Outdated version of zeroize forced in aes-gcm-siv

[mervyn-mccreight]

Currently the version of zeroize is required to be < 1.4 which conflicts with the latest version of secrecy, which needs zeroice to be >= 1.4.

Is there a reason why zeroize is explicitly needed in that version, or can it be updated?

[tarcieri]

It's a hack to preserve the current MSRV.

I agree it's less than ideal. Unfortunately Rust does not provide other mechanisms to select MSRV-compatible packages yet.

[mervyn-mccreight]

Ah I see, thanks.
Is being compatible to Rust < 1.51 a strict requirement, or is it something that is open to change?

[tarcieri]

We should definitely bump MSRV soon. Now that the 2021 edition is out, it would probably be good to bump all of our crates.

One of the many things the 2021 edition helps with is having a rust-version crate attribute which helps sort out MSRV-related issues like this.

[newpavlov]

Is being compatible to Rust < 1.51 a strict requirement

It's not, but we consider bumping MSRV being a breaking change.

Regarding rust-version, I don't think that until rust-lang/cargo#9930 gets implemented we should change our MSRV policy.

[mervyn-mccreight]

Thanks for the detailed explanation :)

Are PRs to bump the version of zeroice plus increasing the defined MSRV welcome, or do you think that this may not be a good "first issue"?

[tarcieri]

For something like an edition bump, it'd be nice to do in a coordinated manner across crates/repos

[fjarri]

Since this issue is still open, how about bumping zeroize to 1.5 (so that it doesn't conflict with the new elliptic-curves, and, I assume, other RustCrypto crates as well)? (the crate I use from AEADs is chacha20poly1305, so hopefully this issue applies to it too)

[tarcieri]

@fjarri it's going to be a giant pain, since we need to do coordinated bumps of all of the dependencies, likely starting with cipher v0.4: RustCrypto/traits#849

Is Cargo not able to resolve the dependencies such that zeroize is 1.4?

[newpavlov]

cipher itself does not depend on zeroize, so I think we can simply bump MSRV for implementation crates during migration to cipher v0.4.

[tarcieri]

FYI: I've opened a tracking issue for zeroize version compatibility here: RustCrypto/utils#723

[tarcieri]

I've released aes-gcm-siv v0.11.0-pre with an unpinned zeroize, which should unblock people who are stuck on compatibility.

Please see #410 for additional upgrades needed for a final release.