Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Require RngCore instead of CryptoRngCore for various random methods #710

Merged
merged 2 commits into from
Dec 7, 2024
Merged

Require RngCore instead of CryptoRngCore for various random methods #710

merged 2 commits into from
Dec 7, 2024

Conversation

fjarri
Copy link
Contributor

@fjarri fjarri commented Dec 7, 2024

Relaxes CryptoRngCore requirement to RngCore. Fixes #137

AaronFeickert
AaronFeickert suggested changes Dec 7, 2024
View reviewed changes
Copy link
Contributor

@AaronFeickert AaronFeickert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are many doc comments that reference cryptographically-secure generation, and are no longer accurate with the relaxed trait bound.

src/non_zero.rs
@@ -233,7 +233,7 @@ where
T: Random + Zero,
{
/// Generate a random `NonZero<T>`.
fn random(mut rng: &mut impl CryptoRngCore) -> Self {
fn random(mut rng: &mut impl RngCore) -> Self {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It may be useful to move aspects of the internal comment to the doc comment now that a CSPRNG is no longer guaranteed.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed this doc comment and allowed the Random::random() one take over.

src/traits.rs
@@ -283,7 +283,7 @@ pub trait Constants: ConstZero {
#[cfg(feature = "rand_core")]
pub trait Random: Sized {
/// Generate a cryptographically secure random value.
fn random(rng: &mut impl CryptoRngCore) -> Self;
fn random(rng: &mut impl RngCore) -> Self;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The doc comment is no longer accurate.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a note

src/traits.rs
@@ -346,25 +346,22 @@ pub trait RandomBits: Sized {
/// Generate a cryptographically secure random value in range `[0, 2^bit_length)`.
///
/// A wrapper for [`RandomBits::try_random_bits`] that panics on error.
fn random_bits(rng: &mut impl CryptoRngCore, bit_length: u32) -> Self {
fn random_bits(rng: &mut impl RngCore, bit_length: u32) -> Self {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The doc comment is no longer accurate.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added notes for the methods in this trait

src/traits.rs
rng: &mut impl CryptoRngCore,
bit_length: u32,
) -> Result<Self, RandomBitsError>;
fn try_random_bits(rng: &mut impl RngCore, bit_length: u32) -> Result<Self, RandomBitsError>;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The doc comment is no longer accurate.

src/traits.rs

/// Generate a cryptographically secure random value in range `[0, 2^bit_length)`,
/// returning an integer with the closest available size to `bits_precision`
/// (if the implementing type supports runtime sizing).
///
/// A wrapper for [`RandomBits::try_random_bits_with_precision`] that panics on error.
fn random_bits_with_precision(
rng: &mut impl CryptoRngCore,
rng: &mut impl RngCore,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The doc comment is no longer accurate.

src/traits.rs
@@ -398,7 +395,7 @@ pub trait RandomMod: Sized + Zero {
/// issue so long as the underlying random number generator is truly a
/// CSRNG, where previous outputs are unrelated to subsequent
/// outputs and do not reveal information about the RNG's internal state.
fn random_mod(rng: &mut impl CryptoRngCore, modulus: &NonZero<Self>) -> Self;
fn random_mod(rng: &mut impl RngCore, modulus: &NonZero<Self>) -> Self;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would be very careful about this doc comment, as the user may not be aware of what constitutes a CSPRNG.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At any rate, the top-line comment is no longer accurate.

src/uint/boxed/rand.rs
@@ -43,7 +40,7 @@ impl RandomMod for BoxedUint {
/// The variable-time nature of the algorithm should not pose a security issue so long as the
/// underlying random number generator is truly a CSRNG, where previous outputs are unrelated to
/// subsequent outputs and do not reveal information about the RNG's internal state.
fn random_mod(rng: &mut impl CryptoRngCore, modulus: &NonZero<Self>) -> Self {
fn random_mod(rng: &mut impl RngCore, modulus: &NonZero<Self>) -> Self {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would be very careful about this doc comment, as the user may not be aware of what constitutes a CSPRNG.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At any rate, the top-line comment is no longer accurate.

src/uint/rand.rs
use subtle::ConstantTimeLess;

impl<const LIMBS: usize> Random for Uint<LIMBS> {
/// Generate a cryptographically secure random [`Uint`].
fn random(mut rng: &mut impl CryptoRngCore) -> Self {
fn random(mut rng: &mut impl RngCore) -> Self {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The doc comment is no longer accurate.

src/uint/rand.rs
@@ -93,7 +90,7 @@ impl<const LIMBS: usize> RandomMod for Uint<LIMBS> {
/// issue so long as the underlying random number generator is truly a
/// CSRNG, where previous outputs are unrelated to subsequent
/// outputs and do not reveal information about the RNG's internal state.
fn random_mod(rng: &mut impl CryptoRngCore, modulus: &NonZero<Self>) -> Self {
fn random_mod(rng: &mut impl RngCore, modulus: &NonZero<Self>) -> Self {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See earlier comments.

@fjarri
Copy link
Contributor Author

fjarri commented Dec 7, 2024

Thanks for checking, that's what happens when you make a PR late at night

@tarcieri tarcieri merged commit e87d7f4 into RustCrypto:master Dec 7, 2024
18 checks passed
@fjarri
Copy link
Contributor Author

fjarri commented Dec 7, 2024

I was in the process of adding a little more stuff to the docs... sorry, should have switched it to the draft form

@fjarri
Copy link
Contributor Author

fjarri commented Dec 7, 2024

Basically just the additional lines

/// To find a CSRNG, look for RNGs implementing the marker trait [`rand_core::CryptoRngCore`].

Maybe it would be too much hand-holding anyway.

@tarcieri
Copy link
Member

tarcieri commented Dec 7, 2024

That seems okay if you want to submit a followup

@AaronFeickert
Copy link
Contributor

Does this change mean that random number generation functions using rejection sampling should be explicitly tagged with a _vartime suffix? Previously, their variable-time nature was guaranteed not to leak anything about output values. This is no longer a guarantee given the relaxed trait bound. The alternative would be to retain the existing naming, but update the documentation to carefully note this.

@tarcieri
Copy link
Member

tarcieri commented Dec 8, 2024

Ugh, I mean it was always "vartime". I agree that now there are more footguns.

@AaronFeickert AaronFeickert mentioned this pull request Dec 8, 2024
Merged
@AaronFeickert
Copy link
Contributor

Made some documentation updates in #711 toward this.

@fjarri fjarri deleted the rng-core branch December 8, 2024 18:31
@tarcieri tarcieri mentioned this pull request Jan 8, 2025
Merged
@tarcieri tarcieri mentioned this pull request Jan 22, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@AaronFeickert AaronFeickert AaronFeickert requested changes

@tarcieri tarcieri tarcieri approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Is there a reason random() and random_mod() require CryptoRng?
3 participants
@fjarri @tarcieri @AaronFeickert