AWS Open Source Security

AWS Libcrypto (AWS-LC) is the flagship cryptographic library maintained by the AWS Cryptography team. Based on code from the Google BoringSSL and OpenSSL projects, AWS-LC serves as a foundation for our other language-specific cryptographic and transport libraries.

AWS Libcrypto Formal Verification (aws-lc-verification) provides specifications, proof scripts, and other artifacts required to formally verify portions of AWS Libcrypto. Formal verification is used to locate bugs and increase assurance of the correctness and security of the library.

Amazon Corretto Crypto Provider (ACCP) is a collection of efficient cryptographic implementations, backed by AWS-LC, and exposed through the standard Java Cryptography Architecture (JCA) interface. It can be used as a drop-in replacement in many different Java applications.

s2n-tls is a C99 implementation of the TLS/SSL protocol that is designed to be simple, fast, and secure. s2n-tls has been widely adopted by AWS services since its introduction in 2015. For example, s2n-tls has handled 100% of SSL traffic for Amazon S3 since 2017.

s2n-quic is a Rust implementation of the IETF QUIC protocol, featuring a simple, easy-to-use API. QUIC is an encrypted transport protocol designed for performance and serves as the foundation of HTTP/3.

s2n-bignum is a collection of bignum arithmetic routines designed for cryptography and utilized by AWS-LC and our other libraries. Each function is written in a constant-time style, and is accompanied by a machine-checked formal proof that its mathematical result is correct based on a formal model of the underlying machine. It thus provides a combination of speed, correctness and security against timing side channels.

AWS Encryption SDK is a client-side encryption library for all types of data. It makes best-practice client-side encryption easier, so you can focus on the core functionality of your application. These libraries may be used with any cryptographic service provider, including AWS Key Management Service (KMS) or AWS CloudHSM.

Cryptographic Computing for Clean Rooms (C3R) allows you to collaborate with your data in AWS Clean Rooms using a technique that allows multiple parties to jointly compute a function over their inputs while keeping those inputs private. If you have data handling policies that require encryption of sensitive data, you can pre-encrypt your data using a common collaboration-specific encryption key so that data is encrypted even when queries are run.