authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2023-03-14 07:40:23+01:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2023-03-14 06:40:23+00:00
log5a12d00708df019fa510076f8af40d6efcb7c608
tree61a84033f560c9ae1138a4938a31cfe7a659ee0e
parent962299157840979ba659d478785f5ed0759d5401
signature Signed by PGP key 4AEE18F83AFDEB23

Move std.crypto.config options to std.options (#14906)

Options have been moved to a single namespace.

3 files changed, 25 insertions(+), 24 deletions(-)

lib/std/crypto.zig+19-23
......@@ -185,31 +185,27 @@ pub const errors = @import("crypto/errors.zig");
185185pub const tls = @import("crypto/tls.zig");
186186pub const Certificate = @import("crypto/Certificate.zig");
187187
188/// Global configuration of cryptographic implementations in the standard library.
189pub const config = struct {
190 /// Side-channels mitigations.
191 pub const SideChannelsMitigations = enum {
192 /// No additional side-channel mitigations are applied.
193 /// This is the fastest mode.
194 none,
195 /// The `basic` mode protects against most practical attacks, provided that the
196 /// application or implements proper defenses against brute-force attacks.
197 /// It offers a good balance between performance and security.
198 basic,
199 /// The `medium` mode offers increased resilience against side-channel attacks,
200 /// making most attacks unpractical even on shared/low latency environements.
201 /// This is the default mode.
202 medium,
203 /// The `full` mode offers the highest level of protection against side-channel attacks.
204 /// Note that this doesn't cover all possible attacks (especially power analysis or
205 /// thread-local attacks such as cachebleed), and that the performance impact is significant.
206 full,
207 };
208
209 /// This is a global configuration that applies to all cryptographic implementations.
210 pub const side_channels_mitigations: SideChannelsMitigations = if (@hasDecl(root, "side_channels_mitigations")) root.side_channels_mitigations else .medium;
188/// Side-channels mitigations.
189pub const SideChannelsMitigations = enum {
190 /// No additional side-channel mitigations are applied.
191 /// This is the fastest mode.
192 none,
193 /// The `basic` mode protects against most practical attacks, provided that the
194 /// application or implements proper defenses against brute-force attacks.
195 /// It offers a good balance between performance and security.
196 basic,
197 /// The `medium` mode offers increased resilience against side-channel attacks,
198 /// making most attacks unpractical even on shared/low latency environements.
199 /// This is the default mode.
200 medium,
201 /// The `full` mode offers the highest level of protection against side-channel attacks.
202 /// Note that this doesn't cover all possible attacks (especially power analysis or
203 /// thread-local attacks such as cachebleed), and that the performance impact is significant.
204 full,
211205};
212206
207pub const default_side_channels_mitigations = .medium;
208
213209test {
214210 _ = aead.aegis.Aegis128L;
215211 _ = aead.aegis.Aegis256;
lib/std/crypto/aes/soft.zig+1-1
......@@ -4,7 +4,7 @@ const mem = std.mem;
44
55const BlockVec = [4]u32;
66
7const side_channels_mitigations = std.crypto.config.side_channels_mitigations;
7const side_channels_mitigations = std.options.side_channels_mitigations;
88
99/// A single AES block.
1010pub const Block = struct {
lib/std/std.zig+5
......@@ -190,6 +190,11 @@ pub const options = struct {
190190 options_override.http_connection_pool_size
191191 else
192192 http.Client.default_connection_pool_size;
193
194 pub const side_channels_mitigations: crypto.SideChannelsMitigations = if (@hasDecl(options_override, "side_channels_mitigations"))
195 options_override.side_channels_mitigations
196 else
197 crypto.default_side_channels_mitigations;
193198};
194199
195200// This forces the start.zig file to be imported, and the comptime logic inside that