OpenSSL vs. BoringSSL: A Comparison of Security and Performance

Last Updated: 2023-09-19

Page content

OpenSSL and BoringSSL are two of the most widely used cryptography libraries in the world, both providing essential encryption and secure communication services to millions of websites, applications, and devices. While both libraries are widely trusted, they differ in important ways when it comes to security and performance. In this article, we’ll take a closer look at the two libraries and compare them in terms of vulnerabilities, performance, and source code.

Security and Vulnerabilities

One of the main differences between OpenSSL and BoringSSL is the approach to security patches and updates. OpenSSL is an open-source project that is maintained by a group of volunteers and is subject to the risks associated with open-source software development. For example, OpenSSL has suffered from serious security vulnerabilities in the past, such as the Heartbleed bug, which affected millions of websites and applications.

BoringSSL, on the other hand, is maintained by Google, which has a large and well-funded security team that is dedicated to maintaining the security of the library. Google also invests heavily in security research and engineering, which allows BoringSSL to stay ahead of the curve when it comes to cryptography security. BoringSSL is also subject to internal security reviews and testing at Google, which helps to catch security vulnerabilities before they are released to the public.

Another important difference between OpenSSL and BoringSSL is the level of cryptographic support. OpenSSL supports a wide range of cryptographic algorithms and protocols, but it also includes older and potentially weaker cryptography options that are no longer considered secure. BoringSSL, on the other hand, includes only the strongest and most secure cryptography options, and it does not support weaker or outdated cryptography options.

OpenSSL has suffered from several high-profile security vulnerabilities in the past, including the Heartbleed, POODLE, and DROWN attacks. These vulnerabilities have exposed sensitive information, such as passwords and encryption keys, and put the security of millions of users at risk.

BoringSSL with the goal of improving its security and performance. While BoringSSL has suffered from a number of vulnerabilities of its own, such as Cloudbleed and null byte injection, it has generally been considered to be more secure than OpenSSL.

Performance

OpenSSL is known for its flexibility and compatibility, but its performance can suffer as a result. BoringSSL, on the other hand, has been optimized for performance and is generally considered to be faster and more efficient than OpenSSL.

For example, BoringSSL uses a different internal architecture that is optimized for modern processors and hardware. This architecture allows BoringSSL to perform cryptographic operations faster and with less overhead compared to OpenSSL. BoringSSL also uses a number of performance-enhancing techniques, such as aggressive inlining, loop unrolling, and constant-time algorithms, that are not present in OpenSSL.

In addition to these design differences, BoringSSL also benefits from Google’s investment in performance research and engineering. Google has a team of experts who are dedicated to optimizing the performance of BoringSSL, and they have access to some of the largest and most advanced computing resources in the world. This investment allows BoringSSL to stay at the cutting edge of cryptography performance and to offer superior performance compared to OpenSSL.

Source Code

OpenSSL is open source, with an active community of developers and contributors. BoringSSL is also open source, but it is maintained by a smaller team at Google and is not as widely used or widely contributed to as OpenSSL.

How to Port from OpenSSL to BoringSSL

Guidance on porting from OpenSSL to BoringSSL. BoringSSL is mostly source-compatible with OpenSSL but some APIs have been removed. Libraries may need little to no changes for BoringSSL support. BoringSSL’s OPENSSL_VERSION_NUMBER matches the OpenSSL version it targets, and BoringSSL also defines feature macros corresponding to removed features. In some cases, BoringSSL-specific code may be necessary, and the OPENSSL_IS_BORINGSSL macro may be used to distinguish between OpenSSL and BoringSSL. However, BoringSSL does not have a stable API or ABI and must be updated with its consumers. It is not suitable for a system library in a traditional Linux distribution.

Source: https://boringssl.googlesource.com/boringssl/+/HEAD/PORTING.md

Conclusion

In conclusion, both OpenSSL and BoringSSL are widely used and widely trusted cryptography libraries, but they differ in important ways when it comes to security, performance, and source code. When choosing between the two libraries, it’s important to weigh the trade-offs and choose the library that best meets your needs and requirements.