Add feature based on aws-lc-rs cryptographic library instead of ring

Author: Kiril Nikolov

Cargo.toml

@@ -26,6 +26,7 @@ base64 = "0.21.0"
 # For PEM decoding
 pem = { version = "3", optional = true }
 simple_asn1 = { version = "0.6", optional = true }
+aws-lc-rs = { version = "1.6.2", optional = true }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 ring = { version = "0.17.4", features = ["std"] }
@@ -50,6 +51,7 @@ criterion = { version = "0.4", default-features = false }
 [features]
 default = ["use_pem"]
 use_pem = ["pem", "simple_asn1"]
+aws_lc_rs = ["aws-lc-rs"]
 
 [[bench]]
 name = "jwt"

README.md

@@ -166,3 +166,7 @@ you can add some leeway to the `iat`, `exp`, and `nbf` validation by setting the
 Last but not least, you will need to set the algorithm(s) allowed for this token if you are not using `HS256`.
 
 Look at `examples/validation.rs` for a full working example.
+
+## FIPS compliance
+
+This library exports a feature that replaces `ring` with `aws_lc_rs` to achieve FIPS compliance. The name of the feature is the same as the cryptographic library `aws_lc_rs`.

src/crypto/ecdsa.rs

@@ -1,3 +1,9 @@
+#[cfg(feature = "use_aws_lc_rs")]
+use aws_lc_rs as ring;
+
+#[cfg(not(feature = "use_aws_lc_rs"))]
+use ring;
+
 use ring::{rand, signature};
 
 use crate::algorithms::Algorithm;

src/crypto/eddsa.rs

@@ -1,23 +1,27 @@
-use ring::signature;
+#[cfg(feature = "use_aws_lc_rs")]
+use aws_lc_rs as ring;
+
+#[cfg(not(feature = "use_aws_lc_rs"))]
+use ring;
 
 use crate::algorithms::Algorithm;
 use crate::errors::Result;
 use crate::serialization::b64_encode;
 
 /// Only used internally when signing or validating EdDSA, to map from our enum to the Ring EdDSAParameters structs.
-pub(crate) fn alg_to_ec_verification(alg: Algorithm) -> &'static signature::EdDSAParameters {
+pub(crate) fn alg_to_ec_verification(alg: Algorithm) -> &'static ring::signature::EdDSAParameters {
     // To support additional key subtypes, like Ed448, we would need to match on the JWK's ("crv")
     // parameter.
     match alg {
-        Algorithm::EdDSA => &signature::ED25519,
+        Algorithm::EdDSA => &ring::signature::ED25519,
         _ => unreachable!("Tried to get EdDSA alg for a non-EdDSA algorithm"),
     }
 }
 
 /// The actual EdDSA signing + encoding
 /// The key needs to be in PKCS8 format
 pub fn sign(key: &[u8], message: &[u8]) -> Result<String> {
-    let signing_key = signature::Ed25519KeyPair::from_pkcs8_maybe_unchecked(key)?;
+    let signing_key = ring::signature::Ed25519KeyPair::from_pkcs8_maybe_unchecked(key)?;
     let out = signing_key.sign(message);
     Ok(b64_encode(out))
 }

src/crypto/mod.rs

@@ -1,3 +1,9 @@
+#[cfg(feature = "use_aws_lc_rs")]
+use aws_lc_rs as ring;
+
+#[cfg(not(feature = "use_aws_lc_rs"))]
+use ring;
+
 use ring::constant_time::verify_slices_are_equal;
 use ring::{hmac, signature};
 

src/crypto/rsa.rs

@@ -1,3 +1,9 @@
+#[cfg(feature = "use_aws_lc_rs")]
+use aws_lc_rs as ring;
+
+#[cfg(not(feature = "use_aws_lc_rs"))]
+use ring;
+
 use ring::{rand, signature};
 
 use crate::algorithms::Algorithm;
@@ -41,7 +47,11 @@ pub(crate) fn sign(
     let key_pair = signature::RsaKeyPair::from_der(key)
         .map_err(|e| ErrorKind::InvalidRsaKey(e.to_string()))?;
 
+    #[cfg(feature = "use_aws_lc_rs")]
+    let mut signature = vec![0; key_pair.public_modulus_len()];
+    #[cfg(not(feature = "use_aws_lc_rs"))]
     let mut signature = vec![0; key_pair.public().modulus_len()];
+
     let rng = rand::SystemRandom::new();
     key_pair.sign(alg, &rng, message, &mut signature).map_err(|_| ErrorKind::RsaFailedSigning)?;
 

src/errors.rs

@@ -1,3 +1,8 @@
+#[cfg(feature = "use_aws_lc_rs")]
+use aws_lc_rs as ring;
+
+#[cfg(not(feature = "use_aws_lc_rs"))]
+use ring;
 use std::error::Error as StdError;
 use std::fmt;
 use std::result;
@@ -77,7 +82,7 @@ pub enum ErrorKind {
     /// Some of the text was invalid UTF-8
     Utf8(::std::string::FromUtf8Error),
     /// Something unspecified went wrong with crypto
-    Crypto(::ring::error::Unspecified),
+    Crypto(ring::error::Unspecified),
 }
 
 impl StdError for Error {
@@ -159,14 +164,14 @@ impl From<::std::string::FromUtf8Error> for Error {
     }
 }
 
-impl From<::ring::error::Unspecified> for Error {
-    fn from(err: ::ring::error::Unspecified) -> Error {
+impl From<ring::error::Unspecified> for Error {
+    fn from(err: ring::error::Unspecified) -> Error {
         new_error(ErrorKind::Crypto(err))
     }
 }
 
-impl From<::ring::error::KeyRejected> for Error {
-    fn from(_err: ::ring::error::KeyRejected) -> Error {
+impl From<ring::error::KeyRejected> for Error {
+    fn from(_err: ring::error::KeyRejected) -> Error {
         new_error(ErrorKind::InvalidEcdsaKey)
     }
 }