webpki VS rust-crypto

Compare webpki vs rust-crypto and see what are their differences.

webpki

WebPKI X.509 Certificate Validation in Rust (by briansmith)

rust-crypto

A (mostly) pure-Rust implementation of various cryptographic algorithms. (by DaGenix)
Our great sponsors
  • InfluxDB - Power Real-Time Data Analytics at Scale
  • WorkOS - The modern identity platform for B2B SaaS
  • SaaSHub - Software Alternatives and Reviews
webpki rust-crypto
6 2
450 1,357
- -
8.0 0.0
about 1 month ago about 1 year ago
Rust Rust
GNU General Public License v3.0 or later Apache License 2.0
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.

webpki

Posts with mentions or reviews of webpki. We have used some of these posts to build our list of alternatives and similar projects. The last one was on 2022-03-13.
  • Struggling with the OpenSSL Crate
    2 projects | /r/rust | 13 Mar 2022
    Beyond that, various things like the ScyllaDB driver are using OpenSSL because WebPKI doesn't support validating connections to IP addresses (as opposed to DNS names) and RusTLS currently delegates to WebPKI.
  • What Is Rust's Hole Purpose?
    4 projects | news.ycombinator.com | 18 Feb 2022
    There's a JIT framework in Rust: https://github.com/bytecodealliance/wasmtime

    There's a library for doing full X.509 certificate parsing and verification: https://briansmith.org/rustdoc/webpki/

    There's definitely some attempts at doing pure-Rust SSL, but I suspect a lot of them are also doing some sketchy things with crypto that shouldn't be trusted (getting constant-time stuff implemented properly is really challenging, and probably requires large amounts of assembly to guarantee correctness).

  • I think a major issue with the rust ecosystem is that it's full of unexpected design decisions
    5 projects | /r/rust | 5 Feb 2022
    An issue was raised with webpki to support the IP addressees 5 years ago, and yet it's still not there. What do people use to overcome the fact that rustls can't do IP-based client connections because of it? My guess would be, they are switching to native-tls or openssl-tls.
  • Why is SSL such a pain?
    5 projects | /r/rust | 28 Jul 2021
    Yes, rustls currently doesn't support certificates without hostnames (only an IP); this is actually an issue with the webpki crate, and work to solve it is ongoing (will hopefully land in a release in a few months or so).
  • Preparing Rustls for Wider Adoption
    9 projects | news.ycombinator.com | 20 Apr 2021
    > Bundling this set with Firefox

    I love that they did that; it was actually my idea (https://bugzilla.mozilla.org/show_bug.cgi?id=657228). I believe the list is pretty large and changes frequently and so they download it dynamically.

    > short cut to a "Yes"

    Do they really do that? That's awesome if so. Then they don't even need to ship the roots.

    > I specifically don't like [...] saying "unknown issuer"

    https://github.com/briansmith/webpki/issues/221

    > If std::fs::File::open() gives me Result with an io:Error that claims "File not found" but the underlying OS file open actually failed due to a permission error, you can see why that's a problem right? Even if this hypothetical OS doesn't expose any specific errors, "File not found" is misleading.

    A more accurate analogy: You ask to open "example.txt" without supplying the path, and there is no "example.txt" in the current working directory. You will get "file not found."

    Regardless, I agree we could have a better name than UnknownIssuer for this error.

    9 projects | news.ycombinator.com | 20 Apr 2021
    > he situation described above just generated an "Invalid certificate" message. More use of anyhow::Context would be helpful. I don't disagree with Rustls disallowing decade-obsolete crypto. It's the "silently ignores" part that's a problem.

    Because of how X.509 certificate validation works, in general it's not possible to tell you why an issuer couldn't be found, because there are many possible reasons.

    Regardless https://github.com/briansmith/webpki/issues/206 tracks improving the situation.

rust-crypto

Posts with mentions or reviews of rust-crypto. We have used some of these posts to build our list of alternatives and similar projects. The last one was on 2022-09-12.

What are some alternatives?

When comparing webpki and rust-crypto you can also consider the following projects:

ring - Safe, fast, small crypto using Rust

curve25519-dalek - A pure-Rust implementation of group operations on Ristretto and Curve25519

rust-native-tls

rust-openssl - OpenSSL bindings for Rust

ed25519-dalek - Fast and efficient ed25519 signing and verification in Rust.

rustls - A modern TLS library in Rust

sodiumoxide - [DEPRECATED] Sodium Oxide: Fast cryptographic library for Rust (bindings to libsodium)

rust-security-framework - Bindings to the macOS Security.framework

RustCrypto Elliptic Curves - Collection of pure Rust elliptic curve implementations: NIST P-224, P-256, P-384, P-521, secp256k1, SM2

RustCrypto - Authenticated Encryption with Associated Data Algorithms: high-level encryption ciphers