RUSTSEC-2022-0093

[jxs]

Description

RUSTSEC-2022-0093 has just been issued which will make cargo deny fail on the CI. I tried updating identity and noise that depend on it, but we are blocked by mcginty/snow#164

[thomaseizinger]

Will this be a patch-release in both cases? I hope 🤞

[mxinden]

Thank you @jxs for raising attention for this.

Trying to understand the impact of this vulnerability.

libp2p-identity

When creating a Keypair, we use the bytes representation which contains both the public and the private key.

rust-libp2p/identity/src/ed25519.rs

Lines 48 to 59 in 2c4c961

	/// Try to parse a keypair from the [binary format](https://datatracker.ietf.org/doc/html/rfc8032#section-5.1.5)
	/// produced by [`Keypair::to_bytes`], zeroing the input on success.
	///
	/// Note that this binary format is the same as `ed25519_dalek`'s and `ed25519_zebra`'s.
	pub fn try_from_bytes(kp: &mut [u8]) -> Result<Keypair, DecodingError> {
	ed25519::Keypair::from_bytes(kp)
	.map(|k| {
	kp.zeroize();
	Keypair(k)
	})
	.map_err(|e| DecodingError::failed_to_parse("Ed25519 keypair", e))
	}

I don't see how an attacker would be able to influence the input public key to extract the private key, as the latter is already known to the attacker at that point.

libp2p-noise

As far as I can tell libp2p-noise, i.e. snow, is using [curve25519‑dalek](https://github.com/dalek-cryptography/curve25519-dalek/blob/main/curve25519-dalek) and not ed25519‑dalek. See snow's Cargo.toml.

The RUSTSEC is only for curve25519‑dalek.

@jxs am I missing something?

[jxs]

Ah, sorry for not being completely clear in the previous comment.
The RUSTSEC is for ed25519-dalek which we use on identity. When i tried updating it, it conflicts with snow as snow uses curve25519-dalek =4.0.0-rc.1 which conflicts with updating ed25519-dalek to 2.0.0 because it uses curve25519-dalek 4.0.0

[kayabaNerve]

A new version of snow has been released.

[mxinden]

Great. Would either of you @jxs or @kayabaNerve mind sending a pull request updating curve25519‑dalek across the project?