Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement ChaCha20Poly1305 with CryptoKit on macOS #76317

Merged
merged 9 commits into from
Oct 1, 2022

Conversation

vcsjones
Copy link
Member

@vcsjones vcsjones commented Sep 28, 2022

This implements ChaCha20Poly1305 on macOS using CryptoKit instead of OpenSSL. Since .NET 7 raised the minimum target to macOS 10.15, we don't need to worry about the Swift runtime availability and can link against the system runtime, which makes this more feasible where before it was not.

This currently does not add support for Apple platforms that are not macOS (i.e. iOS, tvOS) as there are additional linker challenges there that need to be solved.

ChaCha20Poly1305 on macOS is the "easy" one as CryptoKit and OpenSSL have 1:1 functionality. AES-GCM will be done as a follow up, as that work is more complicated and will need to continue to fall back to OpenSSL for some circumstances. But this intends to set the foundation for working with CryptoKit.

Contributes to #52482

/cc @filipnavara

@ghost
Copy link

ghost commented Sep 28, 2022

Tagging subscribers to this area: @dotnet/area-system-security, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

This implements ChaCha20Poly1305 on macOS using CryptoKit instead of OpenSSL. Since .NET 7 raised the minimum target to macOS 10.15, we don't need to worry about the Swift runtime availability and can link against the system runtime, which makes this more feasible where before it was not.

This currently does not add support for Apple platforms that are not macOS (i.e. iOS, tvOS) as there are additional linker challenges there that need to be solved.

ChaCha20Poly1305 on macOS is the "easy" one as CryptoKit and OpenSSL have 1:1 functionality. AES-GCM will be done as a follow up, as that work is more complicated and will need to continue to fall back to OpenSSL for some circumstances.

This is currently blocked on #75160.

/cc @filipnavara

Author: vcsjones
Assignees: -
Labels:

area-System.Security

Milestone: -

@filipnavara
Copy link
Member

Thanks for reviving this!

@vcsjones vcsjones force-pushed the chacha20poly1305macos branch from 5be9b3f to 5f578ba Compare September 30, 2022 13:06
@vcsjones vcsjones marked this pull request as ready for review September 30, 2022 17:40
@vcsjones
Copy link
Member Author

It's green, so, I think this is ready for review.

@bartonjs
Copy link
Member

@akoeplinger You got volunteered to me as someone who might have opinions on the cmake portion of this change.

@akoeplinger
Copy link
Member

image

Copy link
Member

@akoeplinger akoeplinger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CMake parts look good to me.

@vcsjones vcsjones merged commit 72ac50c into dotnet:main Oct 1, 2022
@vcsjones vcsjones deleted the chacha20poly1305macos branch October 1, 2022 16:02
@vcsjones vcsjones added this to the 8.0.0 milestone Oct 9, 2022
@ghost ghost locked as resolved and limited conversation to collaborators Nov 9, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants