You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@couchdb.apache.org by Curt Arnold <ca...@apache.org> on 2009/08/18 01:37:08 UTC
Cryptography in CouchDB
I don't know if it predates the recent OAuth patch, but I believe the
CouchDB now requires an export notice to be filed. The export
notification should have been filed before crypto related code was
committed. I do not know if there is a procedure to follow when the
export notice is not filed beforehand.
See http://www.apache.org/dev/crypto.html and http://www.apache.org/licenses/exports/
It should have dawned on me earlier, but I stumbled upon it when I
built Erlang R13B01 from source without previously installing libssl-
dev. Erlang and CouchDB would build successfully, but CouchDB would
fail on start up. Surprised me that CouchDB requires ssl to launch.
Re: Cryptography in CouchDB
Posted by Paul Davis <pa...@gmail.com>.
Looking through quickly, it looks like we hit on this clause:
> If my project ships a binary that provides bindings to OpenSSL, but does not include its source or binaries, what notifications must be made?
>
> The only required notification for an Apache project that is specially designed to use, but doesn't include, such crypto, is just the notification for the ASF product code.
I haven't the slightest what that means though. We need to add a
notice about something or other?
On Mon, Aug 17, 2009 at 7:37 PM, Curt Arnold<ca...@apache.org> wrote:
> I don't know if it predates the recent OAuth patch, but I believe the
> CouchDB now requires an export notice to be filed. The export notification
> should have been filed before crypto related code was committed. I do not
> know if there is a procedure to follow when the export notice is not filed
> beforehand.
>
> See http://www.apache.org/dev/crypto.html and
> http://www.apache.org/licenses/exports/
>
> It should have dawned on me earlier, but I stumbled upon it when I built
> Erlang R13B01 from source without previously installing libssl-dev. Erlang
> and CouchDB would build successfully, but CouchDB would fail on start up.
> Surprised me that CouchDB requires ssl to launch.
>
>
>
Re: Cryptography in CouchDB
Posted by Paul Davis <pa...@gmail.com>.
On Tue, Aug 18, 2009 at 1:16 AM, Curt Arnold<ca...@apache.org> wrote:
>
> On Aug 17, 2009, at 6:45 PM, Damien Katz wrote:
>
>> I don't think it's necessary as we aren't encrypting anything. We do use
>> the crypto library, but only for generating random UUIDs.
>>
>> -Damien
>>
>
> Probably should have used "suspect" or "concerned" or something more
> speculative. Noticing that CouchDB would not start on an Erlang runtime
> without openssl was a bit jarring. OAuth would also seem to be have a
> significant likelihood of incorporating encryption. Those two facts seemed
> to warrant a message.
>
It is a bit odd. But like Damien says, the only calls to SSL are
crypto:rand_bytes(16) which AFAIK is basically a mask to the best
random number generator supported. It definitely does seem odd.
> The whole export license stuff is an quagmire that I've taken pains to
> avoid. Definitely think that you should check with legal-discuss if you
> have any questions.
>
> erlang_oauth has a module named oauth_rsa_sha1 which makes me suspect that
> it would need an export declaration.
>
All of the cryptographic functionality it uses is supported by Erlang
stdlib modules. I actually stopped this from building because its only
supported on newer versions of Erlang and we weren't using it so it
gets even more fun in that regard.
> The following code snippet from couch_http_oauth.erl
>
> consumer_lookup(Key, MethodStr) ->
> SignatureMethod = case MethodStr of
> "PLAINTEXT" -> plaintext;
> "HMAC-SHA1" -> hmac_sha1;
> %"RSA-SHA1" -> rsa_sha1;
> _Else -> undefined
>
> appears to be at aware of specific encryption method.
>
>
> I also ran into this little snippet in couch_util.erl:
>
> %%% Purpose : Base 64 encoding and decoding.
> %%% Copied from ssl_base_64 to avoid using the
> %%% erlang ssl library
>
> If there is a required dependency on ssl elsewhere, the duplicated code
> probably should be eliminated. Also, the "license notice" doesn't give me
> much confidence.
>
>
> FYI: Encryption notice for Erlang ssl:
> http://erlang.org/doc/apps/ssl/index.html
>
> My wild guess is that the previous CouchDB releases did not need an export
> or cryptography notice if all they did was use the random number generator
> from the SSL module. erlang_oauth and couch_http_oauth seem to be aware
> of cryptographic methods which my reading means that they require some
> action, but exactly what I'm uncertain.
>
Its weird cause they're aware, but aren't built, though if build would
use Erlang provided crypto functions. I'm pretty sure the HMAC stuff
is just SHA1 which the FAQ said isn't cryptographic. If no one
volunteers for legal-discuss duty I'll put it on the list for
tomorrow.
Thanks for catching that. It never would've crossed my mind to check
cryptographic exports since we're not the ones implementing or
distributing it.
Paul Davis
Re: Cryptography in CouchDB
Posted by Damien Katz <da...@apache.org>.
On Aug 24, 2009, at 4:08 AM, Bernd Fondermann wrote:
> On Sun, Aug 23, 2009 at 16:23, Damien Katz<da...@apache.org> wrote:
>> Based on similar HTTP client libraries, it looks like we do need
>> the export
>> restrictions, which really bums me out.
