Crate krabitls 

krabitls — a sans-io, no_std TLS 1.3 client for a fixed embedded profile.

Public surface lives in client (connection facade) and backends (config markers + RustCrypto trait impls). Everything else is internal.

Security

A hobby project — don’t use it for anything you care about. The crypto is hand-rolled and unaudited. The primitives are constant-time; power/EM-DPA blinding (TLS and DTLS key exchange + signing) is an opt-in behind the blinding feature, best-effort and not leakage-lab-validated. The bundled trust is pin-a-pubkey or trust-SAN — no CA bundle or chain walking — but verification is a pluggable VerifyStrategy, so a caller can supply their own. See the README for the full threat model.

Quick start

Drive a handshake with the bundled client::DefaultStream + client::DefaultScratch:

use krabitls::client::{
    ClientParams, DefaultScratch, DefaultStream, PinnedPubkey,
};

let mut scratch = DefaultScratch::new();
let params = ClientParams::pinned(
    "example.com",
    PinnedPubkey::Ed25519(server_pubkey),
)?;

let mut tls = DefaultStream::connect(
    &params, &mut scratch, transport, &mut rng,
)?;
tls.write_all(b"GET / HTTP/1.0\r\nHost: example.com\r\n\r\n")?;

let mut buf = [0u8; 1024];
let n = tls.read(&mut buf)?;
tls.close()?;

transport is any client::Transport (typically a blocking TcpStream wrapper); rng is any rand_core::TryCryptoRng.

Modules

backends

Default backend implementations of the crate-internal swap-point interfaces.

client

High-level TLS 1.3 client facade.

dtls

DTLS 1.3 (RFC 9147) datagram client.

Functions

hex_decode

Compile-time hex decoder for testdata/*.hex fixtures.