Skip to content

Commit

Permalink
Updated aws-lc-fips-sys and fips feature messaging
Browse files Browse the repository at this point in the history
  • Loading branch information
@skmcgrail
skmcgrail committed Nov 17, 2023
1 parent cb030a3 commit da7d0db
Show file tree
Hide file tree
Showing 6 changed files with 67 additions and 42 deletions.
15 changes: 9 additions & 6 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,12 +21,15 @@ A *ring*-compatible crypto library using the cryptographic operations provided b
We do not recommend directly relying on these bindings.

### [aws-lc-fips-sys](aws-lc-fips-sys/README.md)
**Autogenerated** Low-level AWS-LC bindings for the Rust programming language. Providing **experimental** FIPS support.
We do not recommend directly relying on these bindings. This crate
uses [AWS-LC](https://github.com/aws/aws-lc/tree/fips-2022-11-02),
which been submitted to an accredited lab for FIPS validation testing, and upon completion will be submitted to NIST
for certification. Once NIST grants a validation certificate to AWS-LC, we will make an announcement to Rust developers
on how to leverage the FIPS mode using [aws-lc-rs](https://crates.io/crates/aws-lc-rs).
**Autogenerated** Low-level AWS-LC bindings for the Rust programming language, providing FIPS support.
We do not recommend directly relying on these bindings. This crate provides bindings to
[AWS-LC-FIPS 2.x](https://github.com/aws/aws-lc/tree/fips-2022-11-02), which has completed
FIPS validation testing by an accredited lab and has been submitted to NIST for certification. The static build of AWS-LC-FIPS
will be used. (See [README](./aws-lc-fips-sys/README.md)).

Refer to the [NIST Cryptographic Module Validation Program's Modules In Progress List](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/Modules-In-Process-List)
for the latest status of the static or dynamic AWS-LC Cryptographic Module. We will also update our release notes
and documentation to reflect any changes in FIPS certification status.

## Build

Expand Down
17 changes: 13 additions & 4 deletions aws-lc-fips-sys/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,19 @@
[Documentation](https://github.com/aws/aws-lc).

## FIPS
This crate uses [AWS-LC](https://github.com/aws/aws-lc/tree/fips-2022-11-02), which been submitted to an accredited lab
for FIPS validation testing, and upon completion will be submitted to NIST for certification. Once NIST grants a
validation certificate to AWS-LC, we will make an announcement to Rust developers on how to leverage the FIPS mode
using [aws-lc-rs](https://crates.io/crates/aws-lc-rs).

This crate provides bindings to [AWS-LC-FIPS 2.x](https://github.com/aws/aws-lc/tree/fips-2022-11-02), which has completed
FIPS validation testing by an accredited lab and has been submitted to NIST for certification. The static build of AWS-LC-FIPS
will be used.

| Supported Targets |
| --- |
| x86_64-unknown-linux-gnu |
| aarch64-unknown-linux-gnu |

Refer to the [NIST Cryptographic Module Validation Program's Modules In Progress List](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/Modules-In-Process-List)
for the latest status of the static or dynamic AWS-LC Cryptographic Module. We will also update our release notes
and documentation to reflect any changes in FIPS certification status.

## Release Support

Expand Down
2 changes: 1 addition & 1 deletion aws-lc-rs/Cargo.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ exclude = [
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[package.metadata.docs.rs]
rustc-args = ["--cfg", "docsrs"]
rustdoc-args = ["--cfg", "docsrs"]

[features]
alloc = []
Expand Down
36 changes: 21 additions & 15 deletions aws-lc-rs/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,40 +34,47 @@ See our [User Guide](https://awslabs.github.io/aws-lc-rs/) for guidance on insta

## Feature Flags

##### - alloc (default) ####
##### alloc (default)
Allows implementation to allocate values of arbitrary size. (The meaning of this feature differs
from the "alloc" feature of *ring*.) Currently, this is required by the `io::writer` module.

##### - ring-io (default) ####
##### ring-io (default)
Enable feature to access the `io` module.

##### - ring-sig-verify (default) ####
##### ring-sig-verify (default)
Enable feature to preserve compatibility with ring's `signature::VerificationAlgorithm::verify`
function. This adds a requirement on `untrusted = "0.7.1"`.

##### - fips ####
**EXPERIMENTAL** Enable this feature to have aws-lc-rs use the
[*aws-lc-fips-sys*](https://crates.io/crates/aws-lc-fips-sys) crate for the cryptographic
implementations. The *aws-lc-fips-sys* crate provides bindings to the FIPS variant of
[*AWS-LC*](https://github.com/aws/aws-lc). AWS-LC has been submitted to an accredited lab
for FIPS validation testing, and upon completion will be submitted to NIST for certification.
Once NIST grants a validation certificate to AWS-LC, we will make an announcement to Rust
developers on how to leverage the FIPS mode. This feature is currently only available on Linux.
##### fips
Enable this feature to have aws-lc-rs use the [*aws-lc-fips-sys*](https://crates.io/crates/aws-lc-fips-sys)
crate for the cryptographic implementations. The *aws-lc-fips-sys* crate provides bindings to
[AWS-LC-FIPS 2.x](https://github.com/aws/aws-lc/tree/fips-2022-11-02), which has completed
FIPS validation testing by an accredited lab and has been submitted to NIST for certification.
The static build of AWS-LC-FIPS will be used.

##### - asan ####
| Supported Targets |
| --- |
| x86_64-unknown-linux-gnu |
| aarch64-unknown-linux-gnu |

Refer to the [NIST Cryptographic Module Validation Program's Modules In Progress List](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/Modules-In-Process-List)
for the latest status of the static or dynamic AWS-LC Cryptographic Module. We will also update our release notes
and documentation to reflect any changes in FIPS certification status.

