rustls/crypto/ring/
mod.rs

1use alloc::borrow::Cow;
2use alloc::boxed::Box;
3
4use pki_types::PrivateKeyDer;
5pub(crate) use ring as ring_like;
6use webpki::ring as webpki_algs;
7
8use super::signer::SigningKey;
9use crate::crypto::{CryptoProvider, KeyProvider, SecureRandom, SupportedKxGroup};
10use crate::enums::SignatureScheme;
11use crate::rand::GetRandomFailed;
12use crate::webpki::WebPkiSupportedAlgorithms;
13use crate::{Error, Tls12CipherSuite, Tls13CipherSuite};
14
15/// Using software keys for authentication.
16pub mod sign;
17use sign::{EcdsaSigner, Ed25519Signer, RsaSigningKey};
18
19pub(crate) mod hash;
20pub(crate) mod hmac;
21pub(crate) mod kx;
22pub(crate) mod quic;
23#[cfg(feature = "std")]
24pub(crate) mod ticketer;
25pub(crate) mod tls12;
26pub(crate) mod tls13;
27
28/// The default `CryptoProvider` backed by [*ring*].
29///
30/// [*ring*]: https://github.com/briansmith/ring
31pub const DEFAULT_PROVIDER: CryptoProvider = CryptoProvider {
32    tls12_cipher_suites: Cow::Borrowed(DEFAULT_TLS12_CIPHER_SUITES),
33    tls13_cipher_suites: Cow::Borrowed(DEFAULT_TLS13_CIPHER_SUITES),
34    kx_groups: Cow::Borrowed(DEFAULT_KX_GROUPS),
35    signature_verification_algorithms: SUPPORTED_SIG_ALGS,
36    secure_random: &Ring,
37    key_provider: &Ring,
38};
39
40/// The default `CryptoProvider` backed by *ring* that only supports TLS1.3.
41pub const DEFAULT_TLS13_PROVIDER: CryptoProvider = CryptoProvider {
42    tls12_cipher_suites: Cow::Borrowed(&[]),
43    ..DEFAULT_PROVIDER
44};
45
46/// The default `CryptoProvider` backed by *ring* that only supports TLS1.2.
47///
48/// Use of TLS1.3 is **strongly** recommended.
49pub const DEFAULT_TLS12_PROVIDER: CryptoProvider = CryptoProvider {
50    tls13_cipher_suites: Cow::Borrowed(&[]),
51    ..DEFAULT_PROVIDER
52};
53
54/// Default crypto provider.
55#[derive(Debug)]
56struct Ring;
57
58impl SecureRandom for Ring {
59    fn fill(&self, buf: &mut [u8]) -> Result<(), GetRandomFailed> {
60        use ring_like::rand::SecureRandom;
61
62        ring_like::rand::SystemRandom::new()
63            .fill(buf)
64            .map_err(|_| GetRandomFailed)
65    }
66}
67
68impl KeyProvider for Ring {
69    fn load_private_key(
70        &self,
71        key_der: PrivateKeyDer<'static>,
72    ) -> Result<Box<dyn SigningKey>, Error> {
73        if let Ok(rsa) = RsaSigningKey::try_from(&key_der) {
74            return Ok(Box::new(rsa));
75        }
76
77        if let Ok(ecdsa) = EcdsaSigner::try_from(&key_der) {
78            return Ok(Box::new(ecdsa));
79        }
80
81        if let PrivateKeyDer::Pkcs8(pkcs8) = key_der {
82            if let Ok(eddsa) = Ed25519Signer::try_from(&pkcs8) {
83                return Ok(Box::new(eddsa));
84            }
85        }
86
87        Err(Error::General(
88            "failed to parse private key as RSA, ECDSA, or EdDSA".into(),
89        ))
90    }
91}
92
93/// The TLS1.2 cipher suite configuration that an application should use by default.
94///
95/// This will be [`ALL_TLS12_CIPHER_SUITES`] sans any supported cipher suites that
96/// shouldn't be enabled by most applications.
97pub static DEFAULT_TLS12_CIPHER_SUITES: &[&Tls12CipherSuite] = ALL_TLS12_CIPHER_SUITES;
98
99/// A list of all the TLS1.2 cipher suites supported by the rustls *ring* provider.
100pub static ALL_TLS12_CIPHER_SUITES: &[&Tls12CipherSuite] = &[
101    tls12::TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
102    tls12::TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
103    tls12::TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
104    tls12::TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
105    tls12::TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
106    tls12::TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
107];
108
109/// The TLS1.3 cipher suite configuration that an application should use by default.
110///
111/// This will be [`ALL_TLS13_CIPHER_SUITES`] sans any supported cipher suites that
112/// shouldn't be enabled by most applications.
113pub static DEFAULT_TLS13_CIPHER_SUITES: &[&Tls13CipherSuite] = ALL_TLS13_CIPHER_SUITES;
114
115/// A list of all the TLS1.3 cipher suites supported by the rustls *ring* provider.
116pub static ALL_TLS13_CIPHER_SUITES: &[&Tls13CipherSuite] = &[
117    tls13::TLS13_AES_256_GCM_SHA384,
118    tls13::TLS13_AES_128_GCM_SHA256,
119    tls13::TLS13_CHACHA20_POLY1305_SHA256,
120];
121
122/// All defined cipher suites supported by *ring* appear in this module.
