cURL / Mailing Lists / curl-library / Single Mail

curl-library

Re: weak randomness with some TLS backends

From: Marc Hoersken <info_at_marc-hoersken.de>
Date: Sat, 14 Jun 2014 23:56:09 +0200

On 04.06.2014 14:55, Pierre Joye wrote:
> I think it is time to drop windows 2000. Maybe even xp at some point.
> But this function is available for xp, so it is not a issue at this point.

I also suggest dropping support for Windows 2000 and Windows XP before
Service Pack 3 if we want to have reliable native support of the Windows
platform.

An alternative to loading Advapi32.dll dymically using LoadLibrary could
be to statically link with Advapi32.lib which takes care of it.
This could also be an approach for other areas in libcurl which do
currently use LoadLibrary, for example:
  lib/curl_sspi.c: s_hSecDll = LoadLibrary(TEXT("security.dll"));
  lib/curl_sspi.c: s_hSecDll = LoadLibrary(TEXT("secur32.dll"));
  lib/telnet.c: wsock2 = LoadLibrary(TEXT("WS2_32.DLL"));

Besides the CryptoAPI CryptGenRandom function [1], we could of course
also the WinCNG [2] BCryptGenRandom function [3], though that is only
available since Windows Vista.

 [1] http://msdn.microsoft.com/en-us/library/windows/desktop/aa379942.aspx
 [2] http://msdn.microsoft.com/en-us/library/windows/desktop/aa376210.aspx
 [3] http://msdn.microsoft.com/en-us/library/windows/desktop/aa375458.aspx
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
Received on 2014-06-14