Fix CI: rustfmt, clippy and cargo-deny

Cargo.toml

@@ -75,7 +75,7 @@ anyhow = "1"
 bincode = "1"
 chacha20poly1305 = "0.10"
 criterion = "0.8"
-cryptoki = "0.9"
+cryptoki = "0.12.1"
 elliptic-curve = { version = "0.13", features = ["alloc", "pkcs8"] }
 hex = "0.4"
 opaque-ke-3 = { package = "opaque-ke", version = "=3.0.0" }

deny.toml

@@ -46,6 +46,10 @@ ignore = [
   "RUSTSEC-2024-0436",
   # bincode is unmaintained but only used as dev-dependency for tests
   "RUSTSEC-2025-0141",
+  # TODO: remove once opaque-ke and voprf move to elliptic-curve 0.14.
+  # crypto-bigint 0.5 (via elliptic-curve 0.13) has timing variability in
+  # operations intended to be constant-time; there is no patched 0.5.x
+  "RUSTSEC-2026-0387",
 ]
 # Threshold for security vulnerabilities, any vulnerability with a CVSS score
 # lower than the range specified will be ignored. Note that ignored advisories

examples/digital_locker.rs

@@ -201,7 +201,8 @@ fn open_locker(
         )
         .unwrap();
 
-    // Server sends locker contents, encrypted under the session key, to the client
+    // Server sends locker contents, encrypted under the session key, to the
+    // client
     let encrypted_locker_contents =
         encrypt(&server_login_finish_result.session_key, &locker.contents);
 

examples/simple_login.rs

@@ -198,12 +198,14 @@ fn main() {
                             {
                                 println!("\nLogin success!");
                             } else {
-                                // Note that at this point, the client knows whether or not the
-                                // login succeeded. In this example, we simply rely on
-                                // client-reported result of login, but in a real client-server
-                                // implementation, the server may not know the outcome of login yet,
-                                // and extra care must be taken to ensure that the server can learn
-                                // the outcome as well.
+                                // Note that at this point, the client knows
+                                // whether or not the login succeeded. In this
+                                // example, we simply rely on client-reported
+                                // result of login, but in a real client-server
+                                // implementation, the server may not know the
+                                // outcome of login yet, and extra care must be
+                                // taken to ensure that the server can learn the
+                                // outcome as well.
                                 println!("\nIncorrect password, please try again.");
                             }
                         }

src/envelope.rs

@@ -245,7 +245,8 @@ impl<CS: CipherSuite> Envelope<CS> {
         Ok(OpenedInnerEnvelope { export_key })
     }
 
-    // Creates a dummy envelope object that serializes to the all-zeros byte string
+    // Creates a dummy envelope object that serializes to the all-zeros byte
+    // string
     pub(crate) fn dummy() -> Self {
         Self {
             mode: InnerEnvelopeMode::Zero,

src/key_exchange/group/elliptic_curve.rs

@@ -34,9 +34,9 @@ where
             Repr = GenericArray<u8, <FieldBytesSize<Self> as ModulusSize>::CompressedPointSize>,
         > + ToEncodedPoint<Self>,
 {
-    // We don't use `elliptic_curve::PublicKey` because it stores its internals in a
-    // format ideal for serialization and not computation. This is inconsistent with
-    // our other implementations.
+    // We don't use `elliptic_curve::PublicKey` because it stores its internals
+    // in a format ideal for serialization and not computation. This is
+    // inconsistent with our other implementations.
     type Pk = NonIdentity<Self>;
 
     type PkLen = <FieldBytesSize<Self> as ModulusSize>::CompressedPointSize;

src/key_exchange/sigma_i/ecdsa.rs

@@ -52,8 +52,8 @@ where
     type SignatureLen = SignatureSize<G>;
     type VerifyState<CS: CipherSuite, KE: Group> = PreHash<H>;
 
-    // We use a manual implementation of `RandomizedPrehashSigner` to use the same
-    // hash for the message as for generating `k`. See
+    // We use a manual implementation of `RandomizedPrehashSigner` to use the
+    // same hash for the message as for generating `k`. See
     // https://github.com/RustCrypto/signatures/issues/949.
     fn sign<'a, R: CryptoRng + RngCore, CS: CipherSuite, KE: Group>(
         sk: &<Self::Group as Group>::Sk,
@@ -100,8 +100,8 @@ where
     let z =
         hazmat::bits2field::<C>(pre_hash).expect("hash output can not be shorter than a scalar");
 
