Skip to content

Commit ad4fd7e

Browse files
baloobaloo
committed
bump rustcrypto dependencies to pre-release
Signed-off-by: Arthur Gautier <arthur.gautier@arista.com>
1 parent 08efe62 commit ad4fd7e

25 files changed

+927
-525
lines changed

‎.clippy.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
msrv = "1.76.0"
1+
msrv = "1.85.0"

‎.codespellrc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
[codespell]
22
skip = .git,target,Cargo.lock
3-
ignore-words-list = acsend,crate,keypair,daa,de,ser
3+
ignore-words-list = acsend,crate,keypair,inout,daa,de,ser

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
- name: Build the container
3232
run: docker build -t ubuntucontainer tss-esapi/tests/ --file tss-esapi/tests/Dockerfile-ubuntu --target tpm2-tools
3333
- name: Run the container
34-
run: docker run -v $(pwd):/tmp/rust-tss-esapi -w /tmp/rust-tss-esapi/tss-esapi --env RUST_TOOLCHAIN_VERSION=1.76.0 ubuntucontainer /tmp/rust-tss-esapi/tss-esapi/tests/all-ubuntu.sh
34+
run: docker run -v $(pwd):/tmp/rust-tss-esapi -w /tmp/rust-tss-esapi/tss-esapi --env RUST_TOOLCHAIN_VERSION=1.85.0 ubuntucontainer /tmp/rust-tss-esapi/tss-esapi/tests/all-ubuntu.sh
3535
# All in one job as I think it is a big overhead to build and run the Docker
3636
# container?
3737
tests-ubuntu:
@@ -118,7 +118,7 @@ jobs:
118118
- name: Build the container
119119
run: docker build -t ubuntucontainer tss-esapi/tests/ --file tss-esapi/tests/Dockerfile-ubuntu --target tpm2-tss
120120
- name: Check Clippy lints MSRV
121-
run: docker run -v $(pwd):/tmp/rust-tss-esapi -w /tmp/rust-tss-esapi/tss-esapi --env RUST_TOOLCHAIN_VERSION=1.76.0 ubuntucontainer /tmp/rust-tss-esapi/tss-esapi/tests/lint-checks.sh
121+
run: docker run -v $(pwd):/tmp/rust-tss-esapi -w /tmp/rust-tss-esapi/tss-esapi --env RUST_TOOLCHAIN_VERSION=1.85.0 ubuntucontainer /tmp/rust-tss-esapi/tss-esapi/tests/lint-checks.sh
122122
- name: Check Clippy lints latest
123123
run: docker run -v $(pwd):/tmp/rust-tss-esapi -w /tmp/rust-tss-esapi/tss-esapi ubuntucontainer /tmp/rust-tss-esapi/tss-esapi/tests/lint-checks.sh
124124

‎tss-esapi-sys/Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ license = "Apache-2.0"
1111
repository = "https://github.com/parallaxsecond/rust-tss-esapi"
1212
documentation = "https://docs.rs/crate/tss-esapi-sys"
1313
links = "tss2-esys"
14-
rust-version = "1.76.0"
14+
rust-version = "1.85.0"
1515

1616
[build-dependencies]
1717
bindgen = { version = "0.72.0", optional = true }

‎tss-esapi/Cargo.toml‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ categories = ["api-bindings", "external-ffi-bindings", "cryptography"]
1010
license = "Apache-2.0"
1111
repository = "https://github.com/parallaxsecond/rust-tss-esapi"
1212
documentation = "https://docs.rs/crate/tss-esapi"
13-
rust-version = "1.76.0"
13+
rust-version = "1.85.0"
1414

