0.0.7: Update to *ring* 0.9.4. #6
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Blocked by rwf2/cookie-rs#90 |
heartsucker
reviewed
May 9, 2017
| @@ -7,7 +7,7 @@ use crypto::aes::KeySize; | |||
| use crypto::aes_gcm::AesGcm; | |||
| use crypto::chacha20poly1305::ChaCha20Poly1305; | |||
| use crypto::scrypt::{scrypt, ScryptParams}; | |||
| use ring::rand::SystemRandom; | |||
| use ring::rand::{SecureRandom, SystemRandom}; | |||
There was a problem hiding this comment.
Is this implication by adding this that SystemRandom is insecure? And would that mean you recommend changing the usage of SystemRandom to SecureRandom everywhere?
There was a problem hiding this comment.
SystemRandom implements the SecureRandom trait. Previously there was a SystemRandom:fill() in addition to the fill() from SecureRandom. However, now that extra SystemRandom:fill() is gone, so you have to call fill() through the trait, and that requires the trait to be used.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Before ring 0.9.3, it was possible to link multiple versions of ring into a program, e.g. if one version depended on ring 0.6 and another depended on ring 0.9. Unfortunately, this doesn't work, because the linker doesn't know to how to link ring's C/asm code correctly in that kind of situation. ring 0.9.3 added a flag to its Cargo.toml to tell the Rust toolchain to stop allowing multiple versions of ring to be linked into the same program, to prevent any problems this may cause.
ring 0.9.4 was released with an update to make some crates easier to update to 0.9.x.