, Android, FreeBSD, NetBSD, OpenBSD, BeOS, HP-UX, IRIX, Linux, Mac OS X, OS/2, Solaris, OpenVMS, Amiga DE, Windows, WinCE, Sony PlayStation
OpenSSL C89?  ? Needs mutex callbacks Set through native API Yes No Unix, DOS (with djgpp), Windows, OpenVMS, MacOS, NetWare
PolarSSL C89 POSIX read() and write(). API to supply your own replacement. Threading layer available (POSIX or own hooks) Random seed set through entropy pool Yes Yes Known to work on: Win32/64, Linux, Mac OS X, Solaris, FreeBSD, NetBSD, OpenBSD, OpenWRT, iPhone (iOS), Xbox, Android, SeggerOS
SharkSSL C89 None: Transport agnostic API Thread-safe: multiple ports Random seed set through entropy pool and/or HW Yes Yes INTEGRITY, MQX, SMX, ThreadX, VxWorks, SeggerOS, OSE, Android, Win 32/64, Linux 32/64, uCLinux, Mac OS X, OpenBSD, DD-WRT, OpenWrt
JSSE Java Java SE network components Thread-safe Depends on java.security.SecureRandom Yes Java based, platform-independent
Implementation Platform requirements Network requirements Thread safety Random seed Able to cross-compile No OS (bare metal) Supported operating systems

See also[edit]

  • SCTP — with DTLS support
  • DCCP — with DTLS support
  • SRTP — with DTLS support (DTLS-SRTP) and Secure Real-Time Transport Control Protocol (SRTCP)

References[edit]

  1. ^ "Version 1.11.10, 2014-12-10 — Botan". 2014-12-10. Retrieved 2014-12-14. 
  2. ^ "cryptlib 3.4.2 released". 2012-12-17. Retrieved 2014-06-16. 
  3. ^ "CyaSSL ChangeLog". 2014-12-05. Retrieved 2014-12-09. 
  4. ^ "GnuTLS". 2014-11-10. Retrieved 2014-11-10. 
  5. ^ "GnuTLS". 2014-11-10. Retrieved 2014-11-10. 
  6. ^ The features listed are for the closed source version
  7. ^ "MatrixSSL - News". 2014-12-04. Retrieved 2014-12-09. 
  8. ^ "NSS 3.17.3 release notes". Mozilla. 2014-12-01. Retrieved 2014-12-02. 
  9. ^ "NSS 3.16.6 release notes". Mozilla. 2014-10-13. Retrieved 2014-10-13. 
  10. ^ "NSS 3.16.2.3 release notes". Mozilla. 2014-10-27. Retrieved 2014-10-27. 
  11. ^ a b c "OpenSSL: News, Project Newsflash". Retrieved 15 October 2014. 
  12. ^ "LibreSSL 2.1.2 released". 2014-12-09. Retrieved 2014-12-09. 
  13. ^ a b "Download overview - PolarSSL". 2014-10-24. Retrieved 2014-12-09. 
  14. ^ "Nsssl - AOLserver Wiki". Retrieved 2014-07-04. 
  15. ^ "SharkSSL product description". Retrieved 2014-04-21. 
  16. ^ "Latest Java Releases - bouncycastle.org". 2014-07-27. Retrieved 2014-07-29. 
  17. ^ "The Legion of the Bouncy Castle C# Cryptography APIs". 2011-04-07. Retrieved 2014-06-16. 
  18. ^ RFC6176: Prohibiting Secure Sockets Layer (SSL) Version 2.0
  19. ^ "CBC-Padding: Security Flaws in SSL, IPsec, WTLS,...", Serge Vaudenay, 2001
  20. ^ Rizzo/Duong BEAST Countermeasures
  21. ^ Möller, Bodo; Duong, Thai; Kotowicz, Krzysztof (September 2014). "This POODLE Bites: Exploiting The SSL 3.0 Fallback". Retrieved 15 October 2014. 
