[asterisk-dev] SHA1 and MD5 code?

[Tzafrir Cohen]

On Wed, Oct 12, 2011 at 06:22:52PM -0400, Paul Belanger wrote:
> On 11-10-12 05:57 PM, Jeffrey Ollie wrote:
> >On Wed, Oct 12, 2011 at 3:48 PM, Simon Perreault
> ><simon.perreault at viagenie.ca>  wrote:
> >>On 2011-10-12 16:15, Jeffrey Ollie wrote:
> >>>Is there a really good reason to keep SHA1 and MD5 code in the Asterisk source?
> >>
> >>You do know about the backdoor requirement, don't you?
> >
> >Well, yes of course, but by using OpenSSL we can use the same backdoor
> >that everyone else uses and we don't have to maintain our own :) :)
> >
> +1 for not having to maintain our own version (plus is keeps package
> maintainers happy).  However, I'm not skilled enough to determine
> the impact to asterisk.

One note: main/sha1.c would technically be simple to replace, as it is
only used in a single function (main/utils.c:ast_sha1_hash() ).

The MD5 code from main/md5.c is used directly in a number of places:

$ grep 'md5\.h' */*.c
apps/app_festival.c:#include "asterisk/md5.h"        # Single
channels/chan_iax2.c:#include "asterisk/md5.h"       # Single, Double
channels/iax2-provision.c:#include "asterisk/md5.h"  # Single
main/loader.c:#include "asterisk/md5.h"              # Single
main/manager.c:#include "asterisk/md5.h"             # Double
main/md5.c:#include "asterisk/md5.h"
main/utils.c:#include "asterisk/md5.h"               # Single
pbx/pbx_dundi.c:#include "asterisk/md5.h"            # None
pbx/pbx_loopback.c:#include "asterisk/md5.h"         # None
pbx/pbx_realtime.c:#include "asterisk/md5.h"         # None
res/res_crypto.c:#include "asterisk/md5.h"           # File
res/res_jabber.c:#include "asterisk/md5.h"           # None
utils/astman.c:#include "asterisk/md5.h"             # Double

Single: only the following series of calls:

  MD5Init
  MD5Update
  MD5Final

Double: Similar, but calling MD5Update twice

File: Similar, but reads the whole contents of a file (length not known
      in advance

-- 
               Tzafrir Cohen
icq#16849755              jabber:tzafrir.cohen at xorcom.com
+972-50-7952406           mailto:tzafrir.cohen at xorcom.com
http://www.xorcom.com  iax:guest at local.xorcom.com/tzafrir