[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #26941 [Core Tor/Tor]: Privcount blinding and encryption: review dependencies
#26941: Privcount blinding and encryption: review dependencies
-------------------------------------------------+-------------------------
Reporter: teor | Owner: nickm
Type: defect | Status:
| assigned
Priority: Medium | Milestone: Tor:
| 0.3.6.x-final
Component: Core Tor/Tor | Version:
Severity: Normal | Resolution:
Keywords: privcount, 035-roadmap-master, 035 | Actual Points:
-triaged-in-20180711, rust |
Parent ID: #25669 | Points:
Reviewer: | Sponsor:
| SponsorV
-------------------------------------------------+-------------------------
Comment (by teor):
Komlo said:
I see that this crate depends on several external crates. rust-crypto
states that it doesn't have strong security guarantees- is there something
else that we should be using? https://crates.io/crates/rust-crypto.
Should we have an auditing process for when we choose to import/use new
external crates?
nickm says:
hm. I don't think we have something else we should necessarily use yet,
though probably we should make the code so it's parameterized on the
crypto traits we need eventually
I think it's something we can clean up later.
I think what we want is a pattern where we have some traits, maybe copied
from rust-crypto, or maybe theirs, for crypto, and we instantiate them
either with a rust implementation or the Tor c implementation
looks like for this we need sha3/shake, aes, curve25519, and a time-
invariant comparison
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26941#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs