crypto

Problem:

A common pattern is:

GUARD(s2n_stuffer_skip_write(stuffer, bytes_to_write));
uint8_t* ptr = suffer->blob.data + stuffer->write_cursor - bytes_to_write;

which could be simplified.

Solution:

*ptr could be an *out parameter to s2n_stuffer_skip_write

• Does this change what S2N sends over the wire? No.
• Does this change any public APIs? No.

As I was running composer to install a new library into our repo, it warned me that:

Package yzalis/identicon is abandoned, you should avoid using it. No replacement was suggested.

I'm not familiar on what packagist.org's process is to declare a package abandoned. I see that the last commit in their repo is from 2019 and there are a number of unanswered issues and pull requests.

I

Suggested enhancement

When MBEDTLS_USE_PSA_CRYPTO is enabled, a new API function, mbedtls_pk_setup_opaque() is made available to allow the user to wrap a private key held by PSA into a PK context - this allows passing the PSA-held key to existing TLS and X.509 APIs that expect a private key (as a PK context, not a PSA key identifier) without modifying those APIs.

That feature current

Some suggestions to make it easier to run the backend without the front end. Some of these suggestions might be *ix only:

• a command line parameter to indicate that the back end should start with everything that is pending without waiting for a front end to be available in the browser.
• some instruction to make it work as a daemon (Linux) or service (Windows) to gain independence from the te

Please add provider support for the "botan encryption" command and implement the needed AES operations with PKCS#11.
I could not find any command line tool that I can use for that. OpenSSL's PKCS#11 engine does not support AES either.