Comparison of TLS implementations
The Transport Layer Security (TLS) protocol provides the ability to secure communications across networks. This comparison of TLS implementations compares several of the most notable libraries. There are several TLS implementations which are free software and open source.
All comparison categories use the stable version of each implementation listed in the overview section. The comparison is limited to features that directly relate to the TLS protocol.
Overview
Implementation | Developed by | Open source | Software license | Copyright owner | Written in | Latest stable version, release date | Origin | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Botan | Jack Lloyd | Yes | Simplified BSD License | Jack Lloyd | C++ | 3.5.0 (July 8, 2024[1]) [±] | US (Vermont) | ||||||||||
BoringSSL | OpenSSL project | Yes | OpenSSL-SSLeay dual-license, ISC license | Eric Young, Tim Hudson, Sun, OpenSSL project, Google, and others | C, assembly | ?? | Australia/EU | ||||||||||
Bouncy Castle | The Legion of the Bouncy Castle Inc. | Yes | MIT License | Legion of the Bouncy Castle Inc. | Java, C# |
|
Australia | ||||||||||
cryptlib | Peter Gutmann | Yes | Sleepycat License and commercial license | Peter Gutmann | C | 3.4.5 (2019[7]) [±] | NZ | ||||||||||
GnuTLS | GnuTLS project | Yes | GNU LGPLv2.1+ | Free Software Foundation | C | 3.8.2 (November 15, 2023[8]) [±] | EU (Greece and Sweden) | ||||||||||
Java Secure Socket Extension (JSSE) | Oracle | Yes | GNU GPLv2 and commercial license | Oracle | Java | JDK 8, 2014-03-18 | US | ||||||||||
LibreSSL | OpenBSD Project | Yes | Apache License 1.0, 4-clause BSD License, ISC License, and some are public domain | Eric Young, Tim Hudson, Sun, OpenSSL project, OpenBSD Project, and others | C, assembly | Template:Latest stable software release/LibreSSL | Canada | ||||||||||
MatrixSSL[9] | PeerSec Networks | Yes | GNU GPLv2+ and commercial license | PeerSec Networks | C | 4.2.2 (September 11, 2019[10]) [±] | US | ||||||||||
mbed TLS (previously PolarSSL) | ARM | Yes | Apache License 2.0, GNU GPLv2+ and commercial license | ARM Holdings | C | 3.0.0 (July 7, 2021[11]) [±] ) |
EU (Netherlands) | ||||||||||
Network Security Services (NSS) | Mozilla, AOL, Red Hat, Sun, Oracle, Google and others | Yes | MPL 2.0 | NSS contributors | C, assembly |
|
US | ||||||||||
OpenSSL | OpenSSL project | Yes | OpenSSL-SSLeay dual-license | Eric Young, Tim Hudson, Sun, OpenSSL project, and others | C, assembly | 3.0.5 (5 July 2022[13]) [±] | Australia/EU | ||||||||||
S2n | Amazon | Yes | Apache License 2.0, GNU GPLv2+ and commercial license | Amazon, Inc. | C | ?? | US | ||||||||||
SChannel | Microsoft | No | Proprietary | Microsoft Inc. | Windows 10, 2015-07-29 | US | |||||||||||
Secure Transport | Apple Inc. | Yes | APSL 2.0 | Apple Inc. | 57337.20.44 (OS X 10.11.2), 2015-12-08 | US | |||||||||||
wolfSSL (previously CyaSSL) | wolfSSL[14] | Yes | GNU GPLv2+ and commercial license | wolfSSL Inc.[15] | C | 5.6.4 (October 30, 2023[16]) [±] | US | ||||||||||
Implementation | Developed by | Open source | Software license | Copyright owner | Written in | Latest stable version, release date | Origin |
Protocol support
Several versions of the TLS protocol exist. SSL 2.0 is a deprecated[17] protocol version with significant weaknesses. SSL 3.0 (1996) and TLS 1.0 (1999) are successors with two weaknesses in CBC-padding that were explained in 2001 by Serge Vaudenay.[18] TLS 1.1 (2006) fixed only one of the problems, by switching to random initialization vectors (IV) for CBC block ciphers, whereas the more problematic use of mac-pad-encrypt instead of the secure pad-mac-encrypt was addressed with RFC7366.[19] A workaround for SSL 3.0 and TLS 1.0, roughly equivalent to random IVs from TLS 1.1, was widely adopted by many implementations in late 2011,[20] so from a security perspective, all existing version of TLS 1.0, 1.1 and 1.2 provide equivalent strength in the base protocol and are suitable for 128-bit security according to NIST SP800-57 up to at least 2030. In 2014, the POODLE vulnerability of SSL 3.0 was discovered, which takes advantage the known vulnerabilities in CBC, and an insecure fallback negotiation used in browsers.[21]
TLS 1.2 (2008) is the latest published version of the base protocol, introducing a means to identify the hash used for digital signatures. While permitting the use of stronger hash functions for digital signatures in the future (rsa,sha256/sha384/sha512) over the SSL 3.0 conservative choice (rsa,sha1+md5), the TLS 1.2 protocol change inadvertently and substantially weakened the default digital signatures and provides (rsa,sha1) and even (rsa,md5).[22]
Datagram Transport Layer Security (DTLS or Datagram TLS) 1.0 is a modification of TLS 1.1 for a packet-oriented transport layer, where packet loss and packet reordering have to be tolerated. The revision DTLS 1.2 based on TLS 1.2 was published in January 2012[23]
Note that there are known vulnerabilities in SSL 2.0 and SSL 3.0. With the exception of the predictable IVs (for which an easy workaround exists) all currently known vulnerabilities affect all version of TLS 1.0/1.1/1.2 alike.[24]
Implementation | SSL 2.0 (insecure)[25] | SSL 3.0 (insecure)[26] | TLS 1.0[27] | TLS 1.1[28] | TLS 1.2[29] | TLS 1.3 (Draft)[30][31] |
DTLS 1.0[32] | DTLS 1.2[23] |
---|---|---|---|---|---|---|---|---|
Botan | No | No[33] | Yes | Yes | Yes | Yes | Yes | |
BoringSSL | Yes | Yes | Yes | Yes | Yes | Yes | ||
cryptlib | No | Disabled by default at compile time | Yes | Yes | Yes | No | No | |
GnuTLS | No[a] | Disabled by default[34] | Yes | Yes | Yes | Yes | Yes | |
JSSE | No[a] | Disabled by default[35] | Yes | Yes | Yes | No | No | |
LibreSSL | No[36] | No[37] | Yes | Yes | Yes | Yes | No | |
MatrixSSL | No | Disabled by default at compile time[38] | Yes | Yes | Yes | Yes | Yes | |
mbed TLS | No | Disabled by default[39] | Yes | Yes | Yes | Yes[39] | Yes[39] | |
NSS | No[b] | Disabled by default[40] | Yes | Yes[41] | Yes[42] | Yes | Yes[41] | Yes[43] |
OpenSSL | No[44] | Enabled by default | Yes | Yes[45] | Yes[45] | Yes | Yes[46] | |
RSA BSAFE[47] | No | Yes | Yes | Yes | Yes | No | No | |
S2n[48] | No | Yes | Yes | Yes | Yes | No | No | |
SChannel XP, 2003[49] | Disabled by default in MSIE 7 | Enabled by default | Enabled by default in MSIE 7 | No | No | No | No | |
SChannel Vista, 2008[50] | Disabled by default | Enabled by default | Yes | No | No | No | No | |
SChannel 7, 2008R2[51] | Disabled by default | Disabled by default in MSIE 11 | Yes | Enabled by default in MSIE 11 | Enabled by default in MSIE 11 | Yes[52] | No[52] | |
SChannel 8, 2012[51] | Disabled by default | Enabled by default | Yes | Disabled by default | Disabled by default | Yes | No | |
SChannel 8.1, 2012R2, 10[51] | Disabled by default | Disabled by default in MSIE 11 | Yes | Yes | Yes | Yes | No | |
Secure Transport OS X 10.2-10.7, iOS 1-4 | Yes | Yes | Yes | No | No | No | No | |
Secure Transport OS X 10.8-10.10, iOS 5-8 | No[c] | Yes | Yes | Yes[c] | Yes[c] | Yes[c] | No | |
Secure Transport OS X 10.11, iOS 9 | No | No[c] | Yes | Yes | Yes | Yes | Unknown | |
wolfSSL | No | Disabled by default[53] | Yes | Yes | Yes | Yes | Yes | Yes |
Implementation | SSL 2.0 (insecure) | SSL 3.0 (insecure) | TLS 1.0 | TLS 1.1 | TLS 1.2 | TLS 1.3 (Draft) |
DTLS 1.0 | DTLS 1.2 |
- ^ SSL 2.0 client hello is supported even though SSL 2.0 is not supported or is disabled because of the backward compatibilities.
