Skip to content

feat: implement QUIC packet/header protection and enable SHA-224/512 - #1

Closed
stevefan1999-personal wants to merge 1 commit into
stack/04-ticketerfrom
stack/05-quic
Closed

feat: implement QUIC packet/header protection and enable SHA-224/512#1
stevefan1999-personal wants to merge 1 commit into
stack/04-ticketerfrom
stack/05-quic

Conversation

@stevefan1999-personal

Copy link
Copy Markdown
Owner

Summary

Stack layer 5 on top of stack/04-ticketer (PR RustCrypto#290).

  • Implement full RFC 9001 QUIC support:
    • Header protection: AES-128/256-ECB and ChaCha20
    • Packet protection: AES-128-GCM, AES-256-GCM, AES-128-CCM, ChaCha20-Poly1305
    • Multipath nonce path (encrypt/decrypt_in_place_for_path)
    • Wired into TLS 1.3 suites; AES-128-CCM-8 stays quic: None (tag too short for header sample)
  • Enable SHA-224 / SHA-512 hash providers and SHA-512 HMAC
  • Public hash / hmac modules for custom CryptoProvider construction
  • Unit tests for packet/header round-trips via rustls::quic::Keys::initial

Test plan

  • cargo fmt
  • RUSTFLAGS=-Dwarnings cargo test --lib (14 tests)
  • Integration tests (tests/builder.rs)
  • CI green on this PR

Stack

  1. feat: add P-521 key exchange and ECDSA RustCrypto/rustls-rustcrypto#287 stack/01-p521
  2. feat: add X448 key exchange and Ed448 signatures RustCrypto/rustls-rustcrypto#288 stack/02-x448-ed448
  3. feat: add AES-CCM cipher suites RustCrypto/rustls-rustcrypto#289 stack/03-aes-ccm
  4. feat: add ChaCha20-Poly1305 session ticketer RustCrypto/rustls-rustcrypto#290 stack/04-ticketer
  5. this PR stack/05-quic

Replace the stub QUIC module with RFC 9001 header protection (AES-ECB and
ChaCha20) and AEAD packet keys for AES-128/256-GCM, AES-128-CCM, and
ChaCha20-Poly1305. Wire those algorithms into the matching TLS 1.3 suites
(CCM-8 stays unsupported). Also enable the SHA-224/SHA-512 hash providers
and SHA-512 HMAC, and re-export the hash/hmac modules for custom providers.
@stevefan1999-personal

Copy link
Copy Markdown
Owner Author

Opened against wrong repo; will open on RustCrypto/rustls-rustcrypto to match stack RustCrypto#287-RustCrypto#290.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant