From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/4159 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: [Feature Request] SHA-1 HMAC Date: Sat, 26 Oct 2013 14:38:05 -0400 Message-ID: <20131026183805.GP20515@brightrain.aerifal.cx> References: <20131026122848.GN1685@port70.net> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1382812695 24243 80.91.229.3 (26 Oct 2013 18:38:15 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 26 Oct 2013 18:38:15 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-4163-gllmg-musl=m.gmane.org@lists.openwall.com Sat Oct 26 20:38:20 2013 Return-path: Envelope-to: gllmg-musl@plane.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1Va8kd-0001HV-JP for gllmg-musl@plane.gmane.org; Sat, 26 Oct 2013 20:38:19 +0200 Original-Received: (qmail 18212 invoked by uid 550); 26 Oct 2013 18:38:18 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 18204 invoked from network); 26 Oct 2013 18:38:18 -0000 Content-Disposition: inline In-Reply-To: <20131026122848.GN1685@port70.net> User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:4159 Archived-At: On Sat, Oct 26, 2013 at 02:28:48PM +0200, Szabolcs Nagy wrote: > * Daniel Cegie?ka [2013-10-25 21:23:03 +0200]: > > Adding HMAC to musl doesn't make sense. This is only one C file, so > > why you just don't want to keep this in the sources of your software? > > including a source file is not optimal I think whether this is the case depends a lot on what you're doing. One question I always recommend asking is which will be larger and more work to maintain: the copied code, or the library glue? For use of a single hash function from a crypto lib with a complex API, just the glue code to setup and call the crypto lib is probably as large as the hash code. Then you have to consider also the build system. At this point we haven't even started considering the potential space for bugs, issues if someone uses a different implementation of the original crypto lib as a drop-in replacement for it (common with openssl), etc. So I think in this specific case, including the source file may actually be the optimal solution. Rich