Repository navigation
Usage of RustCrypto in TLS Verifier #64
Description
Summary
RustCrypto provider for Rustls should not be used in production because
it has not been externally verified for FIPS compliance. We should discuss
which crypto provider we should use for Rustls.
Crypto providers to consider
1. aws-lc-rs
- Pro: Covers all TLS suites
- Pro: FIPS 140-3 support available (testing complete, NIST certification pending)
- Con: Requires cmake build dependency
2. ring
- Pro: Production-ready, well-tested
- Pro: Simpler build dependencies
- Con: 15-21% slower than aws-lc-rs, no FIPS support
3. rustls-rustcrypto
- Pro: Pure Rust thus it is maximally compatible
- Production warning, no audit, incomplete, slower
Proposed solution
- Use the cargo "feature" mechanism to make the crypto provider optional
- Default to aws-lc-rs since it is faster and compliant
Activity
patricklyc commentedon Jun 29, 2026
Stated criteria
Candidate libraries
aws-lc-rs
Successfully built with
Cargo.tomladjusted and a simple search and replace insrc/connect.rs, and passed e2e tests.No additional build dependencies required when building without FIPS support:
FIPS support is out since
aws-lc-fips-sysfailed to build with the following error:Supported platforms:
ring
Successfully built with
Cargo.tomladjusted and a simple search and replace insrc/connect.rs, and passed e2e tests.Was externally audited along with rustls.
Since ring is currently already included in Cargo.toml, it shouldn't present any additional problems in building for different platforms.
graviola
Perhaps worth mentioning is graviola, a new library by the creator of rustls. It is pure Rust, fits most criteria except production readiness, and not working everywhere. But maybe worth keeping an eye on if these limitations are overcome in the future.
Benchmarks
There is a benchmark comparing the above candidates along with rustcrypto. Unfortunately, ed25519 signing is not tested.
My recommendation
ring makes the most sense since it is already required and fits all criteria.
Pluggable crypto provider seem unnecessary since there are two candidates that fit all criteria (except for FIPS support).