rust-crypto is abandoned, time to look for alternatives?

[untitaker]

I've just been informed in the Rust IRC channel that rust-crypto is abandoned and should not be used anymore. As example of critical fixes that are not merged, I was given DaGenix/rust-crypto#349

Libraries that probably have the primitives rust-jwt needs:

• https://github.com/dnaq/sodiumoxide
• https://github.com/briansmith/ring
• https://github.com/sfackler/rust-openssl

[Keats]

Thanks for the heads up, opened a thread on reddit for some feedback

[frewsxcv]

opened a thread on reddit

Link to said thread

[DaGenix]

Rust-Crypto isn't abandoned, but it has been badly ignored and for that I apologize. I just merged a fix for the issue you referenced above and will try to get a release done with that fix sometime this week.

That being said, Rust-Crypto is still very experimental and has not had anything resembling the amount of security review of something like OpenSSL or sodiumoxide. If security is important to you, there are good reasons you might want to consider using those libraries anyway.

[Keats]

@DaGenix great to hear!
I also use rust-crypto for https://github.com/Keats/rust-bcrypt so i'll see if i can help on some aspect when I have time

[Keats]

Pushed 1.1.2 that contains rust-crypto 0.2.35

[Keats]

I just moved to ring in 1.1.4, closing this