Re: [OT] MatrixSSL

Hi Alex,

On Mon, Jun 12, 2006 at 06:53:39PM +0300, Alex Efros wrote:
> I noticed you using MatrixSSL library in your sslio program and I wanna
> know your attitude to this library as C-expert (if you remember, I'm
> Perl programmer and don't know C good enough).
> 
> I've also tried to use MatrixSSL and found some issues. For example,
> I try to configure my https:// client based on MatrixSSL to know some
> root CA certificates. I've found in /etc/ssl/certs/ 12 root CA
> certificates installed by openssl package, and I try to send them into
> matrixSslReadKeys() using trustedCAcertFiles param.

> I've send email to MatrixSSL support, but they didn't reply yet.
> 
> I'm worrying about these errors because they probably indicate bad,
> insecure style of C programming and may result in unexpected segfaults
> in long-running script which doing a lot of ssl-work or
> remotely exploitable security holes. :( From other view, this can be
> single rare mistake in elegant and secure code. I'm not a C-expert and
> can't know which supposition correct, so I'm asking you.

when I looked at matrixssl, first in spring 2004 (version 1.0), I found
the source code base well written, and decided it's worth to work with.
I found some minor glitches, reported them upstream, and found them
responsive; they included some suggested patches, or fixed the issue in
a different way.  And even if they were not responsive, I thought it
should be possible to fix most of any problems that pop up myself.  I
didn't think so after looking at the openssl code.

I didn't check your complaints yet though, they don't sound nice.  I
suggest to dig deeper, asking them again for a explanation, and make the
issues public somewhere, especially if tehy concern security.

HTH, Gerrit.