3 ms·
A combination of clippy [1] and cargo-audit [2] covers several of these issues, though not all (I'm not aware of a tool to check for uses of bad ciphers in Rust
by pcwalton 5y ago
A combination of clippy [1] and cargo-audit [2] covers several of these issues, though not all (I'm not aware of a tool to check for uses of bad ciphers in Rust for example).
[1]: https://github.com/rust-lang/rust-clippy https://github.com/rust-lang/rust-clippy
[2]: https://github.com/rustsec/rustsec https://github.com/rustsec/rustsec
- tialaramex 5y agoA reasonable strategy for the ciphers would be to avoid implementing non-recommended ciphers altogether. IIRC Go doesn't even provide some of the "obvious" ciphers modes at all in their standard library, because you shouldn't use them. When you're doing exercises as a student this is momentarily annoying - why can't I have this textbook mode? But no production code should use this, so, implementing it just tempts fate and I endorse their approach. I notice that rustls for example does not implement DES. So, while a Go program that wants to do DES TLS should get flagged by this tool, a Rust program that wants do DES TLS has to go find a less popular TLS library, which ought to serve as a reminder that this is a bad idea. Of course the flip side of this coin is that sure enough there's a Rust crate that just implements DES. If you really want to do DES even in Go this lint tool can't prevent you from renaming it BobsNiceCipher and using it anyway... at some level you need engineering teams who'll say "No".