aws-lc-rs

AWS-LC-FIPS module updated to 4.x

This release switches aws-lc-fips-sys (used via the fips feature) from the AWS-LC-FIPS 3.x branch to AWS-LC-FIPS 4.0.

• If your project requires FIPS compliance, please consult your local FIPS compliance experts before upgrading. The FIPS v3 module shipped in aws-lc-rs v1.17.x is FIPS 140-3 validated (Certificate #5314 static, Certificate #5298 dynamic). The 4.x module has completed validation testing by an accredited lab and has been submitted to NIST for certification. Refer to the CMVP Modules In Progress List for its current status, and to FIPS.md for security policies and supported operating environments.
• Consumers who need to remain on the FIPS 3.x module should pin aws-lc-rs to <1.18.0. See the Cargo Book on Specifying Dependencies.

What's Changed

• Switch aws-lc-fips-sys to AWS-LC's "FIPS 4.0" branch by @justsmth in #1185
  • aws-lc-fips-sys v0.13.16 -> v0.14.0. Please see the call-out above.
• The ML-DSA signature APIs are now stable 🎉 by @justsmth in #1188 and #1189
  • PqdsaKeyPair, PqdsaPublicKey, PqdsaPrivateKey, PqdsaSigningAlgorithm, PqdsaVerificationAlgorithm, and the ML_DSA_44 / ML_DSA_65 / ML_DSA_87 algorithms (and their _SIGNING counterparts) now live in aws_lc_rs::signature. ML-DSA no longer requires the unstable feature, and is now available under fips -- the FIPS 4.0 module provides ML-DSA, which is what had kept these APIs unstable. See our updated API documentation.
  • Please migrate any use of aws_lc_rs::unstable::signature to aws_lc_rs::signature. The unstable::signature module remains as deprecated aliases and will be removed in a future release.
  • PqdsaKeyPair::to_pkcs8 has been renamed to to_pkcs8v1, since elsewhere in the module an unqualified to_pkcs8 means PKCS#8 v2. A deprecated to_pkcs8 alias remains available under the unstable feature.
  • Existing unstable consumers continue to compile, with deprecation warnings. Two cases need a source change: builds using #![deny(warnings)], and code that glob-imports both signature::* and unstable::signature::*, which now needs an explicit import to disambiguate.
  • Behavior change: PqdsaVerificationAlgorithm::parsed_verify_digest_sig now always returns Unspecified. Digest-then-verify is not an operation defined by FIPS 204 -- pure ML-DSA signs the message itself, and the pre-hash variant (HashML-DSA) uses a distinct domain separator that this API does not implement.
• Add out-of-place AEAD sealing by @iainmcgin in #1183
  • Adds seal_separate_out_of_place to LessSafeKey and TlsRecordSealingKey. Every sealing entry point was previously in-place, so a caller whose plaintext was borrowed or shared had to copy it into a scratch buffer purely to make it mutable. This mirrors the existing open_separate_gather, so the sealing and opening directions now match.
• Add rsa::KeyPair::from_components for constructing RSA key pairs from raw components by @justsmth in #1175
  • Adds rsa::KeyPairComponents and rsa::KeyPair::from_components, matching ring 0.17, so a signing key can be built from formats such as JWK without first encoding the components as DER. Unlike ring, d and the CRT parameters are validated at construction using RSA_check_key, so keys with inconsistent or placeholder values that ring accepts may be rejected. Unnecessary generic bounds were also removed from PublicKeyComponents.
• Automatically optimize aws-lc for size when opt-level is "s" or "z" by @justsmth in #1159
  • The builder now enables AWS-LC's size-optimized configuration (OPENSSL_SMALL, and no AVX-512 assembly on x86_64) whenever Cargo is already building for size. In CI, a small binary exercising SHA-256, AES-256-GCM, and ECDSA P-256 is 36-50% smaller at opt-level=z than at opt-level=3: 50% on x86_64 Linux, 48% on aarch64 macOS, 39% on x86_64 Windows, 36% on aarch64 Linux. Your own savings depend on how much of AWS-LC your binary retains.
  • No algorithms are removed and outputs are unchanged; the trade-off is slower elliptic-curve performance. Set AWS_LC_SYS_SMALL=1/=0 to force it on or off independently of opt-level.
  • FIPS builds do not opt in automatically: aws-lc-fips-sys requires an explicit AWS_LC_FIPS_SYS_SMALL=1, and warns when it is set.
  • Partially addresses #745; the default size under opt-level=3 footprint is unchanged.
• Export native library build metadata from the -sys crates by @justsmth in #1187, including original commits from @glebpom in #1184
  • Downstream build scripts compiling C code against AWS-LC can now locate our artifacts via DEP_AWS_LC_* / DEP_AWS_LC_FIPS_* (libdir, libcrypto_path, link_kind, and libssl_path with ssl), consistently across the CC, CMake, and system-library build paths. Existing linker directives are unchanged. On Windows, the *_path values are the link-time artifact (import library), not the runtime DLL.
• Key wrap hardening by @justsmth in #1190 and #1191
  • KeyEncryptionKey::unwrap no longer underflows on ciphertexts shorter than 8 bytes. Since the ciphertext is untrusted input, builds with overflow-checks = true would panic instead of returning the documented Err(Unspecified); default release builds were unaffected.
  • KeyEncryptionKey now zeroizes its key material on drop, consistent with the other key types in this crate.
• docs(signature): correct outdated note about signing a separate digest by @WesleyRosenblum in #1186

