|
|
@@ -14,8 +14,12 @@
|
|
|
* Every classes are present.
|
|
|
|
|
|
* Most classes have their unit tests. Some tests like <code>
|
|
|
- SymmetricAlgorithmTest</code> are generated by an external
|
|
|
- tool.
|
|
|
+ SymmetricAlgorithmTest</code> are generated by external
|
|
|
+ tools.
|
|
|
+
|
|
|
+ * MACTripleDES is compatible with the implementation shipped in
|
|
|
+ framework 1.0. Version 1.1 gives different results when the
|
|
|
+ MACed data is a multiple of BlockSize (8 bytes).
|
|
|
</ul>
|
|
|
|
|
|
**** TODO
|
|
|
@@ -25,10 +29,6 @@
|
|
|
href="http://bugzilla.ximian.com/show_bug.cgi?id=40689">
|
|
|
40689</a>). The class need to be re-designed.
|
|
|
|
|
|
- * Support for adding/modifying OID using the
|
|
|
- <code>machine.config</code> configuration file (algorithms
|
|
|
- are done).
|
|
|
-
|
|
|
* RNGCryptoServiceProvider is currently only working on Linux.
|
|
|
The current implementation reside in Mono's runtime and use
|
|
|
the <code>/dev/[u]random</code> device (which do not exists
|
|
|
@@ -44,13 +44,6 @@
|
|
|
algorithm can be different for every CSP (Crypto Service
|
|
|
Provider). However for compatibility we should provide an
|
|
|
implementation compatible with the MS CSP (most likely used).
|
|
|
-
|
|
|
- * Analyse the current coverage of the unit tests on the
|
|
|
- cryptographic classes and complete the unit tests.
|
|
|
-
|
|
|
- * Optimizations (performance) on most class are possible. Some
|
|
|
- have been done using the Community Edition of BoundChecker
|
|
|
- (a free VisualStudio addon) - recommanded!
|
|
|
</ul>
|
|
|
|
|
|
**** Notes
|
|
|
@@ -58,7 +51,12 @@
|
|
|
* All cryptographic algorithms are entirely managed, including
|
|
|
classes named <code>*CryptoServiceProvider</code>, with the
|
|
|
exception of <code>RNGCryptoServiceProvider</code> (which
|
|
|
- resides in the runtime).
|
|
|
+ implementation resides in the runtime).
|
|
|
+
|
|
|
+ * There is a bug in the <code>PKCS1MaskGenerationMethod</code>
|
|
|
+ class (in both framework 1.0 and 1.1). This means our
|
|
|
+ implementation isn't compatible with MS (but is compatible with
|
|
|
+ PKCS#1 v.2.1). However we get OAEP padding for every platform!
|
|
|
|
|
|
* Look at assembly Mono.Security.Win32 if you require more
|
|
|
compatiblity with the Microsoft implementation (like accessing
|
|
|
@@ -79,9 +77,9 @@
|
|
|
|
|
|
* Unit tests are generated from a set of existing certificates
|
|
|
(about a dozen) each having different properties. Another
|
|
|
- set of certificates (more than 300) are used for a more
|
|
|
+ set of certificates (more than 700) are used for a more
|
|
|
complete test (but isn't part of the standard test suite for
|
|
|
- size and time consideration, i.e. a 3.5Mb C# source file).
|
|
|
+ size and time consideration, i.e. a 7.5Mb C# source file).
|
|
|
</ul>
|
|
|
|
|
|
**** TODO
|
|
|
@@ -90,10 +88,6 @@
|
|
|
certificates from PE files but cannot validate the signature
|
|
|
nor the certificate chain (and we're still missing some trust
|
|
|
anchors). See Tools section for more information.
|
|
|
-
|
|
|
- * Integration with CryptoAPI (on Windows) isn't possible as
|
|
|
- long as the <code>X509Certificate(IntPtr)</code> constructor
|
|
|
- isn't completed.
|
|
|
</ul>
|
|
|
|
|
|
**** Notes
|
|
|
@@ -149,10 +143,12 @@
|
|
|
<hr>
|
|
|
** Assembly: Mono.Security
|
|
|
|
|
|
- <b>Rational</b>
|
|
|
+ <b>Rational: </b>
|
|
|
This assembly provides the missing pieces to .NET security. On Windows
|
|
|
CryptoAPI is often used to provide much needed functionalities (like
|
|
|
- some cryptographic algorithms, code signing, X.509 certificates).
|
|
|
+ some cryptographic algorithms, code signing, X.509 certificates). Mono,
|
|
|
+ for platform independance, implements these functionalities in 100%
|
|
|
+ managed code.
|
|
|
|
|
|
*** Namespace: Mono.Security
|
|
|
<ul>
|
|
|
@@ -161,7 +157,8 @@
|
|
|
*** Namespace: Mono.Security.Authenticode
|
|
|
<ul>
|
|
|
* Code signing and verification.
