From 9f40244eab70488eff93f1c17e878842e26d0fff Mon Sep 17 00:00:00 2001 From: Quentin Gliech Date: Fri, 9 Oct 2026 15:33:08 +0200 Subject: [PATCH] Bump `chacha20poly1305` from 0.10 to 0.11 It moves from `generic-array` to `hybrid-array`, so `Encrypter` builds its key and nonce with the `Key` and `Nonce` aliases, and `mas-keystore` no longer depends on `generic-array`. Cookie (via `aes-gcm`) is still on `aead` 0.5, so the older `aead` and `universal-hash` go on the cargo-deny skip list. --- Cargo.lock | 65 ++++++++++++++++++-------------- Cargo.toml | 8 ++-- crates/keystore/Cargo.toml | 2 +- crates/keystore/src/encrypter.rs | 15 ++++---- deny.toml | 4 ++ 5 files changed, 53 insertions(+), 41 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 8ffa0701b..7846cc388 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -42,6 +42,16 @@ dependencies = [ "generic-array", ] +[[package]] +name = "aead" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99" +dependencies = [ + "crypto-common 0.2.2", + "inout 0.2.2", +] + [[package]] name = "aes" version = "0.8.4" @@ -59,7 +69,7 @@ version = "0.10.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1" dependencies = [ - "aead", + "aead 0.5.2", "aes", "cipher 0.4.4", "ctr", @@ -883,17 +893,6 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" -[[package]] -name = "chacha20" -version = "0.9.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818" -dependencies = [ - "cfg-if", - "cipher 0.4.4", - "cpufeatures 0.2.17", -] - [[package]] name = "chacha20" version = "0.10.2" @@ -901,21 +900,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" dependencies = [ "cfg-if", + "cipher 0.5.2", "cpufeatures 0.3.1", "rand_core 0.10.1", ] [[package]] name = "chacha20poly1305" -version = "0.10.1" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35" +checksum = "9b89e1c441e926b9c82a8d023f6e1b7ae0adcfaa7d621814e4d60789bac751cb" dependencies = [ - "aead", - "chacha20 0.9.1", - "cipher 0.4.4", + "aead 0.6.1", + "chacha20", + "cipher 0.5.2", "poly1305", - "zeroize", ] [[package]] @@ -959,7 +958,6 @@ checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad" dependencies = [ "crypto-common 0.1.6", "inout 0.1.4", - "zeroize", ] [[package]] @@ -968,6 +966,7 @@ version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c" dependencies = [ + "block-buffer 0.12.1", "crypto-common 0.2.2", "inout 0.2.2", ] @@ -1458,7 +1457,9 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453" dependencies = [ + "getrandom 0.4.3", "hybrid-array", + "rand_core 0.10.1", ] [[package]] @@ -3724,13 +3725,12 @@ dependencies = [ name = "mas-keystore" version = "1.27.0-rc.0" dependencies = [ - "aead", + "aead 0.6.1", "base64ct", "chacha20poly1305", "const-oid 0.9.6", "der", "elliptic-curve", - "generic-array", "insta", "k256", "mas-iana", @@ -4856,13 +4856,12 @@ dependencies = [ [[package]] name = "poly1305" -version = "0.8.0" +version = "0.9.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf" +checksum = "6e2d0073b297041425c7c3df6eb4792d598a15323fe63346852b092eca02904c" dependencies = [ - "cpufeatures 0.2.17", - "opaque-debug", - "universal-hash", + "cpufeatures 0.3.1", + "universal-hash 0.6.1", ] [[package]] @@ -4874,7 +4873,7 @@ dependencies = [ "cfg-if", "cpufeatures 0.2.17", "opaque-debug", - "universal-hash", + "universal-hash 0.5.1", ] [[package]] @@ -5130,7 +5129,7 @@ version = "0.10.