Upstream AWS-LC (v5.5.0)

aws-lc-sys v0.44.0 aligns with AWS-LC v5.5.0 (previously v5.2.0). See also the release notes for v5.3.0 and v5.4.0.

Build Improvements

• Fix bindings copy from read-only prebuilt AWS-LC install by @justsmth in #1194
  • Copies into OUT_DIR now remove any stale destination first and leave the fresh copy writable, so building against a read-only prebuilt install (e.g. the Nix store) no longer fails with Permission denied on a build-script rerun. An OUT_DIR already poisoned by an earlier build now recovers without a cargo clean.

Issues Being Closed

• ML-DSA stabilization? -- #964
• Expose out-of-place AEAD sealing -- #1182
• Construct an RSA Key pair from raw private components -- #791
• aws-lc-sys build script fails to copy bindings from read only prebuild aws-lc on repeat runs -- #1193

Other Merged PRs

• ci: fix mdbook test failure and run docs checks on PRs by @justsmth in #1181
• Publish script fixes: cargo clean failure, and verify aws-lc-rs against minimum published sys crates by @justsmth in #1179
• Prepare aws-lc-sys v0.44.0 by @justsmth in #1199
• Prepare aws-lc-rs v1.18.0 by @justsmth in #1200

New Contributors

• @iainmcgin made their first contribution in #1183
• @glebpom made their first contribution in #1184 (landed via #1187)

Full Changelog: v1.17.3...v1.18.0

What's Changed

• Add public API to check AWS-LC and FIPS versions by @prasden in #1167
  • awslc_version() returns the linked AWS-LC library version (e.g., "5.1.0"), resolved at runtime. fips_version() returns the AWS-LC FIPS release-branch version as Some(version), or None when unavailable. Note that fips_version() is independent of try_fips_mode().
• Clarify representations of PqdsaKeyPair in serialized forms by @Mark-Simulacrum in #1174
  • Documents how to use PqdsaKeyPair::from_seed in a FIPS setting, and notes that key pairs constructed from the expanded form cannot be re-serialized to PKCS#8 (which contains just the seed).

Build Improvements

• Fix TARGET_* env leakage into host builds by @justsmth in #1171
  • Per the cc-rs convention, TARGET_CC/TARGET_CXX/TARGET_CFLAGS are now only applied when cross-compiling, and HOST_* variables are honored for native builds. Previously, when aws-lc-sys appeared as both a dependency and a build-dependency in a cross build, the cross toolchain's flags leaked into the host-side build.
• Restore cc default flags in memcmp probe; only fail build on confirmed bug by @justsmth in #1173
  • Fixes build failures under RPM hardened build flags (Fedora/RHEL/Rocky rpmbuild defaults): the memcmp probe (GCC bug 95189 check) now retains cc's computed target default flags (e.g., -fPIC) while still excluding user CFLAGS. The check also only runs for GCC versions that may contain the bug, and a probe that fails to build only warns -- the build only fails when the miscompilation is actually demonstrated.

