The ISRG (Internet Security Research Group), which is the founder of the Let's Encrypt project and promotes the development of technologies to enhance internet security, has announced the release of the rustls-openssl-compat layer, allowing the Rustls library to be used as a transparent replacement for OpenSSL. Currently, the project provides an implementation of rustls-libssl, ensuring compatibility with libssl, and is developing an implementation of libcrypto.
The functionality present in the layer is sufficient to enable nginx to operate on Rustls. To switch nginx to Rustls, it is enough to replace the libraries without the need for recompilation or modification of nginx. Among the immediate plans for the development of Rustls is the optimization of performance in areas where Rustls currently lags behind OpenSSL and ensuring support for RFC 8879 for certificate compression. Additionally, the announcement mentioned plans to transition components of the Let's Encrypt certificate authority infrastructure from OpenSSL to Rustls.
The Rustls project develops client and server implementations of TLS 1.2 and TLS 1.3 protocols for use in applications written in Rust. Rustls does not provide its own implementation of cryptographic primitives but uses pluggable cryptographic function providers (supporting algorithms like ECDSA, Ed25519, RSA, ChaCha20-Poly1305, AES128-GCM, and AES256-GCM). By default, Rustls uses a cryptographic provider based on the aws-lc-rs library, which is developed by Amazon and based on BoringSSL's C++ code, maintained by Google's OpenSSL fork. The ring library, partially based on BoringSSL and combining code in assembly, C++, and Rust, can also be used as a cryptographic provider.
Notably, nginx has built-in support for building with BoringSSL, which allows this library to be used directly without additional layers. In addition to the built-in support in Rustls for the aws-lc-rs and ring libraries based on BoringSSL code, several third-party cryptographic providers are also being developed for Rustls, allowing the use of mbedtls (C code), BoringSSL (C++), and RustCrypto (Rust) libraries.
Source: opennet.ru
