Re: New crypto in 2.3.4

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dave Vasilevsky wrote:
> Alexander Skwar wrote:
>> Hm, can't you ship a "bundled" version of OpenSSL?
> 
> Unfortunately OpenSSL uses a license that is not compatible with the
> GPL. Thus it is only ok to link with the version of OpenSSL that is
> part of the system software--bundling OpenSSL is not allowed. It would
> be great if we could use GPL-compatible crypto, but I'm not sure what
> would be the best library. The most common is libgcrypt, but it only
> supports blowfish with 128-bit keys (I think we are now using 160-bit,
> right?). Maybe Crypto++ or Botan would be appropriate.

there is several proposal and patches to replace openSSL. I have them in
the pipe but this will be for 2.4.0.

> 
> Denis Corbin wrote:
>> I don't neither, even if the crypto algorithm used was not perfect.
>> Another solution is to keep the original algorithm beside the new and
>> lable the old algorithm "wbf" (or "weak-blowfish"). Thus, having the
>> real blowfish "bf" available in the resulting binary based on the
>> presence of theses offending headers.
> 
> This would be a nice solution, since it would allow "strong blowfish"
> versions of dar to still produce "weak blowfish" archives, if
> compatibility with weak blowfish versions of dar was desired.

This is also a not too complicated solution.

note that actually, dar-2.3.4 is able to read encrypted archive
generated with older version of dar.


> 
> Dave
> 
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGjm3zpC5CI8gYGlIRAssrAJ9hYHwe886eUsMI6ticvK0AYjhXIgCeNad5
WnoVtSaDsA1kSjWowmLTZ0w=
=Au0s
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/