123pub mod cipher_suite {
124    pub use super::tls12::{
125        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
126        TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
127        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
128    };
129    pub use super::tls13::{
130        TLS13_AES_128_GCM_SHA256, TLS13_AES_256_GCM_SHA384, TLS13_CHACHA20_POLY1305_SHA256,
131    };
132}
133
134/// A `WebPkiSupportedAlgorithms` value that reflects webpki's capabilities when
135/// compiled against *ring*.
136static SUPPORTED_SIG_ALGS: WebPkiSupportedAlgorithms = WebPkiSupportedAlgorithms {
137    all: &[
138        webpki_algs::ECDSA_P256_SHA256,
139        webpki_algs::ECDSA_P256_SHA384,
140        webpki_algs::ECDSA_P384_SHA256,
141        webpki_algs::ECDSA_P384_SHA384,
142        webpki_algs::ED25519,
143        webpki_algs::RSA_PSS_2048_8192_SHA256_LEGACY_KEY,
144        webpki_algs::RSA_PSS_2048_8192_SHA384_LEGACY_KEY,
145        webpki_algs::RSA_PSS_2048_8192_SHA512_LEGACY_KEY,
146        webpki_algs::RSA_PKCS1_2048_8192_SHA256,
147        webpki_algs::RSA_PKCS1_2048_8192_SHA384,
148        webpki_algs::RSA_PKCS1_2048_8192_SHA512,
149        webpki_algs::RSA_PKCS1_2048_8192_SHA256_ABSENT_PARAMS,
150        webpki_algs::RSA_PKCS1_2048_8192_SHA384_ABSENT_PARAMS,
151        webpki_algs::RSA_PKCS1_2048_8192_SHA512_ABSENT_PARAMS,
152    ],
153    mapping: &[
154        // Note: for TLS1.2 the curve is not fixed by SignatureScheme. For TLS1.3 it is.
155        (
156            SignatureScheme::ECDSA_NISTP384_SHA384,
157            &[
158                webpki_algs::ECDSA_P384_SHA384,
159                webpki_algs::ECDSA_P256_SHA384,
160            ],
161        ),
162        (
163            SignatureScheme::ECDSA_NISTP256_SHA256,
164            &[
165                webpki_algs::ECDSA_P256_SHA256,
166                webpki_algs::ECDSA_P384_SHA256,
167            ],
168        ),
169        (SignatureScheme::ED25519, &[webpki_algs::ED25519]),
170        (
171            SignatureScheme::RSA_PSS_SHA512,
172            &[webpki_algs::RSA_PSS_2048_8192_SHA512_LEGACY_KEY],
173        ),
174        (
175            SignatureScheme::RSA_PSS_SHA384,
176            &[webpki_algs::RSA_PSS_2048_8192_SHA384_LEGACY_KEY],
177        ),
178        (
179            SignatureScheme::RSA_PSS_SHA256,
180            &[webpki_algs::RSA_PSS_2048_8192_SHA256_LEGACY_KEY],
181        ),
182        (
183            SignatureScheme::RSA_PKCS1_SHA512,
184            &[webpki_algs::RSA_PKCS1_2048_8192_SHA512],
185        ),
186        (
187            SignatureScheme::RSA_PKCS1_SHA384,
188            &[webpki_algs::RSA_PKCS1_2048_8192_SHA384],
189        ),
190        (
191            SignatureScheme::RSA_PKCS1_SHA256,
192            &[webpki_algs::RSA_PKCS1_2048_8192_SHA256],
193        ),
194    ],
195};
196
197/// All defined key exchange groups supported by *ring* appear in this module.
198///
199/// [`ALL_KX_GROUPS`] is provided as an array of all of these values.
200/// [`DEFAULT_KX_GROUPS`] is provided as an array of this provider's defaults.
201pub mod kx_group {
202    pub use super::kx::{SECP256R1, SECP384R1, X25519};
203}
204
205/// A list of the default key exchange groups supported by this provider.
206pub static DEFAULT_KX_GROUPS: &[&dyn SupportedKxGroup] = ALL_KX_GROUPS;
207
208/// A list of all the key exchange groups supported by this provider.
209pub static ALL_KX_GROUPS: &[&dyn SupportedKxGroup] =
210    &[kx_group::X25519, kx_group::SECP256R1, kx_group::SECP384R1];
211
212#[cfg(feature = "std")]
213pub use ticketer::Ticketer;
214
215/// Compatibility shims between ring 0.16.x and 0.17.x API
216mod ring_shim {
217    use super::ring_like;
218    use crate::crypto::SharedSecret;
219
220    pub(super) fn agree_ephemeral(
221        priv_key: ring_like::agreement::EphemeralPrivateKey,
222        peer_key: &ring_like::agreement::UnparsedPublicKey<&[u8]>,
223    ) -> Result<SharedSecret, ()> {
224        ring_like::agreement::agree_ephemeral(priv_key, peer_key, |secret| {
225            SharedSecret::from(secret)
226        })
227        .map_err(|_| ())
228    }
229}
230
231pub(super) fn fips() -> bool {
232    false
233}
rustls/crypto/ring/mod.rs

rustls/crypto/ring/
mod.rs
