rscrypto

rscrypto is a Rust library of cryptographic primitives, hashes, password hashing, random generation, and checksums. One feature model controls all of them. Portable Rust is the reference implementation. SIMD and assembly backends make it faster on supported targets. Production builds do not depend on C, FFI, OpenSSL, or system libraries.

The rscrypto crate supplies primitives. The companion rscrypto-rustls supplies TLS and QUIC cryptographic adapters.

Install

rscrypto needs Rust 1.100. Until Rust 1.100 is stable, use the 1.100 beta or a newer nightly. Accelerated POWER, IBM Z, and RISC-V builds need a nightly compiler; portable-only builds support the declared MSRV. See Toolchain.

Minimal no_std build with SHA-2 only:

[dependencies]
rscrypto = { version = "0.12", default-features = false, features = ["sha2"] }

All primitives, with operating-system randomness:

[dependencies]
rscrypto = { version = "0.12", features = ["full", "getrandom"] }

The default feature is std. Set default-features = false to remove it. Enable getrandom only for the APIs that get randomness from the operating system, such as key generation, nonces, salts, hedged signing, ML-KEM encapsulation, and RSA blinding. The feature guide explains how to select features. Cargo.toml defines the exact feature graph.

Quick start

use rscrypto::Sha256;

let one_shot = Sha256::digest(b"hello world");

let mut hasher = Sha256::new();
hasher.update(b"hello ");
hasher.update(b"world");

assert_eq!(hasher.finalize(), one_shot);

Hash types support one-shot and streaming use. examples/README.md has runnable examples for AEAD, signatures, RSA, P-256 and P-384 ECDH, X25519, ML-KEM, password hashing, and backend introspection.

Primitives and features

Family	Primitives	Feature
Checksums	CRC-16, CRC-24, CRC-32, CRC-32C, CRC-64/XZ, CRC-64/NVMe	checksums or a leaf feature
Cryptographic hashes	SHA-2, SHA-3, SHAKE, cSHAKE, BLAKE2, BLAKE3, Ascon-Hash/XOF/CXOF	crypto-hashes or a leaf feature
Fast hashes	XXH3-64/128, RapidHash V3-64	fast-hashes or a leaf feature
MACs and KDFs	HMAC-SHA-2/SHA-3, KMAC128/256, Poly1305, HKDF-SHA-2, PBKDF2-HMAC-SHA-2	macs, kdfs, or a leaf feature
Password hashing	Argon2d/i/id, scrypt, bounded PHC password records	password-hashing or a leaf feature
Signatures and RSA	ECDSA P-256/P-384, Ed25519, ML-DSA-44/65/87, SLH-DSA (all 12 FIPS 205 sets, pure and HashSLH-DSA), composite ML-DSA-65 with Ed25519 or ECDSA P-256 (draft-ietf-lamps-pq-composite-sigs-19), RSA signing, verification, encryption, and key generation	signatures or a leaf feature
Key exchange and KEMs	P-256 ECDH, P-384 ECDH, X25519, ML-KEM-512/768/1024	key-exchange or a leaf feature
AEADs	AES-GCM, AES-GCM-SIV, AES-SIV-CMAC, ChaCha20-Poly1305, XChaCha20-Poly1305, AEGIS-256, Ascon-AEAD128	aead or a leaf feature
Random generation	ChaCha20Rng	chacha20-rng (included in full)

ChaCha20Rng accepts a caller-supplied seed and works without std or alloc. rand_core adds generator traits; getrandom adds operating-system seeding.

Signature and KEM keys import and export standard DER (PKCS #8 and SubjectPublicKeyInfo) for ECDSA, Ed25519, RSA, ML-DSA, composite ML-DSA, ML-KEM, and SLH-DSA.

AeadGather encrypts multiple plaintext slices into one ciphertext for AES-GCM and ChaCha20-Poly1305. BLAKE3 supports reader, file, and batch hashing, and an expert decoder verifies sequential unkeyed Bao combined streams. The feature guide describes these APIs and their allocation and std requirements.

The WebSocket accept digest exists only for protocol compatibility. It needs the websocket-sha1 feature. No umbrella feature, including full, enables it.

See docs.rs for exact types and methods. The API compatibility notes explain output types, collection seeds, and retained method names. The cryptographic resilience guide explains security assumptions, migration boundaries, and the evidence to review when choosing stronger cryptography.

TLS and QUIC provider

The rscrypto-rustls companion connects these primitives to rustls and Quinn:

Capability	Coverage
TLS	TLS 1.3; opt-in TLS 1.2 ECDHE suites
Key exchange	X25519MLKEM768 hybrid (preferred), X25519, P-256, P-384; opt-in SecP256r1MLKEM768, SecP384r1MLKEM1024, MLKEM768, MLKEM1024
Authentication	ECDSA P-256/P-384, Ed25519, RSA; opt-in ML-DSA-44/65/87 (ml-dsa) and composite ML-DSA-65 with Ed25519 or ECDSA P-256 at provisional draft codepoints (mldsa65-ed25519, mldsa65-ecdsa-p256)
QUIC	QUIC v1 through Quinn (quinn, opt-in)

The provider supports mutual authentication, session resumption, stateless tickets, and caller-supplied entropy. rustls owns the TLS protocol, rustls-webpki validates certificate paths, and Quinn owns QUIC transport.

The companion requires std and remains unpublished. Its manifest pins rustls and Quinn to upstream development revisions; consumers must use the same Git sources and revisions. See the provider guide for configuration, feature requirements, and limits.

Platforms and dispatch

The portable Rust implementation defines the correct output, byte for byte. Every accelerated backend must give the same output. At compile time, the target sets which backends are available. With std, rscrypto also detects CPU features at run time and selects a backend. If no accelerated backend is available, the portable implementation runs.

The platform guide lists the supported targets. It also explains dispatch, no_std support, and the limits of portable-only.

Assurance

A security claim exists only while its evidence passes. Missing or old evidence removes the claim; it never weakens a gate.