dignifiedquire / dignifiedquire/cx448

serdect version skew

Open
#26 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
3
Forks
1
PR merge metrics
No merged PRs in 30d

Description

`cx448` depends on:

```
crypto-bigint = { version = "0.5.5", features = ["generic-array"], default-features = false }
serdect = { version = "0.3.0", optional = true }
```

but `crypto-bigint` 0.5.5 [depends on an earlier version of `serdect`](https://github.com/RustCrypto/crypto-bigint/blob/395bb171178990a93ef571664271dabc50749043/Cargo.toml#L27):

```
serdect = { version = "0.2", optional = true, default-features = false }
```

This is troubling, because it requires two semver-incompatible versions of `serdect`, in particular across [a major change to the wire format](https://github.com/RustCrypto/formats/blob/master/serdect/CHANGELOG.md#030-2025-01-06):

```
## 0.3.0 (2025-01-06)

NOTE: this release includes major breaking changes to the wire format, namely
all bytestrings now include a length prefix, even when serializing fixed-size
arrays. This is intended to work around deficiencies in the `serde` API
(see serde-rs/serde#2120) as well as serde-based format implementations which
have variable-time behavior when using `serialize_tuple`.

Any binary data serialized with previous versions of `serdect` now needs a
length prefix prepended to the data, which will vary depending on the
particular data format.

### Changed
- Switch to length-prefixed encoding using the `serialize_bytes` method ([#1112], [#1515])
- MSRV 1.70 ([#1244])

[#1112]: https://github.com/RustCrypto/formats/pull/1112
[#1515]: https://github.com/RustCrypto/formats/pull/1515
[#1244]: https://github.com/RustCrypto/formats/pull/1244

```

The implication is that to build `cx448` i need to have two different versions of `serdect` available, each of which produces (and consumes) a different wireformat. Is that deliberate?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by inspecting cx448's dependency declarations and Cargo's resolved dependency graph, then compare the referenced crypto-bigint Cargo.toml entry with serdect 0.3.0 and its changelog. Determine whether the two serdect versions can coexist safely across the affected wire format; done should include a decided dependency strategy and evidence that the resulting build and serialization behavior are correct.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cryptography
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.