6 ms·

AWS Libcrypto for Rust

91 points by jrpelkonen 3y ago

gfs 3y ago
> aws-lc-rs is a cryptographic library using AWS-LC for its cryptographic operations. Why should I use AWS-LC over the myriad cryptography libraries out there already?
- koolba 3y ago
  I would wager this is a big reason: > This crate provides bindings to AWS-LC-FIPS 2.x, which has completed FIPS validation testing by an accredited lab and has been submitted to NIST for certification. If you are in a regulated environment, that’s reason enough.
  - fitzoh 3y ago
    Exactly, see the "Motivation" section of the README
  - colmmacc 3y ago
    Another nice reason is that AWS-LC includes rewrites and optimizations that make it faster than alternatives, especially on Graviton.
    - jpgvm 3y ago
      Are there benches on this vs say OpenSSL on Graviton and Apple M chips? I would be curious how big the difference is vs whatever NEON optimizations are in OpenSSL (and friends) already.
- JoshTriplett 3y ago
  One reason: you can use this as a backend to rustls, and then you no longer have anything under the OpenSSL license in your dependencies, which improves the license compatibility of your project.
  - briansmith 3y ago
    Again, this is just a temporary situation, and a matter of burning down a list of small tasks. Not that the OpenSSL license issue is a big deal for most anyway. Feel free to help; see this issue filed by Josh Triplett: https://github.com/briansmith/ring/issues/1318#issuecomment-1890239223 https://github.com/briansmith/ring/issues/1318#issuecomment-...
    - JoshTriplett 3y ago
      Yeah, I realize, and I am looking forward to having multiple options to choose from that all have the same license compatibility. It's nice that there's a short-term solution that's available for people who need to ship things soon, and it's nice that there's a longstanding library (ring) that'll long-term will be capable of providing a compatible solution as well.
    - deleted 3y ago
      [deleted]
    - littlestymaar 3y ago
      > see this issue filed by Josh Triplett Check who you are replying to ;)
Thaxll 3y ago
It's just a wrapper arround aws-lc which is 100% C++/C/ASM.
- brundolf 3y ago
  It still matters for the ecosystem to have SDKs available for use
- methodical 3y ago
  It's incredible how many Rust packages are just wrappers around C++ implementations. That being said, as a weekend rustacean (I hate saying it but couldn't resist the urge) and current user of tch-rs (a rust PyTorch C++ wrapper) I'm glad somebody out there is writing the interfaces to allow more functionality in Rust. It's probably a good thing that C++ is so established since it allows these types of packages to come to fruition without the leg work of an actual re-implementation of the same logic in Rust from scratch.
  - catgary 3y ago
    Have you looked at burn.dev? It’s kind of a neat approach where they backend to torch/candle/other things and are also building a pure Rust backend that compiles to webgpu shaders.
    - paholg 3y ago
      There's also dfdx, which is pure Rust and really leverages the type system.
  - bee_rider 3y ago
    It seems odd but it makes sense, right? Rust prevents a whole class of bugs. But, reusing existing code that’s already well debugged and battle-tested prevents even more bugs!
  - IshKebab 3y ago
    I think it's actually surprising how few crates are C++ wrappers. You can really tell if you try and cross-compile big Rust programs because it's always the C/C++ wrapper crates that cause issues and 90% of the time it's OpenSSL. There are more wrappers than in Go, but probably fewer than Python.
rusbus 3y ago
How crazy is the build chain these days? Well, to build it in FIPS mode you need a Go compiler!
- guardiangod 3y ago
  Go is only needed to build the test suite. /I asked the same question and got this from the dev.
cryptonector 3y ago
Joy!
arpinum 3y ago
Blog post with performance chart: https://aws.amazon.com/blogs/security/aws-lc-is-now-fips-140-3-certified/ https://aws.amazon.com/blogs/security/aws-lc-is-now-fips-140...
jedisct1 3y ago
There's also an open issue in Boring (the crate for BoringSSL) to enforce usage of FIPS https://github.com/cloudflare/boring/issues/182 https://github.com/cloudflare/boring/issues/182