-    // This can only fail if the computed `r` or `s` are zero, in which case we just
-    // retry with a new `k`. See https://github.com/RustCrypto/signatures/pull/951.
+    // This can only fail if the computed `r` or `s` are zero, in which case we
+    // just retry with a new `k`. See https://github.com/RustCrypto/signatures/pull/951.
     loop {
         let mut ad = FieldBytes::<C>::default();
         rng.fill_bytes(&mut ad);

src/key_exchange/sigma_i/message.rs

@@ -169,21 +169,21 @@ impl<CS: CipherSuite, KE: Group> CachedMessage<CS, KE> {
         transcript: Role,
         identifier: &'a SerializedIdentifier<'_, KeGroup<CS>>,
     ) -> impl Clone + Iterator<Item = &'a [u8]> {
-        Some(identifier.iter())
-            .filter(|_| matches!(transcript, Role::Client))
+        matches!(transcript, Role::Client)
+            .then_some(identifier.iter())
             .into_iter()
             .flatten()
             .chain(self.credential_request.iter())
             .chain(self.ke1_message.iter())
             .chain(
-                Some(identifier.iter())
-                    .filter(|_| matches!(transcript, Role::Server))
+                matches!(transcript, Role::Server)
+                    .then_some(identifier.iter())
                     .into_iter()
                     .flatten(),
             )
             .chain(self.credential_response.iter())
             .chain([self.server_nonce.as_slice(), &self.server_e_pk])
-            .chain(Some(self.server_mac.as_slice()).filter(|_| matches!(transcript, Role::Client)))
+            .chain(matches!(transcript, Role::Client).then_some(self.server_mac.as_slice()))
     }
 }
 

src/keypair.rs

@@ -283,8 +283,9 @@ impl<G: Group> KeyPair<G> {
         use rand::SeedableRng;
         use rand::rngs::StdRng;
 
-        // The no_shrink is because keypairs should be fixed -- shrinking would cause a
-        // different keypair to be generated, which appears to not be very useful.
+        // The no_shrink is because keypairs should be fixed -- shrinking would
+        // cause a different keypair to be generated, which appears to not be
+        // very useful.
         any::<[u8; 32]>()
             .prop_filter_map("valid random keypair", |seed| {
                 let mut rng = StdRng::from_seed(seed);

src/lib.rs

@@ -1358,7 +1358,7 @@
 #![cfg_attr(not(test), deny(unsafe_code))]
 #![warn(clippy::cargo, clippy::doc_markdown, missing_docs, rustdoc::all)]
 #![cfg_attr(not(test), warn(unused_crate_dependencies))]
-#![allow(type_alias_bounds)]
+#![allow(clippy::multiple_crate_versions, type_alias_bounds)]
 
 #[cfg(any(feature = "std", test))]
 extern crate std;

src/tests/parser.rs

@@ -20,15 +20,13 @@ fn parse_vector_types(input: &str) -> String {
 
     let chunks: Vec<&str> = re.split(input).collect();
 
-    let mut count = 1;
-    for caps in re.captures_iter(input) {
+    for (count, caps) in (1..).zip(re.captures_iter(input)) {
         let vector_type = format!(
             "\"{}\": [\n {} \n]",
-            &caps["type"].trim(),
+            caps["type"].trim(),
             parse_ciphersuites(chunks[count])
         );
         vector_types.push(vector_type);
-        count += 1;
     }
 
     vector_types.join(",\n")
@@ -43,16 +41,14 @@ fn parse_ciphersuites(input: &str) -> String {
 
     let chunks: Vec<&str> = re.split(input).collect();
 
