Re: A couple of questions and concerns about Emacs network security

[Paul Eggert]

Perry E. Metzger wrote:
> The security of OpenSSL is, so far as I can tell, more reliably
> managed.

Yes, OpenSSL is surely the best choice for current applications, despite its 
obvious drawbacks. That being said, Emacs shouldn't be tied down to OpenSSL, 
just as it should not be tied down to GnuTLS. There is currently quite a bit of 
interest in replacing OpenSSL with something better, and with luck we'll see 
improvements in the not-too-distant future. We insulate Emacs users from this 
turmoil as best we can.

Here's a useful paper for those of us not plugged into recent work in the area:

Halpin H. A roadmap for high assurance cryptography. FPS 2017. 
https://hal.inria.fr/hal-01673294