- ^ Server-side implementation of the SSL/TLS protocol still supports processing of received v2-compatible client hello messages.[54]
- ^ Secure Transport: SSL 2.0 was discontinued in OS X 10.8. SSL 3.0 was discontinued in OS X 10.11 and iOS 9.TLS 1.1, 1.2 and DTLS are available on iOS 5.0 and later, and OS X 10.9 and later.[55][56]
NSA Suite B Cryptography
Required components for NSA Suite B Cryptography (RFC 6460) are:
- Advanced Encryption Standard (AES) with key sizes of 128 and 256 bits. For traffic flow, AES should be used with either the Counter Mode (CTR) for low bandwidth traffic or the Galois/Counter Mode (GCM) mode of operation for high bandwidth traffic (see Block cipher modes of operation) — symmetric encryption
- Elliptic Curve Digital Signature Algorithm (ECDSA) — digital signatures
- Elliptic Curve Diffie–Hellman (ECDH) — key agreement
- Secure Hash Algorithm 2 (SHA-256 and SHA-384) — message digest
Per CNSSP-15, the 256-bit elliptic curve (specified in FIPS 186-2), SHA-256, and AES with 128-bit keys are sufficient for protecting classified information up to the Secret level, while the 384-bit elliptic curve (specified in FIPS 186-2), SHA-384, and AES with 256-bit keys are necessary for the protection of Top Secret information.
Implementation | TLS 1.2 Suite B |
---|---|
Botan | Yes |
cryptlib | Yes |
GnuTLS | Yes |
JSSE | Yes[57] |
LibreSSL | Yes |
MatrixSSL | Yes |
mbed TLS | Yes |
NSS | No[58] |
OpenSSL | Yes[46] |
RSA BSAFE | Yes[47] |
S2N | |
SChannel | Yes[59] |
Secure Transport | No |
wolfSSL | Yes |
Implementation | TLS 1.2 Suite B |
Certifications
Note that certain certifications have received serious negative criticism from people who are actually involved in them.[60]
Implementation | FIPS 140-1, FIPS 140-2[61] | Common Criteria | Embedded FIPS Solution | |
---|---|---|---|---|
Level 1 | Level 2[disputed – discuss] | |||
Botan[62] | ||||
cryptlib[63] | ||||
GnuTLS[64] | Red Hat Enterprise Linux GnuTLS Cryptographic Module (#2780) | |||
JSSE | ||||
LibreSSL[36] | no support | |||
MatrixSSL[65] | SafeZone FIPS Cryptographic Module: 1.1 (#2389) | |||
mbed TLS[66] | ||||
NSS[67] | Network Security Services: 3.2.2 (#247) Network Security Services Cryptographic Module: 3.11.4 (#815), 3.12.4 (#1278), 3.12.9.1 (#1837) |
Netscape Security Module: 1 (#7[notes 1]), 1.01 (#47[notes 2]) Network Security Services: 3.2.2 (#248[notes 3]) Network Security Services Cryptographic Module: 3.11.4 (#814[notes 4]), 3.12.4 (#1279, #1280[notes 5]) |
||
OpenSSL[68] | OpenSSL FIPS Object Module: 1.0 (#624), 1.1.1 (#733), 1.1.2 (#918), 1.2, 1.2.1, 1.2.2, 1.2.3 or 1.2.4 (#1051) 2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7 or 2.0.8 (#1747) |
|||
RSA BSAFE[69] | Crypto-C ME 3.0.0.1, 4.0.1, 4.1 (#2294, #2300) Crypto-J 6.1 (#2057, #2058) |
|||
SChannel[70] | Cryptographic modules in Windows NT 4.0, 95, 95, 2000, XP, Server 2003, CE 5, CE 6, Mobile 6.x, Vista, Server 2008, 7, Server 2008 R2, 8, Server 2012, RT, Surface, Phone 8 See details on Microsoft FIPS 140 Validated Cryptographic Modules |
|||
Secure Transport | Apple FIPS Cryptographic Module: 1.0 (OS X 10.6, #1514), 1.1 (OS X 10.7, #1701) Apple OS X CoreCrypto Module; CoreCrypto Kernel Module: 3.0 (OS X 10.8, #1964, #1956), 4.0 (OS X 10.9, #2015, #2016) Apple iOS CoreCrypto Module; CoreCrypto Kernel Module: 3.0 (iOS 6, #1963, #1944), 4.0 (iOS 7 , #2020, #2021) |
|||
wolfSSL[71] | wolfCrypt FIPS Module: 3.6.0 (#2425) See details on NIST certificate for validated Operating Environments |
Yes | ||
Implementation | Level 1 | Level 2 | Common Criteria | Embedded FIPS Solution |
FIPS 140-1, FIPS 140-2 |
- ^ with Sun Sparc 5 w/ Sun Solaris v 2.4SE (ITSEC-rated)
- ^ with Sun Ultra-5 w/ Sun Trusted Solaris version 2.5.1 (ITSEC-rated)
- ^ with Solaris v8.0 with AdminSuite 3.0.1 as specified in UK IT SEC CC Report No. P148 EAL4 on a SUN SPARC Ultra-1
- ^ with these platforms; Red Hat Enterprise Linux Version 4 Update 1 AS on IBM xSeries 336 with Intel Xeon CPU, Trusted Solaris 8 4/01 on Sun Blade 2500 Workstation with UltraSPARC IIIi CPU
- ^ with these platforms; Red Hat Enterprise Linux v5 running on an IBM System x3550, Red Hat Enterprise Linux v5 running on an HP ProLiant DL145, Sun Solaris 10 5/08 running on a Sun SunBlade 2000 workstation, Sun Solaris 10 5/08 running on a Sun W2100z workstation
Key exchange algorithms (certificate-only)
This section lists the certificate verification functionality available in the various implementations.
Implementation | RSA[29] | RSA-EXPORT (insecure)[29] | DHE-RSA (forward secrecy)[29] | DHE-DSS (forward secrecy)[29] | ECDH-ECDSA[72] | ECDHE-ECDSA (forward secrecy)[72] | ECDH-RSA[72] | ECDHE-RSA (forward secrecy)[72] | GOST R 34.10-94, 34.10-2001[73] |
---|---|---|---|---|---|---|---|---|---|
Botan | Yes | No | Yes | Yes | No | Yes | No | Yes | No |
cryptlib | Yes | No | Yes | Yes | No | Yes | No | No | No |
GnuTLS | Yes | No | Yes | Disabled by default[34] | No | Yes | No | Yes | No |
JSSE | Yes | Disabled by default | Max 2048 bit | Max 2048 bit | Yes | Yes | Yes | Yes | No[74] |
LibreSSL | Yes | No[36] | Yes | Yes | Yes | Yes | Yes | Yes | Yes[75] |
MatrixSSL | Yes | No | Yes | No | Yes | Yes | Yes | Yes | No |
mbed TLS | Yes | No | Yes | No | Yes | Yes | Yes | Yes | No |
NSS | Yes | Disabled by default | Yes[76] | Yes | Yes | Yes | Yes | Yes | No[77][78] |
OpenSSL | Yes | No[44] | Yes | Disabled by default[44] | Yes | Yes | Yes | Yes | Yes[79] |
RSA BSAFE[47] | Yes | No | Yes | Yes | Yes | Yes | Yes | Yes | No |
SChannel XP/2003 | Yes | Yes | No | XP: Max 1024 bits 2003: 1024 bits only |
No | No | No | No | No[80] |
SChannel Vista/2008 | Yes | Disabled by default | No | 1024 bits only | No | Yes | No | except AES_GCM | No[80] |
SChannel 8/2012 | Yes | Disabled by default | AES_GCM only[81][82][83] | 1024 bits only | No | Yes | No | except AES_GCM | No[80] |
SChannel 7/2008R2, 8.1/2012R2 | Yes | Disabled by default | Yes | 1024 bits only | No | Yes | No | except AES_GCM | No[80] |
SChannel 10 | Yes | Disabled by default | Yes | 1024 bits only | No | Yes | No | Yes | No[80] |
Secure Transport OS X 10.6 | Yes | Yes | except AES_GCM | Yes | Yes | except AES_GCM | Yes | except AES_GCM | No |
Secure Transport OS X 10.8-10.10 | Yes | No | except AES_GCM | No | Yes | except AES_GCM | Yes | except AES_GCM | No |
Secure Transport OS X 10.11 | Yes | No | Yes | No | No | Yes | No | Yes | No |
wolfSSL | Yes | No | Yes | No | Yes | Yes | Yes | Yes | No |
Implementation | RSA | RSA EXPORT (insecure) | DHE-RSA (forward secrecy) | DHE-DSS (forward secrecy) | ECDH-ECDSA | ECDHE-ECDSA (forward secrecy) | ECDH-RSA | ECDHE-RSA (forward secrecy) | GOST R 34.10-94, 34.10-2001 |
Key exchange algorithms (alternative key-exchanges)
Implementation | SRP[84] | SRP-DSS[84] | SRP-RSA[84] | PSK-RSA[85] | PSK[85] | DHE-PSK (forward secrecy)[85] | ECDHE-PSK (forward secrecy)[86] | KRB5[87] | DH-ANON[29] (insecure) | ECDH-ANON[72] (insecure) |
---|---|---|---|---|---|---|---|---|---|---|
Botan | Yes | Yes | Yes | No | Yes | Yes | Yes | No | Disabled by default | Disabled by default |
cryptlib | No | No | No | No | Yes | Yes | No | Unknown | No | No |
GnuTLS | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | Disabled by default | Disabled by default |
JSSE | No | No | No | No | No | No | No | Unknown | Disabled by default in Java 8 | Disabled by default in Java 8 |
LibreSSL | No[88] | No[88] | No[88] | No | No | No | No | No | Yes | Yes |
MatrixSSL | No | No | No | Yes | Yes | Yes | No | No | Disabled by default | No |
mbed TLS | No | No | No | Yes | Yes | Yes | Yes | No | No | No |
