rustls-rustcrypto

rustls-rustcrypto is a cryptography provider for version 0.23 of the Rustls TLS library, implemented entirely with pure-Rust algorithm crates from the RustCrypto organization. It lets Rustls run without the default ring provider (which pulls in C/assembly), which is useful where a fully pure-Rust build, broad platform portability, or a specific crypto stack is required.

The crate wires RustCrypto implementations of AES-GCM, ChaCha20-Poly1305, ECDSA, RSA, ed25519, x25519, SHA-2, and HMAC into Rustls’s provider interface, supporting a common set of TLS 1.2 and TLS 1.3 cipher suites. It is explicitly pre-1.0 and its authors mark it not-for-production and not FIPS-certified, so it is best treated as an alternative provider for experimentation, constrained targets, and pure-Rust builds.

What You Get

• A drop-in Rustls 0.23 CryptoProvider built from RustCrypto crates
• Common TLS 1.2 and TLS 1.3 cipher suites (AES-GCM, ChaCha20-Poly1305)
• ECDSA, RSA, ed25519, and x25519 key exchange and signing support
• A pure-Rust dependency graph with no ring or OpenSSL C code
• Feature flags for std, tls12, zeroize, and logging

Common Use Cases

• Running Rustls without the ring provider for a fully pure-Rust build
• Targeting platforms where ring’s assembly is unavailable or undesirable
• Experimenting with a RustCrypto-based TLS stack for research or portability

Under The Hood

Architecture - The crate implements Rustls’s provider traits across focused modules: src/kx.rs (key exchange), src/sign and src/verify (signing/verification), src/aead.rs and src/aead (AEAD suites), src/hash.rs, src/hmac.rs, and src/quic.rs, assembled through src/lib.rs into a CryptoProvider. Tech Stack - Rust edition 2021 (MSRV 1.75) depending on rustls 0.23 plus the RustCrypto family: aes-gcm, chacha20poly1305, ecdsa, p256/p384, rsa, ed25519-dalek, x25519-dalek, sha2, hmac, and rustls-pki-types, all with default-features disabled to keep the door open for no_std. Code Quality - The repo carries an extensive validation harness (validation/, tests-external/, examples-external/), a Makefile, and a CHANGELOG, though the README candidly warns it is incomplete and unverified, so tests emphasize interop over completeness. API Design - Usage mirrors Rustls conventions: obtain the provider and install it as the process or config crypto provider, so developers already familiar with Rustls need little new API surface.