feat: post-quantum support for age - #287
Conversation
* Introduced support for post-quantum keys in the age encryption provider, allowing users to generate and use hybrid keys for enhanced security. * Updated documentation to reflect the new post-quantum capabilities, including usage instructions and configuration examples. * Modified the Cargo.toml to include the new `age-xwing` dependency for handling post-quantum keys. * Enhanced tests to validate the functionality of post-quantum key decryption and ensure compatibility with existing recipient types. This update aims to future-proof the encryption capabilities of the application against potential quantum threats. Originally authored by [brandonkal](jdx#249).
Summary of ChangesHello @manselmi, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly upgrades the application's cryptographic capabilities by integrating post-quantum key support into the age encryption provider. This enhancement aims to future-proof the system against emerging quantum computing threats, ensuring continued data security. The changes involve updating core dependencies, adjusting encryption/decryption workflows, and providing comprehensive documentation for the new features. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces post-quantum key support for the age encryption provider, a significant enhancement for future-proofing security. The changes include adding the age-xwing dependency, updating the core provider logic to handle hybrid key encryption and decryption, and adding comprehensive documentation and tests for the new functionality. My review focuses on dependency management, code clarity, and documentation consistency. Overall, this is a well-executed feature addition.
|
|
||
| # Provider dependencies | ||
| age = { version = "0.11", features = ["ssh"] } | ||
| age-xwing = { git = "https://github.com/thrzl/age-xwing", tag = "0.1.0" } |
There was a problem hiding this comment.
Using a git dependency can introduce security and maintenance risks, as it relies on the availability and integrity of the external repository. It's generally better to use dependencies from a registry like crates.io. If age-xwing is not available on crates.io, consider forking it into this project's organization or vendoring the code to have more control over it and ensure its long-term availability.
| # Verify your public key matches a recipient | ||
| cat ~/.config/fnox/age.txt # Check public key | ||
| cat ~/.ssh/id_ed25519.pub # Check SSH public key | ||
| cat ~/.config/fnox/age-pq.txt # Check post-quantum public key |
There was a problem hiding this comment.
There's an inconsistency in the documentation. The key generation example earlier uses ~/.config/fnox/age.txt as the output file, but this troubleshooting command refers to ~/.config/fnox/age-pq.txt. To avoid confusion, the filename should be consistent across the document.
| cat ~/.config/fnox/age-pq.txt # Check post-quantum public key | |
| cat ~/.config/fnox/age.txt # Check post-quantum public key |
| { | ||
| // Parse as HybridIdentity | ||
| let identity = | ||
| HybridIdentity::from_string(SecretString::new(pq_line.to_string().into())) |
There was a problem hiding this comment.
The .into() call here is redundant because pq_line.to_string() already returns a String. You can remove it to improve code clarity.
| HybridIdentity::from_string(SecretString::new(pq_line.to_string().into())) | |
| HybridIdentity::from_string(SecretString::new(pq_line.to_string())) |
|
This should probably depend on an X-Wing KEM implementation in crates.io (e.g. https://crates.io/crates/x-wing) instead of a library found only on GitHub. |
|
It would be great if we could lean on rage's implementation of this when it's ready: str4d/rage#632 I might be willing to open a PR adopting it here if I have the availability; I'll keep an eye on their repo in the meantime. EDIT: Maybe |
2 participants
Originally authored by brandonkal.
Introduced support for post-quantum keys in the age encryption provider, allowing users to generate and use hybrid keys for enhanced security.
Updated documentation to reflect the new post-quantum capabilities, including usage instructions and configuration examples.
Modified the Cargo.toml to include the new
age-xwingdependency for handling post-quantum keys.Enhanced tests to validate the functionality of post-quantum key decryption and ensure compatibility with existing recipient types.
This update aims to future-proof the encryption capabilities of the application against potential quantum threats.