Question rustls vs Openssl and libfido2 vs webauth-rs about webauthn-rs HOT 1 CLOSED

Hey there,

rustls only provide TLS - webauthn-rs does not use TLS at all! webauthn-rs in this case is relying on cryptographic primitives such as sha2 and ecdsa (which something like rustls combines to create a tls implementation).

So the question you probably want to ask is "why are you using openssl over ring/other rust crate". There are multiple reasons.

First, no other rust cryptograhic primitive library supports the ability to recreate a public ecdsa key from it's x/y components which is required by webauthn. It's literally impossible to use any other library for the cryptographic operations we require.

Second, as I work for SUSE and we have use for this that may end up with clients, there may be requirements to use a verified cryptographic provider - which openssl is but the other rust primitives are not.

Third openssl for it's flaws, has many people now working on it and funding and support that other libraries simply do not have (ie libressl).

Fourth many of the dangers/pitfalls of the openssl api aren't present in it's rust bindings just by virtue of the type system.

If it helps you, this library has had a security assessment and review especially around the use of openssl and the cryptographic elements and it passed with flying colours. You can have a look and review yourself if you like :) https://github.com/kanidm/webauthn-rs/blob/master/src/crypto.rs#L323

Hope that helps,

from webauthn-rs.