NSS | No[89] | No[89] | No[89] | No[90] | No[90] | No[90] | No[90] | No | Client side only, disabled by default[91] | Disabled by default[92] |
OpenSSL | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes[93] | Disabled by default[94] | Disabled by default[94] |
RSA BSAFE[47] | No | No | No | No | No | No | No | Unknown | Yes | Yes |
SChannel | No | No | No | No | No | No | No | Yes | No | No |
Secure Transport | No | No | No | No | No | No | No | Unknown | Yes | Yes |
wolfSSL | No | No | No | No | Yes | No | Yes[95] | No | No | No |
Implementation | SRP | SRP-DSS | SRP-RSA | PSK-RSA | PSK | DHE-PSK (forward secrecy) | ECDHE-PSK (forward secrecy) | KRB5 | DH-ANON (insecure) | ECDH-ANON (insecure) |
Certificate verification methods
Implementation | Application-defined | PKIX path validation[96] | CRL[97] | OCSP[98] | DANE (DNSSEC)[99] | Trust on First Use (TOFU) |
---|---|---|---|---|---|---|
Botan | Yes | Yes | Yes | Yes | No | No |
cryptlib | Yes | Yes | Unknown | Unknown | No | No |
GnuTLS | Yes | Yes | Yes | Yes | Yes | Yes |
JSSE | Yes | Yes | Yes | Yes | No | No |
LibreSSL | Yes | Yes | Yes | Yes | No | No |
MatrixSSL | Yes | Yes | Yes | Yes[100] | No | No |
mbed TLS | Yes | Yes | Yes | Yes[101] | No | No |
NSS | Yes | Yes | Yes | Yes | No[102] | No |
OpenSSL | Yes | Yes | Yes | Yes | Yes | No |
RSA BSAFE[47] | Yes | Yes | Yes | Yes | No | No |
SChannel | Unknown | Yes | Yes[103] | Yes[103] | No | No |
Secure Transport | Yes | Yes | Yes | Yes | No | No |
wolfSSL | Yes | Yes | Yes | Yes | No | No |
Implementation | Application-defined | PKIX | CRL | OCSP | DANE | TOFU |
Encryption algorithms
Implementation | Block cipher with mode of operation | Stream cipher | None | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
AES GCM [104] |
AES CCM [105] |
AES CBC | Camellia GCM [106] |
Camellia CBC [107] |
ARIA GCM [108] |
ARIA CBC [108] |
SEED CBC [109] |
3DES EDE CBC (insecure)[110] |
GOST 28147-89 CNT (proposed) [73][n 1] |
ChaCha20-Poly1305 [111] |
Null (insecure) [n 2] | |
Botan | Yes | Yes | Yes | Yes | Yes | No | No | Disabled by Default | Disabled by Default | No | Yes[112] | Not implemented |
BoringSSL | Yes | No | Yes | No | No | No | No | No | yes | No | Yes | |
cryptlib | Yes | No | Yes | No | No | No | No | No | yes | No | No | Disabled by default |
GnuTLS | Yes | Yes[34] | Yes | Yes | Yes | No | No | No | yes | No | Yes[113] | Disabled by default |
JSSE | Yes | No | Yes | No | No | No | No | No | yes | No[74] | No | Disabled by default |
LibreSSL | Yes[36] | No | Yes | No | Yes[75] | No | No | No[36] | yes | Yes[75] | Yes[36] | Disabled by default |
MatrixSSL | Yes | No | Yes | No | No | No | No | Yes | Disabled by default | No | Yes[114] | Disabled by default |
mbed TLS | Yes | Yes [115] | Yes | Yes | Yes | No | No | No | yes | No | No | Disabled by default at compile time |
NSS | Yes[116] | No | Yes | No[117][n 3] | Yes[118] | No | No | Yes[119] | yes | No[77][78] | Yes[120] | Disabled by default |
OpenSSL | Yes[121] | Disabled by default[44] | Yes | No | Disabled by default[44] | No | No | Disabled by default[44] | Disabled by default[44] | Yes[79] | Yes[44] | Disabled by default |
RSA BSAFE MES[47] | Yes | Yes | Yes | No | No | No | No | No | yes | No | No | Disabled by default |
RSA BSAFE SSL-J[47] | Yes | No | Yes | No | No | No | No | No | yes | No | No | Disabled by default |
SChannel XP/2003 | No | No | 2003 only[122] | No | No | No | No | No | yes | No[80] | No | Disabled by default |
SChannel Vista/2008, 2008R2, 2012 | No | No | Yes | No | No | No | No | No | yes | No[80] | No | Disabled by default |
SChannel 7, 8, 8.1/2012R2 | Yes except ECDHE_RSA [81][82] |
No | Yes | No | No | No | No | No | yes | No[80] | No | Disabled by default |
Schannel 10[123] | Yes | No | Yes | No | No | No | No | No | yes | No[80] | No | Disabled by default |
Secure Transport OS X 10.6 - 10.10 | No | No | Yes | No | No | No | No | No | yes | No | No | Disabled by default |
Secure Transport OS X 10.11 | Yes | No | Yes | No | No | No | No | No | yes | No | No | Disabled by default |
wolfSSL | Yes | Yes | Yes | No | Yes | No | No | No | yes | No | Yes | Disabled by default |
Implementation | AES GCM | AES CCM | AES CBC | Camellia GCM | Camellia CBC | ARIA GCM | ARIA CBC | SEED CBC | 3DES EDE CBC (insecure)[110] |
GOST 28147-89 CNT (proposed) |
ChaCha20-Poly1305 | Null (insecure) |
Block cipher with mode of operation | Stream cipher | None |
- Notes
Obsolete algorithms
Implementation | Block cipher with mode of operation | Stream cipher | ||||
---|---|---|---|---|---|---|
IDEA CBC [n 1](insecure)[125] |
DES CBC (insecure) [n 1] |
DES-40 CBC (EXPORT, insecure) [n 2] |
RC2-40 CBC (EXPORT, insecure) [n 2] |
RC4-128 (insecure) [n 3] |
RC4-40 (EXPORT, insecure) [n 4][n 2] | |
Botan | No | No | No | No | No[126] | No |
BoringSSL | No | No | No | No | Disabled by default at compile time | No |
cryptlib | No | Disabled by default at compile time | No | No | Disabled by default at compile time | No |
GnuTLS | No | No | No | No | Disabled by default[34] | No |
JSSE | No | Disabled by default | Disabled by default | No | Yes | Disabled by default [127] |
LibreSSL | Yes | Yes | No[36] | No[36] | Yes | No[36] |
MatrixSSL | Yes | No | No | No | Disabled by default | No |
mbed TLS | No | Disabled by default at compile time | No | No | Disabled by default at complile time[39] | No |
NSS | Yes | Disabled by default | Disabled by default | Disabled by default | Lowest priority[128][129] | Disabled by default |
OpenSSL | Disabled by default[44] | Disabled by default | No[44] | No[44] | Disabled by default | No[44] |
RSA BSAFE MES[47] | No | No | No | No | Yes | No |
RSA BSAFE SSL-J[47] | No | Yes | Yes | No | Yes | Yes |
SChannel XP/2003 | No | Yes | Yes | Yes | Yes | Yes |
SChannel Vista/2008 | No | Disabled by default | Disabled by default | Disabled by default | Yes | Disabled by default |
SChannel 7/2008R2 | No | Disabled by default | Disabled by default | Disabled by default | Lowest priority will be disabled soon[130] |
Disabled by default |
SChannel 8/2012 | No | Disabled by default | Disabled by default | Disabled by default | Only as fallback | Disabled by default |
SChannel 8.1/2012R2 | No | Disabled by default | Disabled by default | Disabled by default | Disabled by default[130] | Disabled by default |
Schannel 10[123] | No | Disabled by default | Disabled by default | Disabled by default | Disabled by default[130] | Disabled by default |
Secure Transport OS X 10.6 | Yes | Yes | Yes | Yes | Yes | Yes |
Secure Transport OS X 10.7 | Yes | Unknown | Unknown | Unknown | Yes | Unknown |
Secure Transport OS X 10.8-10.9 | Yes | Disabled by default | Disabled by default | Disabled by default | Yes | Disabled by default |
Secure Transport OS X 10.10-10.11 | Yes | Disabled by default | Disabled by default | Disabled by default | Lowest priority | Disabled by default |
Secure Transport macOS 10.12 | Yes | Disabled by default | Disabled by default | Disabled by default | Disabled by default | Disabled by default |
wolfSSL | Disabled by default[131] | No | No | No | Disabled by default | No |
Implementation | IDEA CBC (insecure)[125] |
DES CBC (insecure) |
DES-40 CBC (EXPORT, insecure) |
RC2-40 CBC (EXPORT, insecure) |
RC4-128 (insecure) |
RC4-40 (EXPORT, insecure) |
Block cipher with mode of operation | Stream cipher |
- Notes
- ^ a b IDEA and DES have been removed from TLS 1.2.[124]
- ^ a b c 40 bits strength of cipher suites were designed to operate at reduced key lengths in order to comply with US regulations about the export of cryptographic software containing certain strong encryption algorithms (see Export of cryptography from the United States). These weak suites are forbidden in TLS 1.1 and later.
