396:
109:
27:
265:
to replace its own CBC-mode decryption. The AWS Security Blog said that the attack could not have been exploited against Amazon, AWS, or its customers, including because the cited versions of s2n had not been used in a
239:—disguising meaningful signals, like your critical data, as seemingly random noise". In 2022 AWS renamed it from s2n to s2n-tls. It has been the subject of several external reviews as well as
1323:
1011:
887:
1313:
832:
838:
982:
826:
295:
254:
against s2n, even though s2n included countermeasures intended to prevent timing attacks. In response, Amazon's s2n team said it would remove
664:
621:
401:
716:
1283:
1104:
920:
299:
343:
1026:
814:
785:
409:
1247:
481:
339:
1318:
1308:
939:
455:
1252:
849:
319:
255:
377:
1064:
1034:
933:
544:
315:
88:
1044:
914:
62:
1225:
988:
368:
146:
1084:
1016:
955:
1205:
1168:
1135:
808:
794:
613:
200:
519:
966:
950:
855:
607:
945:
909:
820:
291:
267:
1272:
1173:
893:
778:
251:
232:
39:
208:
193:
323:
244:
204:
141:
51:
1189:
904:
1140:
866:
617:
1145:
961:
899:
771:
741:
493:
361:
240:
153:
129:
871:
690:
335:
108:
158:
134:
1302:
926:
861:
429:
346:
273:
In
February 2017, Amazon announced that s2n was now handling 100% of SSL traffic for
1220:
994:
258:
609:
Information
Technology Innovation: Resurgence, Confluence, and Continuing Impact
212:
207:(AWS) and initially released in 2015. The goal was to make the code—about 6,000
1267:
545:"Introducing s2n-quic, a new open-source QUIC protocol implementation in Rust"
391:
327:
236:
46:
34:
1262:
1074:
1039:
274:
639:"Lucky Microseconds: A Timing Attack on Amazon's s2n Implementation of TLS"
26:
1079:
1069:
1054:
583:
1119:
1114:
1089:
372:
262:
216:
665:"TLS developers should ditch 'pseudo constant time' crypto processing"
381:
1277:
1230:
1210:
1109:
1094:
1059:
311:
250:
In 2015, independent security researchers described a variant of the
228:
219:—with 500,000 lines, 70,000 of which are involved in processing TLS.
638:
497:
1257:
1215:
1049:
844:
570:
170:
97:
767:
352:
Weaker ciphers and key exchange modes are disabled by default.
763:
717:"s2n Is Now Handling 100 Percent of SSL Traffic for Amazon S3"
331:
196:
122:
520:"Amazon introduces new open-source TLS implementation 's2n'"
637:
Albrecht, Martin R.; Paterson, Kenneth G. (2015-11-23).
571:
aws/s2n-tls: an implementation of the TLS/SSL protocols
456:"Introducing s2n, a New Open Source TLS Implementation"
290:
Common TLS extensions supported by this software are
1240:
1198:
1182:
1161:
1154:
1128:
1025:
1004:
975:
880:
801:
165:
152:
140:
128:
118:
87:
61:
45:
33:
809:Transport Layer Security / Secure Sockets Layer
449:
447:
1012:Export of cryptography from the United States
779:
8:
888:Automated Certificate Management Environment
566:
564:
19:
1158:
833:DNS-based Authentication of Named Entities
786:
772:
764:
482:"A Second Conversation with Werner Vogels"
231:. AWS said that the name "s2n" stands for
107:
18:
839:DNS Certification Authority Authorization
518:Vaughan-Nichols, Steven (June 30, 2015).
1324:Transport Layer Security implementation
689:MacCarthaigh, Colm (24 November 2015).
421:
235:as a nod "to the almost magical act of
227:s2n was first released in June 2015 on
983:Domain Name System Security Extensions
827:Application-Layer Protocol Negotiation
296:Application-Layer Protocol Negotiation
7:
663:Chirgwin, Richard (21 August 2018).
402:Free and open-source software portal
715:Schmidt, Steve (23 February 2017).
1314:C (programming language) libraries
921:Online Certificate Status Protocol
300:Online Certificate Status Protocol
14:
815:Datagram Transport Layer Security
410:Comparison of TLS implementations
364:below were not developed by AWS:
16:Open-source implementation of TLS
1248:Certificate authority compromise
543:Kampanakis, Panos (2022-02-17).
