diff --git a/agent-governance-rust/Cargo.lock b/agent-governance-rust/Cargo.lock index 33be82f13..d658631f0 100644 --- a/agent-governance-rust/Cargo.lock +++ b/agent-governance-rust/Cargo.lock @@ -57,7 +57,7 @@ dependencies = [ "serde", "serde_json", "serde_yaml", - "sha2", + "sha2 0.10.9", "tempfile", "thiserror", ] @@ -72,7 +72,7 @@ dependencies = [ "regex", "serde", "serde_json", - "sha2", + "sha2 0.10.9", "tempfile", "thiserror", ] @@ -202,12 +202,6 @@ version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" -[[package]] -name = "base64ct" -version = "1.8.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06" - [[package]] name = "bit-set" version = "0.8.0" @@ -374,6 +368,17 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" +[[package]] +name = "chacha20" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "rand_core", +] + [[package]] name = "chrono" version = "0.4.44" @@ -449,12 +454,6 @@ version = "1.0.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570" -[[package]] -name = "const-oid" -version = "0.9.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8" - [[package]] name = "core-foundation-sys" version = "0.8.7" @@ -501,9 +500,9 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453" dependencies = [ - "getrandom 0.4.2", + "getrandom", "hybrid-array", - "rand_core 0.10.1", + "rand_core", ] [[package]] @@ -526,15 +525,16 @@ dependencies = [ [[package]] name = "curve25519-dalek" -version = "4.1.3" +version = "5.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be" +checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23" dependencies = [ "cfg-if", - "cpufeatures 0.2.17", + "cpufeatures 0.3.0", "curve25519-dalek-derive", - "digest", + "digest 0.11.3", "fiat-crypto", + "rand_core", "rustc_version", "subtle", "zeroize", @@ -585,16 +585,6 @@ dependencies = [ "syn 2.0.117", ] -[[package]] -name = "der" -version = "0.7.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb" -dependencies = [ - "const-oid", - "zeroize", -] - [[package]] name = "deranged" version = "0.5.8" @@ -622,6 +612,16 @@ dependencies = [ "subtle", ] +[[package]] +name = "digest" +version = "0.11.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2" +dependencies = [ + "block-buffer 0.12.1", + "crypto-common 0.2.2", +] + [[package]] name = "dyn-clone" version = "1.0.20" @@ -630,25 +630,24 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555" [[package]] name = "ed25519" -version = "2.2.3" +version = "3.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53" +checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a" dependencies = [ - "pkcs8", "signature", ] [[package]] name = "ed25519-dalek" -version = "2.2.0" +version = "3.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9" +checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de" dependencies = [ "curve25519-dalek", "ed25519", - "rand_core 0.6.4", - "serde", - "sha2", + "rand_core", + "sha2 0.11.0", + "signature", "subtle", "zeroize", ] @@ -724,9 +723,9 @@ checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6" [[package]] name = "fiat-crypto" -version = "0.2.9" +version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d" +checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24" [[package]] name = "find-msvc-tools" @@ -783,17 +782,6 @@ dependencies = [ "version_check", ] -[[package]] -name = "getrandom" -version = "0.2.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0" -dependencies = [ - "cfg-if", - "libc", - "wasi", -] - [[package]] name = "getrandom" version = "0.4.2" @@ -803,7 +791,7 @@ dependencies = [ "cfg-if", "libc", "r-efi", - "rand_core 0.10.1", + "rand_core", "wasip2", "wasip3", ] @@ -856,7 +844,7 @@ version = "0.12.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e" dependencies = [ - "digest", + "digest 0.10.7", ] [[package]] @@ -1269,16 +1257,6 @@ version = "0.2.17" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd" -[[package]] -name = "pkcs8" -version = "0.10.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7" -dependencies = [ - "der", - "spki", -] - [[package]] name = "polyval" version = "0.7.3" @@ -1296,15 +1274,6 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" -[[package]] -name = "ppv-lite86" -version = "0.2.