6 releases (stable)
|1.1.0||May 24, 2023|
|1.0.2||May 12, 2023|
|1.0.1||Apr 25, 2023|
|1.0.0||Apr 19, 2023|
|0.0.1||Apr 11, 2023|
#141 in Cryptography
41,729 downloads per month
Used in 5 crates (via s2n-quic-crypto)
AWS Libcrypto for Rust (aws-lc-rs)
A ring-compatible crypto library using the cryptographic operations provided by AWS-LC. It uses either the auto-generated aws-lc-sys or aws-lc-fips-sys Foreign Function Interface (FFI) crates found in this repository for invoking AWS-LC.
aws-lc-rs is available through crates.io. It can
be added to your project in the standard way
[dependencies] aws-lc-rs = "1.0.0"
Consuming projects will need a C Compiler (Clang or GCC) and Cmake to build.
- C compiler (Clang or GCC or Visual Studio Build Tools 2017)
- Cmake (>= v3.12)
- Linux or macOS or Windows
Platform- and Feature-specific Requirements
- Linux - required for
- Go - required for
- libclang - required for
bindgenand for any platform lacking pre-generated bindings (like Windows or M1 Macs)
See our User Guide for guidance on installing these requirements.
Contributor Quickstart for Amazon Linux 2023
For those who would like to contribute to our project or build it directly from our repository, a few more packages may be needed. The listing below shows the steps needed for you to begin building and testing our project locally.
# Install dependencies needed for build and testing sudo yum install -y cmake3 clang git clang-libs golang openssl-devel # Install Rust curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh source "$HOME/.cargo/env" # Clone and initialize a local repository git clone https://github.com/awslabs/aws-lc-rs.git cd aws-lc-rs git submodule update --init --recursive # Build and test the project cargo test
- alloc (default)
Allows implementation to allocate values of arbitrary size. (The meaning of this feature differs
from the "alloc" feature of ring.) Currently, this is required by the
- ring-io (default)
Enable feature to access the
- ring-sig-verify (default)
Enable feature to preserve compatibility with ring's
function. This adds a requirement on
untrusted = "0.7.1".
EXPERIMENTAL Enable this feature to have aws-lc-rs use the aws-lc-fips-sys crate for the cryptographic implementations. The aws-lc-fips-sys crate provides bindings to the FIPS variant of AWS-LC. AWS-LC has been submitted to an accredited lab for FIPS validation testing, and upon completion will be submitted to NIST for certification. Once NIST grants a validation certificate to AWS-LC, we will make an announcement to Rust developers on how to leverage the FIPS mode. This feature is currently only available on Linux.
Performs an "address sanitizer" build. This can be used to help detect memory leaks. See the "Address Sanitizer" section of the Rust Unstable Book.
aws-lc-fips-sys to generates fresh bindings for AWS-LC instead of using
the pre-generated bindings. This feature require
libclang to be installed. See the
Although this library attempts to be fully compatible with ring, there are a few places where our behavior is observably different.
- Our implementation requires the
stdlibrary. We currently do not support a
- We can only support a subset of the platforms supported by
aws-lc-sys. We currently support Mac and Linux, both x86-64 and aarch64.
Ed25519KeyPair::from_pkcs8_maybe_uncheckedboth support parsing of v1 or v2 PKCS#8 documents. If a v2 encoded key is provided to either function, public key component, if present, will be verified to match the one derived from the encoded private key.
Rust developers increasingly need to deploy applications that meet US and Canadian government cryptographic requirements. We evaluated how to deliver FIPS validated cryptography in idiomatic and performant Rust, built around our AWS-LC offering. We found that the popular ring (v0.16) library fulfilled much of the cryptographic needs in the Rust community, but it did not meet the needs of developers with FIPS requirements. Our intention is to contribute a drop-in replacement for ring that provides FIPS support and is compatible with the ring API. Rust developers with prescribed cryptographic requirements can seamlessly integrate aws-lc-rs into their applications and deploy them into AWS Regions.
Questions, Feedback and Contributing
We use GitHub Issues for managing feature requests, bug reports, or questions about aws-lc-rs API usage.
Otherwise, if you think you might have found a security impacting issue, please instead follow our Security Notification Process below.
Security Notification Process
If you discover a potential security issue in AWS-LC or aws-lc-rs, we ask that you notify AWS Security via our vulnerability reporting page. Please do not create a public GitHub issue.
If you package or distribute aws-lc-rs, or use aws-lc-rs as part of a large multi-user service, you may be eligible for pre-notification of future aws-lc-rs releases. Please contact firstname.lastname@example.org.
This library is licensed under the Apache-2.0 or the ISC License. For license details see