Amazon Web Services has just released a new, open source library that implements TLS encryption using much less code than the existing OpenSSL library.
The developers called it s2n, which stands for “signal to noise,” and it consists of just over 6,000 lines of C code.
For comparison, OpenSSL consists of more than 500,000 lines of code, and about 70,000 of them make up the TLS encryption.
“Of course with every line of code there is a risk of error, but large code also presents more challenges of controls, security inspections, performance and efficiency,” said AWS Chief Security Officer Stephen Schmidt in the s2n announcement post on the company’s blog.
By developing a new TLS implementation from scratch in a leaner library that leaves out “rarely used extensions and options,” AWS hopes it will be easier to identify vulnerabilities in the code.
Schmidt said AWS had run three security assessments and penetration tests of s2n, by external partners, and plans to continue that practice.
The security of the OpenSSL Project has been under close scrutiny since 2014, when the Heartbleed bug was revealed, allowing hackers to intercept supposedly secure communications.
Immediately after the Heartbleed vulnerability was disclosed, several other critical issues were identified in OpenSSL, and some developers reported that the library is so large and complex that they don't know where to start.
The s2n library is not a replacement for OpenSSL. It only runs the TLS protocol, not the algorithms that handle the actual encryption. Schmidt said Amazon will continue to support the development of the OpenSSL cryptography library through the Linux Foundation's core infrastructure initiative.
Over the next few months, however, Amazon plans to use s2n instead of OpenSSL for TLS encryption across various AWS services.
Amazon Web Services has released s2n under the Apache 2.0 open source license and the code is available on GitHub.
