4

I've been reading about SSL/TLS and I was surprised when I saw the amount SSL/TLS implementations that exist. wikipedia.

So, is there really a need for all these different implementations?

Wouldn't it be cheaper, more productive and faster just to mantain one implementation like OpenSSL?

2
  • I don't think that this question is on-topic here, because this can be extended to any technology which is implemented by more than one library, security-related or not. – Philipp Jun 1 '14 at 3:20
  • 2
    @Philipp I do agree somewhat, but with security related libraries it's more often considered "good" to pick the most established solution rather than an obscure/untested one or rolling your own. In other fields there can be a competitive advantage to jumping on "new" libraries as quickly as possible, but avoiding unknowns is a much bigger part of the equation in security. – thexacre Jun 1 '14 at 3:26
11

Competition is a good thing, and so is redundancy/diversity.

While Heartbleed affected a lot of systems and services due to how widespread OpenSSL is, it certainly didn't effect 100% of systems. Having redundancy in software in general is good, if you have a problem with one piece of software you can fail over to another or mitigate the risk by spreading your software dependencies among multiple vendors (just like you would with hardware).

Secondly, competition in business drives efficiency and quality. The same is true for software. If an easier to use, more efficient or otherwise better solution comes along then that might either overtake the established software or force that established software to improve.

8

This question can be easily extended to any problem which can be solved by a library, security-related or not. This answer applies to libraries which implement any standardized functionality and isn't specific to SSL.

License incompatibility

Not all software licenses are compatible with each other. When you want to use a GPL-licensed library, you need to license your whole project under GPL, which might not fit into your business strategy. Other organizations might reject anything but one specific licenses for ideological reasons. This leads to multiple solutions for the same problem which in practice only differ by license terms.

Patents

Even when a standard itself isn't patented, a certain method to implement that standard might be. In that case you either have to use the patented implementation method and pay the fee, move to a country where the patent isn't enforceable, or create a new implementation with a different method which works around the patent.

Parallel development

It often happens that two different development teams develop an implementation of the same technology independently of each other. When both solutions come to market, none wants to admit that their solution is inferior, so both will keep promoting and maintaining their solution.

Programming language preference

To make sure a library interfaces well with your program, it should preferably be written in the same programming language. When you have a C program, you would prefer a library written in C. When you use Java, you would like a Java implementation. When you use C#, you would rather want it implemented in .NET. It's not like it is impossible in either technology to interface with components written in the others, but it always requires some glue and duct-tape to get it to interface, which might impair performance, code readability and make the build toolchain more complicated.

Technical preference

Different projects have different priorities. Some want the fastest implementation possible. Some need a very low memory footprint. Some want the implementation with the best security track record (which can be measured in many different ways). The best library for one project isn't necessarily also the best for another. Having multiple options to choose from can be beneficial.

2
  • Also very good reasons ;) – thexacre Jun 1 '14 at 3:34
  • 1
    re: programming languages: sometimes you don't want it to be written in the same programming language. if you have a high-load Django app, you wouldn't want a TLS implementation in Python, because it would be way too slow. instead, you want one in e.g. C, because it's compiled (and therefore efficient) and also because Python has nice C bindings. – strugee Jun 1 '14 at 7:34
1

Wouldn't it be cheaper, more productive and faster just to [...]

Ah ! The whole story of Mankind.

Multiple implementations of SSL exist for the sole and most powerful reason that some people wrote them. After all, for a new implementation of anything to exist, it suffices for some lone individual to, at some point (possibly after one too many pint), believe that writing a new one would be a good idea. There is no overall management structure which plans and directs the implementation efforts of all developers on the planet. Instead, there are thousands, even millions of independent entities who all follow their own whims, which need not be rational at all, let alone fit in some master plan.

If we look at the individual projects, we can see some technical, local differences. I am using "technical" in a wide sense here; e.g. GnuTLS was prompted as a competitor for OpenSSL mainly because of license issues. Others have pointed out that a SSL library must, by definition, integrate into the context of other applications, which also implies a lot of variability.

For instance, I once, personally, wrote a new SSL/TLS implementation in C, which is currently deployed in production: the customer needed something which would fit in his embedded devices (specifically, in the bootstrap code for his embedded devices), and there was no way OpenSSL would ever run within 20 kB of ROM + 20 kB of RAM, on a barebone OS which does not even offer a malloc() call. My code could; SSL is not a large protocol, if you weed out some of the optional parts (e.g. concentrate on a couple of cipher suites, don't implement the extensions you don't need, and so on).

0

There's another reason, which also happens to be unrelated to security: in order to become an internet standard protocol, one has to demonstrate multiple interoperable independent implementations of that protocol. IOW: we need to have multiple implementations of TLS, because if we didn't have multiple implementations of TLS we wouldn't have TLS!

1
  • That might be true for SSL, but not TLS. – Diti Jun 2 '14 at 9:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.