Why CHERI
CHERI and Rust
CHERI and Rust are complementary: Rust prevents many errors through language rules, while CHERI enforces pointer authority across native code and component boundaries.
Why it matters
Real products often contain new and established code, multiple languages, firmware and third-party components, so protection must cross language boundaries.
In brief
Are CHERI and Rust alternatives, or can they work together?
CHERI and Rust are complementary. Safe Rust prevents many memory-safety errors through language rules, while CHERI constrains memory access in hardware across C, C++, unsafe Rust, foreign libraries and compartment boundaries.
Key considerations
1. Use Rust to prevent
Write new components in safe Rust where ecosystem, skills and certification needs permit.
2. Use CHERI to enforce
Apply capability protection to native code and hardware-enforced boundaries around components.
3. Design the interface
Review FFI, ownership, allocation and delegated authority so guarantees do not disappear between languages.
Evidence and caveats
Rust does not remove all unsafe code or logic flaws, and CHERI does not make unsafe interfaces correct. Support also varies by platform.
Use evidence from a named system or source and keep claims proportionate. CHERI is one layer in a broader secure-design strategy.