s2n-tls is a C99 implementation of the TLS/SSL protocols designed by AWS for simplicity, small size, and security. It supports TLS 1.2 and 1.3, including features like 0-RTT early data, session tickets, post-quantum KEMs (ML-KEM, ML-DSA), and QUIC transport integration. The library provides a public C API (api/s2n.h) and multiple libcrypto backends (OpenSSL, AWS-LC, BoringSSL, LibreSSL). Extensive formal verification (CBMC, SAW, SideTrail) and fuzz testing ensure memory safety and constant-time execution. The architecture is highly modular with a stuffer buffer abstraction, blob/array utilities, a table-driven TLS extension framework, and a robust error-handling macro system. Rust bindings are first-class, offering safe wrappers (s2n-tls), async Tokio integration (s2n-tls-tokio), an HTTP client connector for Hyper (s2n-tls-hyper), and a metrics subscriber for handshake analysis. The library is used by AWS services like S3 and KMS, and includes interoperability tests against OpenSSL, GnuTLS, Java, and rustls. It is actively maintained with a sophisticated CI pipeline covering unit, integration, fuzz, formal proof, and performance regression tests across multiple platforms and libcrypto versions.
This repository is a full-featured web control panel for managing Xray-core proxy servers, known as 3x-ui. It provides a complete management interface for creating and configuring proxy inbounds (VLESS, VMess, Trojan, Shadowsocks, WireGuard, AmneziaWG, TUIC, Hysteria, MTProto, etc.), managing client accounts with traffic quotas and expiry, operating multi-node distributed setups, and generating subscription links (v2ray, Clash, JSON). The backend is written in Go using the Gin web framework and GORM for database access (SQLite or PostgreSQL), while the frontend is a React/TypeScript SPA with Ant Design and TanStack Query. The system includes sidecar supervision for Xray-core, MTProto (mtg), and TUIC binaries, a Telegram bot, Discord integration, email notifications, and an API token system. It features extensive automated testing (unit, integration, scale, mutation tests) and a documentation site built with Next.js and fumadocs.
OpenSSL is a production-grade cryptographic library and toolkit that implements the TLS, DTLS, and QUIC protocols alongside a comprehensive general-purpose cryptographic library (libcrypto). The codebase is organized around a modular provider architecture: core cryptographic algorithms (ciphers, digests, key exchanges, signatures, etc.) are implemented as loadable providers (default, FIPS, legacy, base, null), with a unified EVP API that dispatches operations to the appropriate provider. The library exposes a vast public API (hundreds of functions in include/openssl/) for secure communications, certificate handling (X.509, PKCS#12, CMS, OCSP), and low-level crypto primitives. The command-line tool (apps/openssl.c) provides administrative and diagnostic commands for key generation, certificate management, encryption, and protocol testing. The architecture is layered: the BIO abstraction handles I/O (files, sockets, memory buffers), the SSL/TLS/QUIC state machines manage handshakes and record layer processing, and the provider framework isolates algorithm implementations from the core library. Key entry points include library initialization (crypto/init.c), provider loading (crypto/provider_core.c), SSL context creation (ssl/ssl_lib.c), and the EVP interface (crypto/evp/). Data flows typically start with an application calling EVP or SSL functions, which route through the provider dispatch to platform-optimized implementations (e.g., AES-NI, ARM NEON, RISC-V vector extensions). The codebase includes extensive fuzzing harnesses (fuzz/), a comprehensive test suite (test/), and demos (demos/) illustrating common use cases. External dependencies are minimal: the core library relies only on OS threading (pthreads, Windows threads) and basic system calls. Optional dependencies include compression libraries (zlib, zstd, brotli) and external test frameworks (tlsfuzzer, NSS, BoringSSL for interop testing). The project actively maintains FIPS 140-3 validation modules and supports post-quantum algorithms (ML-DSA, ML-KEM, SLH-DSA, LMS) alongside legacy algorithms. Platform-specific hardware acceleration is handled through compile-time detection and runtime capability checks (e.g., crypto/armcap.c, crypto/riscvcap.c).
Bouncy Castle for .NET is a comprehensive, production-grade cryptographic library providing implementations of a vast range of symmetric and asymmetric ciphers, hash functions, message authentication codes, digital signatures, key agreement protocols, key encapsulation mechanisms (including post-quantum schemes like ML-KEM, ML-DSA, SLH-DSA), secure random number generation (NIST SP 800-90A DRBG), and ASN.1 encoding/decoding (DER, BER, DL). It supports high-level protocol implementations for TLS/DTLS (client and server, including PSK, SRP, and post-quantum key exchange), OpenPGP (RFC 4880/9580), CMS (Cryptographic Message Syntax), CMP, CRMF, OCSP, TSP, and X.509 certificate generation and validation. The library is designed as a class library with a monolithic architecture organized into namespaces (Org.BouncyCastle.Crypto, .Asn1, .Tls, .Bcpg, .Cms, etc.), exposing both low-level primitives and high-level builders. It targets multiple .NET runtimes with conditional compilation for hardware intrinsics (AES-NI, PCLMULQDQ, SSE/AVX) and Span<T> support. The codebase is actively maintained, with ongoing migration from older algorithm names (e.g., Dilithium → ML-DSA) and extensive use of factory patterns and interface-based abstractions, making it a solid foundation for secure application development.
This repository is a configuration-only bundle for the cryptostorm VPN service, providing OpenVPN client configuration files (.ovpn) organized by cryptographic method (RSA, ECC, Ed25519, Ed448, and post-quantum ML-DSA-87) and server location. Despite having no application source code, the repo is classified as an application because it delivers ready-to-use configuration templates for a network service. The configs are well-structured, with extensive inline comments explaining security choices, cipher performance, and usage instructions. Each .ovpn file follows a consistent template with embedded CA certificates and shared tls-crypt/tls-auth keys. The repository serves as a distribution point for end-users to connect to cryptostorm servers, with a focus on transparency and user education.
cloudflare/tls-tris is a Go library that extends the standard library's crypto/tls package with experimental TLS 1.3 support, post-quantum key exchange (SIDH, SIKE, and hybrids), delegated credentials, and 0-RTT. It is not a standalone package; it replaces the Go standard library's crypto/tls via a patched GOROOT. The library implements full client and server TLS 1.3 handshakes, record layer processing, session ticketing, and provides APIs consistent with the standard Go tls package (tls.Config, tls.Conn, tls.Dial). The codebase is derived from Go 1.10-era crypto/tls with extensive modifications. It includes integration with Cloudflare's SIDH library for post-quantum cryptography and supports hybrid key exchange combining X25519 with SIDH or SIKE. The repository contains comprehensive test infrastructure including golden test data files, BoringSSL test suite runner (bogo), Docker-based interop testing against other TLS implementations (NSS, picotls, mint), and Caddy integration examples. However, the TLS 1.3 implementation is based on early IETF drafts (draft-18, -21, -22, -28) and is not compliant with the final RFC 8446. The post-quantum algorithms SIDH and SIKE have been broken by the Castryck-Decru attack; this code is cryptographically obsolete. The library requires a custom Go toolchain (patched from Go 1.10) and cannot be vendored or used as a standard Go module, making it incompatible with modern Go development workflows.