> On 20 Feb 2024, at 13:40, Peter Eisentraut <pe...@eisentraut.org> wrote: > > On 20.02.24 12:39, Daniel Gustafsson wrote: >> A fifth option is to throw away our in-tree implementations and use the >> OpenSSL >> API's for everything, which is where this thread started. If the effort to >> payoff ratio is palatable to anyone then patches are for sure welcome. > > The problem is that, as I understand it, these crypt routines are not > designed in a way that you can just plug in a crypto library underneath. > Effectively, the definition of what, say, blowfish crypt does, is whatever is > in that source file, and transitively, whatever OpenBSD does.
I don't disagree, but if the OP is willing to take a stab at it then.. > (Fun question: Does OpenBSD care about FIPS?) No, LibreSSL ripped out FIPS support early on. > Of course, you could reimplement the same algorithms independently, using > OpenSSL or whatever. But I don't think this will really improve the state of > the world in aggregate, because to a large degree we are relying on the > upstream to keep these implementations maintained, and if we rewrite them, we > become the upstream. As a sidenote, we are already trailing behind upstream on this, the patch in [0] sits on my TODO, but given the lack of complaints over the years it's not been bumped to the top. -- Daniel Gustafsson [0] https://www.postgresql.org/message-id/flat/CAA-7PziyARoKi_9e2xdC75RJ068XPVk1CHDDdscu2BGrPuW9TQ%40mail.gmail.com#b20783dd6c72e95a8a0f6464d1228ed5
