[13721] in cryptography@c2.net mail archive
Re: Draft Edition of LibTomMath book
daemon@ATHENA.MIT.EDU (Peter Gutmann)
Sat Jun 28 18:41:47 2003
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
Date: Sat, 28 Jun 2003 15:54:51 +1200
From: pgut001@cs.auckland.ac.nz (Peter Gutmann)
To: pgut001@cs.auckland.ac.nz, wk@gnupg.org
Cc: bear@sonic.net, cryptography@metzdowd.com, tomstdenis@yahoo.com
Werner Koch <wk@gnupg.org> writes:
>Does the proprietary SSH still use GMP? I know no other major crypto apps
>using GMP for big number math.
I've seen it used in a couple of lesser-known apps that I played with for
interop testing, nothing that counts as a major app though. Maybe it's being
used by people who prefer the LGPL to the more widely-used OpenSSL bignum
lib's BSD license (or perhaps it's the fact that GMP has documentation :-).
>A problem with GMP is that it heavily uses alloca() and thus it is not that
>hard to find traces of secrets in the core.
Ouch! This is a pity, because GMP seems to have the most active development
in terms of both algorithm optimisation and machine-specific optimisations -
if you want to find a version that runs well on $obscure_embedded_platform,
it's pretty much GMP or nothing.
Peter.
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
