go x/crypto:冻结并弃用更多软件包

f4t66c6m 于 6个月前发布在 Go

关注(0)|答案(5)|浏览(44)

Over the years we did some significant cleanups of x/crypto packages ( #30141 , #31044 , #36646 , #44226 ).
I propose we do one last round, marking as Deprecated

golang.org/x/crypto/salsa20/salsa: should have been an internal package, exposes low-level components of Salsa20, it has 662 importers, but that number is deceptive: all the ones I sampled are golang.org/x/crypto forks, or a shadowsocks implementation that should have used salsa20.XORKeyStream instead
golang.org/x/crypto/ssh/test: should also have been internal, or really a _test.go file, it exposes some test keys, zero importers

and marking as Frozen

golang.org/x/crypto/curve25519 and golang.org/x/crypto/ed25519: wrappers for crypto/ecdh and crypto/ed25519 respectively
golang.org/x/crypto/nacl/auth and golang.org/x/crypto/nacl/sign: mostly unused NaCl APIs (21 and 73 importers), they are essentially wrappers around crypto/hmac and crypto/ed25519 respectively
golang.org/x/crypto/otr: implements a deprecated version of OTR, basically unused (15 importers)
golang.org/x/crypto/xts: implements a mode that should be only used for disk encryption and under duress, increasingly replaced by filesystem-level encryption, basically unused (10 importers)

This leaves a pretty healthy list of non-Deprecated non-Frozen packages, which would be suitable for moving into the stdlib (ignoring x509roots for a moment since it's a special snowflake).

golang.org/x/crypto/acme
golang.org/x/crypto/acme/autocert
golang.org/x/crypto/argon2
golang.org/x/crypto/bcrypt
golang.org/x/crypto/blake2b
golang.org/x/crypto/blake2s
golang.org/x/crypto/chacha20
golang.org/x/crypto/chacha20poly1305
golang.org/x/crypto/cryptobyte
golang.org/x/crypto/cryptobyte/asn1
golang.org/x/crypto/hkdf
golang.org/x/crypto/internal/wycheproof
golang.org/x/crypto/nacl/box
golang.org/x/crypto/nacl/secretbox
golang.org/x/crypto/ocsp
golang.org/x/crypto/pbkdf2
golang.org/x/crypto/salsa20
golang.org/x/crypto/scrypt
golang.org/x/crypto/sha3
golang.org/x/crypto/ssh
golang.org/x/crypto/ssh/agent
golang.org/x/crypto/ssh/knownhosts

/cc @golang/security

Packages summary

Package	Imported by	Current state	Proposed state
acme	496
acme/autocert	2161
argon2	1037
bcrypt	15602
blake2b	2500
blake2s	255
blowfish	881	Deprecated	Deprecated
bn256	20	Deprecated	Deprecated
cast5	501	Deprecated	Deprecated
chacha20	258
chacha20poly1305	2399
cryptobyte	647
cryptobyte/asn1	377
curve25519	1916	Wrapper	Frozen
ed25519	2142	Wrapper	Frozen
hkdf	2208
internal/wycheproof	-	Internal	Internal
md4	764	Deprecated	Deprecated
nacl/auth	21		Frozen
nacl/box	1041
nacl/secretbox	1934
nacl/sign	73		Frozen
ocsp	926
openpgp/...	1897	Deprecated	Deprecated
otr	15	Notice	Frozen
pbkdf2	5239
pkcs12	832	Frozen	Frozen
poly1305	504	Deprecated	Deprecated
ripemd160	3531	Deprecated	Deprecated
salsa20	283
salsa20/salsa	662		Deprecated
scrypt	2381
sha3	10791
ssh	14420
ssh/agent	2236
ssh/knownhosts	590
ssh/terminal	8278	Deprecated	Deprecated
ssh/test	0		Deprecated
tea	188	Deprecated	Deprecated
twofish	266	Deprecated	Deprecated
x509roots/nss	0
x509roots/fallback	11	Submodule	Submodule
xtea	219	Deprecated	Deprecated
xts	10	Notice	Frozen

