By Helen Woeste
The Open Source Technology Improvement Fund is proud to share the results of our security audit of Mbed-TLS. Mbed-TLS is a widely used TLS, DLS, and X.509 open source cryptographic library. With the help of Quarkslab and Alpha-Omega, this project underwent an architecture security review of the version 3.x to 4.0 split.
Audit Process:
This work, which was executed by two Quarkslab security engineers, took place in early 2026. The process was organized into 4 steps: Discovery, Threat Model, Code Review, and Dynamic testing. First, the test environment was set up and a systemic review was conducted of the documentation around the release, as well as an analysis of the test suite and its execution rates. Next, the project was modelled to illustrate the data flow between the TLS layer and TF-PSA-Crypto, trust boundaries, and attack scenarios. Then, a manual code review of the project was done, ending with dynamic testing improvements and development. That work was executed while keeping in mind the scope and focus areas: SSL/DTLS context management, PSA API integration, X.509 parsing, RNG and key generation, and configuration split.
Audit Results:
- 5 Findings with Security Impact
- 1 High, 1 Low, 3 Informational
- Custom Tooling Improvements and Recommendations
- Custom Project Documentation
- Fix Recommendations
- Recommendations for Future Security Development
The Mbed-TLS maintainers worked to resolve the issues reported to them by this work. Their efforts enabled the project’s hardening after this major architectural change. Take advantage of this work by both the audit team and the project maintainers by updating to the most current release. If you would like to contribute to Mbed-TLS, see their webpage for more information.
Thank you to the individuals and groups that made this engagement possible:
- Mbed-TLS maintainers and community, especially: János Folláth, Gilles Peskine, and Minos Galanakis
- Quarkslab, especially: Angèle Bossuat, Julio Loayza Meneses, and Pauline Sauder
- Alpha-Omega
You can read the Audit Report HERE
You can read Quarkslab’s Blog HERE
Everyone around the world depends on open source software. If you’re interested in supporting this critical work, reach out to us!
