curve25519-dalek zeroize dependency not compatible with other libraries #26688

samuelvanderwaal · 2022-07-20T01:03:46Z

Problem

Solana v1.8.x relied on curve25519-dalek ^v2.1.0 which itself has a zeroize dependency of ^1.

However, Solana v1.9+ rely on curve25519-dalek ^v3.2.1 which limits zeroize to a range of >=1, <1.4 which is not compatible with many other cryptography libraries (or libraries which depend on cryptography libraries) which use ^1.4 or ^1.5. E.g.s:

aws-types
num-big-int-dig (which RSA relies on)
jsonwebkey

It's unclear why curve25519-dalek hasn't bumped yet but there is an open PR to do so. Most other cryptography libraries seem to have bumped to v1.4+

Are there any known workarounds for this? If curve25519-dalek doesn't bump, is it possible for Solana to drop back down to ^v2.1?

Proposed Solution

anthontaylor · 2022-08-22T20:31:22Z

I'm currently running into the same issue with dependencies being incompatible with the outdated zeroize on curve25519-dalek.

whymidnight · 2022-10-10T10:54:12Z

this was blocking for me when i tried using RustCrypto/RSA

however, at least for rsa, i found sfackler/rust-openssl that binds to openssl OS package.

this seems to be a viable alternative in the meantime.

whymidnight · 2022-10-10T12:52:43Z

can confirm that i was able to implement RSA key generation and decryption using sfackler/rust-openssl without dependency issues.

samuelvanderwaal · 2022-10-10T17:51:50Z

can confirm that i was able to implement RSA key generation and decryption using sfackler/rust-openssl without dependency issues.

Thanks for sharing this!

NorbertBodziony · 2023-05-08T15:03:26Z

Any update on this ? Majority of packages already bumped zeroize.

mschneider · 2023-05-09T14:55:57Z

curve25519-dalek 3.2.1 seems to be a blocker here, a 4.0.0 release is imminent (rc.2 was published on March 26)

juchiast · 2023-07-24T00:06:28Z

4.0.0 is released

Fixes solana-labs#26688

hlgltvnnk · 2023-07-31T12:07:43Z

Upgrading curve25519-dalek to version 4 will not solve the problem
Because there is also ed25519-dalek-bip32 (v0.2.0), which depends on ed25519-dalek (v1.0.1), which also depends on curve25519-dalek (version = "3")
There is an ed25519-dalek v2.0.0-rc.3 that uses curve25519-dalek "=4.0.0-rc.3", but there is no stable version yet, so ed25519-dalek-bip32 is still on ed25519-dalek 1.0.1
So the way out of this situation may be:

Wait for the release of the stable version of ed25519-dalek -> and then update ed25519-dalek-bip32 -> and then update deps in solana core
Replace the ed25519-dalek-bip32 crate - as far as I understand it is used only for generating a keypair using Bip32 Hierarchical Derivation

juchiast · 2023-08-01T08:26:18Z

Replace the ed25519-dalek-bip32 crate - as far as I understand it is used only for generating a keypair using Bip32 Hierarchical Derivation

solana also uses ed25519-dalek 1.01, so I don't think this is an option.

solana/Cargo.toml

Line 182 in 3dcb382

ed25519-dalek = "=1.0.1"

hlgltvnnk · 2023-08-01T08:58:24Z

Replace the ed25519-dalek-bip32 crate - as far as I understand it is used only for generating a keypair using Bip32 Hierarchical Derivation

solana also uses ed25519-dalek 1.01, so I don't think this is an option.

solana/Cargo.toml

Line 182 in 3dcb382

ed25519-dalek = "=1.0.1"

