Depend on rust-bitcoin crypto primitive impls - #13
Draft
DanGould wants to merge 2 commits into
Draft
Conversation
rust-payjoin (the primary consumer) is on rust-version 1.85; align this crate with it. The old 1.63.0 MSRV existed only because rust-payjoin used to require it. Drops the now-unneeded half/regex pins from the MSRV CI job and the matching instructions from the README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the RustCrypto implementation crates `sha2` and `chacha20poly1305`
with thin adapters (src/rust_bitcoin.rs) backed by rust-bitcoin primitives:
`bitcoin_hashes` for SHA-256/384/512 and the rust-bitcoin `chacha20-poly1305`
crate for ChaCha20-Poly1305.
The adapters implement the existing RustCrypto traits the crate is generic
over (`digest::Digest`/`OutputSizeUser`/`BlockSizeUser` via the high-level
trait tower; `aead::{AeadCore,AeadInPlace,KeyInit,KeySizeUser}`), so the
generic RFC 9180 architecture, ciphersuite line-up, and known-answer tests
are unchanged. `bitcoin_hashes` and the rust-bitcoin cipher perform standard
SHA-2 finalization and RFC 8439 AEAD, so outputs are byte-identical — the
RFC 9180 KATs (with the corrected secp256k1 vectors) still pass unmodified.
Both new dependencies are taken with default-features off to preserve the
crate's `#![no_std]` contract (chacha20-poly1305 defaults to `std`).
Two properties of the replaced AEAD are not provided by `chacha20-poly1305`
and are documented in the module header rather than left implicit: tag
verification is not constant-time by construction (upstream can restore this
dependency-free with an XOR-accumulating compare), and per-operation key
copies are not zeroized because the crate's key types are `Copy` with no
`Drop`. The RFC 8439 maximum-message-length guard that `chacha20poly1305`
enforced is reinstated in the adapter, since the rust-bitcoin cipher advances
its `u32` block counter unchecked.
Adds tests that the previous suite lacked: RFC 4231 HMAC vectors through
`SimpleHmac<D>` for all three digests, which pin each adapter's `BlockSizeUser`
(`HkdfSha384`/`HkdfSha512` had no coverage at all, since every KAT vector is
HKDF-SHA256), and an empty-AAD AEAD round-trip plus tag-tamper check, which is
the configuration BIP 77 / OHTTP encapsulation actually uses.
The `digest`, `hkdf`, `hmac`, `aead`, and `generic-array` trait crates remain
for now; stripping that trait scaffolding is a follow-up.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace the RustCrypto sha2 and chacha20poly1305 implementation crates with thin adapters backed by rust-bitcoin primitives: bitcoin_hashes for SHA-256/384/512, and chacha20-poly1305 for the AEAD.
The adapters satisfy the RustCrypto traits this crate is already generic over, so the RFC 9180 architecture and ciphersuite line-up are untouched. The KATs — including our corrected secp256k1 vectors — pass unmodified, so wire compatibility is intact. The adapter module is pub(crate); the trait crates (digest/hkdf/hmac/aead/generic-array) stay for now, and stripping that scaffolding is a follow-up.
Also here: MSRV 1.63 → 1.85 (follows rust-payjoin, and required by chacha20-poly1305), and tests the suite was missing — RFC 4231 HMAC vectors that pin BlockSizeUser for all three digests (HkdfSha384/HkdfSha512 had zero coverage, since every KAT is HKDF-SHA256), plus an empty-AAD round-trip and tag-tamper check, which is the configuration BIP 77 / OHTTP actually uses.
Two deviations from the replaced AEAD are documented in the module header rather than left implicit: tag verification is not constant-time by construction, and per-operation key copies aren't zeroized (rust-bitcoin's key types are Copy with no Drop). The RFC 8439 max-message-length guard chacha20poly1305 enforced is reinstated in the adapter.
Gates green: tests under --no-default-features --features=secp and --all-features (incl. KATs), build/clippy with -D warnings, fmt --check, and an MSRV 1.85 build.
Disclosure: co-authored by Claude Code