Cryptography in the main image and Plugins build for the VMs

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
7 messages Options
Reply | Threaded
Open this post in threaded view
|

Cryptography in the main image and Plugins build for the VMs

Rob Withers
 
Hi all,

I would like to propose that Cryptography be included as part of the image,
by default.  As it stands now it is in the Cryptography repository, which
most don't seem to know about or there are one-off copies that are developed
separately.  David Shaffer has been stewarding a reintegration of these
forks and ensuring the tests pass.  Everyone should be able to take
advantage of the algorithms provided by the Cryptography package.

Along the same lines, it would be a great help for the vm providers to
include the CryptographyPlugins when they build a new vm.  I believe there
are 3 plugins and they really ought to be build internally, since they are
unchanging.

I would like to hear what others think of the possibility of making this
change.

Thank you,
Rob
 

Reply | Threaded
Open this post in threaded view
|

Re: Cryptography in the main image and Plugins build for the VMs

Casey Ransberger-2

Seems like a good Community Supported Package.

On Jul 8, 2010, at 2:07 AM, "Rob Withers" <[hidden email]> wrote:

> Hi all,
>
> I would like to propose that Cryptography be included as part of the image, by default.  As it stands now it is in the Cryptography repository, which most don't seem to know about or there are one-off copies that are developed separately.  David Shaffer has been stewarding a reintegration of these forks and ensuring the tests pass.  Everyone should be able to take advantage of the algorithms provided by the Cryptography package.
>
> Along the same lines, it would be a great help for the vm providers to include the CryptographyPlugins when they build a new vm.  I believe there are 3 plugins and they really ought to be build internally, since they are unchanging.
>
> I would like to hear what others think of the possibility of making this change.
>
> Thank you,
> Rob
>
Reply | Threaded
Open this post in threaded view
|

Re: Cryptography in the main image and Plugins build for the VMs

Steve Wart-2
In reply to this post by Rob Withers

Given that cryptography still faces export restrictions, would this
cause problems for OSS distributions that want to include Squeak?

Also I'm not sure that people who want to minimize their image size
would benefit. Why can't Cryptography be easily loaded by people who
need it?

Steve

On Thu, Jul 8, 2010 at 2:07 AM, Rob Withers <[hidden email]> wrote:

>
> Hi all,
>
> I would like to propose that Cryptography be included as part of the image,
> by default.  As it stands now it is in the Cryptography repository, which
> most don't seem to know about or there are one-off copies that are developed
> separately.  David Shaffer has been stewarding a reintegration of these
> forks and ensuring the tests pass.  Everyone should be able to take
> advantage of the algorithms provided by the Cryptography package.
>
> Along the same lines, it would be a great help for the vm providers to
> include the CryptographyPlugins when they build a new vm.  I believe there
> are 3 plugins and they really ought to be build internally, since they are
> unchanging.
>
> I would like to hear what others think of the possibility of making this
> change.
>
> Thank you,
> Rob
>
>
>
Reply | Threaded
Open this post in threaded view
|

Re: Cryptography in the main image and Plugins build for theVMs

Rob Withers
 

--------------------------------------------------
From: "Steve Wart" <[hidden email]>
Sent: Thursday, July 08, 2010 7:50 PM
To: "Squeak Virtual Machine Development Discussion"
<[hidden email]>
Cc: "Squeak Crypto" <[hidden email]>; "Squeak Dev"
<[hidden email]>
Subject: Re: [Vm-dev] Cryptography in the main image and Plugins build for
theVMs

>
> Given that cryptography still faces export restrictions, would this
> cause problems for OSS distributions that want to include Squeak?
>

I am not familiar with which pieces of Cryptography are export restricted
and which are not.   According to the Java SDK Crypto docs
(http://download.oracle.com/docs/cd/E17476_01/javase/1.4.2/docs/guide/security/CryptoSpec.html#Architecture)
DSA, MD5 and SHA-1 are at least distributable.  This obviously reduces the
attractiveness of including Crypto in the image, were we to have to split
the package into exportable and non-exportable packages.