1515
[[example]]
1616
name = "hmac"
@@ -32,50 +32,54 @@ num-derive = "0.4.2"
3232
num-traits = "0.2.12"
3333
hostname-validator = "1.1.0"
3434
regex = "1.3.9"
35-
zeroize = { version = "1.5.7", features = ["zeroize_derive"] }
35+
zeroize = { version = "1.8.2", features = ["zeroize_derive"] }
3636
tss-esapi-sys = { path = "../tss-esapi-sys", version = "0.6.0-alpha.1" }
37-
x509-cert = { version = "0.2.0", optional = true }
38-
ecdsa = { version = "0.16.9", features = [
37+
x509-cert = { version = "0.3.0-rc.4", optional = true }
38+
ecdsa = { version = "0.17.0-rc.16", features = [
39+
"algorithm",
3940
"der",
4041
"hazmat",
41-
"arithmetic",
42-
"verifying",
4342
], optional = true }
44-
elliptic-curve = { version = "0.13.8", optional = true, features = [
43+
elliptic-curve = { version = "0.14.0-rc.28", optional = true, features = [
4544
"alloc",
4645
"pkcs8",
4746
] }
48-
p192 = { version = "0.13.0", optional = true }
49-
p224 = { version = "0.13.2", optional = true }
50-
p256 = { version = "0.13.2", optional = true }
51-
p384 = { version = "0.13.0", optional = true }
52-
p521 = { version = "0.13.3", optional = true }
53-
pkcs8 = { version = "0.10.2", optional = true }
54-
rsa = { version = "0.9", optional = true }
55-
sha1 = { version = "0.10.6", optional = true }
56-
sha2 = { version = "0.10.8", optional = true }
57-
sha3 = { version = "0.10.8", optional = true }
58-
sm2 = { version = "0.13.3", optional = true }
59-
sm3 = { version = "0.4.2", optional = true }
60-
digest = { version = "0.10.7", optional = true }
61-
signature = { version = "2.2.0", features = ["std"], optional = true }
47+
p192 = { version = "0.14.0-rc.7", optional = true }
48+
p224 = { version = "0.14.0-rc.7", optional = true }
49+
p256 = { version = "0.14.0-rc.7", optional = true }
50+
p384 = { version = "0.14.0-rc.7", optional = true }
51+
p521 = { version = "0.14.0-rc.7", optional = true }
52+
pkcs8 = { version = "0.11.0-rc.10", optional = true }
53+
rsa = { version = "0.10.0-rc.16", optional = true }
54+
sha1 = { version = "0.11.0-rc.5", optional = true }
55+
sha2 = { version = "0.11.0-rc.5", optional = true }
56+
sha3 = { version = "0.11.0-rc.8", optional = true }
57+
sm2 = { version = "0.14.0-rc.7", optional = true }
58+
sm3 = { version = "0.5.0-rc.5", optional = true }
59+
digest = { version = "0.11.1", optional = true }
60+
signature = { version = "3.0.0-rc.10", features = [
61+
"alloc",
62+
"digest",
63+
], optional = true }
6264
cfg-if = "1.0.0"
6365
strum = { version = "0.26.3", optional = true }
6466
strum_macros = { version = "0.26.4", optional = true }
6567
paste = "1.0.14"
66-
getrandom = "0.2.11"
68+
getrandom = "0.4.0"
6769

6870
[dev-dependencies]
6971
env_logger = "0.11.5"
7072
serde_json = "^1.0.108"
71-
sha2 = { version = "0.10.8", features = ["oid"] }
73+
sha2 = { version = "0.11.0-rc.5", features = ["oid"] }
7274
tss-esapi = { path = ".", features = [
7375
"integration-tests",
7476
"serde",
7577
"abstraction",
7678
"rustcrypto-full",
7779
] }
78-
x509-cert = { version = "0.2.0", features = ["builder"] }
80+
p256 = { version = "0.14.0-rc.7", features = ["ecdh"] }
81+
rand = "0.10"
82+
x509-cert = { version = "0.3.0-rc.4", features = ["builder"] }
7983

8084
[build-dependencies]
8185
semver = "1.0.7"

