Skip to content

Add RustCrypto feature #42

Open
itsbalamurali wants to merge 1 commit into
njaremko:masterfrom
itsbalamurali:master
Open

Add RustCrypto feature #42
itsbalamurali wants to merge 1 commit into
njaremko:masterfrom
itsbalamurali:master

Conversation

@itsbalamurali

@itsbalamurali itsbalamurali commented Feb 3, 2024

Copy link
Copy Markdown

This is continuation of P.R #26 by @martinjlowm's Rust crypto work

@itsbalamurali
itsbalamurali marked this pull request as draft February 3, 2024 17:26
@itsbalamurali

itsbalamurali commented Feb 4, 2024

Copy link
Copy Markdown
Author

Waiting for RustCrypto team to release newer crates.

@itsbalamurali
itsbalamurali marked this pull request as ready for review February 6, 2024 20:22
@njaremko

njaremko commented Mar 19, 2024

Copy link
Copy Markdown
Owner

Sorry for the delay. Notification got buried. Thank you for this, I'll review tomorrow.

@njaremko

njaremko commented Mar 19, 2024

Copy link
Copy Markdown
Owner

The baloo branch you're using in here doesn't seem to exist anymore, so I can't build this locally

@itsbalamurali

itsbalamurali commented Mar 26, 2024

Copy link
Copy Markdown
Author

@njaremko will fix it this weekend.

@njaremko

njaremko commented Mar 26, 2024

Copy link
Copy Markdown
Owner

@itsbalamurali Thanks, ping me when you're ready for a review please

@njaremko

njaremko commented May 24, 2024

Copy link
Copy Markdown
Owner

Is this good for review @itsbalamurali?

@JamesWiresmith JamesWiresmith mentioned this pull request Sep 21, 2025
Merged
Add RustCrypto feature: pure-Rust crypto backend
0fdfd6f 
Reimplements PR njaremko#42 ("Add RustCrypto feature") on top of upstream's
refactored crypto layer (CryptoProvider trait, crypto/xmlsec tree).

Introduces a pluggable native crypto backend (src/crypto/native) for key
generation, X.509 certificate generation, and HTTP-Redirect URL signing /
verification, with two mutually-exclusive backends selected by feature:

- openssl   (default) - OpenSSL crate
- rustcrypto          - pure Rust: rsa (PKCS#1 v1.5 + SHA-256),
                        p256/ecdsa (ECDSA P-256 + SHA-256), sha2, x509-cert

The OpenSSL crate is now optional. xmlsec implies openssl (the xmlsec
wrapper uses OpenSSL for decryption). signed_redirect no longer requires
xmlsec - URL signing works under either native backend.

Default feature set: [openssl, xmlsec]. Pure-Rust build:
  cargo build --no-default-features --features rustcrypto

Both backends build and pass the full test suite (28 tests each), including
RSA/ECDSA keygen -> self-signed cert -> sign -> verify round-trips for the
rustcrypto backend.
@itsbalamurali

itsbalamurali commented Jun 8, 2026

Copy link
Copy Markdown
Author

@njaremko This is ready for review and merge.

I've rebased this onto current master and re-implemented the RustCrypto work against the new crypto architecture (the CryptoProvider trait + crypto/xmlsec tree from the crypto refactor). It's now a single clean commit and shows as mergeable.

What's here

  • New src/crypto/native/ backend abstraction (PrivateKey/PublicKey) with two mutually-exclusive backends:
    • openssl (default) — existing OpenSSL path, now optional
    • rustcrypto — pure Rust: rsa (PKCS#1 v1.5 + SHA-256), p256/ecdsa (ECDSA P-256), sha2, x509-cert for self-signed cert generation
  • OpenSSL crate is now optional; xmlsec implies openssl (the xmlsec wrapper uses OpenSSL for decryption)
  • signed_redirect no longer requires xmlsec — URL signing works under either native backend
  • Default features unchanged: [openssl, xmlsec]. Pure-Rust build: cargo build --no-default-features --features rustcrypto

Testing

  • rustcrypto: full suite passes (28 tests), incl. RSA + ECDSA keygen → self-signed cert → sign → verify round-trips and the redirect-signature tests against the existing test vectors
  • openssl: full suite passes (28 tests)
  • Default openssl + xmlsec: builds and behaves identically to current master (no regression)

One note: the RustCrypto deps are release-candidates (rsa 0.10-rc, x509-cert 0.3-rc, p256 0.14-rc, signature 3.0-rc) — that's currently the only coherent option for this stack, but flagging it in case you'd prefer to wait for stable releases.

Happy to adjust anything.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@itsbalamurali @njaremko