Typestatification #128
Merged
Typestatification #128
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is impeding the upcoming typestate-ification. When it is re-introduced later at a higher level, files removed in this commit can be reused as starting points.
This is a rather minimal version in that the API is only altered as necessary -- setting c_r is not deferred yet. Note that this already not only reduces the size of the Done initiator, but also frees it from lifetime constraints (because at that point it doesn't need to know the setup details any more).
|
Thanks for this PR! I went through and it looks good to me. |
chrysn
force-pushed
the
typestatify
branch
2 times, most recently
from
a6534ad to
3b833f4
Compare
Merged
|
Same comment as here, just waiting for a hax build. |
|
Same as this comment, no issues with |
|
@malishav I am ok with merging this. Do you wish to provide any input? |
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
(Please ignore the "Move crypto operations" commit, this is just based on #127).
In the high level API (edhoc.rs is left for later, turned out to work easily that way), passing the initiator by &mut is replaced by passing it by value, and receiving a new object with different APIs in return. This ensures at build time that functions are only called when suitable -- previously this would have the low-level implementation's checks at runtime. As a side effect, the Copy+Clone derives (that could easily be used to break EDHOC's security) could be removed, obsoleting #114 bit by bit.
This picks up discussion from around #99 (comment).
In order to make this practical, the C API is removed; it may later be reintroduced using higher level abstractions.
Current state: So far this only alters the initiator, not the responder. It also doesn't change API too much. Seeing whether this breaks anything that I did not test; next steps (maybe right in this PR) is typestating the responder.