Re: new crypt implementation, latest DES version used, blowfish support

hi!

A quick note about this patch:

Alexander Peslyak (Solar designer), the author of the Blowfish
implementation and known security expert, was kind enough to review my
code and point me to a better implementation of the DES (his revision
of the FreeSec code). It does not use any locking mechanism (being
fully reentrant), provides extended DES support (not only standard)
and is under BSD license (always preferable than the lgpl one we used
until now).

Updated code is available here (same links):

[1] http://pierre.libgd.org/patches/php_5_3_crypt_win32.patch.txt
[2] http://pierre.libgd.org/patches/crypt20080720.zip

I have used some locking mechanism as I'm really not sure that the
following code is TS:

	static volatile sig_atomic_t initialized = 0;

	if (initialized) return;

	__libc_lock_lock(_crypt_extended_init_lock); // EnterCriticalSection
	if (!initialized) {
		_crypt_extended_init();
		initialized = 1;
	}
//LeaveCriticalSection

VC compilers may generate code that will work in a synced manner but
many documentation refer to this feature as non thread safe. Java's
volatile does work well in threaded environments (multi CPUs as well)
but it is far from obvious for C or C++, it depends strongly on the
compiler, the thread library being used and the platform.

A good explanation:
https://www.securecoding.cert.org/confluence/display/seccode/SIG02-C.+Avoid+using+signals+to+implement+normal+functionality

Any advice or comments are welcome :)

What do you think about enabling Blowfish and extended DES for the
unix as well (when the libc does not have them obviously)?

Cheers,
-- 
Pierre

http://blog.thepimp.net | http://www.libgd.org