>>
>> I'll take care of this next week.
>
> It's not that bad I think.
> (Thankfully, I'm not living under U.S. legislation, plus I am not a
> lawyer, but) as I understand it, anyone exporting software from the
> U.S. is subject to these regulations related to cryptography etc. What
> the ASF provides is just a /classification/ to help our users see
> where these regulations might apply. They have to check for themselves
> anyway when they export. So the notification which is filed with US
> administration does not restrict distribution of CouchDB any more than
> it is restricted anyway without the notification.
>
> The process is as lean as can be: just one patch to an xml file +
> one email.
> People at infra or legal should be able to help you out, our just feel
> free to contact me if you need help with this.
>
> Relax,
>
> Bernd
I just did it, and it wasn't too hard at all :) Thanks for the offer
of help anyway Bernd.
-Damien
>
>>
>> -Damien
>>
>> On Aug 20, 2009, at 12:42 AM, Curt Arnold wrote:
>>
>>> ibrowse_http_client would also look like a potential area of
>>> concern, it
>>> contains calls to ssl:connect and has other code specific to ssl
>>> connections. Likely would not be an issue for CouchDB if we weren't
>>> redistributing it.
>>
>>
Re: Cryptography in CouchDB
Posted by Bernd Fondermann <be...@googlemail.com>.
On Sun, Aug 23, 2009 at 16:23, Damien Katz<da...@apache.org> wrote:
> Based on similar HTTP client libraries, it looks like we do need the export
> restrictions, which really bums me out.
>
> I'll take care of this next week.
It's not that bad I think.
(Thankfully, I'm not living under U.S. legislation, plus I am not a
lawyer, but) as I understand it, anyone exporting software from the
U.S. is subject to these regulations related to cryptography etc. What
the ASF provides is just a /classification/ to help our users see
where these regulations might apply. They have to check for themselves
anyway when they export. So the notification which is filed with US
administration does not restrict distribution of CouchDB any more than
it is restricted anyway without the notification.
The process is as lean as can be: just one patch to an xml file + one email.
People at infra or legal should be able to help you out, our just feel
free to contact me if you need help with this.
Relax,
Bernd
>
> -Damien
>
> On Aug 20, 2009, at 12:42 AM, Curt Arnold wrote:
>
>> ibrowse_http_client would also look like a potential area of concern, it
>> contains calls to ssl:connect and has other code specific to ssl
>> connections. Likely would not be an issue for CouchDB if we weren't
>> redistributing it.
>
>
Re: Cryptography in CouchDB
Posted by Damien Katz <da...@apache.org>.
Based on similar HTTP client libraries, it looks like we do need the
export restrictions, which really bums me out.
I'll take care of this next week.
-Damien
On Aug 20, 2009, at 12:42 AM, Curt Arnold wrote:
> ibrowse_http_client would also look like a potential area of
> concern, it contains calls to ssl:connect and has other code
> specific to ssl connections. Likely would not be an issue for
> CouchDB if we weren't redistributing it.
Re: Cryptography in CouchDB
Posted by Curt Arnold <ca...@apache.org>.
ibrowse_http_client would also look like a potential area of concern,
it contains calls to ssl:connect and has other code specific to ssl
connections. Likely would not be an issue for CouchDB if we weren't
redistributing it.
Re: Cryptography in CouchDB
Posted by Damien Katz <da...@apache.org>.
What call to priv_key? Do you mean the calls to pubic_key? As far as I
can tell we are only validating signatures.
"specially designed to work with any other 5D002 item"
We aren't specially designed to work with encryption, we are just
using some code that happens to be bundled with an encryption library,
but isn't encrypting anything.
-Damien
On Aug 19, 2009, at 3:56 PM, Paul Davis wrote:
> Damien,
>
> Quoting the answer to "What are examples of when a crypto item is
> publicly accessible through ASF servers?" at [1]:
>
> The less obvious example, is the point at which a subversion
> repository starts to include code that is specially designed to work
> with any other 5D002 item, whether that item is ever to be included
> within a product distribution or not.
>
> [1] http://www.apache.org/dev/crypto.html
>
> The calls to crypto are arguable. The calls to priv_key are not.
>
> Paul
>
> On Wed, Aug 19, 2009 at 3:30 PM, Damien Katz<da...@apache.org> wrote:
>> I disagree. I don't think why we need to remove calls to code that
>> doesn't
>> encrypt anything. It doesn't matter that we have a dependency on
>> the erlang
>> crypto lib, we simply aren't encrypting, or enabling encrypting.
>>
>> -Damien
>>
>> On Aug 19, 2009, at 3:07 PM, Paul Davis wrote:
>>
>>> Between William's response and reading the crypto page, I'm fairly
>>> certain that we either need to remove all calls to the priv_key and
>>> crypto modules from SVN or add the NOTICE.
>>>
>>> I'd vote for avoiding the export restrictions, but I'm pretty sure
>>> that we're gonna need to do something.
>>>
>>> Paul
>>>
>>> On Wed, Aug 19, 2009 at 2:55 PM, Damien Katz<da...@apache.org>
>>> wrote:
>>>>
>>>> There is no encryption inside of CouchDB and, there are no plans
>>>> to add
>>>> encryption functionality.
