If not, how does Amazon get away with using S3 as part of GovCloud, which purports itself to be NIST SP 800-53 compliant, one requirement of which is NIST SP 800-53 Control SC-13 ( https://web.nvd.nist.gov/view/800-53/Rev4/control?controlNam... ), which says, while it does not mandate cryptography, if you do use cryptography to satisfy any of the other controls the cryptography must be certified to the appropriate level (classified data must use NSA-approved cryptography, digital signatures must use FIPS-validated cryptography).
This is a base control for NIST SP 800-53, which is a requirement for FedRAMP.
> we have replaced OpenSSL with s2n for all internal and external SSL traffic in Amazon Simple Storage Service (Amazon S3) commercial regions
I suspect that "commercial regions" excludes govcloud.
FIPS PUB 140-2 Annexes: Annex A: Approved Security Functions (Draft 04-08-2016)
Annex B: Approved Protection Profiles (Draft 11-18-2015)
Annex C: Approved Random Number Generators (Draft 01-04-2016)
Annex D: Approved Key Establishment Techniques (Draft 10-08-2014)
Still an exciting project, especially since the API looks dirt simple to use, but it doesn't live up to the awe I felt when I, at first glance, thought they had given a big middle finger and left OpenSSL behind entirely.
Historically, whenever there is an OpenSSL vulnerability, it doesn't affect the ssl application, and so Erlang isn't vulnerable. In short, corroboration.
https://github.com/awslabs/s2n/blob/b9e3636db98e4ba765fb2193...
- what you actually use
- what is broken
I think s2n does exactly that.
> One of the key benefits to s2n is far less code surface, with approximately 6,000 lines of code (compared to OpenSSL’s approximately 500,000 lines).
0: https://github.com/awslabs/s2n/blob/master/crypto/s2n_dhe.h#...
Do you think that was in the original draft of the release?