‎tss-esapi/src/abstraction/no_tpm/quote.rs‎

Lines changed: 43 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -13,19 +13,16 @@ use digest::{Digest, DynDigest};
1313
#[cfg(any(feature = "p224", feature = "p256", feature = "p384"))]
1414
use crate::{abstraction::public::AssociatedTpmCurve, structures::EccSignature};
1515
#[cfg(any(feature = "p224", feature = "p256", feature = "p384"))]
16-
use ecdsa::{
17-
hazmat::{DigestPrimitive, VerifyPrimitive},
18-
PrimeCurve, SignatureSize, VerifyingKey,
19-
};
16+
use ecdsa::{hazmat::DigestAlgorithm, PrimeCurve, SignatureSize, VerifyingKey};
2017
#[cfg(any(feature = "p224", feature = "p256", feature = "p384"))]
2118
use elliptic_curve::{
22-
generic_array::ArrayLength,
19+
array::ArraySize,
2320
point::AffinePoint,
24-
sec1::{FromEncodedPoint, ModulusSize, ToEncodedPoint},
21+
sec1::{FromSec1Point, ModulusSize, ToSec1Point},
2522
CurveArithmetic, FieldBytesSize,
2623
};
2724
#[cfg(any(feature = "p224", feature = "p256", feature = "p384"))]
28-
use signature::hazmat::PrehashVerifier;
25+
use signature::DigestVerifier;
2926

3027
#[cfg(feature = "rsa")]
3128
use rsa::{pkcs1v15, pss, RsaPublicKey};
@@ -40,9 +37,9 @@ fn verify_ecdsa<C>(
4037
hashing_algorithm: HashingAlgorithm,
4138
) -> Result<bool>
4239
where
43-
C: PrimeCurve + CurveArithmetic + DigestPrimitive + AssociatedTpmCurve,
44-
AffinePoint<C>: VerifyPrimitive<C> + FromEncodedPoint<C> + ToEncodedPoint<C>,
45-
SignatureSize<C>: ArrayLength<u8>,
40+
C: PrimeCurve + CurveArithmetic + DigestAlgorithm + AssociatedTpmCurve,
41+
AffinePoint<C>: FromSec1Point<C> + ToSec1Point<C>,
42+
SignatureSize<C>: ArraySize,
4643
FieldBytesSize<C>: ModulusSize,
4744
{
4845
let Ok(signature) = ecdsa::Signature::<C>::try_from(signature) else {
@@ -56,25 +53,45 @@ where
5653

5754
match hashing_algorithm {
5855
#[cfg(feature = "sha1")]
59-
HashingAlgorithm::Sha1 => {
60-
let hash = sha1::Sha1::digest(message);
61-
Ok(verifying_key.verify_prehash(&hash, &signature).is_ok())
62-
}
56+
HashingAlgorithm::Sha1 => Ok(verifying_key
57+
.verify_digest(
58+
|d: &mut sha1::Sha1| {
59+
Digest::update(d, message);
60+
Ok(())
61+
},
62+
&signature,
63+
)
64+
.is_ok()),
6365
#[cfg(feature = "sha2")]
64-
HashingAlgorithm::Sha256 => {
65-
let hash = sha2::Sha256::digest(message);
66-
Ok(verifying_key.verify_prehash(&hash, &signature).is_ok())
67-
}
66+
HashingAlgorithm::Sha256 => Ok(verifying_key
67+
.verify_digest(
68+
|d: &mut sha2::Sha256| {
69+
Digest::update(d, message);
70+
Ok(())
71+
},
72+
&signature,
73+
)
74+
.is_ok()),
6875
#[cfg(feature = "sha2")]
69-
HashingAlgorithm::Sha384 => {
70-
let hash = sha2::Sha384::digest(message);
71-
Ok(verifying_key.verify_prehash(&hash, &signature).is_ok())
72-
}
76+
HashingAlgorithm::Sha384 => Ok(verifying_key
77+
.verify_digest(
78+
|d: &mut sha2::Sha384| {
79+
Digest::update(d, message);
80+
Ok(())
81+
},
82+
&signature,
83+
)
84+
.is_ok()),
7385
#[cfg(feature = "sha2")]
74-
HashingAlgorithm::Sha512 => {
75-
let hash = sha2::Sha512::digest(message);
76-
Ok(verifying_key.verify_prehash(&hash, &signature).is_ok())
77-
}
86+
HashingAlgorithm::Sha512 => Ok(verifying_key
87+
.verify_digest(
88+
|d: &mut sha2::Sha512| {
89+
Digest::update(d, message);
90+
Ok(())
91+
},
92+
&signature,
93+
)
94+
.is_ok()),
7895
_ => Err(Error::WrapperError(WrapperErrorKind::UnsupportedParam)),
7996
}
8097
}