- ^ The RC4 attacks weaken or break RC4 used in SSL/TLS. Use of RC4 is prohibited by RFC 7465.
- ^ The RC4 attacks weaken or break RC4 used in SSL/TLS.
Supported elliptic curves
This section lists the supported elliptic curves by each implementation.
Implementation | sect163k1 NIST K-163 (1)[72] |
sect163r1 (2)[72] |
sect163r2 NIST B-163 (3)[72] |
sect193r1 (4)[72] |
sect193r2 (5)[72] |
sect233k1 NIST K-233 (6)[72] |
sect233r1 NIST B-233 (7)[72] |
sect239k1 (8)[72] |
sect283k1 NIST K-283 (9)[72] |
sect283r1 NIST B-283 (10)[72] |
sect409k1 NIST K-409 (11)[72] |
sect409r1 NIST B-409 (12)[72] |
sect571k1 NIST K-571 (13)[72] |
sect571r1 NIST B-571 (14)[72] |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Botan | No | No | No | No | No | No | No | No | No | No | No | No | No | No |
BoringSSL | No | No | No | No | No | No | No | No | No | No | No | No | No | No |
GnuTLS | No | No | No | No | No | No | No | No | No | No | No | No | No | No |
JSSE | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
LibreSSL | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
MatrixSSL | No | No | No | No | No | No | No | No | No | No | No | No | No | No |
mbed TLS | No | No | No | No | No | No | No | No | No | No | No | No | No | No |
NSS | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
OpenSSL | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
RSA BSAFE[47] | Yes | No | Yes | No | No | Yes | Yes | No | Yes | Yes | Yes | Yes | Yes | Yes |
SChannel Vista/2008, 7/2008R2, 8/2012, 8.1/2012R2, 10 | No | No | No | No | No | No | No | No | No | No | No | No | No | No |
Secure Transport | No | No | No | No | No | No | No | No | No | No | No | No | No | No |
wolfSSL | No | No | No | No | No | No | No | No | No | No | No | No | No | No |
Implementation | sect163k1 NIST K-163 (1) |
sect163r1 (2) |
sect163r2 NIST B-163 (3) |
sect193r1 (4) |
sect193r2 (5) |
sect233k1 NIST K-233 (6) |
sect233r1 NIST B-233 (7) |
sect239k1 (8) |
sect283k1 NIST K-283 (9) |
sect283r1 NIST B-283 (10) |
sect409k1 NIST K-409 (11) |
sect409r1 NIST B-409 (12) |
sect571k1 NIST K-571 (13) |
sect571r1 NIST B-571 (14) |
Implementation | secp160k1 (15)[72] |
secp160r1 (16)[72] |
secp160r2 (17)[72] |
secp192k1 (18)[72] |
secp192r1 prime192v1 NIST P-192 (19)[72] |
secp224k1 (20)[72] |
secp224r1 NIST P-244 (21)[72] |
secp256k1 (22)[72] |
secp256r1 prime256v1 NIST P-256 (23)[72] |
secp384r1 NIST P-384 (24)[72] |
secp521r1 NIST P-521 (25)[72] |
arbitrary prime curves (0xFF01)[72][132] |
arbitrary char2 curves (0xFF02)[72][132] |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Botan | No | No | No | No | No | No | No | No | Yes | Yes | Yes | No | No |
BoringSSL | No | No | No | No | No | No | Yes | No | Yes | Yes | Yes (disabled by default) | No | No |
GnuTLS | No | No | No | No | Yes | No | Yes | No | Yes | Yes | Yes | No | No |
JSSE | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | No |
LibreSSL | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | No |
MatrixSSL | No | No | No | No | Yes | No | Yes | No | Yes | Yes | Yes | No | No |
mbed TLS | No | No | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | No |
NSS | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | No |
OpenSSL | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | No |
RSA BSAFE[47] | No | No | No | No | Yes | No | Yes | No | Yes | Yes | Yes | No | No |
SChannel Vista/2008, 7/2008R2, 8/2012, 8.1/2012R2, 10 | No | No | No | No | No | No | No | No | Yes | Yes | Yes | No | No |
Secure Transport | No | No | No | No | Yes | No | No | No | Yes | No | Yes | No | No |
wolfSSL | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | No |
Implementation | secp160k1 (15) |
secp160r1 (16) |
secp160r2 (17) |
secp192k1 (18) |
secp192r1 prime192v1 NIST P-192 (19) |
secp224k1 (20) |
secp224r1 NIST P-224 (21) |
secp256k1 (22) |
secp256r1 prime256v1 NIST P-256 (23) |
secp384r1 NIST P-384 (24) |
secp521r1 NIST P-521 (25) |
arbitrary prime curves (0xFF01) |
arbitrary char2 curves (0xFF02) |
Implementation | brainpoolP256r1 (26)[133] |
brainpoolP384r1 (27)[133] |
brainpoolP512r1 (28)[133] |
X25519 [134] |
Curve448 Ed448-Goldilocks [135] |
M221 Curve2213 [136] |
E222 [136] |
Curve1174 [136] |
E382 [136] |
M383 [136] |
Curve383187 [136] |
Curve41417 Curve3617 [136] |
M511 Curve511187 [136] |
E521 [136] |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Botan | Yes[137] | Yes[137] | Yes[137] | Yes[112] | No | No | No | No | No | No | No | No | No | No |
BoringSSL | No | No | No | Yes | No | No | No | No | No | No | No | No | No | No |
GnuTLS | No | No | No | Yes[138] | No | No | No | No | No | No | No | No | No | No |
JSSE | No | No | No | No | No | No | No | No | No | No | No | No | No | No |
LibreSSL | Yes[36] | Yes[36] | Yes[36] | No | No | No | No | No | No | No | No | No | No | No |
MatrixSSL | Yes | Yes | Yes | No | No | No | No | No | No | No | No | No | No | No |
mbed TLS | Yes[139] | Yes[139] | Yes[139] | Yes[140] | No | No | No | No | No | No | No | No | No | No |
NSS | No[141] | No[141] | No[141] | No[142] | No | No | No | No | No | No | No | No | No | No |
OpenSSL | Yes[46] | Yes[46] | Yes[46] | Yes[44] | No | No | No | No | No | No | No | No | No | No |
RSA BSAFE[47] | No | No | No | No | No | No | No | No | No | No | No | No | No | No |
SChannel Vista/2008, 7/2008R2, 8/2012, 8.1/2012R2, 10 | No | No | No | No | No | No | No | No | No | No | No | No | No | No |
Secure Transport | No | No | No | No | No | No | No | No | No | No | No | No | No | No |
wolfSSL | Yes | Yes | Yes | Yes[143] | No | No | No | No | No | No | No | No | No | No |
Implementation | brainpoolP256r1 (26) |
brainpoolP384r1 (27) |
brainpoolP512r1 (28) |
Curve25519 | Curve448 Ed448-Goldilocks |
M221 Curve2213 |
E222 | Curve1174 | E382 | M383 | Curve383187 | Curve41417 Curve3617 |
M511 Curve511187 |
E521 |
Data integrity
Implementation | HMAC-MD5 | HMAC-SHA1 | HMAC-SHA256/384 | AEAD | GOST 28147-89 IMIT[73] | GOST R 34.11-94[73] |
---|---|---|---|---|---|---|
Botan | No | Yes | Yes | Yes | No | No |
cryptlib | Yes | Yes | Yes | Yes | No | No |
GnuTLS | Yes | Yes | Yes | Yes | No | No |
JSSE | Yes | Yes | Yes | Yes | No[74] | No[74] |
LibreSSL | Yes | Yes | Yes | Yes | Yes[75] | Yes[75] |
MatrixSSL | Yes | Yes | Yes | Yes | No | No |
mbed TLS | Yes | Yes | Yes | Yes | No | No |
NSS | Yes | Yes | Yes | Yes | No[77][78] | No[77][78] |
OpenSSL | Yes | Yes | Yes | Yes | Yes[79] | Yes[79] |
RSA BSAFE[47] | Yes | Yes | Yes | Yes | No | No |
SChannel XP/2003, Vista/2008 | Yes | Yes | XP SP3, 2003 SP2 via hotfix[144] | No | No[80] | No[80] |
SChannel 7/2008R2, 8/2012, 8.1/2012R2 | Yes | Yes | Yes | except ECDHE_RSA[81][82][83] | No[80] | No[80] |
SChannel 10 | Yes | Yes | Yes | Yes[123] | No[80] | No[80] |
Secure Transport | Yes | Yes | Yes | No | No | No |
wolfSSL | Yes | Yes | Yes | Yes | No | No |
Implementation | HMAC-MD5 | HMAC-SHA1 | HMAC-SHA256/384 | AEAD | GOST 28147-89 IMIT | GOST R 34.11-94 |
Compression
Note the CRIME security exploit takes advantage of TLS compression, so conservative implementations do not enable compression at the TLS level. HTTP compression is unrelated and unaffected by this exploit, but is exploited by the related BREACH attack.
