cryptlib-3.2.2
所属分类:加密解密
开发工具:Delphi
文件大小:390KB
下载次数:5
上传日期:2014-09-17 22:17:33
上 传 者:
N88X8
说明: Windows Cryptlib 加密库API封装
(Cryptlib external API interface )
文件列表:
cryptlib-3.2.2\cl32.dll (905216, 2005-12-08)
cryptlib-3.2.2\COPYING (3484, 2005-01-19)
cryptlib-3.2.2\cryptlib.pas (79676, 2005-08-14)
cryptlib-3.2.2\cryptlib.URL (86, 2005-12-08)
cryptlib-3.2.2 (0, 2013-06-22)
Changes in 3.2.2 release
========================
The bignum code has been updated to the latest version, which is no less
ghastly than before but somewhat faster, particularly on x86 systems.
Changes in 3.2.1 release
========================
The zlib code has exhibited a number of security vulnerabilities, both in the
rather dated 19***-vintage zlib 1.1.x code and the much newer zlib 1.2.x code.
In order to avoid exposing cryptlib users to any new technology until it's
proven itself in the field, cryptlib has stayed with the old zlib code base,
which has avoided problems arising from the vulnerabilities found in the 1.2.x
code. However, the 1.2.x code base does have a number of advantages over the
old 1.1.4 code, including better compression, much faster compression and
decompression, and significantly less memory consumption, particularly for
decompression. Another potential problem with 1.1.4 is that there may be as
yet undiscovered problems in it that no-one's found yet because they're
concentrating on the newer 1.2.x instead.
Because zlib 1.2.x includes a significant rewrite of a fair portion of the
code, it's not possible to simply switch from one version of zlib to the other
at the flip of a compiler switch. Based on user feedback, the preferred
behaviour is to have cryptlib move from the old 1.1.x to the current 1.2.x
code base, so cryptlib 3.2.1 uses zlib 1.2.3 (those values are pure
coincidence). Users concerned about security issues should disable the
compression code (undefine USE_COMPRESSION in cryptini.h) unless it's actually
required.
Support of autoproxy configuration (under operating systems that implement
automatic network proxy discovery) has been added. This includes support for
SOCKS-style HTTP proxies as well as the originally implemented HTTP-
application-gateway HTTP proxies.
Several minor portability issues in 3.2 have been fixed, among other things a
workaround for a problem in gcc 4.0 that prevented the code from compiling.
Changes in 3.2 release
======================
The version that would have been released as 3.11 has been released as 3.2 to
avoid version-numbering confusion. Future releases will use a three-digit
numbering scheme x.y.z, where each of x, y, and z will constitute a single
digit, to avoid confusion over whether the '11' in '3.11' is 11 or 0.11.
The network timeout handling has been split into distinct read and write
timeouts to allow more flexible configuration of network data handling,
typically very small read timeouts to ensure that cryptlib never blocks while
waiting for data, and slightly larger write timeouts to ensure that all data
is completely written when requested.
Client authentication for sessions that support this (only the secure data
sessions, SSH and SSL/TLS, use client authentication) has been changed
slightly. In previous releases, cryptlib would always allow the client's
authentication and complete the handshake, leaving it to the caller to shut
down the session later on if there was a problem. As of this release, server
sessions will return a CRYPT_ENVELOPE_RESOURCE in the same way that envelopes
do when you activate them, to indicate that you need to provide further
information in order to continue. If you receive this status when you try to
activate a server session, you can read the user details via the
CRYPT_SESSINFO_USERNAME and CRYPT_SESSINFO_PASSWORD attributes, and either
comfirm the authentication by setting the CRYPT_SESSINFO_AUTHRESPONSE to true
or deny it by setting it to false. You then re-activate the session, and
cryptlib will complete the handshake. This allows you to check the
authentication details before allowing the handshake to continue. If you'd
prefer the previous behaviour, just set CRYPT_SESSINFO_AUTHRESPONSE to true
before you activate the session and cryptlib will handle confirmation of
authentication itself.
Because the handshake is now controlled by the server rather than the client
(that is, cryptlib won't sit in a loop reading all data from the client, but
will return to the caller to await further input), it's possible that the
client will send further session-control information after the handshake has
completed. To respond to any additional information that the client may send,
your server should try and pop client data before it sends any of its own
data. If the server sends its data first, the client may interpret the
server's data as an (invalid) response to a request that it has in progress.
