Skip to content

Bump ring from 0.16.20 to 0.17.13 #99

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Bump ring from 0.16.20 to 0.17.13 #99

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bdea86e
Bump ring from 0.16.20 to 0.17.13
dependabot[bot] Jun 24, 2026
ac05dd4
Update to new Ring interface
brghena Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
162 changes: 113 additions & 49 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,4 +20,4 @@ clap-num = "1.0.2"
tar = "0.4.39"
elf = "0.7.2"
sha2 = "0.10.7"
ring = "0.16.20"
ring = "0.17.14"
30 changes: 9 additions & 21 deletions src/convert.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@

use crate::header;
use crate::util::{self, align_to, amount_alignment_needed};
use ring::signature::KeyPair;
use ring::{rand, signature};
use sha2::{Digest, Sha256, Sha384, Sha512};
use std::cmp;
Expand Down Expand Up @@ -1060,30 +1059,18 @@ pub fn elf_to_tbf(
panic!("RSA4096 could not be parsed: {:?}", e);
});

let public_key: ring::signature::RsaPublicKeyComponents<Vec<u8>> =
ring::signature::RsaPublicKeyComponents {
n: key_pair
.public_key()
.modulus()
.big_endian_without_leading_zero()
.to_vec(),
e: key_pair
.public_key()
.exponent()
.big_endian_without_leading_zero()
.to_vec(),
};

if key_pair.public_modulus_len() != 512 {
let public_key: ring::signature::RsaPublicKeyComponents<Vec<u8>> = key_pair.public().into();

@brghena brghena Jun 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This got both harder and simpler. Getting the modulus and exponent from a public key is no longer directly supported, however a public key can just be changed into a PublicKeyComponents which is what we're creating here anyways.


if key_pair.public().modulus_len() != 512 {
// A 4096-bit key should have a 512-byte modulus
panic!(
"RSA4096 signature requested but key {:?} is not 4096 bits, it is {} bits",
private_key_path,
key_pair.public_modulus_len() * 8
key_pair.public().modulus_len() * 8
);
}
let rng = rand::SystemRandom::new();
let mut signature = vec![0; key_pair.public_modulus_len()];
let mut signature = vec![0; key_pair.public().modulus_len()];
let _res = key_pair
.sign(
&signature::RSA_PKCS1_SHA512,
Expand All @@ -1095,10 +1082,10 @@ pub fn elf_to_tbf(
panic!("Could not generate RSA4096 signature: {:?}", e);
});
let mut credentials = vec![0; 1024];
credentials[..key_pair.public_modulus_len()]
.copy_from_slice(&public_key.n[..key_pair.public_modulus_len()]);
credentials[..key_pair.public().modulus_len()]
.copy_from_slice(&public_key.n[..key_pair.public().modulus_len()]);
for (i, sig) in signature.iter().enumerate() {
let index = i + key_pair.public_modulus_len();
let index = i + key_pair.public().modulus_len();
credentials[index] = *sig;
}

Expand Down Expand Up @@ -1133,6 +1120,7 @@ pub fn elf_to_tbf(
let key_pair = ring::signature::EcdsaKeyPair::from_pkcs8(
&ring::signature::ECDSA_P256_SHA256_FIXED_SIGNING,
&private_key_contents,
&rand::SystemRandom::new(),

@brghena brghena Jun 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems to be the right thing to do since it was what was previously removed from inside of the function. briansmith/ring@2accae1

)
.unwrap_or_else(|e| {
panic!("ECDSA NIST P256 could not be parsed: {:?}", e);
Expand Down
Loading