Re: [DotGNU]Encryption protocols

[Norbert Bollow]

Chris Smith <address@hidden> wrote:

> Norbert and I have discussed OpenSSL and GnuPGP at great length in terms of 
> licencing (as openssl isn't gpl, but fairly compatible).  The solution that 
> came up was to use 'a crypt toolkit' but not specifically openssl or 
> gnupgp.... OpenSSL would be the prefered option IMO as it's so well
> respected and trusted, but GNUPgp sould be the default at compile
> time as it's GPL... > (I'd want to use openssl every time though TBH :o)

I think with "fairly compatible", Chris means "GPL-incompatible in a
manner that can be worked around with a linking exception."  If I
recall correctly I proposed some language for a linking exception that
explicitly allows linking with any crypto library that is Free
Software.  Nota bene, we certainly don't want a linking exception that
allows linking with non-free crypto stuff.  Protecting computer users
from being effectively forced to use non-free crypto stuff is one of
the main goals of DotGNU.

In any case, the GNU libs, libgcrypt and GNU TLS should be the
default, simply because they're part of GNU, and if there should
be a serious problem with either of them, we should contribute
to fixing the problem rather than choosing a different default.

However, of course when there are Free Software libs which are as
popular as OpenSSL we want to make it easy (e.g. with a configure
option) for people to link with OpenSSL instead of the default.

Greetings, Norbert.

-- 
Founder & Steering Committee member of http://gnu.org/projects/dotgnu/
Free Software Business Strategy Guide   --->  http://FreeStrategy.info
Norbert Bollow, Weidlistr.18, CH-8624 Gruet (near Zurich, Switzerland)
Tel +41 1 972 20 59        Fax +41 1 972 20 69       http://norbert.ch