[kixelated]

Completes quest/m2/adoption/aws-lc-rs/rind-aws-lc-rs.md.

Problem

A crate that calls aws-lc-rs's API has no way onto rind without porting every call. rind-ring covers ring 0.17, but aws-lc-rs has diverged from ring: it takes algorithms by value, has extra modules (cipher, kem, key_wrap, encoding, rsa OAEP), and has different constructors and errors.

Approach

A new published crate, rind-aws-lc-rs 1.0.0, offers aws-lc-rs 1.x's API name for name for every item rind backs. A crate switches with aws-lc-rs = { package = "rind-aws-lc-rs", version = "1" }.

• Modules: aead (with quic, tls, and nonce sequences), agreement, cipher (CTR, CBC, and CBC with PKCS#7), constant_time, digest, encoding, error, hkdf, hmac, io, iv, kem (ML-KEM-768), key_wrap (AES-KW and KWP), pbkdf2, pkcs8, rand, rsa (PKCS#1 and PSS signing, and OAEP), and signature (ECDSA P-256, P-384 and P-521 with every rind digest in both formats, Ed25519, and RSA). It also adds rind's cpu module, as rind-ring does.
• Features: every aws-lc-rs feature but fips is declared and changes nothing. wipe is the crate's own (see Wiping).
• Not offered: items rind refuses or lacks stay out, so code that uses them fails to build. The README lists them: ML-DSA, ML-KEM-512 and ML-KEM-1024, SHA-224, PKCS#1 v1.5 encryption, from_components, the streaming cipher contexts, and others. It also has a "Behaves differently" list.
• Versioning: package.metadata.rind.upstream = "1" holds the version to aws-lc-rs's major through sh/adapter-versions.sh.
• Standalone: the crate depends only on rind, untrusted, and zeroize. It does not depend on rind-ring; see Alternatives.
• RSA public keys are loaded and encoded through rind, which refuses what AWS-LC's RSA_check_key refuses. Only the PKCS#1 field reader is hand-written.
• Panics: the crate panics where aws-lc-rs panics (such as an oversized pbkdf2::derive, documented on the function), so its signatures stay aws-lc-rs's, as rind-ring's stay ring's.
• Wiping: a new wipe feature, which aws-lc-rs lacks, turns on rind/wipe (from moq-dev/rind#461) and wipes the adapter's own copies of secrets on drop (PKCS#8 documents, the OAEP key's PKCS#8, Ed25519 seeds, raw cipher keys, private encodings, and ML-KEM shared secrets) through a crate-private Wiped<T>. Without it nothing is wiped, as in rind's default build. The crate's README documents it, and the root README's "Wiping keys" and MIGRATING.md's cross-API row, which said no adapter forwards the feature, now name it.
• Change to rind: rind::digest::Digest becomes Copy, so the adapter's Digest can be, as aws-lc-rs's is. high::pbkdf2 copies a Digest instead of cloning it, and its Lean proof drops the clone step.
• Registration: the crate is added to the CI package lists in build.yml and armv7.sh, to the README adapter table, and to MIGRATE.md and MIGRATING.md, where the aws-lc-rs route is now a rename instead of a port.

