aboutsummaryrefslogtreecommitdiff
path: root/crates/tor-llcrypto/src
Commit message (Collapse)AuthorAgeFilesLines
* Run maint/add_warning to add lint block everywhereIan Jackson2023-08-234-0/+4
|
* Resolve warnings about ambiguous/redundant doc linksNick Mathewson2023-08-221-2/+2
| | | | | Nightly rustdoc now warns if you have a link that isn't necessary, and if you have a link that might refer to two different things.
* llcrypto: New SimpleMac traitNick Mathewson2023-08-142-0/+19
| | | | | | | | | This will be useful in preference to the regular Mac trait for the places where we need to pass a Mac key around, but we don't need to support incremental operation. Part of arti#993, where we want to expose a MAC object without exposing sensitive data.
* Run add_warnings on all files.Nick Mathewson2023-08-041-2/+2
|
* tor-llcrypto: Add a missing instance of the standard lint blockIan Jackson2023-07-101-0/+10
| | | | This fixes a needless_vec lint on nightly.
* Run maint/add_warning to actually apply new lint allowsIan Jackson2023-07-104-0/+4
|
* Run add_warning to remove `missing_panics_doc` deny.Nick Mathewson2023-07-061-1/+0
| | | | Closes #950.
* llcrypto: Add reference to paper about keypair reuse.Gabriela Moldovan2023-06-271-0/+2
|
* llcrypto: Remove `# Availability` doc sections.Gabriela Moldovan2023-06-271-8/+0
| | | | | | | | | | This removes the `# Availability` section from the `convert_ed25519_to_curve25519_private` and `convert_curve25519_to_ed25519_private` docs. We don't generally have this sort of section anywhere else in the codebase (we use unstable cargo-docs features to make sure items are annotated correctly).
* llcrypto: Add cvt-x25519 feature flag for exporting key conversion functions.Gabriela Moldovan2023-06-272-4/+5
| | | | | | The `convert_curve25519_to_ed25519_private` and `convert_ed25519_to_curve25519_private` functions are now exported by `tor-llcrypto` if the `cvt-25519` feature is enabled.
* llcrypto: Add keymgr feature to semver.mdGabriela Moldovan2023-06-271-0/+1
|
* llcrypto: Add `Panics`, `Availability` docs for ↵Gabriela Moldovan2023-06-271-0/+12
| | | | convert_ed25519_to_curve25519_private.
* llcrypto: Fix clippy lint.Gabriela Moldovan2023-06-271-1/+1
|
* llcrypto: Explain what we need the ed25519->x25519 conversion for.Gabriela Moldovan2023-06-271-0/+4
|
* llcrypto: Document how convert_ed25519_to_curve25519_private computes the key.Gabriela Moldovan2023-06-271-0/+5
|
* llcrypto: Add note about bumping x25519-dalek and clamping.Gabriela Moldovan2023-06-271-0/+45
| | | | | | | | | | This adds a TODO explaining how convert_ed25519_to_curve25519_private will need to be audited when we upgrade to the latest x25519-dalek. This also adds a `debug_assertions` and a test that ensures `StaticSecret::from` is clamping the input (when we bump x25519-dalek, the assertions will fail, as the latest version doesn't do clamping in StaticSecret::from).