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9" -dependencies = [ - "zerocopy", -] - [[package]] name = "precomputed-hash" version = "0.1.1" @@ -1398,32 +1367,13 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" [[package]] name = "rand" -version = "0.8.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a" -dependencies = [ - "libc", - "rand_chacha", - "rand_core 0.6.4", -] - -[[package]] -name = "rand_chacha" -version = "0.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88" -dependencies = [ - "ppv-lite86", - "rand_core 0.6.4", -] - -[[package]] -name = "rand_core" -version = "0.6.4" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c" +checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" dependencies = [ - "getrandom 0.2.17", + "chacha20", + "getrandom", + "rand_core", ] [[package]] @@ -1689,7 +1639,18 @@ checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" dependencies = [ "cfg-if", "cpufeatures 0.2.17", - "digest", + "digest 0.10.7", +] + +[[package]] +name = "sha2" +version = "0.11.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "digest 0.11.3", ] [[package]] @@ -1698,7 +1659,7 @@ version = "0.10.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874" dependencies = [ - "digest", + "digest 0.10.7", "keccak", ] @@ -1710,11 +1671,11 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64" [[package]] name = "signature" -version = "2.2.0" +version = "3.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de" +checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5" dependencies = [ - "rand_core 0.6.4", + "rand_core", ] [[package]] @@ -1745,16 +1706,6 @@ version = "0.10.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591" -[[package]] -name = "spki" -version = "0.7.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d" -dependencies = [ - "base64ct", - "der", -] - [[package]] name = "stacker" version = "0.1.24" @@ -1821,7 +1772,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" dependencies = [ "fastrand", - "getrandom 0.4.2", + "getrandom", "once_cell", "rustix", "windows-sys", @@ -2016,12 +1967,6 @@ dependencies = [ "winapi-util", ] -[[package]] -name = "wasi" -version = "0.11.1+wasi-snapshot-preview1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" - [[package]] name = "wasip2" version = "1.0.2+wasi-0.2.9" @@ -2284,26 +2229,6 @@ dependencies = [ "wasmparser", ] -[[package]] -name = "zerocopy" -version = "0.8.48" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9" -dependencies = [ - "zerocopy-derive", -] - -[[package]] -name = "zerocopy-derive" -version = "0.8.48" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.117", -] - [[package]] name = "zeroize" version = "1.8.2" diff --git a/agent-governance-rust/Cargo.toml b/agent-governance-rust/Cargo.toml index 7d8ff7358..0de5b60d6 100644 --- a/agent-governance-rust/Cargo.toml +++ b/agent-governance-rust/Cargo.toml @@ -17,10 +17,10 @@ base64 = "=0.22.1" cedar-policy = "=4.11.2" clap = { version = "=4.6.3", features = ["derive"] } predicates = "=3.1.4" -ed25519-dalek = { version = "=2.2.0", features = ["rand_core"] } +ed25519-dalek = { version = "=3.0.0", features = ["rand_core"] } hmac = "=0.12.1" opentelemetry = { version = "=0.32.0", default-features = false, features = ["trace"] } -rand = "=0.8.6" +rand = "=0.10.2" regex = "=1.13.1" regorus = { version = "=0.10.1", default-features = false, features = ["regex"] } serde = { version = "=1.0.229", features = ["derive"] } diff --git a/agent-governance-rust/agentmesh-mcp/src/mcp/clock.rs b/agent-governance-rust/agentmesh-mcp/src/mcp/clock.rs index 57d3d05d7..20747259e 100644 --- a/agent-governance-rust/agentmesh-mcp/src/mcp/clock.rs +++ b/agent-governance-rust/agentmesh-mcp/src/mcp/clock.rs @@ -4,7 +4,7 @@ //! Clock and nonce seams for deterministic security testing. use crate::mcp::error::McpError; -use rand::{distributions::Alphanumeric, Rng}; +use rand::distr::{Alphanumeric, SampleString}; use std::collections::VecDeque; use std::sync::Mutex; use std::time::{Duration, SystemTime}; @@ -71,11 +71,7 @@ pub struct SystemNonceGenerator; impl NonceGenerator for SystemNonceGenerator { fn generate(&self) -> Result { - let nonce = rand::thread_rng() - .sample_iter(&Alphanumeric) - .take(32) - .map(char::from) - .collect(); + let nonce = Alphanumeric.sample_string(&mut rand::rng(), 32); Ok(nonce) } } @@ -125,4 +121,11 @@ mod tests { assert_eq!