loadingalias/rscryptoRust cryptography w/ zero required deps: hashes, checksums, MACs, KDFs, password hashing, AEADs, signatures, RSA, key exchange, ML-KEM, and ML-DSA. Portable Rust ref w/ SIMD & ASM backends.
# rscrypto
[](https://crates.io/crates/rscrypto)
[](https://docs.rs/rscrypto)
[](Cargo.toml)
[](#license)
`rscrypto` is a Rust library of cryptographic primitives, hashes, password hashing, and checksums.
One feature model controls all of them.
Portable Rust is the reference implementation.
SIMD and assembly backends make it faster on supported targets.
Production builds do not depend on C, FFI, OpenSSL, or system libraries.
`rscrypto` supplies primitives only.
It is not a TLS stack, a PKI toolkit, a key store, or a protocol implementation.
## Install
`rscrypto` needs Rust 1.100.
Until Rust 1.100 is stable, use the 1.100 beta or a newer nightly.
Accelerated POWER, IBM Z, and RISC-V builds need a nightly compiler;
`portable-only` builds support the declared MSRV.
See [Toolchain](https://github.com/loadingalias/rscrypto/blob/main/docs/platforms.md#toolchain).
Minimal `no_std` build with SHA-2 only:
```toml
[dependencies]
rscrypto = { version = "0.12", default-features = false, features = ["sha2"] }
```
All primitives, with operating-system randomness:
```toml
[dependencies]
rscrypto = { version = "0.12", features = ["full", "getrandom"] }
```
The default feature is `std`.
Set `default-features = false` to remove it.
Enable `getrandom` only for the APIs that get randomness from the operating system,
such as key generation, nonces, salts, hedged signing, ML-KEM encapsulation, and RSA blinding.
The [feature guide](https://github.com/loadingalias/rscrypto/blob/main/docs/features.md) explains how to select features.
[`Cargo.toml`](https://github.com/loadingalias/rscrypto/blob/main/Cargo.toml) defines the exact feature graph.
## Quick start
```rust
use rscrypto::Sha256;
let one_shot = Sha256::digest(b"hello world");
let mut hasher = Sha256::new();
hasher.update(b"hello ");
hasher.update(b"world");
assert_eq!(hasher.finalize(), one_shot);
```
Hash types support one-shot and streaming use.
[`examples/README.md`](https://github.com/loadingalias/rscrypto/blob/main/examples/README.md) has runnable examples for AEAD, signatures, RSA, P-256 and P-384 ECDH,
X25519, ML-KEM, password hashing, and backend introspection.
## Primitives and features
| Family | Primitives | Feature |
| --- | --- | --- |
| Checksums | CRC-16, CRC-24, CRC-32, CRC-32C, CRC-64/XZ, CRC-64/NVMe | `checksums` or a leaf feature |
| Cryptographic hashes | SHA-2, SHA-3, SHAKE, cSHAKE, BLAKE2, BLAKE3, Ascon-Hash/XOF/CXOF | `crypto-hashes` or a leaf feature |
| Fast hashes | XXH3-64/128, RapidHash V3-64 | `fast-hashes` or a leaf feature |
| MACs and KDFs | HMAC-SHA-2/SHA-3, KMAC128/256, Poly1305, HKDF-SHA-2, PBKDF2-HMAC-SHA-2 | `macs`, `kdfs`, or a leaf feature |
| Password hashing | Argon2d/i/id, scrypt, bounded PHC password records | `password-hashing` or a leaf feature |
| Signatures and RSA | ECDSA P-256/P-384, Ed25519, [ML-DSA-44/65/87](https://github.com/loadingalias/rscrypto/blob/main/docs/mldsa.md), SLH-DSA (all 12 FIPS 205 sets, pure and HashSLH-DSA), RSA signing, verification, encryption, and key generation | `signatures` or a leaf feature |
| Key exchange and KEMs | P-256 ECDH, P-384 ECDH, X25519, ML-KEM-512/768/1024 | `key-exchange` or a leaf feature |
| AEADs | AES-GCM, AES-GCM-SIV, AES-SIV-CMAC, ChaCha20-Poly1305, XChaCha20-Poly1305, AEGIS-256, Ascon-AEAD128 | `aead` or a leaf feature |
Signature and KEM keys import and export standard DER (PKCS #8 and SubjectPublicKeyInfo)
for ECDSA, Ed25519, RSA, ML-DSA, ML-KEM, and SLH-DSA.
