[webkit-dev] MD5 in WebCore

[Jeremy Orlow]

Agreed.  Can you give us a pointer to the email thread this decision was
made on?

On Tue, Apr 20, 2010 at 12:12 PM, Alex Russell <slightlyoff at google.com>wrote:

> Hate to ask a dumb question, but why MD5? Isn't it on its last legs as
> a secure hash? New protocols should be avoiding it.
>
> On Tue, Apr 20, 2010 at 11:48 AM, Michael Nordman <michaeln at google.com>
> wrote:
> > In webcore, should we use the same impl on all platforms rather than use
> > cryptdll on windows and md5.cc elsewhere?
> > For chrome, I don't think we can have a dependency between
> > WebKit/WebKit/chromium and /src/base/, and 'base' depending on 'webkit'
> also
> > doesn't work. How can we avoid replicating the code? I guess having
> > webcore's MD5 be platform specific could help us along those lines?
> >
> > On Tue, Apr 20, 2010 at 4:12 AM, Maciej Stachowiak <mjs at apple.com>
> wrote:
> >>
> >> On Apr 20, 2010, at 3:32 AM, Fumitoshi Ukai (鵜飼文敏) wrote:
> >>
> >> I'm implementing new protocol of WebSocket
> >> ( http://www.whatwg.org/specs/web-socket-protocol/ ).
> >> Since it now requires MD5 in handshake, I wonder how I could add MD5 in
> >> WebCore.  For now, there is no MD5 in WebCore.  It is in
> >> WebKitTools/DumpRenderTree to get message digest of image file.
> >> I'm thinking to add new header file as WebCore/platform/MD5.h, which
> >> provides the following functions.
> >>   struct MD5_CTX;
> >>   void MD5_Init(MD5_CTX*);
> >>   void MD5_Update(MD5_CTX*, unsigned char* input, unsigned length);
> >>   void MD5_Final(unsigned char hash[16], MD5_CTX*);
> >> In Windows platform, it is implemented using "Cryptdll.dll".   Is it ok
> to
> >> copy WebKitTools/DumpRenderTree/win/MD5.cpp to
> WebCore/platform/win/MD5.cpp,
> >> or move?
> >> In Mac platform, it is provided by <CommonCrypto/CommonDigest.h> with
> >> #define COMMON_DIGEST_FOR_OPENSSL ?
> >> In Chromium, there is chrome/src/base/md5.{h,cc}.   Should I copy this
> in
> >> WebCore/platform/chromium, or add dependency to base from WebCore?
> >> How about other ports?  is it ok to link openssl or some other library?
> >>  (or use implementation used in chromium?)
> >> I'm also wonder I need to put these functions in namespace WebCore.
> >>
> >> If you put this code in WebCore, it should go in the WebCore namespace.
> I
> >> think it would also be a good idea to turn the API into something more
> >> WebCore-ish, something like:
> >> namespace WebCore {
> >>     class MD5 {
> >>         MD5(); // what was MD5_Init
> >>         addBytes(uint8_t* input, size_t length); // what was MD5_Update
> ;
> >> or maybe this should take a Vector<uint8_t>?
> >>         Vector<uint8_t, 16> checksum(); // what was MD5_Final
> >>     };
> >> }
> >> (The key point being to match the coding style guidelines for names, but
> >> it also seems better to use a class here instead of a struct and
> functions
> >> that take a pointer to it.)
> >> Regards,
> >> Maciej
> >>
> >> _______________________________________________
> >> webkit-dev mailing list
> >> webkit-dev at lists.webkit.org
> >> http://lists.webkit.org/mailman/listinfo.cgi/webkit-dev
> >>
> >
> >
> > _______________________________________________
> > webkit-dev mailing list
> > webkit-dev at lists.webkit.org
> > http://lists.webkit.org/mailman/listinfo.cgi/webkit-dev
> >
> >
> _______________________________________________
> webkit-dev mailing list
> webkit-dev at lists.webkit.org
> http://lists.webkit.org/mailman/listinfo.cgi/webkit-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-dev/attachments/20100420/21e5f889/attachment.html>