Repository: lucid-kv/lucid (language: rust)

Issue:
RUSTSEC-2016-0005: rust-crypto is unmaintained; switch to a modern alternative

> rust-crypto is unmaintained; switch to a modern alternative

| Details             |                                                |
| ------------------- | ---------------------------------------------- |
| Status              | unmaintained                |
| Package             | `rust-crypto`                      |
| Version             | `0.2.36`                   |
| URL                 | [https://github.com/DaGenix/rust-crypto/issues/440](https://github.com/DaGenix/rust-crypto/issues/440) |
| Date                | 2016-09-06                         |
| Unaffected versions | `> 0.2.36`               |

The `rust-crypto` crate has not seen a release or GitHub commit since 2016,
and its author is unresponsive.

We recommend you switch to one of the following crates instead, depending on
which algorithms you need:

- [dalek-cryptography GitHub Org]:
  - Key agreement: [`x25519-dalek`]
  - Signature algorithms: [`ed25519-dalek`]
- [`ring`]:
  - AEAD algorithms: AES-GCM, ChaCha20Poly1305
  - Digest algorithms: SHA-256, SHA-384, SHA-512, SHA-512/256 (legacy: SHA-1)
  - HMAC
  - Key agreement: ECDH (P-256, P-384), X25519
  - Key derivation: HKDF
  - Password hashing: PBKDF2
  - Signature algorithms: ECDSA (P-256, P-384), Ed25519, RSA (PKCS#1v1.5, PSS)
- [RustCrypto GitHub Org]:
  - AEAD algorithms: [`aes-gcm`], [`aes-gcm-siv`], [`aes-siv`], [`chacha20poly1305`], [`xsalsa20poly1305`]
  - Block ciphers: [`aes`], [`cast5`], [`des`]
  - Digest algorithms: [`sha2`], [`sha3`], [`blake2`], [`ripemd160`] (legacy: [`sha-1`])
  - Key derivation: [`hkdf`]
  - MACs: [`cmac`], [`hmac`], [`pmac`], [`poly1305`]
  - Password hashing: [`pbkdf2`]
  - Stream ciphers: [`aes-ctr`], [`chacha20`], [`hc-256`], [`salsa20`]
- [`secp256k1`]:
  - Key agreement: ECDH (secp256k1 only)
  - Signature algorithms: ECDSA (secp256k1 only)
- [`sodiumoxide`]:
  - AEAD algorithms: ChaCha20Poly1305 (IETF version)
  - Digest algorithms: SHA-256, SHA-512
  - HMAC
  - Key agreement: X25519 + BLAKE2b
  - Password hashing: Argon2(i/d), scrypt
  - Public key encryption: NaCl "Box" (X25519 + XSalsa20Poly1305)
  - Signature algorithms: Ed25519
  - Short-input PRF: SipHash24

[dalek-cryptography GitHub Org]: https://github.com/dalek-cryptography
[RustCrypto GitHub Org]: https://github.com/RustCrypto
[`aes`]: https://crates.io/crates/aes
[`aes-ctr`]: https://crates.io/crates/aes-ctr
[`aes-gcm`]: https://crates.io/crates/aes-gcm
[`aes-gcm-siv`]: https://crates.io/crates/aes-gcm-siv
[`aes-siv`]: https://crates.io/crates/aes-siv
[`blake2`]: https://crates.io/crates/blake2
[`cast5`]: https://crates.io/crates/cast5
[`chacha20`]: https://crates.io/crates/chacha20
[`chacha20poly1305`]: https://crates.io/crates/chacha20poly1305
[`cmac`]: https://crates.io/crates/cmac
[`des`]: https://crates.io/crates/des
[`ed25519-dalek`]: https://crates.io/crates/ed25519-dalek
[`hc-256`]: https://crates.io/crates/hc-256
[`hkdf`]: https://crates.io/crates/hkdf
[`hmac`]: https://crates.io/crates/hmac
[`pbkdf2`]: https://crates.io/crates/pbkdf2
[`pmac`]: https://crates.io/crates/pmac
[`poly1305`]: https://crates.io/crates/poly1305
[`ring`]: https://crates.io/crates/ring
[`ripemd160`]: https://crates.io/crates/ripemd160
[`salsa20`]: https://crates.io/crates/salsa20
[`secp256k1`]: https://crates.io/crates/secp256k1
[`sha-1`]: https://crates.io/crates/sha-1
[`sha2`]: https://crates.io/crates/sha2
[`sha3`]: https://crates.io/crates/sha3
[`sodiumoxide`]: https://crates.io/crates/sodiumoxide
[`x25519-dalek`]: https://crates.io/crates/x25519-dalek
[`xsalsa20poly1305`]: https://crates.io/crates/xsalsa20poly1305


See [advisory page](https://rustsec.org/advisories/RUSTSEC-2016-0005.html) for additional details.