394:
25:
1253:Random number generator attacks
940:Extended Validation Certificate
742:"Language Bindings for s2n-tls"
454:Schmidt, Steve (30 June 2015).
334:. It also provides support for
850:HTTP Strict Transport Security
616:. 2020-12-30. pp. 43–46.
584:"Proving Amazon's s2n correct"
1:
344:Elliptic-curve Diffie–Hellman
243:. Galois, Inc. has conducted
934:Domain-validated certificate
480:Killalea, Tom (March 2021).
203:(TLS) protocol developed by
915:Certificate revocation list
1340:
989:Internet Protocol Security
802:Protocols and technologies
310:s2n-tls supports the main
247:of components of s2n-tls.
1017:Server-Gated Cryptography
956:Public key infrastructure
881:Public-key infrastructure
643:Cryptology ePrint Archive
486:Communications of the ACM
83:
68:1.5.1 / 20 August 2024
57:
24:
1169:Man-in-the-middle attack
1136:Certificate Transparency
614:National Academies Press
201:Transport Layer Security
1280:(in regards to TLS 1.0)
1233:(in regards to SSL 3.0)
967:Self-signed certificate
951:Public-key cryptography
872:Perfect forward secrecy
856:HTTP Public Key Pinning
336:perfect forward secrecy
1319:Free security software
1309:Cryptographic software
1284:Kazakhstan MITM attack
946:Public key certificate
910:Certificate revocation
821:Server Name Indication
314:in use today, such as
292:Server Name Indication
268:production environment
199:implementation of the
1273:Lucky Thirteen attack
1174:Padding oracle attack
894:Certificate authority
748:. Amazon Web Services
252:Lucky Thirteen attack
70:; 23 days ago
261:and take code from
245:formal verification
241:penetration testing
205:Amazon Web Services
188:, originally named
52:Amazon Web Services
21:
1190:Bar mitzvah attack
905:Certificate policy
691:"s2n and Lucky 13"
373:LuaJIT 2.0 binding
35:Original author(s)
1296:
1295:
1292:
1291:
867:Opportunistic TLS
721:AWS Security Blog
695:AWS Security Blog
623:978-0-309-68420-0
549:AWS Security Blog
460:AWS Security Blog
362:language bindings
356:Language bindings
183:
182:
40:Colm MacCárthaigh
1331:
1159:
1146:HTTPS Everywhere
962:Root certificate
900:CA/Browser Forum
788:
781:
774:
765:
758:
757:
755:
753:
738:
732:
731:
729:
727:
712:
706:
705:
703:
701:
686:
680:
679:
677:
675:
660:
654:
653:
651:
649:
634:
628:
627:
604:
598:
597:
595:
594:
580:
574:
568:
559:
558:
556:
555:
540:
534:
533:
531:
530:
515:
509:
508:
506:
504:
477:
471:
470:
468:
466:
451:
442:
441:
439:
437:
432:. 20 August 2024
426:
404:
399:
398:
397:
179:
176:
174:
172:
147:Security library
130:Operating system
111:
106:
103:
101:
99:
78:
76:
71:
29:
22:
1339:
1338:
1334:
1333:
1332:
1330:
1329:
1328:
1299:
1298:
1297:
1288:
1236:
1194:
1178:
1155:Vulnerabilities
1150:
1124:
1027:Implementations
1021:
1000:
971:
876:
797:
792:
762:
761:
751:
749:
740:
739:
735:
725:
723:
714:
713:
709:
699:
697:
688:
687:
683:
673:
671:
662:
661:
657:
647:
645:
636:
635:
631:
624:
606:
605:
601:
592:
590:
582:
581:
577:
569:
562:
553:
551:
542:
541:
537:
528:
526:
517:
516:
512:
502:
500:
498:10.1145/3434232
479:
478:
474:
464:
462:
453:
452:
445:
435:
433:
430:"Release 1.5.1"
428:
427:
423:
418:
400:
395:
393:
390:
358:
308:
288:
283:
233:signal to noise
225:
211:long—easier to
169:
114:
96:
79:
74:
72:
69:
17:
12:
11:
5:
1337:
1335:
1327:
1326:
1321:
1316:
1311:
1301:
1300:
1294:
1293:
1290:
1289:
1287:
1286:
1281:
1275:
1270:
1265:
1260:
1255:
1250:
1244:
1242:
1241:Implementation