  22. ^ TLSv1.2's Major Differences from TLSv1.1
  23. ^ a b RFC 6347
  24. ^ "Bard attack". CiteSeerX: 10.1.1.61.5887. 
  25. ^ SSLv2 is insecure
  26. ^ RFC 6101
  27. ^ RFC 2246
  28. ^ RFC 4346
  29. ^ a b c d e f g h RFC 5246
  30. ^ RFC 4347
  31. ^ a b "Version 1.11.6, 2013-12-29 — Botan". 2013-12-29. Retrieved 2014-12-14. 
  32. ^ "MatrixSSL - News". Retrieved 2014-11-09. 
  33. ^ a b "NSS 3.14 release notes". Mozilla Developer Network. Mozilla. Retrieved 2012-10-27. 
  34. ^ "NSS 3.15.1 release notes". Mozilla Developer Network. Mozilla. Retrieved 2013-08-10. 
  35. ^ "NSS 3.16.2 release notes". Mozilla Developer Network. Mozilla. 2014-06-30. Retrieved 2014-06-30. 
  36. ^ a b c d e f www.openssl.org/news/changelog.html
  37. ^ a b c d e f "OpenSSL: OpenSSL 1.0.2 Notes". Retrieved 2014-11-11. 
  38. ^ "LibreSSL 2.1.1 released". 2014-10-16. Retrieved 2014-10-17. 
  39. ^ TLS cipher suites in Microsoft Windows XP and 2003
  40. ^ SChannel Cipher Suites in Microsoft Windows Vista
  41. ^ a b c TLS Cipher Suites in SChannel for Windows 7, 2008R2, 8, 2012
  42. ^ a b "An update is available that adds support for DTLS in Windows 7 SP1 and Windows Server 2008 R2 SP1". Microsoft. Retrieved 13 November 2012. 
  43. ^ "Technical Note TN2287: iOS 5 and TLS 1.2 Interoperability Issues". iOS Developer Library. Apple Inc. Retrieved 2012-05-03. 
  44. ^ "Bug 663320 - (NSA-Suite-B-TLS) Implement RFC6460 (NSA Suite B profile for TLS)". Mozilla. Retrieved 2014-05-19. 
  45. ^ http://technet.microsoft.com/en-us/library/dd566200(v=ws.10).aspx
  46. ^ a b http://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html
  47. ^ http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm
  48. ^ "Is botan FIPS 140 certified?" Frequently Asked Questions — Botan
  49. ^ "What about FIPS 140 certification?" cryptlib FAQ
  50. ^ "As such we are not actively pursuing this kind of certification." GnuTLS 3.3.10 B.5 Certification
  51. ^ Matrix SSL Toolkit
  52. ^ FIPS Validation - MozillaWiki
  53. ^ OpenSSL and FIPS 140-2
  54. ^ Is PolarSSL FIPS certified?
  55. ^ Microsoft FIPS 140 Validated Cryptographic Modules
  56. ^ a b c d e RFC 4492
  57. ^ a b Mozilla.org. "Bug 102794 - Implement the server-side code of the DHE SSL ciphersuites.". Retrieved 19 November 2013. 
  58. ^ a b c d Mozilla.org. "Bug 518787 - Add GOST crypto algorithm support in NSS". Retrieved 2014-07-01. 
  59. ^ a b c d Mozilla.org. "Bug 608725 - Add Russian GOST cryptoalgorithms to NSS and Thunderbird". Retrieved 2014-07-01. 
  60. ^ a b c d openssl/engines/ccgost/README.gost
  61. ^ a b c d e f g h i j k l m n o Extensions to support GOST in SChannel might be available.[citation needed]
  62. ^ a b c "Microsoft Security Bulletin MS14-066 - Critical (Section Update FAQ)". Microsoft. November 11, 2014. Retrieved 11 November 2014. 
  63. ^ a b c d Thomlinson, Matt (November 11, 2014). "Hundreds of Millions of Microsoft Customers Now Benefit from Best-in-Class Encryption". Microsoft Security. Retrieved 11 November 2014. 
