Google forks OpenSSL into BoringSSL

Google will develop its own version of the OpenSSL open source Secure Sockets Layer/Transport Layer Security (SSL/TLS) cryptographic library used to authenticate and secure internet traffic.

Adam Langley, a security engineer with the web services giant, announced the "forking" of OpenSSL into BoringSSL, saying Google will continue to use the code from the former and contribute its own.

Langley said Google had been using a number of patches on top of OpenSSL, with some being accepted into the main code repository of the open source cryptographic library. Others however are too experimental to fit in with OpenSSL's application programming and binary interfaces (API and ABI) stability.

... as Android, Chrome and other products have started to need some subset of these patches, things have grown very complex. The effort involved in keeping all these patches (and there are more than 70 at the moment) straight across multiple code bases is getting to be too much. - Langley

Another fork of OpenSSL, created after Heartbleed, by the OpenBSD secure operating system team is LibreSSL. Langley said BoringSSL will import changes from LibreSSL and that they too can take code from the Google project.

To this end, Google has re-licensed its earlier OpenSSL contributions under the Internet Software Consortium license, as requested by those maintaining LibreSSL.

The BoringSSL name is "aspirational and not yet a promise", Langley wrote.

Langley also said Google will continue to fund the Core Infrastructure Initiative, which in May this year announced it would support the OpenSSL project in the wake of the Heartbleed security issue.