QCA
QCA
What is it?
Taking a hint from the similarly-named Java Cryptography Architecture, QCA aims to provide a straightforward and cross-platform crypto API, using Qt datatypes and conventions. QCA separates the API from the implementation, using plugins known as Providers. The advantage of this model is to allow applications to avoid linking to or explicitly depending on any particular cryptographic library. This allows one to easily change or upgrade crypto implementations without even needing to recompile the application! QCA should work everywhere Qt does, including Windows/Unix/MacOSX.
What do I need to be able to use it?
Latest QCA depends on Qt 5.6+.
What features are supported?
- SSL/TLS
- X.509
- OpenPGP
- Cryptographic Message Syntax (for S/MIME)
- SASL
- PKCS#12
- Smart cards and other key storage
- Secure memory
- Secure random
- RSA/DSA/Diffie-Hellman
- Hash/Cipher/MAC algorithms
- Threading considerations
- Access operating system root certificates
How does it work?
The application includes <QtCrypto> and links to libqca, which provides the 'wrapper API' and plugin loader. Crypto functionality is determined during runtime, and plugins are loaded from the 'crypto' subfolder of the Qt Library Paths.
What is the development plan?
The base QCA library is considered mostly complete. Future development may include OCSP, shared certificate management, and improving the plugin API. However, there is no development plan for the base library at this time. Work will continue on the various plugins though, in order to get them into a release-quality state.
Compatibility
QCA follows a typical API/ABI compatibility scheme. Versions use the "major.minor.patch" format. Major versions of QCA may be incompatible with each other, minor versions are backwards compatible within the same major version, and patch versions are forwards and backwards compatible within the same minor version. This is the same scheme that Qt itself uses.
Documentation
API documentation in HTML format is included in the source distribution.
Where can I get it?
Source: qca-2.1.3.tar.gz
QCA has built-in support for the SHA1 and MD5 hash algorithms, and a weak random number source. To perform any other crypto operations (or to utilize improved versions of the built-in ones), an appropriate provider plugin is needed. There are several available so far, and you could always write your own, too.
As of QCA 2.1, the latest plugins are included in the main tarball and don’t need to be downloaded separately.
| Provider | Capabilities | Depends on |
|---|---|---|
| qca-ossl | TLS, CMS, X.509, RSA, DSA, Diffie-Hellman, PKCS#7, PKCS#12, SHA0, SHA1, SHA224, SHA256, SHA384, SHA512, MD2, MD4, MD5, RIPEMD160, Blowfish, DES, 3DES, AES128, AES192, AES256, CAST5, HMAC(SHA1, MD5, RIPEMD160), PBKDF1(MD2, SHA1), PBKDF2(SHA1) | OpenSSL 0.9.6+ |
| qca-cyrus-sasl | SASL | Cyrus SASL2 |
| qca-gnupg | OpenPGP | GnuPG 1.x or 2.x (runtime dependency only) |
| qca-pkcs11 | PKCS#11 (for smart cards) | pkcs11-helper 1.02+ |
| qca-wingss | SASL GSSAPI (for Kerberos) | Windows only (uses SSPI) |
| qca-logger | Internal module logging (for debug purposes) | None |
The latest source can be found in the 'qca' module of the KDE Git. The code can also be browsed on the web.
"keys" icon from KDE.