Implementation | DEFLATE[145] (insecure) |
---|---|
Botan | No |
cryptlib | No |
GnuTLS | Disabled by default |
JSSE | No |
LibreSSL | No[36] |
MatrixSSL | Disabled by default |
mbed TLS | Disabled by default |
NSS | Disabled by default |
OpenSSL | Disabled by default |
RSA BSAFE[47] | No |
SChannel | No |
Secure Transport | No |
wolfSSL | Disabled by default |
Implementation | DEFLATE |
Extensions
In this section the extensions each implementation supports are listed. Note that the Secure Renegotiation extension is critical for HTTPS client security [citation needed]. TLS clients not implementing it are vulnerable to attacks, irrespective of whether the client implements TLS renegotiation.
Implementation | Secure Renegotiation [146] |
Server Name Indication [147] |
ALPN [148] |
Certificate Status Request [147] |
OpenPGP [149] |
Supplemental Data [150] |
Session Ticket [151] |
Keying Material Exporter [152] |
Maximum Fragment Length [147] |
Truncated HMAC [147] |
Encrypt-then-MAC [153] |
TLS Fallback SCSV [154] |
Extended Master Secret [155] |
TLS Padding [156] |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Botan | Yes | Yes | Yes[157] | No | No | No | Yes | Yes | Yes | No | Yes | Yes[158] | Yes[159] | No |
cryptlib | Yes | Yes | No | No | No | Yes | No | No | No[160] | No | Yes | Yes | Yes | No |
GnuTLS | Yes | Yes | Yes[161] | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes[34] | Yes[162] | Yes[34] | No |
JSSE | Yes | Yes[57] | Unknown | No | No | No | No | No | No | No | No | No | No | No |
LibreSSL | Yes | Yes | Yes[163] | Yes | No | No? | Yes | Yes? | No | No | No | Server side only[164] | No | Yes |
MatrixSSL | Yes | Yes | Yes[165] | Yes[114] | No | No | Yes | No | Yes | Yes | No | Yes[114] | Yes[114] | No |
mbed TLS | Yes | Yes | Yes[166] | No | No | No | Yes | No | Yes | Disabled by default[39] | Yes[167] | Yes[167] | Yes[167] | No |
NSS | Yes | Yes | Yes[168] | Yes | No[169] | No | Yes | Yes | No | No | No[170] | Yes[171] | Yes[172] | Yes[168] |
OpenSSL | Yes | Yes | Yes[46] | Yes | No | No? | Yes | Yes? | No | No | No | Yes[173] | No | Yes[174] |
RSA BSAFE MES[47] | Yes | Yes | No | Yes | No | No | Yes | No | Yes | Yes | No | No | No | No |
RSA BSAFE SSL-J[47] | Yes | Yes | No | No | No | No | No | No | Yes | Yes | No | No | No | No |
SChannel XP/2003 | No | No | No | No | No | Yes | No | No | No | No | No | No | No | No |
SChannel Vista/2008 | Yes | Yes | No | No | No | Yes | No | No | No | No | No | No | No | No |
SChannel 7/2008R2 | Yes | Yes | No | Yes | No | Yes | No | No | No | No | No | No | No | No |
SChannel 8/2012 | Yes | Yes | No | Yes | No | Yes | Client side only[175] | No | No | No | No | No | No | No |
SChannel 8.1/2012R2, 10 | Yes | Yes | Yes | Yes | No | Yes | Yes[175] | No | No | No | No | No | No | No |
Secure Transport | Yes | Yes | Unknown | No | No | Yes | No | No | No | No | No | No | No | No |
wolfSSL | Yes | Yes | Yes[131] | No | No | No | Yes | No | Yes | Yes | No | No | Yes | No |
Implementation | Secure Renegotiation | Server Name Indication | ALPN | Certificate Status Request | OpenPGP | Supplemental Data | Session Ticket | Keying Material Exporter | Maximum Fragment Length | Truncated HMAC | Encrypt-then-MAC | TLS Fallback SCSV | Extended Master Secret | TLS Padding |
Assisted cryptography
This section lists the known ability of an implementation to take advantage of CPU instruction sets that optimize encryption, or utilize system specific devices that allow access to underlying cryptographic hardware for acceleration or for data separation.
Implementation | PKCS #11 device | Intel AES-NI | VIA PadLock | ARMv8-A | Intel SGX |
---|---|---|---|---|---|
Botan | Yes[176] | Yes | No | No | |
cryptlib | Yes | Yes | Yes | No | |
GnuTLS | Yes | Yes | Yes | Yes[177] | No |
JSSE | Yes | Yes[178] | No | No | |
LibreSSL | No | Yes | Yes | No | |
MatrixSSL | Yes | Yes | No | Yes | |
mbed TLS | Yes | Yes[179] | Yes | No | |
NSS | Yes[180] | Yes[181] | No[182] | No | |
OpenSSL | No | Yes | Yes | Yes[183] | |
RSA BSAFE[47] | Yes | Yes | No | ||
SChannel | No | Yes | No | No | |
Secure Transport | No | Yes[184][185] | No | Yes | |
wolfSSL | No | Yes | No | Yes | Yes |
Implementation | PKCS #11 device | Intel AES-NI | VIA PadLock | ARMv8-A | Intel SGX |
System-specific backends
This section lists the ability of an implementation to take advantage of the available operating system specific backends, or even the backends provided by another implementation.
