Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert aes-gcm-siv patch once new version is pushed #168

Closed
bunnie opened this issue May 29, 2022 · 2 comments
Closed

Revert aes-gcm-siv patch once new version is pushed #168

bunnie opened this issue May 29, 2022 · 2 comments
Assignees
Labels
security An issue potentially related to security - memory leaks, architectural crypto, etc.

Comments

@bunnie
Copy link
Member

bunnie commented May 29, 2022

As a reminder of how we got to this purgatory: I thought it would be a good idea to have FIDO2. Which requires CBC for AES. CBC isn't in AES 0.7...

Which brought us to refactoring AES to API level 0.8

Which also brought our cipher dependency to 0.4

Which now contradicts the dependencies required by aes-gcm-siv latest version (0.10.3).

But, a new version of aes-gcm-siv is in the works! pending per issue RustCrypto/AEADs#410

This issue is to remind myself to absorb the release and remove the monkey patch over the aes-gcm-siv dependency from the Cargo.toml file inside the PDDB server, once this problem is resolved.

And with this, I partially take back the gripes about OpenSK rolling all their own crypto APIs. "At least they had CBC on AES without having to pull their software supply chain through a wormhole."

@bunnie bunnie added the security An issue potentially related to security - memory leaks, architectural crypto, etc. label May 29, 2022
@bunnie bunnie self-assigned this May 29, 2022
@bunnie
Copy link
Member Author

bunnie commented Jun 20, 2022

RustCrypto/AEADs@479ae5f moves us closer to closing this issue. For now, we are pointing to the top of their master branch so we're compiling against a preview of what will be released.

All that's missing now is a tagged release.

bunnie added a commit that referenced this issue Jun 20, 2022
at least we're off a fork and back onto the main repo.
@bunnie
Copy link
Member Author

bunnie commented Jul 11, 2022

Also AES-GCM-SIV just found its way into root-keys so don't forget to update it there, too.

@bunnie bunnie closed this as completed in 5be62e3 Aug 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security An issue potentially related to security - memory leaks, architectural crypto, etc.
Projects
None yet
Development

No branches or pull requests

1 participant