This is a temporary workaround (if you want solana to be compatible with other crates that use zeroize) to use the raw version of ed25519-dalek (Im using "2.0.0-rc.3" in my fork) and then replace the ed25519-dalek-bip32 (because I don't want to fork it as well).
This is not stable and should only be used if it blocks development (for example, I need to use the async solana cli in my project, which is implemented in the latest versions of solana, so incompatibility with other packages is a big issue for me).
The best option would be to wait until ed25519-dalek releases v2 and then 1) wait for ed25519-dalek-bip32 to update or 2) replace ed25519-dalek-bip32 (spl also needs to be updated)

hlgltvnnk · 2023-08-14T09:49:42Z

ed25519-dalek v2.0.0 is released!

jbuckmccready · 2023-09-19T17:20:15Z

There is another dependency that needs to be updated to eliminate the awkward zeroize <1.4 dependency problem: aes-gcm-siv needs to be updated to v0.11.1.

mschneider · 2023-09-20T00:43:46Z

can someone post a public example project for reproduction? hbu @samuelvanderwaal @whymidnight @hlgltvnnk @jbuckmccready?

tomlinton · 2023-09-20T02:38:43Z

https://github.com/tomlinton/solana-ed25519-conflict

jbuckmccready · 2023-09-20T03:55:58Z

@mschneider https://github.com/jbuckmccready/solana_zeroize_dep_example

klefevre · 2023-09-27T12:46:14Z

hey @mschneider, thank you for tackling this issue. Do you have any idea when this is going to be fixed?
Currently we can't support Solana because of this issue. In our case, the conflict occurs with the last version of sqlx (0.7.2 at this time).

You can find a demo of the issue here (which is basically the same as the two above): https://github.com/klefevre/solana_zeroize_dep_example/

dbcfd · 2023-09-29T18:00:33Z

hey @mschneider, thank you for tackling this issue. Do you have any idea when this is going to be fixed? Currently we can't support Solana because of this issue. In our case, the conflict occurs with the last version of sqlx (0.7.2 at this time).

You can find a demo of the issue here (which is basically the same as the two above): https://github.com/klefevre/solana_zeroize_dep_example/

Here's a branch with a fix for just solana-program https://github.com/dbcfd/solana/tree/fix/deps. Still have to work through the other parts of solana.

ronanyeah · 2023-12-04T04:21:03Z

I am also unable to use several sqlx features because of the zeroize version. Bumping aes-gcm-siv would be appreciated!

mina86 · 2023-12-05T21:20:18Z

In the meanwhile, here’s a workaround:

[patch.crates-io]
# aes-gcm-siv 0.10.3 and curve25519-dalek 3.x pin zeroize to <1.4
# which conflicts with other dependencies requiring zeroize ^1.5.
# We’re patching both crates to unpin zeroize.
#
# For aes-gcm-siv we’re using the same revision Solana uses in
# an (as of now) unreleased commit, see
# https://github.com/solana-labs/solana/commit/01f1bf27994d9813fadfcd134befd3a449aaa0bd
#
# For curve25519-dalek we’re using commit from a PR, see
# https://github.com/dalek-cryptography/curve25519-dalek/pull/606
aes-gcm-siv = { git = "https://github.com/RustCrypto/AEADs", rev = "6105d7a5591aefa646a95d12b5e8d3f55a9214ef" }
curve25519-dalek = { git = "https://github.com/dalek-cryptography/curve25519-dalek", rev = "8274d5cbb6fc3f38cdc742b4798173895cd2a290" }

The second entry points at a commit in a PR. I’m not sure how GitHub
treats those and if it’s going to remain available. If not, change
repository to "https://github.com/mina86/curve25519-dalek/".

The aes-gcm-siv patch should be unnecessary as soon as new solana
crates release happens.

ronanyeah · 2023-12-05T22:19:24Z

@mina86 Works for me, thank you.

juchiast · 2023-12-13T12:59:15Z

If anyone got subtle dep conflict:

aes-gcm-siv = { git = "https://github.com/RustCrypto/AEADs", rev = "555ae1d82d000f01899498f969e6dc1d0a4fe467" }

serejke · 2023-12-16T18:43:09Z

It is a blocker to import ethers-rs and solana-sdk in the same binary.

