aws-lc-rs v1.17.1

🎉 AWS-LC FIPS v3 Module Has Been Validated

The AWS-LC FIPS v3 module has been awarded FIPS 140-3 validation by NIST's CMVP:

• Certificate #5314 (static)
• Certificate #5298 (dynamic)

Seek guidance from a local FIPS compliance expert regarding requirements for your deployment environments. Please consult the Security Policies associated with our certificates if you have questions.

aws-lc-fips-sys (utilized via the fips feature of aws-lc-rs) currently uses the validated FIPS v3 module.

• In the upcoming aws-lc-rs v1.18.0 release, we plan to switch aws-lc-fips-sys to our FIPS v4 branch.

What's Changed

• Support linking against a system-installed AWS-LC:
  • Set AWS_LC_SYS_SYSTEM_DIR or let pkg-config / OPENSSL_* environment variables auto-detect an existing AWS-LC installation instead of building from source by @justsmth in #1129
  • Support system-installed AWS-LC FIPS library for aws-lc-fips-sys by @justsmth in #1143
  • Auto-detect system AWS-LC from OPENSSL_* and pkg-config by @justsmth in #1156
  • Gate system AWS-LC on a declared minimum version by @justsmth in #1152
• Implement Send/Sync for RSA hazmat encryption key types by @justsmth in #1128
• Add Salt::none constructor for HKDF by @justsmth in #1135
• Add wasm32-unknown-emscripten build and test support by @justsmth in #1059
• Report specific key rejection reasons for invalid RSA key sizes by @justsmth in #1153

Upstream AWS-LC (v5.1.0)

aws-lc-sys now aligns with AWS-LC v5.1.0 (previously v1.73.0). Notable upstream changes include:

• ML-DSA native assembly backends for x86_64 and aarch64, imported from mldsa-native by @jakemas in aws/aws-lc#3195 and aws/aws-lc#3219
• Security hardening: stack secret zeroing, tightened PKCS7/OCSP/ASN.1 error handling (Various PRs)

Build Improvements

• Fix memcmp_check build failure when CFLAGS contains LTO flags by @justsmth in #1134
• Fix missing poly_Rq_mul symbol in Linux x86_64 build by @Lebei2046 in #1130
• Apply -ffile-prefix-map to jitterentropy builder by @justsmth in #1139
• Select compiler flag dialect by driver mode, not target ABI by @justsmth in #1147

Issues Being Closed

• RSA hazmat encryption key types missing Send/Sync -- #1125
• RSA key rejection reports generic Unspecified for invalid key sizes -- #1082
• Build failure when CFLAGS contains LTO flags (Windows/clang) -- #1132
• cargo-xwin (clang-cl) jitterentropy build failure on x86_64-pc-windows-msvc -- #1146
• Support system-provided AWS-LC library -- #936
• cpu_arm_linux.c assumes sys/auxv.h and getauxval (uclibc targets) -- #1108
• jitterentropy embeds absolute paths to files -- #1137

Other Merged PRs

• Add ML-DSA aarch64 native assembly to CC builder scripts by @jakemas in #1113
• Clarify HKDF info concatenation and encoding responsibility by @justsmth in #1145
• CI: support zig cross compile for arm32 by @justsmth in #1124
• fix(clippy): fix truncate warnings by @justsmth in #1126
• ci: replace dtolnay/rust-toolchain with direct rustup invocations by @justsmth in #1133
• Reduce AEAD and RSA test iterations under DISABLE_SLOW_TESTS by @justsmth in #1119
• ci(compilers): retry-tolerant curl, latest Go, drop unused PowerShell by @justsmth in #1138
• ci(cross): generate MSRV-aware lockfile for alpine-linux by @justsmth in #1150
• Harden GitHub Actions workflows against script injection by @justsmth in #1161
• Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #1141
• Bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #1142
• Bump codecov/codecov-action from 6 to 7 by @dependabot[bot] in #1144
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #1155
• Prepare aws-lc-fips-sys v0.13.15 by @justsmth in #1158
• Prepare aws-lc-sys v0.42.0 by @justsmth in #1162
• Prepare aws-lc-rs v1.17.1 by @justsmth in #1164

New Contributors

• @Lebei2046 made their first contribution in #1130

Full Changelog: v1.17.0...v1.17.1