Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:86410
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
To: internals@lists.php.net,internals@lists.php.net
Message-ID: <556634A7.1010008@erebot.net>
Date: Wed, 27 May 2015 23:18:31 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Icedove/31.7.0
MIME-Version: 1.0
References: <CAKws9z0MVb8zAwmyW7ShkOjQOpJLEO_pdA=TnDT47nHa0x+wYQ@mail.gmail.com>	<CAAyV7nHK5E7TrAk5xzk8wRCvfjc=qpHOv_KHt7zga2bfEWmxfA@mail.gmail.com> <CAKws9z3wbdQ_G_Up5DkPDGaUSOcDZtkuFPDr0WQ5EHsrLRuXdw@mail.gmail.com> <55650573.5080004@gmail.com>
In-Reply-To: <55650573.5080004@gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] [RFC] [PHP 7.1] libsodium
From: clicky@erebot.net (Francois Poirotte)

Hi,

I like Anthony's idea of a crypto framework (abstracting away whatever 
underlying library is actually used). Not sure yet how this could be 
implemented though.

For what it's worth, I started playing with libtomcrypt (yet another 
crypto API) a few weeks ago as an attempt to replace the old mcrypt 
extension for my own needs. I found it quite easy to work with, plus the 
license is very permissive (WTFPL).

The result can be seen at https://github.com/fpoirotte/tomcrypt.
This is basically a thin wrapper around libtomcrypt's API.
The code still has many issues I need to resolve (lack of unit tests, 
parameter parsing using improper types, not ready for PHP 7 yet, etc.) 
but I found it to be pretty usable already.

Would there be any wider interest for such an extension?

Regards,
François

On 05/27/2015 01:44 AM, Rowan Collins wrote:
> On 26/05/2015 23:52, Scott Arciszewski wrote:
>> That's fair, and one of the reasons I wanted to make ext/libsodium
>> part of
>> the core was so that segueing into a PDO-style cryptography API would be
>> more natural. Instead of "wrap openssl and maybe wrap libsodium if it's
>> already installed" it would be "wrap what the language already has".
>>
>> Am I mistaken in believing this would be the way forward?
>
> Well, it doesn't quite match how PDO works, as I understand it -
> ext/pdo_pgsql isn't implemented on top of ext/pgsql, the two are
> separate extensions built on top of the libPQ library which Postgres
> provides. The "PHP Crypto Objects" equivalent would be "wrap openssl in
> ext/pco_openssl, wrap libsodium in ext/pco_sodium".
>
> The dependency management would be no different between ext/openssl and
> ext/pco_openssl - PHP doesn't *provide* OpenSSL or mcrypt, it
> *optionally* depends on them, and the same would be true of libsodium,
> whatever the bindings looked like.
>
> As such, bundling an extension which directly exposes libsodium's
> functions isn't really a pre-requisite for a pluggable architecture, and
> could harm the effort by being "too good" and allowing the short-term
> "good enough" solution that Anthony is afraid of.
>
> Regards,