Node, OpenSSL, and patented encryption algorithms about node-convergence-archive HOT 10 CLOSED

If I should instead be posting this to https://github.com/joyent/node/issues, please let me know.

from node-convergence-archive.

My apologies, I clicked the wrong button and closed the issue by mistake. --Steve

from node-convergence-archive.

MDC2 and RC5 are disabled by default. IDEA is enabled, however. You can check yourself with iojs -p 'require("crypto").getCiphers()'.

If you want to disable IDEA, you can add OPENSSL_NO_IDEA to the defines in deps/openssl/openssl.gyp.

from node-convergence-archive.

Thanks, Ben.

Re: IDEA, I take it that we would need to recompile Node after adjusting the openssl.gyp file, or do I have that wrong? Can it be disabled otherwise in javascript code without rebuilding?

I don't know as much about the legal status of IDEA, so I will need to look into that in more detail.

Thanks again!

from node-convergence-archive.

Some information on IDEA: http://www.quadibloc.com/crypto/co040302.htm

from node-convergence-archive.

You'd have to recompile, yes.

from node-convergence-archive.

Thanks, Ben. Your help is much appreciated. --Steve

from node-convergence-archive.

When I run the getCiphers() command above, I don't see RC5 or MDC2, as Ben indicated. I do get a few IDEA-based ciphers:

'idea',
'idea-cbc',
'idea-cfb',
'idea-ecb',
'idea-ofb',

It looks like I might be able to exclude the IDEA algorithm from the ciphers used, as shown on this page, where !RC4 is used (as an example). Perhaps I could do the same with !IDEA. I'll give that a try, and if it works, perhaps that will be sufficient for the lawyers.

from node-convergence-archive.

please take this to the new https://github.com/nodejs/node repo if it's still valid for discussion

from node-convergence-archive.

For posterity, I had a typo in my comment: it said OPENSSL_NO_ASM instead of OPENSSL_NO_IDEA. Updated.

from node-convergence-archive.