aws-lc-rs

aws-lc-rs is a cryptographic library for Rust that performs its operations using AWS-LC, Amazon’s maintained fork of BoringSSL/OpenSSL. It deliberately mirrors the API of the popular ring crate (v0.16), so existing ring-based code can adopt it with minimal changes while gaining a library that is actively maintained by AWS.

Under the hood it calls into AWS-LC through auto-generated FFI bindings (aws-lc-sys, or aws-lc-fips-sys for FIPS builds). It provides the common cryptographic building blocks applications need, including AEAD ciphers, digests, HMAC, HKDF, digital signatures, key agreement, and post-quantum KEM, with an optional FIPS-validated mode for regulated environments.

What You Get

• A ring-compatible API so existing ring-based code migrates with minimal changes
• AEAD ciphers (AES-GCM, ChaCha20-Poly1305), digests, HMAC, and HKDF
• Digital signatures and key agreement (ECDSA, EdDSA, RSA, ECDH) plus post-quantum KEM
• An optional FIPS mode backed by the FIPS-validated build of AWS-LC
• Cryptographic operations delegated to the maintained, high-performance AWS-LC C library via FFI

Common Use Cases

• Adding AEAD encryption, hashing, or HMAC to a Rust service with a well-audited backend
• Migrating a project off the ring crate onto an AWS-maintained alternative
• Meeting FIPS 140 compliance requirements by enabling the FIPS-validated mode

Under The Hood

Architecture - The repository is a Cargo workspace with the safe, high-level aws-lc-rs crate on top and auto-generated FFI crates (aws-lc-sys, aws-lc-fips-sys) beneath it that bind to the AWS-LC C library. aws-lc-rs/src is organized by primitive (aead, digest, hmac, hkdf, agreement, signature/ec/ed25519, cipher, kdf, kem, rand), each module wrapping the corresponding AWS-LC calls behind a ring-shaped Rust API. A build script and the builder/ crate handle compiling or locating AWS-LC, and a fips.rs module gates the FIPS-validated code path.

Tech Stack - Rust (edition 2021) calling into the AWS-LC C/assembly library through generated bindings. The workspace uses standard Cargo tooling, with a builder crate and CMake/Docker/Cross configuration to build AWS-LC across targets; FIPS support links against the separately-validated aws-lc-fips-sys crate.

Code Quality - The project shows strong engineering discipline: a top health score, consistent maintenance, dedicated testing crates (aws-lc-rs-testing, builder-test, links-testing), per-primitive tests under aws-lc-rs/tests, plus a STYLE.md and documented build process. Delegating the actual cryptography to the audited AWS-LC keeps the Rust layer focused on safe wrapping.

API Design - By intentionally matching ring’s API, aws-lc-rs offers an interface already familiar to much of the Rust ecosystem, which lowers adoption cost and lets projects migrate with minimal churn. Modules are named after their primitives and the crate is well documented, though cryptographic APIs inherently demand care, keeping the learning curve moderate.