A C99 TLS/SSL implementation designed for simplicity, small size, speed, and security-first design.
s2n-tls is an open-source implementation of the TLS/SSL protocols written in C99. It provides secure communication for applications by encrypting data transmissions, with a design focused on simplicity, small code size, and high performance. The project prioritizes security through systematic mechanisms like memory protection, timing blinding, and auditable code.
Developers and organizations building networked applications in C or other languages via bindings, who need a lightweight, secure, and performant TLS/SSL library. It is particularly suitable for those requiring strict security controls and auditability.
Developers choose s2n-tls for its security-first design, minimal attack surface, and intuitive API. Its modular support for multiple cryptographic libraries, systematic safety mechanisms, and AWS backing make it a reliable choice for production systems where security and performance are critical.
An implementation of the TLS/SSL protocols
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Incorporates mechanisms like erase-on-read, timing blinding, and built-in memory protection to mitigate side-channel attacks and data leaks, as detailed in the safety mechanisms section.
Structured for reviewability with regular external audits and security evaluations, ensuring a minimized attack surface and trustworthy implementation.
Works with multiple cryptographic libraries like AWS-LC, OpenSSL, and BoringSSL, providing flexibility in choosing the underlying crypto backend as per the build documentation.
Offers blocking, non-blocking, and full-duplex I/O with no internal locks, making it familiar for developers accustomed to POSIX APIs and easy to integrate.
Deliberately omits rarely used features like DTLS and some TLS extensions, which might be necessary for specialized applications or legacy compatibility.
Only Tier 1 platforms are fully tested in CI; Tier 2 platforms may have unresolved issues, limiting deployment options on less common systems.
Requires installation and configuration of a compatible cryptographic library, adding setup complexity compared to self-contained TLS implementations.