[racket-dev] [patch] OpenSSL ECDH(E) + DHE support.

Edward Lee wrote at 02/08/2014 05:52 PM:
[...]
> Racket's OpenSSL bindings do not currently enable the ECDH(E) and the
> DHE ciphers, which are needed for perfect forward secrecy.
>
> I've attached a patch that:
>    
[...]

First, thanks for taking the initiative and contributing.  Second, I 
feel a little embarrassed saying this, since I don't have time to 
volunteer myself right now, but I think the following is important...

I suggest that any contributions touching SSL in the core need careful 
auditing by someone who understands the mechanics fully.  If Edward is 
an expert on this aspect of OpenSSL, his audit would be fine, but 
otherwise someone else has to audit it.

To emphasize: The SSL infrastructure and OpenSSL are both hairy, and a 
small mistake can defeat SSL altogether without being detected for 
years.  This has actually happened before, notably with SSL traffic on 
Debian and Ubuntu systems being compromised for over a year by a 
one-line mistake 
("https://www.schneier.com/blog/archives/2008/05/random_number_b.html").  From 
a Racket extension perspective, in addition to possible logic errors of 
API usage, there's also possible C memory errors through the FFI.

Neil V.