Problem:

A common pattern is:

GUARD(s2n_stuffer_skip_write(stuffer, bytes_to_write));
uint8_t* ptr = suffer->blob.data + stuffer->write_cursor - bytes_to_write;

which could be simplified.

Solution:

*ptr could be an *out parameter to s2n_stuffer_skip_write

• Does this change what S2N sends over the wire? No.
• Does this change any public APIs? No.

https://scotthelme.co.uk/a-new-security-header-feature-policy/

I guess it will be easy to add, because we certainly don't use any of these features.
Or maybe "gyroscope" or so may be used by the random number generator in sjcl, but that's all.

Context

Both DTLS-CID and TLS 1.3 use exactly the same padding mechanism and hence their respective padding granularities will be used in exactly the same way. Because of this, the MBEDTLS_SSL_CID_PADDING_GRANULARITY and MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY options can be combined into a single option which can be used for both DTLS-CID and TLS 1.3.

Please add provider support for the "botan encryption" command and implement the needed AES operations with PKCS#11.
I could not find any command line tool that I can use for that. OpenSSL's PKCS#11 engine does not support AES either.