Use secure_string for more secure Password and SecretKey #328
Conversation
- Updated struct to use SecureString for enhanced security. - Implemented PartialEq and Eq to be able to compare 2 Password instances - Added tests for equality comparison of instances.
…curity - Updated SecretKey struct to use SecureBytes for improved security handling. - Adjusted implementations of PartialEq and Debug to align with SecureBytes. - Implemented serialization for SecretKey since we cannot derive Serialize since SecureBytes doesn't implement it . - Included tests for JSON serialization of SecretKey.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Flags with carried forward coverage won't be shown. Click here to find out more.
... and 1 file with indirect coverage changes 🚀 New features to boost your workflow:
|
| @@ -80,7 +88,7 @@ impl Password { | |||
| /// let password = Password::new("password"); | |||
| /// ``` | |||
| #[must_use] | |||
| pub fn new<T: Into<String>>(password: T) -> Self { | |||
| pub fn new<T: Into<SecureString>>(password: T) -> Self { | |||
There was a problem hiding this comment.
I think we should leave it as Into<String>. Us using SecureString is our implementation detail, and we shouldn't force that on users and do any required casting ourselves.
There was a problem hiding this comment.
Good catch , I'll do that.
| /// The implementation of the [`PartialEq`] trait for this type is inherited from | ||
| /// [`SecureBytes`], which is constant-time to prevent timing attacks. |
There was a problem hiding this comment.
Am I blind or does SecureBytes (which is just SecureVec<u8>) claim it does constant-time comparison, yet they derive normal PartialEq in the source code? Source: https://docs.rs/secure-string/latest/src/secure_string/secure_types/vec.rs.html#23
There was a problem hiding this comment.
Not sure, why would they claim it is constant-time if it is not, will investigate more.
|
@seqre What do you think about the miri thing, because that is a blocker for this PR? |
This implements #47
cot::common_types::Passwordstruct to use SecureString for enhanced security.cot::common_types::Passwordto be able to compare 2 Password instances