s2n-tls is a C99 implementation of the TLS/SSL protocols designed by AWS for simplicity, small size, and security. It supports TLS 1.2 and 1.3, including features like 0-RTT early data, session tickets, post-quantum KEMs (ML-KEM, ML-DSA), and QUIC transport integration. The library provides a public C API (api/s2n.h) and multiple libcrypto backends (OpenSSL, AWS-LC, BoringSSL, LibreSSL). Extensive formal verification (CBMC, SAW, SideTrail) and fuzz testing ensure memory safety and constant-time execution. The architecture is highly modular with a stuffer buffer abstraction, blob/array utilities, a table-driven TLS extension framework, and a robust error-handling macro system. Rust bindings are first-class, offering safe wrappers (s2n-tls), async Tokio integration (s2n-tls-tokio), an HTTP client connector for Hyper (s2n-tls-hyper), and a metrics subscriber for handshake analysis. The library is used by AWS services like S3 and KMS, and includes interoperability tests against OpenSSL, GnuTLS, Java, and rustls. It is actively maintained with a sophisticated CI pipeline covering unit, integration, fuzz, formal proof, and performance regression tests across multiple platforms and libcrypto versions.
Bouncy Castle for .NET is a comprehensive, production-grade cryptographic library providing implementations of a vast range of symmetric and asymmetric ciphers, hash functions, message authentication codes, digital signatures, key agreement protocols, key encapsulation mechanisms (including post-quantum schemes like ML-KEM, ML-DSA, SLH-DSA), secure random number generation (NIST SP 800-90A DRBG), and ASN.1 encoding/decoding (DER, BER, DL). It supports high-level protocol implementations for TLS/DTLS (client and server, including PSK, SRP, and post-quantum key exchange), OpenPGP (RFC 4880/9580), CMS (Cryptographic Message Syntax), CMP, CRMF, OCSP, TSP, and X.509 certificate generation and validation. The library is designed as a class library with a monolithic architecture organized into namespaces (Org.BouncyCastle.Crypto, .Asn1, .Tls, .Bcpg, .Cms, etc.), exposing both low-level primitives and high-level builders. It targets multiple .NET runtimes with conditional compilation for hardware intrinsics (AES-NI, PCLMULQDQ, SSE/AVX) and Span<T> support. The codebase is actively maintained, with ongoing migration from older algorithm names (e.g., Dilithium → ML-DSA) and extensive use of factory patterns and interface-based abstractions, making it a solid foundation for secure application development.
`@openclaw/fs-safe` is a production-grade Node.js library providing capability-style filesystem roots for secure, confined file operations. It enforces path boundaries, rejects symlink/hardlink escapes, and defends against TOCTOU races. The library offers atomic read/write/replace operations, secure archive extraction (ZIP/TAR with entry budgets and integrity checks), cross-process file locking, JSON stores with durability guarantees, permission inspection for POSIX and Windows, and secret file handling. It bundles a Rust native addon (via napi-rs) to accelerate critical operations on Linux, macOS, and Windows, with a transparent JavaScript fallback. The API is organized into modular subpath exports (e.g., `root`, `archive`, `file-store`, `file-lock`, `permissions`, `secret`, `durability`, `atomic`, `temp`, `walk`, `advanced`), each with typed error codes and consistent error categories. The package includes an extensive test suite (>3000 tests) covering security regressions, property-based fuzzing, concurrency stress tests, and cross-platform behavior. It is used by the OpenClaw ecosystem and published on npm with SLSA provenance.
This repository is a PHP 5.x polyfill library that provides implementations of the `random_bytes()` and `random_int()` cryptographic functions introduced in PHP 7. The library implements a fallback chain of secure random sources: libsodium extension, /dev/urandom (Unix), mcrypt_create_iv(), and CAPICOM (Windows). It throws exceptions when no secure random source is available rather than falling back to insecure alternatives. The library features modular implementation with separate files for each random source, along with utility functions for mbstring.func_overload-safe string operations and safe integer casting. It includes comprehensive unit tests and maintains compatibility with PHP versions from 5.2 through current versions by disabling itself on PHP 7.0+.