rscrypto

rscrypto provides pure Rust cryptographic primitives, cryptographic and fast hashes, password hashing, and checksums behind one feature model.

It has no production C/FFI, OpenSSL, or system-library dependency. Leaf features support narrow builds; umbrella features compose larger surfaces.

Use one leaf feature for one primitive, a group for a subset of primitives, or full for the full crate surface. The portable Rust backend is always present. SIMD and ASM are only accelerators.

Published benchmark snapshot: 1.59x geomean across the Linux runners vs the fastest-external competitors with 4,052 / 6,750 wins and 6,101 / 6,750 wins-or-ties.

macOS Apple Silicon local evidence: 1.37x geomean vs fastest-external competitors with 382 / 774 wins and 708 / 774 wins-or-ties.

Raw runs, methodology, and known losses are in benchmark_results/OVERVIEW.md.

Chart: benchmark scorecard. Values above 1.00x mean rscrypto is faster than the fastest matched external implementation.

Why rscrypto?

• One feature model for hashes, MACs, KDFs, password hashing, AEADs, signatures, key exchange, ML-KEM, RSA, and checksums.
• No OpenSSL or production C/FFI dependency.
• Concrete types, scoped errors, typed keys/nonces/tags, and opaque verification failures across the supported primitives.
• Portable Rust implementations are the reference path; SIMD and ASM are accelerators tested against that path.
• no_std, WASM, server, CLI, embedded, and audit-constrained builds use the same leaf-feature model.
• Public validation evidence covers vectors, differential tests, fuzz corpus replay, Miri, backend equivalence, and scoped constant-time release gates.

rscrypto is a primitives crate. It is not a TLS stack, PKI toolkit, key store, or protocol implementation. It does not claim FIPS 140-3 validation, a third-party audit, formal verification, or whole-crate constant-time behavior.

Install

Minimal no_std SHA-2 build:

[dependencies]
rscrypto = { version = "0.7.8", default-features = false, features = ["sha2"] }

Full primitive stack with OS randomness enabled:

[dependencies]
rscrypto = { version = "0.7.8", features = ["full", "getrandom"] }

Use default-features = false for no_std builds. Enable getrandom only when you need APIs that generate salts, keys, nonces, or RSA key-gen entropy from the operating system.

Quick Start

use rscrypto::Sha256;

let one_shot = Sha256::digest(b"hello world");

let mut h = Sha256::new();
h.update(b"hello ");
h.update(b"world");

assert_eq!(h.finalize(), one_shot);

The common API shape is one-shot when convenient and streaming when needed.

Common Workflows

Use docs/types.md when you need the full type map, and docs/features.md when you need the smallest feature set.

What You Get

Flags are layered by use:

• Leaf Primitives: sha2, blake3, aes-gcm, ed25519, x25519, ml-kem, crc32, etc.
• Families/Groups: hashes, checksums, macs, kdfs, password-hashing, aead, signatures, key-exchange.

Full Feature Inventory: docs/features.md. Public Type Inventory: docs/types.md.

Constant-Time Boundaries

rscrypto makes only release-bound, scoped constant-time claims for secret-bearing operations, not for every function in the crate. ct.toml records the candidate primitive/configuration set; it does not create a public claim by itself. A claim exists only where the matching signed GitHub release includes an attested rscrypto-X.Y.Z-ct-evidence.tar.gz bundle that passes all required gates for that exact version, commit, target, profile, and feature set.

Secret-bearing fixed-size owners do not implement PartialEq or Eq. Their ct_eq methods return an opaque CtDecision; callers must explicitly consume it with declassify() to obtain a branchable bit. Verification APIs keep that boundary internal and return one opaque Result. This is misuse resistance at the Rust API boundary, not proof about downstream machine code.

The main candidate secret-bearing surfaces in ct.toml are MAC/tag verification, AEAD authentication failure shape, X25519 scalar multiplication, Ed25519 signing and secret public-key derivation, ECDSA P-256/P-384 blinded signing, ML-KEM-512/768/1024 key gen, encapsulation, decapsulation secret surfaces, RSA private sign/decrypt leaves, and selected password-verification comparisons.

Public parsing, unlisted key gen, OS randomness, raw hashes, checksums, non-cryptographic hashes, benchmark paths, and public-key verification math are not blanket constant-time claims. See docs/constant-time.md for the exact claim and verification model and docs/compliance.md for review boundaries. Releases through v0.6.4 do not contain this bundle and therefore carry no release-bound constant-time claim.

Portability & Accel

rscrypto keeps the portable Rust path as the byte-for-byte authority. ISA kernels are selected only when the target and runtime CPU support them.

Full platform matrix: docs/platforms.md.

Security

rscrypto makes scoped constant-time claims only when a matching release publishes the required evidence bundle, never for every API or build. The fixed-size secret owners named in docs/secret-ownership.md overwrite their owned bytes on drop and mask Debug; the claim does not extend to caller copies. Verification failures use opaque errors, and failed AEAD opens clear caller output buffers. Release artifacts are signed-tag gated, published through crates.io Trusted Publishing, and covered by GitHub build provenance attestations.

No third-party audit, FIPS 140-3 certificate, or formal whole-crate proof is claimed. Report vulnerabilities through GitHub Private Vulnerability Reporting or SECURITY.md, not public issues.

Docs

• Start: docs.rs, examples/, docs/features.md, docs/types.md
• Security and review: SECURITY.md, THREAT_MODEL.md, docs/constant-time.md, docs/compliance.md
• Evidence: docs/test-vector-coverage.md, docs/platforms.md,

MSRV

Rust 1.91.0.

The pinned nightly in rust-toolchain.toml is used for Miri, fuzzing, and exotic-architecture checks.

License

Dual-licensed under Apache-2.0 or MIT, at your option.