#aws #google #boringssl

sys aws-lc-sys

AWS-LC is a general-purpose cryptographic library maintained by the AWS Cryptography team for AWS and their customers. It іs based on code from the Google BoringSSL project and the OpenSSL project.

4 releases

Uses new Rust 2021

new 0.2.1 Dec 2, 2022
0.2.0 Nov 16, 2022
0.1.1 Nov 9, 2022
0.1.0 Nov 9, 2022

#548 in Cryptography

Download history 219/week @ 2022-11-06 831/week @ 2022-11-13 137/week @ 2022-11-20 152/week @ 2022-11-27

1,339 downloads per month

Apache-2.0 OR ISC

20MB
581K SLoC

GNU Style Assembly 232K SLoC // 0.0% comments Rust 111K SLoC // 0.0% comments C 83K SLoC // 0.2% comments Perl 69K SLoC // 0.1% comments C++ 68K SLoC // 0.2% comments Go 18K SLoC // 0.1% comments

AWS libcrypto (AWS-LC)

Join the chat at https://gitter.im/awslabs/aws-lc

AWS-LC is a general-purpose cryptographic library maintained by the AWS Cryptography team for AWS and their customers. It іs based on code from the Google BoringSSL project and the OpenSSL project.

AWS-LC contains portable C implementations of algorithms needed for TLS and common applications. For performance critical algorithms, optimized assembly versions are included for x86 and ARM.

Quickstart for Amazon Linux 2

AWS-LC’s libcrypto is a C library and needs a C compiler. AWS-LC's libssl is a C++ library and needs a C++ compiler.

Fork AWS-LC on GitHub and run the following commands to build AWS-LC with optimizations and debug info, run all tests, and install it:

sudo yum install cmake3 ninja-build clang perl golang
git clone https://github.com/${YOUR_GITHUB_ACCOUNT_NAME}/aws-lc.git
mkdir aws-lc-build && cd aws-lc-build
cmake3 -GNinja \
    -DCMAKE_BUILD_TYPE=RelWithDebInfo \
    -DCMAKE_INSTALL_PREFIX=../aws-lc-install \
    ../aws-lc
ninja-build run_tests && ninja-build install
cd ../aws-lc-install/
ls *

See Building.md for more information about required dependencies and build options. If you’re interested in getting involved open an Issue to discuss your plan or talk to us on Gitter. Contributing.md has info for how to specifically make the change and get it reviewed by AWS-LC maintainers. If you just want to use AWS-LC see our existing documentation in the public header files, if you’re moving your application from OpenSSL see Porting_to_AWS-LC.md for more information.

Why AWS-LC?

AWS-LC's goal is to maintain a secure libcrypto that is compatible with software and applications used at AWS. AWS-LC also serves as the new home for the AWS Cryptography team to publish open source contributions and enhancements that are submitted to other libcrypto projects.

AWS-LC features

API Compatibility

AWS-LC is compatible with the majority of OpenSSL’s APIs to make it easy to use with existing applications. We’re open to discussing adding missing functionality and understanding your use case in an Issue or on Gitter.

Compiler, OS, and CPU support

AWS-LC correctness is tested on a variety of C/C++ compiler, OS, and CPU combinations. For a complete list of tested combinations see tests/ci/Readme.md. If you use a different combination and would like to make sure we test it, please open an issue to discuss adding it to our CI.

Algorithm optimization support

A portable C implementation of all algorithms is included and optimized assembly implementations of select algorithms is included for some x86 and Arm CPUs. We use AWS Graviton processors to test ARMv8 optimizations and Intel CPUs to test x86 and x86-64 optimizations.

The Intel Software Development Emulator is used to run tests on many different x86 processors.

If you use another CPU and would like to make sure we test it or discuss adding an assembly optimized algorithm implementation, please open an issue to discuss adding it to our CI.

AWS-LC safety mechanisms

Automated testing

Every change is tested with our CI that includes positive and negative unit tests, fuzz tests, Sanitizers (Address, Memory, Control flow integrity, Thread, and Undefined behavior), Valgrind, and Formal Verification.

Formal Verification

Portions of AWS-LC have been formally verified in AWS-LC Formal Verification, the checks are run in AWS-LC’s CI on every change. The algorithms that have been verified on certain platforms with caveats include:

  • SHA-2
  • HMAC
  • AES-GCM
  • AES-KWP
  • ECDH & ECDSA with curve P-384

Have a Question?

If you have any questions about Submitting PR's, Opening Issues, AWS-LC API usage or any similar topic, we have a public chatroom available here to answer your questions on Gitter.

Otherwise, if you think you might have found a security impacting issue, please instead follow our Security Notification Process.

Security issue notifications

If you discover a potential security issue in AWS-LC, we ask that you notify AWS Security via our vulnerability reporting page. Please do not create a public GitHub issue.

If you package or distribute AWS-LC, or use AWS-LC as part of a large multi-user service, you may be eligible for pre-notification of future AWS-LC releases. Please contact aws-lc-pre-notifications@amazon.com.

Dependencies