5 ms·

Does Rust have official implementations of Crypto algorithms (in pure Rust)? I am not talking about some github repo in some dudes repository which contributes

by 0xFFC 9y ago

Does Rust have official implementations of Crypto algorithms (in pure Rust)? I am not talking about some github repo in some dudes repository which contributes to it in his spare time.

steveklabnik 9y ago
I'm not sure what you mean by "official" exactly, but I think for any of them, the answer would be "no". That said, https://crates.io/crates/ring https://crates.io/crates/ring is what most people suggest you should reach for: it's a slow and steady port of BoringSSL's code to Rust + asm. Of course, that only has a subset of crypto; there's other great projects too, the tor people have been putting out crates like https://github.com/isislovecruft/curve25519-dalek https://github.com/isislovecruft/curve25519-dalek
- vog 9y ago
  Is there something like "ring" for libsodium instead of BoringSSL? Also, does it really make sense to create a separate crate for every crypto primitive (or small set of primitives)? This has so many obvious disadvantages compared to the "libsodium approach".
  - steveklabnik 9y ago
    I think it has pros and cons, honestly. I'm not aware of anyone porting libsodium, though it's also not my area of specialty.
    - vog 9y ago
      Of course maintaining some kind of "libsodium for rust" is more work, but on the other hand, a central project for rust crypto stuff is highly desirable: Even if initially run by mere crypto enthusiasts, such a central place is needed for the real crypto experts to condensate. Then, obsolete crypto can centally be deprecated and put with a warning, and competing implementations can be resolved at a central place getting (hopefully) all knowing people together to discuss. What's the alternative? That each individual developer has to pick and combine their favourite set of crypto libs, making crypto libs spread by popularity (which is more often than not a self-fulfilling prophecy) rather than actual quality.
      - steveklabnik 9y ago
        I don't see how these two things are at odds; said "central project" could author individual crates? They could even live in the same project, thanks to workspaces.
      - dbrgn 9y ago
        Tweetnacl (http://tweetnacl.cr.yp.to/ http://tweetnacl.cr.yp.to/) would be a good candidate for porting to Rust, since it's very small. Others have done it successfully in other languages: https://github.com/dchest/tweetnacl-js https://github.com/dchest/tweetnacl-js Someone has given it an attempt: https://github.com/jmesmon/sodalite https://github.com/jmesmon/sodalite But the port doesn't seem to be too mature yet. (Edit: For those not aware, Libsodium is based on a portable rewrite of NaCl.)
jandrese 9y ago
>> some github repo in some dudes repository which contributes to it in his spare time This is a little too close to how some real official crypto libraries are maintained. OpenSSL for example.

by 0xFFC 9y ago

Does Rust have official implementations of Crypto algorithms (in pure Rust)? I am not talking about some github repo in some dudes repository which contributes to it in his spare time.

steveklabnik 9y ago

I'm not sure what you mean by "official" exactly, but I think for any of them, the answer would be "no". That said, https://crates.io/crates/ring https://crates.io/crates/ring is what most people suggest you should reach for: it's a slow and steady port of BoringSSL's code to Rust + asm. Of course, that only has a subset of crypto; there's other great projects too, the tor people have been putting out crates like https://github.com/isislovecruft/curve25519-dalek https://github.com/isislovecruft/curve25519-dalek

vog 9y ago
Is there something like "ring" for libsodium instead of BoringSSL? Also, does it really make sense to create a separate crate for every crypto primitive (or small set of primitives)? This has so many obvious disadvantages compared to the "libsodium approach".
- steveklabnik 9y ago
  I think it has pros and cons, honestly. I'm not aware of anyone porting libsodium, though it's also not my area of specialty.
  - vog 9y ago
    Of course maintaining some kind of "libsodium for rust" is more work, but on the other hand, a central project for rust crypto stuff is highly desirable: Even if initially run by mere crypto enthusiasts, such a central place is needed for the real crypto experts to condensate. Then, obsolete crypto can centally be deprecated and put with a warning, and competing implementations can be resolved at a central place getting (hopefully) all knowing people together to discuss. What's the alternative? That each individual developer has to pick and combine their favourite set of crypto libs, making crypto libs spread by popularity (which is more often than not a self-fulfilling prophecy) rather than actual quality.
    - steveklabnik 9y ago
      I don't see how these two things are at odds; said "central project" could author individual crates? They could even live in the same project, thanks to workspaces.
    - dbrgn 9y ago
      Tweetnacl (http://tweetnacl.cr.yp.to/ http://tweetnacl.cr.yp.to/) would be a good candidate for porting to Rust, since it's very small. Others have done it successfully in other languages: https://github.com/dchest/tweetnacl-js https://github.com/dchest/tweetnacl-js Someone has given it an attempt: https://github.com/jmesmon/sodalite https://github.com/jmesmon/sodalite But the port doesn't seem to be too mature yet. (Edit: For those not aware, Libsodium is based on a portable rewrite of NaCl.)

jandrese 9y ago

>> some github repo in some dudes repository which contributes to it in his spare time This is a little too close to how some real official crypto libraries are maintained. OpenSSL for example.