Testing

• tests/differential.rs runs proptests against aws-lc-rs 1.19 for digest, hmac, hkdf (and every key type HKDF fills), pbkdf2, aead, the TLS record keys, nonce sequences, cipher, and key_wrap.
• tests/keys.rs checks key and signature interop both ways: ECDH in raw, SPKI and compressed forms; ECDSA signing and verification across key encodings; Ed25519 PKCS#8 v1 and v2 bytes; ML-KEM-768; RSA PKCS#1 (equal signatures) and PSS (including Max and Custom salt lengths); and OAEP with labels.
• tests/ctgrind.rs checks the secret paths the adapter adds (HKDF and its keys, open_within, the short PBKDF2 compare, cipher, and key wrap). It is clean under admin/ctgrind adapters --release.
• tests/wycheproof.rs runs the HKDF vectors (SHA-1 to SHA-512) through the adapter's own HKDF.
• tests/zeroing.rs checks the adapter's own heap copies of secrets (the OAEP key's PKCS#8 and its cached keys, seeds, private encodings, raw cipher keys, and ML-KEM shared secrets) are wiped before they are freed. It does this with a scanning global allocator and a positive control. It builds only with wipe, and the gate (sh/dispatch.sh check:rs) runs it with --features wipe whenever rind-aws-lc-rs is selected, and nightly build.yml runs it on every OS beside rind's. With the gate removed and the feature off, all 5 secret tests fail, so the feature really controls the wipe.
• Consumer check: jsonwebtoken 11.1.0's own suite and s2n-quic-crypto 0.91's own suite pass with aws-lc-rs patched to a shim that re-exports this crate.
• A rustdoc JSON diff against aws-lc-rs 1.19 finds no missing public names beyond the ones listed above.
• just check passes on 7c0b8cf, the merge of main at d259b75: 702 tests, then rind's 12 and the adapter's 6 zeroing tests under wipe. cargo test -p rind -p rind-aws-lc-rs --features rind/wipe,rind-aws-lc-rs/wipe --test zeroing, nightly's new command, passes on bfee6af.
• nix develop .#prove --command admin/prove passes. Merging moq-dev/rind#476's PBKDF2 proof conflicted with Digest becoming Copy: Secret::block now copies its first U rather than cloning it, and proofs/Rind/X86_64/Pbkdf2.lean drops the clone step that left unused.

Impact

• New crate only. rind gains one additive Copy derive.
• Lines up with moq-dev/rind#461, which merged during this round: the adapter's wipe enables rind/wipe, so one switch wipes both rind's keys and the adapter's copies.
• Quests: the aws-lc-rs patch quest's fixture now starts with s2n-quic-crypto and jsonwebtoken, and the epic's README says the crate stands alone.
• rustls's aws_lc_rs provider, rustls-webpki's aws-lc-rs feature, and rcgen's aws_lc_rs feature name ML-DSA (and rustls names ML-KEM-1024), so they do not build on this crate until rind has those algorithms. quinn-proto and libp2p are blocked through rustls. The README says so.

Alternatives

• Share code with rind-ring, as the epic's plan says. I rejected this because the APIs overlap less than they look. aws-lc-rs takes hmac::Algorithm and hkdf::Algorithm by value, has different Debug output, different error kinds, and extra trait impls on most types. A shared base would need a third crate, or rind-ring types that grow aws-lc-rs's quirks. The duplicated code is thin forwarding to rind.
• Re-export rind types: rejected. Adapters re-export no rind types, so a rind major bump never forces one here.

Follow-ups

• rind-ring/LICENSE is stale compared with rind/LICENSE; this crate copies the current one.
• cipher::StreamingEncryptingKey and its siblings could be built on rind's CTR and CBC.
• RSA verify_digest needs a rind API that verifies a prehashed RSA message.

Models

• Size: L
  Implementer: Codex, gpt-6.1-sol, xhigh effort (integration)
• Implementer: Claude Code, claude-opus-5-5, high effort

Decisions

Settled by the maintainer on 2026-11-07 at review round 3's design checkpoint:

1. Code sharing: ✅ keep the crate standalone (rejected: share code with rind-ring). The APIs differ in most details; see Alternatives.
2. pbkdf2::derive on an output over (2^32 - 1) hash outputs: ✅ panic, for name-for-name parity with aws-lc-rs and rind-ring, documented on the function (rejected: leave derive out).
3. tests/zeroing.rs's freed-memory scan: ✅ keep it, documented as unsound in principle as rind's own zeroing test is (rejected: per-type in-place checks, which miss the Vec and Arc heap copies; no test).
4. Wiping: ✅ follow rind's opt-in wipe feature: the adapter wipes its heap copies of secrets only under its own wipe feature, which enables rind/wipe, and the zeroing test is gated on it (rejected: always wipe).
5. The aws-lc-rs patch quest's fixture: ✅ start with s2n-quic-crypto and jsonwebtoken (rejected: rustls, rustls-webpki, and rcgen, which need ML-DSA and ML-KEM-1024 that rind lacks).

Review

Rewritten by quest review after each round.

