New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 755368 link

Starred by 2 users

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , iOS , Chrome , Mac , Fuchsia
Pri: 3
Type: Task



Sign in to add a comment

Remove base::MD5Context

Project Member Reported by rsleevi@chromium.org, Aug 14 2017

Issue description

base::MD5Context was created, along with the SHA-1, to allow //base code to use MD5 or SHA-1 without any dependencies on NSS or the OS APIs, the latter of which may not be accessible from renderers when the sandbox is in place.

However, with the BoringSSL migration, and with Web Crypto, we already have BoringSSL in the renderer process and we no longer have a dependency on NSS. From looking at the existing consumers, I believe we should be able to replace base::MD5Context with the BoringSSL-using implementation.

While mostly academic, this would at least allow us to reduce the number of MD5 implementations by one, while also leveraging the more optimized implementation from BoringSSL.

Consumers would need to take a dependency on BoringSSL, but a cursory glance suggests all existing consumers already do, and given the static linking, should not reduce in any increased code size.
 

Comment 1 by jif@chromium.org, Aug 25 2017

Owner: rsleevi@chromium.org
Status: Assigned (was: Untriaged)
Owner: ----
Status: Available (was: Assigned)
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 29 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/163381df24701a304695f7556948a16d36d090dd

commit 163381df24701a304695f7556948a16d36d090dd
Author: Zentaro Kavanagh <zentaro@google.com>
Date: Fri Sep 29 03:38:46 2017

Replace internal crypto implementations with boringssl.

- Replace uses of MD5 implementation in base with boringssl.
- Replace uses of internal MD4 implementation with boringssl.
- Use DES directly from boringssl and remove mozilla DES code.
- The existing DES code was partially using boringssl already.
- The existing DES code was setting parity itself. Now uses
boringssl's DES_set_odd_parity
- Re-implemented the mapping of a 128 bit NTLM hash 
onto three DES keys in Create3DesKeysFromNtlmHash

BUG=chromium:755368, chromium:22532 

Change-Id: I9f363b66c32dc8f7529627887ac46023403637e4
Reviewed-on: https://chromium-review.googlesource.com/616801
Commit-Queue: Zentaro Kavanagh <zentaro@google.com>
Reviewed-by: David Benjamin <davidben@chromium.org>
Reviewed-by: Ryan Sleevi <rsleevi@chromium.org>
Reviewed-by: Asanka Herath <asanka@chromium.org>
Cr-Commit-Position: refs/heads/master@{#505285}
[modify] https://crrev.com/163381df24701a304695f7556948a16d36d090dd/net/BUILD.gn
[delete] https://crrev.com/9b8d378a2d15a3f9e3bc3b2f4c941b38a8aa34eb/net/ntlm/des.cc
[delete] https://crrev.com/9b8d378a2d15a3f9e3bc3b2f4c941b38a8aa34eb/net/ntlm/des.h
[delete] https://crrev.com/9b8d378a2d15a3f9e3bc3b2f4c941b38a8aa34eb/net/ntlm/des_unittest.cc
[delete] https://crrev.com/9b8d378a2d15a3f9e3bc3b2f4c941b38a8aa34eb/net/ntlm/md4.cc
[delete] https://crrev.com/9b8d378a2d15a3f9e3bc3b2f4c941b38a8aa34eb/net/ntlm/md4.h
[delete] https://crrev.com/9b8d378a2d15a3f9e3bc3b2f4c941b38a8aa34eb/net/ntlm/md4_unittest.cc
[modify] https://crrev.com/163381df24701a304695f7556948a16d36d090dd/net/ntlm/ntlm.cc
[modify] https://crrev.com/163381df24701a304695f7556948a16d36d090dd/net/ntlm/ntlm.h
[modify] https://crrev.com/163381df24701a304695f7556948a16d36d090dd/net/ntlm/ntlm_unittest.cc

Project Member

Comment 4 by sheriffbot@chromium.org, Oct 1

Labels: Hotlist-Recharge-Cold
Status: Untriaged (was: Available)
This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Status: Available (was: Untriaged)
Labels: Enterprise-Triaged

Sign in to add a comment