Problem: (CRO-392) Outdated dependencies in client's storage encryption #588

devashishdxt · 2019-11-14T03:46:20Z

Solution: Use aes-gcm-siv for encryption/decryption

Note: Turns out that the root cause of timeouts was password hashing using rust-argon2 which, as far as I know, is only useful when we want to store passwords in a database. Adding cache for wallet details is still a good idea and can be done in a different task.

devashishdxt · 2019-11-14T03:50:10Z

bors try

bors · 2019-11-14T04:23:29Z

try

Build failed

continuous-integration/drone/push

tomtau · 2019-11-14T04:49:51Z

Note: Turns out that the root cause of timeouts was password hashing using rust-argon2 which, as far as I know, is only useful when we want to store passwords in a database. Adding cache for wallet details is still a good idea and can be done in a different task.

the client stores structured data (not only random seeds / private keys), so with potentially weak passphrases, it could be useful to slow down brute-forcing.
but that may be a different problem to solve

tomtau · 2019-11-14T04:53:47Z

bors r+

devashishdxt · 2019-11-14T05:50:23Z

Note: Turns out that the root cause of timeouts was password hashing using rust-argon2 which, as far as I know, is only useful when we want to store passwords in a database. Adding cache for wallet details is still a good idea and can be done in a different task.

the client stores structured data (not only random seeds / private keys), so with potentially weak passphrases, it could be useful to slow down brute-forcing.
but that may be a different problem to solve

For this, we can just append a random salt to passphrase before hashing. No need to change hashing algorithm.

580: Bump unicase from 2.5.1 to 2.6.0 r=tomtau a=dependabot-preview[bot] Bumps [unicase](https://github.com/seanmonstar/unicase) from 2.5.1 to 2.6.0. <details> <summary>Release notes</summary> *Sourced from [unicase's releases](https://github.com/seanmonstar/unicase/releases).* > ## v2.6.0 > - Fix `UniCase::eq` in Unicode mode so that it doesn't equal a substring of the other. > - Make crate `no_std`. </details> <details> <summary>Commits</summary> - [`7b116bc`](seanmonstar/unicase@7b116bc) v2.6.0 - [`c14856b`](seanmonstar/unicase@c14856b) Fix Unicode::eq to not equal when one side is a substring of the other ([#39](https://github-redirect.dependabot.com/seanmonstar/unicase/issues/39)) - [`4788cba`](seanmonstar/unicase@4788cba) update version_check - [`fbab380`](seanmonstar/unicase@fbab380) Implement no_std support ([#34](https://github-redirect.dependabot.com/seanmonstar/unicase/issues/34)) - See full diff in [compare view](seanmonstar/unicase@v2.5.1...v2.6.0) </details> <br /> [![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=unicase&package-manager=cargo&previous-version=2.5.1&new-version=2.6.0)](https://dependabot.com/compatibility-score.html?dependency-name=unicase&package-manager=cargo&previous-version=2.5.1&new-version=2.6.0) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) </details> 588: Problem: (CRO-392) Outdated dependencies in client's storage encryption r=tomtau a=devashishdxt Solution: Use `aes-gcm-siv` for encryption/decryption Note: Turns out that the root cause of timeouts was password hashing using `rust-argon2` which, as far as I know, is only useful when we want to store passwords in a database. Adding cache for wallet details is still a good idea and can be done in a different task. Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com> Co-authored-by: Devashish Dixit <devashish@crypto.com>

codecov · 2019-11-14T06:52:37Z

Codecov Report

Merging #588 into master will increase coverage by 0.02%.
The diff coverage is 96.87%.

