crypto

Problem:

A common pattern is:

GUARD(s2n_stuffer_skip_write(stuffer, bytes_to_write));
uint8_t* ptr = suffer->blob.data + stuffer->write_cursor - bytes_to_write;

which could be simplified.

Solution:

*ptr could be an *out parameter to s2n_stuffer_skip_write

• Does this change what S2N sends over the wire? No.
• Does this change any public APIs? No.

As I was running composer to install a new library into our repo, it warned me that:

Package yzalis/identicon is abandoned, you should avoid using it. No replacement was suggested.

I'm not familiar on what packagist.org's process is to declare a package abandoned. I see that the last commit in their repo is from 2019 and there are a number of unanswered issues and pull requests.

I

In test_suite_psa_crypto, for historical reasons, tests of operation setup (hash_setup, mac_key_policy, cipher_key_policy, aead_key_policy) sometimes use one-shot operations and sometimes multi-part operations. Preferably, when both are possible, they should all test both, since we can't be sure that the checks are in the proper place to be done in all cases.

Some suggestions to make it easier to run the backend without the front end. Some of these suggestions might be *ix only:

• a command line parameter to indicate that the back end should start with everything that is pending without waiting for a front end to be available in the browser.
• some instruction to make it work as a daemon (Linux) or service (Windows) to gain independence from the te

Please add provider support for the "botan encryption" command and implement the needed AES operations with PKCS#11.
I could not find any command line tool that I can use for that. OpenSSL's PKCS#11 engine does not support AES either.