Implementation | /dev/crypto | Windows CSP | CommonCrypto | OpenSSL engine |
---|---|---|---|---|
Botan | No | No | No | Partial |
cryptlib | No | No | No | No |
GnuTLS | Yes | No | No | No |
JSSE | No | Yes | No | No |
LibreSSL | Yes | No | No | No[186] |
MatrixSSL | No | No | Yes | Yes |
mbed TLS | No | No | No | No |
NSS | No | No | No | No |
OpenSSL | Yes | No | No | Yes |
RSA BSAFE[47] | No | No | No | No |
SChannel | No | Yes | No | No |
Secure Transport | No | No | Yes | No |
wolfSSL | No | Partial | No | No |
Implementation | /dev/crypto | Windows CSP | CommonCrypto | OpenSSL engine |
Cryptographic module/token support
Implementation | TPM support | Hardware token support | Objects identified via |
---|---|---|---|
Botan | Partial[159] | PKCS11 | |
cryptlib | No | PKCS11 | User-defined label |
GnuTLS | Yes | PKCS11 | RFC7512 PKCS #11 URLs[187] |
JSSE | No | PKCS11 Java Cryptography Architecture, Java Cryptography Extension |
|
LibreSSL | Yes | PKCS11 (via 3rd party module) | Custom method |
MatrixSSL | No | PKCS11 | |
mbed TLS | No | PKCS11 (via libpkcs11-helper) or standard hooks | Custom method |
NSS | No | PKCS11 | |
OpenSSL | Yes | PKCS11 (via 3rd party module) | Custom method |
RSA BSAFE MES[47] | No | PKCS11 (via 3rd party module) | User-defined label |
RSA BSAFE SSL-J[47] | No | No | |
SChannel | No | Microsoft CryptoAPI | UUID, User-defined label |
Secure Transport | |||
wolfSSL | No | No | |
Implementation | TPM support | Hardware token support | Objects identified via |
Code dependencies
Implementation | Dependencies | Optional dependencies |
---|---|---|
Botan | C++11 | sqlite, zlib (compression), bzip2 (compression), liblzma (compression), boost, openssl (crypto backend), trousers (TPM) |
GnuTLS | libc nettle gmp |
zlib (compression) p11-kit (PKCS #11) trousers (TPM) |
JSSE | Java | |
MatrixSSL | none | zlib (compression) |
MatrixSSL-open | libc or newlib | |
mbed TLS | libc | libpkcs11-helper (PKCS #11) zlib (compression) |
NSS | libc libnspr4 libsoftokn3 libplc4 libplds4 |
zlib (compression) |
OpenSSL | libc | zlib (compression) |
wolfSSL | None | libc, zlib (compression) |
Implementation | Dependencies | Optional dependencies |
Development environment
Implementation | Namespace | Build tools | API manual | Crypto back-end | OpenSSL compatibility Layer[clarify] |
---|---|---|---|---|---|
Botan | Botan::TLS | Makefile | Sphinx | Included (pluggable) | No |
cryptlib | crypt* | makefile, MSVC project workspaces | Programmers reference manual (PDF), architecture design manual (PDF) | Included (monolithic) | No |
GnuTLS | gnutls_* | Autoconf, automake, libtool | Manual and API reference (HTML, PDF) | External, libnettle | Yes (limited) |
JSSE | javax.net.ssl | Makefile | API Reference (HTML) + | Java Cryptography Architecture, Java Cryptography Extension |
No |
MatrixSSL | matrixSsl_* ps* |
Makefile, MSVC project workspaces, Xcode projects for OS X and iOS | API Reference (PDF), Integration Guide | Included (pluggable) | Yes (Subset: SSL_read, SSL_write, etc.) |
mbed TLS | ssl_* sha1_* |
Makefile, CMake, MSVC project workspaces | API Reference + High Level and Module Level Documentation (HTML) | Included (monolithic) | No |
NSS | CERT_* SEC_* |
Makefile | Manual (HTML) | Included, PKCS#11 based[188] | Yes (separate package called nss_compat_ossl[189]) |
OpenSSL | SSL_* SHA1_* |
Makefile | Man pages | Included (monolithic) | — |
wolfSSL | CyaSSL_* SSL_* |
Autoconf, automake, libtool, MSVC project workspaces, XCode projects, CodeWarrior projects, MPLAB X projects, Keil, IAR, Clang, GCC | Manual and API Reference (HTML, PDF) | Included (monolithic) | Yes (about 10% of API) |
Implementation | Namespace | Build tools | API manual | Crypto back-end | OpenSSL compatibility layer |
Portability concerns
Implementation | Platform requirements | Network requirements | Thread safety | Random seed | Able to cross-compile | No OS (bare metal) | Supported operating systems |
---|---|---|---|---|---|---|---|
Botan | C++11 | None | Thread-safe | Platform-dependent | Yes | Most Windows and POSIX systems | |
cryptlib | C89 | POSIX send() and recv(). API to supply your own replacement | Thread-safe | Platform-dependent, including hardware sources | Yes | Yes | AMX, BeOS, ChorusOS, DOS, eCos, FreeRTOS/OpenRTOS, uItron, MVS, OS/2, Palm OS, QNX Neutrino, RTEMS, Tandem NonStop, ThreadX, uC/OS II, Unix (AIX, FreeBSD, HPUX, Linux, OS X, Solaris, etc.), VDK, VM/CMS, VxWorks, Win16, Win32, Win64, WinCE/PocketPC/etc, XMK |
GnuTLS | C89 | POSIX send() and recv(). API to supply your own replacement. | Thread-safe, needs custom mutex hooks if neither POSIX nor Windows threads are available. | Platform dependent | Yes | No | Generally any POSIX platforms or Windows, commonly tested platforms include GNU/Linux, Win32/64, OS X, Solaris, OpenWRT, FreeBSD, NetBSD, OpenBSD. |
JSSE | Java | Java SE network components | Thread-safe | Depends on java.security.SecureRandom | Yes | Java based, platform-independent | |
MatrixSSL | C89 | None | Thread-safe | Platform dependent | Yes | Yes | All |
mbed TLS | C89 | POSIX read() and write(). API to supply your own replacement. | Threading layer available (POSIX or own hooks) | Random seed set through entropy pool | Yes | Yes | Known to work on: Win32/64, Linux, OS X, Solaris, FreeBSD, NetBSD, OpenBSD, OpenWRT, iPhone (iOS), Xbox, Android, SeggerOS |
NSS | C89, NSPR[190] | NSPR[190] PR_Send() and PR_Recv(). API to supply your own replacement. | Thread-safe | Platform dependent[191] | Yes (but cumbersome) | No | AIX, Android, FreeBSD, NetBSD, OpenBSD, BeOS, HP-UX, IRIX, Linux, OS X, OS/2, Solaris, OpenVMS, Amiga DE, Windows, WinCE, Sony PlayStation |
OpenSSL | C89? | ? | Needs mutex callbacks | Set through native API | Yes | No | Unix, DOS (with djgpp), Windows, OpenVMS, MacOS, NetWare, eCos |
wolfSSL | C89 | POSIX send() and recv(). API to supply your own replacement. | Thread-safe, needs mutex hooks if PThreads or WinThreads not available, can be turned off | Random seed set through wolfCrypt | Yes | Yes | Win32/64, Linux, OS X, Solaris, ThreadX, VxWorks, FreeBSD, NetBSD, OpenBSD, embedded Linux, Haiku, OpenWRT, iPhone (iOS), Android, Nintendo Wii and Gamecube through DevKitPro, QNX, MontaVista, OpenCL, NonStop, TRON/ITRON/µITRON, Micrium's µC OS, FreeRTOS, SafeRTOS, Freescale MQX, Nucleus, TinyOS, HP/UX, Keil RTX, TI-RTOS |
Implementation | Platform requirements | Network requirements | Thread safety | Random seed | Able to cross-compile | No OS (bare metal) | Supported operating systems |
See also
- SCTP — with DTLS support
- DCCP — with DTLS support
- SRTP — with DTLS support (DTLS-SRTP) and Secure Real-Time Transport Control Protocol (SRTCP)
References
- ^ "Botan: Release Notes". Retrieved 2024-08-13.
- ^ "Release Notes - bouncycastle.org". 2023-11-13. Retrieved 2023-11-18.
- ^ "Java LTS Resources - bouncycastle.org". 2024-03-01. Retrieved 2024-03-31.
- ^ "Java FIPS Resources - bouncycastle.org". 2023-09-28. Retrieved 2022-09-29.
- ^ "The Legion of the Bouncy Castle C# Cryptography APIs". 2024-02-05. Retrieved 2024-02-06.
- ^ "C# .NET FIPS Resources - bouncycastle.org". 2023-02-28. Retrieved 2023-02-28.
- ^ Gutmann, Peter (2019). "Downloading". cryptlib. University of Auckland School of Computer Science. Retrieved 2019-08-07.
- ^ "The GnuTLS Transport Layer Security Library". Retrieved 4 December 2023.
- ^ The features listed are for the closed source version
- ^ "MatrixSSL 4.2.2 Open release". 2019-09-11. Retrieved 2020-03-20.
- ^ "Mbed TLS releases". 2021-07-07. Retrieved 2021-10-14.
- ^ a b "NSS:Release versions". Mozilla Wiki. Retrieved 7 November 2022.
- ^ "OpenSSL: Newslog". Retrieved 7 July 2022.
- ^ "wolfSSL product description". Retrieved 2016-05-03.
- ^ "wolfSSL Embedded SSL/TLS". Retrieved 2016-05-03.
- ^ "wolfSSL ChangeLog". 2023-10-31. Retrieved 2023-10-31.
