Indeed, it could be a problem with rust-crypto since its last update was 2 years ago and the last merged PR was 7th Sep. 2016.

But looks like there's no better choice so far.

The RustCrypt crate seems quite new, I'm afraid it could be still buggy, just my feeling.

I see rust-bitcoin project is also still using rust-crypto:

https://github.com/rust-bitcoin/rust-bitcoin/blob/master/Cargo.toml#L26

I'm not against this replacement, just want to inform these info 😃

I have a bad idea: we clone rust-crypto into mimblewimble and start maintain it by ourselves, since this crate is quite important for Grin.

Anybody second me?

@garyyu there should another branch in the new crypto lib repo where all the new stuff is, and that's likely what we should use. IIRC

@sesam

there should another branch in the new crypto lib repo where all the new stuff is

What do you mean the new crypto lib repo?

It's just that rust-crypto relies on old dependencies and is unmaintained since two years.
Whereas https://crates.io/crates/sha2 is two years old (so not that new) and relies on modern dependencies.

I have a bad idea: we clone rust-crypto into mimblewimble and start maintain it by ourselves, since this crate is quite important for Grin.

Anybody second me?

I think the idea is to migrate to https://github.com/rust-bitcoin/bitcoin_hashes once it's ready (according to this)

@mcdallas good catch - I knew we'd discussed something as a replacement but couldn't remember where/what it was...

So, we'd better open an issue and leave it there to remind us this https://github.com/rust-bitcoin/bitcoin_hashes .

But I feel this bitcoin_hashes is not at progress state, and the once it's ready could become a dream and wake for nothing?

Again, nobody second me to clone rust-crypto to mimblewimble? 😄

I don't see the issue with using RustCrypto/Hashes/HMac instead of rust-crypto. And I don't see why bitcoin_hashes would be better a better replacement (except maybe less dependencies).

I just need @TheBlueMatt (nudge, nudge) to merge the open PRs on bitcoin_hashes, then I think it will be done and in maintenance mode.

It's just that rust-crypto relies on old dependencies and is unmaintained since two years.
Whereas https://crates.io/crates/sha2 is two years old (so not that new) and relies on modern dependencies.

This reasoning should be written in the commit message, not only in the PR history.

@garyyu that's a lot of risky code to maintain when we only use a fraction of it.

This PR is a net improvement, possibly with more improvements to come. So let's merge.