workspace: bump RustCrypto dependencies to new set of releases

biscuit-auth/Cargo.toml

@@ -26,21 +26,21 @@ uuid = ["dep:uuid"]
 pem = ["ed25519-dalek/pem", "ed25519-dalek/pkcs8"]
 
 [dependencies]
-rand_core = "^0.6"
-sha2 = "^0.9"
+rand_core = "0.10"
+sha2 = "0.11"
 prost = "0.10"
 prost-types = "0.10"
 regex = { version = "1.5", default-features = false, features = ["std"] }
 nom = { version = "7", default-features = false, features = ["std"] }
 hex = "0.4"
 zeroize = { version = "1.5", default-features = false }
 thiserror = "1"
-rand = { version = "0.8" }
+rand = { version = "0.10" }
 wasm-bindgen = { version = "0.2", optional = true }
 base64 = "0.13.0"
-ed25519-dalek = { version = "2.0.0", features = ["rand_core", "zeroize"] }
+ed25519-dalek = { version = "3", features = ["rand_core", "zeroize"] }
 serde = { version = "1.0.132", optional = true, features = ["derive"] }
-getrandom = { version = "0.2.15" }
+getrandom = { version = "0.4" }
 time = { version = "0.3.7", features = ["formatting", "parsing"] }
 uuid = { version = "1", optional = true }
 biscuit-parser = { version = "0.2.0", path = "../biscuit-parser" }
@@ -49,14 +49,11 @@ chrono = { version = "0.4.26", optional = true, default-features = false, featur
   "serde",
 ] }
 serde_json = "1.0.117"
-ecdsa = { version = "0.16.9", features = ["signing", "verifying", "pem", "alloc", "pkcs8", "serde"] }
-p256 = "0.13.2"
-pkcs8 = "0.9.0"
-elliptic-curve = { version = "0.13.8", features = ["pkcs8"] }
+p256 = { version = "0.14", features = ["alloc", "pem", "pkcs8", "serde"] }
 
 [dev-dependencies]
 bencher = "0.1.5"
-rand = "0.8"
+rand = "0.10"
 chrono = { version = "0.4.26", features = ["serde", "clock"] }
 colored-diff = "0.2.3"
 prost-build = "0.10"

biscuit-auth/examples/testcases.rs

@@ -716,7 +716,7 @@ fn random_block(target: &str, root: &KeyPair, test: bool) -> TestResult {
     } else {
         let serialized = biscuit2.container();
         let mut proto = serialized.to_proto();
-        let arr: [u8; 32] = rng.gen();
+        let arr: [u8; 32] = rng.random();
         proto.blocks[0].block = Vec::from(&arr[..]);
         let mut data = Vec::new();
         proto.encode(&mut data).unwrap();

biscuit-auth/src/crypto/ed25519.rs

@@ -19,7 +19,7 @@ use super::Signature;
 use ed25519_dalek::pkcs8::DecodePrivateKey;
 use ed25519_dalek::Signer;
 use ed25519_dalek::*;
-use rand_core::{CryptoRng, RngCore};
+use rand_core::{CryptoRng, Rng};
 use std::{convert::TryInto, hash::Hash, ops::Drop};
 use zeroize::Zeroize;
 
@@ -30,7 +30,7 @@ pub struct KeyPair {
 }
 
 impl KeyPair {
-    pub fn new_with_rng<T: RngCore + CryptoRng>(rng: &mut T) -> Self {
+    pub fn new_with_rng<T: Rng + CryptoRng + ?Sized>(rng: &mut T) -> Self {
         let kp = ed25519_dalek::SigningKey::generate(rng);
         KeyPair { kp }
     }

biscuit-auth/src/crypto/mod.rs

@@ -20,7 +20,7 @@ mod ed25519;
 mod p256;
 
 use nom::Finish;
-use rand_core::{CryptoRng, RngCore};
+use rand_core::{CryptoRng, Rng};
 use std::fmt;
 use std::hash::Hash;
 use std::str::FromStr;
@@ -35,15 +35,15 @@ pub enum KeyPair {
 impl KeyPair {
     /// Create a new ed25519 keypair with the default OS RNG
     pub fn new() -> Self {
-        Self::new_with_rng(Algorithm::Ed25519, &mut rand::rngs::OsRng)
+        Self::new_with_rng(Algorithm::Ed25519, &mut rand::rng())
     }
 