  64. ^ a b c Update adds new TLS cipher suites and changes cipher suite priorities in Windows 8.1 and Windows Server 2012 R2
  65. ^ a b c d Extensions to support JSSE in SChannel might be available.[citation needed]
  66. ^ a b c RFC 5054
  67. ^ a b c RFC 4279
  68. ^ RFC 5489
  69. ^ "RFC 5487 in CyaSSL TLS Library". 2014-06-25. Retrieved 2014-07-14. 
  70. ^ a b c "Bug 405155 - add support for TLS-SRP, rfc5054". Mozilla. Retrieved 2014-01-25. 
  71. ^ a b c d "Bug 306435 - Mozilla browsers should support the new IETF TLS-PSK protocol to help reduce phishing". Mozilla. Retrieved 2014-01-25. 
  72. ^ "Bug 236245 - Update ECC/TLS to conform to RFC 4492". Mozilla. Retrieved 2014-06-09. 
  73. ^ a b c "LibreSSL 2.0.4 released". Retrieved 2014-08-04. 
  74. ^ RFC 3280
  75. ^ RFC 2560
  76. ^ "Bug 672600 - Use DNSSEC/DANE chain stapled into TLS handshake in certificate chain validation". Mozilla. Retrieved 2014-06-18. 
  77. ^ a b "How Certificate Revocation Works". Microsoft TechNet. Microsoft. March 16, 2012. Retrieved July 10, 2013. 
  78. ^ RFC 5288
  79. ^ RFC 6655
  80. ^ RFC 6367
  81. ^ RFC 5932, RFC 6367
  82. ^ a b RFC 6209
  83. ^ RFC 4162
  84. ^ draft-agl-tls-chacha20poly1305-04 - ChaCha20 and Poly1305 based Cipher Suites for TLS, draft-mavrogiannopoulos-chacha-tls-03 - The ChaCha Stream Cipher for Transport Layer Security
  85. ^ draft-mavrogiannopoulos-chacha-tls-03 - The ChaCha Stream Cipher for Transport Layer Security
  86. ^ "Version 1.11.8, 2014-02-13 — Botan". 2014-02-13. Retrieved 2014-12-14. 
  87. ^ "NSS 3.15.2 release notes". Mozilla Developer Network. Mozilla. Retrieved 2013-09-26. 
  88. ^ "Bug 940119 - libssl does not support any TLS_ECDHE_*_CAMELLIA_*_GCM cipher suites". Mozilla. Retrieved 2013-11-19. 
  89. ^ "NSS 3.12 is released". Retrieved 2013-11-19. 
  90. ^ "NSS 3.12.3 Release Notes". Mozilla Developer Network. Mozilla. Retrieved 2014-07-01. 
  91. ^ "NSS 3.15.3 release notes". Mozilla Developer Network. Mozilla. Retrieved 2014-07-13. 
  92. ^ "MFSA 2013-103: Miscellaneous Network Security Services (NSS) vulnerabilities". Mozilla. Mozilla. Retrieved 2014-07-13. 
  93. ^ a b "Issue 310768: Support ChaCha20+Poly1305 TLS cipher suites". Google. Retrieved 2013-12-01. 
  94. ^ "Chrome 32 promotes Chacha20/Poly1305 suite, SSL Client Test fails to process SSL/TLS handshake". Qualys. Retrieved 2013-12-01. 
  95. ^ "Bug 917571 - Support ChaCha20+Poly1305 cipher suites". Mozilla. Retrieved 2013-12-01. 
  96. ^ As of November 2014, only available on private version of NSS integrated into Chromium and derived browsers (Google Chrome and Opera).[94][95] Patch for NSS upstream has been submitted and under review.[96]
  97. ^ As of November 2014, only available on private version of OpenSSL integrated into Chromium and derived browsers (Google Chrome and Opera).[94]
  98. ^ PolarSSL 1.3.8 release notes
  99. ^ PolarSSL RC4 deprecation plan
  100. ^ Hofix 984963: TLS AES cipher suites for Microsoft Windows 2003
  101. ^ Microsoft security advisory: Update for disabling RC4
  102. ^ "Release Notes: Important Issues in Windows 8.1 Preview". Microsoft. 2013-06-24. Retrieved 2014-11-04. 
