github-starred/libxlsxwriter

Fork 0

mirror of https://github.com/jmcnamara/libxlsxwriter.git synced 2026-05-15 14:15:54 -06:00

[GH-ISSUE #286] Does libxlsxwriter contain any encryption/decryption code? #230

New issue

Closed

opened 2026-05-05 12:00:15 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 12:00:15 -06:00

Owner

Originally created by @znakeeye on GitHub (May 4, 2020).
Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/286

Originally assigned to: @jmcnamara on GitHub.

When compiling the library, will any type of encryption/decryption be linked with the library?

Reading the source code, there seem to be few fragments of encryption which are excluded:

/* Encryption not required by libxlsxwriter. */
#ifndef NOCRYPT
#define NOCRYPT
#endif
#ifndef NOUNCRYPT
#define NOUNCRYPT
#endif

However, it would be great if the documentation was clear about the use of encryption/decryption. This is a very important topic e.g. when it comes to trade compliance.

Originally created by @znakeeye on GitHub (May 4, 2020). Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/286 Originally assigned to: @jmcnamara on GitHub. When compiling the library, will any type of encryption/decryption be linked with the library? Reading the source code, there seem to be few fragments of encryption which are excluded: ``` /* Encryption not required by libxlsxwriter. */ #ifndef NOCRYPT #define NOCRYPT #endif #ifndef NOUNCRYPT #define NOUNCRYPT #endif ``` However, it would be great if the documentation was clear about the use of encryption/decryption. This is a very important topic e.g. when it comes to **trade compliance**.

gitea-mirror

2026-05-05 12:00:15 -06:00

closed this issue
added the
question
label

gitea-mirror commented

2026-05-05 12:00:21 -06:00

Author

Owner

@jmcnamara commented on GitHub (May 4, 2020):

When compiling the library, will any type of encryption/decryption be linked with the library?

No. The NOCRYPT flag is for minizip.c in the third party code.

This is a very important topic e.g. when it comes to trade compliance.

Good suggestion. I'll add something about that to the Licence page.

@jmcnamara commented on GitHub (May 4, 2020): > When compiling the library, will any type of encryption/decryption be linked with the library? No. The `NOCRYPT` flag is for minizip.c in the third party code. > This is a very important topic e.g. when it comes to **trade compliance**. Good suggestion. I'll add something about that to the Licence page.

gitea-mirror commented

2026-05-05 12:00:22 -06:00

Author

Owner

@jmcnamara commented on GitHub (May 4, 2020):

Note, the library does embed and use (optionally on) MD5 which is a hashing function. I don't know if that is covered or forbidden by export/trade compliance. Does anyone know?

@jmcnamara commented on GitHub (May 4, 2020): Note, the library does embed and use ([optionally on](https://libxlsxwriter.github.io/license.html)) MD5 which is a hashing function. I don't know if that is covered or forbidden by export/trade compliance. Does anyone know?

gitea-mirror commented

2026-05-05 12:00:23 -06:00

Author

Owner

@znakeeye commented on GitHub (May 5, 2020):

A bit uncertain, I'd say. Here is a somewhat old source that states that MD5 is "cryptographic". Still, this hashing function is no longer considered secure. Hmm.

Which parts of the library depend on MD5?

@znakeeye commented on GitHub (May 5, 2020): A bit uncertain, I'd say. [Here](https://www.federalregister.gov/documents/2010/06/25/2010-15072/encryption-export-controls-revision-of-license-exception-enc-and-mass-market-eligibility-submission) is a somewhat old source that states that `MD5` is "cryptographic". Still, this hashing function is no longer considered secure. Hmm. Which parts of the library depend on MD5?

gitea-mirror commented

2026-05-05 12:00:24 -06:00

Author

Owner

@jmcnamara commented on GitHub (May 5, 2020):

Which parts of the library depend on MD5?

From the Licence file:

Note, the MD5 library is used to avoid including duplicate image files in the xlsx file. If this functionality isn't required it is possible to compile libxlsxwriter without this library by passing USE_NO_MD5=1 to make.

@jmcnamara commented on GitHub (May 5, 2020): > Which parts of the library depend on MD5? From the [Licence](https://libxlsxwriter.github.io/license.html) file: _Note, the MD5 library is used to avoid including duplicate image files in the xlsx file. If this functionality isn't required it is possible to compile libxlsxwriter without this library by passing `USE_NO_MD5=1` to make._

gitea-mirror commented

2026-05-05 12:00:26 -06:00

Author

Owner

@znakeeye commented on GitHub (May 5, 2020):

Ah, great. So with this flag set, the library will definitely be 100% free of cryptographic functions. It seems.

@znakeeye commented on GitHub (May 5, 2020): Ah, great. So with this flag set, the library will definitely be 100% free of cryptographic functions. It seems.

gitea-mirror commented

2026-05-05 12:00:28 -06:00

Author

Owner

@jmcnamara commented on GitHub (May 31, 2020):

Closing this even though we didn't get an answer to the underlying question on whether export compliance is required with libxlsxwriter. If anyone know that please let me know.

@jmcnamara commented on GitHub (May 31, 2020): Closing this even though we didn't get an answer to the underlying question on whether export compliance is required with libxlsxwriter. If anyone know that please let me know.