Bump num-bigint from 0.4.1 to 0.4.2 (#68)

Bumps [num-bigint](https://github.com/rust-num/num-bigint) from 0.4.1 to 0.4.2.
- [Release notes](https://github.com/rust-num/num-bigint/releases)
- [Changelog](https://github.com/rust-num/num-bigint/blob/master/RELEASES.md)
- [Commits](https://github.com/rust-num/num-bigint/compare/num-bigint-0.4.1...num-bigint-0.4.2)

---
updated-dependencies:
- dependency-name: num-bigint
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bump sha2 from 0.9.7 to 0.9.8 (#70)

Bump sha2 from 0.9.6 to 0.9.7 (#69)

Bump num-bigint from 0.4.0 to 0.4.1 (#67)

Bumps [num-bigint](https://github.com/rust-num/num-bigint) from 0.4.0 to 0.4.1.
- [Release notes](https://github.com/rust-num/num-bigint/releases)
- [Changelog](https://github.com/rust-num/num-bigint/blob/master/RELEASES.md)
- [Commits](https://github.com/rust-num/num-bigint/compare/num-bigint-0.4.0...num-bigint-0.4.1)

---
updated-dependencies:
- dependency-name: num-bigint
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bump sha2 from 0.9.5 to 0.9.6 (#66)

Bumps [sha2](https://github.com/RustCrypto/hashes) from 0.9.5 to 0.9.6.
- [Release notes](https://github.com/RustCrypto/hashes/releases)
- [Commits](https://github.com/RustCrypto/hashes/compare/sha2-v0.9.5...sha2-v0.9.6)

---
updated-dependencies:
- dependency-name: sha2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bump sha-1 from 0.9.7 to 0.9.8 (#65)

Bumps [sha-1](https://github.com/RustCrypto/hashes) from 0.9.7 to 0.9.8.
- [Release notes](https://github.com/RustCrypto/hashes/releases)
- [Commits](https://github.com/RustCrypto/hashes/compare/sha-1-v0.9.7...sha-1-v0.9.8)

---
updated-dependencies:
- dependency-name: sha-1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Cargo.lock: bump dependencies (#64)

spake2: bump `hkdf` dependency to v0.11 (#63)

Fix typo over -> other (#60)

Bump sha-1 from 0.9.6 to 0.9.7 (#59)

Bumps [sha-1](https://github.com/RustCrypto/hashes) from 0.9.6 to 0.9.7.
- [Release notes](https://github.com/RustCrypto/hashes/releases)
- [Commits](https://github.com/RustCrypto/hashes/compare/sha-1-v0.9.6...sha-1-v0.9.7)

---
updated-dependencies:
- dependency-name: sha-1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

srp: fix typos in docstrings (#58)

This fixes a few minor typos in docstrings.

Bump sha-1 from 0.9.4 to 0.9.6 (#56)

Bumps [sha-1](https://github.com/RustCrypto/hashes) from 0.9.4 to 0.9.6.
- [Release notes](https://github.com/RustCrypto/hashes/releases)
- [Commits](https://github.com/RustCrypto/hashes/compare/sha-1-v0.9.4...sha-1-v0.9.6)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Cargo.lock: bump dependencies (#52)

Bump num-bigint from 0.2.6 to 0.4.0 (#46)

Bumps [num-bigint](https://github.com/rust-num/num-bigint) from 0.2.6 to 0.4.0.
- [Release notes](https://github.com/rust-num/num-bigint/releases)
- [Changelog](https://github.com/rust-num/num-bigint/blob/master/RELEASES.md)
- [Commits](https://github.com/rust-num/num-bigint/compare/num-bigint-0.2.6...num-bigint-0.4.0)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bump generic-array from 0.12.3 to 0.14.4 (#45)

Bumps [generic-array](https://github.com/fizyk20/generic-array) from 0.12.3 to 0.14.4.
- [Release notes](https://github.com/fizyk20/generic-array/releases)
- [Changelog](https://github.com/fizyk20/generic-array/blob/master/CHANGELOG.md)
- [Commits](https://github.com/fizyk20/generic-array/compare/0.12.3...0.14.4)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Add Dependabot config (#43)

Migrate to GitHub Actions (#42)

Uses the standard boilerplate we've been using for other projects

Edit badges

srp v0.5.0 (#38)

Bump digest, sha-1, and sha2 dependencies to v0.9 (#37)

Bump MSRV to 1.41.0 (#36)

srp v0.4.3

remove num_traits dep

spake2: update to hex-0.4

Switch from num to num-traits and num-bigint (#31)

Merge branch 'pr28'

Fix spelling errors.

spake2: tighten the curve25519-dalek dependency to 1.2.x

This was just "1", which allowed our MSRV to be accidentally raised from 1.31
to 1.32 without a deliberate spake2 minor-version bump (dalek-1.0.x compiles
with rustc-1.31, but dalek-1.1.x required 1.32).

Hopefully by making it "1.2", our MSRV will remain at 1.32 until we
explicitly decide to take on a dependency that needs something newer.

refs #21

travis: use rust 'stable' for rustfmt check

This was previously locked down at a specific version (1.31.0, much older
than the current 1.36), so we'd get consistent behavior over time. But since
we allow the rustfmt build to fail (it's in allow_failures), we don't need
this consistency so much. PR authors are expected to format their code
against the current stable rustfmt, but test it against the MSRV (currently
1.32.0).

refs #21

Merge branch '21-pin-travis'

refs #21

document MSRV, remove 1.31.1 from travis

oops, be more specific about the rust version: 1.32.0

travis: exercise 1.31.1 and 1.32

1.31.1 is our intended MSRV (Minimum Supported Rust Version), but we probably
don't actually work there because of an insufficiently-constrained dependency
that requires 1.32.

