Problem:

A common pattern is:

GUARD(s2n_stuffer_skip_write(stuffer, bytes_to_write));
uint8_t* ptr = suffer->blob.data + stuffer->write_cursor - bytes_to_write;

which could be simplified.

Solution:

*ptr could be an *out parameter to s2n_stuffer_skip_write

• Does this change what S2N sends over the wire? No.
• Does this change any public APIs? No.

https://scotthelme.co.uk/a-new-security-header-feature-policy/

I guess it will be easy to add, because we certainly don't use any of these features.
Or maybe "gyroscope" or so may be used by the random number generator in sjcl, but that's all.

This option is a trade-off between a feature a code size: it allows people who don't need that feature to avoid paying the cost in code size, by disabling it.

However:

• the code size savings are not that significant
• in the future we can design a mechanism for that an other ssl_config options that will save more code size and be more uniform, see #3535 "Hardcoding of SSL options"

Wor

Please add provider support for the "botan encryption" command and implement the needed AES operations with PKCS#11.
I could not find any command line tool that I can use for that. OpenSSL's PKCS#11 engine does not support AES either.