Bump to group 0.14 / rand_core 0.10 (unblocks ibs -> postguard rand upgrade)

[dobby-coder]

Goal

Unblock the rand upgrade in postguard (encryption4all/postguard#195), which is stuck at the bottom of a three-repo dependency chain:

pg-curve (group 0.13) → ibe (this repo, blocked on group 0.14) → ibs (already migrated on main, not yet released) → postguard.

ibe#41 (closed) already documents why the group 0.14 bump was deliberately skipped: pg-curve 0.2.0 and pairing 0.23.0 both pin group 0.13, and ibe passes pg-curve's curve types into group trait bounds, so a partial bump doesn't compile. Note: pg-curve's own issue tracker is disabled, so any upstream fix there has to ship as a PR without a tracking issue on that repo — this issue is the place to coordinate it.

What's needed

1. Check whether pg-curve can be bumped to group 0.14 / pairing 0.24-ish / rand_core 0.10 (upstream ff/group/pairing compatibility permitting), and open a PR there if so.
2. Once pg-curve supports it, bump ibe's own group/pairing/rand_core deps to match.
3. Confirm cargo test --all-features, cargo clippy --all-features, cargo fmt --check all pass.

Acceptance criteria

• ibe builds against group 0.14 (or newer) with rand_core 0.10, or
• A clear written blocker is recorded here (e.g. an upstream crate version that doesn't exist yet).
• If it lands, comment on encryption4all/postguard#195 so the rand bump there can be picked back up.

Planned via evening chat with r.hensen@caesar.nl — part of tonight's plan.

[dobby-coder]

/dobby Bump pg-curve/ibe to group 0.14 / rand_core 0.10 to unblock the ibs -> postguard rand upgrade

[dobby-coder]

Investigated the bump. It is blocked upstream by the pairing crate, so no compilable pg-curve/ibe change exists today.

State on crates.io (verified 2026-07-16):

• group 0.14.0 and ff 0.14.0 are published and stable, both on rand_core 0.10.
• pairing has no stable 0.24. The only 0.24 is pairing 0.24.0-pre.0, a pre-release that pins group =0.14.0-pre.0 (which is on rand_core 0.9, not 0.10).
• Upstream bls12_381 is still 0.8.0 on group 0.13.

pg-curve is a fork of bls12_381 and must implement the pairing traits, because ibe uses multi_miller_loop, pairing, Gt, and G2Prepared across all its schemes (the pairings feature is not optional for us). So pg-curve cannot move to group 0.14 until a stable pairing 0.24 (or bls12_381 0.9) exists.

Empirically confirmed: bumping pg-curve to pairing = "0.24" fails resolution (failed to select a version for the requirement pairing = "^0.24"). Forcing the full pre-release stack resolves rand_core to 0.9 (and duplicates it), so it does not reach rand_core 0.10 and is not viable for production crypto anyway.

Conclusion: this refines encryption4all/ibe#41 — group 0.14/ff 0.14 are now available, but the remaining gate is upstream pairing. Nothing to resume on encryption4all/postguard#195 yet. Keeping this issue open to track the upstream pairing 0.24 release.

I recorded the precise blocker in CLAUDE.md so the next attempt can skip the crates.io check: encryption4all/ibe#54.