rscrypto

rscrypto is a Rust library of cryptographic primitives, hashes, password hashing, and checksums. One feature model controls all of them. Portable Rust is the reference implementation. SIMD and assembly backends make it faster on supported targets. Production builds do not depend on C, FFI, OpenSSL, or system libraries.

rscrypto supplies primitives only. It is not a TLS stack, a PKI toolkit, a key store, or a protocol implementation.

Install

rscrypto needs Rust 1.100. Until Rust 1.100 is stable, use the 1.100 beta or a newer nightly. Accelerated POWER, IBM Z, and RISC-V builds need a nightly compiler; portable-only builds support the declared MSRV. See Toolchain.

Minimal no_std build with SHA-2 only:

[dependencies]
rscrypto = { version = "0.12", default-features = false, features = ["sha2"] }

All primitives, with operating-system randomness:

[dependencies]
rscrypto = { version = "0.12", features = ["full", "getrandom"] }

The default feature is std. Set default-features = false to remove it. Enable getrandom only for the APIs that get randomness from the operating system, such as key generation, nonces, salts, hedged signing, ML-KEM encapsulation, and RSA blinding. The feature guide explains how to select features. Cargo.toml defines the exact feature graph.

Quick start

use rscrypto::Sha256;

let one_shot = Sha256::digest(b"hello world");

let mut hasher = Sha256::new();
hasher.update(b"hello ");
hasher.update(b"world");

assert_eq!(hasher.finalize(), one_shot);

Hash types support one-shot and streaming use. examples/README.md has runnable examples for AEAD, signatures, RSA, P-256 and P-384 ECDH, X25519, ML-KEM, password hashing, and backend introspection.

Primitives and features

Family	Primitives	Feature
Checksums	CRC-16, CRC-24, CRC-32, CRC-32C, CRC-64/XZ, CRC-64/NVMe	checksums or a leaf feature
Cryptographic hashes	SHA-2, SHA-3, SHAKE, cSHAKE, BLAKE2, BLAKE3, Ascon-Hash/XOF/CXOF	crypto-hashes or a leaf feature
Fast hashes	XXH3-64/128, RapidHash V3-64	fast-hashes or a leaf feature
MACs and KDFs	HMAC-SHA-2/SHA-3, KMAC128/256, Poly1305, HKDF-SHA-2, PBKDF2-HMAC-SHA-2	macs, kdfs, or a leaf feature
Password hashing	Argon2d/i/id, scrypt, bounded PHC password records	password-hashing or a leaf feature
Signatures and RSA	ECDSA P-256/P-384, Ed25519, ML-DSA-44/65/87, SLH-DSA (all 12 FIPS 205 sets, pure and HashSLH-DSA), RSA signing, verification, encryption, and key generation	signatures or a leaf feature
Key exchange and KEMs	P-256 ECDH, P-384 ECDH, X25519, ML-KEM-512/768/1024	key-exchange or a leaf feature
AEADs	AES-GCM, AES-GCM-SIV, AES-SIV-CMAC, ChaCha20-Poly1305, XChaCha20-Poly1305, AEGIS-256, Ascon-AEAD128	aead or a leaf feature

Signature and KEM keys import and export standard DER (PKCS #8 and SubjectPublicKeyInfo) for ECDSA, Ed25519, RSA, ML-DSA, ML-KEM, and SLH-DSA.

The WebSocket accept digest exists only for protocol compatibility. It needs the websocket-sha1 feature. No umbrella feature, including full, enables it.

See docs.rs for exact types and methods. The API compatibility notes explain output types, collection seeds, and retained method names. The cryptographic resilience guide explains security assumptions, migration boundaries, and the evidence to review when choosing stronger cryptography.

Platforms and dispatch

The portable Rust implementation defines the correct output, byte for byte. Every accelerated backend must give the same output. At compile time, the target sets which backends are available. With std, rscrypto also detects CPU features at run time and selects a backend. If no accelerated backend is available, the portable implementation runs.