All workarounds above are fragile.

error: failed to select a version for `zeroize`.
    ... required by package `curve25519-dalek v3.2.1`
    ... which satisfies dependency `curve25519-dalek = "^3.2.1"` of package `solana-program v1.17.11`
    ... which satisfies dependency `solana-program = "=1.17.11"` of package `solana-sdk v1.17.11`
    ... which satisfies dependency `solana-sdk = "^1.17.11"` of package `solana v0.1.0 (~/myproject/solana)`
versions that meet the requirements `>=1, <1.4` are: 1.3.0, 1.2.0, 1.1.1, 1.1.0, 1.0.0
all possible versions conflict with previously selected packages.
  previously selected package `zeroize v1.5.3`
    ... which satisfies dependency `zeroize = "^1.5"` of package `elliptic-curve v0.13.5`
    ... which satisfies dependency `elliptic-curve = "^0.13.5"` of package `ethers-core v2.0.11`
    ... which satisfies dependency `ethers-core = "^2.0.11"` of package `ethers v2.0.11`
    ... which satisfies dependency `ethers = "^2.0.11"` of package `ethereum v0.1.0 (~/myproject/ethereum)`
    ... which satisfies path dependency `ethereum` (locked to 0.1.0) of package `main v0.1.0 (~/myproject/main)`
failed to select a version for `zeroize` which could resolve this conflict

dougEfresh · 2024-01-14T11:40:40Z

@mschneider
May I assist with solving this issue ?

ara-selini · 2024-06-13T01:43:53Z

What's the recommended solution now? This is a pretty big pain point for us.

samuelvanderwaal · 2024-06-13T01:58:26Z

What's the recommended solution now? This is a pretty big pain point for us.

It depends on what exactly the conflict is for you. You might be able to replace the external crypto lib with something that doesn't use curve25519-dalek such as they do here: #26688 (comment), or you might be able to patch in a new version of curve25519-dalek to fix it. I haven't seen a standard suggestion from Solana yet.

AraMambreyan · 2024-06-13T02:54:19Z

What's the recommended solution now? This is a pretty big pain point for us.

It depends on what exactly the conflict is for you. You might be able to replace the external crypto lib with something that doesn't use curve25519-dalek such as they do here: #26688 (comment), or you might be able to patch in a new version of curve25519-dalek to fix it. I haven't seen a standard suggestion from Solana yet.

Our dependency conflict is with ethers-rs which will be very difficult to fix as it is deep in the stack.

How do we patch it? The suggestion above doesn’t work.

35359595 · 2024-06-13T02:58:57Z

@AraMambreyan I presume https://github.com/alloy-rs/alloy is not working either?

AraMambreyan · 2024-06-13T03:06:01Z

@AraMambreyan I presume https://github.com/alloy-rs/alloy is not working either?

Migrating to Alloy will be a huge effort for a repository as large as ours.

I doubt it will work anyway as I’d expect it to use newer versions of the dependencies than ethers-rs.

appetrosyan · 2024-06-13T04:19:47Z

I would suggest vendoring your own versions of the dependencies instead. I was supposed to fix this, but had to move to other projects. We could pool efforts on that. You should have my contact details, so we can discuss

appetrosyan · 2024-06-13T04:24:11Z

Meanwhile, here's a stack which we use in our internal projects:

ethers = { version = "=0.13.0" } # zeroize dep issue again
ethers-abi = { version = "18.0.0"}

[patch.crates-io]
der = { git = "https://github.com/tavakyan/formats.git", branch = "fix/downgrade-zeroize-version" }
curve25519-dalek = { git = "https://github.com/solana-labs/curve25519-dalek.git", rev = "b500cdc2a920cd5bff9e2dd974d7b97349d61464" }

Which should work with

resolver = "2"

AraMambreyan · 2024-06-13T04:29:51Z

I would suggest vendoring your own versions of the dependencies instead. I was supposed to fix this, but had to move to other projects. We could pool efforts on that. You should have my contact details, so we can discuss

Oh, hey Alex, good to see you here, small world!