Discussion / hints:

Fix patch:
diff --git a/Cargo.lock b/Cargo.lock
index 8d8bced..5d316b2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -344,11 +344,6 @@ dependencies = [
  "num_cpus 1.10.1 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
-[[package]]
-name = "gcc"
-version = "0.3.55"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-
 [[package]]
 name = "generic-array"
 version = "0.12.3"
@@ -643,7 +638,7 @@ dependencies = [
  "nickel 0.11.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "plugin 0.2.6 (registry+https://github.com/rust-lang/crates.io-index)",
  "rand 0.7.2 (registry+https://github.com/rust-lang/crates.io-index)",
- "rust-crypto 0.2.36 (registry+https://github.com/rust-lang/crates.io-index)",
+ "ring 0.14.6 (registry+https://github.com/rust-lang/crates.io-index)",
  "rustflake 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "serde 1.0.101 (registry+https://github.com/rust-lang/crates.io-index)",
  "serde_derive 1.0.101 (registry+https://github.com/rust-lang/crates.io-index)",
@@ -1016,15 +1011,6 @@ dependencies = [
  "proc-macro2 1.0.6 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
-[[package]]
-name = "rand"
-version = "0.3.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-dependencies = [
- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
- "rand 0.4.6 (registry+https://github.com/rust-lang/crates.io-index)",
-]
-
 [[package]]
 name = "rand"
 version = "0.4.6"
@@ -1225,28 +1211,11 @@ dependencies = [
  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
 ]
 