‎tss-esapi/src/abstraction/public.rs‎

Lines changed: 25 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ use crate::{Error, WrapperErrorKind};
88

99
use core::convert::TryFrom;
1010
use elliptic_curve::{
11-
generic_array::typenum::Unsigned,
12-
sec1::{EncodedPoint, FromEncodedPoint, ModulusSize, ToEncodedPoint},
11+
array::typenum::Unsigned,
12+
sec1::{FromSec1Point, ModulusSize, Sec1Point, ToSec1Point},
1313
AffinePoint, CurveArithmetic, FieldBytesSize, PublicKey,
1414
};
1515

@@ -18,7 +18,7 @@ use x509_cert::spki::SubjectPublicKeyInfoOwned;
1818
#[cfg(feature = "rsa")]
1919
use {
2020
crate::structures::RsaExponent,
21-
rsa::{BigUint, RsaPublicKey},
21+
rsa::{BoxedUint, RsaPublicKey},
2222
};
2323

2424
#[cfg(any(
@@ -41,7 +41,7 @@ impl<C> TryFrom<&Public> for PublicKey<C>
4141
where
4242
C: CurveArithmetic + AssociatedTpmCurve,
4343
FieldBytesSize<C>: ModulusSize,
44-
AffinePoint<C>: FromEncodedPoint<C> + ToEncodedPoint<C>,
44+
AffinePoint<C>: FromSec1Point<C> + ToSec1Point<C>,
4545
{
4646
type Error = Error;
4747

@@ -57,15 +57,13 @@ where
5757
let x = unique.x().as_bytes();
5858
let y = unique.y().as_bytes();
5959

60-
if x.len() != FieldBytesSize::<C>::USIZE {
61-
return Err(Error::local_error(WrapperErrorKind::InvalidParam));
62-
}
63-
if y.len() != FieldBytesSize::<C>::USIZE {
64-
return Err(Error::local_error(WrapperErrorKind::InvalidParam));
65-
}
66-
67-
let encoded_point =
68-
EncodedPoint::<C>::from_affine_coordinates(x.into(), y.into(), false);
60+
let encoded_point = Sec1Point::<C>::from_affine_coordinates(
61+
x.try_into()
62+
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?,
63+
y.try_into()
64+
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?,
65+
false,
66+
);
6967
let public_key = PublicKey::<C>::try_from(&encoded_point)
7068
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?;
7169

@@ -86,10 +84,10 @@ impl TryFrom<&Public> for RsaPublicKey {
8684
unique, parameters, ..
8785
} => {
8886
let exponent = match parameters.exponent() {
89-
RsaExponent::ZERO_EXPONENT => BigUint::from(RSA_DEFAULT_EXP),
90-
_ => BigUint::from(parameters.exponent().value()),
87+
RsaExponent::ZERO_EXPONENT => BoxedUint::from(RSA_DEFAULT_EXP),
88+
_ => BoxedUint::from(parameters.exponent().value()),
9189
};
92-
let modulus = BigUint::from_bytes_be(unique.as_bytes());
90+
let modulus = BoxedUint::from_be_slice_vartime(unique.as_bytes());
9391