>>>>
>>>> I'd rather not add export restrictions if it's unnecessary, since
>>>> it is
>>>> intended to limit who can use it.
>>>>
>>>> -Damien
>>>>
>>>> On Aug 19, 2009, at 2:40 PM, Paul Davis wrote:
>>>>
>>>>> Damien,
>>>>>
>>>>> Looks like legal-discuss is suggesting that we fill out the
>>>>> notices
>>>>> [1]. The instructions [2] don't appear overly complicated but it
>>>>> does
>>>>> appear that you're the only one with the proper authority to
>>>>> make the
>>>>> updates to different web pages.
>>>>>
>>>>> Paul
>>>>>
>>>>> [1]
>>>>>
>>>>> http://mail-archives.apache.org/mod_mbox/www-legal-discuss/200908.mbox/%3c4A8C2657.1090303@rowe-clan.net%3e
>>>>> [2] http://www.apache.org/dev/crypto.html
>>>>>
>>>>> On Tue, Aug 18, 2009 at 1:49 PM, Damien Katz<da...@apache.org>
>>>>> wrote:
>>>>>>
>>>>>> On Aug 17, 2009, at 10:16 PM, Curt Arnold wrote:
>>>>>>
>>>>>>>
>>>>>>> On Aug 17, 2009, at 6:45 PM, Damien Katz wrote:
>>>>>>>
>>>>>>>> I don't think it's necessary as we aren't encrypting
>>>>>>>> anything. We do
>>>>>>>> use
>>>>>>>> the crypto library, but only for generating random UUIDs.
>>>>>>>>
>>>>>>>> -Damien
>>>>>>>>
>>>>>>>
>>>>>>> Probably should have used "suspect" or "concerned" or
>>>>>>> something more
>>>>>>> speculative. Noticing that CouchDB would not start on an Erlang
>>>>>>> runtime
>>>>>>> without openssl was a bit jarring. OAuth would also seem to be
>>>>>>> have a
>>>>>>> significant likelihood of incorporating encryption. Those two
>>>>>>> facts
>>>>>>> seemed
>>>>>>> to warrant a message.
>>>>>>>
>>>>>>> The whole export license stuff is an quagmire that I've taken
>>>>>>> pains to
>>>>>>> avoid. Definitely think that you should check with legal-
>>>>>>> discuss if
>>>>>>> you
>>>>>>> have any questions.
>>>>>>>
>>>>>>> erlang_oauth has a module named oauth_rsa_sha1 which makes me
>>>>>>> suspect
>>>>>>> that
>>>>>>> it would need an export declaration.
>>>>>>>
>>>>>>> The following code snippet from couch_http_oauth.erl
>>>>>>>
>>>>>>> consumer_lookup(Key, MethodStr) ->
>>>>>>> SignatureMethod = case MethodStr of
>>>>>>> "PLAINTEXT" -> plaintext;
>>>>>>> "HMAC-SHA1" -> hmac_sha1;
>>>>>>> %"RSA-SHA1" -> rsa_sha1;
>>>>>>> _Else -> undefined
>>>>>>>
>>>>>>> appears to be at aware of specific encryption method.
>>>>>>>
>>>>>>>
>>>>>>> I also ran into this little snippet in couch_util.erl:
>>>>>>>
>>>>>>> %%% Purpose : Base 64 encoding and decoding.
>>>>>>> %%% Copied from ssl_base_64 to avoid using the
>>>>>>> %%% erlang ssl library
>>>>>>>
>>>>>>> If there is a required dependency on ssl elsewhere, the
>>>>>>> duplicated
>>>>>>> code
>>>>>>> probably should be eliminated. Also, the "license notice"
>>>>>>> doesn't
>>>>>>> give
>>>>>>> me
>>>>>>> much confidence.
>>>>>>>
>>>>>>>
>>>>>>> FYI: Encryption notice for Erlang ssl:
>>>>>>> http://erlang.org/doc/apps/ssl/index.html
>>>>>>>
>>>>>>> My wild guess is that the previous CouchDB releases did not
>>>>>>> need an
>>>>>>> export
>>>>>>> or cryptography notice if all they did was use the random number
>>>>>>> generator
>>>>>>> from the SSL module. erlang_oauth and couch_http_oauth seem
>>>>>>> to be
>>>>>>> aware
>>>>>>> of cryptographic methods which my reading means that they
>>>>>>> require some
>>>>>>> action, but exactly what I'm uncertain.
>>>>>>
>>>>>> I disagree. We don't encrypt anything and as far as I know
>>>>>> neither does
>>>>>> any
>>>>>> of the Auth stuff, which just uses cryptographic strength
>>>>>> hashes, not
>>>>>> encryption itself.
>>>>>>
>>>>>> -Damien
>>>>>>
>>>>>>
>>>>
>>>>
>>
>>
Re: Cryptography in CouchDB
Posted by Paul Davis <pa...@gmail.com>.
Damien,
Quoting the answer to "What are examples of when a crypto item is
publicly accessible through ASF servers?" at [1]:
The less obvious example, is the point at which a subversion
repository starts to include code that is specially designed to work
with any other 5D002 item, whether that item is ever to be included
within a product distribution or not.
