aranya_crypto/
lib.rs

1//! The Aranya Cryptography Engine.
2//!
3//! # Overview
4//!
5//! Instead of performing ad-hoc cryptography, Aranya's
6//! cryptography is centralized inside of the *cryptography
7//! engine*. The cryptographic APIs provided by the cryptography
8//! engine are described in multiple documents, including the
9//! [IDAM crypto] spec.
10//!
11//! While it's generally referred to as *the* cryptography
12//! engine, it's important to note that there can be multiple
13//! implementations of the cryptography engine. The cryptography
14//! engine requires a particular set of primitives, but allows
15//! users to choose their own algorithms.
16//!
17//! # Design
18//!
19//! As mentioned above, the cryptography engine only requires
20//! certain cryptographic primitives, not algorithms. For
21//! instance, it requires an AEAD with at least a 128-bit
22//! security level, not AES-GCM.
23//!
24//! The set of algorithms is referred to as a *cipher suite*.
25//! Each algorithm has an identifier that distinguishes it from
26//! other algorithms implementing the same primitive. For
27//! example, the identifier for AES-256-GCM is different from the
28//! identifer for ChaCha20Poly1305. The identifiers for the
29//! algorithms used by a particular cipher suite are referred to
30//! as the cipher suite's identifier, or "suite IDs."
31//!
32//! Every cryptographic operation performed by the engine mixes
33//! in the cipher suite's identifier for domain separation and
34//! contextual binding purposes. Among other things, this helps
35//! prevent cross-version attacks.
36// TODO: Once the idam_crypto doc gets open sourced this link should be updated. <https://github.com/aranya-project/aranya-docs/issues/17>
37//! [IDAM crypto]: <https://git.spideroak-inc.com/spideroak-inc/aranya-docs/blob/idam-crypto-apis/src/idam_crypto.md>
38
39#![allow(unstable_name_collisions)]
40#![cfg_attr(docsrs, feature(doc_cfg))]
41#![cfg_attr(not(any(test, doctest, feature = "std")), no_std)]
42#![cfg_attr(not(all(test, feature = "trng")), deny(unsafe_code))]
43#![warn(missing_docs)]
44
45pub mod afc;
46pub mod apq;
47mod aranya;
48mod ciphersuite;
49pub mod default;
50pub mod engine;
51mod error;
52mod groupkey;
53mod hpke;
54pub mod id;
55pub mod keystore;
56mod misc;
57mod oid;
58pub mod policy;
59pub mod test_util;
60mod tests;
61pub mod tls;
62mod util;
63
64pub use aranya::*;
65pub use buggy;
66pub use ciphersuite::*;
67pub use default::Rng;
68pub use engine::{Engine, UnwrapError, WrapError};
69pub use error::*;
70pub use groupkey::*;
71pub use id::{BaseId, Identified, custom_id};
72pub use keystore::{KeyStore, KeyStoreExt};
73// These were already exported in the root of the crate, so keep
74// them even though `policy` is a public module now.
75pub use policy::{Cmd, CmdId, PolicyId, merge_cmd_id};
76#[doc(no_inline)]
77#[cfg(feature = "bearssl")]
78#[cfg_attr(docsrs, doc(cfg(feature = "bearssl")))]
79pub use spideroak_crypto::bearssl;
80/// Constant time cryptographic operations.
81#[doc(inline)]
82pub use spideroak_crypto::subtle;
83#[doc(inline)]
84pub use spideroak_crypto::{
85    csprng::{Csprng, Random},
86    zeroize,
87};
88pub use spideroak_crypto::{generic_array, typenum};
89
90/// Dangerous cryptography.
91pub mod dangerous {
92    #[doc(inline)]
93    pub use siphasher;
94    #[doc(inline)]
95    pub use spideroak_crypto;
96}
aranya_crypto/lib.rs

aranya_crypto/
lib.rs
