[Webkit-unassigned] [Bug 162913] [GTK][EFL] CryptoDigest implementation depends on GnuTLS with LGPLv3+/GPLv2+ deps

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=162913

--- Comment #4 from Carlos Alberto Lopez Perez <clopez at igalia.com> ---
(In reply to comment #3)
> Note that we seem to agree that libgcrypt is the best option if we add a new
> dependency.
> 
> However, Zan notes that WTF has its own implementation of SHA-1, and we
> could probably roll our own SHA-2 as well, which together would be
> sufficient to replace all GnuTLS functionality used by CryptoDigest. This
> would probably be ideal.
> 


Here are c++ public-domain implementations of sha-2 https://github.com/kalven/sha-2

Avoid adding an extra dependency will be my preferred option. Specially if is only for something as simple as computing sha1/sha2 hashes.

Perhaps the SubtleCrypto code can be replace with a libgcrypt implementation. 

And then the code for CSP code can use the hash functions from SubtleCrypto if this was selected at build time. Otherwise it can fall back to our simple/non-optimized internal implementations of sha-1/sha-2.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20161005/758b96b9/attachment-0001.html>