@@            Coverage Diff             @@
##           master     #588      +/-   ##
==========================================
+ Coverage   67.73%   67.75%   +0.02%     
==========================================
  Files         124      124              
  Lines       14785    14776       -9     
==========================================
- Hits        10015    10012       -3     
+ Misses       4770     4764       -6

Impacted Files	Coverage Δ
client-common/src/error.rs	`61.9% <0%> (-1%)`	⬇️
client-core/src/service/hd_key_service.rs	`88.03% <100%> (ø)`	⬆️
client-common/src/storage.rs	`94.23% <100%> (+5.52%)`	⬆️
...ient-core/src/service/multi_sig_session_service.rs	`77.84% <0%> (+0.4%)`	⬆️
client-core/src/service/root_hash_service.rs	`85.62% <0%> (+0.62%)`	⬆️

tomtau · 2019-11-14T08:33:42Z

bors r-

bors · 2019-11-14T08:33:44Z

Canceled

tomtau

as it modifies the drone pipeline, it changed its checksum and signature will keep failing, so every CI execution will then need a manual approval

.drone.yml

Solution: Use aes-gcm-siv for encryption/decryption

tomtau · 2019-11-14T08:54:50Z

bors r+

588: Problem: (CRO-392) Outdated dependencies in client's storage encryption r=tomtau a=devashishdxt Solution: Use `aes-gcm-siv` for encryption/decryption Note: Turns out that the root cause of timeouts was password hashing using `rust-argon2` which, as far as I know, is only useful when we want to store passwords in a database. Adding cache for wallet details is still a good idea and can be done in a different task. Co-authored-by: Devashish Dixit <devashish@crypto.com>

bors · 2019-11-14T10:44:35Z

Build succeeded

devashishdxt requested review from yihuang, tomtau, calvinaco, leejw51crypto, lezzokafka and linfeng-crypto November 14, 2019 03:46

calvinaco approved these changes Nov 14, 2019

View reviewed changes

bors bot added a commit that referenced this pull request Nov 14, 2019

Try #588:

7c81333

tomtau suggested changes Nov 14, 2019

View reviewed changes

.drone.yml Show resolved Hide resolved

leejw51crypto approved these changes Nov 14, 2019

View reviewed changes

Problem: (CRO-392) Outdated dependencies in client's storage encryption

ab101a4

Solution: Use aes-gcm-siv for encryption/decryption

devashishdxt requested a review from tomtau November 14, 2019 08:51

bors bot merged commit ab101a4 into crypto-com:master Nov 14, 2019

devashishdxt deleted the client-enc-update branch November 15, 2019 04:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Problem: (CRO-392) Outdated dependencies in client's storage encryption #588

Problem: (CRO-392) Outdated dependencies in client's storage encryption #588

devashishdxt commented Nov 14, 2019 •

edited

Loading

devashishdxt commented Nov 14, 2019

bors bot commented Nov 14, 2019

tomtau commented Nov 14, 2019

tomtau commented Nov 14, 2019

devashishdxt commented Nov 14, 2019 •

edited

Loading

codecov bot commented Nov 14, 2019 •

edited

Loading

tomtau commented Nov 14, 2019

bors bot commented Nov 14, 2019

tomtau left a comment •

edited

Loading

tomtau commented Nov 14, 2019

bors bot commented Nov 14, 2019

Problem: (CRO-392) Outdated dependencies in client's storage encryption #588

Problem: (CRO-392) Outdated dependencies in client's storage encryption #588

Conversation

devashishdxt commented Nov 14, 2019 • edited Loading

devashishdxt commented Nov 14, 2019

bors bot commented Nov 14, 2019

try

Build failed

tomtau commented Nov 14, 2019

tomtau commented Nov 14, 2019

devashishdxt commented Nov 14, 2019 • edited Loading

codecov bot commented Nov 14, 2019 • edited Loading

Codecov Report

tomtau commented Nov 14, 2019

bors bot commented Nov 14, 2019

Canceled

tomtau left a comment • edited Loading

Choose a reason for hiding this comment

tomtau commented Nov 14, 2019

bors bot commented Nov 14, 2019

Build succeeded

devashishdxt commented Nov 14, 2019 •

edited

Loading

devashishdxt commented Nov 14, 2019 •

edited

Loading

codecov bot commented Nov 14, 2019 •

edited

Loading

tomtau left a comment •

edited

Loading