• Reviewer: Codex, gpt-6.1-sol, xhigh effort
• Session: 01a1b771-c693-7f32-8a88-8b3df1390a63, round 1
• Head: bfee6af
• Base: origin/main at 0b2f253
• Score: 10/10, No actionable findings remain in the specified diff; the wipe integration and recorded validation support landing, though builds and tests were not rerun in the read-only sandbox.
• Findings: none

Round 1 of the new session (started because #461 changed AGENTS.md) reviewed bfee6af with no findings. 7c0b8cf adds only a conflict-free merge of main (d259b75).

Integration validation

Head 21a66e5 merges main at 63b68f4. The two conflicts only combined the package lists so both rind-str0m and rind-aws-lc-rs run on every existing target; no runtime behavior changed. This mechanical merge retains the clean local review recorded above.

• Full just ci origin/main: passed, including 724 selected tests and both wiping suites.
• nix develop .#prove --command admin/prove: passed for x86_64 and aarch64.
• The previous land-fixer handback's missing Lean toolchain is resolved.

(Written by GPT-6.1 Sol with xhigh)

[kixelated]

Design change: following the maintainer's decisions of 2026-11-07 at review round 3's checkpoint, the adapter wipes its own heap copies of secrets only under a new wipe feature (a crate-private Wiped<T> replaces Zeroizing), matching rind's opt-in wiping in moq-dev/rind#461. tests/zeroing.rs builds only with the feature, and the gate runs it with --features wipe. Since #461 is still open, the feature cannot yet enable rind/wipe; whichever PR lands second makes it wipe = ["rind/wipe"]. The crate stays standalone, the oversized pbkdf2::derive panic and the freed-memory scan stay as they are, and the aws-lc-rs patch quest's fixture now starts with s2n-quic-crypto and jsonwebtoken. Review round 4 continued the session as the maintainer asked, and reported no findings.

(Written by Claude Opus 5.5 with high)

[pullfrog]

Your OpenCode Go account is out of credit. Top it up, then re-trigger Pullfrog.

OpenCode Go's response

provider error: Insufficient account funds

Top up OpenCode Go →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using glm-5.3}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 24 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a96ad390-a0cc-4a13-ac9f-b3aa76d41caa

Commits

Reviewing files that changed from the base of the PR and between 63b68f4 and 21a66e5.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 48

• .github/workflows/build.yml
• Cargo.toml
• MIGRATE.md
• MIGRATING.md
• README.md
• proofs/Rind/X86_64/Pbkdf2.lean
• quest/m2/adoption/aws-lc-rs/README.md
• quest/m2/adoption/aws-lc-rs/aws-lc-rs-patch.md
• quest/m2/adoption/aws-lc-rs/rind-aws-lc-rs.md
• rind-aws-lc-rs/CHANGELOG.md
• rind-aws-lc-rs/Cargo.toml
• rind-aws-lc-rs/LICENSE
• rind-aws-lc-rs/README.md
• rind-aws-lc-rs/src/aead.rs
• rind-aws-lc-rs/src/aead/nonce_sequence.rs
• rind-aws-lc-rs/src/aead/quic.rs
• rind-aws-lc-rs/src/aead/tls.rs
• rind-aws-lc-rs/src/agreement.rs
• rind-aws-lc-rs/src/buffer.rs
• rind-aws-lc-rs/src/cipher.rs
• rind-aws-lc-rs/src/constant_time.rs
• rind-aws-lc-rs/src/cpu.rs
• rind-aws-lc-rs/src/der.rs
• rind-aws-lc-rs/src/digest.rs
• rind-aws-lc-rs/src/encoding.rs
• rind-aws-lc-rs/src/error.rs
• rind-aws-lc-rs/src/hkdf.rs
• rind-aws-lc-rs/src/hmac.rs
• rind-aws-lc-rs/src/io.rs
• rind-aws-lc-rs/src/iv.rs
• rind-aws-lc-rs/src/kem.rs
• rind-aws-lc-rs/src/key_wrap.rs
• rind-aws-lc-rs/src/lib.rs
• rind-aws-lc-rs/src/pbkdf2.rs
• rind-aws-lc-rs/src/pkcs8.rs
• rind-aws-lc-rs/src/rand.rs
• rind-aws-lc-rs/src/rsa.rs
• rind-aws-lc-rs/src/signature.rs
• rind-aws-lc-rs/src/wipe.rs
• rind-aws-lc-rs/tests/ctgrind.rs
• rind-aws-lc-rs/tests/differential.rs
• rind-aws-lc-rs/tests/keys.rs
• rind-aws-lc-rs/tests/wycheproof.rs
• rind-aws-lc-rs/tests/zeroing.rs
• rind/src/high/digest.rs
• rind/src/high/pbkdf2.rs
• sh/armv7.sh
• sh/dispatch.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[kixelated]

