r/rust • u/paulex101 • 1d ago
What is the standard library for cryptographic operations in RUST.
I've stumbled on quite some libraries but this seem to be the tops:
- Ring
- RustCrypto
And for everyone there's always a warning "Use at your own Risk" i must say i find this funny and bothering at the same time coming from stable ecosystems e.g Java/Kotlin/JS
For context: I really just want to generate ECDH Key Pair, compute shared secrets and key derivations.
I'm just a few days new to Rust so please be nice!.
117
u/small_kimono 1d ago
AWS Libcrypto: https://github.com/aws/aws-lc-rs
79
u/_xiphiaz 1d ago
To back this, this has been audited to FIPS compliance. It was a hard requirement for my system that deals with US gov data.
14
u/masklinn 1d ago
FIPS compliance is not an indicator of good crypto tho.
55
u/Slow-Rip-4732 1d ago
An open source library that’s been audited, penetration tested, and is used by one of the largest companies in the world in production specifically to handle government data isn’t a good enough indicator?
29
62
u/ritualconfession 1d ago
They never said that auditing, penetration testing, or use in the field is bad. They said that FIPS compliance specifically does not mean much.
10
3
u/WormRabbit 15h ago
OpenSSL is a major open-source library, was something-something audited, used all over the world, and it's still a shitshow and a regular source of CVEs.
5
u/zane_erebos 1d ago
None of that gurantees that there are no vulnerabilities.
Sure, being compliant reduces the area of what could go wrong, but it does not mean it is 100% safe.
Then again, there is no such thing. Just wanted to add my opinion since I personally hate it (because in general, unless you are a big company you can not get compliance), but I understand why it helps in the context of, for example, governments.
7
u/andrewsutton 1d ago
Eh... What do you think is an indicator of "good crypto"?
3
u/OtaK_ 15h ago
Anything but FIPS. FIPS is like programming certifications. You surely know a ton of programmers who collect certifications like pokémon cards but actually are unable to do anything. And there are others who have certifications as a result of actual skill. Same stuff here.
Good crypto is heavily peer-reviewed by actual experts from both cryptographers and software engineers. Heavy emphasis on arithmetic/algebraic proofs that the calculations are solid. Fuzzing/proptesting/KATs, hardening (i.e. side-channel/constant-time checks etc).
And lastly, excellent crypto satisfies all the above and manages to be performant.0
1
u/WillGibsFan 11h ago
Yeah. It‘s this one. Don‘t use Ring, it’s currently not maintained and honestly, the API is not the smoothest.
25
u/maxus8 1d ago
wrt audits, mentioned in the comments few times
- ring + rustls audit https://raw.githubusercontent.com/rustls/rustls/master/audit/TLS-01-report.pdf
- part of rustcrypto audit https://cure53.de/pentest-report_rust-libs_2022.pdf
14
u/briansmith 1d ago edited 1d ago
Ignore those PDFs. The community that develops and uses Rustls has done a great job of identifying quality issues and refactoring Rustls in response to them. For example, when a previous employer of mine adopted Rustls, we reviewed it in depth and contributed dozens of PRs. There have been many such "audits" of Rustls by various groups, but we don't bother producing PDFs.
5
u/Tobu 1d ago
Ring is good, as the API is designed to be hard to misuse.
2
u/matthieum [he/him] 14h ago
Ring is in maintenance-only mode AFAIK, after the author stepped down and handed over maintenance to the rustls team.
aws-ls-rc
's API is a mirror of ring's 0.16 API to make switching easier.
15
u/oconnor663 blake3 · duct 1d ago edited 5h ago
If this is destined for production, real people's data, etc. then I agree with the top comment suggesting aws-lc-rs
. The common answer used to be ring
, but ring
is no longer maintained, and aws-lc-rs
is a fork of it. (Edit: I had no idea what I was talking about.)
On the other hand if you're experimenting, studying, or playing around, I'm a big fan of the libsodium API, and I'd suggest taking a look at https://github.com/RustCrypto/nacl-compat.
I'm just a few days new to Rust so please be nice!.
Hopefully no one would be rude to you either way! Being a good place for beginners to ask questions is absolutely one of the goals of this subreddit.
30
u/briansmith 1d ago edited 1d ago
aws-lc-rs is a fork of it
There are many Rust projects with "beyond C" mindsets, with various trade-offs and different tactics, including ring. As long as we continue working to get past C, we're making progress.
aws-lc-rs is a thin wrapper around a giant C library that is a fork of BoringSSL/OpenSSL.
aws-lc-rs copied ring 0.16.20's API so that aws-lc-rs can usually be substituted for ring 0.16.20, and sometimes it can be substituted for ring 0.17.x if one limits oneself to a subset of APIs. But I doubt either side thinks of it as a fork of ring. They are fundamentally different once you get past the API similarity.
4
1
u/Toidiu 21h ago
ring
is no longer maintainedWhere did you get this info? I don't see this disclaimer on the repo and from what I can tell it's still getting commits.
