Date: Fri, 26 Apr 2013 11:47:29 -0400 From: Rich Felker <dalias@...ifal.cx> To: musl@...ts.openwall.com Subject: Re: High-priority library replacements? On Fri, Apr 26, 2013 at 10:11:32AM +0200, Gregor Pintar wrote: > 2013/4/26, idunham@...abit.com <idunham@...abit.com>: > > I hate to be the one who says this, but... > > Why another crypto library? > > There are at least 6 I can think of off the top of my head > > (openssl crypto, gcrypt, nettle, tomcrypt, gpg, openbgp) > > and I know that's not even half of them. > > tomcrypt is already good (as Rich mentioned), so code quality isn't > > a reason. > Most of them are realy bad (support only few ciphers, ugly API, > inflexible, license). > tomcrypt is good, but it has some global states (ltc_cipher_descriptor, ...) Yes, this is stupid, but I don't think there's any reason to use it. Can't you just use the extern descriptor for the cipher you want directly? In any case, I agree that when using tomcrypt the register and unregister functions should be nop'd out and the cipher_descriptor array replaced with a const version thereof. There may be more changes needed to fix it too, but that sounds like most of it. > > While writing your own "xyz" may be a good learning experience and fun > > and so on, a crypto library faces some restrictions: > > -You will need to fix bugs promptly until you hand over maintainership. > > (Otherwise, you become responsible when there's a vulnerability that > > stays unfixed.) > Not really a problem for me. > BTW, latest official stable tomcrypt release was released in 2007. Yes, that's because it's already very mature.. :) BTW, a big plus of that is that it would be safe to fork tomcrypt and fix any issues in it that aren't going to get fixed upstream, like global state, since maintaining a fork of a mature but clean codebase is almost no work. > > What Rich asked about was an SSL lib based on an existing crypto lib, > > namely tomcrypt. And that is likely to be a quicker path to results. > tomcrypt is definitely quicker path. Note that there's no reason the crypto implementation couldn't later be replaced if there's an option better than tomcrypt. Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.