Subject: C-Client and security

From: "Sushmita Roy" <[email-masked]>
Date: Mon, 11 Jun 2001 12:19:36 +0530

Hi Mark,

   I had a couple of doubts regarding the C-client library.

 1. Is there any way of using S/Mime or PGP with C-client ?
    Considering that there is support for basic Mime parsing,
    how do I fit in 3rd party libraries for S/Mime or PGP ?

 2. Besides CRAM-MD5 and APOP, is there support for any other
    forms of security (Digital Signatures, etc) in the C-Client
    library ? Maybe in the future versions ?

 3. Has anybody implemented a thread-safe version of the
    C-client library (without strtok, gethostbyname, etc) ?

 Thanks and Regards
 Sushmita

---

From: Mark Crispin <[email-masked]>
Date: Wed, 13 Jun 2001 23:48:15 -0700 (PDT)

>     how do I fit in 3rd party libraries for S/Mime or PGP ?

S/MIME, PGP, digital signatures, etc. are all done externally to c-client.
c-client consists of routines to access and transmit mail; what you are
asking about is not part of c-client's mission.  Similarly, it is not the
mission of the S/MIME libraries to do IMAP.

You use c-client with other libraries the way that you use any other set
of libraries.  You are not restricted to using a single library in your
application program.

As a general principal, you'd use c-client calls to access the data, when
you would then pass to the S/MIME library.  And vice versa.  You have to
study the calls available in both libraries, and work out for yourself how
you want to do this.  I realize that this isn't particularly helpful, but
the fact is that I would have to do the same amount of study myself to
answer specific questions about how to do this..

>     library ? Maybe in the future versions ?

CRAM-MD5 and APOP are methods of authentication (to log in), and as such
are part of c-client's mission because c-client needs to log in to access
or transmit mail.

That is completely different from digital signatures.

>     C-client library (without strtok, gethostbyname, etc) ?

Personally, I think that the C library should be fixed so that you can
call standard routines such as gethostbyname() without having to worry
about whether or not it is "thread-safe".  Other programming languages and
operating systems implemented threads without having such nonsense.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.