     /// Create a new keypair with a chosen algorithm and the default OS RNG
     pub fn new_with_algorithm(algorithm: Algorithm) -> Self {
-        Self::new_with_rng(algorithm, &mut rand::rngs::OsRng)
+        Self::new_with_rng(algorithm, &mut rand::rng())
     }
 
-    pub fn new_with_rng<T: RngCore + CryptoRng>(algorithm: Algorithm, rng: &mut T) -> Self {
+    pub fn new_with_rng<T: Rng + CryptoRng + ?Sized>(algorithm: Algorithm, rng: &mut T) -> Self {
         match algorithm {
             Algorithm::Ed25519 => KeyPair::Ed25519(ed25519::KeyPair::new_with_rng(rng)),
             Algorithm::Secp256r1 => KeyPair::P256(p256::KeyPair::new_with_rng(rng)),

biscuit-auth/src/crypto/p256.rs

@@ -9,9 +9,8 @@ use super::error;
 use super::Signature;
 
 use p256::ecdsa::{signature::Signer, signature::Verifier, SigningKey, VerifyingKey};
-use p256::elliptic_curve::rand_core::{CryptoRng, RngCore};
-use p256::NistP256;
-use std::hash::Hash;
+use p256::elliptic_curve::{rand_core::{CryptoRng, Rng},Generate};
+use std::{convert::TryInto, hash::Hash};
 
 /// pair of cryptographic keys used to sign a token's block
 #[derive(Debug, PartialEq)]
@@ -20,8 +19,8 @@ pub struct KeyPair {
 }
 
 impl KeyPair {
-    pub fn new_with_rng<T: RngCore + CryptoRng>(rng: &mut T) -> Self {
-        let kp = SigningKey::random(rng);
+    pub fn new_with_rng<T: Rng + CryptoRng + ?Sized>(rng: &mut T) -> Self {
+        let kp = SigningKey::generate_from_rng(rng);
 
         KeyPair { kp }
     }
@@ -37,15 +36,19 @@ impl KeyPair {
         if bytes.len() != 32 {
             return Err(Format::InvalidKeySize(bytes.len()));
         }
-        let kp = SigningKey::from_bytes(bytes.into())
-            .map_err(|s| s.to_string())
-            .map_err(Format::InvalidKey)?;
+        let kp = SigningKey::from_bytes(
+            bytes
+                .try_into()
+                .map_err(|_| Format::InvalidKeySize(bytes.len()))?,
+        )
+        .map_err(|s| s.to_string())
+        .map_err(Format::InvalidKey)?;
 
         Ok(KeyPair { kp })
     }
 
     pub fn sign(&self, data: &[u8]) -> Result<Signature, error::Format> {
-        let signature: ecdsa::Signature<NistP256> = self
+        let signature: p256::ecdsa::Signature = self
             .kp
             .try_sign(data)
             .map_err(|s| s.to_string())
@@ -120,15 +123,14 @@ impl PrivateKey {
 
     /// deserializes from a big endian byte array
     pub fn from_bytes(bytes: &[u8]) -> Result<Self, error::Format> {
-        // the version of generic-array used by p256 panics if the input length
-        // is incorrect (including when using `.try_into()`)
-        if bytes.len() != 32 {
-            return Err(Format::InvalidKeySize(bytes.len()));
-        }
-        SigningKey::from_bytes(bytes.into())
-            .map(PrivateKey)
-            .map_err(|s| s.to_string())
-            .map_err(Format::InvalidKey)
+        SigningKey::from_bytes(
+            bytes
+                .try_into()
+                .map_err(|_| Format::InvalidKeySize(bytes.len()))?,
+        )
+        .map(PrivateKey)
+        .map_err(|s| s.to_string())
+        .map_err(Format::InvalidKey)
     }
 