[1] http://www.apache.org/dev/crypto.html
The calls to crypto are arguable. The calls to priv_key are not.
Paul
On Wed, Aug 19, 2009 at 3:30 PM, Damien Katz<da...@apache.org> wrote:
> I disagree. I don't think why we need to remove calls to code that doesn't
> encrypt anything. It doesn't matter that we have a dependency on the erlang
> crypto lib, we simply aren't encrypting, or enabling encrypting.
>
> -Damien
>
> On Aug 19, 2009, at 3:07 PM, Paul Davis wrote:
>
>> Between William's response and reading the crypto page, I'm fairly
>> certain that we either need to remove all calls to the priv_key and
>> crypto modules from SVN or add the NOTICE.
>>
>> I'd vote for avoiding the export restrictions, but I'm pretty sure
>> that we're gonna need to do something.
>>
>> Paul
>>
>> On Wed, Aug 19, 2009 at 2:55 PM, Damien Katz<da...@apache.org> wrote:
>>>
>>> There is no encryption inside of CouchDB and, there are no plans to add
>>> encryption functionality.
>>>
>>> I'd rather not add export restrictions if it's unnecessary, since it is
>>> intended to limit who can use it.
>>>
>>> -Damien
>>>
>>> On Aug 19, 2009, at 2:40 PM, Paul Davis wrote:
>>>
>>>> Damien,
>>>>
>>>> Looks like legal-discuss is suggesting that we fill out the notices
>>>> [1]. The instructions [2] don't appear overly complicated but it does
>>>> appear that you're the only one with the proper authority to make the
>>>> updates to different web pages.
>>>>
>>>> Paul
>>>>
>>>> [1]
>>>>
>>>> http://mail-archives.apache.org/mod_mbox/www-legal-discuss/200908.mbox/%3c4A8C2657.1090303@rowe-clan.net%3e
>>>> [2] http://www.apache.org/dev/crypto.html
>>>>
>>>> On Tue, Aug 18, 2009 at 1:49 PM, Damien Katz<da...@apache.org> wrote:
>>>>>
>>>>> On Aug 17, 2009, at 10:16 PM, Curt Arnold wrote:
>>>>>
>>>>>>
>>>>>> On Aug 17, 2009, at 6:45 PM, Damien Katz wrote:
>>>>>>
>>>>>>> I don't think it's necessary as we aren't encrypting anything. We do
>>>>>>> use
>>>>>>> the crypto library, but only for generating random UUIDs.
>>>>>>>
>>>>>>> -Damien
>>>>>>>
>>>>>>
>>>>>> Probably should have used "suspect" or "concerned" or something more
>>>>>> speculative. Noticing that CouchDB would not start on an Erlang
>>>>>> runtime
>>>>>> without openssl was a bit jarring. OAuth would also seem to be have a
>>>>>> significant likelihood of incorporating encryption. Those two facts
>>>>>> seemed
>>>>>> to warrant a message.
>>>>>>
>>>>>> The whole export license stuff is an quagmire that I've taken pains to
>>>>>> avoid. Definitely think that you should check with legal-discuss if
>>>>>> you
>>>>>> have any questions.
>>>>>>
>>>>>> erlang_oauth has a module named oauth_rsa_sha1 which makes me suspect
>>>>>> that
>>>>>> it would need an export declaration.
>>>>>>
>>>>>> The following code snippet from couch_http_oauth.erl
>>>>>>
>>>>>> consumer_lookup(Key, MethodStr) ->
>>>>>> SignatureMethod = case MethodStr of
>>>>>> "PLAINTEXT" -> plaintext;
>>>>>> "HMAC-SHA1" -> hmac_sha1;
>>>>>> %"RSA-SHA1" -> rsa_sha1;
>>>>>> _Else -> undefined
>>>>>>
>>>>>> appears to be at aware of specific encryption method.
>>>>>>
>>>>>>
>>>>>> I also ran into this little snippet in couch_util.erl:
>>>>>>
>>>>>> %%% Purpose : Base 64 encoding and decoding.
>>>>>> %%% Copied from ssl_base_64 to avoid using the
>>>>>> %%% erlang ssl library
>>>>>>
>>>>>> If there is a required dependency on ssl elsewhere, the duplicated
>>>>>> code
>>>>>> probably should be eliminated. Also, the "license notice" doesn't
>>>>>> give
>>>>>> me
>>>>>> much confidence.
>>>>>>
>>>>>>
>>>>>> FYI: Encryption notice for Erlang ssl:
>>>>>> http://erlang.org/doc/apps/ssl/index.html
>>>>>>
>>>>>> My wild guess is that the previous CouchDB releases did not need an
>>>>>> export
>>>>>> or cryptography notice if all they did was use the random number
>>>>>> generator
>>>>>> from the SSL module. erlang_oauth and couch_http_oauth seem to be
>>>>>> aware
>>>>>> of cryptographic methods which my reading means that they require some
>>>>>> action, but exactly what I'm uncertain.
>>>>>
>>>>> I disagree. We don't encrypt anything and as far as I know neither does
>>>>> any
>>>>> of the Auth stuff, which just uses cryptographic strength hashes, not
>>>>> encryption itself.