91 points by jrpelkonen 3y ago

gfs 3y ago

> aws-lc-rs is a cryptographic library using AWS-LC for its cryptographic operations. Why should I use AWS-LC over the myriad cryptography libraries out there already?

koolba 3y ago
I would wager this is a big reason: > This crate provides bindings to AWS-LC-FIPS 2.x, which has completed FIPS validation testing by an accredited lab and has been submitted to NIST for certification. If you are in a regulated environment, that’s reason enough.
- fitzoh 3y ago
  Exactly, see the "Motivation" section of the README
- colmmacc 3y ago
  Another nice reason is that AWS-LC includes rewrites and optimizations that make it faster than alternatives, especially on Graviton.
  - jpgvm 3y ago
    Are there benches on this vs say OpenSSL on Graviton and Apple M chips? I would be curious how big the difference is vs whatever NEON optimizations are in OpenSSL (and friends) already.
JoshTriplett 3y ago
One reason: you can use this as a backend to rustls, and then you no longer have anything under the OpenSSL license in your dependencies, which improves the license compatibility of your project.
- briansmith 3y ago
  Again, this is just a temporary situation, and a matter of burning down a list of small tasks. Not that the OpenSSL license issue is a big deal for most anyway. Feel free to help; see this issue filed by Josh Triplett: https://github.com/briansmith/ring/issues/1318#issuecomment-1890239223 https://github.com/briansmith/ring/issues/1318#issuecomment-...
  - JoshTriplett 3y ago
    Yeah, I realize, and I am looking forward to having multiple options to choose from that all have the same license compatibility. It's nice that there's a short-term solution that's available for people who need to ship things soon, and it's nice that there's a longstanding library (ring) that'll long-term will be capable of providing a compatible solution as well.
  - deleted 3y ago
    [deleted]
  - littlestymaar 3y ago
    > see this issue filed by Josh Triplett Check who you are replying to ;)

Thaxll 3y ago

It's just a wrapper arround aws-lc which is 100% C++/C/ASM.

brundolf 3y ago
It still matters for the ecosystem to have SDKs available for use
methodical 3y ago
It's incredible how many Rust packages are just wrappers around C++ implementations. That being said, as a weekend rustacean (I hate saying it but couldn't resist the urge) and current user of tch-rs (a rust PyTorch C++ wrapper) I'm glad somebody out there is writing the interfaces to allow more functionality in Rust. It's probably a good thing that C++ is so established since it allows these types of packages to come to fruition without the leg work of an actual re-implementation of the same logic in Rust from scratch.
- catgary 3y ago
  Have you looked at burn.dev? It’s kind of a neat approach where they backend to torch/candle/other things and are also building a pure Rust backend that compiles to webgpu shaders.
  - paholg 3y ago
    There's also dfdx, which is pure Rust and really leverages the type system.
- bee_rider 3y ago
  It seems odd but it makes sense, right? Rust prevents a whole class of bugs. But, reusing existing code that’s already well debugged and battle-tested prevents even more bugs!
- IshKebab 3y ago
  I think it's actually surprising how few crates are C++ wrappers. You can really tell if you try and cross-compile big Rust programs because it's always the C/C++ wrapper crates that cause issues and 90% of the time it's OpenSSL. There are more wrappers than in Go, but probably fewer than Python.

rusbus 3y ago

How crazy is the build chain these days? Well, to build it in FIPS mode you need a Go compiler!

guardiangod 3y ago
Go is only needed to build the test suite. /I asked the same question and got this from the dev.

cryptonector 3y ago

Joy!

arpinum 3y ago

Blog post with performance chart: https://aws.amazon.com/blogs/security/aws-lc-is-now-fips-140-3-certified/ https://aws.amazon.com/blogs/security/aws-lc-is-now-fips-140...

jedisct1 3y ago

There's also an open issue in Boring (the crate for BoringSSL) to enforce usage of FIPS https://github.com/cloudflare/boring/issues/182 https://github.com/cloudflare/boring/issues/182