Hacker News Reader

Comment by pzmarzly | Hacker News Reader

Also in referent news: "The State of TLS Stacks" by HAProxy devs https://www.haproxy.com/blog/state-of-ssl-stacks https://news.ycombinator.com/item?id=43912164

TLDR OpenSSL days seem to be coming to an end, but Rustls C bindings add not production ready yet.

View on HN

Rustls has two C APIs.

The first is C bindings for the native Rustls API. This should work great for anyone who wants to use Rustls from C, but it means writing to the Rustls API.

The second is C bindings that provide OpenSSL compatibility. This only supports a subset of the OpenSSL API (enough for Nginx but not yet HAProxy, for example), so not everything that uses OpenSSL will work with the Rustls OpenSSL compatibility layer yet. We are actively improving the amount of OpenSSL API surface that we support.

I should probably help with that whole OpenSSL compat. thing. Is there guidance somewhere or should I just find something interesting to implement and send over a PR ?

The repository is here:

https://github.com/rustls/rustls-openssl-compat

We just work with normal issues/PRs, and there is a Rustls discord channel if you want to chat. We'd love your help!

Would love to see compliance and accreditation coming through for native rusttls, like FIPS. That'll unlock a large potential market, which can in turn unlock other markets.

You can get FIPS by using some of the third party back-end integration via aws-lc-rs.

The default cryptographic back-end for Rustls, aws-lc-rs, is FIPS compliant and integrated in a FIPS-compliant way so it's easy to get FIPS compliance with Rustls.

Reply on news.ycombinator.com