>>>>>
>>>>> -Damien
>>>>>
>>>>>
>>>
>>>
>
>
Re: Cryptography in CouchDB
Posted by Damien Katz <da...@apache.org>.
I disagree. I don't think why we need to remove calls to code that
doesn't encrypt anything. It doesn't matter that we have a dependency
on the erlang crypto lib, we simply aren't encrypting, or enabling
encrypting.
-Damien
On Aug 19, 2009, at 3:07 PM, Paul Davis wrote:
> Between William's response and reading the crypto page, I'm fairly
> certain that we either need to remove all calls to the priv_key and
> crypto modules from SVN or add the NOTICE.
>
> I'd vote for avoiding the export restrictions, but I'm pretty sure
> that we're gonna need to do something.
>
> Paul
>
> On Wed, Aug 19, 2009 at 2:55 PM, Damien Katz<da...@apache.org> wrote:
>> There is no encryption inside of CouchDB and, there are no plans to
>> add
>> encryption functionality.
>>
>> I'd rather not add export restrictions if it's unnecessary, since
>> it is
>> intended to limit who can use it.
>>
>> -Damien
>>
>> On Aug 19, 2009, at 2:40 PM, Paul Davis wrote:
>>
>>> Damien,
>>>
>>> Looks like legal-discuss is suggesting that we fill out the notices
>>> [1]. The instructions [2] don't appear overly complicated but it
>>> does
>>> appear that you're the only one with the proper authority to make
>>> the
>>> updates to different web pages.
>>>
>>> Paul
>>>
>>> [1]
>>> http://mail-archives.apache.org/mod_mbox/www-legal-discuss/200908.mbox/%3c4A8C2657.1090303@rowe-clan.net%3e
>>> [2] http://www.apache.org/dev/crypto.html
>>>
>>> On Tue, Aug 18, 2009 at 1:49 PM, Damien Katz<da...@apache.org>
>>> wrote:
>>>>
>>>> On Aug 17, 2009, at 10:16 PM, Curt Arnold wrote:
>>>>
>>>>>
>>>>> On Aug 17, 2009, at 6:45 PM, Damien Katz wrote:
>>>>>
>>>>>> I don't think it's necessary as we aren't encrypting anything.
>>>>>> We do
>>>>>> use
>>>>>> the crypto library, but only for generating random UUIDs.
>>>>>>
>>>>>> -Damien
>>>>>>
>>>>>
>>>>> Probably should have used "suspect" or "concerned" or something
>>>>> more
>>>>> speculative. Noticing that CouchDB would not start on an Erlang
>>>>> runtime
>>>>> without openssl was a bit jarring. OAuth would also seem to be
>>>>> have a
>>>>> significant likelihood of incorporating encryption. Those two
>>>>> facts
>>>>> seemed
>>>>> to warrant a message.
>>>>>
>>>>> The whole export license stuff is an quagmire that I've taken
>>>>> pains to
>>>>> avoid. Definitely think that you should check with legal-
>>>>> discuss if you
>>>>> have any questions.
>>>>>
>>>>> erlang_oauth has a module named oauth_rsa_sha1 which makes me
>>>>> suspect
>>>>> that
>>>>> it would need an export declaration.
>>>>>
>>>>> The following code snippet from couch_http_oauth.erl
>>>>>
>>>>> consumer_lookup(Key, MethodStr) ->
>>>>> SignatureMethod = case MethodStr of
>>>>> "PLAINTEXT" -> plaintext;
>>>>> "HMAC-SHA1" -> hmac_sha1;
>>>>> %"RSA-SHA1" -> rsa_sha1;
>>>>> _Else -> undefined
>>>>>
>>>>> appears to be at aware of specific encryption method.
>>>>>
>>>>>
>>>>> I also ran into this little snippet in couch_util.erl:
>>>>>
>>>>> %%% Purpose : Base 64 encoding and decoding.
>>>>> %%% Copied from ssl_base_64 to avoid using the
>>>>> %%% erlang ssl library
>>>>>
>>>>> If there is a required dependency on ssl elsewhere, the
>>>>> duplicated code
>>>>> probably should be eliminated. Also, the "license notice"
>>>>> doesn't give
>>>>> me
>>>>> much confidence.
>>>>>
>>>>>
>>>>> FYI: Encryption notice for Erlang ssl:
>>>>> http://erlang.org/doc/apps/ssl/index.html
>>>>>
>>>>> My wild guess is that the previous CouchDB releases did not need
>>>>> an
>>>>> export
>>>>> or cryptography notice if all they did was use the random number
>>>>> generator
>>>>> from the SSL module. erlang_oauth and couch_http_oauth seem
>>>>> to be
>>>>> aware
>>>>> of cryptographic methods which my reading means that they
>>>>> require some
>>>>> action, but exactly what I'm uncertain.
>>>>
>>>> I disagree. We don't encrypt anything and as far as I know
>>>> neither does
>>>> any
>>>> of the Auth stuff, which just uses cryptographic strength hashes,
>>>> not
>>>> encryption itself.
>>>>
>>>> -Damien
>>>>
>>>>
>>
>>
Re: Cryptography in CouchDB
Posted by Paul Davis <pa...@gmail.com>.
