Re: one idea

Thus spake Ethan Grammatikidis ([email protected]):
> Dropbear:
> http://matt.ucc.asn.au/dropbear/dropbear.html

-rwxr-xr-x    1 leitner  users      218136 Jan 13 19:05 dropbear
-rwxr-xr-x    1 leitner  users      202712 Jan 13 19:05 dbclient

That is on my AMD64 box with dietlibc.

> GNU TLS comparison with OpenSSL:
> http://www.gnu.org/software/gnutls/comparison.html

I don't trust gnutls as far as I can throw it.
I looked at is a few years ago and it was full of basic beginner's
security bugs.

It has changed maintainers in the mean time but I still don't trust it
at all.

Apart from that it uses the slowest bignum library I could find in my
tests, so expect horrible performance.

> yaSSL, dual-licensed (available as either GPL or commercial):
> http://www.yassl.com/

Does not compile for me using diet libc.

I am using openssl for my SSL needs at the moment, but that is more out
of convenience and because I have working code for it.  I do have to say
that I find the openssl code more trustworthy than most other crypto
code I have seen so far.

If I had to start a new project using SSL and openssl was not an option,
I would probably use xyssl.  Check out polarssl.org, that's the guy who
took over development.

-rwxr-xr-x    1 leitner  users      156824 Jan 13 19:14 ssl_server

That is their test SSL server, again on my AMD64 box.  That looks like a
reasonable size for an SSL server, if you ask me.  For comparison:

-rwxr-xr-x    1 root     root       160280 Dec 29 13:15 /opt/diet/bin/gatling
-rwxr-xr-x    1 root     root      1006592 Dec 29 13:15 /opt/diet/bin/tlsgatling

I have not looked at the API of xyssl.  My knock out criterium for SSL
implementations is that you can do non-blocking I/O with the API.  That
is more commonplace now than it used to be.  Both openssl and xyssl
support it.  cyassl and gnutls apparently do, too.

Felix