[Info-vax] cURL/libcurl 7.46 PCSI kits available.

[Craig A. Berry]

On 1/7/16 7:41 AM, John Reagan wrote:
> On Wednesday, January 6, 2016 at 11:51:13 PM UTC-5, David Froble wrote:
>
>>
>> Following this with interest, ....  and disgust ....
>>
>> As far as encryption goes, I seem to recall reading somewhere that Microsoft
>> gave up on OpenSSL and developed their own software.  Could be wrong about this.
>>
>

> There is also LibreSSL (from OpenBSD, forked from OpenSSL), BoringSSL
> (from Google), Amazon released "s2n" to replace libSSL as a
> streamlined TLS, etc.  A search for OpenSSL replacements turns up
> lots to read.
>
> I don't see any "replacement" from Micrsoft, but Windows has its own
> version of TLS, etc. built in (and has for years). Plus many browers
> also provide their own implementations of such.

I haven't heard anything about Microsoft's crypto being open source. I
suspect it's not, but I could have missed something.

Apple's CommonCrypto is open source:

<http://www.opensource.apple.com/source/CommonCrypto/CommonCrypto-60075.20.1/>

and is in plain C (not Objective C) so it could probably be ported to
VMS with moderate effort.

But OpenSSL has been been getting some of the TLC it lacked, recently
including money from the Dutch government[1], and I believe has been
porting back some of the fixes produced in the various forks. So it's
not necessarily a bad way forward if the various problems with the VMS
port and porting schedule get fixed.

[1] 
<http://arstechnica.com/tech-policy/2016/01/dutch-government-encryption-good-backdoors-bad/>