The WebSocket accept digest exists only for protocol compatibility.
It needs the `websocket-sha1` feature.
No umbrella feature, including `full`, enables it.
See [docs.rs](https://docs.rs/rscrypto) for exact types and methods.
The [API compatibility notes](https://github.com/loadingalias/rscrypto/blob/main/docs/api-compatibility.md) explain output types, collection seeds,
and retained method names.
The [cryptographic resilience guide](https://github.com/loadingalias/rscrypto/blob/main/docs/cryptographic-resilience.md) explains security assumptions,
migration boundaries, and the evidence to review when choosing stronger cryptography.
## Platforms and dispatch
The portable Rust implementation defines the correct output, byte for byte.
Every accelerated backend must give the same output.
At compile time, the target sets which backends are available.
With `std`, `rscrypto` also detects CPU features at run time and selects a backend.
If no accelerated backend is available, the portable implementation runs.
The [platform guide](https://github.com/loadingalias/rscrypto/blob/main/docs/platforms.md) lists the supported targets.
It also explains dispatch, `no_std` support, and the limits of `portable-only`.
## Assurance
A security claim exists only while its evidence passes.
Missing or old evidence removes the claim; it never weakens a gate.
- **Correctness:** NIST, RFC, upstream, and Wycheproof vectors, independent implementations,
property tests, negative tests, and Miri.
- **Fuzzing:** fuzz targets run the production code across primitives, parsers, state machines,
and trait boundaries.
Minimized inputs replay as tests.
A separate lane runs them with sanitizers.
- **Backends:** differential tests compare each accelerated backend with portable Rust.
They cover lengths, alignments, tails, state transitions, dispatch,
and fallback on native targets.
- **Constant time:** [`ct.toml`](https://github.com/loadingalias/rscrypto/blob/main/ct.toml) lists the exact operations under test.
The evidence combines inspection of optimized linked binaries,
BINSEC proofs for fixed-shape kernels, and DudeCT timing tests for end-to-end operations.
- **Secrets:** types that own secrets hide their contents in `Debug` output
and clear their initialized storage on drop.
Copy rules vary by type; for example, keyed BLAKE2 and BLAKE3 state supports `Clone`.
The [secret ownership inventory](https://github.com/loadingalias/rscrypto/blob/main/docs/secret-ownership.md) lists each type.
- **Failures:** verification failures do not tell why they failed.
A failed AEAD open clears the unauthenticated plaintext.
A constant-time claim applies only to the target, features, compiler, profile,
and operation that its evidence covers.
Source code that looks branchless is not proof.
For details, see the [test evidence](https://github.com/loadingalias/rscrypto/blob/main/docs/test-vector-coverage.md), the [constant-time model](https://github.com/loadingalias/rscrypto/blob/main/docs/constant-time.md), the [secret lifecycle](https://github.com/loadingalias/rscrypto/blob/main/docs/secret-lifecycle.md),
and the [threat model](https://github.com/loadingalias/rscrypto/blob/main/THREAT_MODEL.md).
`rscrypto` has not had a third-party security audit.
The project cannot pay for one now, and automated evidence does not replace it.
`rscrypto` does not claim to be audited, FIPS 140-3 validated, formally verified,
or constant time as a whole crate.
Report a suspected vulnerability through [GitHub Private Vulnerability Reporting](https://github.com/loadingalias/rscrypto/security/advisories/new).
Follow the [`SECURITY.md`](https://github.com/loadingalias/rscrypto/blob/main/SECURITY.md) process.
Do not open a public issue.
## Performance
Bench run [#39888945058](https://github.com/loadingalias/rscrypto/actions/runs/39888945058) measured the v0.12.0 source on eight platforms on 2026-10-23,
and the same plan ran on a local Apple M1 Pro.
