The series of mirage-crypto* releases

Ecosystem
,
1

Dear everyone,

it is my delight to release mirage-crypto* in version 2.4.1 ([new release] mirage-crypto (6 packages) (2.4.1) by hannesm · Pull Request #30568 · ocaml/opam-repository · GitHub). There have been a series of releases since late July with 2.2.0 (July 27th, 2.3.0 Aug 7th, 2.4.0 Aug 17th, 2.4.1 Aug 26th). The reasoning behind is that several people used LLM to find some issues in the implementation that we are fixing in the process. It is likely there’ll be more releases. We try to limit the releases we cut during each month (the goal is at most one release per month). Me as a maintainer of that package is as well at the edge of what I can do (time-wise – please consider donating at Robur - Open Source Software Cooperative or via GitHub spoinsors – in the case you use this piece of software). There won’t be backports of fixes. The only supported release is the latest one.

Even more appreciated would be if someone jumps in, reads code, reviews pull requests when they come in, contributes code cleanups (please don’t submit any LLM generated improvements directly, but do careful reviews of them). Especially since now everyone is on the red team.

The performance of mirage-crypto has decreased due to added checks, but only in a small margin as far as I can observe on hardware that I use. Feel free to conduct your own benchmarks (there is bench/speed.ml available), and propose improvements.

Now, the changes range between fixes and cleanups to has a published advisory. There’s not always a clear border. The full list can be found in the CHANGES file, or in the commit history. I encourage everyone to update to the latest release, and not use any previous release. As mentioned, some advisories are out, and for other fixes we think they may not need an advisory (although it may be that other implementations issues advisories for such fixes, so please be careful – you can as well submit PRs to ocaml/security-advisories if you think some specific fixes are important enough to get an advisory).

The fixes in more detail follow. Thanks to Eric Ebinger, Thomas Gazagnaire, and Anil Madhavapeddy for the reports. And to Tarides for make it possible that I spend some time on reviewing, merging, and releasing mirage-crypto.

mirage-crypto-ec

mirage-crypto

mirage-crypto-rng

mirage-crypto-pk

4 Likes