crypto

Problem:

A common pattern is:

GUARD(s2n_stuffer_skip_write(stuffer, bytes_to_write));
uint8_t* ptr = suffer->blob.data + stuffer->write_cursor - bytes_to_write;

which could be simplified.

Solution:

*ptr could be an *out parameter to s2n_stuffer_skip_write

• Does this change what S2N sends over the wire? No.
• Does this change any public APIs? No.

As I was running composer to install a new library into our repo, it warned me that:

Package yzalis/identicon is abandoned, you should avoid using it. No replacement was suggested.

I'm not familiar on what packagist.org's process is to declare a package abandoned. I see that the last commit in their repo is from 2019 and there are a number of unanswered issues and pull requests.

I

Suggested enhancement

The max_content_len (in and out) is configurable at compile time only. It is used in mbedtls_ssl_setup for alloc memory.

Justification

When in need of having 2 tls sessions to different servers, even if one server is not supporting max_content_len, both sessions are forced to have 16k of IN buffer since it is a compile time option. If configurable at run time,

Please add provider support for the "botan encryption" command and implement the needed AES operations with PKCS#11.
I could not find any command line tool that I can use for that. OpenSSL's PKCS#11 engine does not support AES either.

Some suggestions to make it easier to run the backend without the front end. Some of these suggestions might be *ix only:

• a command line parameter to indicate that the back end should start with everything that is pending without waiting for a front end to be available in the browser.
• some instruction to make it work as a daemon (Linux) or service (Windows) to gain independence from the te