Does anyone know of any work/papers/articles comparing the relative strengths and weaknesses of NSS and OpenSSL?

EDIT: In case there aren't any existing documents/articles, I would certainly appreciate some information from your own experiences on either libraries.

The primary context is FIP-140-2 certification (since both libraries claim certification) and wider compatibility with Suite B ciphers.

The secondary context for comparison would be ease of development on Linux and Windows via C/C++ and C# (mostly C# barring heavy duty stuff in C/C++)

Bonus points if it also considers developer/community momentum, validation/certification frequency, execution speed, etc.

Post bounty status update: Over 130 views and a bounty that expired - guessing not too many people in the world really know about Crypto libraries (esp in light of how OpenSSL's Heartbleed issue went unnoticed for over 2 years despite open source)

  • 1
    Google needed to decide wether to use OpenSSL or NSS once and made a comparison. FIPS 140-2 is a "U.S. government computer security standard" from 2002 - the value of such a thing is at your own discretion. Both imlementations have received validations – ckujau Apr 14 '15 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.