git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] sha1: add gnutls as a sha1 provider

From
Todd Zullinger <tmz@pobox.com>
Date
Nov 14, 2017, 19:47 UTC
Message-ID
<20171114194718.GY5144@zaya.teonanacatl.net>
In-Reply-To
<20171114093402.29256-1-slandden@gmail.com>
Hi Shawn,
Shawn Landden wrote:
Show 5 quoted lines
> I think this is preferrable to bringing the assembly routines into 
> the git code-base, as a way of getting access to these high-performance 
> routines to a git available in Debian, Ubuntu, or Fedora (which 
> all use BLK_SHA1=1 due to GPLv2 + OpenSSL license considerations, 
> see Debian Bug #879459).

While it seems like it could be useful to have the choice of using the fast SHA1 implementation without concern about licensing issues, there's a few details I thought were worth mentioning.

Fedora moved from OpenSSL SHA1 to BLK_SHA1 to reduce the size of the binaries and dependencies, not due to licensing issues (Fedora considers OpenSSL a system library and allows linking GPLv2 code).

Fedora now uses the default DC_SHA1 (the collision-detecting SHA1 implementation). DC_SHA1 is not, as far as I know, as fast as the OpenSSL/GnuTLS SHA1, but it's safer given the increasingly successful attacks against SHA1. I don't envision changing that to gain performance. (And, of course, the speed of SHA1 should become less of an issue once git moves to a new, stronger hash.)

It looks like the Debian packages use the default DC_SHA1 implementation as well. Regardless of the licensing concerns regarding OpenSSL in Debian, I suspect they'll want to use the default, collision-detecting SHA1 implementation. That doesn't mean a patch to add the option of GnuTLS isn't useful though.

Fedora does link with OpenSSL's libcrypto and libssl in Fedora for the remote-curl helpers and imap-send. I believe the remote-curl helpers just link with curl, which happens to use OpenSSL on Fedora and could use GnuTLS instead. The imap-send command might also use curl and whatever crypto library curl is built with too, but I'm not terribly familiar with imap-send. (I think those are the only uses of libcrypto or libssl in Fedora's packages, but I could be mistaken).

That's a lot of text without having anything to say about the actual patch. Hopefully it's at least mildly useful to you or others. :)

-- 
Todd
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
When we remember we are all mad, the mysteries of life disappear and
life stands explained.
    -- Mark Twain
Previous: Shawn LanddenNext: Shawn Landden
Message 2 of 3 in “sha1: add gnutls as a sha1 provider”
  1. sha1: add gnutls as a sha1 providerShawn Landden, Nov 14, 2017
  2. Todd ZullingerNov 14, 2017
  3. Shawn LanddenNov 18, 2017

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.