- ^ RFC6176: Prohibiting Secure Sockets Layer (SSL) Version 2.0
- ^ "CBC-Padding: Security Flaws in SSL, IPsec, WTLS,...", Serge Vaudenay, 2001
- ^ RFC7366: Encrypt-then-MAC for Transport Layer Security (TLS) and Datagram Transport Layer Security
- ^ Rizzo/Duong BEAST Countermeasures
- ^ Möller, Bodo; Duong, Thai; Kotowicz, Krzysztof (September 2014). "This POODLE Bites: Exploiting The SSL 3.0 Fallback" (PDF). Retrieved 15 October 2014.
- ^ TLSv1.2's Major Differences from TLSv1.1
- ^ a b RFC 6347
- ^ "Bard attack". CiteSeerX 10.1.1.61.5887.
{{cite web}}
: Missing or empty|url=
(help) - ^ The SSL Protocol <draft-hickman-netscape-ssl-00.txt>
- ^ RFC 6101
- ^ RFC 2246
- ^ RFC 4346
- ^ a b c d e f RFC 5246
- ^ draft-ietf-tls-tls13-11 - The Transport Layer Security (TLS) Protocol Version 1.3
- ^ draft-ietf-tls-tls13-latest
- ^ RFC 4347
- ^ "Version 1.11.13, 2015-01-11 — Botan". 2015-01-11. Retrieved 2015-01-16.
- ^ a b c d e f "[gnutls-devel] GnuTLS 3.4.0 released". 2015-04-08. Retrieved 2015-04-16.
- ^ "Java™ SE Development Kit 8, Update 31 Release Notes". Retrieved 2015-01-22.
- ^ a b c d e f g h i j k l m "OpenBSD 5.6 Released". 2014-11-01. Retrieved 2015-01-20.
- ^ "LibreSSL 2.3.0 Released". 2015-09-23. Retrieved 2015-09-24.
- ^ "MatrixSSL - News". Retrieved 2014-11-09.
- ^ a b c d e "mbed TLS 2.0.0 released". 2015-07-10. Retrieved 2015-07-14.
- ^ "NSS 3.19 release notes". Mozilla Developer Network. Mozilla. Retrieved 2015-05-06.
- ^ a b "NSS 3.14 release notes". Mozilla Developer Network. Mozilla. Retrieved 2012-10-27.
- ^ "NSS 3.15.1 release notes". Mozilla Developer Network. Mozilla. Retrieved 2013-08-10.
- ^ "NSS 3.16.2 release notes". Mozilla Developer Network. Mozilla. 2014-06-30. Retrieved 2014-06-30.
- ^ a b c d e f g h i j k l m https://www.openssl.org/news/openssl-1.1.0-notes.html
- ^ a b "Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.1 [14 Mar 2012]". 2012-03-14. Archived from the original on December 5, 2014. Retrieved 2015-01-20.
{{cite web}}
: Unknown parameter|deadurl=
ignored (|url-status=
suggested) (help) - ^ a b c d e f "Major changes between OpenSSL 1.0.1l and OpenSSL 1.0.2 [22 Jan 2015]". Archived from the original on September 4, 2014. Retrieved 2015-01-22.
{{cite web}}
: Unknown parameter|deadurl=
ignored (|url-status=
suggested) (help) - ^ a b c d e f g h i j k l m n o p q r s t "RSA BSAFE Technical Specification Comparison Tables" (PDF).
- ^ "S2N Readme".
- ^ TLS cipher suites in Microsoft Windows XP and 2003
- ^ SChannel Cipher Suites in Microsoft Windows Vista
- ^ a b c TLS Cipher Suites in SChannel for Windows 7, 2008R2, 8, 2012
- ^ a b "An update is available that adds support for DTLS in Windows 7 SP1 and Windows Server 2008 R2 SP1". Microsoft. Retrieved 13 November 2012.
- ^ "[wolfssl] wolfSSL 3.6.6 Released". 2015-08-20. Retrieved 2015-08-24.
- ^ "NSS 3.24 release notes". Mozilla Developer Network. Mozilla. Retrieved 2016-06-19.
- ^ "Technical Note TN2287: iOS 5 and TLS 1.2 Interoperability Issues". iOS Developer Library. Apple Inc. Retrieved 2012-05-03.
- ^ https://dev.ssllabs.com/ssltest/clients.html
- ^ a b http://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html
- ^ "Bug 663320 - (NSA-Suite-B-TLS) Implement RFC6460 (NSA Suite B profile for TLS)". Mozilla. Retrieved 2014-05-19.
- ^ http://technet.microsoft.com/en-us/library/dd566200(v=ws.10).aspx
- ^ "Secure or Compliant, Pick One" Steve Marquess blog Archived December 27, 2013, at the Wayback Machine
- ^ http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm
- ^ "Is botan FIPS 140 certified?" Frequently Asked Questions — Botan
- ^ "What about FIPS 140 certification?" cryptlib FAQ
- ^ "While, as a free software project, we are not actively pursuing this kind of certification, GnuTLS has been FIPS-140-2 certified in several systems by third parties." GnuTLS 3.5.6 B.5 Certification
- ^ Matrix SSL Toolkit
- ^ Is PolarSSL FIPS certified?
- ^ FIPS Validation - MozillaWiki
- ^ OpenSSL and FIPS 140-2
- ^ Validated 140-1 and 140-2 Cryptographic Modules
- ^ Microsoft FIPS 140 Validated Cryptographic Modules
- ^ wolfSSL - wolfCrypt FIPS 140-2 Validation
- ^ a b c d e f g h i j k l m n o p q r s t u v w x y z aa ab ac ad ae af RFC 4492
- ^ a b c d draft-chudov-cryptopro-cptls-04 - GOST 28147-89 Cipher Suites for Transport Layer Security (TLS)
- ^ a b c d Extensions to support JSSE in SChannel might be available.[citation needed]
- ^ a b c d e "LibreSSL 2.1.2 released". 2014-12-09. Retrieved 2015-01-20.
- ^ "NSS 3.20 release notes". Mozilla. 2015-08-19. Retrieved 2015-08-20.
- ^ a b c d Mozilla.org. "Bug 518787 - Add GOST crypto algorithm support in NSS". Retrieved 2014-07-01.
- ^ a b c d Mozilla.org. "Bug 608725 - Add Russian GOST cryptoalgorithms to NSS and Thunderbird". Retrieved 2014-07-01.
- ^ a b c d openssl/engines/ccgost/README.gost
- ^ a b c d e f g h i j k l m n o Extensions to support GOST in SChannel might be available.[citation needed]
- ^ a b c "Microsoft Security Bulletin MS14-066 - Critical (Section Update FAQ)". Microsoft. November 11, 2014. Retrieved 11 November 2014.
- ^ a b c Thomlinson, Matt (November 11, 2014). "Hundreds of Millions of Microsoft Customers Now Benefit from Best-in-Class Encryption". Microsoft Security. Retrieved 11 November 2014.
- ^ a b Update adds new TLS cipher suites and changes cipher suite priorities in Windows 8.1 and Windows Server 2012 R2
- ^ a b c RFC 5054
- ^ a b c RFC 4279
- ^ RFC 5489
- ^ RFC 2712
- ^ a b c "LibreSSL 2.0.4 released". Retrieved 2014-08-04.
- ^ a b c "Bug 405155 - add support for TLS-SRP, rfc5054". Mozilla. Retrieved 2014-01-25.
- ^ a b c d "Bug 306435 - Mozilla browsers should support the new IETF TLS-PSK protocol to help reduce phishing". Mozilla. Retrieved 2014-01-25.
- ^ "Bug 1170510 - Implement NSS server side support for DH_anon". Mozilla. Retrieved 2015-06-03.
- ^ "Bug 236245 - Update ECC/TLS to conform to RFC 4492". Mozilla. Retrieved 2014-06-09.
- ^ "Changes between 0.9.6h and 0.9.7 [31 Dec 2002]". Retrieved 2016-01-29.
- ^ a b "Changes between 0.9.8n and 1.0.0 [29 Mar 2010]". Retrieved 2016-01-29.
- ^ "wolfSSL (Formerly CyaSSL) Release 3.9.0 (03/18/2016)". 2016-03-18. Retrieved 2016-04-05.
- ^ RFC 5280
- ^ RFC 3280
- ^ RFC 2560
- ^ RFC 6698, RFC 7218
- ^ "MatrixSSL 3.8.3". Retrieved 2017-01-18.
- ^ "mbed TLS 2.0 defaults implement best practices". Retrieved 2017-01-18.
- ^ "Bug 672600 - Use DNSSEC/DANE chain stapled into TLS handshake in certificate chain validation". Mozilla. Retrieved 2014-06-18.