Each platform has up to 914 headline comparisons: checksums, hashes, MACs, KDFs, password hashing,
AEADs, signatures, key exchange, ML-KEM, ML-DSA, SLH-DSA, and RSA.
The comparisons follow [equal-task rules](https://github.com/loadingalias/rscrypto/blob/main/docs/benchmarking.md#comparison-rules).
Each comparison divides the median time of the fastest external crate by the median time of `rscrypto`.
A ratio above 1.00x means `rscrypto` is faster; a tie is 0.95x through 1.05x.
| Platform | Points | Faster | Tie | Slower | Median | Geomean |
| ----------------------- | -----: | -----: | ---: | -----: | -----: | ------: |
| Intel Linux (`c8i`) | 914 | 372 | 254 | 288 | 1.00x | 1.23x |
| AMD Linux (`c8a`) | 914 | 420 | 264 | 230 | 1.03x | 1.20x |
| Intel Windows (`c8i`) | 914 | 420 | 258 | 236 | 1.03x | 1.25x |
| AMD Windows (`c8a`) | 914 | 517 | 149 | 248 | 1.08x | 1.20x |
| Graviton5 Linux (`c9g`) | 914 | 379 | 284 | 251 | 1.03x | 1.21x |
| POWER10 Linux | 914 | 414 | 314 | 186 | 1.03x | 1.38x |
| IBM Z Linux | 911 | 726 | 90 | 95 | 2.31x | 3.07x |
| RISC-V Linux | 914 | 406 | 276 | 232 | 1.03x | 1.08x |
| Apple M1 Pro (local) | 914 | 380 | 381 | 153 | 1.03x | 1.24x |
These results are from one run per platform, at half the default sampling time,
on cloud and shared hosts.
RISC-V's completed `auth` family was recovered from the same run on 2026-10-24;
its row now includes all 914 headline comparisons.
The Apple row comes from one local run whose host was not checked for load first;
treat its small differences as unconfirmed.
On IBM Z, `rscrypto` uses its CPACF and vector backends where they exist, and AWS-LC is absent.
The [benchmark overview](https://github.com/loadingalias/rscrypto/blob/main/benchmark_results/OVERVIEW.md#2026-10-23-v0120-release-benchmark-run) gives the results by family,
TLS 1.3 and QUIC connections through `rscrypto-rustls`, the largest remaining losses, the method, and the limits.
The [comparison contracts](https://github.com/loadingalias/rscrypto/blob/main/docs/benchmarking.md#ml-kem-and-argon2-comparison-contracts) define equivalent ML-KEM and Argon2 workloads.
Older summary tables mixed different workloads.
They are historical records, not current claims.
The [October 24 follow-up](https://github.com/loadingalias/rscrypto/blob/main/benchmark_results/OVERVIEW.md) measures standalone Poly1305, BLAKE3 readers,
and RSA import after the dependency and compiler refresh.
Matched Apple M1 Pro comparisons against rebuilt v0.12 source show Poly1305 at 3.44–5.23x
for the selected empty, 64 B, 1 KiB, and 16 KiB inputs,
and RSA import at 1.44x and 1.49x for the selected 2048- and 8192-bit PSS verification cases.
These use eight balanced prebuilt rounds;
the overview retains the repeat spread and exact workloads.
The matched Graviton3 cold 1 MiB BLAKE3 file reader takes about 58% longer and remains unresolved.
This focused subset does not replace the full release catalog above or qualify its older Apple row.
## Project
The guides and examples describe the source in this repository.
For a published version, use the matching [API documentation](https://docs.rs/rscrypto).
Read [`CONTRIBUTING.md`](https://github.com/loadingalias/rscrypto/blob/main/CONTRIBUTING.md) before you change code.
[`CHANGELOG.md`](https://github.com/loadingalias/rscrypto/blob/main/CHANGELOG.md) lists published changes.
## License
Dual-licensed under [Apache-2.0](https://github.com/loadingalias/rscrypto/blob/main/LICENSE-APACHE) or [MIT](https://github.com/loadingalias/rscrypto/blob/main/LICENSE-MIT), at your option.