[WIP] Update crypto deps to prerelease versions #731
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
No New Or Fixed Issues Found |
dani-garcia
force-pushed
the
ps/update-crypto-pre
branch
from
45e7416
to
22120ba
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## ps/solve-kdf-leaks #731 +/- ##
======================================================
- Coverage 60.96% 60.90% -0.06%
======================================================
Files 173 173
Lines 10731 10716 -15
======================================================
- Hits 6542 6527 -15
Misses 4189 4189 ☔ View full report in Codecov by Sentry. |
dani-garcia
added a commit
that referenced
this pull request
Apr 26, 2024
## Type of change ``` - [ ] Bug fix - [ ] New feature development - [x] Tech debt (refactoring, code cleanup, dependency upgrades, etc) - [ ] Build/deploy pipeline (DevOps) - [ ] Other ``` ## Objective - The `pbkdf2` and `argon` implementation have been updated to use their `SensitiveVec`s as buffers and outputs. - Some functions are using `inline(always)` to avoid stack copies. - The `base64` implementation was updated to avoid using `decode_string` as that produced some leaks in some circumstances, instead we decode to a `SensitiveVec` and then use `try_into` to convert to a `String`. - The testing framework has been expanded with some MasterKey cases, and the Dockerfile has been improved to cache the built dependencies, allowing a much faster develop-test loop. Note that some of the argon tests are leaky for the moment, I've tested the new pre-release versions of the crypto crates, which include new zeroize features for sha1, sha2, and blake2 (used by argon). This seems to help a bit -> #731
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Type of change
Objective
Update all the crypto crates to the latest prerelease versions, these crates have changed from
generic-arraytohybrid-array, as far as I know to make better use of const generics. I've decided to change all the usages ofgeneric-arrayto a normal rust[u8; N], but I still added the dependency in theCargo.tomlto enable thezeroizefeature.Note that this requires updating MSRV from 1.71 to 1.72