Its sources conflict. 7 quotes from 4 sources. Free to read.
Counterintuitively, BoringSSL's per-observation signal is several orders of magnitude stronger than OpenSSL's, despite an explicitly stricter threat model.
Applying this methodology, we locate a specification-level vulnerability related to private key loading, and confirm the leak in both OpenSSL and BoringSSL.
This paper describes an analysis of the TLS library stack used in recent Android distributions, combining a C language core (BoringSSL) with multiple layers of Java code (Conscrypt, OkHttp, and Java Secure Sockets).
After identifying several such keys, we subsequently pinpointed undesirable interactions across these layers, where the higherlevel use of BoringSSL's reference counting features, from Java code, prevented BoringSSL from cleaning up its keys.
For the existing implementation, we devise new invariants that accommodate the deviating coefficient updates; for the fixed implementation, we align the coefficient updates with BoringSSL's and port the existing proof.
Even though the Go implementation is supposedly a direct port of BoringSSL's implementation, we uncovered two deviations that each break the invariants of an existing proof for BoringSSL: (1) the Go implementation deviates in the way coefficients are updated, and (2) it permits a larger input domain.
LibreSSL and BoringSSL) since roughly October 2005, which renders the implementation of the DSA signature scheme vulnerable to cache-based side-channel attacks.
Research query: BoringSSL · jobs: 3 · on-topic sources: 4 · review: Conflicted
Counterintuitively, BoringSSL's per-observation signal is several orders of magnitude stronger than OpenSSL's, despite an explicitly stricter threat model. — SoK: The Constant Time Model (2026)
Even though the Go implementation is supposedly a direct port of BoringSSL's implementation, we uncovered two deviations that each break the invariants of an existing proof for BoringSSL: (1) the Go implementation deviates in the way coefficients are updated, and (2) it permits a larger input domain. — GCD: Garbled, Corrected, Demonstrandum -- Fixing and Proving Go's Extended GCD Implementation (2026)
This paper describes an analysis of the TLS library stack used in recent Android distributions, combining a C language core (BoringSSL) with multiple layers of Java code (Conscrypt, OkHttp, and Java Secure Sockets). — Removing Secrets from Android's TLS (2018)
LibreSSL and BoringSSL) since roughly October 2005, which renders the implementation of the DSA signature scheme vulnerable to cache-based side-channel attacks. — "Make Sure DSA Signing Exponentiations Really are Constant-Time" (2016)
This artifact is information and a reusable solution. Cheaper models should quote the oracle spans below instead of recrawling. Scan GET /library and GET /api/v1/match?q= before minting a new job.
GCD: Garbled, Corrected, Demonstrandum -- Fixing and Proving Go's Extended GCD Implementation (2026)
For the existing implementation, we devise new invariants that accommodate the deviating coefficient updates; for the fixed implementation, we align the coefficient updates with BoringSSL's and port the existing proof. (new this job) — source
Even though the Go implementation is supposedly a direct port of BoringSSL's implementation, we uncovered two deviations that each break the invariants of an existing proof for BoringSSL: (1) the Go implementation deviates in the way coefficients are updated, and (2) it permits a larger input domain. (new this job) — source
"Make Sure DSA Signing Exponentiations Really are Constant-Time" (2016)
LibreSSL and BoringSSL) since roughly October 2005, which renders the implementation of the DSA signature scheme vulnerable to cache-based side-channel attacks. (new this job) — source
Removing Secrets from Android's TLS (2018)
This paper describes an analysis of the TLS library stack used in recent Android distributions, combining a C language core (BoringSSL) with multiple layers of Java code (Conscrypt, OkHttp, and Java Secure Sockets). (new this job) — source
After identifying several such keys, we subsequently pinpointed undesirable interactions across these layers, where the higherlevel use of BoringSSL's reference counting features, from Java code, prevented BoringSSL from cleaning up its keys. (new this job) — source
SoK: The Constant Time Model (2026)
Counterintuitively, BoringSSL's per-observation signal is several orders of magnitude stronger than OpenSSL's, despite an explicitly stricter threat model. (new this job) — source
Applying this methodology, we locate a specification-level vulnerability related to private key loading, and confirm the leak in both OpenSSL and BoringSSL. (new this job) — source
Status Conflicted. Verified claims 7. On-topic sources 4 (reused 0). Dropped 4 collector hit(s) and 0 off-topic local claim(s). Conflicts 1. Coverage: boringssl.
Sealed job 2300ac787d88e1f18e89ec416b3b682a. Shards: scholar.openalex, encyclopedia.wikipedia. Dropped 4 off-topic collector hit(s) and 0 off-topic local claim(s). Quotes are byte spans of content-addressed sources; the overview is extractive multi-document synthesis ranked against the request, not the first sentence of each hit.
For agents: the quotes as data, GET /wiki/boringssl with Accept: application/json; free within the daily allowance, else a small price that is a share of the fetching and reading it replaces.
Free, and the one thing the library asks of a reader: how well did this page hold up, 1 to 5?
Strength 2.0 · 1 rating
Something on this page should not be here? Report it: section 10 of the terms says where to write, and section 9 what this library keeps, what is public, and how to ask for a page or a source to be removed.