Repository navigation
rsa v0.10 release tracking #647
Description
Hello, My project is currently forced to use the latest rsa-rc version due to the fact rsa 0.9 still uses rand 0.8 which is pretty much broken on newer rust version due to the addition of the "gen" keyword, Using the release candidate of RSA becomes a problem when users try to use our crate and Cargo fetches a newer RC version then our crate is currently at, resulting in compile errors. I'm sick of constantly having to update the RC and just wish there would be finally an official release.
Activity
tarcieri commentedon Jan 26, 2026
We're currently waiting on the release of
rand_corev0.10, which I hope will be soon (and I hope you can appreciate why we wouldn't want to ship onrand_corev0.9 ifrand_corev0.10 is imminent), and then we'll start releasing the lower-level crates in our stack, which you can track here: RustCrypto/traits#1571It would still also be good to address this before a release: #626
[-]When 0.10 will release[/-][+]`rsa` v0.10 release tracking[/+]Snowiiii commentedon Feb 1, 2026
@tarcieri rand_core 0.10 just released
psalaberria002 commentedon May 21, 2026
Any progress on this one?
konstin commentedon Jun 23, 2026
A stable release would be interesting for us to remove dependency duplication, the 0.10 prerelease has (transitive) dependency bumps that we require to update.
tarcieri commentedon Jun 23, 2026
It's next on my TODO list after elliptic curves and AEADs, which I'm currently wrapping up
Pgarrett commentedon Jul 13, 2026
Hi @tarcieri any update on the release? Thanks!
tarcieri commentedon Jul 13, 2026
It’s one of the next things I plan to work on, but unfortunately still needs a fairly significant amount of work
docs(security): the RSA/Marvin ignore now says exactly which path is …
dishmaker commentedon Aug 29, 2026
TODO:
Snowiiii commentedon Aug 29, 2026
Whatever it takes at this point, just please give us 0.10 :crying:
tarcieri commentedon Oct 2, 2026
I created #711 as a tracking issue for all of the remaining constant-time problems I was able to identify based on draft-irtf-cfrg-rsa-guidance.
I don't think we need to address all of these prior to a v0.10.0 release, but it would at least be good to address the ones that require API changes and definitely get #626 addressed.