Adding standalone RSA code

[Colin Percival]

Ryan Sommers wrote:
> I have to say I'm with Mark and das@ (I believe it was). As good as
> smaller and more efficeint sounds, when it comes to crypto libraries I'd
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> rather stick with OpenSSL.

You're missing the point.  I'm not talking about "smaller and more efficient".
I'm talking about "smaller and more secure".

> It's definately a lot more source code,
> however, as stated above, it has quite a few more eyes on it as well.

Openssl has had 8 significant security flaws fixed in the past two years.
Yes, they have more eyes looking at their code -- but even if they've found
80% of the security problems in the past two years, that still leaves two
major security flaws left.

Further, speaking from my experience on secteam, I'm more than a little
dubious of the "many eyes" concept anyway (at least when it comes to
security issues); the amount of time that security flaws sit in our tree
before anyone notices them is rather depressing.

> What happens if during a lapse of ENOTIME for you a bug
> comes up with the library and exposes a severe security flaw for an
> application making use of it?

In that case, the 9410 people (at last count) who have used FreeBSD Update
in the past couple of years are already in trouble. :-)

Colin Percival