LibreSSL Cryptographic Library

LibreSSL is a free and open-source TLS and cryptography library that began as a fork of OpenSSL in April 2014 by the OpenBSD project, following the discovery of the critical Heartbleed vulnerability (CVE-2014-0160) in OpenSSL. The fork was initiated by Theo de Raadt and Bob Beck of the OpenBSD team to improve code quality, security, and maintainability of the widely-used TLS library. The portable version extends LibreSSL beyond OpenBSD to other operating systems. Key features: security hardening: LibreSSL removed obsolete, insecure, and rarely-used code from the OpenSSL codebase, including SSLv2, SSLv3 (after POODLE), Kerberos ciphers, compression, and patented algorithms. Dangerous APIs like the original BIO abstraction were rewritten or removed. The codebase was significantly reduced (from approximately 460,000 lines to about 360,000 lines in the initial cleanup). Modern TLS: support for TLS 1.2 and TLS 1.3 (RFC 8446), with secure cipher suites only (no RC4, no 3DES, no EXPORT ciphers). TLS 1.3 was added in LibreSSL 2.9.0 (2019). Cryptographic algorithms: AES (CBC, GCM, CCM), ChaCha20-Poly1305, Camellia, RSA (with blinding), DSA, ECDSA (NIST curves P-256, P-384, P-521; Curve25519/Ed25519 since version 2.6), Diffie-Hellman and ECDH key exchange, SHA-1/256/384/512, SHA-3 (Keccak), BLAKE2b, HKDF, HMAC, scrypt. API compatibility: maintains source-level compatibility with OpenSSL for most applications. The libssl and libcrypto shared libraries provide the same API (SSL_CTX_new, SSL_read, SSL_write, EVP_*, etc.) and ABI, allowing drop-in replacement on many systems. Cross-platform: Linux, macOS, FreeBSD, Solaris, Windows (via the portable version). Used as the default TLS library in OpenBSD since version 5.6 (2014). ISP-style license (same as the original OpenSSL license).