Feature for providing custom crypto options and implementations

[lgmugnier]

Hello!

I'm trying to see if I can adapt this library to run in a FIPS way which essentially means I need a way to swap out the crypto implementations for FIPS-certified ones like aws-lc-rs or boringssl. I will probably also need some future weird or custom algorithms for fun and business.

I was wondering how amenable everyone would be to me implementing a configuration option for the Client and Server that allows for custom algorithms and implementations? Or maybe I missed something and this is possible without a new feature?

[Eugeny]

russh used to have a partial-FIPS-compliant build mode (RSA only) but it proved to be too hard to maintain with multiple parallel crypto backends.
You'd need to swap out all crypto references as well as fork ssh-key and repeat it there.

[lgmugnier]

I was thinking of implementing something like rustls' CryptoProvider that way people can use their own libraries (like a fips-certified one) but doesn't require any direct support/maintentance from russh. It would default to what we have now and anything else would be the responsibility of whoever is importing the lib and defining their own custom CryptoProvider.

[theoparis]

+1 - I'd like to use https://github.com/ctz/graviola with russh.

[youer0219]

+1. I want to embed the OQS library and even other types of libraries. Yet this seems to involve a considerable amount of engineering effort. Moreover, none of the major SSH libraries appear to have a similar provider mechanism.