16 releases (4 breaking)
|new 0.5.0||Feb 22, 2021|
|0.4.2||Dec 16, 2020|
|0.4.1||Nov 9, 2020|
|0.1.8||Jul 17, 2020|
#165 in Cryptography
682 downloads per month
Used in 2 crates (via odoh-rs)
This is an work-in-progress implementation of the HPKE hybrid encryption standard.
Here are all the primitives listed in the spec. The primitives with checked boxes are the ones that are implemented.
- DHKEM(Curve25519, HKDF-SHA256)
- DHKEM(Curve448, HKDF-SHA512)
- DHKEM(P-256, HKDF-SHA256)
- DHKEM(P-384, HKDF-SHA384)
- DHKEM(P-521, HKDF-SHA512)
Default features flags:
Feature flag list:
x25519- Enables X25519-based KEMs
p256- Enables NIST P-256-based KEMs
serde_impls- Includes implementations of
std- Necessary for running known-answer tests. No need to enable unless you're debugging this crate.
For info on how to omit or include feature flags, see the cargo docs on features.
To run all tests, execute
cargo test --all-features. This includes known-answer tests, which test against
COMMIT_ID is the short commit of the version of the spec that the test vectors came from. See the reference implementation for information on how to generate a test vector.
To run all benchmarks, execute
cargo bench --all-features. If you set your own feature flags, the benchmarks will still work, and run the subset of benches that it is able to. The results of a benchmark can be read as a neat webpage at
- NIST Ciphersuite with 128-bit security: AES-GCM-128, HKDF-SHA256, ECDH-P256
- Non-NIST Ciphersuite with 128-bit security: ChaCha20-Poly1305, HKDF-SHA256, X25519
Functions benchmarked in each ciphersuite:
setup_senderwith OpModes of Base, Auth, Psk, and AuthPsk
setup_receiverwith OpModes of Base, Auth, Psk, and AuthPsk
AeadCtxS::sealwith plaintext length 64 and AAD length 64
AeadCtxR::openwith ciphertext length 64 and AAD length 64
See the client-server example for an idea of how to use HPKE.
A definition: crypto agility refers to the ability of a cryptosystem or protocol to vary its underlying primitives. For example, TLS has "crypto agility" in that you can run the protocol with many different ciphersuites.
This crate does not support crypto agility out of the box. This is because the cryptographic primitives are encoded as types satisfying certain constraints, and types need to be determined at compile time (broadly speaking). That said, there is nothing preventing you from implementing agility yourself. There is a sample implementation in the examples folder. The sample implementation is messy because agility is messy.
- Add support for more KEMs
- More examples
Licensed under either of
at your option.
This code has not been audited in any sense of the word. Use at your own discretion.