RustCrypto: Constant-Time Base64
Pure Rust implementation of Base64 (RFC 4648).
Implements multiple Base64 alphabets without data-dependent branches or lookup tables, thereby providing portable "best effort" constant-time operation.
Supports no_std environments and avoids heap allocations in the core API
(but also provides optional alloc support for convenience).
About
This crate implements several Base64 alphabets in constant-time for sidechannel
resistance, aimed at purposes like encoding/decoding the "PEM" format used to
store things like cryptographic private keys (i.e. in the pem-rfc7468 crate).
The paper Util::Lookup: Exploiting key decoding in cryptographic libraries demonstrates how the leakage from non-constant-time Base64 parsers can be used to practically extract RSA private keys from SGX enclaves.
The padded variants require (=) padding. Unpadded variants expressly
reject such padding.
Whitespace is expressly disallowed, with the exception of the
Decoder::new_wrapped and Encoder::new_wrapped modes which provide
fixed-width line wrapping.
Supported Base64 variants
- Standard Base64:
[A-Z],[a-z],[0-9],+,/ - URL-safe Base64:
[A-Z],[a-z],[0-9],-,_ - bcrypt Base64:
.,/,[A-Z],[a-z],[0-9] crypt(3)Base64:.,-,[0-9],[A-Z],[a-z]
Minimum Supported Rust Version (MSRV) Policy
MSRV increases are not considered breaking changes and can happen in patch releases.
The crate MSRV accounts for all supported targets and crate feature combinations, excluding explicitly unstable features.
License
Licensed under either of:
at your option.
Contribution
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.