Struct rustls::crypto::CipherSuiteCommon

pub struct CipherSuiteCommon {
    pub suite: CipherSuite,
    pub hash_provider: &'static dyn Hash,
    pub confidentiality_limit: u64,
}

Common state for cipher suites (both for TLS 1.2 and TLS 1.3)

Fields

suite: CipherSuite

The TLS enumeration naming this cipher suite.

hash_provider: &'static dyn Hash

Which hash function the suite uses.

confidentiality_limit: u64

Number of TCP-TLS messages that can be safely encrypted with a single key of this type

Once a MessageEncrypter produced for this suite has encrypted more than confidentiality_limit messages, an attacker gains an advantage in distinguishing it from an ideal pseudorandom permutation (PRP).

This is to be set on the assumption that messages are maximally sized – each is 2¹⁴ bytes. It does not consider confidentiality limits for QUIC connections - see the [quic::KeyBuilder.confidentiality_limit] field for this context.

For AES-GCM implementations, this should be set to 2²⁴ to limit attack probability to one in 2⁶⁰. See AEBounds (Table 1) and draft-irtf-aead-limits-08:

>>> p = 2 ** -60
>>> L = (2 ** 14 // 16) + 1
>>> qlim = (math.sqrt(p) * (2 ** (129 // 2)) - 1) / (L + 1)
>>> print(int(qlim).bit_length())
24

For chacha20-poly1305 implementations, this should be set to u64::MAX: see https://www.ietf.org/archive/id/draft-irtf-cfrg-aead-limits-08.html#section-5.2.1

Implementations

impl CipherSuiteCommon

pub fn fips(&self) -> bool

Return true if this is backed by a FIPS-approved implementation.

This means all the constituent parts that do cryptography return true for fips().