You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by David Jencks <da...@yahoo.com> on 2007/03/22 19:30:06 UTC
BouncyCastle and apache ds
I recently realized apacheds was using bouncy castle which IIUC is
not distributable with apache stuff, so I looked into whether they
could switch to our geronimo-util.
apacheds appears to use bouncycastle for some kerberos support. Some
of the classes they need are already in geronimo-util, but these are
missing so far:
org.bouncycastle.crypto.digests.SHA1Digest
org.bouncycastle.crypto.modes.CBCBlockCipher
org.bouncycastle.crypto.params.ParametersWithIV
org.bouncycastle.crypto.engines.DESEngine
org.bouncycastle.crypto.engines.DESedeEngine
org.bouncycastle.crypto.digests.MD4Digest
org.bouncycastle.crypto.params.DESParameters
org.bouncycastle.crypto.digests.MD5Digest
(unless I missed some)
See also DIRSERVER-877
Does anyone have a guess as to whether we could include these in our
geronimo-util or if the equivalents are in the platform crypto support?
thanks
david jencks
Re: BouncyCastle and apache ds
Posted by Emmanuel Lecharny <el...@gmail.com>.
Enrique Rodriguez a écrit :
> On 3/23/07, Emmanuel Lecharny <el...@gmail.com> wrote:
>
>> ...
>> Last thing, we will need to fix the same thing in 1.0.2, but I'm afraid
>> that we won't be able to backport your modifications, because we are
>> using a 1.4 jdk.
>
>
> A quick look at javadocs says the classes I used came into the JDK
> between 1.2 and 1.4, so backporting might work. I did use type-safe
> collections in a handful of places, but those are easy enough to
> remove.
>
> Enrique
>
Ok, I have backported the modifications to 1.0.2 version. It was not
exactly simple, as many changes have been done between 1.0 and 1.5
versions (mostly, IoHandler inheritence).
We are now IP free :) The only remaining step would be to rewrite the
DER code, something we might consider for 1.5.2 version, or 1.5.3, when
we both have time to do it :)
What would be very cool is to bacport some of the tests you have from
1.5 to 1.0, if you find 5 minutes to do so.
Also, has I did a straight back-port, it may be cool if you can review
the 1.0 code, because even if it compiles, and test are ok, I'm not 100%
sure that it's all ok.
We are done ! Thanks Enrique for the good work :)
Emmanuel
Re: BouncyCastle and apache ds
Posted by Enrique Rodriguez <en...@gmail.com>.
On 3/23/07, Emmanuel Lecharny <el...@gmail.com> wrote:
> ...
> Last thing, we will need to fix the same thing in 1.0.2, but I'm afraid
> that we won't be able to backport your modifications, because we are
> using a 1.4 jdk.
A quick look at javadocs says the classes I used came into the JDK
between 1.2 and 1.4, so backporting might work. I did use type-safe
collections in a handful of places, but those are easy enough to
remove.
Enrique
Re: BouncyCastle and apache ds
Posted by Emmanuel Lecharny <el...@gmail.com>.
Enrique Rodriguez a écrit :
> On 3/23/07, Emmanuel Lecharny <el...@gmail.com> wrote:
>
>> ...
>> I just think we can't release with this IP issue. So just go ahead, and
>> commit. If needed, we will launch a new vote.
>
>
> OK, I'm up to date in trunk; new non-BC code is checked in. Hopefully
> the Bamboo CI shows tests passing and we're OK.
>
> Enrique
>
Awesome !
Last thing, we will need to fix the same thing in 1.0.2, but I'm afraid
that we won't be able to backport your modifications, because we are
using a 1.4 jdk.
I've started a new project (apacheds-crypto) which will only contain the
BC jar without the offending IDEA IP protected (damn !) classes. I'm too
tired to commit it, but will do tommorow.
Thanks a lot !
Emmanuel
Re: BouncyCastle and apache ds
Posted by Enrique Rodriguez <en...@gmail.com>.
On 3/23/07, Emmanuel Lecharny <el...@gmail.com> wrote:
> ...
> I just think we can't release with this IP issue. So just go ahead, and
> commit. If needed, we will launch a new vote.
OK, I'm up to date in trunk; new non-BC code is checked in. Hopefully
the Bamboo CI shows tests passing and we're OK.
