Conversation
Route SigV4 HMAC-SHA256 / SHA-256 and (when combined with sigv4a) SigV4a ECDSA-P256 through aws-lc-rs (or aws-lc-fips-sys) when the new features are enabled, mirroring the additive __rustls / rustls-aws-lc / rustls-aws-lc-fips pattern in aws-smithy-http-client and the companion PR smithy-lang#4690 for aws-smithy-checksums. The default build is unchanged and keeps the existing hmac / sha2 / p256 (RustCrypto) path; the new features are strictly opt-in. This is the aws-sigv4 half of smithy-rs#4681. With both halves landed, FIPS-conscious customers can route TLS, request checksums, and request signing end-to-end through aws-lc-rs without forking the runtime crates. An internal __aws-lc-rs feature gates every swapped code path; the public aws-lc-rs and fips features each select the aws-lc-rs backend explicitly (aws-lc-sys vs aws-lc-fips-sys). Source-level cfgs ensure that when __aws-lc-rs is active, no RustCrypto cryptographic code path is executed for SigV4 or SigV4a, even when sigv4a is also enabled. For the SigV4a ECDSA path, the existing 32-byte deterministic scalar contract from generate_signing_key is preserved. calculate_signature wraps the scalar in a minimal 51-byte RFC 5915 SEC1 ECPrivateKey DER (publicKey field intentionally omitted) and hands it to EcdsaKeyPair::from_private_key_der, which lets AWS-LC derive the public point internally — no p256 code path is required. Verified on macOS (aarch64-apple-darwin): - cargo test -p aws-sigv4 (default, RustCrypto) 89 ok - cargo test -p aws-sigv4 --features sigv4a 124 ok - cargo test -p aws-sigv4 --features aws-lc-rs 89 ok - cargo test -p aws-sigv4 --features "aws-lc-rs sigv4a" 124 ok - cargo build -p aws-sigv4 --features "fips sigv4a" ok - cargo clippy -p aws-sigv4 --features "aws-lc-rs sigv4a" --all-targets -- -D warnings clean
This is an unmerged PR into smithy-rs that someone created ([but didn't try to merge, as the maintainers didn't want to support the extra feature](smithy-lang#4690)). Going to see if I can work off of this.
jkaczman
changed the title
jkaczman
marked this pull request as draft
September 22, 2026 12:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re: