Cryptography May 2011

cryptography@lists.squeakfoundation.org

4 participants
6 discussions

Re: Blowfish, BCrypt and Password Hashing added to Cryptography project.
by Paul DeBruicker 15 May '11

15 May '11

Hi German, ByteArray>>fromHexString: is an extension defined in the Cryptography-Core package. I missed it when I was creating the Blowfish packages. Thanks for finding that. I've pasted the method below. Paul ByteArray>>#fromHexString: hexString "Returns a byteArray from a hex string. The hex string can have leading zeros that will not be truncated, preserving the size of the byteArray for things like cyrptograpy" | anInteger hexSize stringSize aStringOfHex | aStringOfHex := (hexString copyWithoutAll: (Array with: $ with: Character cr with: Character tab)). stringSize := aStringOfHex size. (stringSize > 3 and: [(aStringOfHex copyFrom: 1 to: 3) = '16r']) ifTrue: [anInteger := Number readFrom: (aStringOfHex asUppercase at: 3 put: $r; yourself). hexSize := aStringOfHex size - 3 / 2] ifFalse: [anInteger := Number readFrom: aStringOfHex asUppercase base: 16. hexSize := aStringOfHex size / 2]. ^ anInteger asByteArrayOfSize: hexSize asInteger

2 1

Blowfish, BCrypt and Password Hashing added to Cryptography project.
by Paul DeBruicker 15 May '11

15 May '11

Hi - Thanks for the suggestions. I added the packages a few minutes ago. Let me know if any progress gets made on the speed of the Blowfish algorithm and I'll take a look a fixing the Smalltalk bcrypt inaccuracy. Paul

2 2

Re: [squeak-dev] Re: Some question regarding portability
by Germán Arduino 11 May '11

11 May '11

2011/5/10 Sven Van Caekenberghe <sven(a)beta9.be>: > > On 10 May 2011, at 14:45, Andreas Raab wrote: > >>>>> - Are announcements available ? Can this framework be loaded ? What is the official way to do this ? >>>> >>>> There are at least four different implementations of the announcements framework. They are not (fully) compatible with each other. The question is: which one is required by Zinc? >>> >>> I am not aware of that many versions. >>> I subclass Announcement, instanciate an Announcer, send #announce: and #on:send:do to it, that's all. >> >> Then how about adding ZnAnnouncement, ZnAnnouncer with the two or three methods that you actually need? Announcements always struck me as more of a pattern than a framework. > > I agree that Announcements are pretty simple. > Still, if it is available, then why not use it. > Sharing and reusing general purpose classes seems pretty important and elementary to me. > > Of course, this sharing and reuse makes package management and dependencies more difficult. > > For example, I need MD5, for which it seems to be necessary to load Cryptography in Squeak, a quite large framework that seems to be under development (many unit tests failed, MD5 works OK). You have chosen a shortcut in WebClient by implementing MD5 yourself. This runs against the refactoring rule but makes it easier for users because they don't need to load a dependency. > Hi Sven: Yes, Cryptography is mostly a name to group different implementations of crypto related stuff. I agree that may not be the better idea thinking in reuse. I'm copying this mail to the crypto list (even when I think that most of the people is here also) to discuss about better ways to name/install the things. Regards. Germán.

2 1

Re: Cryptography Digest, Vol 40, Issue 1
by Paul DeBruicker 05 May '11

05 May '11

On 05/04/2011 08:00 AM, cryptography-request(a)lists.squeakfoundation.org wrote: > Date: Tue, 3 May 2011 19:47:11 -0400 > From: "Ron Teitelbaum"<ron(a)usmedrec.com> > Subject: RE: [Cryptography Team] Blowfish& Bcrypt in Smalltalk + > accessing crypt(3) through FFI. > To: "'Cryptography Team Development List'" > <cryptography(a)lists.squeakfoundation.org> > Message-ID:<029c01cc09ec$6cfa5a20$46ef0e60$(a)usmedrec.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Germán and Paul, > > I apologize too. I missed the request for Paul to be added. Paul I have > added you as a developer on Cryptography. > Ron- I am not yet added as a developer. I'm pad1 on squeaksource. Chris- Sounds like a plan. Germán - I'll move them after Ron adds me or you can if you like. Then I'll delete the other projects to avoid confusion. Paul

2 1

Re: Cryptography Digest, Vol 40, Issue 1
by Paul DeBruicker 04 May '11

04 May '11

On 05/04/2011 08:00 AM, cryptography-request(a)lists.squeakfoundation.org wrote: > Message: 2 > Date: Tue, 3 May 2011 19:47:11 -0400 > From: "Ron Teitelbaum"<ron(a)usmedrec.com> > Subject: RE: [Cryptography Team] Blowfish& Bcrypt in Smalltalk + > accessing crypt(3) through FFI. > To: "'Cryptography Team Development List'" > <cryptography(a)lists.squeakfoundation.org> > Message-ID:<029c01cc09ec$6cfa5a20$46ef0e60$(a)usmedrec.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Germán and Paul, > > I apologize too. I missed the request for Paul to be added. Paul I have > added you as a developer on Cryptography. > > Germán would you like to be an admin on the group? > > Please let me know if you need anything else. > > Ron Teitelbaum > Cryptography Team Leader > After not hearing back the other day I went ahead and made a Blowfish and PasswordHashing repository on SqueakSource just to get it out there. I'm happy to move everything (or have it moved) to the crypto library. The links are http://www.squeaksource.com/Blowfish and http://www.squeaksource.com/PasswordHashing The PasswordHashing package has my flawed bcrypt Smalltalk implementation and also FFI dependent classes that access crypt(3) and libxcrypt on linux. The FFI classes work fine. If anyone wants to look into speeding up the Smalltalk bcrypt implementation (I think my slow Blowfish implementation is the problem) I'd be happy to sort out why its inaccurate. I just don't have the interest to look for the speed ups at this time. Thanks Paul DeBruicker

3 2

Blowfish & Bcrypt in Smalltalk + accessing crypt(3) through FFI.
by Paul DeBruicker 04 May '11

04 May '11

Hi - I've made a working implementation of the Blowfish algorithm in Pharo, a partially broken implementation of Bcrypt in Pharo, and a reliable way to access the linux crypt library using FFI in Pharo on linux. At the moment it takes about 25 seconds to hash a password using my Bcrypt implementation in Pharo, which is about 50x too long. So I'm going to try to get a FFI version put together or just use SHA512 from the linux crypt library. I have learned a lot but don't expect to fix the improper hashing as I don't think the fix would cause a massive speed up. I think the hashing error is probably an off-by-one error in an array index in the BCrypt class. Ruby, Python, Lisp, PHP all access a C or Java library for bcrypt which probably should have told me something. I could either make a SqueakSource repository for all this or put it in the Cryptography package. Or I can email anyone the mcz files off list that would like them. Let me know how to proceed when you get a chance. Thanks Paul

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Cryptography May 2011