rob thijssen
11d1bb97a6
The two halves of the harvest-now-decrypt-later defence (design.md §5.2), each a standalone primitive; pqxdh combines them into a root key next. - X25519 (x25519-dalek): secret/public keys, encode round-trip, diffie_hellman. Secrets seeded from getrandom directly (no rng-trait plumbing, wasm-clean). - ML-KEM-768 (ml-kem 0.3.2, FIPS 203): keygen, encapsulate/decapsulate, key encode/parse via kem's KeyExport; system-RNG methods route through getrandom 0.4 (wasm_js in browser). Tests: X25519 DH agreement + encoding round-trip; ML-KEM encapsulate↔decapsulate agreement, public-key round-trip, and the implicit-rejection property (a wrong decapsulation key yields a different, non-erroring secret — so transcript binding, not a decap error, is what authenticates). Compiles to wasm32. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UMbqdSzDP4F7Y9AdK5LXaV
73 lines
2.0 KiB
TOML
73 lines
2.0 KiB
TOML
[workspace]
|
|
resolver = "3"
|
|
members = ["crates/*"]
|
|
|
|
[workspace.package]
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
rust-version = "1.85"
|
|
license = "AGPL-3.0-only"
|
|
authors = ["Rob Thijssen <rob@example>"]
|
|
|
|
[workspace.dependencies]
|
|
# Internal crates
|
|
buh-entities = { path = "crates/buh-entities", version = "=0.1.0" }
|
|
buh-core = { path = "crates/buh-core", version = "=0.1.0" }
|
|
buh-data = { path = "crates/buh-data", version = "=0.1.0" }
|
|
|
|
# Async runtime
|
|
tokio = { version = "1", features = ["full"] }
|
|
async-trait = "0.1"
|
|
futures = "0.3"
|
|
|
|
# Serialization
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
|
|
# Web
|
|
axum = { version = "0.8", features = ["macros"] }
|
|
tower = "0.5"
|
|
tower-http = { version = "0.6", features = ["trace", "limit", "cors"] }
|
|
|
|
# Per-node datastore: Turso Database (embedded, pure-Rust SQLite rewrite).
|
|
# Not sqlx — the turso crate is the native async API. All SQL is centralised in buh-data.
|
|
turso = "0.4"
|
|
|
|
# Config
|
|
figment = { version = "0.10", features = ["toml", "env"] }
|
|
|
|
# CLI
|
|
clap = { version = "4", features = ["derive", "env"] }
|
|
|
|
# Errors / logging
|
|
thiserror = "2"
|
|
anyhow = "1"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["json", "env-filter"] }
|
|
|
|
# Client crypto core (buh-crypto only; the node never links these)
|
|
ml-dsa = "0.1.1"
|
|
# default-features off drops the old getrandom-0.2 RNG path (we supply nonces ourselves);
|
|
# `alloc` keeps the Vec-returning encrypt/decrypt.
|
|
chacha20poly1305 = { version = "0.10", default-features = false, features = ["alloc"] }
|
|
# 0.4 to match the version crypto-common (under ml-dsa) pulls, so the wasm_js backend is
|
|
# enabled once for a single getrandom in the tree.
|
|
getrandom = "0.4"
|
|
sha2 = "0.10"
|
|
hkdf = "0.12"
|
|
x25519-dalek = { version = "2", features = ["static_secrets"] }
|
|
ml-kem = "0.3.2"
|
|
|
|
# WASM FFI (buh-crypto `wasm` feature only)
|
|
wasm-bindgen = "0.2"
|
|
wasm-bindgen-test = "0.3"
|
|
|
|
# Misc
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
uuid = { version = "1", features = ["v4", "serde"] }
|
|
hex = "0.4"
|
|
base64 = "0.22"
|
|
bytes = "1"
|
|
tempfile = "3"
|
|
rand = "0.8"
|