RustCrypto: Constant-Time Base64
Pure Rust implementation of Base64 (RFC 4648).
Implements multiple Base64 alphabets without data-dependent branches or lookup tables, thereby providing portable "best effort" constant-time operation.
Supports no_std environments and avoids heap allocations in the core API
(but also provides optional alloc support for convenience).
About
This crate implements several Base64 alphabets in constant-time for sidechannel
resistance, aimed at purposes like encoding/decoding the "PEM" format used to
store things like cryptographic private keys (i.e. in the pem-rfc7468 crate).
The paper Util::Lookup: Exploiting key decoding in cryptographic libraries demonstrates how the leakage from non-constant-time Base64 parsers can be used to practically extract RSA private keys from SGX enclaves.
The padded variants require (=) padding. Unpadded variants expressly
reject such padding.
Whitespace is expressly disallowed, with the exception of the
Decoder::new_wrapped and Encoder::new_wrapped modes which provide
fixed-width line wrapping.
Supported Base64 variants
- Standard Base64:
[A-Z],[a-z],[0-9],+,/ - URL-safe Base64:
[A-Z],[a-z],[0-9],-,_ - bcrypt Base64:
.,/,[A-Z],[a-z],[0-9] crypt(3)Base64:.,-,[0-9],[A-Z],[a-z]
Minimum Supported Rust Version
This crate requires Rust 1.60 at a minimum.
We may change the MSRV in the future, but it will be accompanied by a minor version bump.
License
Licensed under either of:
at your option.
Contribution
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.