Of these only `rand_core` is included in the public API; regardless of `rand`
semver tricks, this is a breaking API change, but the major version is already
bumped to include the Serde serialization fixes.
By default, Cargo treats version specifiers as semver-compatible ranges, so the
version specifiers we include should only have the components that are actually
meaningful, e.g., "1" instead of "1.0.0" (which actually means "1").
`zeroize` is WASM-friendly as it has no dependencies on C compilers.
Instead uses Rust's own volatile write semantics and compiler fences to
ensure zeroization is not elided by the compiler.
This is a breaking change to the serialization format. It fixes it so that the
Serde encoding can match the conventional encoding of each type of object, and
so that Serde can be used with no overhead -- when using serde-bincode, the
Serde encoding now matches the manual encoding.
This ensures that the serde Serialize and Deserialize implementations use
fixed-length Serde tuples, rather than variable-length byte arrays. This flaw
in data modeling was pointed out by Trevor Perrin.
This was more useful at the time when we were determining, e.g., optimal lookup
table sizes and could regenerate them more easily, but it came at a massive
complexity cost. It also meant that we were unable to implement backend
autoselection. This commit removes the `build.rs` entirely. In the future, a
different `build.rs` could be added that auto-selects a backend, but it seems
like the current default-u64 setup has been working fine.
Closes#238.
This issue was discovered independently by both Jack "str4d" Grigg
(issue #238), who noted that reduction was not performed on addition, and
Laurent Grémy & Nicolas Surbayrole of Quarkslab, who noted that it was possible
to cause an overflow and compute incorrect results.
Found by @3for; this only affected width-7 NAF computations, which were never
used in the source tree (only width 5, optimal for dynamic cases, and 8, better
for static cases).
Closes#272
The function `FieldElement::sqrt_ratio_i` always returns a positive root
by definition. Therefore the test for negativity in the edwards point
decompression function always returns false and we only need to flip its
sign if `compressed_sign_bit` is set.
