rustls/manual/
features.rs

1/*!
2
3The below list reflects the support provided with the default crate features.
4Items marked with an asterisk `*` can be extended or altered via public
5APIs ([`CryptoProvider`] for example).
6
7[`CryptoProvider`]: crate::crypto::CryptoProvider
8
9## Current features
10
11* TLS1.2 and TLS1.3
12* ECDSA, Ed25519 or RSA server authentication by clients `*`
13* ECDSA, Ed25519 or RSA server authentication by servers `*`
14* Forward secrecy using ECDHE; with curve25519, nistp256 or nistp384 curves `*`
15* AES128-GCM and AES256-GCM bulk encryption, with safe nonces `*`
16* ChaCha20-Poly1305 bulk encryption ([RFC7905](https://tools.ietf.org/html/rfc7905)) `*`
17* ALPN support
18* SNI support
19* Tunable fragment size to make TLS messages match size of underlying transport
20* Optional use of vectored IO to minimise system calls
21* TLS1.2 session resumption
22* TLS1.2 resumption via tickets ([RFC5077](https://tools.ietf.org/html/rfc5077))
23* TLS1.3 resumption via tickets or session storage
24* TLS1.3 0-RTT data
25* Server and optional client authentication
26* Extended master secret support ([RFC7627](https://tools.ietf.org/html/rfc7627))
27* Exporters ([RFC5705](https://tools.ietf.org/html/rfc5705))
28* OCSP stapling by servers
29* [RFC8879](https://tools.ietf.org/html/rfc8879) certificate compression by clients
30  and servers `*`
31
32## Non-features
33
34For reasons explained in the other sections of this manual, rustls does not
35and will not support:
36
37* SSL1, SSL2, SSL3, TLS1 or TLS1.1
38* RC4
39* DES or triple DES
40* EXPORT ciphersuites
41* MAC-then-encrypt ciphersuites
42* Ciphersuites without forward secrecy
43* Renegotiation
44* Kerberos
45* TLS 1.2 protocol compression
46* Discrete-log Diffie-Hellman `*`
47* Automatic protocol version downgrade
48* Using CA certificates directly to authenticate a server/client (often called "self-signed
49  certificates"). _Rustls' default certificate verifier does not support using a trust anchor as
50  both a CA certificate and an end-entity certificate in order to limit complexity and risk in
51  path building. While dangerous, all authentication can be turned off if required --
52  see the [example code](https://github.com/rustls/rustls/blob/992e2364a006b2e84a8cf6a7c3eaf0bdb773c9de/examples/src/bin/tlsclient-mio.rs#L318)_ `*`
53
54*/
rustls/manual/features.rs

rustls/manual/
features.rs
