awslabs/s2n

Features

• C Security Libraries - A high-performance security library implemented in C for applications requiring fine-grained control over network I/O.
• Callback-Based Data Streaming - Implements a transport-level callback mechanism for sending and receiving network data without internal socket management.
• Memory Locking - Prevents cryptographic keys and plaintext from being swapped to disk using operating system memory locking.
• Cryptographic Backends - Provides an abstraction layer to interface with multiple underlying encryption libraries.
• Data Encryption - Implements the encryption and decryption of application data streams over secure connections.
• Mutual TLS Authentication - Enforces mutual identity verification by requiring both client and server to exchange digital certificates.
• Server Identity Verification - Authenticates remote server identities using X.509 certificates and enforces hostname verification to prevent impersonation.
• Quantum-Resistant Certificate Verifications - Implements identity verification using quantum-resistant digital signatures to protect against future computing threats.
• Post-Quantum Cryptography - Implements quantum-resistant key exchange and digital signatures to protect network connections against future computing threats.
• Post-Quantum Key Exchange - Implements quantum-resistant key exchange algorithms combined with classical methods for hybrid security.
• Cryptographic Memory Hardening - Protects sensitive memory and mitigates timing attacks to prevent the leak of private keys.
• Side-Channel Attack Mitigations - Mitigates timing side-channel attacks by introducing randomized delays during parsing failures.
• General TLS Connection Establishment - Handles the full TLS handshake process to establish a secure encrypted channel between peers.
• TLS Protocol Implementations - Provides a full implementation of the TLS and SSL protocols for establishing secure network connections.
• Cipher Suite and Protocol Version Configurations - Selects specific versions of ciphersuites and protocol versions to balance security and backwards compatibility.
• Transport Layer Security - Implements a secure network transport layer that encrypts data streams and manages peer authentication.
• Non-blocking IO Architectures - Supports non-blocking I/O architectures and custom callbacks for managing data transmission.
• Cryptography Backends - Provides a modular architecture allowing the library to plug into various cryptographic backends for core operations.
• Early Data Transmitters - Supports 0-RTT data transmission, allowing application data to be sent before the handshake completes.
• Session State Serialization - Converts connection state into byte strings to facilitate session transport and storage for resumption.
• Non-Blocking I/O Interfaces - Provides non-blocking I/O interfaces using custom callbacks to optimize encrypted data stream transmission.
• Certificate Transparency - Retrieves signed certificate timestamps to verify that certificates have been logged in a public transparency framework.
• Cipher Performance Optimizations - Improves performance on devices without hardware acceleration by prioritizing ChaCha20 over AES based on client preference.
• First-Byte Latency Reductions - Decreases initial delay during TCP slow start by sending smaller records and reverting to small sizes after inactivity.
• Certificate Revocation Validation - Verifies certificate validity and revocation status using OCSP stapling and pre-loaded revocation lists.
• Memory-Based Key Protection - Prevents cryptographic keys and plaintext from being swapped to disk using operating system memory-locking features.
• Randomness Isolation - Isolates random number generators per thread for public and private data to prevent side-channel leaks.
• Certificate Trust Managers - Manages sets of trusted root certificates to validate peer identities and enforce private trust chains.
• Pre-Shared Key Handshakes - Supports secure connections using pre-shared secrets exchanged outside the handshake to bypass certificate requirements.
• SSL/TLS Connection Termination - Gracefully terminates secure sessions using TLS close notify alerts.
• TLS Record Size Optimizations - Optimizes network performance by dynamically adjusting encrypted record sizes to reduce first-byte latency.
• TLS Record Size Tunings - Balances throughput and latency by tuning the maximum size of encrypted records sent to a peer.
• TLS Session Optimizations - Reduces connection latency through session resumption, pre-shared keys, and tuning record sizes for faster first-byte delivery.
• TLS Session Resumption - Speeds up subsequent connections by serializing and reusing connection state to skip full handshakes.
• TLS Session Resumptions - Speeds up subsequent connections by reusing cryptographic state from a previous handshake to skip certificate authentication.
• Timing-Side-Channel Protections - Mitigates timing side-channel attacks by introducing randomized delays during parsing failures to prevent sensitive data inference.
• Connection Settings - Manages security policies and certificate pairs via a shared configuration object across network connections.
• Build Systems - A secure, fast, and simple TLS/SSL protocol implementation.
• Cryptographic Libraries - Implementation of TLS/SSL protocols focused on security and performance.
• Networking Libraries - TLS/SSL protocol implementation focused on security and speed.
• Windows Environments - Listed in the “Windows Environments” section of the Awesome C awesome list.
• Cryptography Libraries - Implementation of TLS and SSL protocols.
• Security And Privacy - An implementation of the TLS/SSL protocols.

Star history