Re: Crypto problems again

[Simon Josefsson <jas@extundo.com>]

Lars Magne Ingebrigtsen <larsi@gnus.org> writes:

> Lars Magne Ingebrigtsen <larsi@gnus.org> writes:
>
>> Simon Josefsson <jas@extundo.com> writes:
>>
>>> What's the definition of crypto code?  For example, does an elisp
>>> wrapper around GnuTLS count?  A wrapper around GnuPG?  Emacs contains
>>> a MD5 implementation in C, is it "crypto"?  Or MD4, SHA-1?  Are
>>> authentication mechanisms based on hashing, like CRAM-MD5, "crypto"?
>>
>> Ok; I'll ask RMS...
>
> And here's the response from RMS:
>
> ----------
>
>     What's the definition of crypto code? 
>
> I will explain how I understand the matter.  However, why ask me when
> you can learn from experts?  There must be web sites that explain this
> issue in detail.  I don't know which sites, but you can find them more
> easily than I can.

Anyone?  Preferably authoritative information from a governmental
department or so.

> 					   For example, does an elisp
>     wrapper around GnuTLS count?
>
> Yes.

This implies several modifications, for example to imap.el.  I don't
think I'll be able to look into this soonish.  If someone else wants
to look into this, I could probably find the time to review a proposed
patch for any (non-intended) negative effects.

> 								Are
>     authentication mechanisms based on hashing, like CRAM-MD5, "crypto"?
>
> Authentication does not count as encryption.

So our new SASL library is not a problem, I think.  OTOH, some
mechanisms (NTLM?) might use encryption as part of the authentication.
Does that count?  Even if it is weak encryption?  (56-bit DES.)