Announcing wolfssl-wolfcrypt Rust Crate v2.0.0

    • We are pleased to announce the release of wolfssl-wolfcrypt version 2.0.0, now available on crates.io. This major update introduces critical safety enhancements, expanded algorithm support, and architectural changes to improve reliability across different build configurations.

    Breaking Changes

    This release includes some breaking API changes necessitated by memory safety and soundness improvements:

    • RNG Ownership: ECC::set_rng, RSA::set_rng, and Curve25519Key::set_rng now take an owned RNG instead of a mutable borrow. This ensures the underlying C pointer remains valid for the lifetime of the object.
    • Parameter Coercion: Many parameters formerly requiring &mut RNG (such as in generate*, make_pub*, and sign_* methods) now accept &RNG.
    • LMS::sigs_left() removal: Replace with has_sigs_left().
    • LMS::get_kid() API change: Caller must now supply the output buffer.
    • AES buffer method changes: Some AES methods used to accept buffers over generic types and have been changed to only accept buffers of U8.

    New Features & Algorithms

    Version 2.0.0 broadens the crate’s cryptographic capabilities:

    • Expanded AEAD: Added support for AES-192-GCM and AES-192-CCM.
    • BLAKE2 Support: New blake2_digest and blake2_mac modules providing typed wrappers for BLAKE2b and BLAKE2s.
    • HMAC Enhancements: Implemented the Clone trait for HMAC types using a deep-copy via wc_HmacCopy.
    • Shared RNGs: Introduced set_shared_rng(Rc) (available with the alloc feature) to allow a single RNG instance to be safely shared among multiple consumers on the same thread.

    Reliability & Security Fixes

    • ECC Move-Safety: ECC keys are now allocated on the C heap. This prevents memory corruption that previously occurred when the Rust compiler moved self-referential C structs (common in WOLFSSL_SP_MATH_ALL configurations).
    • Input Validation: Added strict length validation for ECC::import_unsigned to prevent potential out-of-bounds reads during FFI calls.
    • Logic Correctness: Resolved a double-initialization bug in ECC key creation that could lead to resource leaks in asynchronous builds.

    Getting Started

    To use the latest version, update your Cargo.toml:

    [dependencies]
wolfssl-wolfcrypt = "2.0.0"

    Note: This version requires wolfSSL v5.9.0 or later as the underlying C library.

    API Coverage

    The following cryptographic primitives and modules from the underlying wolfCrypt C library are currently exposed via this crate’s wrapper API:

    • AES Support:
      • Includes CBC, CCM, CFB, CTR, EAX, ECB, GCM, OFB, and XTS modes.
    • BLAKE2: Typed wrappers for BLAKE2b and BLAKE2s.
    • CMAC: Support for Cipher-based Message Authentication Code.
    • ChaCha20-Poly1305: High-performance AEAD support.
    • Curve25519: Elliptic curve Diffie-Hellman operations.
    • DH: Traditional Finite Field Diffie-Hellman.
    • ECC: Comprehensive Elliptic Curve Cryptography API.
    • Ed25519: Edwards-curve Digital Signature Algorithm support.
    • Ed448: High-security Edwards-curve signatures.
    • HKDF: HMAC-based Extract-and-Expand Key Derivation Function.
    • HMAC: Hash-based Message Authentication Code implementation.
    • LMS: Leighton-Micali Signatures for post-quantum security.
    • ML-DSA: Module-Lattice-Based Digital Signature Standard.
    • ML-KEM: Module-Lattice-Based Key-Encapsulation Mechanism.
    • PBKDF2: Password-Based Key Derivation Function 2.
    • PKCS #12 PBKDF: Legacy password derivation for PKCS #12 archives.
    • PRF: Pseudo-Random Function implementations.
    • RNG: Cryptographically secure Random Number Generation.
    • RSA: Support for RSA signatures and encryption.
    • scrypt: Memory-hard password-based key derivation.
    • SHA Family:
      • Full support for SHA-1, SHA-2 (224-512), SHA-3 (224-512), and SHAKE (128-256).
    • SRTP/SRTCP KDF: Specialized key derivation for secure media streaming.
    • SSH KDF: Key derivation routines for Secure Shell protocols.
    • TLSv1.3 HKDF: Specific HKDF implementations for the TLS 1.3 stack.

    RustCrypto Trait Support

    In addition to its native API, this crate can implement the common RustCrypto traits for wolfCrypt-backed types. Each set of trait implementations is gated behind a Cargo feature so that projects only pull in the dependencies they need. All features are off by default.

    Feature RustCrypto crate wolfCrypt types
    digest digest SHA (sha_digest), BLAKE2 (blake2_digest)
    mac digest (mac) HMAC (hmac_mac), CMAC (cmac_mac), BLAKE2 (blake2_mac)
    signature signature ECDSA (ecdsa), RSA PKCS#1 v1.5 (rsa_pkcs1v15)
    cipher cipher AES (aes)
    aead aead AES-GCM/CCM/EAX (aes), ChaCha20-Poly1305
    rand_core rand_core RNG (random)
    kem kem ML-KEM (mlkem_kem)
    password-hash password-hash PBKDF2 (pbkdf2_password_hash), scrypt (scrypt_password_hash)

    The BLAKE2, CMAC, and HMAC trait modules additionally require the corresponding algorithm support to be enabled in the wolfSSL C library.

    Enable features in your Cargo.toml, for example:

    [dependencies]
wolfssl-wolfcrypt = { version = "2.0", features = ["digest", "signature"] }

    If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.

    Download wolfSSL Now