The manual contains more details on the new client authentication and server
data handling process.
Starting with releases after 3.2, the attribute cursor manipulation functions
will be unified so that they work identically for all container objects that
maintain lists of attributes (most of this interface is already available in
3.2 for forwards-compatibility reasons). This means that the three attribute-
list mechanisms CRYPT_CERTINFO_CURRENT_EXTENSION,
CRYPT_CERTINFO_CURRENT_FIELD, and CRYPT_CERTINFO_CURRENT_COMPONENT (for
certificates), CRYPT_ATTRIBUTE_CURRENT_GROUP (formerly
CRYPT_ENVINFO_CURRENT_COMPONENT) for envelopes, and the future
CRYPT_ATTRIBUTE_CURRENT_GROUP for session objects will be folded into the
single mechanism CRYPT_ATTRIBUTE_CURRENT_GROUP, CRYPT_ATTRIBUTE_CURRENT, and
CRYPT_ATTRIBUTE_CURRENT_INSTANCE. This provides both a unified, consistent
interface across the different object types and allows envelope and session
attributes to be handled in the same way as certificates currently are. For
example under the older cryptlib 3.1 behaviour envelope signatures were
implicitly selected by reading the signature attribute, which changed the
current selection of the signature result and extra signature information
attributes. From releases after this one envelope signature attributes are
grouped by signature, so selecting the first signature explicitly selects the
associated signature key, signature result, and extra signature information
attributes, selecting the second signature explicitly selects the associated
information for that, and so on. In addition reading this information under
3.1 and earlier was something of a hunt-and-peck approach that required
reading each possible attribute in turn to see whether it was present. The
attribute cursor interface allows each present attribute to be enumerated
using the attribute cursor, with cryptlib doing the work of sorting out what's
present and what isn't. Finally, cryptlib 3.2 allows more session attributes
to be accessed by the caller, which requires the use of attribute cursors
since many of them are composite values or multi-valued attributes.
As part of this unification of mechanisms, the CRYPT_ENVINFO_CURRENT_COMPONENT
attribute has been renamed CRYPT_ATTRIBUTE_CURRENT_GROUP for compatibility
with future cryptlib releases. For certificates, cryptlib 3.11 supports both
the legacy CRYPT_CERTINFO_CURRENT_xxx attributes and the new
CRYPT_ATTRIBUTE_CURRENT_xxx ones, so you can either keep using the
certificate-specific cursor attributes for now or move to the universal cursor
attributes for compatibility with future versions. All that's necessary to
upgrade is a search and replace in your code to rename the attributes. More
information on the unified attribute cursor mechanism is given in the
Introduction section of the manual.
The various situation-specific SSH attributes like
CRYPT_SESSINFO_SSH_SUBSYSTEM and CRYPT_SESSINFO_SSH_PORTFORWARD have been
replaced with more generic forms for compatibility with future cryptlib
versions, which allow more complete control over SSH channel types and
parameters. See the manual for details on creating and controlling SSH
channels using the new attributes.
The SHA-2 algorithm is now enabled by default (previously it had to be
explicitly enabled via a compile-time option). Note that this algorithm isn't
supported by most software and standards, so using it in anything other than
closed environments will lead to interoperability problems. If you want to
use SHA-2, you should test it against any other software that you need to
interoperate with to ensure that it can handle this algorithm.
The Unix randomness slow poll now has an early-out mechanism that avoids the
full heavyweight slow poll if sufficient entropy is available without it.
This typically occurs on systems with both built-in randomness sources and
either a kernel statistics interface or an advanced /proc interface, which
provide the same data as the full slow poll at a fraction of the overhead.
Changes in 3.11 beta 1
======================
As noted in the 3.1 release notes, releases after 3.1 update the cryptlib 2.x
legacy functions cryptImport/ExportKey(Ex), cryptCreate/CheckSignature(Ex),
and cryptQueryObject to take a length parameter as their second argument.
These functions never took a length parameter in their original form because
they dealt with encoded signature/key exchange data, for which it's always
possible to determine the length by parsing it. However, this makes checking
of user-supplied parameters difficult - cryptlib always knows how much output
it'll produce, but it can't be sure that the user wants (or expects) that much
output, particularly if they've forgotten to perform a length check before
exporting a key or creating a signature. In order to avoid this problem,
releases after 3.1 make this minor API change, which fixes the last of the old
cryptlib 2.x functions. Since most people use the higher-level API functions,
this change shouldn't affect the majority of users.