|
|
|
- * Support for SPC files and PVK files.
|
|
|
+ * Support for SPC (Software Publisher Certificate) files and
|
|
|
+ PVK (Private Key) files.
|
|
|
</ul>
|
|
|
*** Namespace: Mono.Security.Cryptography
|
|
|
<ul>
|
|
|
@@ -170,20 +167,20 @@
|
|
|
</ul>
|
|
|
*** Namespace: Mono.Security.X509
|
|
|
<ul>
|
|
|
- * X.509 certificate building and decoding.
|
|
|
+ * X.509 structures (certificate, CRL...) building and decoding.
|
|
|
</ul>
|
|
|
*** Namespace: Mono.Security.X509.Extensions
|
|
|
<ul>
|
|
|
- * X.509 extensions (from X.509, PKIX, Netsapce, Microsoft,
|
|
|
- Entrust...).
|
|
|
+ * X.509 extensions (from public X.509 to private PKIX, Netsapce,
|
|
|
+ Microsoft, Entrust...).
|
|
|
</ul>
|
|
|
|
|
|
**** Status
|
|
|
<ul>
|
|
|
- * Some part of the work has not yet been commited (cleaning up).
|
|
|
+ * Some part of the work has not yet been commited (still cleaning up).
|
|
|
|
|
|
* A big part of this assembly is also included inside Mono's
|
|
|
- corlib. The class are duplicated in this assembly so the
|
|
|
+ corlib. The classes are duplicated in this assembly so the
|
|
|
functionalities can be used without a dependency on Mono's
|
|
|
corlib (which depends on Mono's runtime).
|
|
|
|
|
|
@@ -193,18 +190,19 @@
|
|
|
<hr>
|
|
|
** Assembly: Mono.Security.Win32
|
|
|
|
|
|
- <b>Rational</b>
|
|
|
+ <b>Rational: </b>
|
|
|
This assembly goal is to provide maximum compatibility with CryptoAPI
|
|
|
to application running with Mono's runtime on the Windows operating
|
|
|
system.
|
|
|
|
|
|
- <b>This assembly should NEVER be used directly by any application</b>.
|
|
|
+ <b>This assembly should NEVER be used directly by any application</b>
|
|
|
+ (e.g. referecing the assembly from a project).
|
|
|
The classes should only be used by modifying the <code>machine.config
|
|
|
</code> configuration file (and then only if this increased
|
|
|
compatibility is required by an application).
|
|
|
|
|
|
- See the file <code>/mcs/class/Mono.Security.Win32/README</code> for
|
|
|
- complete instructions.
|
|
|
+ See the file <code><a href="http://cvs.hispalinux.es/cgi-bin/cvsweb/~checkout~/mcs/class/Mono.Security.Win32/README?rev=1.1&content-type=text/plain&cvsroot=mono">/mcs/class/Mono.Security.Win32/README</a></code>
|
|
|
+ for complete instructions.
|
|
|
|
|
|
*** Namespace: Mono.Security.Cryptography
|
|
|
|
|
|
@@ -216,10 +214,10 @@
|
|
|
|
|
|
* Wrapper classes for unmanaged versions of hash algorithms:
|
|
|
MD2, MD4, MD5 and SHA1 are supported. <b>note</b>: some
|
|
|
- algorithms shouldn't be used in new design (MD4 is broken and
|
|
|
- MD2 isn't considered safe). They are included to preserve
|
|
|
- interoperability with older applications (e.g. some old, but
|
|
|
- still valid, X.509 certificates use MD2).
|
|
|
+ algorithms shouldn't be used in new design (MD4 is broken,
|
|
|
+ MD2 and MD5 aren't considered safe for some usage). They are
|
|
|
+ included to preserve interoperability with older applications
|
|
|
+ (e.g. some old, but still valid, X.509 certificates use MD2).
|
|
|
</ul>
|
|
|
|
|
|
**** TODO
|
|
|
@@ -235,9 +233,13 @@
|
|
|
|
|
|
**** Ideas
|
|
|
<ul>
|
|
|
- * Similar assembly could be created for <a href="http://www.openssl.org">
|
|
|
- OpenSSL</a>, NSS, crypto++, cryptlib ... for improved
|
|
|
- performance and/or HSM support under Linux.
|
|
|
+ * Similar assemblies (e.g. <code>Mono.Security.XXX</code>)
|
|
|
+ could be created for <a href="http://www.openssl.org">OpenSSL</a>,
|
|
|
+ <a href="http://www.mozilla.org/projects/security/pki/nss/">NSS</a>,
|
|
|
+ <a href="http://www.eskimo.com/~weidai/cryptlib.html">crypto++</a>,
|
|
|
+ <a href="http://www.cryptlib.orion.co.nz/">cryptlib</a> ... for
|
|
|
+ improved performance and/or HSM (Hardware Security Module) support
|
|
|
+ under Linux and/or Windows.