来源：https://github.com/golang/go/issues/65250

5条答案

按热度按时间

lztngnrs1#

此建议已添加到建议项目中的活动列，并将在每周的建议审查会议上进行审查。
— rsc 建议审查组

赞(0）回复(0）举报 6个月前

oxalkeyp2#

Have all remaining concerns about this proposal been addressed?
Mark as Deprecated :

golang.org/x/crypto/salsa20/salsa: should have been an internal package, exposes low-level components of Salsa20, it has 662 importers, but that number is deceptive: all the ones I sampled are golang.org/x/crypto forks, or a shadowsocks implementation that should have used salsa20.XORKeyStream instead
golang.org/x/crypto/ssh/test: should also have been internal, or really a _test.go file, it exposes some test keys, zero importers

Mark as Frozen :

golang.org/x/crypto/curve25519 and golang.org/x/crypto/ed25519: wrappers for crypto/ecdh and crypto/ed25519 respectively
golang.org/x/crypto/nacl/auth and golang.org/x/crypto/nacl/sign: mostly unused NaCl APIs (21 and 73 importers), they are essentially wrappers around crypto/hmac and crypto/ed25519 respectively
golang.org/x/crypto/otr: implements a deprecated version of OTR, basically unused (15 importers)
golang.org/x/crypto/xts: implements a mode that should be only used for disk encryption and under duress, increasingly replaced by filesystem-level encryption, basically unused (10 importers)

赞(0）回复(0）举报 6个月前

axr492tv3#

Based on the discussion above, this proposal seems like a likely accept.
— rsc for the proposal review group
Mark as Deprecated :

golang.org/x/crypto/salsa20/salsa: should have been an internal package, exposes low-level components of Salsa20, it has 662 importers, but that number is deceptive: all the ones I sampled are golang.org/x/crypto forks, or a shadowsocks implementation that should have used salsa20.XORKeyStream instead
golang.org/x/crypto/ssh/test: should also have been internal, or really a _test.go file, it exposes some test keys, zero importers

Mark as Frozen :

golang.org/x/crypto/curve25519 and golang.org/x/crypto/ed25519: wrappers for crypto/ecdh and crypto/ed25519 respectively
golang.org/x/crypto/nacl/auth and golang.org/x/crypto/nacl/sign: mostly unused NaCl APIs (21 and 73 importers), they are essentially wrappers around crypto/hmac and crypto/ed25519 respectively
golang.org/x/crypto/otr: implements a deprecated version of OTR, basically unused (15 importers)
golang.org/x/crypto/xts: implements a mode that should be only used for disk encryption and under duress, increasingly replaced by filesystem-level encryption, basically unused (10 importers)

赞(0）回复(0）举报 6个月前

yfwxisqw4#

No change in consensus, so accepted. 🎉
This issue now tracks the work of implementing the proposal.
— rsc for the proposal review group
Mark as Deprecated :

golang.org/x/crypto/salsa20/salsa: should have been an internal package, exposes low-level components of Salsa20, it has 662 importers, but that number is deceptive: all the ones I sampled are golang.org/x/crypto forks, or a shadowsocks implementation that should have used salsa20.XORKeyStream instead
golang.org/x/crypto/ssh/test: should also have been internal, or really a _test.go file, it exposes some test keys, zero importers

Mark as Frozen :

golang.org/x/crypto/curve25519 and golang.org/x/crypto/ed25519: wrappers for crypto/ecdh and crypto/ed25519 respectively
golang.org/x/crypto/nacl/auth and golang.org/x/crypto/nacl/sign: mostly unused NaCl APIs (21 and 73 importers), they are essentially wrappers around crypto/hmac and crypto/ed25519 respectively
golang.org/x/crypto/otr: implements a deprecated version of OTR, basically unused (15 importers)
golang.org/x/crypto/xts: implements a mode that should be only used for disk encryption and under duress, increasingly replaced by filesystem-level encryption, basically unused (10 importers)