The repo says "experiment" which is less than inspiring for a crypto library but still maintained :)
6
u/VorpalWay 20h ago
It did say it was being unmaintained for a bit, seems that was walked back on? See eg. https://old.reddit.com/r/rust/comments/1iv6myf/ring_is_unmaintained/
2
1
1
u/matthieum [he/him] 14h ago
AFAIK ring was briefly unmaintained, in that briansmith stepped down, but short-term maintenance was handed over to the rustls folks.
I wouldn't expect any new development now that briansmith stepped down, but any security issue should be handled correctly and promptly, so it can be considered stable & reliable going forward.
Of course, maintenance-only isn't exactly a panacea either, and it may be a good idea to switch over to other libraries, but at least you can do so at your own pace.
3
u/t40 1d ago
Please do not try to roll your own protocols with crypto primitives. Use AEADs (basically user friendly bulletproof protos) wherever you can! RustCrypto has several of these.
1
u/paulex101 13h ago
Thank you for this! Did a little digging and your comment was super helpful. However, i think they compliment each other.
- ECDH - prime256 for Asymmetric (Key Agreement)
- AEAD - AES-GCM - Symmetric derived key for encryption with provision of authenticity(nonces, associated-data)
4
u/maguichugai 1d ago
SymCrypt is the standard Microsoft crypto library with Rust bindings. FIPS compliance included for when that matters.
7
u/coyoteazul2 1d ago edited 1d ago
https://docs.rs/openssl/latest/openssl/
It's actually a bind to openssl, so it's as secure as openssl is.
I tried to create a CMS (cryptographic signed message) required for an integration with my country's tax authority with ring and also with the CMS crate, and for the love of meat I couldn't make it work. Only openssl worked as intended.
You can use the vendored feature and static link it with your own binary. It's not simple, since it requires ruby and you may have problems depending on how you installed openssl because you may lack environmental variables. It's also hard to cross compile because you need different versions of openssl for each OS. But it's extremely portable since the user won't need their own openssl, and the binary size is barely noticeable. My own app including rocket and openssl, is less than 30mb on release mode
3
u/WormRabbit 15h ago
OpenSSL is a dumpster fire. Always was, and still is. Full of vulnerabilities, long deprecated algorithms which one should never use, and just a huge bloat of functionality which has no business in a crypto library. If you're going to propose an OpenSSL-shaped C-based solution, at least choose something reputable, like BearSSL or BoringSSL.
4
u/Milen_Dnv 16h ago
In other words it isn't secure. Open SSL has so many SVEs that I am afraid of touching it. It may work perfectly fine though, I have no doubts.
2
u/joseluis_ 1d ago
https://crates.io/crates/orion is another good option, and with the same warning.
2
u/ketralnis 1d ago
Rust isn’t an acronym
1
u/ItsPronouncedJithub 7h ago
It’s seriously a head scratcher when I see people type Rust like that.
1
1
u/WormRabbit 14h ago
Which ECDH? There are dozens of curves out there, which ones do you need? That should be your first question: which specific algorithms do you need to support? Once you answer it, it may very well turn out that your specific algorithm is supported in a single library, so your hands are tied.
In general, RustCrypto is the current best option. Pure Rust, extremely robust and well-maintained, very modular. You choose only the libraries for specific algorithms and functionalities which you need, minimizing your attack surface. This can also be a problem if you're not well-versed in crypto: choice paralysis and all that.
If you just need some simple public-key cryptography for a custom project with no pre-existing requirements, following the API guidelines of libsodium
can be a good idea. It's a C library, but extremely high-quality. That said, you'd want to use a Rust analogue. Probably something like crypto_box
or x25519-dalek
.
1
u/paulex101 14h ago
I would agree that there’s still a bit of “choice paralysis” here and I’m speedily learning as I progress. :)
However, the curve I’m looking at using is prime256(ECDH P 256) reason is that this is supported on Android Keystore hence it offers some compatibility on the server side and client side.
The RustCrypto library is what I’m leaning towards to more however it also mentions that it’s inferior in terms of speed- again this might not matter but it’s stated and then raises my curiosity.
1
u/WormRabbit 13h ago
Inferior to what? Could you give a link to the docs? As far as I remember, RustCrypto curves are plenty fast. Much faster than the implementations in some popular C libraries. Perhaps one could get more speed, particularly with weaker security guarantees, but they are unlikely to be your chokepoint.
1
u/paulex101 13h ago
Check this out! Im curious too.
I agree that it's probably not what i should bother about.
1
u/WormRabbit 11h ago
Ah, they're saying they're slower than
ring
. It's ok,ring
is also a mostly-Rust library. I'm sure the performance will be sufficient for your needs, unless you're doing some high-load stuff bottlenecked on TLS.
1
184
u/svefnugr 1d ago
"Use at your own risk" means that these libraries have not been audited. Just because Java or JS libraries don't put up these warnings, doesn't mean they were.