9492
let public_key = RsaPublicKey::new(modulus, exponent)
9593
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?;
@@ -163,7 +161,7 @@ impl<C> TryFrom<&TpmPublicKey> for PublicKey<C>
163161
where
164162
C: CurveArithmetic + AssociatedTpmCurve,
165163
FieldBytesSize<C>: ModulusSize,
166-
AffinePoint<C>: FromEncodedPoint<C> + ToEncodedPoint<C>,
164+
AffinePoint<C>: FromSec1Point<C> + ToSec1Point<C>,
167165
{
168166
type Error = Error;
169167

@@ -173,17 +171,21 @@ where
173171
let x = x.as_slice();
174172
let y = y.as_slice();
175173

176-
// TODO: When elliptic_curve bumps to 0.14, we can use the TryFrom implementation instead
177-
// of checking lengths manually
178174
if x.len() != FieldBytesSize::<C>::USIZE {
179175
return Err(Error::local_error(WrapperErrorKind::InvalidParam));
180176
}
181177
if y.len() != FieldBytesSize::<C>::USIZE {
182178
return Err(Error::local_error(WrapperErrorKind::InvalidParam));
183179
}
184180

185-
let encoded_point =
186-
EncodedPoint::<C>::from_affine_coordinates(x.into(), y.into(), false);
181+
let encoded_point = Sec1Point::<C>::from_affine_coordinates(
182+
x.try_into()
183+
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?,
184+
y.try_into()
185+
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?,
186+
false,
187+
);
188+
187189
let public_key = PublicKey::<C>::try_from(&encoded_point)
188190
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?;
189191

@@ -201,8 +203,8 @@ impl TryFrom<&TpmPublicKey> for RsaPublicKey {
201203
fn try_from(value: &TpmPublicKey) -> Result<Self, Self::Error> {
202204
match value {
203205
TpmPublicKey::Rsa(modulus) => {
204-
let exponent = BigUint::from(RSA_DEFAULT_EXP);
205-
let modulus = BigUint::from_bytes_be(modulus.as_slice());
206+
let exponent = BoxedUint::from(RSA_DEFAULT_EXP);
207+
let modulus = BoxedUint::from_be_slice_vartime(modulus.as_slice());
206208

207209
let public_key = RsaPublicKey::new(modulus, exponent)
208210
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?;

‎tss-esapi/src/abstraction/signatures.rs‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,16 @@ use crate::{
88

99
use std::convert::TryFrom;
1010

11-
use ecdsa::SignatureSize;
11+
use ecdsa::{EcdsaCurve, SignatureSize};
1212
use elliptic_curve::{
13-
generic_array::{typenum::Unsigned, ArrayLength},
13+
array::{typenum::Unsigned, ArraySize},
1414
FieldBytes, FieldBytesSize, PrimeCurve,
1515
};
1616

1717
impl<C> TryFrom<&EccSignature> for ecdsa::Signature<C>
1818
where
19-
C: PrimeCurve,
20-
SignatureSize<C>: ArrayLength<u8>,
19+
C: PrimeCurve + EcdsaCurve,
20+
SignatureSize<C>: ArraySize,
2121
{
2222
type Error = Error;
2323

@@ -33,8 +33,12 @@ where
3333
}
3434

3535
let signature = ecdsa::Signature::from_scalars(
36-
FieldBytes::<C>::clone_from_slice(r),
37-
FieldBytes::<C>::clone_from_slice(s),
36+
FieldBytes::<C>::try_from(r)
37+
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?
38+
.clone(),
39+
FieldBytes::<C>::try_from(s)
40+
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?
41+
.clone(),
3842
)
3943
.map_err(|_| Error::local_error(WrapperErrorKind::InvalidParam))?;
4044
Ok(signature)
@@ -43,8 +47,8 @@ where
4347

4448
impl<C> TryFrom<&Signature> for ecdsa::Signature<C>
4549
where
46-
C: PrimeCurve,
47-
SignatureSize<C>: ArrayLength<u8>,
50+
C: PrimeCurve + EcdsaCurve,
51+
SignatureSize<C>: ArraySize,
4852
{
4953
type Error = Error;
5054

0 commit comments

Comments
 (0)