1.32 is probably our actual MSRV, and will be the one we aim for going
forward.

refs #21

Merge branch '21-update-hkdf'

refs #21

update spake2 to current hkdf-0.8

spake2/Cargo.toml: num-bigint is merely a dev-dependency

We only use it in unit tests.

This might help with no-std, so refs #15

srp doc fix. closes #16

(cargo-release) start next development iteration spake2-v0.2.1-alpha.0

(cargo-release) spake2-v0.2.0

srp: release srp-0.4.0

Merge branch 'edition-2018'

srp/Cargo.toml: remember to bump minor version for next release

Since edition=2018 means we'll require rust-1.31

Use curve25519-dalek v1

update srp to idioms of edition-2018

srp: fix to work with edition-2018

srp: fix some low-hanging clippy warnings

update spake2 to edition-2018

reformat using rustfmt from latest 1.31.0

spake2: Merge PR11: better Debug impl

add group name to SPAKE2 Debug impl

More idiomatic Debug impl

travis: update RUSTFMT to use rust-1.30 instead of 1.29

Merge PR10: update-deps

fix rustfmt

deps: update srp to lazy_static-1.2

deps: update to rand-0.6

fix spake2 doctests

spake2: add docs and basic doctest to lib.rs

update SRP dependencies

README: add deps.rs badge

update spake2 deps (sha2-0.8, hkdf-0.7)

travis: allow rustfmt to fail

I'm on the fence about this, but I have to admit that having your PR fail
because of formatting issues isn't a great experience for new contributors.

We will need to run `cargo fmt` ourselves on a regular basis.

spake2 code reorganization (#6)

add doc logo

replaced / with OR in license fields

(cargo-release) start next development iteration spake2-v0.1.2-alpha.0

(cargo-release) spake2-v0.1.1

spake2/Cargo.toml: update keywords, description, categories

spake2: update to latest deps (curve25519-dalek-0.21)

delete spake2/.travis.yml and .gitignore, subsumed by top-level files

Merge branch 'rustfmt'

reformat all code to match rustfmt-1.29.0

travis: cargo fmt now wants --check

travis: need to install rustfmt component

travis: test rustfmt too

spake2/Cargo.toml: add metadata to fix cargo-release commit messages

This ensures that our tags and automatically-generated commits (before and
after each release, automated by 'cargo-release') refer to the correct
version strings, like "spake2-v0.1.0". The default tag would be
"spake2-0.1.0", and the commit messages wouldn't mention "spake2" at
all (which might get confusing now that we have multiple crates in a single
repo).

Cargo.toml: update repo URLs

finish relicensing spake2 to MIT/Apache-2.0

READMEs: relicense spake2 under dual MIT+Apache2

Also update spake2 protocol URL, update badges.

Cargo.toml: add spake2 to the workspace

readme update

Add 'spake2/' from commit 'f6e9d07dffa9a9b39f203c23043f93337ebe1ab6'

git-subtree-dir: spake2
git-subtree-mainline: 1afa40d15b0c2cecc989bdfc67a5251aa5cd5954
git-subtree-split: f6e9d07dffa9a9b39f203c23043f93337ebe1ab6

This moves https://github.com/warner/spake2.rs into the "spake2/"
subdirectory of https://github.com/RustCrypto/PAKEs .

I'll move the release tags over next, then update the travis config and
READMEs.

README/Cargo.toml: add more badges

(cargo-release) start next development iteration 0.1.1-alpha.0

(cargo-release) version 0.1.0

README: oops, I was supposed to bump the minor version for this release

I introduced a breaking API change, and should have named that last release
0.1.0 instead of 0.0.9. I'll release this as 0.1.0.

(cargo-release) start next development iteration 0.0.10-alpha.0

(cargo-release) version 0.0.9

README: soften the disclaimer by roughly 24%

cargo fmt

update deps: hkdf-0.6

update deps: curve25519-dalek=0.19

forbid unsafe_code, and warnings durings tests

update deps: curve25519-dalek=0.18

use newtypes for Password and Identity to avoid usage errors

This a breaking API change. The next release should bump the minor version
number.

As discussed in https://github.com/warner/spake2.rs/issues/3 and
https://github.com/warner/magic-wormhole.rs/issues/32 , if an application
were to accidentally swap the "password" and "identity" arguments (mainly for
start_symmetric which only takes two args), the app would appear to work, but
would contain a devastating security vulnerability (online brute-force
password attack, with precomputation enabled).

You might think of newtypes as giving the API named parameters. Instead of:

`s = start_symmetric(b"pw", b"appid")`

you get:

`s = start_symmetric(&Password::new(b"pw"), &Identity::new(b"appid"))`

but it protects you (with a compile-time error) against mistakes like:

`s = start_symmetric(&Identity::new(b"appid"), &Password::new(b"pw"))`

I'd like to find a way to remove requirement to pass a reference (and enable
`start_symmetric(Password::new(..)..)`).

(cargo-release) start next development iteration 0.0.9-alpha.0

(cargo-release) version 0.0.8

update deps: num-bigint=0.2

(cargo-release) start next development iteration 0.0.8-alpha.0

(cargo-release) version 0.0.7

travis: add rustfmt, ignore WIP-* branches