     /// deserializes from an hex-encoded string
@@ -196,7 +198,7 @@ pub struct PublicKey(VerifyingKey);
 impl PublicKey {
     /// serializes to a byte array
     pub fn to_bytes(&self) -> Vec<u8> {
-        self.0.to_encoded_point(true).to_bytes().into()
+        self.0.to_sec1_point(true).to_bytes().into()
     }
 
     /// serializes to an hex-encoded string

biscuit-auth/src/datalog/expression.rs

@@ -8,10 +8,7 @@ use super::{MapKey, SymbolIndex, Term};
 use super::{SymbolTable, TemporarySymbolTable};
 use regex::Regex;
 use std::sync::Arc;
-use std::{
-    collections::HashMap,
-    convert::TryFrom,
-};
+use std::{collections::HashMap, convert::TryFrom};
 
 #[derive(Clone)]
 pub struct ExternFunc(

biscuit-auth/src/datalog/mod.rs

@@ -151,46 +151,48 @@ impl Rule {
         let variables = MatchedVariables::new(self.variables_set());
 
         CombineIt::new(variables, &self.body, facts, symbols)
-        .map(move |(origin, variables)| {
-                    let mut temporary_symbols = TemporarySymbolTable::new(symbols);
-                    for e in self.expressions.iter() {
-                        match e.evaluate(&variables, &mut temporary_symbols, extern_funcs) {
-                            Ok(Term::Bool(true)) => {}
-                            Ok(Term::Bool(false)) => return Ok((origin, variables, false)),
-                            Ok(_) => return Err(error::Expression::InvalidType),
-                            Err(e) => {
-                                //println!("expr returned {:?}", res);
-                                return Err(e);
-                            }
+            .map(move |(origin, variables)| {
+                let mut temporary_symbols = TemporarySymbolTable::new(symbols);
+                for e in self.expressions.iter() {
+                    match e.evaluate(&variables, &mut temporary_symbols, extern_funcs) {
+                        Ok(Term::Bool(true)) => {}
+                        Ok(Term::Bool(false)) => return Ok((origin, variables, false)),
+                        Ok(_) => return Err(error::Expression::InvalidType),
+                        Err(e) => {
+                            //println!("expr returned {:?}", res);
+                            return Err(e);
                         }
                     }
-            Ok((origin, variables, true))
-        }).filter_map(move |res/*(mut origin,h, expression_res)*/| {
-            match res {
-                Ok((mut origin,h , expression_res)) => {
-                    if expression_res {
-                    let mut p = head.clone();
-                    for index in 0..p.terms.len() {
-                        match &p.terms[index] {
-                            Term::Variable(i) => match h.get(i) {
-                              Some(val) => p.terms[index] = val.clone(),
-                              None => {
-                                // head variables should be bound in the body predicates
-                                return None;
-                              }
-                            },
-                            _ => continue,
-                        };
-                    }
-
-                    origin.insert(rule_origin);
-                    Some(Ok((origin, Fact { predicate: p })))
-                } else {None}
-                },
-                Err(e) => Some(Err(e))
-            }
+                }
+                Ok((origin, variables, true))
+            })
+            .filter_map(move |res /*(mut origin,h, expression_res)*/| {
+                match res {
+                    Ok((mut origin, h, expression_res)) => {
+                        if expression_res {
+                            let mut p = head.clone();
+                            for index in 0..p.terms.len() {
+                                match &p.terms[index] {
+                                    Term::Variable(i) => match h.get(i) {
+                                        Some(val) => p.terms[index] = val.clone(),
+                                        None => {
+                                            // head variables should be bound in the body predicates
+                                            return None;
+                                        }
+                                    },
+                                    _ => continue,
+                                };
+                            }
 
-        })
+                            origin.insert(rule_origin);
+                            Some(Ok((origin, Fact { predicate: p })))
+                        } else {
+                            None
+                        }
+                    }
+                    Err(e) => Some(Err(e)),
+                }
+            })
     }
 
     pub fn find_match(