Call for maintainers/participants

[cpu]

Hello folks,

As you may or may not know, the Wycheproof repository was donated by Google to the C2SP organization to allow continued community maintenance of the JSON test vectors many of us have found tremendously useful in downstream projects.

After some initial tidying and some continuous integration groundwork we believe we're now ready to solicit increased participation from the community, and additional maintainers.

I've tagged a number of folks that I'm aware of who participate in downstream projects that rely on Wycheproof test vector data in one way or another. My ask for you is to reply with an indicator of:

• Whether you would be interested in helping review contributions to this repo as a selected maintainer. The repo activity is generally pretty low, and this would be best-effort.
• Whether you would be interested in being tagged in discussion issues related to the project (e.g. changes to schema format, release processes, etc).

Please feel free to tag in others if you're aware of a project/contributor I've missed that you think might be interested.

In no particular order, some folks I'd be interested in hearing from:
@davidben, @alex, @reaperhulk, @justsmth, @ctz, @tob-scott-a, @SalusaSecondus, @rolandshoemaker, @randombit, @tarcieri, @botovq

[alex]

I'm interested in hearing about schema changes and other things that'll effect us as downstream contributors. (Happy to write up how we use wycheproof if helpful).

Don't have bandwidth for reviews unfortunately.

[botovq]

I can help with reviews, I have some spare bandwidth for this in the foreseeable future and planned on contributing a handful of things anyway.

[rolandshoemaker]

Wycheproof is unbelievably valuable to Go, and constitutes a large portion of our testing of cryptographic algorithms.

While I don't have a huge amount of spare time to dedicate to doing reviews, I'd be happy to be added to the roster of people willing to do so.

[reaperhulk]

I'm happy to be tagged for changes affecting pyca/cryptography and can potentially provide some limited review bandwidth depending on the type of review required.

[bleichenbacher-daniel]

I'm obviously interested too. To avoid duplication of work: I'm already in the process of writing tests for a number of libraries:
https://github.com/bleichenbacher-daniel/Rooterberg/blob/main/doc/libraries.md
These tests use the latest version of the test vectors and I'm running them whenever new test vectors become available.
Additionally, I'm working on resurrecting the tests for timing leakages. As it turns out there are quite a number of libraries that are careless about timing leaks.
There are of course additional goals of the project: one is simply generating a list of primitive, algorithms and formats supported by libraries. All too often libraries do not clearly document what is supported. This can become annoying if there are multiple versions of a primitive.
Another goals would be to find some consensus about the validity of formats. E.g., there are simple questions such as whether an empty string is a valid or acceptable PKCS5/7 padded ciphertext. Several libraries do accept empty ciphertexts, hence it may be overreach to flag such occurrences a bug.

[ctz]

I'm happy to be tagged on anything in this repo, and nevertheless am watching and will pipe-up when necessary.

[justsmth]

Hello! 😊 Yes, I'd be happy to help review contributions to this repository. I'm also good with being tagged on any discussion issues for the project. Also tagging: @skmcgrail

[SalusaSecondus]

I am no longer involved in the Amazon Corretto Crypto Provider and so am not a downstream consumer any more.

That said, this is an extremely valuable project and I am happy to be involved as a maintainer/reviewer/person with opinions. You may tag me in (and/or ping me through other channels) whenever you like.

If ACCP is interested in more directly integrating these tests, @alexw91 may be worth talking to.

[davidben]

My time is very sporadic, but I'm very distractible and happy to help out.

[cpu]

Thanks to everyone that replied. I'm hoping we can send repo invites out soon. Please stay tuned.

[sgmenda-aws]

Please feel free to tag me as well.

[alexw91]

I'm happy to help however I can, although I expect that AWS Cryptography would probably rather integrate Wycheproof testing into AWS-LC directly (instead of into ACCP which is a Java wrapper around AWS-LC).