> Also I'm not sure that people who want to minimize their image size
> would benefit. Why can't Cryptography be easily loaded by people who
> need it?

People may not know where it resides.  It is not a part of the trunk.  It is
in a SqueakSource repository.

Thanks,
Rob

>
> Steve
>
> On Thu, Jul 8, 2010 at 2:07 AM, Rob Withers <[hidden email]> wrote:
>>
>> Hi all,
>>
>> I would like to propose that Cryptography be included as part of the
>> image,
>> by default.  As it stands now it is in the Cryptography repository, which
>> most don't seem to know about or there are one-off copies that are
>> developed
>> separately.  David Shaffer has been stewarding a reintegration of these
>> forks and ensuring the tests pass.  Everyone should be able to take
>> advantage of the algorithms provided by the Cryptography package.
>>
>> Along the same lines, it would be a great help for the vm providers to
>> include the CryptographyPlugins when they build a new vm.  I believe
>> there
>> are 3 plugins and they really ought to be build internally, since they
>> are
>> unchanging.
>>
>> I would like to hear what others think of the possibility of making this
>> change.
>>
>> Thank you,
>> Rob
>>
>>
>>
Reply | Threaded
Open this post in threaded view
|

Re: Cryptography in the main image and Plugins build for the VMs

David T. Lewis
In reply to this post by Rob Withers
 
On Thu, Jul 08, 2010 at 05:07:29AM -0400, Rob Withers wrote:

<snip>

> Along the same lines, it would be a great help for the vm providers to
> include the CryptographyPlugins when they build a new vm.  I believe there
> are 3 plugins and they really ought to be build internally, since they are
> unchanging.

Hi Rob,

With respect to the plugins (and I know this was discussed in earlier
emails) can you please provide a link to the SqueakSource repository for
the three plugins? We can add this to the VMMaker configuration map and
to ConfigurationOfVMMaker so they will be easily loaded into VM development
images.

Assuming no legal issues, I would expect that the plugins can be included
in future VM builds without difficulty (at the discretion of the platform
maintainers of course). BTW, don't worry about internal versus external,
that's a packaging issue, and if there is any concern about legal issues
(real or imagined) it will probably be best to make them external modules
for the benefit of folks who may be concerned about such things.

Thanks,
Dave

Reply | Threaded
Open this post in threaded view
|

Re: Cryptography in the main image and Plugins build for theVMs

Rob Withers
 
--------------------------------------------------
From: "David T. Lewis" <[hidden email]>
Sent: Thursday, July 08, 2010 10:26 PM
To: "Squeak Virtual Machine Development Discussion"
<[hidden email]>
Cc: "Squeak Crypto" <[hidden email]>; "Squeak Dev"
<[hidden email]>
Subject: Re: [Vm-dev] Cryptography in the main image and Plugins build for
theVMs

>
> On Thu, Jul 08, 2010 at 05:07:29AM -0400, Rob Withers wrote:
>
> <snip>
>
>> Along the same lines, it would be a great help for the vm providers to
>> include the CryptographyPlugins when they build a new vm.  I believe
>> there
>> are 3 plugins and they really ought to be build internally, since they
>> are
>> unchanging.
>
> Hi Rob,
>
> With respect to the plugins (and I know this was discussed in earlier
> emails) can you please provide a link to the SqueakSource repository for
> the three plugins? We can add this to the VMMaker configuration map and
> to ConfigurationOfVMMaker so they will be easily loaded into VM
> development
> images.
>
> Assuming no legal issues, I would expect that the plugins can be included
> in future VM builds without difficulty (at the discretion of the platform
> maintainers of course). BTW, don't worry about internal versus external,
> that's a packaging issue, and if there is any concern about legal issues
> (real or imagined) it will probably be best to make them external modules
> for the benefit of folks who may be concerned about such things.
>
> Thanks,
> Dave

Hi Dave,

Thanks, this would be great!  The repository containing the Crypto plugins
is:

MCHttpRepository
        location: 'http://www.squeaksource.com/Cryptography'
        user: ''
        password: ''

The package is CryptographyPlugins, newly created.

