SaaSHub helps you find the best software and product alternatives Learn more →
Boringssl Alternatives
Similar projects and alternatives to boringssl
-
tokio
A runtime for writing reliable asynchronous applications with Rust. Provides I/O, networking, scheduling, timers, ...
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
-
-
-
-
-
-
-
-
-
Tink
Discontinued Tink is a multi-language, cross-platform, open source library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse.
-
wolfssl
The wolfSSL library is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. wolfSSL supports up to TLS 1.3 and DTLS 1.3!
-
-
-
-
-
-
-
-
NOTE:
The number of mentions on this list indicates mentions on common posts plus user suggested alternatives.
Hence, a higher number means a better boringssl alternative or higher similarity.
boringssl discussion
boringssl reviews and mentions
Posts with mentions or reviews of boringssl.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2024-07-30.
-
OpenSSL bug exposed up to 255 bytes of server heap and existed since 2011
> Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.
BoringSSL fix: https://boringssl.googlesource.com/boringssl/+/c1d9ac02514a1...
The heap leak was independently observed in 2014 in the Android okhttp library: https://github.com/square/okhttp/issues/437#issuecomment-358...
-
New vulnerabilities (CVE-2022-3602 and CVE-2022-3786) in OpenSSL, how they affect IoT and RTOS Devices.
I have nothing constructive to add except that OpenSSL has a long history of producing vulnerabilities so much so that Google has created their own fork publicly available here: https://boringssl.googlesource.com/boringssl/ (used in chromium, chrome, and android).
-
OpenSSL added new C parser code [...] without doing any basic security testing
> Large web companies like Google implement their own encryption stack anyway.
Google uses BoringSSL[1], which is another OpenSSL fork. I believe AWS uses a mix of OpenSSL and Boring SSL (someone can correct me!).
So it's "their own encryption stack," but that stack is at least originally comprised of OpenSSL's code. They've probably done an admirable job of refactoring it, but API and ABI constraints still apply (it's very hard to change the massive body of existing code that assumes OpenSSL's APIs).
[1]: https://boringssl.googlesource.com/boringssl/
-
CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows
OpenSSL gets plenty of funding but we need to put more funding into TLS implementations that have a bigger focus on security and stability like boringssl, nss, go's tls, and rustls. It's 2022 and we have both languages better suited for this and tools to make existing languages safer and more robust, it's incredible to me that we aren't even more anxious over the current state of openssl.
-
BearSSL: A smaller SSL/TLS library
It was not built for chromium AFAIK
To quote: https://boringssl.googlesource.com/boringssl/
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
- OpenSSL Security Advisory for CVE-2022-0778
-
I think a major issue with the rust ecosystem is that it's full of unexpected design decisions
Use Google's fork of OpenSSL which exists because Google likes to do it's own weird things sometimes. This doesn't say anything about "OpenSSL is considered dangerous", it says "This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you."
- Information and learning resources for cryptography newcomers
-
OpenSSL Security Advisory (14 December 2021)
And this is why projects like https://boringssl.googlesource.com/boringssl/ exist
-
U.S. Telecoms Are Going to Start Physically Removing Huawei Gear
The immediate effect of Heartbleed was the OpenBSD folk [1] and Google [2] forking OpenSSL.
There's a talk from Bob Beck of OpenBSD on pruning OpenSSL, it's pretty hilarious [3].
In that case open source was at least able to react appropriately, even if it didn't act preemptively.
[1]: https://www.libressl.org
[2]: https://boringssl.googlesource.com/boringssl/
[3]: https://www.youtube.com/watch?v=GnBbhXBDmwU
-
A note from our sponsor - SaaSHub
www.saashub.com | 4 Oct 2024
Stats
Basic boringssl repo stats
11
1,804
9.7
2 days ago
google/boringssl is an open source project licensed under GNU General Public License v3.0 or later which is an OSI approved license.
The primary programming language of boringssl is C++.
Sponsored
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com