[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Not-so-mass bug filing for the patented IDEA algorithm

* Neil Williams:

> Which are the offending libraries?

Botan, Crypto++, BouncyCastle, a few Perl-related packages.

> Is this mass-bug-filing intended to be against the applications that
> link against the libraries or just the offending libraries
> themselves?

Just the libraries.  Debian's crypto libraries haven't got many
reverse dependencies anyway.  There's a slight chance that
BouncyCastle's PGP functionality is impacted.  (Old PGP is the only
de-facto standard that once promoted the adoption of IDEA.)

> Why do the upstream libraries contain an implementation of the
> algorithm in the first place?

In case of BouncyCastle, it's probably related to its PGP support.
The others include it purely for coverage, I guess.

> Or to prevent a SONAME bump, replace the function definition with a
> no-op/error.

No-op could be quite harmful.

Reply to: