ferritls-rustls 0.4.0

rustls CryptoProvider adapter backed by ferritls-core (pure Rust)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103

//! 适配层 API 形状测试（M6/M7）。
//!
//! 清单断言防止套件/组清单与文档漂移；provider smoke 覆盖两个出厂
//! 配置的构成与 `fips()` 语义（认证前恒 false）。

#[test]
fn suite_inventory_matches_docs() {
    assert_eq!(ferritls_rustls::cipher::TLS13_SUITE_NAMES.len(), 4);
    assert!(ferritls_rustls::cipher::TLS13_SUITE_NAMES.contains(&"TLS_AES_128_GCM_SHA256"));
    assert!(ferritls_rustls::cipher::TLS13_SUITE_NAMES.contains(&"TLS_AES_256_GCM_SHA384"));
    assert!(ferritls_rustls::cipher::TLS13_SUITE_NAMES.contains(&"TLS_CHACHA20_POLY1305_SHA256"));
    assert!(ferritls_rustls::cipher::TLS13_SUITE_NAMES.contains(&"TLS_AES_128_CCM_SHA256"));
}

#[test]
fn kx_group_names_are_stable() {
    use rustls::NamedGroup;
    assert_eq!(ferritls_rustls::kx::X25519_GROUP.name(), NamedGroup::X25519);
    assert_eq!(
        ferritls_rustls::kx::SECP256R1_GROUP.name(),
        NamedGroup::secp256r1
    );
    assert_eq!(
        ferritls_rustls::kx::SECP384R1_GROUP.name(),
        NamedGroup::secp384r1
    );
    assert_eq!(
        ferritls_rustls::kx::X25519MLKEM768_GROUP.name(),
        NamedGroup::X25519MLKEM768
    );
    assert_eq!(ferritls_rustls::kx::ALL_KX_GROUPS.len(), 4);
    assert_eq!(ferritls_rustls::kx::FIPS_KX_GROUPS.len(), 3);
    // 混合组在两个清单中均为首项（PQ 优先）
    assert_eq!(
        ferritls_rustls::kx::ALL_KX_GROUPS[0].name(),
        NamedGroup::X25519MLKEM768
    );
    assert_eq!(
        ferritls_rustls::kx::FIPS_KX_GROUPS[0].name(),
        NamedGroup::X25519MLKEM768
    );
}

#[test]
fn default_provider_smoke() {
    let p = ferritls_rustls::default_provider();
    assert!(!p.fips(), "认证前 fips() 必须为 false");
    assert_eq!(p.cipher_suites.len(), 4);
    assert_eq!(p.kx_groups.len(), 4);
}

#[test]
fn fips_mode_provider_smoke() {
    let p = ferritls_rustls::fips_mode_provider();
    // 批准模式也必须为 false：批准模式 ≠ 已认证。
    assert!(!p.fips());
    assert_eq!(p.cipher_suites.len(), 3, "批准模式无 ChaCha20-Poly1305");
    assert_eq!(
        p.kx_groups.len(),
        3,
        "批准模式：X25519MLKEM768 混合 + P-256/384，无独立 X25519"
    );
}

/// X25519MLKEM768 端到端形状与共享秘密一致性（M8.3）：
/// 客户端 share 1216 B、服务端 share 1120 B、ss 64 B，两侧一致；
/// 篡改 share 必须被拒绝（ek 模校验 / 密文长度）。
#[test]
fn x25519_mlkem768_roundtrip_and_rejects() {
    use rustls::crypto::CompletedKeyExchange;
    let group = ferritls_rustls::kx::X25519MLKEM768_GROUP;

    // 正常往返（complete 消费 Box，负例先行）
    let client = group.start().expect("client start");
    assert_eq!(client.pub_key().len(), 1184 + 32, "客户端 share 形状");
    let server: CompletedKeyExchange = group
        .start_and_complete(client.pub_key())
        .expect("server start_and_complete");
    assert_eq!(server.pub_key.len(), 1088 + 32, "服务端 share 形状");

    // 负例 1：客户端 share 长度错误 → 服务端拒绝
    let mut bad_share = client.pub_key().to_vec();
    bad_share.pop();
    assert!(group.start_and_complete(&bad_share).is_err());

    // 负例 2：服务端 share 长度错误 → 客户端 complete 拒绝
    let client2 = group.start().expect("client start 2");
    let server2 = group
        .start_and_complete(client2.pub_key())
        .expect("server 2");
    let mut short = server2.pub_key.clone();
    short.pop();
    assert!(client2.complete(&short).is_err());

    // 正向 complete（消费 client）
    let ss_client = client.complete(&server.pub_key).expect("client complete");
    assert_eq!(ss_client.secret_bytes().len(), 64, "ss = ML-KEM ‖ X25519");
    assert_eq!(
        ss_client.secret_bytes(),
        server.secret.secret_bytes(),
        "两侧共享秘密一致"
    );
}