On Thu, Nov 25, 2010 at 09:29:40PM +0100, Pierre Joye wrote:
> On Wed, Nov 24, 2010 at 9:04 PM, Dan Fandrich <dan_at_coneharvesters.com> wrote:
> > On Wed, Nov 24, 2010 at 12:25:02PM +0100, Pierre Joye wrote:
> >> Yes, the CryptoAPI is crypto safe (in decent windows versions, xp sp1+
> >> afair) and is also used by openssl btw. See an example here:
> >>
> >> http://lxr.php.net/opengrok/xref/PHP_5_3/win32/winutil.c#52
> >
> > If OpenSSL already uses this, then does libcurl need to seed it
> > as well?
>
> Right, I don't think it is necessary.

How about the case where it's running under a Windows pre-XP SP1? Perhaps
we need a run-time check and still do the RAND_screen() call only in those
cases. This assumes that the linked OpenSSL will always be new enough that
it calls the CryptoAPI itself where appropriate. What would a suitable
run-time check be?

>>> Dan
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
Received on 2010-11-25