NSF Safe-OSE: Addressing Vulnerabilities in OpenSSL's Providers, Primitives, and Protocols

This Safety, Security, and Privacy of Open-Source Ecosystems (Safe-OSE) project addresses vulnerabilities in OpenSSL, the most widely deployed cryptographic library, the foundation of secure communication for the majority of the web, and a mature open-source ecosystem supported by a robust developer community, an extensive user base, and a managing organization that steers its long-term development. The library underpins critical infrastructure across government, finance, and healthcare; federal information systems rely on its FIPS-validated cryptographic module to meet regulatory requirements; and countless downstream products and services depend on its safe, secure, and privacy-preserving functions. The broader impact of this project lies in proactively identifying and eliminating vulnerabilities before they can be exploited, strengthening national cybersecurity, reducing the systemic risk that flaws in widely deployed cryptographic libraries pose to public and private services, and helping maintain United States leadership in cryptographic software security. All tooling and methodologies developed under this project will be released as open source, enabling the OpenSSL community to sustain improvements beyond the project period. The project also trains students in cryptographic security through direct contributions to a widely used open-source code base, building a workforce equipped to maintain critical software infrastructure. This Safe-OSE project addresses vulnerabilities in three rapidly evolving areas of the OpenSSL code base: providers, the modular software architecture; primitives, including emerging cryptosystems; and new protocols. For providers, the project systematically analyzes boundary conditions where subtle bugs can escalate into severe vulnerabilities. For primitives, the work develops automated tooling that bridges constant-time verification with OpenSSL's provider API. For new protocols, the project analyzes state machines, where critical memory safety issues have historically appeared. The intellectual merit lies in adapting and integrating formal methods, side-channel analysis, and memory safety techniques into a cohesive auditing framework matched to the constraints of a production cryptographic library, and in embedding these methods within the ecosystem's build and test infrastructure so that vulnerability detection becomes part of ongoing quality control rather than a one-time effort. Anticipated results include stable public releases that address identified vulnerabilities, systematic auditing processes for new contributions, and enhanced resilience of the OpenSSL ecosystem against future incidents. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.