Repository navigation
rsa v0.10 release tracking #647
Description
Hello, My project is currently forced to use the latest rsa-rc version due to the fact rsa 0.9 still uses rand 0.8 which is pretty much broken on newer rust version due to the addition of the "gen" keyword, Using the release candidate of RSA becomes a problem when users try to use our crate and Cargo fetches a newer RC version then our crate is currently at, resulting in compile errors. I'm sick of constantly having to update the RC and just wish there would be finally an official release.
Reacted by Rene Leonhardt, yunuservices and Sebastian Bernauer
Activity
tarcieri commentedon Jan 26, 2026
We're currently waiting on the release of
rand_corev0.10, which I hope will be soon (and I hope you can appreciate why we wouldn't want to ship onrand_corev0.9 ifrand_corev0.10 is imminent), and then we'll start releasing the lower-level crates in our stack, which you can track here: RustCrypto/traits#1571It would still also be good to address this before a release: #626
[-]When 0.10 will release[/-][+]`rsa` v0.10 release tracking[/+]Snowiiii commentedon Feb 1, 2026
@tarcieri rand_core 0.10 just released
psalaberria002 commentedon May 21, 2026
Any progress on this one?
konstin commentedon Jun 23, 2026
A stable release would be interesting for us to remove dependency duplication, the 0.10 prerelease has (transitive) dependency bumps that we require to update.
tarcieri commentedon Jun 23, 2026
It's next on my TODO list after elliptic curves and AEADs, which I'm currently wrapping up
Pgarrett commentedon Jul 13, 2026
Hi @tarcieri any update on the release? Thanks!
tarcieri commentedon Jul 13, 2026
It’s one of the next things I plan to work on, but unfortunately still needs a fairly significant amount of work
docs(security): the RSA/Marvin ignore now says exactly which path is …
dishmaker commentedon Aug 29, 2026
TODO:
Snowiiii commentedon Aug 29, 2026
Whatever it takes at this point, just please give us 0.10 :crying:
tarcieri commentedon Oct 2, 2026
I created #711 as a tracking issue for all of the remaining constant-time problems I was able to identify based on draft-irtf-cfrg-rsa-guidance.
I don't think we need to address all of these prior to a v0.10.0 release, but it would at least be good to address the ones that require API changes and definitely get #626 addressed.
tarcieri commentedon Nov 4, 2026
FYI, I just released v0.10.0-rc.20 (#768) which includes a significant number of constant-time fixes including infallible PKCS#1v1.5 depadding with implicit rejection.
I would like to complete all the items in #711 first, just in case any breaking changes are required, and there are a few other small showstopper items, and then I can release a final v0.10.0.
tarcieri commentedon Nov 5, 2026
#711 is now complete AFAICT, and I've released v0.10.0-rc.21 with the constant-time fixes I've completed since the v0.10.0-rc.20 release.
I would like to try to figure out
marvin-toolkit/and try to use it to validate that the sidechannels are closed. Or if anyone else can take a look at it, that would be swell.After that, I can (finally) cut a final v0.10.0 release.
pinkforest commentedon Nov 6, 2026
Given the pub is not breaking anymore I would be keen on 0.10 despite anything given it is better position for anyone to be on 0.10 over 0.9 and deal with the breakage earlier than sooner.
Re: #776 (comment)
That will put majority of the users in better position regardless and 0.10.1 if any will be implicit update upon any build process if / when there are any side channels left.
As to limit default-on surface area I would recommend smuggling this through though for release:
feature=pkcs1v15#778tarcieri commentedon Nov 7, 2026
I've released
v0.10.0-rc.22(#785), which migrates toTryRngCore(#779) and feature-gates PKCS#1 v1.5 support with thepkcs1v15to help improve discovery of its insecurity as an algorithm and deprecated status.This should hopefully be a true final "release candidate" in that I intend to ship v0.10.0 after this with only e.g. improved test coverage and perhaps some performance improvements as the changes. Please let me know if you encounter any release-blocking issues.
pinkforest commentedon Nov 7, 2026
Added changelog:
tarcieri commentedon Nov 8, 2026
Release PR: #790
tarcieri commentedon Nov 8, 2026
rsav0.10.0 is released 🎉https://crates.io/crates/rsa/0.10.0