Skip to content

Adding Siemens sponsorship #127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ounsworth wants to merge 1 commit into from
Closed

Adding Siemens sponsorship #127

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions CONTRIBUTORS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,22 @@ The following organisations and people have contributed to the Bouncy Castle Cry

Thanks, may your castles never deflate!

# Donors
# Sponsors

The following people and organizations donated financially to help with the release of Bouncy Castle Rust.

Donations and sponsorships can be made at: [Cryptic Forest Software github](https://github.com/sponsors/CrypticForest)
* Siemens is a Premier Sponsor of the bc-rust project

Tho following organizations donate developer time to the Bouncy Castle Rust project.

* Cryptic Forest Software
* OpenSSL Corporation
* KeyFactor

# Organizations

Holders of [Cryptic Forest Software](mailto:crypticforest@crypticforest.com) maintenance and support contracts directly support the development and tailoring of this library. You know who you are!
Holders of [Cryptic Forest Software](mailto:crypticforest@crypticforest.com) maintenance and support contracts directly
support the development and tailoring of this library. You know who you are!

# People -- direct contributions and pull requests

Expand Down
82 changes: 52 additions & 30 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,52 +6,69 @@
[![Rust Docs](https://github.com/bcgit/bc-rust/actions/workflows/rust-docs.yml/badge.svg)](https://github.com/bcgit/bc-rust/actions/workflows/rust-docs.yml)

> [!WARNING]
> This package is currently in ALPHA, meaning that it is not complete or production-ready and will be evolving rapidly over the coming months.
> We are releasing only a small set of cryptographic algorithms in order to get feedback from the community on the API and build structure.
> This package is currently in ALPHA, meaning that it is not complete or production-ready and will be evolving rapidly
over the coming months.
> We are releasing only a small set of cryptographic algorithms in order to get feedback from the community on the API
and build structure.


The Bouncy Castle Crypto package is a Rust implementation of cryptographic algorithms, it was developed by the Legion of the Bouncy Castle, a registered Australian Charity, with a little help! The Legion, and the latest goings on with this package, can be found at https://www.bouncycastle.org.
The Bouncy Castle Crypto package is a Rust implementation of cryptographic algorithms, it was developed by the Legion of
the Bouncy Castle, a registered Australian Charity, with a little help! The Legion, and the latest goings on with this
package, can be found at https://www.bouncycastle.org.

The aim of this package is to bring the Bouncy Castle team's experience building easy-to-use and FIPS-validated cryptography to Rust. The build system is designed so that you can build the entire library, a single algorithm, or anything in between. It also comes with a command-line interface for all the supported algorithms.
The aim of this package is to bring the Bouncy Castle team's experience building easy-to-use and FIPS-validated
cryptography to Rust. The build system is designed so that you can build the entire library, a single algorithm, or
anything in between. It also comes with a command-line interface for all the supported algorithms.

If you are interested in purchasing a support contract or accelerating the development of this package, please contact us at [office@bouncycastle.org](mailto:office@bouncycastle.org) or [mike@bouncycastle.org](mailto:mike@bouncycastle.org).
If you are interested in purchasing a support contract or accelerating the development of this package, please contact
us at [office@bouncycastle.org](mailto:office@bouncycastle.org)
or [mike@bouncycastle.org](mailto:mike@bouncycastle.org).

## Docs and Benches
# Sponsors and Contributors

See [CONTRIBUTORS.md].

@ounsworth ounsworth Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TODO -- also needs a link to the bc-rust sponsors page on bouncycastle.org, once that's up.


# Docs and Benches

During ALPHA, we're just publishing docs and benchmark results unofficially on github.

Rust crate docs are available here: https://bcgit.github.io/bc-rust/bouncycastle/

Benchmark data is available here: https://bcgit.github.io/bc-rust/benches/report/index.html

A basic script that reports lines-of-code and some basic code quality metrics is available here: https://bcgit.github.io/bc-rust/code_stats.txt
A basic script that reports lines-of-code and some basic code quality metrics is available
here: https://bcgit.github.io/bc-rust/code_stats.txt

## Portability, Performance, and Memory-Safety
# Portability, Performance, and Memory-Safety

This project does not attempt to be the fastest or the most constant-time.
There exist excellent cryptographic libraries that include hand-optimized assembly that will always beat Bouncy Castle Rust
on performance benchmarks, as well as having a smaller memory and code-size footprint.
Many of these libraries also use formal methods to prove the constant-time and memory-safety security properties of their code.
This project does not attempt to be the fastest or the most constant-time. There exist excellent cryptographic libraries
that include hand-optimized assembly that will always beat Bouncy Castle Rust on performance benchmarks, as well as
having a smaller memory and code-size footprint. Many of these libraries also use formal methods to prove the
constant-time and memory-safety security properties of their code.