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af" dependencies = [ - "chacha20 0.10.2", + "chacha20", "getrandom 0.4.3", "rand_core 0.10.1", ] @@ -7139,6 +7138,16 @@ dependencies = [ "subtle", ] +[[package]] +name = "universal-hash" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96" +dependencies = [ + "crypto-common 0.2.2", + "ctutils", +] + [[package]] name = "unsafe-libyaml" version = "0.2.11" diff --git a/Cargo.toml b/Cargo.toml index bc16adb85..701789e68 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -117,8 +117,8 @@ version = "0.5.1" # AEAD (Authenticated Encryption with Associated Data) [workspace.dependencies.aead] -version = "0.5.2" -features = ["std"] +version = "0.6.1" +features = ["alloc", "getrandom"] # Argon2 password hashing [workspace.dependencies.argon2] @@ -150,8 +150,8 @@ features = ["serde1"] # ChaCha20Poly1305 AEAD [workspace.dependencies.chacha20poly1305] -version = "0.10.1" -features = ["std"] +version = "0.11.0" +features = ["alloc", "getrandom"] # Memory optimisation for short strings [workspace.dependencies.compact_str] diff --git a/crates/keystore/Cargo.toml b/crates/keystore/Cargo.toml index 0b97e5d88..7e33008a9 100644 --- a/crates/keystore/Cargo.toml +++ b/crates/keystore/Cargo.toml @@ -1,3 +1,4 @@ +# Copyright 2025, 2026 Element Creations Ltd. # Copyright 2025 New Vector Ltd. # # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial @@ -24,7 +25,6 @@ chacha20poly1305.workspace = true const-oid.workspace = true der.workspace = true elliptic-curve.workspace = true -generic-array.workspace = true k256.workspace = true p256.workspace = true p384.workspace = true diff --git a/crates/keystore/src/encrypter.rs b/crates/keystore/src/encrypter.rs index a2cb738e0..8520dac91 100644 --- a/crates/keystore/src/encrypter.rs +++ b/crates/keystore/src/encrypter.rs @@ -1,3 +1,4 @@ +// Copyright 2025, 2026 Element Creations Ltd. // Copyright 2024, 2025 New Vector Ltd. // Copyright 2022-2024 The Matrix.org Foundation C.I.C. // @@ -8,8 +9,7 @@ use std::sync::Arc; use aead::Aead; use base64ct::{Base64, Encoding}; -use chacha20poly1305::{ChaCha20Poly1305, KeyInit}; -use generic_array::GenericArray; +use chacha20poly1305::{ChaCha20Poly1305, Key, KeyInit, Nonce}; use thiserror::Error; /// Helps encrypting and decrypting data @@ -30,8 +30,7 @@ impl Encrypter { /// Creates an [`Encrypter`] out of an encryption key #[must_use] pub fn new(key: &[u8; 32]) -> Self { - let key = GenericArray::from_slice(key); - let aead = ChaCha20Poly1305::new(key); + let aead = ChaCha20Poly1305::new(&Key::from(*key)); let aead = Arc::new(aead); Self { aead } } @@ -42,8 +41,8 @@ impl Encrypter { /// /// Will return `Err` when the payload failed to encrypt pub fn encrypt(&self, nonce: &[u8; 12], decrypted: &[u8]) -> Result, aead::Error> { - let nonce = GenericArray::from_slice(&nonce[..]); - let encrypted = self.aead.encrypt(nonce, decrypted)?; + let nonce = Nonce::from(*nonce); + let encrypted = self.aead.encrypt(&nonce, decrypted)?; Ok(encrypted) } @@ -53,8 +52,8 @@ impl Encrypter { /// /// Will return `Err` when the payload failed to decrypt pub fn decrypt(&self, nonce: &[u8; 12], encrypted: &[u8]) -> Result, aead::Error> { - let nonce = GenericArray::from_slice(&nonce[..]); - let encrypted = self.aead.decrypt(nonce, encrypted)?; + let nonce = Nonce::from(*nonce); + let encrypted = self.aead.decrypt(&nonce, encrypted)?; Ok(encrypted) } diff --git a/deny.toml b/deny.toml index 5ceaf6a35..f0fa2172a 100644 --- a/deny.toml +++ b/deny.toml @@ -124,6 +124,10 @@ skip = [ # still on 0.4 { name = "cipher", version = "0.4.4" }, { name = "inout", version = "0.1.4" }, + # chacha20poly1305 0.11 is on aead 0.6, cookie (via aes-gcm) is still on + # aead 0.5 + { name = "aead", version = "0.5.2" }, + { name = "universal-hash", version = "0.5.1" }, # zerovec-derive (via icu) moved to syn 3, everything else is on syn 2 { name = "syn", version = "2.0.106" }, ]