Problem:

A common pattern is:

GUARD(s2n_stuffer_skip_write(stuffer, bytes_to_write));
uint8_t* ptr = suffer->blob.data + stuffer->write_cursor - bytes_to_write;

which could be simplified.

Solution:

*ptr could be an *out parameter to s2n_stuffer_skip_write

• Does this change what S2N sends over the wire? No.
• Does this change any public APIs? No.

As I was running composer to install a new library into our repo, it warned me that:

Package yzalis/identicon is abandoned, you should avoid using it. No replacement was suggested.

I'm not familiar on what packagist.org's process is to declare a package abandoned. I see that the last commit in their repo is from 2019 and there are a number of unanswered issues and pull requests.

I

There are no unit tests for mbedtls_x509write_csr_set_extension.

Please add provider support for the "botan encryption" command and implement the needed AES operations with PKCS#11.
I could not find any command line tool that I can use for that. OpenSSL's PKCS#11 engine does not support AES either.