1238:
1237:
1235:
1234:
1228:
1223:
1218:
1213:
1208:
1202:
1200:
1196:
1195:
1193:
1192:
1186:
1184:
1180:
1179:
1177:
1176:
1171:
1165:
1163:
1156:
1152:
1151:
1149:
1148:
1143:
1138:
1132:
1130:
1126:
1125:
1123:
1122:
1117:
1112:
1107:
1102:
1097:
1092:
1087:
1082:
1077:
1072:
1067:
1062:
1057:
1052:
1047:
1042:
1037:
1031:
1029:
1023:
1022:
1020:
1019:
1014:
1008:
1006:
1002:
1001:
999:
998:
992:
986:
979:
977:
973:
972:
970:
969:
964:
959:
953:
948:
943:
937:
931:
930:
929:
924:
918:
907:
902:
897:
891:
884:
882:
878:
877:
875:
874:
869:
864:
859:
853:
847:
842:
836:
830:
824:
818:
812:
805:
803:
799:
798:
793:
791:
790:
783:
776:
768:
760:
759:
733:
707:
681:
655:
629:
622:
599:
575:
560:
535:
510:
472:
443:
420:
419:
417:
414:
413:
412:
406:
405:
389:
386:
385:
384:
375:
357:
354:
347:ephemeral keys
340:Diffie–Hellman
307:
304:
287:
286:TLS extensions
284:
282:
279:
224:
221:
181:
180:
167:
163:
162:
159:Apache License
156:
150:
149:
144:
138:
137:
135:Cross-platform
132:
126:
125:
120:
116:
115:
113:
112:
93:
91:
85:
84:
81:
80:
75:20 August 2024
67:
65:
63:Stable release
59:
58:
55:
54:
49:
43:
42:
37:
31:
30:
15:
13:
10:
9:
6:
4:
3:
2:
1336:
1325:
1322:
1320:
1317:
1315:
1312:
1310:
1307:
1306:
1304:
1285:
1282:
1279:
1276:
1274:
1271:
1269:
1266:
1264:
1261:
1259:
1256:
1254:
1251:
1249:
1246:
1245:
1243:
1239:
1232:
1229:
1227:
1224:
1222:
1219:
1217:
1214:
1212:
1209:
1207:
1204:
1203:
1201:
1197:
1191:
1188:
1187:
1185:
1181:
1175:
1172:
1170:
1167:
1166:
1164:
1160:
1157:
1153:
1147:
1144:
1142:
1139:
1137:
1134:
1133:
1131:
1127:
1121:
1118:
1116:
1113:
1111:
1108:
1106:
1103:
1101:
1098:
1096:
1093:
1091:
1088:
1086:
1083:
1081:
1078:
1076:
1073:
1071:
1068:
1066:
1063:
1061:
1058:
1056:
1053:
1051:
1048:
1046:
1043:
1041:
1038:
1036:
1035:Bouncy Castle
1033:
1032:
1030:
1028:
1024:
1018:
1015:
1013:
1010:
1009:
1007:
1003:
996:
993:
990:
987:
984:
981:
980:
978:
974:
968:
965:
963:
960:
957:
954:
952:
949:
947:
944:
941:
938:
935:
932:
928:
927:OCSP stapling
925:
922:
919:
916:
913:
912:
911:
908:
906:
903:
901:
898:
895:
892:
889:
886:
885:
883:
879:
873:
870:
868:
865:
863:
862:OCSP stapling
860:
857:
854:
851:
848:
846:
843:
840:
837:
834:
831:
828:
825:
822:
819:
816:
813:
810:
807:
806:
804:
800:
796:
789:
784:
782:
777:
775:
770:
769:
766:
747:
743:
737:
734:
722:
718:
711:
708:
696:
692:
685:
682:
670:
666:
659:
656:
644:
640:
633:
630:
625:
619:
615:
611:
610:
603:
600:
589:
585:
579:
576:
572:
567:
565:
561:
550:
546:
539:
536:
525:
521:
514:
511:
499:
495:
491:
487:
483:
476:
473:
461:
457:
450:
448:
444:
431:
425:
422:
415:
411:
408:
407:
403:
392:
387:
383:
379:
376:
374:
370:
367:
366:
365:
363:
355:
353:
350:
348:
345:
341:
337:
333:
329:
325:
321:
317:
313:
305:
303:
301:
297:
293:
285:
280:
278:
276:
271:
269:
264:
260:
259:cipher suites
257:
253:
248:
246:
242:
238:
234:
230:
222:
220:
218:
215:than that of
214:
210:
206:
202:
198:
195:
191:
187:
178:
168:
164:
160:
157:
155:
151:
148:
145:
143:
139:
136:
133:
131:
127:
124:
121:
117:
110:
105:
95:
94:
92:
90:
86:
82:
66:
64:
60:
56:
53:
50:
48:
44:
41:
38:
36:
32:
28:
23:
1099:
995:Secure Shell
750:. Retrieved
745:
736:
724:. Retrieved
720:
710:
698:. Retrieved
694:
684:
672:. Retrieved
669:The Register
668:
658:
646:. Retrieved
642:
632:
608:
602:
591:. Retrieved
587:
578:
552:. Retrieved
548:
538:
527:. Retrieved
523:
513:
501:. Retrieved
492:(3): 50–57.