Bouncy Castle Rust aims to take a different approach: this is a pure-Rust implementation that strictly forbids unsafe rust code by placing:
Bouncy Castle Rust aims to take a different approach: this is a pure-Rust implementation that strictly forbids unsafe
rust code by placing:

```rust
#![forbid(unsafe_code)]
```
at the top of every sub-crate.
We also avoid (except where absolutely necessary) third-party depencendencies which could themselves introduce unsafe code.

This gives maximum portability because our code will compile on any platform supported by the Rust compiler.
It also means that our code automatically inherits all the memory and type safety guarantees of Rust.
However, it unfortunately means that we cannot guarantee constant-time since the Rust compiler itself does not guarantee constant-time.
We do a best-effort to write constant-time code; for example our Hex and Base64 implementations are both based on the constant-time implementation recommended in (Sieck, 2021)](https://arxiv.org/pdf/2108.04600.pdf),
and our cryptographic primitives use bitshift-and-XOR constructions instead of loop-and-if constructions but we cannot fully
guarantee that the Rust compiler does not make optimizations that break the constant-time properties.
This means that Bouncy Castle Rust should be constant-time enough for most applications, however, if your threat model includes
resisting attacks by bad guys with soldering irons, oscilloscopes and electron microscopes, then this might not be the cryptographic library for you
and if you get in touch with us, we would be happy to recommend an alternative project that uses formally-verified assembly more suited to your needs.
at the top of every sub-crate. We also avoid (except where absolutely necessary) third-party depencendencies which could
themselves introduce unsafe code.

## Roadmap
This gives maximum portability because our code will compile on any platform supported by the Rust compiler. It also
means that our code automatically inherits all the memory and type safety guarantees of Rust. However, it unfortunately
means that we cannot guarantee constant-time since the Rust compiler itself does not guarantee constant-time. We do a
best-effort to write constant-time code; for example our Hex and Base64 implementations are both based on the
constant-time implementation recommended in (Sieck, 2021)](https://arxiv.org/pdf/2108.04600.pdf), and our cryptographic
primitives use bitshift-and-XOR constructions instead of loop-and-if constructions but we cannot fully guarantee that
the Rust compiler does not make optimizations that break the constant-time properties. This means that Bouncy Castle
Rust should be constant-time enough for most applications, however, if your threat model includes resisting attacks by
bad guys with soldering irons, oscilloscopes and electron microscopes, then this might not be the cryptographic library
for you and if you get in touch with us, we would be happy to recommend an alternative project that uses
formally-verified assembly more suited to your needs.

# Roadmap

This alpha release includes the following cryptographic primitives:

Expand All @@ -62,8 +79,11 @@ This alpha release includes the following cryptographic primitives:
* HMAC
* HKDF
* The NIST HashDRBG random number generator
* ML-DSA
* ML-KEM

But more than anything, the alpha release focuses on the design of the public trait and error type system contained in the `core-interface` sub-crate.
But more than anything, the alpha release focuses on the design of the public trait and error type system contained in
the `core-interface` sub-crate.

Next up will be to round out the set of cryptographic primitives:

Expand All @@ -84,14 +104,15 @@ After that, we'll tackle in some kind of order (depending on public interest and

## Community feedback is most welcome!

As this is an alpha release, we're eagerly looking for feedback from the community. We would especially like feedback on the following areas:
As this is an alpha release, we're eagerly looking for feedback from the community. We would especially like feedback on
the following areas:

* Public API ergonomics and granularity of exposed functionality.
* Certification / compliance concerns.
* Prioritization of roadmap items above.

You can reach us at [office@bouncycastle.org](mailto:office@bouncycastle.org) or [mike@bouncycastle.org](mailto:mike@bouncycastle.org).

You can reach us at [office@bouncycastle.org](mailto:office@bouncycastle.org)
or [mike@bouncycastle.org](mailto:mike@bouncycastle.org).

## Building

Expand All @@ -113,4 +134,5 @@ cargo build -p sha3

## Legal

This software is distributed under a license based on the MIT X Consortium license. To view the license, [see here](https://www.bouncycastle.org/licence.html).
This software is distributed under a license based on the MIT X Consortium license. To view the
license, [see here](https://www.bouncycastle.org/licence.html).
Loading