Between William's response and reading the crypto page, I'm fairly
certain that we either need to remove all calls to the priv_key and
crypto modules from SVN or add the NOTICE.
I'd vote for avoiding the export restrictions, but I'm pretty sure
that we're gonna need to do something.
Paul
On Wed, Aug 19, 2009 at 2:55 PM, Damien Katz<da...@apache.org> wrote:
> There is no encryption inside of CouchDB and, there are no plans to add
> encryption functionality.
>
> I'd rather not add export restrictions if it's unnecessary, since it is
> intended to limit who can use it.
>
> -Damien
>
> On Aug 19, 2009, at 2:40 PM, Paul Davis wrote:
>
>> Damien,
>>
>> Looks like legal-discuss is suggesting that we fill out the notices
>> [1]. The instructions [2] don't appear overly complicated but it does
>> appear that you're the only one with the proper authority to make the
>> updates to different web pages.
>>
>> Paul
>>
>> [1]
>> http://mail-archives.apache.org/mod_mbox/www-legal-discuss/200908.mbox/%3c4A8C2657.1090303@rowe-clan.net%3e
>> [2] http://www.apache.org/dev/crypto.html
>>
>> On Tue, Aug 18, 2009 at 1:49 PM, Damien Katz<da...@apache.org> wrote:
>>>
>>> On Aug 17, 2009, at 10:16 PM, Curt Arnold wrote:
>>>
>>>>
>>>> On Aug 17, 2009, at 6:45 PM, Damien Katz wrote:
>>>>
>>>>> I don't think it's necessary as we aren't encrypting anything. We do
>>>>> use
>>>>> the crypto library, but only for generating random UUIDs.
>>>>>
>>>>> -Damien
>>>>>
>>>>
>>>> Probably should have used "suspect" or "concerned" or something more
>>>> speculative. Noticing that CouchDB would not start on an Erlang runtime
>>>> without openssl was a bit jarring. OAuth would also seem to be have a
>>>> significant likelihood of incorporating encryption. Those two facts
>>>> seemed
>>>> to warrant a message.
>>>>
>>>> The whole export license stuff is an quagmire that I've taken pains to
>>>> avoid. Definitely think that you should check with legal-discuss if you
>>>> have any questions.
>>>>
>>>> erlang_oauth has a module named oauth_rsa_sha1 which makes me suspect
>>>> that
>>>> it would need an export declaration.
>>>>
>>>> The following code snippet from couch_http_oauth.erl
>>>>
>>>> consumer_lookup(Key, MethodStr) ->
>>>> SignatureMethod = case MethodStr of
>>>> "PLAINTEXT" -> plaintext;
>>>> "HMAC-SHA1" -> hmac_sha1;
>>>> %"RSA-SHA1" -> rsa_sha1;
>>>> _Else -> undefined
>>>>
>>>> appears to be at aware of specific encryption method.
>>>>
>>>>
>>>> I also ran into this little snippet in couch_util.erl:
>>>>
>>>> %%% Purpose : Base 64 encoding and decoding.
>>>> %%% Copied from ssl_base_64 to avoid using the
>>>> %%% erlang ssl library
>>>>
>>>> If there is a required dependency on ssl elsewhere, the duplicated code
>>>> probably should be eliminated. Also, the "license notice" doesn't give
>>>> me
>>>> much confidence.
>>>>
>>>>
>>>> FYI: Encryption notice for Erlang ssl:
>>>> http://erlang.org/doc/apps/ssl/index.html
>>>>
>>>> My wild guess is that the previous CouchDB releases did not need an
>>>> export
>>>> or cryptography notice if all they did was use the random number
>>>> generator
>>>> from the SSL module. erlang_oauth and couch_http_oauth seem to be
>>>> aware
>>>> of cryptographic methods which my reading means that they require some
>>>> action, but exactly what I'm uncertain.
>>>
>>> I disagree. We don't encrypt anything and as far as I know neither does
>>> any
>>> of the Auth stuff, which just uses cryptographic strength hashes, not
>>> encryption itself.
>>>
>>> -Damien
>>>
>>>
>
>
Re: Cryptography in CouchDB
Posted by Damien Katz <da...@apache.org>.
There is no encryption inside of CouchDB and, there are no plans to
add encryption functionality.
I'd rather not add export restrictions if it's unnecessary, since it
is intended to limit who can use it.
-Damien
On Aug 19, 2009, at 2:40 PM, Paul Davis wrote:
> Damien,
>
> Looks like legal-discuss is suggesting that we fill out the notices
> [1]. The instructions [2] don't appear overly complicated but it does
> appear that you're the only one with the proper authority to make the
> updates to different web pages.
>
> Paul
>
> [1] http://mail-archives.apache.org/mod_mbox/www-legal-discuss/200908.mbox/%3c4A8C2657.1090303@rowe-clan.net%3e
> [2] http://www.apache.org/dev/crypto.html
>
> On Tue, Aug 18, 2009 at 1:49 PM, Damien Katz<da...@apache.org> wrote:
>>
>> On Aug 17, 2009, at 10:16 PM, Curt Arnold wrote:
>>
>>>
>>> On Aug 17, 2009, at 6:45 PM, Damien Katz wrote:
>>>
>>>> I don't think it's necessary as we aren't encrypting anything. We
>>>> do use
>>>> the crypto library, but only for generating random UUIDs.
