Take inputs to parse as `untrusted::Input` values. about ring HOT 3 CLOSED

Another option, which I saw in another library and I think is nice, is to define a new type for each kind of argument. For example, we currently have:

pub fn verify(alg: &VerificationAlgorithm, public_key: Input,
              msg: Input, signature: Input) -> Result<(), Unspecified> { ... }

But, we could instead:

enum EncodedPublicKey(untrusted::Input);
enum Signed(untrusted::Input);
enum EncodedSignature(untrusted::Input);

pub fn verify(alg: &VerificationAlgorithm, public_key: EncodedPublicKey,
              msg: Signed, signature: EncodedSignature) -> Result<(), Unspecified> { ... }

Pros of such a change:

• It would be much harder for the caller to confuse one input argument for another.
• Future (breaking) changes to the API are likely to result in more compile-time failures and fewer (near zero) runtime failures, which is what we want.

Cons of such a change:

• If somebody isn't doing their parsing using untrusted.rs already, then they would have to wrap their &[u8] slices in both untrusted::Input and the wrapper type, which could get really annoying.

from ring.

Input & Reader were moved to ring a long time ago and then factors out into untrusted.rs. We take inputs as untrusted::Input in several places. We need to comb through the API, especially older APIs, and change the ones that operate on untrusted inputs to take those as untrusted::Input.

from ring.

Not only did we do this, but everybody hates it. Oh well.

from ring.