Re: [INTERNALS-WIN] Re: new crypt implementation, latest DES version used, blowfish support

On Sun, Jul 20, 2008 at 9:44 PM, Steph Fox <[email protected]> wrote:

>> Alexander Peslyak (Solar designer), the author of the Blowfish
>> implementation and known security expert, was kind enough to review my
>> code and point me to a better implementation of the DES (his revision
>> of the FreeSec code). It does not use any locking mechanism (being
>> fully reentrant), provides extended DES support (not only standard)
>> and is under BSD license (always preferable than the lgpl one we used
>> until now).
>
> Excuse me displaying my ignorance (this really isn't my area) - Alexander's
> code is already in the PHP core.

It is not, the implementation we had was based on one of the original
DES implementation (sometimes in the 90's), lgpl licensed as coming
from the old libc (afair). Alexander suggested me to use his revision
of the FreeSec implementation which is BSD and (almost) threadsafe (to
be cleared). The Suhosin patch also contains a modified version of the
crypt php function as well as Alexander's blowfish implementation.

> Is there some reason for a Windows-specific crypt implementation?

Because windows has no glibc, PHP Windows uses win32/crypt_win32.c
(crypt wrapper and std DES) and win32/md5crypt (md5 crypt).

> It looks to me like MD5 and standard DES are covered
> twice over in your current patch

I must miss something (don't get the full code here), but where are
the two? There is one md5 implementation in win32/crypt/crypt_win32.c
as the old win32/md5crypt.c is deleted.

> the BLOWFISH check could be shared
> x-platform, but I could be missing something?

Is it not what I ask in my post?

"What do you think about enabling Blowfish and extended DES for the
unix as well (when the libc does not have them obviously)?"


--
Pierre

http://blog.thepimp.net | http://www.libgd.org