[webkit-dev] MD5 in WebCore

[Alex Russell]

Hate to ask a dumb question, but why MD5? Isn't it on its last legs as
a secure hash? New protocols should be avoiding it.

On Tue, Apr 20, 2010 at 11:48 AM, Michael Nordman <michaeln at google.com> wrote:
> In webcore, should we use the same impl on all platforms rather than use
> cryptdll on windows and md5.cc elsewhere?
> For chrome, I don't think we can have a dependency between
> WebKit/WebKit/chromium and /src/base/, and 'base' depending on 'webkit' also
> doesn't work. How can we avoid replicating the code? I guess having
> webcore's MD5 be platform specific could help us along those lines?
>
> On Tue, Apr 20, 2010 at 4:12 AM, Maciej Stachowiak <mjs at apple.com> wrote:
>>
>> On Apr 20, 2010, at 3:32 AM, Fumitoshi Ukai (鵜飼文敏) wrote:
>>
>> I'm implementing new protocol of WebSocket
>> ( http://www.whatwg.org/specs/web-socket-protocol/ ).
>> Since it now requires MD5 in handshake, I wonder how I could add MD5 in
>> WebCore.  For now, there is no MD5 in WebCore.  It is in
>> WebKitTools/DumpRenderTree to get message digest of image file.
>> I'm thinking to add new header file as WebCore/platform/MD5.h, which
>> provides the following functions.
>>   struct MD5_CTX;
>>   void MD5_Init(MD5_CTX*);
>>   void MD5_Update(MD5_CTX*, unsigned char* input, unsigned length);
>>   void MD5_Final(unsigned char hash[16], MD5_CTX*);
>> In Windows platform, it is implemented using "Cryptdll.dll".   Is it ok to
>> copy WebKitTools/DumpRenderTree/win/MD5.cpp to WebCore/platform/win/MD5.cpp,
>> or move?
>> In Mac platform, it is provided by <CommonCrypto/CommonDigest.h> with
>> #define COMMON_DIGEST_FOR_OPENSSL ?
>> In Chromium, there is chrome/src/base/md5.{h,cc}.   Should I copy this in
>> WebCore/platform/chromium, or add dependency to base from WebCore?
>> How about other ports?  is it ok to link openssl or some other library?
>>  (or use implementation used in chromium?)
>> I'm also wonder I need to put these functions in namespace WebCore.
>>
>> If you put this code in WebCore, it should go in the WebCore namespace. I
>> think it would also be a good idea to turn the API into something more
>> WebCore-ish, something like:
>> namespace WebCore {
>>     class MD5 {
>>         MD5(); // what was MD5_Init
>>         addBytes(uint8_t* input, size_t length); // what was MD5_Update ;
>> or maybe this should take a Vector<uint8_t>?
>>         Vector<uint8_t, 16> checksum(); // what was MD5_Final
>>     };
>> }
>> (The key point being to match the coding style guidelines for names, but
>> it also seems better to use a class here instead of a struct and functions
>> that take a pointer to it.)
>> Regards,
>> Maciej
>>
>> _______________________________________________
>> webkit-dev mailing list
>> webkit-dev at lists.webkit.org
>> http://lists.webkit.org/mailman/listinfo.cgi/webkit-dev
>>
>
>
> _______________________________________________
> webkit-dev mailing list
> webkit-dev at lists.webkit.org
> http://lists.webkit.org/mailman/listinfo.cgi/webkit-dev
>
>