Remove libsodium #86
Open
Remove libsodium #86
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sgessa
commented
May 24, 2024
There was a problem hiding this comment.
@Ianleeclark can you take a look? What do you think?
PS: should I bump the Elixir version too?
| iex> Paseto.V2.sign("Test Message", sk) | ||
| "v2.public.VGVzdAJxQsXSrgYBkcwiOnWamiattqhhhNN_1jsY-LR_YbsoYpZ18-ogVSxWv7d8DlqzLSz9csqNtSzDk4y0JV5xaAE" | ||
| """ | ||
| @spec sign(String.t(), String.t(), String.t()) :: String.t() | {:error, String.t()} | ||
| def sign(data, secret_key, footer \\ "") when byte_size(secret_key) == 64 do | ||
| def sign(data, secret_key, footer \\ "") when byte_size(secret_key) == 32 do |
There was a problem hiding this comment.
each key in Ed25519 is 32 bytes
| @@ -3,17 +3,15 @@ | |||
| vector: "v2-S-1", | |||
| token: | |||
| "v2.public.eyJkYXRhIjoidGhpcyBpcyBhIHNpZ25lZCBtZXNzYWdlIiwiZXhwIjoiMjAxOS0wMS0wMVQwMDowMDowMCswMDowMCJ9HQr8URrGntTu7Dz9J2IF23d1M7-9lH9xiqdGyJNvzp4angPW5Esc7C5huy_M8I8_DjJK2ZXC2SUYuOFM-Q_5Cw", | |||
| private_key: | |||
| "b4cbfb43 df4ce210 727d953e 4a713307 fa19bb7d 9f850414 38d9e11b 942a3774 1eb9dbbb bc047c03 fd70604e 0071f098 7e16b28b 757225c1 1f00415d 0e20b1a2", | |||
| private_key: "b4cbfb43 df4ce210 727d953e 4a713307 fa19bb7d 9f850414 38d9e11b 942a3774", | |||
There was a problem hiding this comment.
removing the public key since it's not needed
| public_key: "1eb9dbbb bc047c03 fd70604e 0071f098 7e16b28b 757225c1 1f00415d 0e20b1a2", | ||
| payload: ~s({"data":"this is a signed message","exp":"2019-01-01T00:00:00+00:00"}) | ||
| ], | ||
| [ | ||
| vector: "v2-S-2", | ||
| token: | ||
| "v2.public.eyJkYXRhIjoidGhpcyBpcyBhIHNpZ25lZCBtZXNzYWdlIiwiZXhwIjoiMjAxOS0wMS0wMVQwMDowMDowMCswMDowMCJ9flsZsx_gYCR0N_Ec2QxJFFpvQAs7h9HtKwbVK2n1MJ3Rz-hwe8KUqjnd8FAnIJZ601tp7lGkguU63oGbomhoBw.eyJraWQiOiJ6VmhNaVBCUDlmUmYyc25FY1Q3Z0ZUaW9lQTlDT2NOeTlEZmdMMVc2MGhhTiJ9", | ||
| private_key: | ||
| "b4cbfb43 df4ce210 727d953e 4a713307 fa19bb7d 9f850414 38d9e11b 942a3774 1eb9dbbb bc047c03 fd70604e 0071f098 7e16b28b 757225c1 1f00415d 0e20b1a2", | ||
| private_key: "b4cbfb43 df4ce210 727d953e 4a713307 fa19bb7d 9f850414 38d9e11b 942a3774", |
There was a problem hiding this comment.
removing the public key since it's not needed
|
Sorry for the delay, but I'll take a look at this before the end of the weekend and thank you again for the contribution!
…-------- Ursprüngliche Nachricht --------
Am 24.05.24 14:36 um Stefano Gessa schrieb :
@sgessa commented on this pull request.
***@***.***(https://github.com/Ianleeclark) can you take a look? What do you think?
PS: should I bump the Elixir version too?