Enrique
Re: BouncyCastle and apache ds
Posted by Emmanuel Lecharny <el...@gmail.com>.
Enrique Rodriguez a écrit :
> On 3/22/07, David Jencks <da...@yahoo.com> wrote:
>
>> ...
>> What next? Should I commit this while we figure out what to do next?
>
>
> Turns out I only needed 2 hrs. to replace BC with JDK JCE. I have the
> BC dep removed locally with all tests passing. I am ready to commit.
> At this point I only need to hear from other Directory developers as
> to whether this is an acceptable change 3-4 days before a release.
>
> Personally, I think this was a safe change as the BC & JDK API's are
> similar. Also, I wrote a couple new unit tests at the same time.
>
> Enrique
>
I just think we can't release with this IP issue. So just go ahead, and
commit. If needed, we will launch a new vote.
Emmanuel
Re: BouncyCastle and apache ds
Posted by Enrique Rodriguez <en...@gmail.com>.
On 3/22/07, David Jencks <da...@yahoo.com> wrote:
> ...
> What next? Should I commit this while we figure out what to do next?
Turns out I only needed 2 hrs. to replace BC with JDK JCE. I have the
BC dep removed locally with all tests passing. I am ready to commit.
At this point I only need to hear from other Directory developers as
to whether this is an acceptable change 3-4 days before a release.
Personally, I think this was a safe change as the BC & JDK API's are
similar. Also, I wrote a couple new unit tests at the same time.
Enrique
Re: BouncyCastle and apache ds
Posted by Enrique Rodriguez <en...@gmail.com>.
On 3/22/07, David Jencks <da...@yahoo.com> wrote:
> ...
> What next? Should I commit this while we figure out what to do next?
Turns out I only needed 2 hrs. to replace BC with JDK JCE. I have the
BC dep removed locally with all tests passing. I am ready to commit.
At this point I only need to hear from other Directory developers as
to whether this is an acceptable change 3-4 days before a release.
Personally, I think this was a safe change as the BC & JDK API's are
similar. Also, I wrote a couple new unit tests at the same time.
Enrique
Re: BouncyCastle and apache ds
Posted by David Jencks <da...@yahoo.com>.
Getting improved code would be great :-)
Meanwhile Rick added the classes to geronimo 2.0 (GERONIMO-3004, rev
521413, I deployed a snapshot, and attached a patch to DIRSERVER-877
that uses geronimo-util: all the integration tests pass.
The only problem I can see is that geronimo-util is a snapshot at the
moment.
I see 2 choices:
- we are hoping to release 1.2 soon, we're just waiting on a couple
other releases. We might be able to add this to g. 1.2
- at the end of the month we expect to put out 2.0-M4.
What next? Should I commit this while we figure out what to do next?
thanks
david jencks
On Mar 22, 2007, at 3:38 PM, Enrique Rodriguez wrote:
> On 3/22/07, David Jencks <da...@yahoo.com> wrote:
>> ...
>> apacheds appears to use bouncycastle for some kerberos support. Some
>> of the classes they need are already in geronimo-util, but these are
>> missing so far:
>>
>> org.bouncycastle.crypto.digests.SHA1Digest
>> org.bouncycastle.crypto.modes.CBCBlockCipher
>> org.bouncycastle.crypto.params.ParametersWithIV
>> org.bouncycastle.crypto.engines.DESEngine
>> org.bouncycastle.crypto.engines.DESedeEngine
>> org.bouncycastle.crypto.digests.MD4Digest
>> org.bouncycastle.crypto.params.DESParameters
>> org.bouncycastle.crypto.digests.MD5Digest
>
> The use of these classes are left-over from when the Kerberos server
> was first written on some old JDK version. I've had, in the back of
> my mind, a clean-up project to entirely remove our use of BC ever
> since we decided to go with JDK 1.5. Everything in this list is
> supported in the JDK. I estimate I can remove the entire dep on BC in
> one weekend. Definitely not this weekend (tomorrow) but we (ApacheDS)
> could package this as an initiative along with moving to our own
> improved-performance ASN.1 DER codecs.
>
> As an added bonus there are some easy enhancements to Kerberos that I
> want to add, that also could use JDK 1.5 JCE enhancements.
>
> For now, help from Geronimo with the util jar sounds like a good way
> to go if we need to address this for our impending release.