The platform guide lists the supported targets. It also explains dispatch, no_std support, and the limits of portable-only.

Assurance

A security claim exists only while its evidence passes. Missing or old evidence removes the claim; it never weakens a gate.

• Correctness: NIST, RFC, upstream, and Wycheproof vectors, independent implementations, property tests, negative tests, and Miri.
• Fuzzing: fuzz targets run the production code across primitives, parsers, state machines, and trait boundaries. Minimized inputs replay as tests. A separate lane runs them with sanitizers.
• Backends: differential tests compare each accelerated backend with portable Rust. They cover lengths, alignments, tails, state transitions, dispatch, and fallback on native targets.
• Constant time: ct.toml lists the exact operations under test. The evidence combines inspection of optimized linked binaries, BINSEC proofs for fixed-shape kernels, and DudeCT timing tests for end-to-end operations.
• Secrets: types that own secrets hide their contents in Debug output and clear their initialized storage on drop. Copy rules vary by type; for example, keyed BLAKE2 and BLAKE3 state supports Clone. The secret ownership inventory lists each type.
• Failures: verification failures do not tell why they failed. A failed AEAD open clears the unauthenticated plaintext.

A constant-time claim applies only to the target, features, compiler, profile, and operation that its evidence covers. Source code that looks branchless is not proof.

For details, see the test evidence, the constant-time model, the secret lifecycle, and the threat model.

rscrypto has not had a third-party security audit. The project cannot pay for one now, and automated evidence does not replace it. rscrypto does not claim to be audited, FIPS 140-3 validated, formally verified, or constant time as a whole crate.

Report a suspected vulnerability through GitHub Private Vulnerability Reporting. Follow the SECURITY.md process. Do not open a public issue.

Performance

Bench run #39888945058 measured the v0.12.0 source on eight platforms on 2026-10-23, and the same plan ran on a local Apple M1 Pro. Each platform has up to 914 headline comparisons: checksums, hashes, MACs, KDFs, password hashing, AEADs, signatures, key exchange, ML-KEM, ML-DSA, SLH-DSA, and RSA. The comparisons follow equal-task rules. Each comparison divides the median time of the fastest external crate by the median time of rscrypto. A ratio above 1.00x means rscrypto is faster; a tie is 0.95x through 1.05x.

Platform	Points	Faster	Tie	Slower	Median	Geomean
Intel Linux (c8i)	914	372	254	288	1.00x	1.23x
AMD Linux (c8a)	914	420	264	230	1.03x	1.20x
Intel Windows (c8i)	914	420	258	236	1.03x	1.25x
AMD Windows (c8a)	914	517	149	248	1.08x	1.20x
Graviton5 Linux (c9g)	914	379	284	251	1.03x	1.21x
POWER10 Linux	914	414	314	186	1.03x	1.38x
IBM Z Linux	911	726	90	95	2.31x	3.07x
RISC-V Linux	603	251	189	163	1.02x	1.07x
Apple M1 Pro (local)	914	380	381	153	1.03x	1.24x

These results are from one run per platform, at half the default sampling time, on cloud and shared hosts. RISC-V's auth family (signatures, key exchange, KDFs, MACs, and password hashing) was still measuring, so its row covers 603 comparisons. The Apple row comes from one local run whose host was not checked for load first; treat its small differences as unconfirmed. On IBM Z, rscrypto uses its CPACF and vector backends where they exist, and AWS-LC is absent. The benchmark overview gives the results by family, TLS 1.3 and QUIC connections through rscrypto-rustls, the largest remaining losses, the method, and the limits. The comparison contracts define equivalent ML-KEM and Argon2 workloads. Older summary tables mixed different workloads. They are historical records, not current claims.

Project

The guides and examples describe the source in this repository. For a published version, use the matching API documentation.

Read CONTRIBUTING.md before you change code. CHANGELOG.md lists published changes.

License

Dual-licensed under Apache-2.0 or MIT, at your option.