Re: [edk2-devel] [RFC] [staging/CryptoLibrary] Openssl1.1 replacement proposal

["Yao, Jiewen" <jiewen.yao@intel.com>]

If you are asking how to do that best *at this moment*, I suggest we create a branch in https://github.com/tianocore/edk2-staging and continue the research work. Before September 2023, we need community's help to resolve openssl-3 size issue, before check in.

If you are asking how to do that best after September 2023, we have no choice but put to edk2 main branch. We have to remove openssl-11.

If we have either openssl-30 and mbedtls work (size/feature), we can replace openssl-11 with either openssl-30 or mbedtls.

Worst case, if we have to support dual-crypto module, I think to:
1) replace openssl-11 with openssl-30 directly.
2) add mbedtls as another cryptolib instance.

Thank you
Yao, Jiewen

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Gerd
> Hoffmann
> Sent: Wednesday, February 8, 2023 7:45 PM
> To: devel@edk2.groups.io; Yao, Jiewen <jiewen.yao@intel.com>
> Subject: Re: [edk2-devel] [RFC] [staging/CryptoLibrary] Openssl1.1 replacement
> proposal
> 
>   Hi,
> 
> > 3. If 1 or 2 can success, we can replace openssl 1.1 with one crypto lib.
> > If both 1 and 2 fail, we may use *dual-crypto module*. For example: mbedtls
> for PEI and openssl3.0 for DXE.
> > The source code size will become larger, more time to download the tree.
> 
> Suggestions how to do that best, ideally without duplicating CryptoPkg
> for that?
> 
> A while back I've tried to add openssl-3 in parallel to openssl-11,
> with the idea to allow projects picking the one or the other, and quicky
> ran into problems because apparently libraries can't add include
> directories.  Only packages can do that (see Includes.Common.Private in
> CryptoPkg/CryptoPkg.dec which adds Library/OpensslLib/openssl/include).
> 
> take care,
>   Gerd
> 
> 
> 
> 
>