Skip to content

Conversation

@tbrezot
Copy link
Collaborator

@tbrezot tbrezot commented Jul 17, 2025

This commit reviews the serialization approach from the ground to allow using different serializers and deserializers. For instance, this allows avoiding a copy after calling .serialize(): in the previous version, serialize() was always returning a Zeroizing<Vec<u8>>; in this new version, serialize takes an additional type parameter specifying which Serializer to use and returns Serializer::Output.

Two serializers are implemented:

  • SecretSerializer which returns a Zeroizing<Vec<u8>>; calling .serialize<SecretSerializer>() is therefore equivalent to the previous .serialze() call.

  • PublicSerializer which returns a Vec<u8> and is therefore appropriate to for use in deserialization of values that do not need to be zeroized on drop.

Error management is not optimal since the error type of Serializable is now constrained to be CryptoCoreError. Adding a per-implementation error back through type Error: std::error::Error messes up with error conversion when serializing other types. For example when serializing Option<T> where T: Serializable, a boolean is serialized to encode option variants and its serialization error must be compatible with T::Error and Self::Error. Finally, since this is a trait, ad-hoc bounds cannot be added easily. All in all, constraining the error type seems and okay and easy solution. I remain open to suggestions.

WARNING: this is a breaking change and requires a major version bump.

This commit reviews the serialization approach from the ground to allow using
different serializers and deserializers. For instance, this allows avoiding a
copy after calling `.serialize()`: in the previous version, `serialize()` was
always returning a `Zeroizing<Vec<u8>>`; in this new version, `serialize` takes
an additional type parameter specifying which `Serializer` to use and returns
`Serializer::Output`.

Two serializers are implemented:

- `SecretSerializer` which returns a `Zeroizing<Vec<u8>>`; calling
`.serialize<SecretSerializer>()` is therefore equivalent to the previous
`.serialze()` call.

- `PublicSerializer` which returns a `Vec<u8>` and is therefore appropriate to
for use in deserialization of values that do not need to be zeroized on drop.
@tbrezot tbrezot requested review from HatemMn and Manuthor July 17, 2025 07:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants