Repository navigation
chore(deps): upgrade RustCrypto stack to latest versions - #25
Conversation
Upgrade all cryptography dependencies to their latest versions and
migrate the codebase to the new RustCrypto 0.11 ecosystem APIs.
Dependency updates:
- aes-gcm 0.10 -> 0.11.0-rc.3
- aes-gcm-siv 0.11 -> 0.12.0-rc.3
- ccm 0.5 -> 0.6.0-rc.3
- chacha20poly1305 0.10 -> 0.11.0-rc.3
- aead 0.5 -> 0.6.0-rc.10
- aes 0.8 -> 0.9
- chacha20 0.9 -> 0.10
- ctr 0.9 -> 0.10
- camellia 0.1 -> 0.2
- sm4 0.5 -> 0.6
- ghash 0.5 -> 0.6
- subtle 2.5 -> 2.6
- bytes 1.3 -> 1.11
- blake3 1.3 -> 1.8
The AEAD crates remain on their 0.11 rc releases because the stable
0.10 line still pins aes 0.8 and ghash 0.5, which would conflict with
the upgraded block/universal-hash stack.
API migration:
- Replace aead::generic_array with aead::array (hybrid-array)
- Replace AeadInPlace with AeadInOut (encrypt_inout_detached /
decrypt_inout_detached take InOutBuf)
- Update AeadCore impl for SM4-GCM: drop CiphertextOverhead, add
TAG_POSITION constant
- Replace deprecated Array::from_slice / from_mut_slice with TryFrom
- Rename cipher::{BlockEncrypt, BlockDecrypt} imports to their
BlockCipher{Encrypt,Decrypt} counterparts
- Import Unsigned from typenum (cipher::typenum / aead::array::typenum)
- Use cipher::Iv for chacha20 nonce (Nonce is no longer re-exported)
Also bump rust-version to 1.85 to match the MSRV of the new
RustCrypto crates.
|
What is left to do on this PR or what is blocking it? Asking to see if there is anything I can help with, because I would love a release of shadowsocks with |
|
|
|
This PR seem unblocked now! The RustCrypto project has released everything we need as stable. You can now bump all the release candidates to their stable versions. To help out I submitted that as a separate PR, but if you feel that's excessive then feel free to close it and just do the remaining upgrade here yourself. #26 |
aes-gcm 0.11, aes-gcm-siv 0.12, ccm 0.6, chacha20poly1305 0.11 and aead 0.6 are now published as stable, so drop the release candidate pins. No API changes between the rc.3 releases and stable.
3 participants
Summary
Upgrade all cryptography dependencies to their latest versions and migrate the codebase to the new RustCrypto 0.11 ecosystem APIs. All RustCrypto crates are now pinned to their stable releases: this PR initially used the
0.11-era release candidates, and the bump to the stable publishes landed via #26 (thanks @linus-mullvad!). The stable releases contain no API changes compared to the RCs.Dependency updates
The whole AEAD stack is moved together: the former stable 0.10 line still pins
aes 0.8andghash 0.5, which would conflict with the upgraded block/universal-hash crates, so the unified 0.11/0.12/0.6 generation keeps dependency resolution clean.API migration
aead::generic_arraywithaead::array(hybrid-array)AeadInPlacewithAeadInOut—encrypt_inout_detached/decrypt_inout_detachednow take anInOutBufAeadCoreimpl: dropCiphertextOverhead, add the newTAG_POSITIONassociated constantArray::from_slice/from_mut_slicewithTryFromcipher::{BlockEncrypt, BlockDecrypt}imports to theirBlockCipher{Encrypt,Decrypt}counterpartsUnsignedfromtypenum(cipher::typenum/aead::array::typenum) since the re-export atcipher::Unsignedwas removedcipher::Ivfor ChaCha20 nonce (chacha20::Nonceis no longer re-exported)Also bumps
rust-versionto 1.85 to match the MSRV of the new RustCrypto generation.Verification
Verified against the stable releases (both locally and in CI):
cargo build --features "v1-stream v1-aead-extra v2-extra"— 0 errors, 0 warningscargo test --features "v1-stream v1-aead-extra v2-extra"— 25/25 passingcargo test --features "v1-stream v1-aead-extra v2-extra aws-lc"— 25/25 passingcargo clippyand build/test jobs green across ubuntu/windows/macosNote
The pre-existing
ringfeature remains broken (theringbranch inaes_gcm.rsandchacha20_poly1305.rsdeclares helper traits but never exposes theAes128Gcm/Aes256Gcm/ChaCha20Poly1305structs). This bug existed before this PR and is unrelated to the dependency upgrade.