(generator.generate().unwrap(), "a"); assert_eq!(generator.generate().unwrap(), "b"); } + + #[test] + fn system_nonce_generator_produces_expected_format() { + let nonce = SystemNonceGenerator.generate().unwrap(); + assert_eq!(nonce.len(), 32); + assert!(nonce.bytes().all(|byte| byte.is_ascii_alphanumeric())); + } } diff --git a/agent-governance-rust/agentmesh/src/credential_vault.rs b/agent-governance-rust/agentmesh/src/credential_vault.rs index a54f1fb07..e5dd4d5ff 100644 --- a/agent-governance-rust/agentmesh/src/credential_vault.rs +++ b/agent-governance-rust/agentmesh/src/credential_vault.rs @@ -23,7 +23,7 @@ use std::time::{SystemTime, UNIX_EPOCH}; use aes_gcm::aead::{Aead, KeyInit}; use aes_gcm::{Aes256Gcm, Key, Nonce}; use hmac::{Hmac, Mac}; -use rand::RngCore; +use rand::Rng; use regex::Regex; use serde::{Deserialize, Serialize}; use sha2::Sha256; @@ -280,7 +280,7 @@ impl CredentialVault { #[must_use] pub fn generate_key() -> [u8; KEY_LENGTH] { let mut k = [0u8; KEY_LENGTH]; - rand::thread_rng().fill_bytes(&mut k); + rand::rng().fill_bytes(&mut k); k } @@ -546,7 +546,7 @@ impl Default for CredentialVault { fn encrypt(key: &[u8; KEY_LENGTH], plaintext: &[u8]) -> Result, CredentialError> { let cipher = Aes256Gcm::new(Key::::from_slice(key)); let mut nonce_bytes = [0u8; NONCE_LENGTH]; - rand::thread_rng().fill_bytes(&mut nonce_bytes); + rand::rng().fill_bytes(&mut nonce_bytes); let nonce = Nonce::from_slice(&nonce_bytes); let ct = cipher .encrypt(nonce, plaintext) diff --git a/agent-governance-rust/agentmesh/src/identity.rs b/agent-governance-rust/agentmesh/src/identity.rs index ca82fe3b9..ad61a3ed1 100644 --- a/agent-governance-rust/agentmesh/src/identity.rs +++ b/agent-governance-rust/agentmesh/src/identity.rs @@ -4,7 +4,7 @@ //! Ed25519-based agent identity with DID support. use ed25519_dalek::{Signer, SigningKey, Verifier, VerifyingKey}; -use rand::rngs::OsRng; +use rand::{rand_core::UnwrapErr, rngs::SysRng}; use serde::{Deserialize, Serialize}; /// Maximum delegation depth to prevent Sybil attacks via infinite chains. @@ -29,7 +29,7 @@ pub struct AgentIdentity { impl AgentIdentity { /// Generate a new Ed25519-based identity for the given agent. pub fn generate(agent_id: &str, capabilities: Vec) -> Result { - let signing_key = SigningKey::generate(&mut OsRng); + let signing_key = SigningKey::generate(&mut UnwrapErr(SysRng)); let public_key = signing_key.verifying_key(); Ok(Self { did: format!("did:agentmesh:{}", agent_id), @@ -77,7 +77,7 @@ impl AgentIdentity { } } - let signing_key = SigningKey::generate(&mut OsRng); + let signing_key = SigningKey::generate(&mut UnwrapErr(SysRng)); let public_key = signing_key.verifying_key(); Ok(Self { diff --git a/agent-governance-rust/agentmesh/src/identity_support.rs b/agent-governance-rust/agentmesh/src/identity_support.rs index 7e1bb7199..a95048f5a 100644 --- a/agent-governance-rust/agentmesh/src/identity_support.rs +++ b/agent-governance-rust/agentmesh/src/identity_support.rs @@ -7,7 +7,7 @@ use crate::identity::{AgentIdentity, IdentityError, PublicIdentity, MAX_DELEGATI use base64::engine::general_purpose::URL_SAFE_NO_PAD; use base64::Engine; use ed25519_dalek::SigningKey; -use rand::rngs::OsRng; +use rand::{rand_core::UnwrapErr, rngs::SysRng}; use serde::{Deserialize, Serialize}; use serde_json::{Map, Value}; use sha2::{Digest, Sha256}; @@ -170,7 +170,7 @@ impl Credential { // effectively never" — semantically the same as what the caller // appears to have asked for — without invoking arithmetic UB. let expires_at_secs = issued_at_secs.saturating_add(ttl_seconds.max(1)); - let signing_key = SigningKey::generate(&mut OsRng); + let signing_key = SigningKey::generate(&mut UnwrapErr(SysRng)); let token = URL_SAFE_NO_PAD.encode(signing_key.to_bytes()); Self { credential_id: format!("cred_{:016x}", rand::random::()), @@ -1052,7 +1052,7 @@ impl KeyRotationManager { previous_public_key: identity.public_key.to_bytes().to_vec(), rotated_at_secs: unix_secs_now(), }); - let signing_key = SigningKey::generate(&mut OsRng); + let signing_key = SigningKey::generate(&mut UnwrapErr(SysRng)); let public_key = signing_key.verifying_key(); AgentIdentity { did: identity.did.clone(),