CryptoAPI

[Dan Kegel]

Travis Michielsen wrote:
> I was going to start implementing the Cypto API (in advapi32.dll) over the
> next few weeks.  As of yet these functions are no more than stubs.  However,
> I am finding increased use of this API as more applications becomed
> networkable and relying more heavily on internet connections.
> 
> I was hoping to implement these functions by using the OpenSSL library
> (if/when available).  This library seems to have similar capabilities.
> 
> One of my concerns is about legal issues.  What special concerns should I
> note about cryptographic software?  Are there any special copyright issues I
> should be aware of?

OpenSSL appears to have a very liberal license -- the only restriction
is that you have to credit the original author.  So it's like the original
BSD licenses.
 
> Another question is about design.  M$ seems to split the cryptographic
> software into different dlls (rsabase.dll, rsasig.dll, dssbase.dll, etc.).
> Should I do this as well so that, applications can use the native dlls if
> necessary or should I simply implement it entirely though advapi32.dll which
> and avoid the need to create several new (and very small) dlls under wine?
> Because most of the code is already in another library (OpenSSL) creating
> extra dlls seems abit unnecessary.

Depends on whether any real world apps use those individual DLL's.
If not, then you're free to combine them all.

Another question is whether to statically link in OpenSSL, or
use dynamic linking (early or late).

I'm very interested in OpenSSL stuff, and have integrated OpenSSL support
into a nonblocking server at work.  I found the OpenSSL list very helpful.

- Dan

-- 
"I have seen the future, and it licks itself clean." -- Bucky Katt