search

dalek-cryptography / x25519-dalek

X25519 elliptic curve Diffie-Hellman key exchange in pure-Rust, using curve25519-dalek.
BSD 3-Clause "New" or "Revised" License
326 stars 132 forks source link

Create a prerelease using `curve25519-dalek 4.0.0-rc` #121

Closed stackinspector closed 1 year ago

stackinspector commented 1 year ago

The latest prerelease of ed25519-dalek has been updated to curve25519-dalek 4.0.0-rc, and using both prereleases (of it and this crate) would cause dependency redundance. The reason for using prereleases is that the ed25519-dalek and curve25519-dalek prereleases use digest API version 0.10, which does not force the hash algorithm to implement resetting state, which is different from the three-year-old version 0.9 used by current stable versions. And I need to replace the SHA2 algorithm in Ed25519 with cSHAKE256 provided by tiny-keccak crate (I know this makes it not specification-compliant) and the public API of tiny-keccak does not support resetting state. For now I'm using this crate on git main to solve this problem temporarily. (Is there a security risk with this?)

pinkforest commented 1 year ago

We are about to release rc.2 across the crates :heart: from current main which should be safe to use.

Just need to make StaticSecret optional today in which is one API change we are doing for 2.0.0 x25519 - if you're not using StaticSecret w/ default feature set then you'll be okay until rc.2 compat wise.

pinkforest commented 1 year ago

rc.2 is out btw across all the crates