-    let mut count = 1;
-    for caps in re.captures_iter(input) {
+    for (count, caps) in (1..).zip(re.captures_iter(input)) {
         let ciphersuite = format!(
             "{{ \"{}, {}\": {{ {} }} }}",
             &caps["oprf"],
             &caps["group"],
             parse_params(chunks[count])
         );
         ciphersuites.push(ciphersuite);
-        count += 1;
     }
 
     ciphersuites.join(",\n")

tests/remote_key.rs

@@ -15,7 +15,7 @@
 
 #[cfg(feature = "ecdsa")]
 use ::ecdsa::SignatureSize;
-use cryptoki::context::{CInitializeArgs, Pkcs11};
+use cryptoki::context::{CInitializeArgs, CInitializeFlags, Pkcs11};
 use cryptoki::mechanism::Mechanism;
 use cryptoki::mechanism::elliptic_curve::{EcKdf, Ecdh1DeriveParams};
 use cryptoki::object::{Attribute, AttributeType, KeyType, ObjectClass, ObjectHandle};
@@ -35,7 +35,7 @@
 use elliptic_curve::sec1::{FromEncodedPoint, ModulusSize, Tag, ToEncodedPoint};
 use elliptic_curve::{AffinePoint, CurveArithmetic, FieldBytesSize, Group as _, ProjectivePoint};
 use generic_array::typenum::Unsigned;
 use generic_array::{ArrayLength, GenericArray};
 use opaque_ke::key_exchange::KeyExchange;
 use opaque_ke::key_exchange::group::Group;
 #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
@@ -46,7 +46,7 @@
 #[cfg(all(feature = "ristretto255", feature = "ed25519"))]
 use opaque_ke::key_exchange::sigma_i::pure_eddsa::PureEddsa;
 #[cfg(feature = "ecdsa")]
 use opaque_ke::key_exchange::sigma_i::{CachedMessage, HashOutput, Message, SigmaI};
 use opaque_ke::key_exchange::tripledh::TripleDh;
 use opaque_ke::keypair::{KeyPair, PublicKey};
 use opaque_ke::ksf::Identity;
@@ -134,8 +134,8 @@
     }
 
     test::<Suite>(
-        // This should be [`Mechanism::EccMontgomeryKeyPairGen`], but SoftHSM has an incorrect
-        // implementation. See https://github.com/softhsm/SoftHSMv2/issues/647.
+        // This should be [`Mechanism::EccMontgomeryKeyPairGen`], but SoftHSM
+        // has an incorrect implementation. See https://github.com/softhsm/SoftHSMv2/issues/647.
         Mechanism::EccEdwardsKeyPairGen,
         ObjectIdentifier::new("1.3.101.110").unwrap(),
         Attribute::Derive(true),
@@ -242,7 +242,7 @@
     let key_material_info = server_setup.key_material_info(&[]);
     let key_material = pkcs11_hkdf::<CS>(
         key_material_info.ikm,
-        hmac_mechanism,
+        &hmac_mechanism,
         Vec::from_iter(key_material_info.info.into_iter().flatten().copied()),
     );
     let message = ServerRegistration::start_with_key_material(&server_setup, key_material, message)
@@ -266,7 +266,7 @@
     let key_material_info = server_setup.key_material_info(&[]);
     let key_material = pkcs11_hkdf::<CS>(
         key_material_info.ikm,
-        hmac_mechanism,
+        &hmac_mechanism,
         Vec::from_iter(key_material_info.info.into_iter().flatten().copied()),
     );
     let builder = ServerLogin::builder_with_key_material(
@@ -310,7 +310,9 @@
 static SESSION: LazyLock<Mutex<Session>> = LazyLock::new(|| {
     let module = env::var("PKCS11_MODULE").expect("`PKCS11_MODULE` environment variable");
     let pkcs11 = Pkcs11::new(module).unwrap();
-    pkcs11.initialize(CInitializeArgs::OsThreads).unwrap();
+    pkcs11
+        .initialize(CInitializeArgs::new(CInitializeFlags::OS_LOCKING_OK))
+        .unwrap();
 
     let slot = pkcs11.get_slots_with_token().unwrap()[0];
 
@@ -380,7 +382,7 @@
 // by almost all HSMs and still protects the OPRF seed.
 fn pkcs11_hkdf<CS: CipherSuite>(
     hmac: ObjectHandle,
-    mechanism: Mechanism,
+    mechanism: &Mechanism,
     info: Vec<u8>,
 ) -> GenericArray<u8, <OprfGroup<CS> as voprf::Group>::ScalarLen> {
     let mut okm = GenericArray::default();
@@ -403,7 +405,7 @@
         data.extend(&info);
         data.extend(&[block_n + 1]);
 
-        let output = session.sign(&mechanism, hmac, &data).unwrap();
+        let output = session.sign(mechanism, hmac, &data).unwrap();
         block.copy_from_slice(&output[..block.len()]);
         prev = Some(output);
     }