Rust Crypto

Cryptographic algorithms written in pure Rust. AEAD encryption, block/stream ciphers, hashes, elliptic curves, RSA, signatures, PKCS/PKIX, and more

[Rust Crypto @RustCryptoOrg]

[ANN] `ssh-key` v0.5.0: now with “sshsig” support (as supported by git v2.34.0 and above)
https://t.co/jUYSSnGlOC

[Rust Crypto @RustCryptoOrg]

The `p384` v0.11.0 crate release now includes a full arithmetic implementation, enabling both ECDSA and ECDH support, using field arithmetic implementations from `fiat-crypto`: https://t.co/tY1cmvSqGb

[Deirdre Connolly¹ @durumcrustulum]

Excited to use the new `hybrid-array` crate from @RustCryptoOrg ! It's like `generic-array` but with no `unsafe` under the hood, a bridge to using fully-featured const generics in expressions in the not-too-distant Rust future!

https://t.co/RCl026YXzd
https://t.co/0Wr0rsojTI

[Rust Crypto @RustCryptoOrg]

@durumcrustulum @matthew_d_green @kennwhite @LindellYehuda @ncweaver We have AES-GCM-SIV too! https://t.co/dlGKfQE5Zg

[Rust Crypto @RustCryptoOrg]

@encthenet @Keltounet Yes

[Rust Crypto @RustCryptoOrg]

@kennyog Yes, it ensures both r and s are valid nonzero elements of the scalar field

[Rust Crypto @RustCryptoOrg]

Our `ecdsa` crate prevents vulnerabilities like Java's CVE-2022-21449 using type safety.

We use a `NonZeroScalar` type to model the `r` and `s` components of an ECDSA signature. This prevents either of them from ever accidentally being zero.
https://t.co/4fpigNWTUt

[Rust Crypto @RustCryptoOrg]

@kennyog Yes, it ensures both r and s are valid nonzero elements of the scalar field

[Rust Crypto @RustCryptoOrg]

For context https://t.co/bE62oPXZBP

[Rust Crypto @RustCryptoOrg]

Announcing ssh-key v0.4: now with pure Rust keygen, certificate validation, and SSH CA support
https://t.co/of19yZCino

[Rust Crypto @RustCryptoOrg]

[ANN] `cmov` v0.1: constant-time conditional move intrinsics for x86/x86_64/aarch64 leveraging @rustlang 1.59's new stable inline assembly
https://t.co/bio7c8nTVJ

[Rust Crypto @RustCryptoOrg]

Announcing initial hash2curve support in the following @RustCryptoOrg elliptic curve crates:

- `k256` v0.10.2 (secp256k1)
- `p256` v0.10.1 (NIST P-256)

Repo: https://t.co/Kf8XJAiDZx

See trait documentation here:
https://t.co/dJdhUW5nAa

[Armin Ronacher ⇌ @mitsuhiko]

My sha1 crate is now called sha1_smol for when you need a dependency free version. Major versions of the sha1 crate in the future will refer to the RustCrypto SHA1 implementation. Users of the 0.6 line of sha1 are auto migrated to sha1_smol. https://t.co/NK0nsSxFLb

[Rust Crypto @RustCryptoOrg]

[ANN] `ssh-key` v0.2.0: no_std-friendly constant-time parser for OpenSSH private/public keys
https://t.co/a0cvGwDSXQ

[Rust Crypto @RustCryptoOrg]

[ANN] `crypto-bigint` v0.3.0: @rustlang big integer library designed for cryptography use cases.

Repo: https://t.co/nsM0En31cG

Docs: https://t.co/iQimqWZKFs

[Rust Crypto @RustCryptoOrg]

`crypto-bigint` v0.2.6 has been released.

Among other new features, it adds support for encoding `UInt` types using Recursive Length Prefix (RLP) encoding
https://t.co/hcBt7TCz4w

[Tony "Abolish ICE" Arcieri 🦀🌹 @bascule]

"Password auth in Rust, from scratch - Attacks and best practices"

Tutorial on how to do Argon2 in Rust using the @RustCryptoOrg `argon2` crate, part of the "Zero To Production In Rust" series:
https://t.co/VNQdCzcxPD

[Rust Crypto @RustCryptoOrg]

Why is constant-time PEM encoding important for an RSA library?

A forthcoming paper illustrates RSA key extraction from SGX enclaves using PEM/Base64 sidechannels alone:
https://t.co/3mQJU60tHH

[Rust Crypto @RustCryptoOrg]

[ANN] `rsa` v0.5.0: pure @rustlang implementation of the RSA public key cipher and digital signature algorithm.

This release includes constant-time PEM decoding/encoding for PKCS#1 and PKCS#8 keys.

- repo: https://t.co/pnwQPyKfr6
- docs: https://t.co/wBCiHL3x8L

[Tony "Abolish ICE" Arcieri 🦀🌹 @bascule]

In a moment of serendipity I just so happen to have published a new @RustCryptoOrg strict PEM parser which not only uses a constant time Base64 implementation but in the happy path completely avoids any branching or table lookups on potentially secret data
https://t.co/86ULrBIyED

[Rust Crypto @RustCryptoOrg]

@derekilikered Likewise, we use constant-time scalar inversions for ECDSA verification, where variable-time inversions could potentially be faster.

[Rust Crypto @RustCryptoOrg]

Updated ECDSA/secp256k1 benchmarks comparing:

- @RustCryptoOrg's pure Rust `k256` crate
- The pure Rust `libsecp256k1` crate
- The `secp256k1` crate (FFI wrapper for the bitcoin-core C library)

Faster is better.

[Rust Crypto @RustCryptoOrg]

@derekilikered There are many other low-hanging fruit optimizations to pursue as yet.

For example, we don't yet precompute powers of the generator, which would also speed up verification.

We also use constant-time formulas for ECDSA verification. Things might be improved by e.g. wNAF.