Issues Being Closed

• Public API for FIPS status -- #1166
• memcmp probe fails under RPM hardened build flags -- #1168
• Cross-compilation failure: TARGET_CFLAGS applied to host builds -- #1169

Other Merged PRs

• ci: Stop installing winehq-stable in cross windows-gnu pre-build by @justsmth in #1172
• ci: only run push-triggered workflows on main by @justsmth in #1163
• Prepare aws-lc-sys v0.43.0 by @justsmth in #1176
• Prepare aws-lc-rs v1.17.2 by @justsmth in #1178
• Prepare aws-lc-fips-sys v0.13.16 by @justsmth in #1180
• build(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #1177

New Contributors

• @Mark-Simulacrum made their first contribution in #1174
• @prasden made their first contribution in #1167

Full Changelog: v1.17.1...v1.17.3

🎉 AWS-LC FIPS v3 Module Has Been Validated

The AWS-LC FIPS v3 module has been awarded FIPS 140-3 validation by NIST's CMVP:

• Certificate #5314 (static)
• Certificate #5298 (dynamic)

Seek guidance from a local FIPS compliance expert regarding requirements for your deployment environments. Please consult the Security Policies associated with our certificates if you have questions.

aws-lc-fips-sys (utilized via the fips feature of aws-lc-rs) currently uses the validated FIPS v3 module.

• In the upcoming aws-lc-rs v1.18.0 release, we plan to switch aws-lc-fips-sys to our FIPS v4 branch.

What's Changed

• Support linking against a system-installed AWS-LC:
  • Set AWS_LC_SYS_SYSTEM_DIR or let pkg-config / OPENSSL_* environment variables auto-detect an existing AWS-LC installation instead of building from source by @justsmth in #1129
  • Support system-installed AWS-LC FIPS library for aws-lc-fips-sys by @justsmth in #1143
  • Auto-detect system AWS-LC from OPENSSL_* and pkg-config by @justsmth in #1156
  • Gate system AWS-LC on a declared minimum version by @justsmth in #1152
• Implement Send/Sync for RSA hazmat encryption key types by @justsmth in #1128
• Add Salt::none constructor for HKDF by @justsmth in #1135
• Add wasm32-unknown-emscripten build and test support by @justsmth in #1059
• Report specific key rejection reasons for invalid RSA key sizes by @justsmth in #1153

Upstream AWS-LC (v5.1.0)

aws-lc-sys now aligns with AWS-LC v5.1.0 (previously v1.73.0). Notable upstream changes include:

• ML-DSA native assembly backends for x86_64 and aarch64, imported from mldsa-native by @jakemas in aws/aws-lc#3195 and aws/aws-lc#3219
• Security hardening: stack secret zeroing, tightened PKCS7/OCSP/ASN.1 error handling (Various PRs)

Build Improvements

• Fix memcmp_check build failure when CFLAGS contains LTO flags by @justsmth in #1134
• Fix missing poly_Rq_mul symbol in Linux x86_64 build by @Lebei2046 in #1130
• Apply -ffile-prefix-map to jitterentropy builder by @justsmth in #1139
• Select compiler flag dialect by driver mode, not target ABI by @justsmth in #1147

Issues Being Closed

• RSA hazmat encryption key types missing Send/Sync -- #1125
• RSA key rejection reports generic Unspecified for invalid key sizes -- #1082
• Build failure when CFLAGS contains LTO flags (Windows/clang) -- #1132
• cargo-xwin (clang-cl) jitterentropy build failure on x86_64-pc-windows-msvc -- #1146
• Support system-provided AWS-LC library -- #936
• cpu_arm_linux.c assumes sys/auxv.h and getauxval (uclibc targets) -- #1108
• jitterentropy embeds absolute paths to files -- #1137

Other Merged PRs

• Add ML-DSA aarch64 native assembly to CC builder scripts by @jakemas in #1113
• Clarify HKDF info concatenation and encoding responsibility by @justsmth in #1145
• CI: support zig cross compile for arm32 by @justsmth in #1124
• fix(clippy): fix truncate warnings by @justsmth in #1126
• ci: replace dtolnay/rust-toolchain with direct rustup invocations by @justsmth in #1133
• Reduce AEAD and RSA test iterations under DISABLE_SLOW_TESTS by @justsmth in #1119
• ci(compilers): retry-tolerant curl, latest Go, drop unused PowerShell by @justsmth in #1138
• ci(cross): generate MSRV-aware lockfile for alpine-linux by @justsmth in #1150
• Harden GitHub Actions workflows against script injection by @justsmth in #1161
• Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #1141
• Bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #1142
• Bump codecov/codecov-action from 6 to 7 by @dependabot[bot] in #1144
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #1155
• Prepare aws-lc-fips-sys v0.13.15 by @justsmth in #1158
• Prepare aws-lc-sys v0.42.0 by @justsmth in #1162
• Prepare aws-lc-rs v1.17.1 by @justsmth in #1164

New Contributors

• @Lebei2046 made their first contribution in #1130

Full Changelog: v1.17.0...v1.17.1