- ^ a b "How Certificate Revocation Works". Microsoft TechNet. Microsoft. March 16, 2012. Retrieved July 10, 2013.
- ^ RFC 5288, RFC 5289
- ^ RFC 6655, RFC 7251
- ^ RFC 6367
- ^ RFC 5932, RFC 6367
- ^ a b RFC 6209
- ^ RFC 4162
- ^ a b https://sweet32.info/
- ^ RFC 7905
- ^ a b "Version 1.11.12, 2015-01-02 — Botan". 2015-01-02. Retrieved 2015-01-09.
- ^ "gnutls 3.4.12". 2016-05-20. Retrieved 2016-05-29.
- ^ a b c d "Changes in 3.8.3". Retrieved 2016-06-19.
- ^ PolarSSL 1.3.8 release notes
- ^ "NSS 3.25 release notes". Mozilla Developer Network. Mozilla. Retrieved 2016-07-01.
- ^ "Bug 940119 - libssl does not support any TLS_ECDHE_*_CAMELLIA_*_GCM cipher suites". Mozilla. Retrieved 2013-11-19.
- ^ "NSS 3.12 is released". Retrieved 2013-11-19.
- ^ "NSS 3.12.3 Release Notes". Mozilla Developer Network. Mozilla. Retrieved 2014-07-01.
- ^ "NSS 3.23 release notes". Mozilla Developer Network. Mozilla. Retrieved 2016-03-09.
- ^ "openssl/CHANGES at OpenSSL_1_0_1-stable · openssl/openssl". Retrieved 2015-01-20.
- ^ Hofix 984963: TLS AES cipher suites for Microsoft Windows 2003
- ^ a b c https://dev.ssllabs.com/ssltest/viewClient.html?name=IE&version=11&platform=Win%2010%20Preview
- ^ RFC 5469
- ^ a b https://sweet32.info
- ^ "Version 1.11.15, 2015-03-08 — Botan". 2015-03-08. Retrieved 2015-03-11.
- ^ http://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html
- ^ "NSS 3.15.3 release notes". Mozilla Developer Network. Mozilla. Retrieved 2014-07-13.
- ^ "MFSA 2013-103: Miscellaneous Network Security Services (NSS) vulnerabilities". Mozilla. Mozilla. Retrieved 2014-07-13.
- ^ a b c https://blogs.windows.com/msedgedev/2016/08/09/rc4-now-deprecated/
- ^ a b "wolfSSL (Formerly CyaSSL) Release 3.7.0 (10/26/2015)". 2015-10-26. Retrieved 2015-11-19.
- ^ a b Negotiation of arbitrary curves has been shown to be insecure for certain curve sizes Mavrogiannopoulos, Nikos and Vercautern, Frederik and Velichkov, Vesselin and Preneel, Bart (2012). A cross-protocol attack on the TLS protocol. Proceedings of the 2012 ACM conference on Computer and communications security (PDF). pp. 62–72. ISBN 978-1-4503-1651-4.
{{cite book}}
: CS1 maint: multiple names: authors list (link) - ^ a b c RFC 7027
- ^ Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier: draft-ietf-tls-rfc4492bis
- ^ Curve25519 for ephemeral key exchange in Transport Layer Security (TLS): draft-ietf-tls-curve25519
- ^ a b c d e f g h i Additional Elliptic Curves for Transport Layer Security (TLS) Key Agreement: draft-josefsson-tls-additional-curves
- ^ a b c "Version 1.11.5, 2013-11-10 — Botan". 2013-11-10. Retrieved 2015-01-23.
- ^ ""An overview of the new features in GnuTLS 3.5.0"". 2016-05-02. Retrieved 2016-12-09.
- ^ a b c "PolarSSL 1.3.1 released". 2013-10-15. Retrieved 2015-01-23.
- ^ "PolarSSL 1.3.3 released". 2013-12-31. Retrieved 2015-01-23.
- ^ a b c "Bug 943639 - Support for Brainpool ECC Curve (rfc5639)". Mozilla. Retrieved 2014-01-25.
- ^ "Bug 957105 - Add support for curve25519 Key Exchange and UMAC MAC support for TLS". Mozilla. Retrieved 2015-01-23.
- ^ "wolfSSL (Formerly CyaSSL) Release 3.4.6 (03/30/2015)". 2015-03-30. Retrieved 2015-11-19.
- ^ "SHA2 and Windows". Retrieved 2014-09-08.
- ^ RFC 3749
- ^ RFC 5746
- ^ a b c d RFC 6066
- ^ RFC 7301
- ^ RFC 6091
- ^ RFC 4680
- ^ RFC 5077
- ^ RFC 5705
- ^ RFC 7366
- ^ RFC 7507
- ^ RFC 7627
- ^ RFC 7685
- ^ "Version 1.11.16, 2015-03-29 — Botan". 2016-03-29. Retrieved 2016-09-08.
- ^ "Version 1.11.10, 2014-12-10 — Botan". 2014-12-10. Retrieved 2014-12-14.
- ^ a b "Version 1.11.26, 2016-01-04 — Botan". 2016-01-04. Retrieved 2016-02-25.
- ^ Present, but disabled by default due to lack of use by any implementation.
- ^ "gnutls 3.2.0". Retrieved 2015-01-26.
- ^ "gnutls 3.4.4". Retrieved 2015-08-25.
- ^ "LibreSSL 2.1.3 released". 2015-01-22. Retrieved 2015-01-22.
- ^ "LibreSSL 2.1.4 released". 2015-03-04. Retrieved 2015-03-04.
- ^ "MatrixSSL - News". 2014-12-04. Retrieved 2015-01-26.
- ^ "Download overview - PolarSSL". 2014-04-11. Retrieved 2015-01-26.
- ^ a b c "mbed TLS 1.3.10 released". 2015-02-08. Retrieved 2015-02-09.
- ^ a b "NSS 3.15.5 release notes". Mozilla Developer Network. Mozilla. Retrieved 2015-01-26.
- ^ "Bug 961416 - Support RFC6091 - Using OpenPGP Keys for Transport Layer Security Authentication (TLS1.2)". Mozilla. Retrieved 2014-06-18.
- ^ "Bug 972145 - Implement the encrypt-then-MAC TLS extension". Mozilla. Retrieved 2014-11-06.
- ^ "NSS 3.17.1 release notes". Retrieved 2014-10-17.
- ^ "NSS 3.21 release notes". Retrieved 2015-11-14.
- ^ http://www.openssl.org/news/secadv_20141015.txt
- ^ "Major changes between OpenSSL 1.0.1f and OpenSSL 1.0.1g [7 Apr 2014]". 2014-04-07. Archived from the original on 2015-01-20. Retrieved 2015-02-10.
{{cite web}}
: Unknown parameter|deadurl=
ignored (|url-status=
suggested) (help) - ^ a b "What's New in TLS/SSL (Schannel SSP)". Retrieved 2014-06-18.
- ^ "Version 1.11.31, 2015-08-30 — Botan". 2016-08-30. Retrieved 2016-09-08.
- ^ https://lists.gnupg.org/pipermail/gnutls-devel/2016-October/008194.html
- ^ https://stackoverflow.com/questions/14259671/java-ssl-provider-with-aes-ni-support
- ^ "We've incorporated support for AES-NI in our AES and GCM modules". 2013-12-31. Retrieved 2014-01-07.
- ^ Normally NSS's libssl performs all operations via the PKCS#11 interface, either to hardware or software tokens
- ^ "Bug 706024 - AES-NI enhancements to NSS on Sandy Bridge systems". Retrieved 2013-09-28.
- ^ "Bug 479744 - RFE : VIA Padlock ACE support (hardware RNG, AES, SHA1 and SHA256)". Retrieved 2014-04-11.
- ^ http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddacb8f27ba4c8a8d51c306c150e1a8703b008f2
- ^ http://www.opensource.apple.com/source/Security/Security-55179.13/sec/Security/SecECKey.c
- ^ http://km.support.apple.com/library/APPLE/APPLECARE_ALLGEOS/HT5396/Crypto_Officer_Role_Guide_for_FIPS_140-2_Compliance_OS_X_Mountain_Lion_v10.8.pdf
- ^ "LibreSSL 2.2.1 Released". 2015-07-08. Retrieved 2016-01-30.
- ^ RFC 7512
- ^ On the fly replaceable/augmentable.
- ^ http://fedoraproject.org/wiki/Nss_compat_ossl
- ^ a b Netscape Portable Runtime (NSPR)
- ^ For Unix/Linux it uses /dev/urandom if available, for Windows it uses CAPI. For other platforms it gets data from clock, and tries to open system files. NSS has a set of platform dependent functions it uses to determine randomness.