native-ossl

Safe, idiomatic Rust wrappers for modern OpenSSL (3.0.7+, 4.x).

native-ossl gives Rust code direct access to the OpenSSL cryptographic library already installed on the system — no reimplementation, no vendored C code by default, no protocol logic added on top. The API covers the full public OpenSSL stack: EVP algorithms, asymmetric keys, TLS, X.509, OCSP, PKCS#12, BIO, and provider/library-context management.

What is provided

Requirements

• OpenSSL 3.0.7 or later (system install; 3.2+ for KEM/message-sign APIs, 3.5+ for SSH-KDF/KBKDF)
• Rust 1.77 or later (required for c"..." C-string literal syntax)
• pkg-config

# Fedora / RHEL
sudo dnf install openssl-devel
# Ubuntu / Debian
sudo apt install libssl-dev pkg-config
# macOS (Homebrew)
brew install openssl@3
export PKG_CONFIG_PATH="$(brew --prefix openssl@3)/lib/pkgconfig"

Usage

[dependencies]
native-ossl = { version = "0.1" }

SHA-256

usenative_ossl::digest::DigestAlg;letsha256=DigestAlg::fetch(c"SHA2-256",None)?;letmutctx=sha256.new_context()?;ctx.update(b"hello world")?;letmutout=[0u8;32];ctx.finish(&mutout)?;

AES-256-GCM

usenative_ossl::{cipher::{CipherAlg,AeadEncryptCtx,AeadDecryptCtx},rand::Rand};letalg=CipherAlg::fetch(c"AES-256-GCM",None)?;letmutkey=[0u8;32];letmutnonce=[0u8;12];Rand::fill(&mutkey)?;Rand::fill(&mutnonce)?;letmutenc=AeadEncryptCtx::new(&alg,&key,&nonce,None)?;letmutct=vec![0u8;plaintext.len()];enc.update(plaintext,&mutct)?;enc.finalize(&mutct[n..])?;letmuttag=[0u8;16];enc.tag(&muttag)?;

HKDF

usenative_ossl::{digest::DigestAlg,kdf::HkdfBuilder};letsha256=DigestAlg::fetch(c"SHA2-256",None)?;letmutokm=[0u8;32];HkdfBuilder::new(&sha256).key(ikm).salt(salt).info(info).derive(&mutokm)?;

Ed25519 sign / verify

usenative_ossl::pkey::KeygenCtx;letkey=KeygenCtx::new(c"ED25519")?.generate()?;letsig=key.sign_oneshot(message)?;key.verify_oneshot(&sig,message)?;

TLS client (fluent builder)

usenative_ossl::ssl::{SslCtxBuilder,Client,TlsVersion,HostnameFlags};letctx=SslCtxBuilder::<Client>::new()?.min_proto_version(TlsVersion::Tls12)?.default_ca_paths()?.verify_peer().verify_hostname("example.com")?.verify_hostname_flags(HostnameFlags::NO_PARTIAL_WILDCARDS)?.build()?;letmutssl=ctx.new_ssl()?;ssl.set_connect_state();ssl.connect()?;

Inspect certificate signature algorithm

usenative_ossl::x509::X509;letcert=X509::from_pem(&std::fs::read("cert.pem")?)?;letinfo=cert.signature_info()?;// info.md_nid, info.pk_nid, info.security_bits
println!("pk_nid={} md_nid={} bits={}",info.pk_nid,info.md_nid,info.security_bits);

Cargo features

Version-gated APIs

The build system detects the installed OpenSSL version automatically and activates the appropriate #[cfg(...)] gates. No manual flags are needed.

Algorithm flags (ossl_slhdsa, ossl_mldsa, ossl_mlkem) are detected from header macros rather than the version number, so they track distribution backports correctly.

Building and testing

cargo build
cargo test --all
cargo clippy --all-targets -- -D warnings

See docs/src/dev/building.md for FIPS mode, fips-provider, vendored builds, and the full CI checklist.

Documentation

cargo install mdbook
cd docs && mdbook build --open

Or browse the source under docs/src/.

License

Apache-2.0. See LICENSE.