UnmaintainedRUSTSEC-2016-0005 · rust-crypto
RUSTSEC-2016-0005: rust-crypto is unmaintained; switch to a modern alternative
Short answerNot a bug report: rust-crypto is no longer maintained, so future security issues will not be fixed. Plan to move to a maintained alternative.
| Crate | rust-crypto |
|---|---|
| Type | Unmaintained |
| Affected versions | Before 0.2.37. |
| Fixed in | not applicable (the crate is unmaintained) |
| Severity | not scored |
| Published | 2016-09-06 |
| Last changed | 2022-01-09 |
| Also known as | none |
What to do
- Look for a maintained fork or alternative crate.
- If you cannot move yet, acknowledge it in your audit config so CI stays green while you plan: add
"RUSTSEC-2016-0005"toignorein.cargo/audit.tomlordeny.toml, with a comment saying why. - Find who pulls it in:
cargo tree -i rust-crypto.
Details from the advisory
The rust-crypto crate has not seen a release or GitHub commit since 2016, and its author is unresponsive.
*NOTE: The (old) rust-crypto crate (with hyphen) should not be confused with similarly named (new) RustCrypto GitHub Org (without hyphen). The GitHub Org is actively maintained.*
We recommend you switch to one of the following crates instead, depending on which algorithms you need:
- dalek-cryptography GitHub Org:
- Key agreement:
x25519-dalek - Signature algorithms:
ed25519-dalek ring:- AEAD algorithms: AES-GCM, ChaCha20Poly1305
- Digest algorithms: SHA-256, SHA-384, SHA-512, SHA-512/256 (legacy: SHA-1)
- HMAC
- Key agreement: ECDH (P-256, P-384), X25519
- Key derivation: HKDF
- Password hashing: PBKDF2
- Signature algorithms: ECDSA (P-256, P-384), Ed25519, RSA (PKCS#1v1.5, PSS)
- RustCrypto GitHub Org:
- AEAD algorithms:
aes-gcm,aes-gcm-siv,aes-siv,chacha20poly1305,xsalsa20poly1305 - Block ciphers:
aes,cast5,des - Digest algorithms:
sha2,sha3,blake2,ripemd160(legacy:sha-1, [md-5]) - Key derivation:
hkdf - MACs:
cmac,hmac,pmac,poly1305 - Password hashing:
pbkdf2 - Stream ciphers:
aes-ctr,chacha20,hc-256,salsa20 secp256k1:- Key agreement: ECDH (secp256k1 only)
- Signature algorithms: ECDSA (secp256k1 only)
orion:- AEAD algorithms: ChaCha20Poly1305 (IETF version), XChaCha20Poly1305
- Digest algorithms: SHA-512, BLAKE2b
- Key derivation: HKDF
- MACs: HMAC, Poly1305
- Password hashing: PBKDF2
- Stream ciphers: ChaCha20 (IETF version), XChaCha20
References
- Package: crates.io/crates/rust-crypto
- Advisory: rustsec.org/advisories/RUSTSEC-2016-0005.html
- Report: github.com/DaGenix/rust-crypto/issues/440
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for rust-crypto
Up next
Same craterust-crypto: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?