feat: upgrade crypto ecosystem to latest RustCrypto stack (#1)

Upgrade all core cryptographic dependencies to their latest versions: Dependencies: - digest: 0.10 to 0.11 - elliptic-curve: 0.13 to 0.14 - hkdf: 0.12 to 0.13 - hmac: 0.12 to 0.13 - rand: 0.8 to 0.10 - rand_chacha: 0.3 to 0.10 - sha2: 0.10 to 0.11 - getrandom: 0.2 to 0.4 (WASM) - ml-kem: 0.3.0-rc.0 to 0.3 - ecdsa: 0.16 to 0.17.0-rc.23 - rfc6979: 0.4 to 0.6 (now internal to ecdsa) - p256/p384/p521: 0.13 to 0.14.0-rc.15 - curve25519-dalek: 4 to 5.0.0-rc - ed25519-dalek: 2 to 3.0.0-rc - cryptoki: 0.9 to 0.12 - rustyline: 17 to 18 - scrypt: 0.11 to 0.12 - voprf replaced by voprf-vx 1.0.0-pre.0 Migration changes: - generic-array 0.14 to 1.4 with hybrid-array 0.4 interop - ArrayLength<u8> to ArrayLength (generic-array 1.x) - Added ConcatExt trait to disambiguate from [T]::concat - Replaced Hmac with SimpleHmac for digest 0.11 compatibility - Added OutputSize<H>: ArrayLength bounds throughout Hash trait - Converted hybrid_array::Array between GenericArray at API boundaries - Updated GroupEncoding Repr bound to hybrid_array::Array - ECDSA sign now uses ecdsa::hazmat::sign_prehashed_rfc6979 - Removed direct rfc6979 dependency (handled by ecdsa internally) - Replaced bincode with postcard for no_std serialization - Re-exported hybrid_array from crate root Other changes: - Renamed crate to opaque-vx - Increased MSRV to 1.89 - Added cryptography to Cargo.toml categories - Removed Facebook-specific contributions from CONTRIBUTING.md - Removed v3 to v4 migration test - Removed unstable rustfmt configurations for stable compatibility Reviewed-on: #1 Co-authored-by: UneBaguette <[email protected]> Co-committed-by: UneBaguette <[email protected]>
2026-07-01 11:52:12 +02:00
parent 5e2ba86643
commit 71df1ee49a
45 changed files with 1680 additions and 1483 deletions
@@ -1,112 +0,0 @@
-// Copyright (c) Meta Platforms, Inc. and affiliates.
-//
-// This source code is dual-licensed under either the MIT license found in the
-// LICENSE-MIT file in the root directory of this source tree or the Apache
-// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
-// of this source tree. You may select, at your option, one of the above-listed
-// licenses.
-
-use digest::OutputSizeUser;
-use generic_array::GenericArray;
-use generic_array::sequence::{Concat, Split};
-use generic_array::typenum::Sum;
-use opaque_ke::ksf::Identity;
-use opaque_ke::{CipherSuite, ClientLogin, ServerLogin, ServerRegistration, ServerSetup, TripleDh};
-use opaque_ke_3::key_exchange::group::KeGroup as v3KeGroup;
-use opaque_ke_3::key_exchange::tripledh::TripleDh as v3TripleDh;
-use opaque_ke_3::keypair::KeyPair;
-use opaque_ke_3::ksf::Identity as v3Identity;
-use opaque_ke_3::{
-    CipherSuite as v3CipherSuite, ClientRegistration as v3ClientRegistration,
-    ServerRegistration as v3ServerRegistration, ServerSetup as v3ServerSetup,
-};
-use p256::NistP256;
-use rand::rngs::OsRng;
-use sha2::Sha256;
-
-const PASSWORD: &[u8] = b"test password";
-const CLIENT_IDENTIFIER: &[u8] = b"test client identifier";
-
-struct OldCipherSuite;
-
-impl v3CipherSuite for OldCipherSuite {
-    type OprfCs = NistP256;
-    type KeGroup = NistP256;
-    type KeyExchange = v3TripleDh;
-    type Ksf = v3Identity;
-}
-
-struct NewCipherSuite;
-
-impl CipherSuite for NewCipherSuite {
-    type OprfCs = NistP256;
-    type KeyExchange = TripleDh<NistP256, Sha256>;
-    type Ksf = Identity;
-}
-
-#[test]
-fn registration_upload() {
-    // V3 registration.
-    let result = v3ClientRegistration::<OldCipherSuite>::start(&mut OsRng, PASSWORD).unwrap();
-    let client = result.state;
-
-    let old_server_setup = v3ServerSetup::<OldCipherSuite>::new(&mut OsRng);
-    let response =
-        v3ServerRegistration::start(&old_server_setup, result.message, CLIENT_IDENTIFIER)
-            .unwrap()
-            .message;
-
-    let upload = client
-        .finish(&mut OsRng, PASSWORD, response, Default::default())
-        .unwrap()
-        .message;
-
-    let old_registration = v3ServerRegistration::finish(upload);
-
-    // `ServerSetup` migration.
