search

hyperledger / aries-bbssignatures-rs

Apache License 2.0
5 stars 6 forks source link

Pairing-plus out-dated #5

Open andrewwhitehead opened 1 year ago

andrewwhitehead commented 1 year ago

pairing-plus is the library that implements the bls12-381 curve as well as the hash-to-curve operations. It hasn't been updated in 3 years at this point, and while the bls12_381 library would be a good replacement otherwise, unfortunately pairing-plus does not match up with the current hash-to-curve spec - it implements draft 7. Updating would be a breaking change, but that also restricts the versions of blake2 and hkdf that can be used here. The only solution to allow updating the other dependencies without breaking compatibility of the signatures might be to vendor the pairing-plus dependency.

swcurran commented 1 year ago

Can we use the existing library for now, and then consider update options once we have a stable deployment?

andrewwhitehead commented 1 year ago

Yes, it still builds and there aren't any known security issues.