Will ping you.

tarcieri · 2024-06-13T12:53:21Z

Note: there's an upstream fix being worked on here: anza-xyz#1693

appetrosyan · 2024-06-13T14:22:57Z

That's a good start.

danielementary · 2024-06-18T23:49:40Z

I used the patches from solana Cargo.toml and it worked for compiling my project with both Solana and libp2p

tarcieri · 2024-06-18T23:52:23Z

FYI, all versions of curve25519-dalek prior to v4.1.3 contain a critical timing sidechannel vulnerability which may leak private keys: https://rustsec.org/advisories/RUSTSEC-2024-0344.html

It would be very good for Solana to prioritize PRs like anza-xyz#1693 as currently it's using unmaintained versions of important crypto libraries.

danielementary · 2024-06-19T00:03:22Z

Sure, I meant my comment as a workaround for those who just want to get started with the dependencies and can’t compile, rather than ignoring any security concerns (personally, this would have helped me a few weeks ago when I was starting my project). I’ve been patiently waiting for that PR to be merged too

sarmatdev · 2024-07-03T16:55:08Z

> P.S Patching `aes-gcm-siv` and `curve25519-dalek` doesn't work. The error is:

@uandere Hey, did you managed to solve this issue?

klefevre · 2024-07-05T09:38:02Z

This PR was open in Jul 20, 2022. Still not fixed. I guess Solana owners don't want us to use their library.

samuelvanderwaal · 2024-07-05T15:37:27Z

This PR was open in Jul 20, 2022. Still not fixed. I guess Solana owners don't want us to use their library.

It's being worked on here and looks very close: anza-xyz#1693.

ohaddahan · 2024-07-22T09:05:30Z

More dependency issues anza-xyz#612 I'm also facing them.
Tried your solution @juchiast but didn't help :(

ItsFunny · 2024-07-25T02:53:17Z

this works for me:
[patch.crates-io]
curve25519-dalek = { git = 'https://github.com/ivs/curve25519-dalek', branch='rustls-dep-hell' }
aes-gcm-siv = { git = 'https://github.com/ivs/AEADs', branch='rustls-dep-hell' }

ohaddahan · 2024-07-25T03:05:51Z

this works for me:

[patch.crates-io]

curve25519-dalek = { git = 'https://github.com/ivs/curve25519-dalek', branch='rustls-dep-hell' }

aes-gcm-siv = { git = 'https://github.com/ivs/AEADs', branch='rustls-dep-hell' }

Try adding Tauri 2.0.0-beta with features rustls , that should fail 😢

solanagirl · 2024-08-16T19:32:28Z

i am also facing this with incompatible zeroize versions

jonwalch · 2024-09-04T18:01:08Z

$ cargo build
    Updating crates.io index
error: failed to select a version for `zeroize`.
    ... required by package `curve25519-dalek v3.2.1`
    ... which satisfies dependency `curve25519-dalek = "^3.2.1"` of package `solana-program v2.0.8`
    ... which satisfies dependency `solana-program = "=2.0.8"` of package `solana-sdk v2.0.8`
    ... which satisfies dependency `solana-sdk = "^2.0.8"` of package `webserver v0.1.0 (/Users/jon/Developer/superstate/webserver)`
versions that meet the requirements `>=1, <1.4` are: 1.3.0, 1.2.0, 1.1.1, 1.1.0, 1.0.0

all possible versions conflict with previously selected packages.