-    let server_setup = {
-        let old_serialized = old_server_setup.serialize();
-
-        type OldSeedLen = <<<OldCipherSuite as v3CipherSuite>::OprfCs as voprf::CipherSuite>::Hash as OutputSizeUser>::OutputSize;
-        type OldSkLen = <<OldCipherSuite as v3CipherSuite>::KeGroup as v3KeGroup>::SkLen;
-        let (old_serialied_rest, old_fake_keypair_serialized): (
-            GenericArray<u8, Sum<OldSeedLen, OldSkLen>>,
-            _,
-        ) = old_serialized.split();
-        let old_fake_keypair =
-            KeyPair::<<OldCipherSuite as v3CipherSuite>::KeGroup>::from_private_key_slice(
-                &old_fake_keypair_serialized,
-            )
-            .unwrap();
-        let old_fake_pk_serialized = old_fake_keypair.public().serialize();
-
-        let new_serialized = old_serialied_rest.concat(old_fake_pk_serialized);
-        ServerSetup::<NewCipherSuite>::deserialize(&new_serialized).unwrap()
-    };
-
-    // `ServerRegistration` migration.
-    let old_registration_serialized = old_registration.serialize();
-    let registration =
-        ServerRegistration::<NewCipherSuite>::deserialize(&old_registration_serialized).unwrap();
-
-    // Check if new `ServerRegistration` still works.
-    let result = ClientLogin::<NewCipherSuite>::start(&mut OsRng, PASSWORD).unwrap();
-    let client = result.state;
-
-    let result = ServerLogin::start(
-        &mut OsRng,
-        &server_setup,
-        Some(registration),
-        result.message,
-        CLIENT_IDENTIFIER,
-        Default::default(),
-    )
-    .unwrap();
-    let server = result.state;
-
-    let result = client
-        .finish(&mut OsRng, PASSWORD, result.message, Default::default())
-        .unwrap();
-
-    server.finish(result.message, Default::default()).unwrap();
-}
@@ -36,27 +36,27 @@ use elliptic_curve::sec1::{FromEncodedPoint, ModulusSize, Tag, ToEncodedPoint};
 use elliptic_curve::{AffinePoint, CurveArithmetic, FieldBytesSize, Group as _, ProjectivePoint};
 use generic_array::typenum::Unsigned;
 use generic_array::{ArrayLength, GenericArray};
-use opaque_ke::key_exchange::KeyExchange;
-use opaque_ke::key_exchange::group::Group;
+use opaque_vx::key_exchange::KeyExchange;
+use opaque_vx::key_exchange::group::Group;
 #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
-use opaque_ke::key_exchange::group::ed25519::{self, Ed25519};
-use opaque_ke::key_exchange::group::elliptic_curve::NonIdentity;
+use opaque_vx::key_exchange::group::ed25519::{self, Ed25519};
+use opaque_vx::key_exchange::group::elliptic_curve::NonIdentity;
 #[cfg(feature = "ecdsa")]
-use opaque_ke::key_exchange::sigma_i::ecdsa::{self, Ecdsa, PreHash};
+use opaque_vx::key_exchange::sigma_i::ecdsa::{self, Ecdsa, PreHash};
 #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
-use opaque_ke::key_exchange::sigma_i::pure_eddsa::PureEddsa;
+use opaque_vx::key_exchange::sigma_i::pure_eddsa::PureEddsa;
 #[cfg(feature = "ecdsa")]
-use opaque_ke::key_exchange::sigma_i::{CachedMessage, HashOutput, Message, SigmaI};
-use opaque_ke::key_exchange::tripledh::TripleDh;
-use opaque_ke::keypair::{KeyPair, PublicKey};
-use opaque_ke::ksf::Identity;
-use opaque_ke::{
+use opaque_vx::key_exchange::sigma_i::{CachedMessage, HashOutput, Message, SigmaI};
+use opaque_vx::key_exchange::tripledh::TripleDh;
+use opaque_vx::keypair::{KeyPair, PublicKey};
+use opaque_vx::ksf::Identity;
+use opaque_vx::{
    CipherSuite, ClientLogin, ClientLoginFinishParameters, ClientLoginStartResult,
    ClientRegistration, ClientRegistrationFinishParameters, ClientRegistrationStartResult,
    ServerLogin, ServerLoginParameters, ServerLoginStartResult, ServerRegistration, ServerSetup,
 };
 #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
-use opaque_ke::{Curve25519, Ristretto255};
+use opaque_vx::{Curve25519, Ristretto255};
 use p256::NistP256;
 use p384::NistP384;
 use p521::NistP521;