rustls/crypto/ring/
mod.rs

1use crate::crypto::{CryptoProvider, KeyProvider, SecureRandom};
2use crate::enums::SignatureScheme;
3use crate::rand::GetRandomFailed;
4use crate::sign::SigningKey;
5use crate::suites::SupportedCipherSuite;
6use crate::webpki::WebPkiSupportedAlgorithms;
7use crate::Error;
8
9use pki_types::PrivateKeyDer;
10use webpki::ring as webpki_algs;
11
12use alloc::sync::Arc;
13
14pub(crate) use ring as ring_like;
15
16/// Using software keys for authentication.
17pub mod sign;
18
19pub(crate) mod hash;
20pub(crate) mod hmac;
21pub(crate) mod kx;
22pub(crate) mod quic;
23pub(crate) mod ticketer;
24#[cfg(feature = "tls12")]
25pub(crate) mod tls12;
26pub(crate) mod tls13;
27
28/// A `CryptoProvider` backed by the [*ring*] crate.
29///
30/// [*ring*]: https://github.com/briansmith/ring
31pub fn default_provider() -> CryptoProvider {
32    CryptoProvider {
33        cipher_suites: DEFAULT_CIPHER_SUITES.to_vec(),
34        kx_groups: ALL_KX_GROUPS.to_vec(),
35        signature_verification_algorithms: SUPPORTED_SIG_ALGS,
36        secure_random: &Ring,
37        key_provider: &Ring,
38    }
39}
40
41/// Default crypto provider.
42#[derive(Debug)]
43struct Ring;
44
45impl SecureRandom for Ring {
46    fn fill(&self, buf: &mut [u8]) -> Result<(), GetRandomFailed> {
47        use ring_like::rand::SecureRandom;
48
49        ring_like::rand::SystemRandom::new()
50            .fill(buf)
51            .map_err(|_| GetRandomFailed)
52    }
53}
54
55impl KeyProvider for Ring {
56    fn load_private_key(
57        &self,
58        key_der: PrivateKeyDer<'static>,
59    ) -> Result<Arc<dyn SigningKey>, Error> {
60        sign::any_supported_type(&key_der)
61    }
62}
63
64/// The cipher suite configuration that an application should use by default.
65///
66/// This will be [`ALL_CIPHER_SUITES`] sans any supported cipher suites that
67/// shouldn't be enabled by most applications.
68pub static DEFAULT_CIPHER_SUITES: &[SupportedCipherSuite] = ALL_CIPHER_SUITES;
69
70/// A list of all the cipher suites supported by the rustls *ring* provider.
71pub static ALL_CIPHER_SUITES: &[SupportedCipherSuite] = &[
72    // TLS1.3 suites
73    tls13::TLS13_AES_256_GCM_SHA384,
74    tls13::TLS13_AES_128_GCM_SHA256,
75    tls13::TLS13_CHACHA20_POLY1305_SHA256,
76    // TLS1.2 suites
77    #[cfg(feature = "tls12")]
78    tls12::TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
79    #[cfg(feature = "tls12")]
80    tls12::TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
81    #[cfg(feature = "tls12")]
82    tls12::TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
83    #[cfg(feature = "tls12")]
84    tls12::TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
85    #[cfg(feature = "tls12")]
86    tls12::TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
87    #[cfg(feature = "tls12")]
88    tls12::TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
89];
90
91/// All defined cipher suites supported by *ring* appear in this module.
92pub mod cipher_suite {
93    #[cfg(feature = "tls12")]
94    pub use super::tls12::{
95        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
96        TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
97        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
98    };
99    pub use super::tls13::{
100        TLS13_AES_128_GCM_SHA256, TLS13_AES_256_GCM_SHA384, TLS13_CHACHA20_POLY1305_SHA256,
101    };
102}
103
104/// A `WebPkiSupportedAlgorithms` value that reflects webpki's capabilities when
105/// compiled against *ring*.