Design change: moq-dev/rind#461 merged during this round, so the adapter's wipe feature now enables rind/wipe, and one switch wipes both rind's keys and the adapter's copies. The gate and nightly build.yml run the adapter's zeroing tests beside rind's, and the root README and MIGRATING.md, which said no adapter forwards the feature, now name rind-aws-lc-rs's. Merging main also met moq-dev/rind#476's PBKDF2 proof: with Digest now Copy, Secret::block copies instead of cloning, and the proof drops its clone step (admin/prove passes). The new review session's first round found nothing on bfee6af.

(Written by Claude Opus 5.5 with high)

[moq-bot]

quest land watch: the merge queue removed this pull request at 7c0b8cf because it conflicts with main (merge_conflict).

The land fixer works on it in the background, and the watcher re-enqueues it at the back of the queue once it is fixed or judged flaky, or hands it back here with what it needs.

(written by quest land watch)

[moq-bot]

codex, gpt-6.1-sol, medium effort land fixer note:

Prepared merge commit 86fa26c695a8b2dcfb64c55ba9ac62142d7dbc79 on pr-465, retaining both base's rind-str0m and this PR's rind-aws-lc-rs in every conflicting test list. The resolution edits protected .github/workflows/build.yml and sh/armv7.sh. Other protected changes arrive unchanged from base. Cargo.lock merged cleanly; compared with base, its only addition is this PR's workspace package.

Failure log lines 3–13:

Auto-merging .github/workflows/build.yml
CONFLICT (content): Merge conflict in .github/workflows/build.yml
Auto-merging Cargo.lock
Auto-merging Cargo.toml
Auto-merging MIGRATE.md
Auto-merging MIGRATING.md
Auto-merging README.md
Auto-merging sh/armv7.sh
CONFLICT (content): Merge conflict in sh/armv7.sh
Auto-merging sh/dispatch.sh
Automatic merge failed; fix conflicts and then commit the result.

just ci base passed Rust formatting, Clippy, all 724 tests, rind's 12 wipe tests, the adapter's 6 wipe tests, doc tests, and the host MSRV build. Stopped the remaining gate after identifying the proof toolchain blocker. git diff --check, actionlint, shellcheck sh/armv7.sh sh/dispatch.sh, and bash -n sh/armv7.sh sh/dispatch.sh passed.

The proof check requires Lean v4.35.0, which is unavailable locally. Toolchain setup requests https://releases.lean-lang.org/lean4/v4.35.0/lean-4.35.0-linux.tar.zst; stopped setup and proof validation because that host is outside this fixer's permitted dependency sources. Full required validation remains incomplete, so this is a handback. Please provision the pinned toolchain, review the protected workflow resolution, and run both complete checks before applying the commit.

(written by codex, gpt-6.1-sol, medium effort)

[moq-bot]

codex, gpt-6.1-sol, medium effort land fixer: Conflict resolution is committed, but nix develop .#prove --command admin/prove cannot be completed: required Lean setup reports 'info: downloading https://releases.lean-lang.org/lean4/v4.35.0/lean-4.. Recommendation: Review commit 86fa26c695a8b2dcfb64c55ba9ac62142d7dbc79, including protected .github/workflows/build.yml; run just ci base and nix develop .#prove --command admin/prove with the pinned Lean toolchain p

Auto-merging .github/workflows/build.yml
CONFLICT (content): Merge conflict in .github/workflows/build.yml
Auto-merging Cargo.lock
Auto-merging Cargo.toml
Auto-merging MIGRATE.md
Auto-merging MIGRATING.md
Auto-merging README.md
Auto-merging sh/armv7.sh
CONFLICT (content): Merge conflict in sh/armv7.sh
Auto-merging sh/dispatch.sh
Automatic merge failed; fix conflicts and then commit the result.

(written by codex, gpt-6.1-sol, medium effort)