  previously selected package `zeroize v1.5.3`
    ... which satisfies dependency `zeroize = "^1.5"` of package `elliptic-curve v0.13.6`
    ... which satisfies dependency `elliptic-curve = "^0.13.5"` of package `ethers-core v2.0.14`
    ... which satisfies dependency `ethers-core = "^2.0.14"` of package `ethers v2.0.14`
    ... which satisfies dependency `ethers = "^2.0.14"` of package `webserver v0.1.0 (/Users/jon/Developer/superstate/webserver)`

failed to select a version for `zeroize` which could resolve this conflict

tarcieri · 2024-09-04T18:36:05Z

Note: this PR to upgrade curve25519-dalek to v4.x was just merged: anza-xyz#2252

It's unclear when it will make it into a release, but it should address the issue.

danimhr · 2024-09-09T16:50:29Z

This solved my issued

IntelC-H · 2024-09-13T11:46:01Z

@danimhr, How to fix it?

pxr64 · 2024-10-14T07:21:18Z

How can i use the solana-sdk in my project?

error: failed to select a version for `zeroize`.
    ... required by package `curve25519-dalek v3.2.1`
    ... which satisfies dependency `curve25519-dalek = "^3.2.1"` of package `solana-program v2.0.13`
    ... which satisfies dependency `solana-program = "=2.0.13"` of package `solana-sdk v2.0.13`
    ... which satisfies dependency `solana-sdk = "^2.0.13"` of package `integration_tests v0.1.0 (/Users/bogdanbrinzoiu/Work/liquidium-icp-pools/liquidium-pools/canisters/integration_tests)`
versions that meet the requirements `>=1, <1.4` are: 1.3.0, 1.2.0, 1.1.1, 1.1.0, 1.0.0

all possible versions conflict with previously selected packages.

  previously selected package `zeroize v1.5.3`
    ... which satisfies dependency `zeroize = "^1.5"` of package `elliptic-curve v0.13.6`
    ... which satisfies dependency `elliptic-curve = "^0.13"` of package `k256 v0.13.1`
    ... which satisfies dependency `k256 = "^0.13.1"` of package `ic-agent v0.37.1`
    ... which satisfies dependency `ic-agent = "^0.37.1"` of package `pocket-ic v5.0.0 (https://github.com/dfinity/ic?rev=6dae2daa1888cc0f4ee191d0dacb7186a6b4570e#6dae2daa)`
    ... which satisfies git dependency `pocket-ic` (locked to 5.0.0) of package `integration_tests v0.1.0 (/Users/bogdanbrinzoiu/Work/liquidium-icp-pools/liquidium-pools/canisters/integration_tests)`

KirillLykov · 2024-10-14T12:54:07Z

you can try

zeroize = { version = "1.7", default-features = false }

and check how we build downstream projects: https://github.com/anza-xyz/agave/blob/f9f8b60ca15fa721c6cdd816c99dfd4e9123fd77/scripts/build-downstream-anchor-projects.sh#L72

So maybe something like that helps

[patch.crates-io]
curve25519-dalek = { git = "https://github.com/anza-xyz/curve25519-dalek.git", rev = "b500cdc2a920cd5bff9e2dd974d7b97349d61464" }

acheroncrypto · 2024-10-31T16:11:51Z

This issue looks to be resolved with the release of Solana v2.1.0 crates (at least for the most part).

However, the new release has also introduced a new set of compatibility issues with existing crates that still use older versions of curve25519-dalek, e.g. spl-token-2022 (solana-labs/solana-program-library#7416 (comment)), which could have been avoided with proper versioning.

mschneider added the dependencies label May 9, 2023

kskalski added a commit to kskalski/solana that referenced this issue Jul 27, 2023

Bump curve25519-dalek to 4.0.0

8d152fc

Fixes solana-labs#26688

juchiast mentioned this issue Aug 4, 2023

Release 2.0 TODO dalek-cryptography/ed25519-dalek#245

Closed

ellttBen mentioned this issue Aug 8, 2023

Not able to pull latest rust sns-sdk library Bonfida/sns-sdk#16

Closed

mschneider self-assigned this Sep 20, 2023

tareknaser mentioned this issue Oct 26, 2023

zeroize: Apply zeroize patch to all repository crates. #33853

Closed

tareknaser mentioned this issue Nov 11, 2023

Remove Crate Patches from Cargo.toml Upon Solana Crate Updates hyperledger-solang/solang-aqd#5