---------------------------------------------------------------
In [lib/paseto/v2.ex](#86 (comment)):
> iex> Paseto.V2.sign("Test Message", sk)
"v2.public.VGVzdAJxQsXSrgYBkcwiOnWamiattqhhhNN_1jsY-LR_YbsoYpZ18-ogVSxWv7d8DlqzLSz9csqNtSzDk4y0JV5xaAE"
"""
@SPEC sign(String.t(), String.t(), String.t()) :: String.t() | {:error, String.t()}
- def sign(data, secret_key, footer \\ "") when byte_size(secret_key) == 64 do
+ def sign(data, secret_key, footer \\ "") when byte_size(secret_key) == 32 do
each key in Ed25519 is 32 bytes
---------------------------------------------------------------
In [test/fixtures/test_vectors/v2_public.exs](#86 (comment)):
> @@ -3,17 +3,15 @@
vector: "v2-S-1",
token:
"v2.public.eyJkYXRhIjoidGhpcyBpcyBhIHNpZ25lZCBtZXNzYWdlIiwiZXhwIjoiMjAxOS0wMS0wMVQwMDowMDowMCswMDowMCJ9HQr8URrGntTu7Dz9J2IF23d1M7-9lH9xiqdGyJNvzp4angPW5Esc7C5huy_M8I8_DjJK2ZXC2SUYuOFM-Q_5Cw",
- private_key:
- "b4cbfb43 df4ce210 727d953e 4a713307 fa19bb7d 9f850414 38d9e11b 942a3774 1eb9dbbb bc047c03 fd70604e 0071f098 7e16b28b 757225c1 1f00415d 0e20b1a2",
+ private_key: "b4cbfb43 df4ce210 727d953e 4a713307 fa19bb7d 9f850414 38d9e11b 942a3774",
removing the public key since it's not needed
---------------------------------------------------------------
In [test/fixtures/test_vectors/v2_public.exs](#86 (comment)):
> public_key: "1eb9dbbb bc047c03 fd70604e 0071f098 7e16b28b 757225c1 1f00415d 0e20b1a2",
payload: ~s({"data":"this is a signed message","exp":"2019-01-01T00:00:00+00:00"})
],
[
vector: "v2-S-2",
token:
"v2.public.eyJkYXRhIjoidGhpcyBpcyBhIHNpZ25lZCBtZXNzYWdlIiwiZXhwIjoiMjAxOS0wMS0wMVQwMDowMDowMCswMDowMCJ9flsZsx_gYCR0N_Ec2QxJFFpvQAs7h9HtKwbVK2n1MJ3Rz-hwe8KUqjnd8FAnIJZ601tp7lGkguU63oGbomhoBw.eyJraWQiOiJ6VmhNaVBCUDlmUmYyc25FY1Q3Z0ZUaW9lQTlDT2NOeTlEZmdMMVc2MGhhTiJ9",
- private_key:
- "b4cbfb43 df4ce210 727d953e 4a713307 fa19bb7d 9f850414 38d9e11b 942a3774 1eb9dbbb bc047c03 fd70604e 0071f098 7e16b28b 757225c1 1f00415d 0e20b1a2",
+ private_key: "b4cbfb43 df4ce210 727d953e 4a713307 fa19bb7d 9f850414 38d9e11b 942a3774",
removing the public key since it's not needed
—
Reply to this email directly, [view it on GitHub](#86 (review)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AAPVZTDK2EQJQU42R3MRSHLZD4X5TAVCNFSM6AAAAABIHOFJQSVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZDANZWG42DMNBSG4).
You are receiving this because you were mentioned.Message ID: ***@***.***>
|
|
Unfortunately I'm going to have to reject this as it increases the maintenance burden and quite frankly I'm stuffed to the gills at the moment. Should things ease up, I'll leave this open and reassure |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR removes
libsaltylibrary because outdated and no longer maintained.libsaltywas used forXChaCha20Poly1305andEd25519crypto functions that are now implemented using Erlang native crypto functions.I also fixed an issue where
V2.sign/3expected a keypair (a binary composed with private + public key) with 64 bytes length to work. Only the secret key is needed for signing and must be 32 bytes.