authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2023-03-14 07:40:23+01:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2023-03-14 06:40:23+00:00
log5a12d00708df019fa510076f8af40d6efcb7c608
tree61a84033f560c9ae1138a4938a31cfe7a659ee0e
parent962299157840979ba659d478785f5ed0759d5401
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

Move std.crypto.config options to std.options (#14906)

Options have been moved to a single namespace.

3 files changed, 25 insertions(+), 24 deletions(-)

lib/std/crypto.zig+19-23
...@@ -185,31 +185,27 @@ pub const errors = @import("crypto/errors.zig");...@@ -185,31 +185,27 @@ pub const errors = @import("crypto/errors.zig");
185pub const tls = @import("crypto/tls.zig");185pub const tls = @import("crypto/tls.zig");
186pub const Certificate = @import("crypto/Certificate.zig");186pub const Certificate = @import("crypto/Certificate.zig");
187187
188/// Global configuration of cryptographic implementations in the standard library.188/// Side-channels mitigations.
189pub const config = struct {189pub const SideChannelsMitigations = enum {
190 /// Side-channels mitigations.190 /// No additional side-channel mitigations are applied.
191 pub const SideChannelsMitigations = enum {191 /// This is the fastest mode.
192 /// No additional side-channel mitigations are applied.192 none,
193 /// This is the fastest mode.193 /// The `basic` mode protects against most practical attacks, provided that the
194 none,194 /// application or implements proper defenses against brute-force attacks.
195 /// The `basic` mode protects against most practical attacks, provided that the195 /// It offers a good balance between performance and security.
196 /// application or implements proper defenses against brute-force attacks.196 basic,
197 /// It offers a good balance between performance and security.197 /// The `medium` mode offers increased resilience against side-channel attacks,
198 basic,198 /// making most attacks unpractical even on shared/low latency environements.
199 /// The `medium` mode offers increased resilience against side-channel attacks,199 /// This is the default mode.
200 /// making most attacks unpractical even on shared/low latency environements.200 medium,
201 /// This is the default mode.201 /// The `full` mode offers the highest level of protection against side-channel attacks.
202 medium,202 /// Note that this doesn't cover all possible attacks (especially power analysis or
203 /// The `full` mode offers the highest level of protection against side-channel attacks.203 /// thread-local attacks such as cachebleed), and that the performance impact is significant.
204 /// Note that this doesn't cover all possible attacks (especially power analysis or204 full,
205 /// thread-local attacks such as cachebleed), and that the performance impact is significant.
206 full,
207 };
208
209 /// This is a global configuration that applies to all cryptographic implementations.
210 pub const side_channels_mitigations: SideChannelsMitigations = if (@hasDecl(root, "side_channels_mitigations")) root.side_channels_mitigations else .medium;
211};205};
212206
207pub const default_side_channels_mitigations = .medium;
208
213test {209test {
214 _ = aead.aegis.Aegis128L;210 _ = aead.aegis.Aegis128L;
215 _ = aead.aegis.Aegis256;211 _ = aead.aegis.Aegis256;
lib/std/crypto/aes/soft.zig+1-1
...@@ -4,7 +4,7 @@ const mem = std.mem;...@@ -4,7 +4,7 @@ const mem = std.mem;
44
5const BlockVec = [4]u32;5const BlockVec = [4]u32;
66
7const side_channels_mitigations = std.crypto.config.side_channels_mitigations;7const side_channels_mitigations = std.options.side_channels_mitigations;
88
9/// A single AES block.9/// A single AES block.
10pub const Block = struct {10pub const Block = struct {
lib/std/std.zig+5
...@@ -190,6 +190,11 @@ pub const options = struct {...@@ -190,6 +190,11 @@ pub const options = struct {
190 options_override.http_connection_pool_size190 options_override.http_connection_pool_size
191 else191 else
192 http.Client.default_connection_pool_size;192 http.Client.default_connection_pool_size;
193
194 pub const side_channels_mitigations: crypto.SideChannelsMitigations = if (@hasDecl(options_override, "side_channels_mitigations"))
195 options_override.side_channels_mitigations
196 else
197 crypto.default_side_channels_mitigations;
193};198};
194199
195// This forces the start.zig file to be imported, and the comptime logic inside that200// This forces the start.zig file to be imported, and the comptime logic inside that