* llcrypto: Document ed25519->curve25519->ed25519 conversion behaviour.Gabriela Moldovan2023-06-271-0/+5
|
* llcrypto: Implement ed25519_to_curve25519_private conversion.Gabriela Moldovan2023-06-271-0/+57
| | | | | | | | | | | | | In `ArtiNativeKeyStore`, private keys are stored in OpenSSH format. However, `ssh-key` (the crate we use for parsing OpenSSH keys) doesn't support x25519 keys. As a workaround, this type of key will stored as ed25519 and converted to x25519 upon retrieval. This commit implements the `convert_ed25519_to_curve25519_private` conversion function (needed by `ArtiNativeKeyStore` to support x25519 keys). Part of #900
* Back down x25519-dalek to 2.0.0-pre.1 from 2.0.0-rc.2pinkforest2023-06-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ========================= Notes from nickm: (This differs from pinkforest's original MR: It removes the Cargo.lock changes and the version bump on tor-llcrypto.) Minimal Cargo.lock changes from downgrade. (These are exactly those changes generated by running "build" and "test".) There are several reasons to do this: * It's best to bump all of our dalek dependencies at once to rc.3 or later, rather than the piecemeal approach we've been stuck with so far. * We don't want to do this bump right now, since there are some tricky questions about clamping we need to figure out (see #808), and we need to make sure we get them right, and we're in a distracted this week. * We _do_ need to move away from 2.0.0-rc.2 right now, since it was causing a failure in `cargo install arti`, and then it got yanked. Thanks to pinkforest for helping us out here and explaining all of this! Fixes #926. Commit-edited-by: Nick Mathewson <[email protected]>
* lints: Run maint/add_warning to actually apply new lintsIan Jackson2023-06-211-0/+2
|
* llcrypto: add another warning to ct_lookup.Nick Mathewson2023-06-161-2/+3
|
* Lower tor-proto::util::ct::lookup to tor-llcryptoNick Mathewson2023-06-161-0/+66
| | | | | | | | This is mostly code movement; you may want to review it with `--color-moved`. I'm doing this so we can also use the function in netdoc for looking up hsdesc authentication.
* tor-llcrypto: remove use of arrayrefNick Mathewson2023-06-013-18/+15
|
* llcrypto: Don't take or return "unescorted" ed25519 keys.Nick Mathewson2023-05-181-19/+37
| | | | | | | | | | | | Per #798, we want to make sure that we never pass around an `ed25519::SecretKey`; only an `ed25519::Keypair` (or `ExpandedKeypair`). This is because, when you're computing an ed25519 signature, you have to use the public key as one of your inputs, and if you ever use a mismatched public key you are vulnerable to a nonce reuse attack. (For more info see https://moderncrypto.org/mail-archive/curves/2020/001012.html )
* llcrypto: Add an `ed25519::ExpandedKeypair` type.Nick Mathewson2023-05-181-0/+25
| | | | | | | | This is like an `ed25519::Keypair`, except that instead of a `SecretKey` it contains an `ExpandedSecretKey`. We'll be using this to implement #798, where we impose a rule that there must be no "unescorted" ed25519 secret keys.
* Use non-deprecated *Secret::random_from_rng.Nick Mathewson2023-05-131-1/+1
| | | | The `new` function is deprecated in x25519-dalek 2.0.0-rc.2
* update rsa to 0.9.xtrinity-1686a2023-05-081-5/+4
|
* tor-llcrypto: key blinding: Use consistent terminologyIan Jackson2023-03-281-19/+22
| | | | | | | | | | | | | | | | | | | | Unhelpfully, the spec uses the variable name `h` and the phrase "blinding factor" for both the unclamped and clamped value. The clamped value is internal to the algorithm. In our code: * Don't ever use the word "parameter" or variable name `param`. This doesn't appear in the spec anywhere. * Use `h` for the unclamped blinding factor, and `blinding_factor` for the clamped blinding factor. * Rename `blinding_factor` function to `clamp_blinding_factor`, since in the spec's terminology it takes an (unclamped) "blinding factor" and returns a (clamped) "blinding factor". * State explicitly what thing in the spec the `h` parameters are.
* Use the type system to enforce use of blinded keys.Gabriela Moldovan2023-03-271-0/+12
| | | | | | | | | | | | | | | Hidden services use blinded singing keys derived from the identity key to sign descriptor signing keys. Before this patch, the hidden descriptor builder represented its blinded signing keys (`blinded_id`) as plain `ed25519::Keypair`s. This was not ideal, as there was nothing preventing the caller from accidentally initializing `blinded_id` with an unblinded keypair. This introduces a new `HsBlindKeypair` type to represent blinded keypairs. Signed-off-by: Gabriela Moldovan <[email protected]>
* Add builder for encoding hidden service descriptors.Gabi Moldovan2023-03-241-1/+1
| | | | | | | | | | | | | | This introduces the `NetdocBuilder` trait described in `netdoc-builder.md` and a new `tor-netdoc::doc::hsdesc::build` module, which exports the `HsDescBuilder`. Hidden services will use `HsDescBuilder` to build and encode hidden service descriptors. There are several TODOs in the code that I'm planning to address separately. Partially addresses #745. Signed-off-by: Gabriela Moldovan <[email protected]>
* Suppress a renamed-lint lint.Nick Mathewson2023-03-101-1/+2
| | | | | | | The derive_hash_xor_eq lint was renamed in 1.68, but we can't use it under its new name, since we still need to support back to 1.60. Instead, we suppress the warning about the lint being renamed.
