The biggest source of vulnerabilities in cryptographic libraries is memory safety bugs, not cryptography bugs

• rustls

  57 5,437 9.9 Rust

  A modern TLS library in Rust

  

This makes a surprisingly strong case for the approach taken by libraries such as rustls, which are written in Rust and are dramatically smaller in size than most of the alternatives.

• crates.io

  660 2,796 10.0 Rust

  The Rust package registry

  

(Outside of crates.io)

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• cryptofuzz

  6 655 9.0 C++

  Fuzzing cryptographic libraries. Magic bug printer go brrrr.

2) There's a popular fuzzing technique, called "differential fuzzing" that works especially well for cryptographic libraries. The idea is to have the fuzzer look for both memory safety issues (like buffer overflows, even if they're too small to cause a crash AddressSaniziter can detect) and actual logic bugs in the cryptography implementation (e.g. the output of one implementation not matching the output of another, given the same state/inputs).

Suggest a related project