In addition to the cryptlib 2.x legacy functions, two standard data-returning
functions cryptExportCert and the rarely-used cryptGetCertExtension now also
take a length parameter to specify the maximum buffer size. This brings them
into line with the (updated) legacy functions, and allows cryptlib to perform
better checking of user-supplied parameters, particularly in the case of
languages like Visual Basic and Java where the mapping of language-native data
types to the blocks of memory used by a C-language library can be tricky.
Changes in 3.1 release
======================
The final release contains mostly minor tweaks based on user feedback from the
3.1 final betas, with no noticeable external changes. Internally, the HTTP
engine has been significantly improved, TLS 1.1 is now supported (although at
release time there were no other known implementations of this to test
against), the BeOS port has been re-done to handle the current state of the OS
using GNU development tools instead of the original Be ones (thanks to Simon
Taylor for providing access to his system to do the work on), and the
perpetual tweaking of the networking subsystem to handle OS-specific quirks
has continued.
Changes in 3.1 beta 5
=====================
This release contains an extensive rewrite of the network-layer code to handle
various quirks and system-specific peculiarities in sockets implementations.
For this reason it's strongly recommended that if you're using secure sessions
or networking, you move to this version as quickly as possible. In addition
the code is now IPv6-enabled as part of the rewrite. In connection with this,
it's now possible to specify connect and network timeouts at the per-session
level rather than only as a cryptlib-wide option. To do this, set the timeout
value giving a specific session as the target object rather than CRYPT_UNUSED
for all of cryptlib:
cryptSetAttribute( cryptSession, CRYPT_OPTION_NET_TIMEOUT, timeout );
All of the session objects now provide extensive text diagnostics of errors
via the CRYPT_ATTRIBUTE_INT_ERRORMESSAGE attribute. This means that if a
session encounters a problem in communicating with another system, the
extended error message will usually provide additional information that goes
beyond the standard error code.
Support for SSHv2 subsystems such as SFTP has been added via the
CRYPT_SESSINFO_SSH_SUBSYSTEM attribute, and support for SSL/TLS with shared
keys (e.g. passwords) has been added. This allows secure SSL with mutual
authentication of both client and server, without the need for either
expensive server certificates or the complexity of client certificates. In
addition the shared-key mechanism is significantly faster than operations
involving certificates and private keys, and places far less load on both
client and server.
The CRYPT_OPTION_CERT_OBLIVIOUS option introduced in beta 4 has been changed
from a simple boolean value to a multivalued option
CRYPT_OPTION_CERT_COMPLIANCELEVEL, which indicates the level of checking
applied to certificates. This ranges from CRYPT_COMPLIANCELEVEL_OBLIVIOUS
(almost no checking except for the signature) through to
CRYPT_COMPLIANCELEVEL_PKIX_FULL (full compliance with PKIX certificate
standards). The default is CRYPT_COMPLIANCELEVEL_STANDARD, which provides a
reduced level of checking for compliance with other certificate software.
The CRYPT_ERROR_BUSY status has been renamed to CRYPT_ERROR_TIMEOUT to make it
more consistent with conditions like network timeouts, which is where it most
commonly occurs.
Some of the database keyset types have been renamed to make the names more
consistent. The three types are now CRYPT_KEYSET_ODBC for databases accessed
through an ODBC interface, CRYPT_KEYSET_DATABASE for databases with the
backend-specific interface code compiled into cryptlib, and
CRYPT_KEYSET_PLUGIN for databases accessed via the cryptlib database plugin
interface. The CRYPT_KEYSET_DATABASE type can be selected in the usual manner
at compile time with the USE_xxx compile options, see the manual for more
details on databases and compile options.
Changes in 3.1 beta 4
=====================
The changes in this release are mostly to fix a variety of minor problems that
cropped up in beta 3 related to portability across different systems. One
notable change is the inclusion of the CRYPT_OPTION_CERT_OBLIVIOUS
configuration option. This option is present in order to allow cryptlib to
handle the large number of broken certificates in use. Enabling this option
(setting it to TRUE) will cause cryptlib to ignore all certificate extensions
except key usage and the CA flag, making it compatible with other PKI
software. A future version of cryptlib will replace this option with a
multivalue selection allowing a choice of checking ranging from very little
(in order to be compatible with existing software and to process existing
certificates) through to full PKIX compliance (which will, however, reject a
large number of certificates in use today).
