boring-rustls-provider 5.0.0

A BoringSSL-based rustls crypto provider with optional FIPS and post-quantum support
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105

use rustls::{SignatureScheme, Tls12CipherSuite, crypto};

use crate::{aead, hash, prf};

static ALL_ECDSA_SCHEMES: &[SignatureScheme] = &[
    SignatureScheme::ECDSA_NISTP256_SHA256,
    SignatureScheme::ECDSA_NISTP384_SHA384,
    SignatureScheme::ECDSA_NISTP521_SHA512,
    SignatureScheme::ED25519,
    SignatureScheme::ED448,
];

static ALL_RSA_SCHEMES: &[SignatureScheme] = &[
    SignatureScheme::RSA_PKCS1_SHA256,
    SignatureScheme::RSA_PKCS1_SHA384,
    SignatureScheme::RSA_PKCS1_SHA512,
    SignatureScheme::RSA_PSS_SHA256,
    SignatureScheme::RSA_PSS_SHA384,
    SignatureScheme::RSA_PSS_SHA512,
];

const PRF_SHA256: prf::PrfTls1WithDigest = prf::PrfTls1WithDigest(boring::nid::Nid::SHA256);
const PRF_SHA384: prf::PrfTls1WithDigest = prf::PrfTls1WithDigest(boring::nid::Nid::SHA384);

/// TLS 1.2 ECDHE-ECDSA with AES-128-GCM and SHA-256.
pub static ECDHE_ECDSA_AES128_GCM_SHA256: Tls12CipherSuite = Tls12CipherSuite {
    common: rustls::crypto::CipherSuiteCommon {
        suite: rustls::CipherSuite::TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
        hash_provider: hash::SHA256,
        confidentiality_limit: 1 << 23,
    },
    aead_alg: &aead::Aead::<aead::aes::Aes128>::DEFAULT,
    prf_provider: &PRF_SHA256,
    kx: crypto::KeyExchangeAlgorithm::ECDHE,
    sign: ALL_ECDSA_SCHEMES,
};

/// TLS 1.2 ECDHE-RSA with AES-128-GCM and SHA-256.
pub static ECDHE_RSA_AES128_GCM_SHA256: Tls12CipherSuite = Tls12CipherSuite {
    common: rustls::crypto::CipherSuiteCommon {
        suite: rustls::CipherSuite::TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        hash_provider: hash::SHA256,
        confidentiality_limit: 1 << 23,
    },
    aead_alg: &aead::Aead::<aead::aes::Aes128>::DEFAULT,
    prf_provider: &PRF_SHA256,
    kx: crypto::KeyExchangeAlgorithm::ECDHE,
    sign: ALL_RSA_SCHEMES,
};

/// TLS 1.2 ECDHE-ECDSA with AES-256-GCM and SHA-384.
pub static ECDHE_ECDSA_AES256_GCM_SHA384: Tls12CipherSuite = Tls12CipherSuite {
    common: rustls::crypto::CipherSuiteCommon {
        suite: rustls::CipherSuite::TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
        hash_provider: hash::SHA384,
        confidentiality_limit: 1 << 23,
    },
    aead_alg: &aead::Aead::<aead::aes::Aes256>::DEFAULT,
    prf_provider: &PRF_SHA384,
    kx: crypto::KeyExchangeAlgorithm::ECDHE,
    sign: ALL_ECDSA_SCHEMES,
};

/// TLS 1.2 ECDHE-RSA with AES-256-GCM and SHA-384.
pub static ECDHE_RSA_AES256_GCM_SHA384: Tls12CipherSuite = Tls12CipherSuite {
    common: rustls::crypto::CipherSuiteCommon {
        suite: rustls::CipherSuite::TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
        hash_provider: hash::SHA384,
        confidentiality_limit: 1 << 23,
    },
    aead_alg: &aead::Aead::<aead::aes::Aes256>::DEFAULT,
    prf_provider: &PRF_SHA384,
    kx: crypto::KeyExchangeAlgorithm::ECDHE,
    sign: ALL_RSA_SCHEMES,
};

/// TLS 1.2 ECDHE-ECDSA with ChaCha20-Poly1305 and SHA-256.
///
/// Not available in FIPS mode.
pub static ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: Tls12CipherSuite = Tls12CipherSuite {
    common: rustls::crypto::CipherSuiteCommon {
        suite: rustls::CipherSuite::TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
        hash_provider: hash::SHA256,
        confidentiality_limit: u64::MAX,
    },
    aead_alg: &aead::Aead::<aead::chacha20::ChaCha20Poly1305>::DEFAULT,
    prf_provider: &PRF_SHA256,
    kx: crypto::KeyExchangeAlgorithm::ECDHE,
    sign: ALL_ECDSA_SCHEMES,
};

/// TLS 1.2 ECDHE-RSA with ChaCha20-Poly1305 and SHA-256.
///
/// Not available in FIPS mode.
pub static ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: Tls12CipherSuite = Tls12CipherSuite {
    common: rustls::crypto::CipherSuiteCommon {
        suite: rustls::CipherSuite::TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
        hash_provider: hash::SHA256,
        confidentiality_limit: u64::MAX,
    },
    aead_alg: &aead::Aead::<aead::chacha20::ChaCha20Poly1305>::DEFAULT,
    prf_provider: &PRF_SHA256,
    kx: crypto::KeyExchangeAlgorithm::ECDHE,
    sign: ALL_RSA_SCHEMES,
};