The OpenSSL engine of Digest uses the low-level API of OpenSSL, whose
use has been discouraged for years for multiple reasons.
A long-standing issue on a FIPS-enabled system is that using ::Digest
results in crashing the Ruby process, because the low-level API lacks
the mechanism to report an error (the policy violation) and thus kills
the process as a last resort[1][2]. Also, the upcoming OpenSSL 3.0 will
deprecate it for future removal[3]. Compiling with
-Wdeprecated-declarations will start to emit warnings.
A proper fix for this is to make it use the EVP API instead. This is a
non-trivial work as it requires backwards-incompatible changes to the
framework interface of Digest::Base and rb_digest_metadata_t.
It is more than 15 years ago that the openssl library became part of the
standard library. It has implemented the exactly same functionality as
OpenSSL::Digest, in fact, as a subclass of Digest::Class. There is not
much point in having an identical code in the digest library. Let's
just get rid of OpenSSL within digest. This leaves the C implementations
and the CommonCrypto engine for Apple systems.
A patch is being prepared for the openssl library to provide ::Digest
constants for better performance[4].
[1] https://bugs.ruby-lang.org/issues/6946
[2] https://bugs.ruby-lang.org/issues/13681
[3] https://www.openssl.org/docs/OpenSSL300Design.html
[4] https://github.com/ruby/openssl/pull/377
* ext/digest/digest_conf.rb (digest_conf): check for CommonDigest.
* ext/digest/*/*cc.h: for Apple CommonCrypto/CommonDigest.h.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@49565 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
rb_ to avoid name clash in writing extensions.
* ext/digest: Introduce Digest::Class and Digest::Instance for
ease of implementing subclasses and add-ons, inspried by
gotoyuzo.
* ext/digest: The Digest::Instance module now requires and assumes
that any instance be resettable and clonable, and add some
convenient instance methods such as "new()", for creating a new
copy, parameter taking "digest()" and "hexdigest()", for instant
calculation. These methods make digest instances work just like
digest classes.
* ext/digest/sha2/lib/digest/sha2.rb:
Add the Digest::SHA2 class to wrap up SHA2 variants: SHA256,
SHA384 and SHA512, hoping this module would make a decent
example of a digest subclass written in Ruby.
* ext/digest/lib/digest.rb: Adjust autoload entries for SHA2
classes.
* ext/digest/lib/digest/hmac.rb: Follow the framework updates.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@11197 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
ext/digest/md5/md5init.c, ext/digest/rmd160/rmd160init.c,
ext/digest/sha1/sha1init.c, ext/digest/sha2/sha2init.c:
Introduce API versioning.
* ext/digest/digest.c, ext/digest/digest.h,
ext/digest/md5/md5init.c, ext/digest/rmd160/rmd160init.c,
ext/digest/sha1/sha1init.c, ext/digest/sha2/sha2init.c: Remove
the constants DIGEST_LENGTH and BLOCK_LENGTH and turn them into
instance methods digest_length() and block_length(). Class
methods with the same names are also provided, which take extra
parameters for a digest method.
* ext/digest/lib/digest/hmac.rb: Completely redesign the API which
is similar to Perl's, now that Digest classes can take hashing
parameters.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@11166 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
variable of a class object instead of a class variable for
metadata. This change is crucial for ruby 1.8 and applying it
also to the trunk will assure compatibilities.
* ext/digest/md5/md5init.c (Init_md5): Ditto.
* ext/digest/rmd160/rmd160init.c (Init_rmd160): Ditto.
* ext/digest/sha1/sha1init.c (Init_sha1): Ditto.
* ext/digest/sha2/sha2init.c (Init_sha2): Ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@11133 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
rb_digest_base_equal): Simplify the equality check and just
compare resulted digests since state-level equality should
not be significant.
* ext/digest/digest.h: Ditto.
* ext/digest/*/*.[ch]: Ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@11131 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
hash_final_func_t was inconsistent with others, change it and
rename to hash_finish_func_t to avoid confusion.
* ext/digest/digest.[ch]: Remove and eliminate the use of
hash_end_func_t. Implement hexdigest conversion in the base
class.
* ext/digest/md5/md5.c, ext/digest/md5/md5.h,
ext/digest/md5/md5init.c, ext/digest/md5/md5ossl.c,
ext/digest/md5/md5ossl.h: Remove MD5_End() and change
MD5_Final() to MD5_Finish().
* ext/digest/rmd160/depend, ext/digest/rmd160/extconf.rb,
ext/digest/rmd160/rmd160.c, ext/digest/rmd160/rmd160.h,
ext/digest/rmd160/rmd160hl.c, ext/digest/rmd160/rmd160init.c,
ext/digest/rmd160/rmd160ossl.c, ext/digest/rmd160/rmd160ossl.h:
Remove unused functions RMD160_End(), RMD160_File(),
RMD160_Data() and change RMD160_Final() to RMD160_Finish().
* ext/digest/sha1/extconf.rb, ext/digest/sha1/sha1.c,
ext/digest/sha1/sha1.h, ext/digest/sha1/sha1hl.c,
ext/digest/sha1/sha1init.c, ext/digest/sha1/sha1ossl.c,
ext/digest/sha1/sha1ossl.h: Likewise.
* ext/digest/sha2/extconf.rb, ext/digest/sha2/sha2.c,
ext/digest/sha2/sha2.h, ext/digest/sha2/sha2hl.c,
ext/digest/sha2/sha2init.c: Likewise.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@11086 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
project.
ext/digest:
This module provides the module Digest and the abstract class
Digest::Base.
ext/digest/md5 (which obsoletes ext/md5):
This module provides the class Digest::MD5 which implements the
MD5 Message-Digest Algorithm.
ext/digest/rmd160:
This module provides the class Digest::RMD160 which implements the
RIPEMD-160 cryptographic hash function.
ext/digest/sha1 (which obsoletes ext/sha1):
This module provides the class Digest::SHA1 which implements the
SHA-1 Secure Hash Algorithm.
ext/digest/sha2:
This module provides the classes Digest::SHA256, Digest::SHA384
and Digest::SHA512 which implement the SHA-256, SHA-384 and
SHA-512 Secure Hash Algorithms, respectively.
lib/md5.rb, lib/sha1.rb:
These files are provided for backward compatibility.
All these classes have the common API, which previously ext/md5 and
ext/sha1 modules provided. While the new API keeps 100% backward
compatibility, it has been enriched with several utility methods.
Read digest.txt for further details.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@1609 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
