-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Implement ChaCha20Poly1305 with CryptoKit on macOS #76317
Conversation
Tagging subscribers to this area: @dotnet/area-system-security, @vcsjones Issue DetailsThis implements ChaCha20Poly1305 on macOS using CryptoKit instead of OpenSSL. Since .NET 7 raised the minimum target to macOS 10.15, we don't need to worry about the Swift runtime availability and can link against the system runtime, which makes this more feasible where before it was not. This currently does not add support for Apple platforms that are not macOS (i.e. iOS, tvOS) as there are additional linker challenges there that need to be solved. ChaCha20Poly1305 on macOS is the "easy" one as CryptoKit and OpenSSL have 1:1 functionality. AES-GCM will be done as a follow up, as that work is more complicated and will need to continue to fall back to OpenSSL for some circumstances. This is currently blocked on #75160. /cc @filipnavara
|
src/native/libs/System.Security.Cryptography.Native.Apple/CMakeLists.txt
Show resolved
Hide resolved
src/native/libs/System.Security.Cryptography.Native.Apple/pal_aead.swift
Outdated
Show resolved
Hide resolved
src/native/libs/System.Security.Cryptography.Native.Apple/CMakeLists.txt
Outdated
Show resolved
Hide resolved
Thanks for reviving this! |
Co-authored-by: Filip Navara <filip.navara@gmail.com>
Co-authored-by: Filip Navara <filip.navara@gmail.com>
5be9b3f
to
5f578ba
Compare
It's green, so, I think this is ready for review. |
@akoeplinger You got volunteered to me as someone who might have opinions on the cmake portion of this change. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
CMake parts look good to me.
This implements ChaCha20Poly1305 on macOS using CryptoKit instead of OpenSSL. Since .NET 7 raised the minimum target to macOS 10.15, we don't need to worry about the Swift runtime availability and can link against the system runtime, which makes this more feasible where before it was not.
This currently does not add support for Apple platforms that are not macOS (i.e. iOS, tvOS) as there are additional linker challenges there that need to be solved.
ChaCha20Poly1305 on macOS is the "easy" one as CryptoKit and OpenSSL have 1:1 functionality. AES-GCM will be done as a follow up, as that work is more complicated and will need to continue to fall back to OpenSSL for some circumstances. But this intends to set the foundation for working with CryptoKit.
Contributes to #52482
/cc @filipnavara