rscrypto

rscrypto is a Rust library of cryptographic primitives, hashes, password hashing, random generation, and checksums. One feature model controls all of them. Portable Rust is the reference implementation. SIMD and assembly backends make it faster on supported targets. Production builds do not depend on C, FFI, OpenSSL, or system libraries.

The rscrypto crate supplies primitives. The companion rscrypto-rustls supplies TLS and QUIC cryptographic adapters.

rscrypto needs Rust 1.100. Until Rust 1.100 is stable, use the 1.100 beta or a newer nightly. Accelerated POWER, IBM Z, and RISC-V builds need a nightly compiler; portable-only builds support the declared MSRV. See Toolchain.

Minimal no_std build with SHA-2 only:

[dependencies]
rscrypto = { version = "0.12", default-features = false, features = ["sha2"] }

All primitives, with operating-system randomness:

[dependencies]
rscrypto = { version = "0.12", features = ["full", "getrandom"] }

The default feature is std. Set default-features = false to remove it. Enable getrandom only for the APIs that get randomness from the operating system, such as key generation, nonces, salts, hedged signing, ML-KEM encapsulation, and RSA blinding. The feature guide explains how to select features. Cargo.toml defines the exact feature graph.

use rscrypto::Sha256;

let one_shot = Sha256::digest(b"hello world");

let mut hasher = Sha256::new();
hasher.update(b"hello ");
hasher.update(b"world");

assert_eq!(hasher.finalize(), one_shot);

Hash types support one-shot and streaming use. examples/README.md has runnable examples for AEAD, signatures, RSA, P-256 and P-384 ECDH, X25519, ML-KEM, password hashing, and backend introspection.

ChaCha20Rng accepts a caller-supplied seed and works without std or alloc. rand_core adds generator traits; getrandom adds operating-system seeding.

Signature and KEM keys import and export standard DER (PKCS #8 and SubjectPublicKeyInfo) for ECDSA, Ed25519, RSA, ML-DSA, composite ML-DSA, ML-KEM, and SLH-DSA.

AeadGather encrypts multiple plaintext slices into one ciphertext for AES-GCM and ChaCha20-Poly1305. BLAKE3 supports reader, file, and batch hashing, and an expert decoder verifies sequential unkeyed Bao combined streams. The feature guide describes these APIs and their allocation and std requirements.

The WebSocket accept digest exists only for protocol compatibility. It needs the websocket-sha1 feature. No umbrella feature, including full, enables it.

See docs.rs for exact types and methods. The API compatibility notes explain output types, collection seeds, and retained method names. The cryptographic resilience guide explains security assumptions, migration boundaries, and the evidence to review when choosing stronger cryptography.

The rscrypto-rustls companion connects these primitives to rustls:

The provider supports mutual authentication, session resumption, stateless tickets, and caller-supplied entropy. rustls owns the TLS protocol and rustls-webpki validates certificate paths. The QUIC transport belongs to the application.

The companion requires std and remains unpublished. Its manifest pins rustls to an upstream development revision; consumers must use the same Git source and revision. See the provider guide for configuration, feature requirements, and limits.

The portable Rust implementation defines the correct output, byte for byte. Every accelerated backend must give the same output. At compile time, the target sets which backends are available. With std, rscrypto also detects CPU features at run time and selects a backend. If no accelerated backend is available, the portable implementation runs.

The platform guide lists the supported targets. It also explains dispatch, no_std support, and the limits of portable-only.

A security claim exists only while its evidence passes. Missing or old evidence removes the claim; it never weakens a gate.

• Correctness: NIST, RFC, upstream, and Wycheproof vectors, independent implementations, property tests, negative tests, and Miri.
• Fuzzing: fuzz targets run the production code across primitives, parsers, state machines, and trait boundaries. Minimized inputs replay as tests. A separate lane runs them with sanitizers.
• Backends: differential tests compare each accelerated backend with portable Rust. They cover lengths, alignments, tails, state transitions, dispatch, and fallback on native targets.
• TLS and QUIC: provider tests compare with ring and AWS-LC. Separate runners exercise OpenSSL and Go TLS peers, quic-go QUIC peers, and a declared BoGo TLS 1.2/1.3 profile. The provider test commands document campaign scope and exclusions.
• Constant time: ct.toml lists the exact operations under test. The evidence combines inspection of optimized linked binaries, BINSEC proofs for fixed-shape kernels, and DudeCT timing tests for end-to-end operations.
• Secrets: types that own secrets hide their contents in Debug output and clear their initialized storage on drop. Copy rules vary by type; for example, keyed BLAKE2 and BLAKE3 state supports Clone. The secret ownership inventory lists each type.
• Failures: verification failures do not tell why they failed. A failed AEAD open clears the unauthenticated plaintext.

A constant-time claim applies only to the target, features, compiler, profile, and operation that its evidence covers. Source code that looks branchless is not proof.

For details, see the test evidence, the constant-time model, the secret lifecycle, and the threat model.

rscrypto has not had a third-party security audit. The project cannot pay for one now, and automated evidence does not replace it. rscrypto does not claim to be audited, FIPS 140-3 validated, formally verified, or constant time as a whole crate.

Report a suspected vulnerability through GitHub Private Vulnerability Reporting. Follow the SECURITY.md process. Do not open a public issue.

Bench run 41546963938, attempt 2, and a completed local Apple M1 Pro run measured the default catalog at 6926f298 on November 2–3, 2026. All collected product and benchmark workload hashes agree. The results cover checksums, hashes, MACs, KDFs, password hashing, AEADs, signatures, key exchange, ML-KEM, ML-DSA, SLH-DSA, and RSA. RISC-V Auth is pending; its full aggregate remains blank.

Each point divides the fastest external median time by the rscrypto median for equivalent work. Above 1.00x favors rscrypto; the fixed tie band is 0.95x through 1.05x. These classifications describe point estimates, not statistical significance.

IBM Z's 4-CPU cohort covers checksum, Auth, and AEAD; its 8-CPU cohort covers hashes. Their different workloads and host allocations remain separate. The other complete rows each cover 914 headline points.

These are single campaigns with 20 samples, 100 ms warm-up, and 400 ms measurement targets, using nightly-2026-10-24. Cloud/shared hosts and the Mac's overlapping validation and extraction work leave small differences unconfirmed. The Mac's full just bench completed all 108 runs and 4,824 cases; a fresh listing confirmed complete coverage.

The benchmark overview reports every collected workload: 41,589 measured cases, 14,007 matched points, all 130 measured comparison definitions, headline and other family results, absolute costs, hardware, provenance, and limits. TLS/QUIC provider, OpenSSL, and BLAKE3 file-reader targets are outside this default campaign; their separate dated results remain in the overview. Older campaigns retain their original dates and methods and do not fill missing current results.

The guides and examples describe the source in this repository. For a published version, use the matching API documentation.

Read CONTRIBUTING.md before you change code. CHANGELOG.md lists published changes.

Licensed under Apache-2.0.