>
> Enrique
Re: BouncyCastle and apache ds
Posted by David Jencks <da...@yahoo.com>.
Getting improved code would be great :-)
Meanwhile Rick added the classes to geronimo 2.0 (GERONIMO-3004, rev
521413, I deployed a snapshot, and attached a patch to DIRSERVER-877
that uses geronimo-util: all the integration tests pass.
The only problem I can see is that geronimo-util is a snapshot at the
moment.
I see 2 choices:
- we are hoping to release 1.2 soon, we're just waiting on a couple
other releases. We might be able to add this to g. 1.2
- at the end of the month we expect to put out 2.0-M4.
What next? Should I commit this while we figure out what to do next?
thanks
david jencks
On Mar 22, 2007, at 3:38 PM, Enrique Rodriguez wrote:
> On 3/22/07, David Jencks <da...@yahoo.com> wrote:
>> ...
>> apacheds appears to use bouncycastle for some kerberos support. Some
>> of the classes they need are already in geronimo-util, but these are
>> missing so far:
>>
>> org.bouncycastle.crypto.digests.SHA1Digest
>> org.bouncycastle.crypto.modes.CBCBlockCipher
>> org.bouncycastle.crypto.params.ParametersWithIV
>> org.bouncycastle.crypto.engines.DESEngine
>> org.bouncycastle.crypto.engines.DESedeEngine
>> org.bouncycastle.crypto.digests.MD4Digest
>> org.bouncycastle.crypto.params.DESParameters
>> org.bouncycastle.crypto.digests.MD5Digest
>
> The use of these classes are left-over from when the Kerberos server
> was first written on some old JDK version. I've had, in the back of
> my mind, a clean-up project to entirely remove our use of BC ever
> since we decided to go with JDK 1.5. Everything in this list is
> supported in the JDK. I estimate I can remove the entire dep on BC in
> one weekend. Definitely not this weekend (tomorrow) but we (ApacheDS)
> could package this as an initiative along with moving to our own
> improved-performance ASN.1 DER codecs.
>
> As an added bonus there are some easy enhancements to Kerberos that I
> want to add, that also could use JDK 1.5 JCE enhancements.
>
> For now, help from Geronimo with the util jar sounds like a good way
> to go if we need to address this for our impending release.
>
> Enrique
Re: BouncyCastle and apache ds
Posted by Enrique Rodriguez <en...@gmail.com>.
On 3/22/07, David Jencks <da...@yahoo.com> wrote:
> ...
> apacheds appears to use bouncycastle for some kerberos support. Some
> of the classes they need are already in geronimo-util, but these are
> missing so far:
>
> org.bouncycastle.crypto.digests.SHA1Digest
> org.bouncycastle.crypto.modes.CBCBlockCipher
> org.bouncycastle.crypto.params.ParametersWithIV
> org.bouncycastle.crypto.engines.DESEngine
> org.bouncycastle.crypto.engines.DESedeEngine
> org.bouncycastle.crypto.digests.MD4Digest
> org.bouncycastle.crypto.params.DESParameters
> org.bouncycastle.crypto.digests.MD5Digest
The use of these classes are left-over from when the Kerberos server
was first written on some old JDK version. I've had, in the back of
my mind, a clean-up project to entirely remove our use of BC ever
since we decided to go with JDK 1.5. Everything in this list is
supported in the JDK. I estimate I can remove the entire dep on BC in
one weekend. Definitely not this weekend (tomorrow) but we (ApacheDS)
could package this as an initiative along with moving to our own
improved-performance ASN.1 DER codecs.
As an added bonus there are some easy enhancements to Kerberos that I
want to add, that also could use JDK 1.5 JCE enhancements.
For now, help from Geronimo with the util jar sounds like a good way
to go if we need to address this for our impending release.
Enrique
Re: BouncyCastle and apache ds
Posted by Rick McGuire <ri...@gmail.com>.
This turned out to be a trivial update. Committed revision 521413.
Rick
David Jencks wrote:
> I talked with Rick McGuire who set up our original geronimo-util jar
> and he thinks it will be pretty easy to pull these classes in or
> convert to using platform JCE and he's offered to see about adding
> them while he waits for various other problems to get solved.