>>>>
>>>> -Damien
>>>>
>>>
>>> Probably should have used "suspect" or "concerned" or something more
>>> speculative. Noticing that CouchDB would not start on an Erlang
>>> runtime
>>> without openssl was a bit jarring. OAuth would also seem to be
>>> have a
>>> significant likelihood of incorporating encryption. Those two
>>> facts seemed
>>> to warrant a message.
>>>
>>> The whole export license stuff is an quagmire that I've taken
>>> pains to
>>> avoid. Definitely think that you should check with legal-discuss
>>> if you
>>> have any questions.
>>>
>>> erlang_oauth has a module named oauth_rsa_sha1 which makes me
>>> suspect that
>>> it would need an export declaration.
>>>
>>> The following code snippet from couch_http_oauth.erl
>>>
>>> consumer_lookup(Key, MethodStr) ->
>>> SignatureMethod = case MethodStr of
>>> "PLAINTEXT" -> plaintext;
>>> "HMAC-SHA1" -> hmac_sha1;
>>> %"RSA-SHA1" -> rsa_sha1;
>>> _Else -> undefined
>>>
>>> appears to be at aware of specific encryption method.
>>>
>>>
>>> I also ran into this little snippet in couch_util.erl:
>>>
>>> %%% Purpose : Base 64 encoding and decoding.
>>> %%% Copied from ssl_base_64 to avoid using the
>>> %%% erlang ssl library
>>>
>>> If there is a required dependency on ssl elsewhere, the duplicated
>>> code
>>> probably should be eliminated. Also, the "license notice" doesn't
>>> give me
>>> much confidence.
>>>
>>>
>>> FYI: Encryption notice for Erlang ssl:
>>> http://erlang.org/doc/apps/ssl/index.html
>>>
>>> My wild guess is that the previous CouchDB releases did not need
>>> an export
>>> or cryptography notice if all they did was use the random number
>>> generator
>>> from the SSL module. erlang_oauth and couch_http_oauth seem to
>>> be aware
>>> of cryptographic methods which my reading means that they require
>>> some
>>> action, but exactly what I'm uncertain.
>>
>> I disagree. We don't encrypt anything and as far as I know neither
>> does any
>> of the Auth stuff, which just uses cryptographic strength hashes, not
>> encryption itself.
>>
>> -Damien
>>
>>
Re: Cryptography in CouchDB
Posted by Paul Davis <pa...@gmail.com>.
Damien,
Looks like legal-discuss is suggesting that we fill out the notices
[1]. The instructions [2] don't appear overly complicated but it does
appear that you're the only one with the proper authority to make the
updates to different web pages.
Paul
[1] http://mail-archives.apache.org/mod_mbox/www-legal-discuss/200908.mbox/%3c4A8C2657.1090303@rowe-clan.net%3e
[2] http://www.apache.org/dev/crypto.html
On Tue, Aug 18, 2009 at 1:49 PM, Damien Katz<da...@apache.org> wrote:
>
> On Aug 17, 2009, at 10:16 PM, Curt Arnold wrote:
>
>>
>> On Aug 17, 2009, at 6:45 PM, Damien Katz wrote:
>>
>>> I don't think it's necessary as we aren't encrypting anything. We do use
>>> the crypto library, but only for generating random UUIDs.
>>>
>>> -Damien
>>>
>>
>> Probably should have used "suspect" or "concerned" or something more
>> speculative. Noticing that CouchDB would not start on an Erlang runtime
>> without openssl was a bit jarring. OAuth would also seem to be have a
>> significant likelihood of incorporating encryption. Those two facts seemed
>> to warrant a message.
>>
>> The whole export license stuff is an quagmire that I've taken pains to
>> avoid. Definitely think that you should check with legal-discuss if you
>> have any questions.
>>
>> erlang_oauth has a module named oauth_rsa_sha1 which makes me suspect that
>> it would need an export declaration.
>>
>> The following code snippet from couch_http_oauth.erl
>>
>> consumer_lookup(Key, MethodStr) ->
>> SignatureMethod = case MethodStr of
>> "PLAINTEXT" -> plaintext;
>> "HMAC-SHA1" -> hmac_sha1;
>> %"RSA-SHA1" -> rsa_sha1;
>> _Else -> undefined
>>
>> appears to be at aware of specific encryption method.
>>
>>
>> I also ran into this little snippet in couch_util.erl:
>>
>> %%% Purpose : Base 64 encoding and decoding.
>> %%% Copied from ssl_base_64 to avoid using the
>> %%% erlang ssl library
>>
>> If there is a required dependency on ssl elsewhere, the duplicated code
>> probably should be eliminated. Also, the "license notice" doesn't give me
>> much confidence.
>>
>>
>> FYI: Encryption notice for Erlang ssl:
>> http://erlang.org/doc/apps/ssl/index.html
>>
>> My wild guess is that the previous CouchDB releases did not need an export
>> or cryptography notice if all they did was use the random number generator
>> from the SSL module. erlang_oauth and couch_http_oauth seem to be aware
>> of cryptographic methods which my reading means that they require some
>> action, but exactly what I'm uncertain.
