RustCrypto / hashes

Collection of cryptographic hash functions written in pure Rust
1.9k stars 256 forks source link

Upgrade issues from sha-1 0.9.8 to sha1 0.10.x #464

Closed burkematthew closed 1 year ago

burkematthew commented 1 year ago

Hi there!

First, thanks for all the hard work that has gone into building and maintaining this crate.

Secondly, we're running into some issues when upgrading from sha-1 0.9.8 to sha1 0.10.x. I've reviewed the PRs associated with the release of 0.10.x and looked through the docs, but nothing seems to indicate a recommended path to address.

Here is a snippet of our previously working source:

use base64::encode;
use hmacsha::HmacSha;
use sha1::Sha1;
use tracing::{debug, warn};

async fn valid_signature(signature: &str, uri: &str) -> bool {
  let signing_key = std::env::var("TOKEN").unwrap_or_else(|_| "".to_string());
  if signing_key.is_empty() {
    warn!(target: crate::EVENT_TARGET_LOG_STREAM, "No signing key found.  Failing validation.");
    return false;
  }

  let mut hasher = HmacSha::new(signing_key.as_bytes(), uri.as_bytes(), Sha1::default());
  let buf = hasher.compute_digest();
  let result = buf.as_slice();
  let encoded_digest = encode(result);

  debug!(target: crate::EVENT_TARGET_LOG_STREAM, "Encoded Digest: {}", &encoded_digest);
  encoded_digest == signature
}

However, when upgrading to 0.10.x, the following line is failing because trait bounds are not satisfied:

  let mut hasher = HmacSha::new(signing_key.as_bytes(), uri.as_bytes(), Sha1::default());

In particular, some of the trait bounds that are not satisfied are:

digest::Update
digest::FixedOutput
digest::Reset

This seems like some breaking changes to me, but nothing to assist in how to remediate these breaks. Anything that can be offered to assist would be greatly appreciated!

tarcieri commented 1 year ago

Whatever hmacsha is, it looks like it needs to be updated to digest v0.10 as well

newpavlov commented 1 year ago

Also, if hmacsha uses the hmac crate under the hood, then it also has to be updated to v0.12.