There are 4 plugins: DESPlugin, DSAPlugin, MD5Plugin, and  SHA256Plugin.
Under the relaxation in export restrictions in 2000, all of these are
exportable.

Thanks,
Rob

>
Reply | Threaded
Open this post in threaded view
|

RE: [squeak-dev] Re: [Vm-dev] Cryptography in the main image andPlugins build for the VMs

Ron Teitelbaum
In reply to this post by Steve Wart-2

Hi All,

As a reminder we did register to allow US developers to contribute and for
anyone to download the code from SqueakSource (and google).
http://lists.squeakfoundation.org/pipermail/cryptography/2006-January/000121
.html

What this does not do is allow users to download the main image from
anywhere else.

http://forum.world.st/UPDATE-Notification-of-publicly-available-cryptography
-code-td133064.html

If we decide to make the code available in the main image then there are two
things to consider.  First it needs to be registered.  Second it could make
distributing Squeak more difficult for end users of Squeak in the United
States that want to send the code outside the US.  Downloading the code from
these locations from anywhere is allowed but downloading packaging and
sending your final product somewhere is not covered.

I am not a lawyer so please get proper legal advice before exporting any
cryptographic code.

All the best,

Ron Teitelbaum
Teleplace

> -----Original Message-----
> From: [hidden email] [mailto:squeak-dev-
> [hidden email]] On Behalf Of Miguel Enrique Cobá
> Martínez
> Sent: Friday, July 09, 2010 11:10 AM
> To: The general-purpose Squeak developers list
> Cc: Squeak Crypto; Squeak Virtual Machine Development Discussion
> Subject: Re: [squeak-dev] Re: [Vm-dev] Cryptography in the main image
> andPlugins build for the VMs
>
> El jue, 08-07-2010 a las 16:50 -0700, Steve Wart escribió:
> > Given that cryptography still faces export restrictions, would this
> > cause problems for OSS distributions that want to include Squeak?
>
> This is not true. Every linux distro comes with strong security. Nobody
> cares about export restrictions. I have downloaded from kernel.org that
> is located in USA. No problem.
>
> But if that is your concern, then you only need to put the cryptography
> package in a server outside the USA (Europe would be fine) and problem
> solved.
>
> But, that export restrictions are a problem that was solved a decade
> ago.
>
> Cheers
> >
> > Also I'm not sure that people who want to minimize their image size
> > would benefit. Why can't Cryptography be easily loaded by people who
> > need it?
> >
> > Steve
> >
> > On Thu, Jul 8, 2010 at 2:07 AM, Rob Withers <[hidden email]> wrote:
> > >
> > > Hi all,
> > >
> > > I would like to propose that Cryptography be included as part of the
> image,
> > > by default.  As it stands now it is in the Cryptography repository,
> which
> > > most don't seem to know about or there are one-off copies that are
> developed
> > > separately.  David Shaffer has been stewarding a reintegration of
> these
> > > forks and ensuring the tests pass.  Everyone should be able to take
> > > advantage of the algorithms provided by the Cryptography package.
> > >
> > > Along the same lines, it would be a great help for the vm providers to
> > > include the CryptographyPlugins when they build a new vm.  I believe
> there
> > > are 3 plugins and they really ought to be build internally, since they
> are
> > > unchanging.
> > >
> > > I would like to hear what others think of the possibility of making
> this
> > > change.
> > >
> > > Thank you,
> > > Rob
> > >
> > >
> > >
> >
>
> --
> Miguel Cobá
> http://miguel.leugim.com.mx
>