>
> thanks
> david jencks
>
> (more or less replying for rick since AFAIK he's not subscribed here)
>
> On Mar 22, 2007, at 2:30 PM, David Jencks wrote:
>
>> I recently realized apacheds was using bouncy castle which IIUC is
>> not distributable with apache stuff, so I looked into whether they
>> could switch to our geronimo-util.
>>
>> apacheds appears to use bouncycastle for some kerberos support. Some
>> of the classes they need are already in geronimo-util, but these are
>> missing so far:
>>
>> org.bouncycastle.crypto.digests.SHA1Digest
>> org.bouncycastle.crypto.modes.CBCBlockCipher
>> org.bouncycastle.crypto.params.ParametersWithIV
>> org.bouncycastle.crypto.engines.DESEngine
>> org.bouncycastle.crypto.engines.DESedeEngine
>> org.bouncycastle.crypto.digests.MD4Digest
>> org.bouncycastle.crypto.params.DESParameters
>> org.bouncycastle.crypto.digests.MD5Digest
>>
>>
>> (unless I missed some)
>>
>> See also DIRSERVER-877
>>
>> Does anyone have a guess as to whether we could include these in our
>> geronimo-util or if the equivalents are in the platform crypto support?
>>
>> thanks
>> david jencks
>>
>
>
Re: BouncyCastle and apache ds
Posted by Rick McGuire <ri...@gmail.com>.
This turned out to be a trivial update. Committed revision 521413.
Rick
David Jencks wrote:
> I talked with Rick McGuire who set up our original geronimo-util jar
> and he thinks it will be pretty easy to pull these classes in or
> convert to using platform JCE and he's offered to see about adding
> them while he waits for various other problems to get solved.
>
> thanks
> david jencks
>
> (more or less replying for rick since AFAIK he's not subscribed here)
>
> On Mar 22, 2007, at 2:30 PM, David Jencks wrote:
>
>> I recently realized apacheds was using bouncy castle which IIUC is
>> not distributable with apache stuff, so I looked into whether they
>> could switch to our geronimo-util.
>>
>> apacheds appears to use bouncycastle for some kerberos support. Some
>> of the classes they need are already in geronimo-util, but these are
>> missing so far:
>>
>> org.bouncycastle.crypto.digests.SHA1Digest
>> org.bouncycastle.crypto.modes.CBCBlockCipher
>> org.bouncycastle.crypto.params.ParametersWithIV
>> org.bouncycastle.crypto.engines.DESEngine
>> org.bouncycastle.crypto.engines.DESedeEngine
>> org.bouncycastle.crypto.digests.MD4Digest
>> org.bouncycastle.crypto.params.DESParameters
>> org.bouncycastle.crypto.digests.MD5Digest
>>
>>
>> (unless I missed some)
>>
>> See also DIRSERVER-877
>>
>> Does anyone have a guess as to whether we could include these in our
>> geronimo-util or if the equivalents are in the platform crypto support?
>>
>> thanks
>> david jencks
>>
>
>
Re: BouncyCastle and apache ds
Posted by David Jencks <da...@yahoo.com>.
I talked with Rick McGuire who set up our original geronimo-util jar
and he thinks it will be pretty easy to pull these classes in or
convert to using platform JCE and he's offered to see about adding
them while he waits for various other problems to get solved.
thanks
david jencks
(more or less replying for rick since AFAIK he's not subscribed here)
On Mar 22, 2007, at 2:30 PM, David Jencks wrote:
> I recently realized apacheds was using bouncy castle which IIUC is
> not distributable with apache stuff, so I looked into whether they
> could switch to our geronimo-util.
>
> apacheds appears to use bouncycastle for some kerberos support.
> Some of the classes they need are already in geronimo-util, but
> these are missing so far:
>
> org.bouncycastle.crypto.digests.SHA1Digest
> org.bouncycastle.crypto.modes.CBCBlockCipher
> org.bouncycastle.crypto.params.ParametersWithIV
> org.bouncycastle.crypto.engines.DESEngine
> org.bouncycastle.crypto.engines.DESedeEngine
> org.bouncycastle.crypto.digests.MD4Digest
> org.bouncycastle.crypto.params.DESParameters
> org.bouncycastle.crypto.digests.MD5Digest
>
>
> (unless I missed some)
>
> See also DIRSERVER-877
>
> Does anyone have a guess as to whether we could include these in
> our geronimo-util or if the equivalents are in the platform crypto
> support?
