RUSTSEC-2021-0137: sodiumoxide is deprecated

[github-actions[bot]]

sodiumoxide is deprecated

Details
Status	unmaintained
Package	sodiumoxide
Version	0.2.7
URL	https://github.com/sodiumoxide/sodiumoxide/commit/5bb1dfd2578539b89ffb0cbea25f21f00cfb963e
Date	2021-10-22

Alternatives may be found - not in any specific order:

• libsodium-sys-stable
• dryoc
• RustCrypto/nacl-compat (crypto_box, crypto_kx, crypto_secretstream)
• RustCrypto/xsalsa20poly1305 (crypto_secretbox)
• Signatory
• ed25519-compact
• ed25519-dalek
• ring

Recommendations can be also found from:

• Awesome Rust Cryptography

No direct maintained fork exists.

See advisory page for additional details.

[AbhijithGanesh]

@thomaseizinger , this issue with regards to cryptography isn't major and using ed25519 for edwards key will be a good replacement if any such cryptographic methods are used!

[thomaseizinger]

@thomaseizinger , this issue with regards to cryptography isn't major and using ed25519 for edwards key will be a good replacement if any such cryptographic methods are used!

I don't think we can just replace this that easily. The noise transport follows a specification (see https://github.com/libp2p/specs).

[AbhijithGanesh]

Let me review this and amend my PR, I wasn't aware of noise specification.

[mxinden]

@pinkforest do you have opinions on which alternative to use?

[pinkforest]

:) @thomaseizinger and @mxinden you owe me a :tropical_drink: for this .. :ship: PR #2817

You could just continue with sodiumoxide as it's only in testing purposes...

But yeah there are always big concerns what happens with unmaintained stuff

I've sent a PR to use ed25519-compact and libsodium-sys-stable that is the maintained version of libsodium-sys

All are maintained by Frank @jedisct1 who also maintains the libsodium C-library and ed25519-compact

• https://github.com/jedisct1/libsodium - C-Library
• https://github.com/jedisct1/libsodium-sys-stable - Stable current maintained :crab: sys crate
• https://github.com/jedisct1/rust-ed25519-compact

Thanks Frank !

[AbhijithGanesh]

@pinkforest Does that make my PR redundant ? Should I close it?