Incorporating dependencies from RustCrypto?

[mominul]

The RustCrypto project already has implemented some basic foundational algorithms. It seems this project is implementing all the algorithms again thus increasing the development time and feature lag from the bouncycastle java project.

Rust ecosystem has a lack of highlevel library like BouncyCastle.

Is there any blockers that are preventing code sharing among the projects?

[ounsworth]

Hi @mominul !

A couple of thoughts here:

1. Code sharing could in theory be ok, but we do not want build-time dependencies on other projects. As we explain in our blog, dependencies on code that we don't control becomes a supply-chain liability. I have nothing against the RustCrypto project, but when the code is 100% written by Bouncy Castle project members, then we know 100% where it came from, and there is value in that. Even if people wanted to donate algorithm code to bc-rust (assuming that the licenses are ok), we would want to review the code line-by-line very very carefully for backdoors, and often that is more work than writing it yourself.

2. In cryptography, there is value in diversity. Meaning that if two people implement the same FIPS specification independently then maybe only one of them makes a mistake that leads to a subtle vulnerability. Or if one project gets hacked or accepts a malicious contribution, the other project is not affected. Or one project makes design decisions that are better on embedded devices while the other project is better for servers, or better for non-experts, or whatever. It's good to have multiple independent implementations in the world.

3. The hard part here is not implementing the algorithms; porting algorithm code from bc-java into rust is actually not that hard. What is time-consuming is thinking through each algorithm and how to make it fit into a consistent API across bc-rust, and also making sure the source code lines up well against the sample algorithms in the NIST FIPS and SP documents so that the source code is easy to audit. I understand that these are different design goals than the RustCrypto project has (they are more focused on performance), so starting from their code instead of bc-java might actually not be less work.

But thank you for your positive comments

[mominul]

Thank you for the answer! I wish the best for this project and hope that this will change the ecosystem landscape of signing and crypto in Rust! ❤️