Usage of RustCrypto in TLS Verifier

[KerneyJ]

Summary

RustCrypto provider for Rustls should not be used in production because
it has not been externally verified for FIPS compliance. We should discuss
which crypto provider we should use for Rustls.

Crypto providers to consider

1. aws-lc-rs

• Pro: Covers all TLS suites
• Pro: FIPS 140-3 support available (testing complete, NIST certification pending)
• Con: Requires cmake build dependency

2. ring

• Pro: Production-ready, well-tested
• Pro: Simpler build dependencies
• Con: 15-21% slower than aws-lc-rs, no FIPS support

3. rustls-rustcrypto

• Pro: Pure Rust thus it is maximally compatible
• Production warning, no audit, incomplete, slower

Proposed solution

• Use the cargo "feature" mechanism to make the crypto provider optional
• Default to aws-lc-rs since it is faster and compliant

Resources

• aws-lc-rs Repository
• rustls-rustcrypto Repository
• Rustls Performance Analysis
• Rustls FIPS Support

[patricklyc]

Stated criteria

• Reasonably fast
• Production ready
• Supports ed25519 keys
• Easy to build
• Works everywhere
• Statically linked binary
• Externally verified?
• FIPS support (optional)

Candidate libraries

aws-lc-rs

Successfully built with Cargo.toml adjusted and a simple search and replace in src/connect.rs, and passed e2e tests.

No additional build dependencies required when building without FIPS support:

FIPS support is out since aws-lc-fips-sys failed to build with the following error:

Supported platforms:

ring

Successfully built with Cargo.toml adjusted and a simple search and replace in src/connect.rs, and passed e2e tests.

Was externally audited along with rustls.

Since ring is currently already included in Cargo.toml, it shouldn't present any additional problems in building for different platforms.

graviola

Perhaps worth mentioning is graviola, a new library by the creator of rustls. It is pure Rust, fits most criteria except production readiness, and not working everywhere. But maybe worth keeping an eye on if these limitations are overcome in the future.

Benchmarks

There is a benchmark comparing the above candidates along with rustcrypto. Unfortunately, ed25519 signing is not tested.

My recommendation

ring makes the most sense since it is already required and fits all criteria.
Pluggable crypto provider seem unnecessary since there are two candidates that fit all criteria (except for FIPS support).