On 20.02.24 12:39, Daniel Gustafsson wrote:
> A fifth option is to throw away our in-tree implementations and use the OpenSSL
> API's for everything, which is where this thread started. If the effort to
> payoff ratio is palatable to anyone then patches are for sure welcome.
The problem is that, as I understand it, these crypt routines are not
designed in a way that you can just plug in a crypto library underneath.
Effectively, the definition of what, say, blowfish crypt does, is
whatever is in that source file, and transitively, whatever OpenBSD
does. (Fun question: Does OpenBSD care about FIPS?) Of course, you
could reimplement the same algorithms independently, using OpenSSL or
whatever. But I don't think this will really improve the state of the
world in aggregate, because to a large degree we are relying on the
upstream to keep these implementations maintained, and if we rewrite
them, we become the upstream.