Re: [gentoo-dev] libressl status]

Re: [gentoo-dev] libressl status]

[Paul B. Henson]

On Fri, Apr 03, 2015 at 01:59:25AM +0200, Hanno Böck wrote:

> Is there a way to split libtls off libressl?

To revive this rather old thread, I just wanted to provide an update.
After some discussion with upstream portable openntpd, the libressl team
decided to go ahead and create a standalone libtls package that will
eventually work with openssl:

https://github.com/libressl-portable/portable/pull/83

This work has already been pulled into libressl head, and there has also
been some work on adding the missing libressl APIs to openssl:

https://github.com/busterb/openssl/commits/libressl-apis

I believe these are going to get submitted to openssl for review soon.
Unfortunately, there are still some security features missing in openssl
that haven't been worked on (for openntpd purposes, specifically the
ability for the openssl RNG to function in an empty chroot; if I
understand correctly it needs access to /dev/(u)random while running).

So it's not quite there yet, but it is being worked on, so I'm hopeful
at some point in the not too distant future we can have openntpd with
tls constraint support without having to deal with openssl vs libressl
headaches :).