oxitls-rustcrypto-provider 0.2.1

Pure-Rust RustCrypto rustls CryptoProvider with the RUSTSEC-2026-0104 fix (rustls-webpki CRL-panic): webpki dependency removed, algorithm identifiers routed through rustls-pki-types.
docs.rs failed to build oxitls-rustcrypto-provider-0.2.1
Please check the build logs for more information.
See Builds for ideas on how to fix a failed build, or Metadata for how to configure docs.rs builds.
If you believe this is docs.rs' fault, open an issue.

OxiTLS vendored fork. This is a copy of rustls-rustcrypto vendored into the OxiTLS workspace as the oxitls-rustcrypto-provider crate. It exists to fix RUSTSEC-2026-0104 — a CRL-parsing panic in rustls-webpki 0.102.x. The patched copy drops the vulnerable rustls-webpki dependency and routes alg_id through rustls-pki-types instead. It is a full workspace member (see the root Cargo.toml [workspace] members list); the root Cargo.toml resolves the rustls-rustcrypto workspace dependency to this crate via a package rename (rustls-rustcrypto = { package = "oxitls-rustcrypto-provider", ... }), not a [patch.crates-io] override. The original upstream README follows unchanged.

rustls-rustcrypto

crate Docs Build Status Apache2/MIT licensed Rust Version Project Chat

RustCrypto-based provider implementation for version 0.23 of rustls, maintained by the RustCrypto organization.

⚠️USE THIS AT YOUR OWN RISK! DO NOT USE THIS IN PRODUCTION⚠️

Not only that this is incomplete that only few selected TLS suites implemented (it should be well enough to cover 70% of the usage), but the elephant in the room is that neither did rustls nor RustCrypto packages were formally verified and certified with FIPS compliance.

Note that RustCrypto performance is generally inferior than ring, but in exchange you got a pure Rust implementation that theoretically compiles everywhere Rust was ported to. In our case, we need to have std but foundational support for future no_std expansion is already here.

Supported Cipher Suites

  • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  • TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  • TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
  • TLS13_AES_128_GCM_SHA256
  • TLS13_AES_256_GCM_SHA384
  • TLS13_CHACHA20_POLY1305_SHA256

License

Licensed under either of:

at your option.

Some code authored by @ctz was adapted from upstream rustls. Licensed as above with permission.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.