docs(host): the identity comments still named ring after the aws-lc-rs move #202

Merged

enricobuehler merged 1 commits from worktree-identity-doc-aws-lc into main 2026-08-13 16:00:05 +00:00

Conversation 0 Commits 1 Files Changed 1

+9 -9

enricobuehler commented 2026-08-13 15:59:10 +00:00

Owner

Copy Link

Copy Source

PR #192 (79d755cd) moved rustls, quinn, rcgen and tokio-rustls to aws-lc-rs, but two comments in crates/punktfunk-host/src/identity.rs still credited ring:

• The module doc credited the P-256 key to "generated by ring via rcgen". rcgen now selects aws_lc_rs — crates/punktfunk-host/Cargo.toml:135 and crates/punktfunk-core/Cargo.toml:80.
• The legacy-RSA fallback claimed "rustls/ring can SERVE an existing RSA cert". The substance still holds under aws-lc-rs; only the provider name was wrong.

4903c9d3 fixed the generate() doc but missed the module doc, whose phrase wraps across two lines (generated by / ring via rcgen), so a line-based grep never matched it.

Why it mattered

The stale comment is load-bearing for anyone reasoning about the crypto backend: it was read as evidence that the P-256 identity is signed by ring, which also affects how you reason about ECDSA nonce generation. Under aws-lc the nonce is hardened with SHA-512(private key ‖ message digest) fed into the RBG as additional data (aws-lc/crypto/fipsmodule/ecdsa/ecdsa.c:280) — the same hedged property, but a different library to go read.

Scope

Comment-only. Every changed line in the diff is a comment, so compilation is unaffected by construction; cargo fmt -p punktfunk-host -- --check is clean and all lines stay within the file's 100-column budget. No behaviour change, no algorithm change — the identity remains ECDSA P-256.

PR #192 (`79d755cd`) moved rustls, quinn, rcgen and tokio-rustls to aws-lc-rs, but two comments in `crates/punktfunk-host/src/identity.rs` still credited `ring`: - **The module doc** credited the P-256 key to *"generated by ring via rcgen"*. rcgen now selects `aws_lc_rs` — `crates/punktfunk-host/Cargo.toml:135` and `crates/punktfunk-core/Cargo.toml:80`. - **The legacy-RSA fallback** claimed *"rustls/ring can SERVE an existing RSA cert"*. The substance still holds under aws-lc-rs; only the provider name was wrong. `4903c9d3` fixed the `generate()` doc but missed the module doc, whose phrase wraps across two lines (`generated by` / `ring via rcgen`), so a line-based grep never matched it. ### Why it mattered The stale comment is load-bearing for anyone reasoning about the crypto backend: it was read as evidence that the P-256 identity is signed by ring, which also affects how you reason about ECDSA nonce generation. Under aws-lc the nonce is hardened with `SHA-512(private key ‖ message digest)` fed into the RBG as additional data (`aws-lc/crypto/fipsmodule/ecdsa/ecdsa.c:280`) — the same hedged property, but a different library to go read. ### Scope Comment-only. Every changed line in the diff is a comment, so compilation is unaffected by construction; `cargo fmt -p punktfunk-host -- --check` is clean and all lines stay within the file's 100-column budget. No behaviour change, no algorithm change — the identity remains ECDSA P-256.

enricobuehler added 1 commit 2026-08-13 15:59:12 +00:00

docs(host): the identity comments still named ring after the aws-lc-rs move ... 92db66514b

PR #192 (79d755cd) moved rustls, quinn, rcgen and tokio-rustls to aws-lc-rs,
but two comments in identity.rs still credited ring:

  * the module doc credited the P-256 key to "ring via rcgen" — rcgen now
    selects `aws_lc_rs` (punktfunk-host/Cargo.toml:135, punktfunk-core/Cargo.toml:80);
  * the legacy-RSA fallback claimed "rustls/ring can SERVE an existing RSA cert".
    The substance still holds under aws-lc-rs; only the provider name was wrong.

4903c9d3 fixed the `generate()` doc but missed the module doc, whose phrase wraps
across two lines ("generated by" / "ring via rcgen"), so a line-based grep never
matched it.

Comment-only: every changed line is a comment, cargo fmt clean.

enricobuehler merged commit 9c13335089 into main 2026-08-13 16:00:05 +00:00

enricobuehler deleted branch worktree-identity-doc-aws-lc 2026-08-13 16:00:07 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

FernandoMX enricobuehler (Enrico Bühler) kszlim nannku neoney sassycrown

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unom/punktfunk#202