-[[package]]
-name = "rust-crypto"
-version = "0.2.36"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-dependencies = [
- "gcc 0.3.55 (registry+https://github.com/rust-lang/crates.io-index)",
- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
- "rand 0.3.23 (registry+https://github.com/rust-lang/crates.io-index)",
- "rustc-serialize 0.3.24 (registry+https://github.com/rust-lang/crates.io-index)",
- "time 0.1.42 (registry+https://github.com/rust-lang/crates.io-index)",
-]
-
 [[package]]
 name = "rustc-demangle"
 version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 
-[[package]]
-name = "rustc-serialize"
-version = "0.3.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-
 [[package]]
 name = "rustc_version"
 version = "0.2.3"
@@ -1961,7 +1930,6 @@ dependencies = [
 "checksum fuchsia-zircon-sys 0.3.3 (registry+https://github.com/rust-lang/crates.io-index)" = "3dcaa9ae7725d12cdb85b3ad99a434db70b468c09ded17e012d86b5c1010f7a7"
 "checksum futures 0.1.29 (registry+https://github.com/rust-lang/crates.io-index)" = "1b980f2816d6ee8673b6517b52cb0e808a180efc92e5c19d02cdda79066703ef"
 "checksum futures-cpupool 0.1.8 (registry+https://github.com/rust-lang/crates.io-index)" = "ab90cde24b3319636588d0c35fe03b1333857621051837ed769faefb4c2162e4"
-"checksum gcc 0.3.55 (registry+https://github.com/rust-lang/crates.io-index)" = "8f5f3913fa0bfe7ee1fd8248b6b9f42a5af4b9d65ec2dd2c3c26132b950ecfc2"
 "checksum generic-array 0.12.3 (registry+https://github.com/rust-lang/crates.io-index)" = "c68f0274ae0e023facc3c97b2e00f076be70e254bc851d972503b328db79b2ec"
 "checksum getrandom 0.1.13 (registry+https://github.com/rust-lang/crates.io-index)" = "e7db7ca94ed4cd01190ceee0d8a8052f08a247aa1b469a7f68c6a3b71afcf407"
 "checksum glob 0.2.11 (registry+https://github.com/rust-lang/crates.io-index)" = "8be18de09a56b60ed0edf84bc9df007e30040691af7acd1c41874faac5895bfb"
@@ -2033,7 +2001,6 @@ dependencies = [
 "checksum quick-error 1.2.2 (registry+https://github.com/rust-lang/crates.io-index)" = "9274b940887ce9addde99c4eee6b5c44cc494b182b97e73dc8ffdcb3397fd3f0"
 "checksum quote 0.6.13 (registry+https://github.com/rust-lang/crates.io-index)" = "6ce23b6b870e8f94f81fb0a363d65d86675884b34a09043c81e5562f11c1f8e1"
 "checksum quote 1.0.2 (registry+https://github.com/rust-lang/crates.io-index)" = "053a8c8bcc71fcce321828dc897a98ab9760bef03a4fc36693c231e5b3216cfe"
-"checksum rand 0.3.23 (registry+https://github.com/rust-lang/crates.io-index)" = "64ac302d8f83c0c1974bf758f6b041c6c8ada916fbb44a609158ca8b064cc76c"
 "checksum rand 0.4.6 (registry+https://github.com/rust-lang/crates.io-index)" = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
 "checksum rand 0.6.5 (registry+https://github.com/rust-lang/crates.io-index)" = "6d71dacdc3c88c1fde3885a3be3fbab9f35724e6ce99467f7d9c5026132184ca"
 "checksum rand 0.7.2 (registry+https://github.com/rust-lang/crates.io-index)" = "3ae1b169243eaf61759b8475a998f0a385e42042370f3a7dbaf35246eacc8412"
@@ -2056,9 +2023,7 @@ dependencies = [
 "checksum remove_dir_all 0.5.2 (registry+https://github.com/rust-lang/crates.io-index)" = "4a83fa3702a688b9359eccba92d153ac33fd2e8462f9e0e3fdf155239ea7792e"
 "checksum rgb 0.8.14 (registry+https://github.com/rust-lang/crates.io-index)" = "2089e4031214d129e201f8c3c8c2fe97cd7322478a0d1cdf78e7029b0042efdb"
 "checksum ring 0.14.6 (registry+https://github.com/rust-lang/crates.io-index)" = "426bc186e3e95cac1e4a4be125a4aca7e84c2d616ffc02244eef36e2a60a093c"
-"checksum rust-crypto 0.2.36 (registry+https://github.com/rust-lang/crates.io-index)" = "f76d05d3993fd5f4af9434e8e436db163a12a9d40e1a58a726f27a01dfd12a2a"
 "checksum rustc-demangle 0.1.16 (registry+https://github.com/rust-lang/crates.io-index)" = "4c691c0e608126e00913e33f0ccf3727d5fc84573623b8d65b2df340b5201783"
-"checksum rustc-serialize 0.3.24 (registry+https://github.com/rust-lang/crates.io-index)" = "dcf128d1287d2ea9d80910b5f1120d0b8eede3fbf1abe91c40d39ea7d51e6fda"
 "checksum rustc_version 0.2.3 (registry+https://github.com/rust-lang/crates.io-index)" = "138e3e0acb6c9fb258b19b67cb8abd63c00679d2851805ea151465464fe9030a"
 "checksum rustflake 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)" = "3fd2a23c7b59744081b34eadc799cda78e9471f333fe265c1dae05ab70d5ac94"
 "checksum ryu 1.0.2 (registry+https://github.com/rust-lang/crates.io-index)" = "bfa8506c1de11c9c4e4c38863ccbe02a305c8188e85a05a784c9e11e1c3910c8"
diff --git a/Cargo.toml b/Cargo.toml
index b546d11..5aa4399 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -24,7 +24,7 @@ jsonwebtoken = "*"
 app_dirs = "*"
 colored = "*"
 yaml-rust = "*"
-rust-crypto = "*"
+ring = "*"
 uuid = "*"
 rand = "*"
 warp = "*"
diff --git a/src/lucid.rs b/src/lucid.rs
index 05c0edb..8ca5bd5 100644
--- a/src/lucid.rs
+++ b/src/lucid.rs
@@ -3,7 +3,6 @@ use std::io::{Error, ErrorKind};
 use app_dirs::*;
 use chrono::*;
 use clap::App;
-use crypto::digest::Digest;
 use jsonwebtoken::*;
 
 use crate::configuration::Configuration;
@@ -143,11 +142,16 @@ impl Lucid {
                 }
 
                 if let Some(matches) = cli.subcommand_matches("init") {
-                    use crypto::sha2::Sha256;
+                    use ring::digest::SHA256;
                     use rand::Rng;
-                    let mut hasher = Sha256::new();
-                    hasher.input(&rand::thread_rng().gen::<[u8; 32]>());
-                    let mut secret_key = hasher.result_str();
+                    let secret_key_bytes = ring::digest::digest(&SHA256, &rand::thread_rng().gen::<[u8; 32]>());
+                    let mut secret_key = secret_key_bytes.as_ref().iter().fold(
+                        String::with_capacity(secret_key_bytes.as_ref().len() * 2),
+                        |mut acc, x| {
+                            acc.push_str(&format!("{:0>2x}", x));
+                            acc
+                        },
+                    );
 
                     match matches.value_of("secret") {
                         Some(secret) => {


Test patch: