3 ms·
Ring is not that great tbh, not pure rust and the API is quite hard to use even for cryptography practitioners.
by baby 6y ago
Ring is not that great tbh, not pure rust and the API is quite hard to use even for cryptography practitioners.
- deleted 6y ago[deleted]
- dx87 6y agoPure rust wouldn't be good for a cryptography library because it doesn't have features like constant-time functions that mitigate side channel attacks.
- baby 6y agoAs much as C does
- kijiki 6y agoThe secure constant time implementations in Ring are from OpenSSL, and written in assembly, because that sort of code cannot be written safely in C or Rust.
- baby 6y agoI’ve read that kind of perl-generated assembly and honestly it is also unreadable and unauditable. I decided not to go for it for the project I’m working on and use pure rust libraries. But note that you can write inline assembly in rust too[1] [1]: https://doc.rust-lang.org/1.8.0/book/inline-assembly.html https://doc.rust-lang.org/1.8.0/book/inline-assembly.html I’ve also used tooling[2] to measure any timing issues in libraries like dalek (ed25519) and it couldn’t find any (so good luck if you’re trying to exploit that over the network) [2]: https://github.com/rozbb/dudect-bencher https://github.com/rozbb/dudect-bencher Today I’d be more worried by memory safety bugs created by the use of C or assembly, or logic bugs due to only a few people being able to audit an implementation.
- steveklabnik 6y agoThose asm docs are from Rust 1.8; the feature was completely re-written since then. https://github.com/rust-lang/rfcs/blob/master/text/2873-inline-asm.md https://github.com/rust-lang/rfcs/blob/master/text/2873-inli...
- h_anna_h 6y agoyes it can.