Problem:

A common pattern is:

GUARD(s2n_stuffer_skip_write(stuffer, bytes_to_write));
uint8_t* ptr = suffer->blob.data + stuffer->write_cursor - bytes_to_write;

which could be simplified.

Solution:

*ptr could be an *out parameter to s2n_stuffer_skip_write

• Does this change what S2N sends over the wire? No.
• Does this change any public APIs? No.

If using mbedtls from other cmake projects it is quite problematic to set the CMAKE_BUILD_TYPE
like it is done in https://github.com/ARMmbed/mbedtls/blob/72ca39737f974db44723760623d1b29980c00a88/CMakeLists.txt#L115

I suggest a simple patch - basically only do the lines when the project is the top project

$ git diff HEAD^
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 5af4c8124..275

https://scotthelme.co.uk/a-new-security-header-feature-policy/

I guess it will be easy to add, because we certainly don't use any of these features.
Or maybe "gyroscope" or so may be used by the random number generator in sjcl, but that's all.

Please add provider support for the "botan encryption" command and implement the needed AES operations with PKCS#11.
I could not find any command line tool that I can use for that. OpenSSL's PKCS#11 engine does not support AES either.