Re: [PATCH v3 3/5] argon2: Import Argon2 from cryptsetup

[Daniel Kiper]

On Tue, Mar 10, 2020 at 07:58:30PM +0100, Patrick Steinhardt wrote:
> In order to support the Argon2 key derival function for LUKS2, we
> obviously need to implement Argon2. It doesn't make a lot of sense to
> hand-code any crypto, which is why this commit instead imports Argon2
> from the cryptsetup project. This commit thus imports the code from the
> official reference implementation located at [1]. The code is licensed
> under CC0 1.0 Universal/Apache 2.0. Given that both LGPLv2.1+ and Apache
> 2.0 are compatible with GPLv3, it should be fine to import that code.
>
> The code is imported from commit 62358ba (Merge pull request #270 from
> bitmark-property-system/master, 2019-05-20). To make it work for GRUB,
> several adjustments were required that have beed documented in
> "grub-dev.texi".
>
> [1]: https://github.com/P-H-C/phc-winner-argon2
>
> Signed-off-by: Patrick Steinhardt <address@hidden>

[...]

> diff --git a/grub-core/lib/argon2/argon2.c b/grub-core/lib/argon2/argon2.c
> new file mode 100644
> index 000000000..c77f7f6ff
> --- /dev/null
> +++ b/grub-core/lib/argon2/argon2.c
> @@ -0,0 +1,232 @@
> +/*
> + * Argon2 reference source code package - reference C implementations
> + *
> + * Copyright 2015
> + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves
> + *
> + * You may use this work under the terms of a Creative Commons CC0 1.0
> + * License/Waiver or the Apache Public License 2.0, at your option. The 
> terms of
> + * these licenses can be found at:
> + *
> + * - CC0 1.0 Universal : http://creativecommons.org/publicdomain/zero/1.0
> + * - Apache 2.0        : http://www.apache.org/licenses/LICENSE-2.0
> + *
> + * You should have received a copy of both of these licenses along with this
> + * software. If not, they may be obtained at the above URLs.
> + */
> +
> +#include <grub/dl.h>
> +
> +#include "argon2.h"
> +#include "core.h"
> +
> +GRUB_MOD_LICENSE ("GPLv3");

I think we should change that if the license above is different.
Anyway, I am trying to get in touch with FSF license team. I have not
got a reply yet... I will see what is possible in my company...

Otherwise patch LGTM...

Daniel