Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improved Security levels usage #2

Open
pinkforest opened this issue Feb 28, 2024 · 0 comments
Open

Improved Security levels usage #2

pinkforest opened this issue Feb 28, 2024 · 0 comments

Comments

@pinkforest
Copy link

pinkforest commented Feb 28, 2024

Current non-exclusive feature approach has several problems

  • One transient dependency can break the build
  • Multi-tier dependency trees lose / don't relay feature information - reality in Rust ecosystem
  • A single crate using default features will break the build over security level setting

curve25519-dalek used to use features for backend selection pre-4.0.0 and there transient dependencies were setting features they did not offer downstream meaning transient dependency ended up dictating what backend was chosen - if lucky.

Often non-default backends were not be able to used all together due to transient dependency not relaying the desired backend in any single level of whole dependency-chain.

**Improvement Options

Option Security Level Decider Multiple Security Levels via crate
cfg[(kyber_security_level)] Top level binary only No - top level bin chooses one
crate::1024::x Immediate dependant Yes

1/ Use cfg[(kyber_security_level)] = LEVEL predicate

Pro is it leaves the choice of security level to the top level binary.

2/ re-export security levels via public API

e.g. crate::1024::x

Pro about having explicit "intent clear" API for different security levels which may be easier to read, test and audit

x/ pre-RFC

Also there is a pre-RFC about mutually explicit global features but can't be used today.

This can be adopted later if it ever lands given it's not at RFC level yet and RFCs typically have years long leadtime.

@pinkforest pinkforest changed the title Imrpoved security levels usage Improved Security levels usage Feb 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant