The rc_crypto crate, like its name implies, handles all of our cryptographic needs.
For consumers, it pretty much follows the very rust-idiomatic ring crate API and offers the following functionality:
- Cryptographically secure pseudorandom number generation.
- Cryptographic digests, hmac, and hkdf.
- Authenticated encryption (AEAD) routines.
- ECDH key agreement.
- ECDSA signature verification.
- Constant-time string comparison.
- HTTP Hawk Authentication through the rust-hawk crate.
- HTTP Encrypted Content-Encoding through the ece crate.
Under the hood, it is backed by Mozilla's NSS library, through bindings in the nss crate. This has a number of advantages for our use-case:
- Uses Mozilla-owned-and-audited crypto primitives.
- Decouples us from ring's fast-moving versioning and stability policy.