Open

qdrs mentioned this issue Jun 24, 2024

update aes-gcm-siv, curve25519, and ed25519 deps #35594

Closed

tarcieri mentioned this issue Aug 5, 2024

Tracker: rand 0.9 rust-random/rand#1165

Open

23 tasks

cgebe mentioned this issue Aug 8, 2024

Support different versions of the same dependency within a workspace rust-lang/cargo#13594

Open

curve25519-dalek zeroize dependency not compatible with other libraries #26688

curve25519-dalek zeroize dependency not compatible with other libraries #26688

Comments

samuelvanderwaal commented Jul 20, 2022 • edited Loading

Problem

Proposed Solution

anthontaylor commented Aug 22, 2022

whymidnight commented Oct 10, 2022 • edited Loading

whymidnight commented Oct 10, 2022

samuelvanderwaal commented Oct 10, 2022

NorbertBodziony commented May 8, 2023

mschneider commented May 9, 2023

juchiast commented Jul 24, 2023

hlgltvnnk commented Jul 31, 2023

juchiast commented Aug 1, 2023 • edited Loading

hlgltvnnk commented Aug 1, 2023 • edited Loading

hlgltvnnk commented Aug 14, 2023

jbuckmccready commented Sep 19, 2023

mschneider commented Sep 20, 2023 • edited Loading

tomlinton commented Sep 20, 2023

jbuckmccready commented Sep 20, 2023

klefevre commented Sep 27, 2023 • edited Loading

dbcfd commented Sep 29, 2023

ronanyeah commented Dec 4, 2023

mina86 commented Dec 5, 2023

ronanyeah commented Dec 5, 2023

juchiast commented Dec 13, 2023

serejke commented Dec 16, 2023

dougEfresh commented Jan 14, 2024

ara-selini commented Jun 13, 2024

samuelvanderwaal commented Jun 13, 2024

AraMambreyan commented Jun 13, 2024

35359595 commented Jun 13, 2024

AraMambreyan commented Jun 13, 2024

appetrosyan commented Jun 13, 2024

appetrosyan commented Jun 13, 2024

AraMambreyan commented Jun 13, 2024

tarcieri commented Jun 13, 2024

appetrosyan commented Jun 13, 2024

danielementary commented Jun 18, 2024

tarcieri commented Jun 18, 2024

danielementary commented Jun 19, 2024

sarmatdev commented Jul 3, 2024 • edited Loading

klefevre commented Jul 5, 2024

samuelvanderwaal commented Jul 5, 2024

ohaddahan commented Jul 22, 2024

ItsFunny commented Jul 25, 2024 • edited Loading

ohaddahan commented Jul 25, 2024

solanagirl commented Aug 16, 2024

jonwalch commented Sep 4, 2024

tarcieri commented Sep 4, 2024

danimhr commented Sep 9, 2024

IntelC-H commented Sep 13, 2024

pxr64 commented Oct 14, 2024

KirillLykov commented Oct 14, 2024 • edited Loading

acheroncrypto commented Oct 31, 2024

samuelvanderwaal commented Jul 20, 2022 •

edited

Loading

whymidnight commented Oct 10, 2022 •

edited

Loading

juchiast commented Aug 1, 2023 •

edited

Loading

hlgltvnnk commented Aug 1, 2023 •

edited

Loading

mschneider commented Sep 20, 2023 •

edited

Loading

klefevre commented Sep 27, 2023 •

edited

Loading

sarmatdev commented Jul 3, 2024 •

edited

Loading

ItsFunny commented Jul 25, 2024 •

edited

Loading

KirillLykov commented Oct 14, 2024 •

edited

Loading