Re: New crypto in 2.3.4

Alexander Skwar wrote:
> Hm, can't you ship a "bundled" version of OpenSSL?

Unfortunately OpenSSL uses a license that is not compatible with the
GPL. Thus it is only ok to link with the version of OpenSSL that is
part of the system software--bundling OpenSSL is not allowed. It would
be great if we could use GPL-compatible crypto, but I'm not sure what
would be the best library. The most common is libgcrypt, but it only
supports blowfish with 128-bit keys (I think we are now using 160-bit,
right?). Maybe Crypto++ or Botan would be appropriate.

Denis Corbin wrote:
> I don't neither, even if the crypto algorithm used was not perfect.
> Another solution is to keep the original algorithm beside the new and
> lable the old algorithm "wbf" (or "weak-blowfish"). Thus, having the
> real blowfish "bf" available in the resulting binary based on the
> presence of theses offending headers.

This would be a nice solution, since it would allow "strong blowfish"
versions of dar to still produce "weak blowfish" archives, if
compatibility with weak blowfish versions of dar was desired.

Dave

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/