RustCrypto
webpki
Our great sponsors
RustCrypto | webpki | |
---|---|---|
10 | 6 | |
641 | 451 | |
3.3% | - | |
7.6 | 8.0 | |
5 days ago | 2 months ago | |
Rust | Rust | |
MIT License | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
RustCrypto
-
(Why) is a toy password manager a too complex summer project?
I would say a toy (or personal-use-only) password manager is a relatively simple project. If we are to forget about the GUI parts, you need to determine serialization of your password database (bincode + serde should be enough) and how to encrypt it. For the latter you need only two algorithms: a password hash for deriving encryption key from password and optional salt (the latter is usually randomly generated and stored as a "key file"), and an AEAD algorithm for encrypting and decrypting serialized database. There are certain pitfalls with encryption (e.g. you should not reuse nonce with the same key, especially with modes like GCM) and with properly erasing sensitive data from memory, as well as preventing it from leaking to things like swap, but learning about those is part of the learning experience.
-
Announcing street-cred 0.1.1 - My first Rust crate
FYI: the rust-crypto crate is unmaintained. Take a look at https://github.com/RustCrypto/AEADs instead
-
Help using ring to decrypt encrypted bytes using AES key (using AEAD).
For AEAD with AES, you may want to use RustCrypto (https://github.com/RustCrypto/AEADs.git) instead
-
Dexios - a secure command-line encryption tool.
Dexios is a secure command-line encryption tool, that uses audited crates provided by the RustCrypto Team.
-
Idiomatically initializing and using a variable with two different types
This is in relation to RustCrypto/AEADs#421 - myself and another user are having the exact same issue.
-
SafeCloset, a Secret Safe - Why and how I made it in Rust
I choose an AEDS crate from the RustCrypto group: AES-GCM in its SIV variant (the SIV variant isn't really needed but it doesn't cost much).
-
Crate for AES256 - which one to choose? Questions about block cipher modes and AEAD too.
Use RustCrypto's aes with one of its block modes (https://docs.rs/block-modes/latest/block_modes/) or AEAD algorithms (https://github.com/RustCrypto/AEADs). There's a lot of modular stuff in RustCrypto, just need to browse a little 😉.
-
Sodiumoxide has been deprecated
crypto_secretbox: https://github.com/RustCrypto/AEADs/tree/master/xsalsa20poly1305
-
What encryption crates do you guys recommend, especially one with support for streams
I'd recommend https://github.com/RustCrypto/AEADs. RustCrypto's crates are high quality, widely used and some have even been audited. Unfortunately they don't provide a read/write interface.
- How to implement a simple password-based encryption with ring?
webpki
-
Struggling with the OpenSSL Crate
Beyond that, various things like the ScyllaDB driver are using OpenSSL because WebPKI doesn't support validating connections to IP addresses (as opposed to DNS names) and RusTLS currently delegates to WebPKI.
-
What Is Rust's Hole Purpose?
There's a JIT framework in Rust: https://github.com/bytecodealliance/wasmtime
There's a library for doing full X.509 certificate parsing and verification: https://briansmith.org/rustdoc/webpki/
There's definitely some attempts at doing pure-Rust SSL, but I suspect a lot of them are also doing some sketchy things with crypto that shouldn't be trusted (getting constant-time stuff implemented properly is really challenging, and probably requires large amounts of assembly to guarantee correctness).
-
I think a major issue with the rust ecosystem is that it's full of unexpected design decisions
An issue was raised with webpki to support the IP addressees 5 years ago, and yet it's still not there. What do people use to overcome the fact that rustls can't do IP-based client connections because of it? My guess would be, they are switching to native-tls or openssl-tls.
-
Why is SSL such a pain?
Yes, rustls currently doesn't support certificates without hostnames (only an IP); this is actually an issue with the webpki crate, and work to solve it is ongoing (will hopefully land in a release in a few months or so).
-
Preparing Rustls for Wider Adoption
> Bundling this set with Firefox
I love that they did that; it was actually my idea (https://bugzilla.mozilla.org/show_bug.cgi?id=657228). I believe the list is pretty large and changes frequently and so they download it dynamically.
> short cut to a "Yes"
Do they really do that? That's awesome if so. Then they don't even need to ship the roots.
> I specifically don't like [...] saying "unknown issuer"
https://github.com/briansmith/webpki/issues/221
> If std::fs::File::open() gives me Result with an io:Error that claims "File not found" but the underlying OS file open actually failed due to a permission error, you can see why that's a problem right? Even if this hypothetical OS doesn't expose any specific errors, "File not found" is misleading.
A more accurate analogy: You ask to open "example.txt" without supplying the path, and there is no "example.txt" in the current working directory. You will get "file not found."
Regardless, I agree we could have a better name than UnknownIssuer for this error.
What are some alternatives?
ring - Safe, fast, small crypto using Rust
rust-native-tls
rustls - A modern TLS library in Rust
sodiumoxide - [DEPRECATED] Sodium Oxide: Fast cryptographic library for Rust (bindings to libsodium)
rust-crypto - A (mostly) pure-Rust implementation of various cryptographic algorithms.
rust-openssl - OpenSSL bindings for Rust
orion - Usable, easy and safe pure-Rust crypto [Moved to: https://github.com/orion-rs/orion]
schannel-rs - Schannel API-bindings for rust (provides an interface for native SSL/TLS using windows APIs)
Ockam - Orchestrate end-to-end encryption, cryptographic identities, mutual authentication, and authorization policies between distributed applications – at massive scale.