[lwshang]

Real fix for RUSTSEC-2026-0387 (crypto-bigint non-constant-time arithmetic), which #844 ignores for now. crypto-bigint 0.5 has no fixed release, and both the elliptic-curve 0.13 stack and our SLIP-0010 code pin it.

• Moves to k256/p256/elliptic-curve 0.14, pkcs8 0.11, sec1 0.8, crypto-bigint 0.7, scrypt 0.12 and bip32 0.6.
• Encrypted identities are written with the same PBES2 parameters as before (scrypt N=2^17, r=8, p=1, AES-256-CBC). The existing encrypted-PKCS#8 fixture tests still pass.
• from_sec1_der now returns elliptic_curve::DecodeError, so identity import gets its own BadEcDerKey variant for it.

Blocked on dfinity/agent-rs#745 and an ic-agent release. Until then, ic-agent comes from that branch through [patch.crates-io], and deny.toml allows the git source.

Before merging:

• Bump ic-agent/ic-utils/ic-identity-hsm to the release; drop [patch.crates-io] and allow-git
• Rebase on chore(deps): fix RUSTSEC-2026-0385/0386/0387 #844 and remove its RUSTSEC-2026-0387 ignore from deny.toml. Once the advisory no longer applies, cargo-deny only warns about the stale ignore (advisory-not-detected); it doesn't fail.

Tested locally against the agent-rs branch: cargo deny check passes in full; clippy is clean; icp-app, icp-cli unit and identity_tests pass, except the SoftHSM and mops tests, because those tools aren't installed here.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

The cryptographic migration needs final human verification after the upstream agent-rs release and documented pre-merge dependency cleanup.

No open issues 🎉

What changed in this PR

Migrates the CLI’s identity cryptography to RustCrypto 0.14 to address RUSTSEC-2026-0387, replacing the vulnerable crypto-bigint dependency.

Changes:

• Updates cryptographic dependencies and temporarily uses the upstream agent-rs migration branch.
• Adapts identity import, encryption, and SLIP-0010 derivation to the new APIs while retaining existing encryption parameters.
• Adds a dedicated error variant for malformed elliptic-curve DER keys.

File	Description
deny.toml	Temporarily permits the agent-rs Git source.
crates/​icp-cli/​src/​commands/​identity/​import.rs	Updates PKCS#8 parsing and elliptic-curve decoding errors.
crates/​icp-app/​src/​identity/​seed/​slip10.rs	Migrates scalar arithmetic and public-key encoding APIs.
crates/​icp-app/​src/​identity/​key.rs	Updates identity serialization and encryption APIs.
Cargo.toml	Upgrades cryptographic dependencies and adds temporary agent-rs patches.
Cargo.lock	Records upgraded dependencies and the agent-rs Git revision.

_{Review effort: Balanced}