#56 kernelize crypto extension

[Andre Radke]

The cryptographic verbs currently implemented in my
crypto DLL should be made available as kernel verbs.

http://spicynoodles.net/projects/crypto.html

Currently, the following algorithms are implemented in
the crypto DLL: RC4, MD2, MD5, RIPEMD160, SHA1, SHA, MD5.

However, as I understand the license for the original
cryptographic code I used (SSLeay0.90b), it does not
allow the redistribution of the code under the GPL. For
the kernel implementation, I would recommend using code
from the OpenSSL project, available under an
Apache-style license.

http://www.openssl.org/

The legal implications of including cryptographic code
in the kernel also need to be investigated. This
relates mainly to the RC4 encryption algorithm, all the
other verbs implement hashing algorithms which are
usually not subject to U.S. export restrictions.

[Thomas Creedon]

Logged In: YES
user_id=1464347

OpenSSL seems to contain code and licenses from SSLeay. I'm
not a lawyer but it looks like we could use the code with
out project. Here is some text from the OpenSSL FAQ.

'If you develop open source software that uses OpenSSL, you
may find it useful to [text deleted] state explicitly that
"This program is released under the GPL with the additional
exemption that compiling, linking, and/or using OpenSSL is
allowed."'

[Andre Radke]

Logged In: YES
user_id=1137587

Also see "add string.hashHmacSha1 verb":

https://sourceforge.net/tracker/index.php?func=detail&aid=1445080&group_id=120666&atid=687801

[Andre Radke]

Logged In: YES
user_id=1137587

(attached source code for my crypto DLL)

[Andre Radke]

Source code for crypto DLL

[Thomas Creedon]

Logged In: YES
user_id=1464347

I've added SHA1 to the kernel. MD5 of course is already in
the kernel. Folks feel free to grab a chunk of code and
make it a verb! Let us know here which ones you've done.

[Thomas Creedon]

Logged In: YES
user_id=1464347

I've cribbed the code for RIPEMD-160. Seems to be working
here locally. Letting it burn in for a bit.

[Thomas Creedon]

Logged In: YES
user_id=1464347

Although there is a lot of stuff in OpenSSL that we wouldn't
use, I'm wondering if we decided to use it, if it would be
simplest to include the whole OpenSSL folder in our sources.

What I would think makes the most sense would be to drop the
"openssl" folder into the Common folder. We are using it as
a library, like Paige or PREC. When new versions come out,
we just replace the whole folder in the repository.

I'd hate to get into the situation where we have to dig
around in each new release to grab the files we are using.

Another advantage is that all the copyright/license
information stays with the code and we don't have to parse
that out as well.

I did a little more digging around and I think it would be
relatively easy to integrate the functions from openssl into
our project. A lot of the stuff in openssl is based on the
code used in Andre's crypto.dll.

[Andre Radke]

Logged In: YES
user_id=1137587

Regarding the inclusion of OpenSSL, see "Vendor Branches"
in the Subversion book:

http://svnbook.red-bean.com/en/1.1/ch07s05.html

We should probably do the same thing with PRE, eventually.

Before we include OpenSSL, we need to figure out the legal
questions though.