>
> I disagree. We don't encrypt anything and as far as I know neither does any
> of the Auth stuff, which just uses cryptographic strength hashes, not
> encryption itself.
>
> -Damien
>
>
Re: Cryptography in CouchDB
Posted by Damien Katz <da...@apache.org>.
On Aug 17, 2009, at 10:16 PM, Curt Arnold wrote:
>
> On Aug 17, 2009, at 6:45 PM, Damien Katz wrote:
>
>> I don't think it's necessary as we aren't encrypting anything. We
>> do use the crypto library, but only for generating random UUIDs.
>>
>> -Damien
>>
>
> Probably should have used "suspect" or "concerned" or something more
> speculative. Noticing that CouchDB would not start on an Erlang
> runtime without openssl was a bit jarring. OAuth would also seem to
> be have a significant likelihood of incorporating encryption. Those
> two facts seemed to warrant a message.
>
> The whole export license stuff is an quagmire that I've taken pains
> to avoid. Definitely think that you should check with legal-discuss
> if you have any questions.
>
> erlang_oauth has a module named oauth_rsa_sha1 which makes me
> suspect that it would need an export declaration.
>
> The following code snippet from couch_http_oauth.erl
>
> consumer_lookup(Key, MethodStr) ->
> SignatureMethod = case MethodStr of
> "PLAINTEXT" -> plaintext;
> "HMAC-SHA1" -> hmac_sha1;
> %"RSA-SHA1" -> rsa_sha1;
> _Else -> undefined
>
> appears to be at aware of specific encryption method.
>
>
> I also ran into this little snippet in couch_util.erl:
>
> %%% Purpose : Base 64 encoding and decoding.
> %%% Copied from ssl_base_64 to avoid using the
> %%% erlang ssl library
>
> If there is a required dependency on ssl elsewhere, the duplicated
> code probably should be eliminated. Also, the "license notice"
> doesn't give me much confidence.
>
>
> FYI: Encryption notice for Erlang ssl: http://erlang.org/doc/apps/ssl/index.html
>
> My wild guess is that the previous CouchDB releases did not need an
> export or cryptography notice if all they did was use the random
> number generator from the SSL module. erlang_oauth and
> couch_http_oauth seem to be aware of cryptographic methods which my
> reading means that they require some action, but exactly what I'm
> uncertain.
I disagree. We don't encrypt anything and as far as I know neither
does any of the Auth stuff, which just uses cryptographic strength
hashes, not encryption itself.
-Damien
Re: Cryptography in CouchDB
Posted by Curt Arnold <ca...@apache.org>.
On Aug 17, 2009, at 6:45 PM, Damien Katz wrote:
> I don't think it's necessary as we aren't encrypting anything. We do
> use the crypto library, but only for generating random UUIDs.
>
> -Damien
>
Probably should have used "suspect" or "concerned" or something more
speculative. Noticing that CouchDB would not start on an Erlang
runtime without openssl was a bit jarring. OAuth would also seem to be
have a significant likelihood of incorporating encryption. Those two
facts seemed to warrant a message.
The whole export license stuff is an quagmire that I've taken pains to
avoid. Definitely think that you should check with legal-discuss if
you have any questions.
erlang_oauth has a module named oauth_rsa_sha1 which makes me suspect
that it would need an export declaration.
The following code snippet from couch_http_oauth.erl
consumer_lookup(Key, MethodStr) ->
SignatureMethod = case MethodStr of
"PLAINTEXT" -> plaintext;
"HMAC-SHA1" -> hmac_sha1;
%"RSA-SHA1" -> rsa_sha1;
_Else -> undefined
appears to be at aware of specific encryption method.
I also ran into this little snippet in couch_util.erl:
%%% Purpose : Base 64 encoding and decoding.
%%% Copied from ssl_base_64 to avoid using the
%%% erlang ssl library
If there is a required dependency on ssl elsewhere, the duplicated
code probably should be eliminated. Also, the "license notice"
doesn't give me much confidence.
FYI: Encryption notice for Erlang ssl: http://erlang.org/doc/apps/ssl/index.html
My wild guess is that the previous CouchDB releases did not need an
export or cryptography notice if all they did was use the random
number generator from the SSL module. erlang_oauth and
couch_http_oauth seem to be aware of cryptographic methods which my
reading means that they require some action, but exactly what I'm
uncertain.
Re: Cryptography in CouchDB
Posted by Damien Katz <da...@apache.org>.
I don't think it's necessary as we aren't encrypting anything. We do
use the crypto library, but only for generating random UUIDs.
-Damien
On Aug 17, 2009, at 4:37 PM, Curt Arnold wrote:
> I don't know if it predates the recent OAuth patch, but I believe
> the CouchDB now requires an export notice to be filed. The export
> notification should have been filed before crypto related code was
> committed. I do not know if there is a procedure to follow when the
> export notice is not filed beforehand.
>
> See http://www.apache.org/dev/crypto.html and http://www.apache.org/licenses/exports/
>
> It should have dawned on me earlier, but I stumbled upon it when I
> built Erlang R13B01 from source without previously installing libssl-
> dev. Erlang and CouchDB would build successfully, but CouchDB would
> fail on start up. Surprised me that CouchDB requires ssl to launch.
>
>