106static SUPPORTED_SIG_ALGS: WebPkiSupportedAlgorithms = WebPkiSupportedAlgorithms {
107    all: &[
108        webpki_algs::ECDSA_P256_SHA256,
109        webpki_algs::ECDSA_P256_SHA384,
110        webpki_algs::ECDSA_P384_SHA256,
111        webpki_algs::ECDSA_P384_SHA384,
112        webpki_algs::ED25519,
113        webpki_algs::RSA_PSS_2048_8192_SHA256_LEGACY_KEY,
114        webpki_algs::RSA_PSS_2048_8192_SHA384_LEGACY_KEY,
115        webpki_algs::RSA_PSS_2048_8192_SHA512_LEGACY_KEY,
116        webpki_algs::RSA_PKCS1_2048_8192_SHA256,
117        webpki_algs::RSA_PKCS1_2048_8192_SHA384,
118        webpki_algs::RSA_PKCS1_2048_8192_SHA512,
119        webpki_algs::RSA_PKCS1_3072_8192_SHA384,
120    ],
121    mapping: &[
122        // Note: for TLS1.2 the curve is not fixed by SignatureScheme. For TLS1.3 it is.
123        (
124            SignatureScheme::ECDSA_NISTP384_SHA384,
125            &[
126                webpki_algs::ECDSA_P384_SHA384,
127                webpki_algs::ECDSA_P256_SHA384,
128            ],
129        ),
130        (
131            SignatureScheme::ECDSA_NISTP256_SHA256,
132            &[
133                webpki_algs::ECDSA_P256_SHA256,
134                webpki_algs::ECDSA_P384_SHA256,
135            ],
136        ),
137        (SignatureScheme::ED25519, &[webpki_algs::ED25519]),
138        (
139            SignatureScheme::RSA_PSS_SHA512,
140            &[webpki_algs::RSA_PSS_2048_8192_SHA512_LEGACY_KEY],
141        ),
142        (
143            SignatureScheme::RSA_PSS_SHA384,
144            &[webpki_algs::RSA_PSS_2048_8192_SHA384_LEGACY_KEY],
145        ),
146        (
147            SignatureScheme::RSA_PSS_SHA256,
148            &[webpki_algs::RSA_PSS_2048_8192_SHA256_LEGACY_KEY],
149        ),
150        (
151            SignatureScheme::RSA_PKCS1_SHA512,
152            &[webpki_algs::RSA_PKCS1_2048_8192_SHA512],
153        ),
154        (
155            SignatureScheme::RSA_PKCS1_SHA384,
156            &[webpki_algs::RSA_PKCS1_2048_8192_SHA384],
157        ),
158        (
159            SignatureScheme::RSA_PKCS1_SHA256,
160            &[webpki_algs::RSA_PKCS1_2048_8192_SHA256],
161        ),
162    ],
163};
164
165/// All defined key exchange groups supported by *ring* appear in this module.
166///
167/// [`ALL_KX_GROUPS`] is provided as an array of all of these values.
168pub mod kx_group {
169    pub use super::kx::SECP256R1;
170    pub use super::kx::SECP384R1;
171    pub use super::kx::X25519;
172}
173
174pub use kx::ALL_KX_GROUPS;
175pub use ticketer::Ticketer;
176
177/// Compatibility shims between ring 0.16.x and 0.17.x API
178mod ring_shim {
179    use super::ring_like;
180    use crate::crypto::SharedSecret;
181
182    pub(super) fn agree_ephemeral(
183        priv_key: ring_like::agreement::EphemeralPrivateKey,
184        peer_key: &ring_like::agreement::UnparsedPublicKey<&[u8]>,
185    ) -> Result<SharedSecret, ()> {
186        ring_like::agreement::agree_ephemeral(priv_key, peer_key, |secret| {
187            SharedSecret::from(secret)
188        })
189        .map_err(|_| ())
190    }
191}
rustls/crypto/ring/mod.rs

rustls/crypto/ring/
mod.rs