##### asan
Performs an "address sanitizer" build. This can be used to help detect memory leaks. See the
["Address Sanitizer" section](https://doc.rust-lang.org/beta/unstable-book/compiler-flags/sanitizer.html#addresssanitizer)
of the [Rust Unstable Book](https://doc.rust-lang.org/beta/unstable-book/).

##### - bindgen ####
##### bindgen
Causes `aws-lc-sys` or `aws-lc-fips-sys` to generates fresh bindings for AWS-LC instead of using
the pre-generated bindings. This feature requires `libclang` to be installed. See the
[requirements](https://rust-lang.github.io/rust-bindgen/requirements.html)
for [rust-bindgen](https://github.com/rust-lang/rust-bindgen)

## *ring*-compatibility

Although this library attempts to be fully compatible with *ring*, there are a few places where our
Although this library attempts to be fully compatible with *ring* (v0.16.x), there are a few places where our
behavior is observably different.

* Our implementation requires the `std` library. We currently do not support a
Expand All @@ -90,7 +97,6 @@ for ring that provides FIPS support and is compatible with the ring API. Rust de
prescribed cryptographic requirements can seamlessly integrate aws-lc-rs into their applications
and deploy them into AWS Regions.


### Contributor Quickstart for Amazon Linux 2023

For those who would like to contribute to our project or build it directly from our repository,
Expand Down
2 changes: 1 addition & 1 deletion aws-lc-rs/README.tpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ a few more packages may be needed. The listing below shows the steps needed for
building and testing our project locally.
```shell
# Install dependencies needed for build and testing
sudo yum install -y cmake3 clang git clang-libs golang openssl-devel
sudo yum install -y cmake3 clang git clang-libs golang openssl-devel perl-FindBin

# Install Rust
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
Expand Down
37 changes: 22 additions & 15 deletions aws-lc-rs/src/lib.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,40 +34,47 @@
//!
//! # Feature Flags
//!
//! #### - alloc (default) ####
//! #### alloc (default)
//! Allows implementation to allocate values of arbitrary size. (The meaning of this feature differs
//! from the "alloc" feature of *ring*.) Currently, this is required by the `io::writer` module.
//!
//! #### - ring-io (default) ####
//! #### ring-io (default)
//! Enable feature to access the `io` module.
//!
//! #### - ring-sig-verify (default) ####
//! #### ring-sig-verify (default)
//! Enable feature to preserve compatibility with ring's `signature::VerificationAlgorithm::verify`
//! function. This adds a requirement on `untrusted = "0.7.1"`.
//!
//! #### - fips ####
//! **EXPERIMENTAL** Enable this feature to have aws-lc-rs use the
//! [*aws-lc-fips-sys*](https://crates.io/crates/aws-lc-fips-sys) crate for the cryptographic
//! implementations. The *aws-lc-fips-sys* crate provides bindings to the FIPS variant of
//! [*AWS-LC*](https://github.com/aws/aws-lc). AWS-LC has been submitted to an accredited lab
//! for FIPS validation testing, and upon completion will be submitted to NIST for certification.
//! Once NIST grants a validation certificate to AWS-LC, we will make an announcement to Rust
//! developers on how to leverage the FIPS mode. This feature is currently only available on Linux.
//!
//! #### - asan ####
//! #### fips
//! Enable this feature to have aws-lc-rs use the [*aws-lc-fips-sys*](https://crates.io/crates/aws-lc-fips-sys)
//! crate for the cryptographic implementations. The *aws-lc-fips-sys* crate provides bindings to
//! [AWS-LC-FIPS 2.x](https://github.com/aws/aws-lc/tree/fips-2022-11-02), which has completed
//! FIPS validation testing by an accredited lab and has been submitted to NIST for certification.
//! The static build of AWS-LC-FIPS will be used.
//!
//! | Supported Targets |
//! | --- |
//! | x86_64-unknown-linux-gnu |
//! | aarch64-unknown-linux-gnu |
//!
//! Refer to the [NIST Cryptographic Module Validation Program's Modules In Progress List](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/Modules-In-Process-List)
//! for the latest status of the static or dynamic AWS-LC Cryptographic Module. We will also update our release notes
//! and documentation to reflect any changes in FIPS certification status.
//!
//! #### asan
//! Performs an "address sanitizer" build. This can be used to help detect memory leaks. See the
//! ["Address Sanitizer" section](https://doc.rust-lang.org/beta/unstable-book/compiler-flags/sanitizer.html#addresssanitizer)
//! of the [Rust Unstable Book](https://doc.rust-lang.org/beta/unstable-book/).
//!
//! #### - bindgen ####
//! #### bindgen
//! Causes `aws-lc-sys` or `aws-lc-fips-sys` to generates fresh bindings for AWS-LC instead of using
//! the pre-generated bindings. This feature requires `libclang` to be installed. See the
//! [requirements](https://rust-lang.github.io/rust-bindgen/requirements.html)
//! for [rust-bindgen](https://github.com/rust-lang/rust-bindgen)
//!
//! # *ring*-compatibility
//!
//! Although this library attempts to be fully compatible with *ring*, there are a few places where our
//! Although this library attempts to be fully compatible with *ring* (v0.16.x), there are a few places where our
//! behavior is observably different.
//!
//! * Our implementation requires the `std` library. We currently do not support a
Expand Down

0 comments on commit da7d0db

Please sign in to comment.