Rullst Security 🛡️

“Defense-in-Depth RASP, Cryptographic Vault & Runtime Protection for Rust”

rullst-security provides authenticated field encryption, bounded defensive middleware, local abuse controls, and security telemetry. Its RASP/DLP rules are defense-in-depth heuristics: they reduce specific risks but do not establish complete OWASP coverage, replace parameterized SQL/authorization, or certify the application that mounts them. Which security layer to use, and when compares these layers with the Core baseline and gives one recommended production stack.

⚡ Capability & Lifecycle Matrix

🔐 1. Rullst Vault (Authenticated AES-256-GCM)

FieldEncryptor provides authenticated encryption at rest (AEAD) with a versioned envelope and keyring-assisted rotation. Applications can keep prior keys readable while writing with a new key; deployment coordination, key custody, data re-encryption, and retirement remain operator responsibilities.

Usage Example

use rullst_security::vault::FieldEncryptor;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let master_key = [0x42u8; 32]; // 256-bit cryptographic key
    let sensitive_data = "user_ssn_123-45-6789";

    // Encrypt with key ID and Additional Authenticated Data (AAD)
    let encrypted = FieldEncryptor::encrypt_with_key_id(
        sensitive_data,
        master_key,
        "key-2026-v1",
        b"tenant-organization-id-42",
    )?;
    println!("Ciphertext Envelope: {}", encrypted);

    // Decrypt and verify authentication tag and AAD
    let decrypted = FieldEncryptor::decrypt_with_aad(
        &encrypted,
        master_key,
        b"tenant-organization-id-42",
    )?;
    assert_eq!(decrypted, sensitive_data);

    Ok(())
}

🛡️ 2. Runtime Application Self-Protection (RASP)

The RASP request inspector scrutinizes incoming requests before they reach your controllers:

#![allow(unused)]
fn main() {
use rullst_security::RaspInspector;

let is_sqli = RaspInspector::inspect_text("admin' OR '1'='1");
assert!(is_sqli);

let is_traversal = RaspInspector::inspect_uri("/files/../../../etc/passwd");
assert!(is_traversal);
}

Mount RaspSecurityLayer explicitly when the extended inspector is desired. The default rullst-core::Server currently mounts the smaller Core WAF rather than this layer; consolidation remains roadmap work.

The inspector matches case-insensitive signatures, raw and after one percent-decoding pass, in the request target, every header except Cookie and Authorization, and identity-encoded textual bodies up to 1 MiB. It does not inspect multipart or binary bodies, does not undo double encoding, HTML entities or SQL comments, and refuses ordinary text that contains a signature (../, sleep(, /bin/sh). It reduces exposure to known payloads; it is not an injection defense on its own.

🚫 3. Anti-Bruteforce Login Guard & Tarpit

#![allow(unused)]
fn main() {
use rullst_security::LoginGuard;

async fn apply_login_delay() {
let guard = LoginGuard::new(); // defaults: 5 failures, 15-minute local jail

// Record failure and apply the returned progressive delay in the async handler.
let delay = guard.record_login_failure("account:alice");
tokio::time::sleep(delay).await;

if guard.is_jailed("account:alice") {
    println!("Identity is in the local Login Jail");
}
}
}

📱 4. Multi-Factor Authentication (TOTP MFA)

#![allow(unused)]
fn main() {
use rullst_security::{
    build_otpauth_uri, generate_mfa_secret, generate_totp_code, verify_totp_code,
};

let secret = generate_mfa_secret();
let otp_uri = build_otpauth_uri("Rullst SaaS", "[email protected]", &secret);
let current_code = generate_totp_code(&secret);

// Validate 6-digit code submitted by user
let is_valid = verify_totp_code(&secret, "123456");
}

The secret must be encrypted at rest. Recovery helpers return plaintext codes only at enrollment and salted HMAC verifiers for storage; consume/delete must be one durable transaction. The application still owns replay/attempt limiting, enrollment confirmation, recovery UX, audit and clock-monitoring policy.