update all crypto dependencies

Cargo.toml

@@ -60,14 +60,13 @@ bigdecimal = { version = "0.4.8", features = ["serde-json"] }
 include_dir = "0.7.2"
 config = { version = "0.15.4", features = ["json"] }
 markdown = { version = "1.0.0-alpha.23", features = ["log"] }
-password-hash = "0.5.0"
-argon2 = "0.5.3"
+argon2 = { version = "0.6.0-rc.8", features = ["rand_core"] }
 actix-web-httpauth = "0.8.0"
 rand = "0.10.0"
 actix-multipart = "0.7.2"
 base64 = "0.22"
-hmac = "0.12"
-sha2 = "0.10"
+hmac = "0.13"
+sha2 = "0.11"
 rustls-acme = "0.15"
 dotenvy = "0.15.7"
 csv-async = { version = "1.2.6", features = ["tokio"] }

src/render.rs

@@ -432,12 +432,13 @@ impl HeaderContext {
 async fn verify_password_async(
     password_hash: String,
     password: String,
-) -> Result<Result<(), password_hash::Error>, anyhow::Error> {
+) -> Result<Result<(), argon2::password_hash::Error>, anyhow::Error> {
     tokio::task::spawn_blocking(move || {
-        let hash = password_hash::PasswordHash::new(&password_hash)
+        use argon2::{PasswordHash, PasswordVerifier};
+
+        let hash = PasswordHash::new(&password_hash)
             .map_err(|e| anyhow::anyhow!("invalid value for the password_hash property: {e}"))?;
-        let phfs = &[&argon2::Argon2::default() as &dyn password_hash::PasswordVerifier];
-        Ok(hash.verify_password(phfs, password))
+        Ok(argon2::Argon2::default().verify_password(password.as_bytes(), &hash))
     })
     .await?
 }

src/webserver/database/sqlpage_functions/functions.rs

@@ -432,10 +432,12 @@ pub(crate) async fn hash_password(password: Option<String>) -> anyhow::Result<Op
         return Ok(None);
     };
     actix_web::rt::task::spawn_blocking(move || {
+        use argon2::PasswordHasher;
+
         // Hashes a password using Argon2. This is a CPU-intensive blocking operation.
         let phf = argon2::Argon2::default();
-        let salt = password_hash::SaltString::generate(&mut password_hash::rand_core::OsRng);
-        let password_hash = &password_hash::PasswordHash::generate(phf, password, &salt)
+        let password_hash = phf
+            .hash_password(password.as_bytes())
             .map_err(|e| anyhow!("Unable to hash password: {e}"))?;
         Ok(password_hash.to_string())
     })
@@ -902,7 +904,7 @@ async fn hmac<'a>(
     key: Cow<'a, str>,
     algorithm: Option<Cow<'a, str>>,
 ) -> anyhow::Result<Option<String>> {
-    use hmac::{Hmac, Mac};
+    use hmac::{Hmac, KeyInit, Mac};
     use sha2::{Sha256, Sha512};
 
     let algorithm = algorithm.as_deref().unwrap_or("sha256");
@@ -936,10 +938,13 @@ async fn hmac<'a>(
 
     // Convert to requested output format
     let output = match output_format.to_lowercase().as_str() {
-        "hex" => result.into_iter().fold(String::new(), |mut acc, byte| {
-            write!(&mut acc, "{byte:02x}").unwrap();
+        "hex" => {
+            let mut acc = String::with_capacity(result.len() * 2);
+            for byte in result {
+                write!(&mut acc, "{byte:02x}").unwrap();
+            }
             acc
-        }),
+        }
         "base64" => base64::Engine::encode(&base64::engine::general_purpose::STANDARD, result),
         _ => {
             anyhow::bail!(

src/webserver/oidc.rs

@@ -620,7 +620,7 @@ fn process_oidc_logout(
 
 fn compute_logout_signature(redirect_uri: &str, timestamp: i64, client_secret: &str) -> String {
     use base64::Engine;
-    use hmac::{Hmac, Mac};
+    use hmac::{Hmac, KeyInit, Mac};
     use sha2::Sha256;
 
     let mut mac = Hmac::<Sha256>::new_from_slice(client_secret.as_bytes())
@@ -1046,13 +1046,12 @@ fn build_auth_url(oidc_state: &OidcState) -> AuthUrl {
 }
 
 fn hash_nonce(nonce: &Nonce) -> String {
-    use argon2::password_hash::{rand_core::OsRng, PasswordHasher, SaltString};
-    let salt = SaltString::generate(&mut OsRng);
+    use argon2::PasswordHasher;
     // low-cost parameters: oidc tokens are short-lived and the source nonce is high-entropy
     let params = argon2::Params::new(8, 1, 1, Some(16)).expect("bug: invalid Argon2 parameters");
     let argon2 = argon2::Argon2::new(argon2::Algorithm::Argon2id, argon2::Version::V0x13, params);
     let hash = argon2
-        .hash_password(nonce.secret().as_bytes(), &salt)
+        .hash_password(nonce.secret().as_bytes())
         .expect("bug: failed to hash nonce");
     hash.to_string()
 }
@@ -1070,13 +1069,13 @@ fn nonce_matches(id_token_nonce: &Nonce, state_nonce: &Nonce) -> Result<(), Stri
         id_token_nonce.secret(),
         state_nonce.secret()
     );
-    let hash = argon2::password_hash::PasswordHash::new(id_token_nonce.secret()).map_err(|e| {
+    let hash = argon2::PasswordHash::new(id_token_nonce.secret()).map_err(|e| {
         format!(
             "Failed to parse state nonce ({}): {e}",
             id_token_nonce.secret()
         )
     })?;
-    argon2::password_hash::PasswordVerifier::verify_password(
+    argon2::PasswordVerifier::verify_password(
         &argon2::Argon2::default(),
         state_nonce.secret().as_bytes(),
         &hash,

tests/oidc/mod.rs

@@ -20,7 +20,7 @@ fn base64url_encode(data: &[u8]) -> String {
 }
 
 pub fn make_jwt(claims: &serde_json::Value, secret: &str) -> String {
-    use hmac::{Hmac, Mac};
+    use hmac::{Hmac, KeyInit, Mac};
     use sha2::Sha256;
 
     let header = json!({