Changes in 3.1 beta 3
=====================
The way in which GeneralNames and DNs in GeneralNames are selected has
changed. Until now GeneralNames were selected with:
cryptSetAttribute( cryptCert, attributeID, CRYPT_UNUSED );
which selected the GeneralName with the given attributeID and also updated the
attribute cursor. Selecting the DN within the GeneralName required a second
selection to specify the DN. This special-case behaviour was inconsistent
with the way other attributes were handled, and caused some confusion for
users, as well as obscuring the fact that the attribute cursor was being
updated as it would be for an explicit attribute selection. Beta 3 changes
the selection mechanism so that it matches that used for all other attributes:
cryptSetAttribute( cryptCert, CRYPT_CERTINFO_CURRENT_EXTENSION,
attributeID );
(or whatever alternative attribute cursor mechanism is preferred). In
addition, it's no longer necessary to perform a two-stage select for DNs in
GeneralNames, since these are now implicitly selected by selecting the
GeneralName that contains them. This means that handling of GeneralName
attributes is now consistent with all other attribute types.
Because GeneralNames are now automatically selected, you need to be careful
when working with a DN such as the certificate subject name after selecting a
GeneralName, since a GeneralName contains its own DN which will be the one
that's accessed after selecting the GeneralName. For example if you set an
email address (which is part of the GeneralName), this will select the
GeneralName, and any subsequent DN accesses will refer to the DN inside the
GeneralName rather than the subject name DN. It's good practice to move back
to the subject name with:
cryptSetAttribute( cryptCert, CRYPT_CERTINFO_SUBJECTNAME,
CRYPT_UNUSED );
after working with a GeneralName to make sure that you're referring to the
correct DN.
Microsoft broke the Jet (MS Access) database engine at around SP4 (opinions on
the exact time vary). This version, or newer versions, may be installed
automatically when applying service packs or installing other software
(different broken versions of Jet are installed in Win2K SP2 and SP3, for
example, and it's built into Windows XP). The symptoms are that when running
the self-test you'll get an error message "Cannot open any more tables" even
though no tables are open, or more seriously a deadlock inside the VC++
runtime file access routines. The details of this problem are discussed in
Microsoft Knowledge Base Article 304536, Microsoft Knowledge Base Article
282010, and Microsoft Knowledge Base Article 239114.
The Microsoft-recommended fix is to upgrade to Jet SP6. This typically
requires downloading and installing the SP6 upgrade from the Microsoft
Download Centre, simply installing recent MDAC components won't work since
there were no Jet components included after MDAC 2.5 SP2, and installing
Office XP or Access 2002 may not work either since the setup programs only
update system files in certain situations and to a certain level. On the
other hand Jet SP6 may not install unless it detects an appropriate service
pack level on the system.
Non-Microsoft advice is to downgrade to a version of Jet at SP3 or earlier by
replacing msjetoledb40.dll and msjet40.dll with files from JET OLE DB SP3,
since even the latest version (SP6) still appears to exhibit these problems.
A better solution is to avoid the use of Jet entirely, and in particular you
should *never* use Jet in a production environment since it's far too buggy
and unstable to trust live data to (it was probably named Jet because it both
sucks and blows).
Changes in 3.1 beta 2
=====================
The last two type names that didn't follow the pattern xxx_TYPE, CRYPT_ALGO
and CRYPT_MODE, have now been brought into line with the other names, so you
need to change the type names to CRYPT_ALGO_TYPE and CRYPT_MODE_TYPE if you're
using them in your code.
SSHv2 server support is now present.
PKCS #11 devices can now be auto-detected by specifying the device name as
"[Autodetect]" if the device name isn't known.
Pre-connected network sockets can be supplied to sessions as the
CRYPT_SESSINFO_NETWORKSOCKET attribute, rather than having cryptlib
connect/disconnect the socket itself.
The PKCS #15 format has had various features added to it over time (see the
note for 3.0 beta 1), cryptlib has supported these in a read-only manner,
meaning that it creates keysets that are as backwards-compatible as possible
with old versions of the code that used earlier versions of PKCS #15. In
order to make some features like certificate update in a keyset possi ... ...
近期下载者:
相关文件:
收藏者: