[crypto] Prepare for version increment - #30916
Open
siemen11 wants to merge 2 commits into
Open
Conversation
siemen11
requested review from
andrea-caforio,
johannheyszl,
nasahlpa and
timothytrippel
and removed request for
a team and
timothytrippel
August 4, 2026 13:59
siemen11
force-pushed
the
crypto_version_readiness
branch
from
August 4, 2026 16:18
12b2b7a to
ba3e0f8
Compare
nasahlpa
approved these changes
Aug 5, 2026
nasahlpa
left a comment
nasahlpa
left a comment
Contributor
There was a problem hiding this comment.
Thanks Siemen, I agree that it makes sense that CL has a single ground of truth (otcrypto_lib_version) rather than directly using kOtcryptoLibVersion1
|
|
||
| static const otcrypto_key_config_t kEd25519PrivateKeyConfig = { | ||
| .version = kOtcryptoLibVersion1, | ||
| .version = kCryptoLibVersion, |
Contributor
There was a problem hiding this comment.
It seems we are a bit mixing kCryptoLibVersion and otcrypto_lib_version(). Shouldn't we use the function?
Contributor
Author
There was a problem hiding this comment.
Thanks indeed messy, made it all otcrypto_lib_version
siemen11
force-pushed
the
crypto_version_readiness
branch
2 times, most recently
from
August 5, 2026 11:24
69e7b7b to
4491a5c
Compare
siemen11
force-pushed
the
crypto_version_readiness
branch
4 times, most recently
from
August 5, 2026 16:49
342230f to
c068aa9
Compare
siemen11
force-pushed
the
crypto_version_readiness
branch
2 times, most recently
from
August 6, 2026 08:52
8274242 to
5831c65
Compare
siemen11
force-pushed
the
crypto_version_readiness
branch
3 times, most recently
from
August 6, 2026 11:47
8c26b47 to
9bedc61
Compare
Cryptolib uses kOtcryptoLibVersion1 as version of the library and in key configs. This commit adds a kOtcryptoLibVersion2 magic number. We create a new API call otcrypto_lib_version() which returns the version of the library. We then switch all tests and internal cryptolib functions to use this call to automatically reference the current version. Integrity was also rejecting keys which did not set the current version number, however, the library has to be backward compatible, so we removed the check. Later on, we can decide what to do on certain version numbers. The documentation was also updated in this regard. Signed-off-by: Siemen Dhooghe <sdhooghe@google.com>
As we would move to higher version numbers for the library, we allow for migration options to increment older key version numbers. As such, we add to the documentation, add the api function (which is just a simple function from now checking it is the current version), and the integrity check checks whether we are on the current version and would reject if it is not the case. For clarity, only blinded keys have a version, unblinded keys do not. The version is mainly there for masking. Due to hardware keys using their version numbers as part of the diversifier, we can not migrate those. Signed-off-by: Siemen Dhooghe <sdhooghe@google.com>
siemen11
force-pushed
the
crypto_version_readiness
branch
from
August 6, 2026 13:31
9bedc61 to
19be08a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cryptolib uses kOtcryptoLibVersion1 as version of the library and in key configs.
This commit adds a kOtcryptoLibVersion2 magic number.
We create a new API call otcrypto_lib_version() which returns the version of the library. We then switch all tests and internal cryptolib functions to use this call to automatically reference the current version.
Integrity was also rejecting keys which did not set the current version number, however, the library has to be backward compatible, so we removed the check. Later on, we can decide what to do on certain version numbers.
The documentation was also updated in this regard.