  103. ^ "W8.1(IE11) vs RC4 | Qualys Community". Retrieved 2014-11-04. 
  104. ^ a b c https://dev.ssllabs.com/ssltest/viewClient.html?name=IE&version=11&platform=Win%2010%20Preview
  105. ^ RFC 5469
  106. ^ http://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html
  107. ^ Negotiation of arbitrary curves has been shown to be insecure for certain curve sizes Mavrogiannopoulos, Nikos and Vercautern, Frederik and Velichkov, Vesselin and Preneel, Bart (2012). A cross-protocol attack on the TLS protocol. Proceedings of the 2012 ACM conference on Computer and communications security. pp. 62–72. ISBN 978-1-4503-1651-4. 
  108. ^ a b c "Bug 943639 - Support for Brainpool ECC Curve (rfc5639)". Mozilla. Retrieved 2014-01-25. 
  109. ^ a b c d e f "OpenSSL RT #2239: [PATCH] RFC 5639 support - resolved 2012-04-22". OpenSSL.org. Retrieved 2014-02-03. 
  110. ^ a b c d e f "openssl-1.0.2-stable prerelease tarballs available on OpenSSL's FTP server: files openssl-1.0.2-stable-SNAP-*.tar.gz". OpenSSL.org. Retrieved 2014-02-03. 
  111. ^ "SHA2 and Windows". Retrieved 2014-09-08. 
  112. ^ RFC 3749
  113. ^ RFC 5746
  114. ^ a b c d RFC 6066
  115. ^ RFC 7301
  116. ^ RFC 6091
  117. ^ RFC 4680
  118. ^ RFC 5077
  119. ^ RFC 5705
  120. ^ draft-ietf-tls-downgrade-scsv-01 - TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks
  121. ^ RFC 7366
  122. ^ "Version 1.11.10, 2014-12-10 — Botan". 2014-12-10. Retrieved 2014-12-14. 
  123. ^ Present but disabled by default due to lack of use by any implementation.
  124. ^ "Bug 961416 - Support RFC6091 - Using OpenPGP Keys for Transport Layer Security Authentication (TLS1.2)". Mozilla. Retrieved 2014-06-18. 
  125. ^ "NSS 3.17.1 release notes". Retrieved 2014-10-17. 
  126. ^ "Bug 972145 - Implement the encrypt-then-MAC TLS extension". Mozilla. Retrieved 2014-11-06. 
  127. ^ http://www.openssl.org/news/secadv_20141015.txt
  128. ^ a b "What's New in TLS/SSL (Schannel SSP)". Retrieved 2014-06-18. 
  129. ^ Normally NSS's libssl performs all operations via the PKCS#11 interface, either to hardware or software tokens
  130. ^ "Bug 706024 - AES-NI enhancements to NSS on Sandy Bridge systems". Retrieved 2013-09-28. 
  131. ^ "Bug 479744 - RFE : VIA Padlock ACE support (hardware RNG, AES, SHA1 and SHA256)". Retrieved 2014-04-11. 
  132. ^ "We've incorporated support for AES-NI in our AES and GCM modules". 2013-12-31. Retrieved 2014-01-07. 
  133. ^ http://stackoverflow.com/questions/14259671/java-ssl-provider-with-aes-ni-support
  134. ^ PKCS #11 URLs
  135. ^ On the fly replaceable/augmentable.
  136. ^ http://fedoraproject.org/wiki/Nss_compat_ossl
  137. ^ a b Netscape Portable Runtime (NSPR)
  138. ^ For Unix/Linux it uses /dev/urandom if available, for Windows it uses CAPI. For other platforms it gets data from clock, and tries to open system files. NSS has a set of platform dependent functions it uses to determine randomness.