>
> thanks
> david jencks
>
Re: BouncyCastle and apache ds
Posted by Rick McGuire <ri...@gmail.com>.
This list doesn't look too bad, and doesn't appear to drag in too much
extra stuff. I'll take a crack to see if this can be pulled together.
Rick
David Jencks wrote:
> I recently realized apacheds was using bouncy castle which IIUC is not
> distributable with apache stuff, so I looked into whether they could
> switch to our geronimo-util.
>
> apacheds appears to use bouncycastle for some kerberos support. Some
> of the classes they need are already in geronimo-util, but these are
> missing so far:
>
> org.bouncycastle.crypto.digests.SHA1Digest
> org.bouncycastle.crypto.modes.CBCBlockCipher
> org.bouncycastle.crypto.params.ParametersWithIV
> org.bouncycastle.crypto.engines.DESEngine
> org.bouncycastle.crypto.engines.DESedeEngine
> org.bouncycastle.crypto.digests.MD4Digest
> org.bouncycastle.crypto.params.DESParameters
> org.bouncycastle.crypto.digests.MD5Digest
>
>
> (unless I missed some)
>
> See also DIRSERVER-877
>
> Does anyone have a guess as to whether we could include these in our
> geronimo-util or if the equivalents are in the platform crypto support?
>
> thanks
> david jencks
>
>
Re: BouncyCastle and apache ds
Posted by David Jencks <da...@yahoo.com>.
I talked with Rick McGuire who set up our original geronimo-util jar
and he thinks it will be pretty easy to pull these classes in or
convert to using platform JCE and he's offered to see about adding
them while he waits for various other problems to get solved.
thanks
david jencks
(more or less replying for rick since AFAIK he's not subscribed here)
On Mar 22, 2007, at 2:30 PM, David Jencks wrote:
> I recently realized apacheds was using bouncy castle which IIUC is
> not distributable with apache stuff, so I looked into whether they
> could switch to our geronimo-util.
>
> apacheds appears to use bouncycastle for some kerberos support.
> Some of the classes they need are already in geronimo-util, but
> these are missing so far:
>
> org.bouncycastle.crypto.digests.SHA1Digest
> org.bouncycastle.crypto.modes.CBCBlockCipher
> org.bouncycastle.crypto.params.ParametersWithIV
> org.bouncycastle.crypto.engines.DESEngine
> org.bouncycastle.crypto.engines.DESedeEngine
> org.bouncycastle.crypto.digests.MD4Digest
> org.bouncycastle.crypto.params.DESParameters
> org.bouncycastle.crypto.digests.MD5Digest
>
>
> (unless I missed some)
>
> See also DIRSERVER-877
>
> Does anyone have a guess as to whether we could include these in
> our geronimo-util or if the equivalents are in the platform crypto
> support?
>
> thanks
> david jencks
>
Re: BouncyCastle and apache ds
Posted by Enrique Rodriguez <en...@gmail.com>.
On 3/22/07, David Jencks <da...@yahoo.com> wrote:
> ...
> apacheds appears to use bouncycastle for some kerberos support. Some
> of the classes they need are already in geronimo-util, but these are
> missing so far:
>
> org.bouncycastle.crypto.digests.SHA1Digest
> org.bouncycastle.crypto.modes.CBCBlockCipher
> org.bouncycastle.crypto.params.ParametersWithIV
> org.bouncycastle.crypto.engines.DESEngine
> org.bouncycastle.crypto.engines.DESedeEngine
> org.bouncycastle.crypto.digests.MD4Digest
> org.bouncycastle.crypto.params.DESParameters
> org.bouncycastle.crypto.digests.MD5Digest
The use of these classes are left-over from when the Kerberos server
was first written on some old JDK version. I've had, in the back of
my mind, a clean-up project to entirely remove our use of BC ever
since we decided to go with JDK 1.5. Everything in this list is
supported in the JDK. I estimate I can remove the entire dep on BC in
one weekend. Definitely not this weekend (tomorrow) but we (ApacheDS)
could package this as an initiative along with moving to our own
improved-performance ASN.1 DER codecs.
As an added bonus there are some easy enhancements to Kerberos that I
want to add, that also could use JDK 1.5 JCE enhancements.
For now, help from Geronimo with the util jar sounds like a good way
to go if we need to address this for our impending release.
Enrique