Crate rustls_ccm 

AES-CCM cipher suites for rustls.

Neither aws-lc-rs nor ring expose AES-CCM, so rustls’s built-in providers cannot offer these suites. This crate fills the gap using the RustCrypto aes + ccm crates, plugged in via rustls’s CryptoProvider extension point.

CCM cipher suites are required or recommended by several IoT and energy protocols, including IEEE 2030.5 (Smart Energy), Matter, Thread, and constrained-device TLS profiles (RFC 7925).

Cipher suites

TLS 1.2 (RFC 7251)

Suite	Tag	Key
TLS_ECDHE_ECDSA_WITH_AES_128_CCM	16 B	128-bit
TLS_ECDHE_ECDSA_WITH_AES_256_CCM	16 B	256-bit
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8	8 B	128-bit
TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8	8 B	256-bit

TLS 1.3 (RFC 8446)

Suite	Tag	Key
TLS13_AES_128_CCM_SHA256	16 B	128-bit
TLS13_AES_128_CCM_8_SHA256	8 B	128-bit

Limitations

Raw traffic-secret extraction for kTLS/hardware offload (dangerous_extract_secrets()) is not supported: ConnectionTrafficSecrets has no CCM variant, so extract_keys returns UnsupportedOperationError for all CCM suites. SSLKEYLOGFILE-style key logging (rustls::KeyLog) works normally — it is fed from the key schedule and does not involve extract_keys.

Usage

Use crypto_provider() for an aws-lc-rs provider with all CCM suites appended after the defaults (CCM is negotiated only when the peer offers nothing stronger), or pick individual suites and build your own provider.

let provider = rustls_ccm::crypto_provider();
let config = rustls::ClientConfig::builder_with_provider(provider.into())
    .with_safe_default_protocol_versions()
    .unwrap();

Statics

TLS13_AES_128_CCM_8_SHA256

TLS_AES_128_CCM_8_SHA256 (0x1305, RFC 8446).

TLS13_AES_128_CCM_SHA256

TLS_AES_128_CCM_SHA256 (0x1304, RFC 8446). Recommended=Y.

TLS_ECDHE_ECDSA_WITH_AES_128_CCM

TLS_ECDHE_ECDSA_WITH_AES_128_CCM (0xC0AC, RFC 7251).

TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8

TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 (0xC0AE, RFC 7251).

TLS_ECDHE_ECDSA_WITH_AES_256_CCM

TLS_ECDHE_ECDSA_WITH_AES_256_CCM (0xC0AD, RFC 7251).

TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8

TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 (0xC0AF, RFC 7251).

Functions

all_suites

All CCM cipher suites provided by this crate (TLS 1.2 + TLS 1.3).

crypto_provider

Returns an aws-lc-rs CryptoProvider with all CCM suites appended.