AnotherTLS

Yet another TLS implementation, but written from scratch (including the crypto) in pure Rust - of course. The focus of this implementation is the simplicity and to use no dependencies. I started this project to deep dive into Rust, cryptography and network protocols.

If you are interested in hacking TLS, you should checkout my VulnTLS project.

What makes AnotherTLS unique?

It depends only on the standard library and the ibig crate. So you will find the entire TLSv1.3 stack in a single repo to play around with, as I do with my VulnTLS implementation. Also, everything is pub, so you can use AnotherTLS to easily simulate parts of TLS for example to write an exploit.

With the current version it is possible to connect via curl or the browser with the AnotherTLS server. AnotherTLS can also be used as a client. Since the parsing of certificates is still WIP, it is not yet possible to connect (securely) to known websites (resp. certificates are not verified).

handshake and application data

$ cargo run --bin server_https
# other window
$ curl -iv --insecure https://localhost:4000/

client certificate

$ cargo run --bin server_client_auth
# other window
$ cd ./examples/src/bin/config/client_cert/
$ curl --cert client.signed.cert --key client.key -iv --insecure https://localhost:4000/

For more information about using AnotherTLS, see the ./examples folder.

depending standards

The TLSv1.3 stack consists of the following standards, which are also implemented in this repository.

implemented

• SHA256
• SHA384
• AES
• AES_GCM
• prime256v1
• X25519
• HKDF
• HMAC
• X.509
• CHACHA20_POLY1305
• CHACHA20_POLY1305_TLS

open

• TLS curves: secp384r1

security

Currently, the focus of this implementation is to be TLS-complaint according to the RFC8446, but when all requirements are implemented, I will switch the focus to the security part, because this is one of the main reasons I started this project.

Todo

• setup tlsfuzzer
• setup TLS-Attacker