Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been working on a project that will require secure communication over the internet, so I've been thinking of TLS 1.2. After looking around I chose Botan but then I thought about using a more common one, OpenSSL. But since Heartbleed I've been reading quite a bit about problems with OpenSSL, and it seems to be rather poorly documented. I'm a decent programmer, but I don't know nearly enough about cryptography to evaluate a library on anything else than ease of use.

My question is this: Is there any way for me to evaluate the cryptographic strength and solidness of a library without paying a code review firm to go through the entire library?

Or do I just pick one that appear solid? My current alternatives are Botan and PolarSSL, both appear easier to use than OpenSSL.

share|improve this question

closed as primarily opinion-based by e-sushi, Maarten Bodewes, AFS, DrLecter, hunter Apr 20 '14 at 15:56

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

There is no answer here that is not at least opinionated. After the last debacle using a non-managed language (read: one that not intrinsically protects against buffer overflows), I would not consider anything in C. As Botan is object oriented C++ it would come slightly closer. FIPS certification is clearly not enough; it may even be detrimental to perform certification. – Maarten Bodewes Apr 19 '14 at 16:59
Why would FIPS be detrimental? – dutt Apr 19 '14 at 23:48
Because it takes a lot of resources away from actually developing the library. They are paper procedures mostly. Furthermore, FIPS and CC (CC much more so) have the nasty side effect that they do not promote updates to libraries. – Maarten Bodewes Apr 20 '14 at 6:13
Ah, ok. Could i reword this question to make it more factual, something along the lines of "Factors to consider when choosing a crypto library"? – dutt Apr 22 '14 at 11:59

Browse other questions tagged or ask your own question.