1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
[]
= "pylon-auth"
= true
= true
= true
= true
= true
= true
= true
= true
= true
[]
= "src/lib.rs"
[]
= { = true }
= { = true }
= { = true }
= { = true }
= { = true }
= { = true }
# Apple "Sign in with Apple" client_secret JWT signing — ES256 over
# the developer's downloadable .p8 PKCS8 key. ring is already in the
# tree via rustls so this adds no new transitive deps.
= { = true }
= { = true }
# SHA-256 used for PKCE code_challenge derivation (RFC 7636 §4.2).
= { = true }
# SHA-1 for HIBP Pwned Passwords + TOTP (RFC 6238 default algorithm).
# SHA-1 is broken for collisions but HIBP and TOTP both use it as the
# stable index/HMAC key. Not used for any modern hash-collision security.
= { = true }
# HMAC used by TOTP (HMAC-SHA1) + JWT-shaped sessions (HMAC-SHA256).
= { = true }
# RFC 3339 timestamp parser for SIWE expiration_time / not_before fields.
= { = true }
# secp256k1 ECDSA recovery + keccak256 — SIWE signature verification.
= { = true }
= { = true }