mirrors/arti.git/crates/tor-llcrypto/src/pk, branch arti-v1.1.5

llcrypto: Don't take or return "unescorted" ed25519 keys.

2023-05-18T15:00:43Z

Per #798, we want to make sure that we never pass around an `ed25519::SecretKey`; only an `ed25519::Keypair` (or `ExpandedKeypair`). This is because, when you're computing an ed25519 signature, you have to use the public key as one of your inputs, and if you ever use a mismatched public key you are vulnerable to a nonce reuse attack. (For more info see https://moderncrypto.org/mail-archive/curves/2020/001012.html )

llcrypto: Add an `ed25519::ExpandedKeypair` type.

2023-05-18T14:56:43Z

This is like an `ed25519::Keypair`, except that instead of a `SecretKey` it contains an `ExpandedSecretKey`. We'll be using this to implement #798, where we impose a rule that there must be no "unescorted" ed25519 secret keys.

Use non-deprecated *Secret::random_from_rng.

2023-05-13T20:52:23Z

The `new` function is deprecated in x25519-dalek 2.0.0-rc.2

update rsa to 0.9.x

2023-05-08T15:24:23Z

tor-llcrypto: key blinding: Use consistent terminology

2023-03-28T11:47:12Z

Unhelpfully, the spec uses the variable name `h` and the phrase "blinding factor" for both the unclamped and clamped value. The clamped value is internal to the algorithm. In our code: * Don't ever use the word "parameter" or variable name `param`. This doesn't appear in the spec anywhere. * Use `h` for the unclamped blinding factor, and `blinding_factor` for the clamped blinding factor. * Rename `blinding_factor` function to `clamp_blinding_factor`, since in the spec's terminology it takes an (unclamped) "blinding factor" and returns a (clamped) "blinding factor". * State explicitly what thing in the spec the `h` parameters are.

Use the type system to enforce use of blinded keys.

2023-03-27T10:45:51Z

Hidden services use blinded singing keys derived from the identity key to sign descriptor signing keys. Before this patch, the hidden descriptor builder represented its blinded signing keys (`blinded_id`) as plain `ed25519::Keypair`s. This was not ideal, as there was nothing preventing the caller from accidentally initializing `blinded_id` with an unblinded keypair. This introduces a new `HsBlindKeypair` type to represent blinded keypairs. Signed-off-by: Gabriela Moldovan

Expose a little new functionality from tor-llcrypto.

2023-02-28T16:23:44Z

Expose ED25519 signature length; make ValidatableEd25519Signature implement Debug and Clone.

llcrypto: Implement `Into<[u8;32]>` for Ed25519Identity

2023-02-07T14:00:19Z

tor-llcrypto: Tolerate some warnings (fmt)

2023-01-20T17:29:45Z

tor-llcrypto: Tolerate some warnings

2023-01-20T16:37:31Z

Without this, cargo +stable clippy -p tor-netdoc --all-features produces warnings.