search

dalek-cryptography / x25519-dalek

X25519 elliptic curve Diffie-Hellman key exchange in pure-Rust, using curve25519-dalek.
BSD 3-Clause "New" or "Revised" License
328 stars 133 forks source link

Update rand_core to 0.6 #64

Closed PaulGrandperrin closed 2 years ago

PaulGrandperrin commented 3 years ago

https://github.com/rust-random/rand/blob/master/rand_core/CHANGELOG.md This new version makes using rand_core on wasm seamless (thanks to the update of getrandom to v0.2) The crate compiles well with this PR, but since some rand_core traits are publicly exposed in this crate's API, this is strictly speaking a breaking change.

PaulGrandperrin commented 3 years ago

it'll be very useful for a crate like https://github.com/novifinancial/opaque-ke to be used in a browser

Frederick888 commented 3 years ago

Sorry if I overlooked something, but is https://github.com/dalek-cryptography/x25519-dalek/blob/0985e1babf0ba03d151b864ee28baee564662a8d/src/x25519.rs#L229 actually needed? I updated rand_core locally without enabling getrandom and removed this line, then tried e.g. cargo test --features=default,serde,std,u64_backend and it seemed ok.

PaulGrandperrin commented 3 years ago

@Frederick888 I pushed a new commit removing the use of OsRng and the getrandom feature, but for some reason, it didn't trigger a new travis test.

Andrew-Shay commented 3 years ago

Any status updates on this PR?

PaulGrandperrin commented 3 years ago

It seems that there is an issue with the leadership and release process at https://github.com/dalek-cryptography. See https://github.com/dalek-cryptography/curve25519-dalek/pull/338#issuecomment-772059572 Maybe @hdevalence will create x25519-dalek-ng with new PR merged?

isislovecruft commented 3 years ago

Hey, I'm happy to merge this into a 2.x alpha which tracks the curve25519-dalek 4.x alphas, if that is a tenable solution to fix problems in production deploys which want the latest rand. I don't have a hard date set yet for releasing those new major versions, as I would like to minimise future backporting efforts, but also maximise downstream compatibility and batch enough breaking changes together to not be a continual breakage point. Thoughts, anyone?

mcginty commented 3 years ago

Both snow and innernet would benefit from an alpha, since you can't cargo publish crates with git dependencies, for what it's worth :).