489:
485:
475:
463:. Retrieved
459:
434:. Retrieved
424:
359:
351:
309:
306:Cryptography
289:
272:
249:
226:
189:
185:
184:
47:Developer(s)
1141:Convergence
795:TLS and SSL
648:24 November
588:Galois, Inc
573:, on GitHub
194:open-source
1303:Categories
1268:Heartbleed
593:2024-08-20
554:2024-08-22
529:2024-08-20
416:References
237:encryption
119:Written in
89:Repository
1263:goto fail
1075:MatrixSSL
1040:BoringSSL
811:(TLS/SSL)
436:27 August
275:Amazon S3
263:BoringSSL
161: 2.0
1199:Protocol
1129:Notaries
1105:SChannel
1080:mbed TLS
1070:LibreSSL
1055:cryptlib
985:(DNSSEC)
976:See also
752:23 March
726:23 March
700:23 March
674:23 March
503:23 March
465:23 March
388:See also
338:through
281:Features
256:CBC-mode
192:, is an
177:/s2n-tls
102:/awslabs
1120:wolfSSL
1115:stunnel
1100:s2n-tls
1090:OpenSSL
1005:History
991:(IPsec)
326:modes,
312:ciphers
223:History
217:OpenSSL
186:s2n-tls
166:Website
154:License
73: (
20:s2n-tls
1278:POODLE
1231:POODLE
1226:Logjam
1211:BREACH
1183:Cipher
1162:Theory
1110:SSLeay
1095:Rustls
1060:GnuTLS
923:(OCSP)
890:(ACME)
858:(HPKP)
852:(HSTS)
835:(DANE)
829:(ALPN)
817:(DTLS)
746:GitHub
620:
378:Python
330:, and
298:, and
229:GitHub
213:review
171:github
98:github
1258:FREAK
1221:DROWN
1216:CRIME
1206:BEAST
1050:BSAFE
1045:Botan
997:(SSH)
958:(PKI)
917:(CRL)
845:HTTPS
841:(CAA)
823:(SNI)
524:ZDNET
382:CyS2N
209:lines
1065:JSSE
942:(EV)
936:(DV)
896:(CA)
754:2021
728:2021
702:2021
676:2021
650:2015
618:ISBN
505:2021
467:2021
438:2024
360:The
328:3DES
322:and
175:/aws
173:.com
142:Type
104:/s2n
100:.com
1085:NSS
494:doi
369:Lua
342:or
332:RC4
324:GCM
320:CBC
318:in
316:AES
197:C99
190:s2n
123:C99
1305::
744:.
719:.
693:.
667:.
641:.
612:.
586:.
563:^
547:.
522:.
490:64
488:.
484:.
458:.
446:^
380::
371::
349:.
302:.
294:,
277:.
270:.
787:e
780:t
773:v
756:.
730:.
704:.
678:.
652:.
626:.
596:.
557:.
532:.
507:.
496::
469:.
440:.
77:)
Text is available under the Creative Commons Attribution-ShareAlike License. Additional terms may apply.
