Re: MD5

I'm not a proxy of Cincom, but my experience with security related
protocols is that the [implementation] ones in production should always be
maintained by people who keep them current due possible exploits, CVEs,
etc.

So the parcels of the VisualWorks should be the incumbent ones and no
alternative ones should be left in the system to avoid the risk of a non
system functionality to augment the threat surface of the applications
implemented in VW.

On the other hand, since the solution is appropriate to PDFtalk, I vote to
keep it private to that project.

my .01999... cents


On Mon, Dec 4, 2023 at 2:52 PM Christian Haider <[email protected]>
wrote:

> Hi,
>
>
>
> MD5 is a relatively simple hashing algorithm used in many places.
>
> Often, small strings are hashed (like passwords or, in my case, to get an
> ID for a PDF) where performance is not so important.
>
> For file checksums, performance is more important.
>
>
>
> Up to now, I used the MD5 function from VisualWorks (parcel MD5) without
> any problem on windows.
>
> The new VW 9.3 relies fully on the crypto libraries of the platform which
> makes it incompatible with earlier versions I want to support.
> Additionally, there is a lot of confusion about how to setup the required
> libraries under linux and mac (I couldn’t get it to work properly).
>
>
>
> Therefore, I implemented MD5 myself to free the PDFtalk library from this
> dependency. There is also another implementation in the PostgreSQL library
> MD5Hash in [PostgreSQL3EXDI]. But this is also a dependency I don’t want
> for the library.
>
>
>
> The implementation is done and works fast enough (about the same
> performance as MD5Hash). Fun fact: both in-image implementations are much
> faster than the host library implementation – for small strings. For large
> strings, the OS is faster by magnitudes.
>
>
>
> Now the question: shall I just keep it private as part of PDFtalk or would
> it be useful as stand-alone package for others?
>
>
>
> The class name may be MD5 in namespace Smalltalk. There are existing
> Security.MD5 (host impl.) and Security.MD5Hash (PostgreSQL) classes.
>
> The package could be named ‘MD5 stand-alone’ and has SecurityBase as
> prerequisite.
>
>
>
> What do you think? Is it worth it?
>
>
>
> Cheers,
>
> Christian
>
>
>
>
>