Make ring optional

[tomleavy]

It would be nice to take advantage of the serialization part of the library without being tied specifically to ring. I believe RemoteKeypair could be leveraged to provide your own implementation of signing (perhaps with the Openssl crate)?

[est31]

That's an interesting proposal. I've thought about adding optional support for the rust crypto crates so you can choose between them and ring. I'm not sure about the review side of things though.

Openssl, at least the CLI, provides facilities to generate certificates as well, so I'm not sure why one wants to use it with rcgen instead of using it directly. What is your use case for this specific set up?

[tomleavy]

What I'm trying to do is have my code port to as many systems / crypto libraries as possible while sharing as much as they can. One thing I want to be able to do is sign using WebCrypto API in the browser so I don't need any additional crypto library dependencies, the OpenSSL thing was just an example.

[djc]

While RemoteKeyPair works for signing, there's a still a bunch more stuff that would need work. For example, there's a decent amount of SHA256 going on outside the scope of signing itself.

[est31]

@tomleavy I see, that makes sense.

[iamjpotts]

ring also has a non-trivial license.

[est31]

cc rustls/rustls#521, rustls/rustls#1184

[cpu]

cc rustls/rustls#521, rustls/rustls#1184

Also under consideration for rustls/webpki: rustls/webpki#130

[cpu]

As of acec387 it's possible to build rcgen with aws-lc-rs instead of ring using --no-default-features --features=aws_lc_rs.

Being able to use an arbitrary cryptographic library will require more foundational work, closer to Rustls crypto provider struct and associated traits. I suspect that's what the OP wanted, so I think we should leave this issue open despite the fact that ring is technically now an optional dependency as the title of the issue requests.

[tomleavy]

I'm good to close this based on aws-lc-rs ... my original goal was to build in additional x509 support for mls-rs which is also an AWS project and has bindings for aws-lc-rs

[est31]

Okay, closing as per #201. Thanks, everyone!