|
|
|
</ul>
|
|
|
<hr>
|
|
|
** Assembly: Microsoft.Web.Services
|
|
|
@@ -254,7 +256,7 @@
|
|
|
<a href="http://www.oasis-open.org/committees/wss/">OASIS</a> or
|
|
|
other committees.
|
|
|
|
|
|
- <b>[*] There are some licensing issues to consider before stating to
|
|
|
+ <b>[*] There are some licensing issues to consider before starting to
|
|
|
implement WS-Security. All contributors must sign an agreement with
|
|
|
Microsoft before commiting anything related to WS-Security into CVS.
|
|
|
</b>
|
|
|
@@ -273,7 +275,7 @@
|
|
|
<ul>
|
|
|
* Nothing (yet) commited in CVS. However the classes in this
|
|
|
namespace are outside WS-Security scope. So development, for
|
|
|
- those, could be done without signing any agreements.
|
|
|
+ those classes, could be done without signing any agreements.
|
|
|
</ul>
|
|
|
|
|
|
**** TODO
|
|
|
@@ -293,7 +295,7 @@
|
|
|
|
|
|
**** Status
|
|
|
|
|
|
- The following tools are complete:
|
|
|
+ The following tools are complete (mostly complete):
|
|
|
<ul>
|
|
|
* <code>secutil</code> is a tool to extract certificates and
|
|
|
strongnames from assemblies in a format that can be easily
|
|
|
@@ -307,12 +309,21 @@
|
|
|
can be used (once transformed in SPC) to sign assemblies.
|
|
|
</ul>
|
|
|
|
|
|
-**** TODO
|
|
|
- The following tools are still missing or incomplete:
|
|
|
+ Somewhat usable, somewhat incomplete:
|
|
|
<ul>
|
|
|
+ * <code>sn</code> is a clone of the <code>sn</code> to manage
|
|
|
+ strongnames. Current version is limited to creating new keypairs
|
|
|
+ and converting values.
|
|
|
+
|
|
|
* <code>monosn</code> is a clone of the <code>sn</code> to manage
|
|
|
strongnames. This tools is part of the runtime (not the class
|
|
|
library) and as such is written in C and won't run without Mono.
|
|
|
+ </ul>
|
|
|
+
|
|
|
+
|
|
|
+**** TODO
|
|
|
+ The following tools are still missing or largely incomplete:
|
|
|
+ <ul>
|
|
|
|
|
|
* <code>signcode</code> and <code>chktrust</code> (in progress)
|
|
|
for signing and validating Authenticode(tm) signatures on
|
|
|
@@ -331,28 +342,34 @@
|
|
|
<ul>
|
|
|
* SSL/TLS for secure communication (a prototype is under way).
|
|
|
Some work is already visible in Mono.Security assembly (e.g.
|
|
|
- RC4).
|
|
|
+ RC4, RSAManaged ...).
|
|
|
</ul>
|
|
|
|
|
|
|
|
|
<hr>
|
|
|
** How to Help
|
|
|
|
|
|
- Complete any of the TODO (and feel good about it ;-).
|
|
|
+ <ul>
|
|
|
+ * Complete any of the TODO (and feel good about it ;-).
|
|
|
|
|
|
- Add missing unit tests to classes or methods.
|
|
|
+ * Analyse the current coverage of the unit tests on the
|
|
|
+ cryptographic classes and complete the unit tests.
|
|
|
|
|
|
- Write some documentation on the cryptographic classes for the
|
|
|
- <a href="http://go-mono.com/tutorial/html/en/index.html">Mono
|
|
|
- Handbook</a> as I'm not a very good writer (at least in English).
|
|
|
+ * Optimization can also be done on most algorithms as crypto
|
|
|
+ is never fast enough. Some have been done using the
|
|
|
+ Community Edition of BoundChecker (a free VisualStudio
|
|
|
+ addon) - recommanded! Just be sure to test every optimization
|
|
|
+ (using the unit test) carefully - it's so fast to break an
|
|
|
+ algorithm ;-).
|
|
|
|
|
|
- Optimization can also be done on algorithms as crypto is never fast
|
|
|
- enough. Just be sure to test every optimization (using the unit test)
|
|
|
- carefully - it's so fast to break an algorithm ;-).
|
|
|
+ * Write some documentation on the cryptographic classes for
|
|
|
+ the <a href="http://go-mono.com/tutorial/html/en/index.html">Mono
|
|
|
+ Handbook</a> as I'm not a very good writer (at least in English).
|
|
|
+ </ul>
|
|
|
|
|
|
Contact Sebastien Pouliot (<a href="mailto:[email protected]">home</a>
|
|
|
, <a href="mailto:[email protected]">work</a>) if you need additional
|
|
|
informations about the status of the cryptographic classes.
|
|
|
|
|
|
<hr>
|
|
|
-Last reviewed: April 7, 2003 (post mono 0.23)
|
|
|
+Last reviewed: June 11, 2003 (post mono 0.24)
|
Sebastien Pouliot