Re: new crypt implementation, latest DES version used, blowfish support

hi! A quick note about this patch: Alexander Peslyak (Solar designer), the author of the Blowfish implementation and known security expert, was kind enough to review my code and point me to a better implementation of the DES (his revision of the FreeSec code). It does not use any locking mechanism (being fully reentrant), provides extended DES support (not only standard) and is under BSD license (always preferable than the lgpl one we used until now). Updated code is available here (same links): [1] http://pierre.libgd.org/patches/php_5_3_crypt_win32.patch.txt [2] http://pierre.libgd.org/patches/crypt20080720.zip I have used some locking mechanism as I'm really not sure that the following code is TS: static volatile sig_atomic_t initialized = 0; if (initialized) return; __libc_lock_lock(_crypt_extended_init_lock); // EnterCriticalSection if (!initialized) { _crypt_extended_init(); initialized = 1; } //LeaveCriticalSection VC compilers may generate code that will work in a synced manner but many documentation refer to this feature as non thread safe. Java's volatile does work well in threaded environments (multi CPUs as well) but it is far from obvious for C or C++, it depends strongly on the compiler, the thread library being used and the platform. A good explanation: https://www.securecoding.cert.org/confluence/display/seccode/SIG02-C.+Avoid+using+signals+to+implement+normal+functionality Any advice or comments are welcome :) What do you think about enabling Blowfish and extended DES for the unix as well (when the libc does not have them obviously)? Cheers, -- Pierre http://blog.thepimp.net | http://www.libgd.org