* Expose a little new functionality from tor-llcrypto.Nick Mathewson2023-02-281-0/+9
| | | | | Expose ED25519 signature length; make ValidatableEd25519Signature implement Debug and Clone.
* llcrypto: Implement `Into<[u8;32]>` for Ed25519IdentityNick Mathewson2023-02-072-0/+7
|
* llcrypto: Derive zeroize for CtByteArray.Nick Mathewson2023-02-071-1/+2
|
* Allow clippy::unchecked_duration_subtraction in testsNick Mathewson2023-01-272-0/+2
| | | | | This panics on error, and we're fine with a panic on misbehavior in tests.
* Disable clippy::unlinlined-format-argsNick Mathewson2023-01-271-0/+1
| | | | | | | | This warning kind of snuck up on us! (See #748) For now, let's disable it. (I've cleaned it up in a couple of examples, since those are meant to be more idiomatic and user-facing.) Closes #748.
* tor-llcrypto: Tolerate some warnings (fmt)Ian Jackson2023-01-201-1/+4
|
* tor-llcrypto: Tolerate some warningsIan Jackson2023-01-201-0/+4
| | | | | | Without this, cargo +stable clippy -p tor-netdoc --all-features produces warnings.
* Upgrade to latest rsa crate.Nick Mathewson2023-01-201-1/+1
|
* Complete our migration to base64ct.Nick Mathewson2023-01-201-12/+5
| | | | | | | | | This is in lieu of upgrading to the latest base64 crate, which has a different API from the old one. Since we have to migrate either way, we might as well use base64ct everywhere. I don't think that most of these cases _require_ constant-time base64, but it won't hurt.
* Merge branch 'blind_privkey' into 'main'Ian Jackson2023-01-091-17/+159
|\ | | | | | | | | | | | | llcrypto: Implement secret-key blinding. Closes #719 See merge request tpo/core/arti!964
| * llcrypto: Implement secret-key blinding.Nick Mathewson2023-01-061-17/+159
| | | | | | | | | | | | | | | | Closes #719. Due to a difference between ed25519-dalek and ed25519-donna, converting these secret keys directly to public keys does not work. I've documented this in a "Limitations" section.
* | llcrypto: fix a comment.Nick Mathewson2023-01-061-1/+1
| | | | | | | | This described the wrong type of key.
* | llcrypto: clarify meaning of "Identity".Nick Mathewson2023-01-062-8/+17
| | | | | | | | | | | | | | | | | | | | The `Ed25519Identity` and `RsaIdentity` types are not precisely always used as relay identifiers: they are more generally used as _key_ identifiers. This will become relevant as `RsaIdentity` is used for authority keys (as in authorities' VoterInfo blocks), and as `Ed25519Identity` is used as the identifier behind an onion service key.
* | Merge branch 'test-lints' into 'main'eta2023-01-062-0/+16
|\ \ | | | | | | | | | | | | Add test lint blocks to all "mod test" See merge request tpo/core/arti!937
| * | test lint blocks: Add many many automaticallyIan Jackson2022-12-122-0/+16
| |/ | | | | | | | | This is precisely the result of running the rune in maint/adhoc-add-lint-blocks.
* / Add a new "CtByteArray" type, and use it in Id types.Nick Mathewson2023-01-054-39/+152
|/ | | | | | This type provides a common implementation for types that are implemented as arrays of bytes that should only be compared with constant-time comparisons.
* llcrypto: Make key id types Redactable.Nick Mathewson2022-11-282-0/+28
|
* Fix a bunch of "needless borrow" warnings on nightlyNick Mathewson2022-11-181-1/+1
| | | | | It looks like, despite a few false starts, they've got this warning right; there weren't any false positives.
* Upgrade rsa to 0.7. Closes #613.Nick Mathewson2022-11-101-1/+1
|
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-26 19:06:37 +0000