[TLS] Re: Response to CoI Complaints

On Fri, 2026-07-17 at 00:25 +0200, Jacob Appelbaum wrote:
> Hi Panos,
> 
> Doesn't at least one of Amazon's TLS libraries counter the exact
> class 
> of technical concerns raised in this and related threads?

OpenSSL uses CTR_DRBG by default, with Hash_DRBG and HMAC_DRBG as
optional choices. BoringSSL and aws-lc/s2n-tls at least use CTR_DRBG.
NSS (Firefox) uses Hash_DRBG. BearSSL uses HMAC_DRBG but also has
CTR_DRBG.

OpenSSL documents how it instantiates the various DRBGs:
https://docs.openssl.org/4.0/man7/EVP_RAND/#the-overall-picture - one
main DRBG that seeds per-thread DRBG for secret and DRBG for non-secret
randomness.

Markku made the point that in FIPS module land, with your H(m) you
would be hashing the output of AES or SHA2 again. Actually, this is
also true all the time in several major TLS libraries.

_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]