[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110107023444.GA11873@openwall.com>
Date: Fri, 7 Jan 2011 05:34:44 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: hmailserver patch has errors, error when compiling in Linux x86 64-bit and 32-bit
Robert, James -
On Thu, Jan 06, 2011 at 09:08:18PM -0500, Robert Harris wrote:
> Why is the jumbo patch so dependent on such an old version of openssl?
It is not. This is a minimum version requirement, not an exact version
requirement. You should also be able to build with 0.9.8 and newer (and
I think you did on your Cygwin).
> It looks like OpenSSL 0.9.7 was first outdated in July 2005.
In a sense, yes. Upstream support for 0.9.7 ended in 2007. Yes, we
need to update to 1.0.0+ in Owl-current - this is planned. For the
Owl 3.0 release, this change would potentially make the system less
"stable" overall, so we chose to postpone it. We did not have enough
resources (people's time) for all desired package updates in 2007-2009,
and in 2010 it was too late (we wanted to release the stable stuff
that we happened to readily have).
Yes, this means that we're the ones to backport any important security
fixes (or reuse other distros' backports) in Owl 3.0-stable. We're
quite used to that. We already have some security fix backports in our
0.9.7m-based package. In fact, our use of an older branch of OpenSSL
happened to save us from some vulnerabilities (that were only introduced
in later versions).
> What is the process/level of effort to get JtR using the latest versions of
> Openssl?
No process, no effort. It just works. It's just not great to require
those newer versions yet, so the jumbo patches released so far only
require 0.9.7+ and I am unhappy about changing that to 0.9.8+ just yet.
That's irrespective of Owl's version of OpenSSL. There are other
systems still in use that only have 0.9.7.
> What do you want to do to resolve/How do you want to handle the current
> "issue" with the hmailserver patch?
I might look into including a SHA-256 implementation along with this
patch when I consider merging this into the jumbo patch. Or add a
compile-time OpenSSL version check, excluding some "formats" on older
versions. Or not merge.
I think that there are fewer users of the jumbo patch who would benefit
from integrated hmailserver support than those who would be
inconvenienced by the requirement of 0.9.8+. So simply merging the
patch would be bad overall (at this time).
If/when we have more "formats", including some more popular ones, that
also need 0.9.8+ for some reason, then this could be a reason to
introduce this requirement (and merge the hmailserver patch as well).
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
