Cryptography in Rust — rustls, ring & RustCrypto

Overview

Rust has no JCA and no curated crypto stdlib — the language ships nothing, and the ecosystem answered with some of the most credible cryptography libraries anywhere: rustls, a from-scratch memory-safe TLS stack now displacing OpenSSL well beyond Rust; ring, the BoringSSL-derived primitives workhorse; and RustCrypto, the pure-Rust trait-based crate families covering everything else. The practical craft is choosing between those poles per need, plus the hygiene layer (zeroize, secrecy) that Rust's ownership model makes unusually effective.

Key points

• rustls is the TLS answer: modern protocols only (TLS 1.2/1.3), no legacy baggage, audited, and faster than OpenSSL in many paths. Pluggable crypto providers — aws-lc-rs (the default; FIPS-validatable) or ring — and the ecosystem wires it everywhere: reqwest (rustls-tls), tonic, sqlx, redis all take it as a feature flag; rustls-pemfile loads certs, rcgen generates them (tests, mTLS setups).
• ring: fast, opinionated primitives (AEAD, HKDF, signatures, RNG) with a deliberately narrow API — hard to misuse, hard to extend; historically the foundation under rustls and jsonwebtoken. Its maintenance-mode status since 2025 accelerated the drift toward aws-lc-rs and RustCrypto — check which backend your dependencies actually pull.
• RustCrypto is the trait-based bazaar: aes-gcm, chacha20poly1305, sha2, hmac, argon2/scrypt/bcrypt (under the password-hash API), rsa, the elliptic-curve crates — pure Rust, no_std-capable, uniform traits (Aead, Digest, Mac). Mix-and-match where ring is take-it-or-leave-it.
• The dalek curves: ed25519-dalek/x25519-dalek/curve25519-dalek — the standard modern-signature stack (also RustCrypto-adjacent); most token and end-to-end schemes land here.
• Password hashing: argon2 with the password-hash PHC-string API is the default; bcrypt for compatibility — same guidance as every stack, with the OWASP parameters in AppSec fundamentals.
• age (and its Rust-native implementation rage) is the file/backup encryption answer — modern, misuse-resistant, scriptable; the "stop inventing GPG workflows" tool.
• Secret hygiene is where ownership shines: zeroize wipes memory on drop (#[derive(ZeroizeOnDrop)]), secrecy's SecretString/SecretBox blocks accidental Debug/Display leaks and forces explicit expose_secret() calls — compiler-visible secret handling with no JVM/Go equivalent.
• Randomness: rand for general use, getrandom/OsRng for key material — ring and RustCrypto types take RNGs explicitly, keeping the OS entropy path visible.
• openssl bindings remain for FIPS mandates the aws-lc-rs provider can't cover, legacy algorithm needs, and C-parity requirements — a dependency-hygiene cost (native build, vendoring) you pay knowingly.

Details

Choosing, quickly

Related

• Security in Rust applications — the map — parent map.
• OAuth2 & OIDC in Rust — JWT validation on these primitives.
• Building & releasing — musl builds and the openssl-vs-rustls packaging consequences.
• AppSec fundamentals — algorithm choice and key management theory.
• Cryptography in Java — JCA/JSSE — the provider-architecture contrast.
• Cryptography in Go — the curated-stdlib contrast; Rust reaches the same misuse-resistance through crate culture instead.