3 ms·

Also in referent news: "The State of TLS Stacks" by HAProxy devs https://www.haproxy.com/blog/state-of-ssl-stacks https://www.haproxy.com/blog/state-of-ssl-stac

Also in referent news: "The State of TLS Stacks" by HAProxy devs https://www.haproxy.com/blog/state-of-ssl-stacks https://www.haproxy.com/blog/state-of-ssl-stacks https://news.ycombinator.com/item?id=43912164 https://news.ycombinator.com/item?id=43912164 TLDR OpenSSL days seem to be coming to an end, but Rustls C bindings add not production ready yet.

Twirrim 1y ago
Would love to see compliance and accreditation coming through for native rusttls, like FIPS. That'll unlock a large potential market, which can in turn unlock other markets. You can get FIPS by using some of the third party back-end integration via aws-lc-rs.
- jaas 1y ago
  The default cryptographic back-end for Rustls, aws-lc-rs, is FIPS compliant and integrated in a FIPS-compliant way so it's easy to get FIPS compliance with Rustls.
jaas 1y ago
Rustls has two C APIs. The first is C bindings for the native Rustls API. This should work great for anyone who wants to use Rustls from C, but it means writing to the Rustls API. The second is C bindings that provide OpenSSL compatibility. This only supports a subset of the OpenSSL API (enough for Nginx but not yet HAProxy, for example), so not everything that uses OpenSSL will work with the Rustls OpenSSL compatibility layer yet. We are actively improving the amount of OpenSSL API surface that we support.
- tialaramex 1y ago
  I should probably help with that whole OpenSSL compat. thing. Is there guidance somewhere or should I just find something interesting to implement and send over a PR ?
  - jaas 1y ago
    The repository is here: https://github.com/rustls/rustls-openssl-compat https://github.com/rustls/rustls-openssl-compat We just work with normal issues/PRs, and there is a Rustls discord channel if you want to chat. We'd love your help!

3 ms·

Also in referent news: "The State of TLS Stacks" by HAProxy devs https://www.haproxy.com/blog/state-of-ssl-stacks https://www.haproxy.com/blog/state-of-ssl-stac

by pzmarzly 1y ago

Twirrim 1y ago
Would love to see compliance and accreditation coming through for native rusttls, like FIPS. That'll unlock a large potential market, which can in turn unlock other markets. You can get FIPS by using some of the third party back-end integration via aws-lc-rs.
- jaas 1y ago
  The default cryptographic back-end for Rustls, aws-lc-rs, is FIPS compliant and integrated in a FIPS-compliant way so it's easy to get FIPS compliance with Rustls.
jaas 1y ago
Rustls has two C APIs. The first is C bindings for the native Rustls API. This should work great for anyone who wants to use Rustls from C, but it means writing to the Rustls API. The second is C bindings that provide OpenSSL compatibility. This only supports a subset of the OpenSSL API (enough for Nginx but not yet HAProxy, for example), so not everything that uses OpenSSL will work with the Rustls OpenSSL compatibility layer yet. We are actively improving the amount of OpenSSL API surface that we support.
- tialaramex 1y ago
  I should probably help with that whole OpenSSL compat. thing. Is there guidance somewhere or should I just find something interesting to implement and send over a PR ?
  - jaas 1y ago
    The repository is here: https://github.com/rustls/rustls-openssl-compat https://github.com/rustls/rustls-openssl-compat We just work with normal issues/PRs, and there is a Rustls discord channel if you want to chat. We'd love your help!