dcrypt 2.0.0

Rust APIs for classical, post-quantum, and hybrid cryptographic primitives
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150

name: Security validation

on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: security-validation-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: "1"

jobs:
  format-and-check:
    name: Format and all-target workspace check
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install stable Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
        with:
          toolchain: stable
          components: rustfmt
      - name: Check formatting
        run: cargo fmt --all -- --check
      - name: Check every workspace target with every feature
        run: cargo check --workspace --all-targets --all-features

  workspace-tests:
    name: Workspace crate tests
    runs-on: ubuntu-24.04
    timeout-minutes: 90
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install stable Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
        with:
          toolchain: stable
      - name: Run workspace library and integration tests
        # dcrypt-tests contains the heavyweight suites gated in dedicated jobs below.
        run: cargo test --workspace --all-features --exclude dcrypt-tests --no-fail-fast

  ml-dsa-acvp:
    name: Exact ML-DSA FIPS 204 ACVP outputs
    runs-on: ubuntu-24.04
    timeout-minutes: 90
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install stable Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
        with:
          toolchain: stable
      - name: Compare ML-DSA results with bundled official expectedResults
        run: >-
          cargo test --release -p dcrypt-tests --test acvp_tests test_ml_dsa_
          -- --test-threads=1 --nocapture

  statistical-timing:
    name: Repository statistical timing regressions (not dudect or ctgrind)
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install stable Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
        with:
          toolchain: stable
      - name: Run the in-repository statistical timing suite serially
        env:
          VERBOSE: "1"
        run: >-
          cargo test -p dcrypt-tests --test constant_time_tests
          -- --test-threads=1 --nocapture

  dependency-policy:
    name: RustSec and workspace dependency policy
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install stable Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
        with:
          toolchain: stable
      - name: Resolve the ignored lockfile for this audit
        run: cargo generate-lockfile
      - name: Install pinned security tools
        run: |
          cargo install --root "$RUNNER_TEMP/security-tools" cargo-audit --version 0.22.2 --locked
          cargo install --root "$RUNNER_TEMP/security-tools" cargo-deny --version 0.20.2 --locked
          echo "$RUNNER_TEMP/security-tools/bin" >> "$GITHUB_PATH"
      - name: Audit resolved dependencies against RustSec
        run: cargo audit
      - name: Enforce advisories, licenses, bans, and sources for all workspace roots
        run: cargo deny --workspace --all-features check

  miri:
    name: Miri (${{ matrix.crate }})
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        crate: [dcrypt-api, dcrypt-common]
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install nightly Rust with Miri
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
        with:
          toolchain: nightly-2026-08-07
          components: miri
      - name: Prepare Miri's sysroot
        run: cargo miri setup
      - name: Run the public memory-handling tests under Miri
        # Keep the standalone Loom scheduler model in the stable test job;
        # Miri runs the real registry and secret-buffer unit tests directly.
        run: cargo miri test -p ${{ matrix.crate }} --lib --all-features

  fuzz-build:
    name: Build externally controlled decoder fuzz targets
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install nightly Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
        with:
          toolchain: nightly-2026-08-07
      - name: Install pinned cargo-fuzz
        run: cargo install cargo-fuzz --version 0.13.2 --locked
      - name: Build every fuzz target
        run: |
          cargo fuzz build signature_decoders
          cargo fuzz build hybrid_decoders
          cargo fuzz build symmetric_decoders
          cargo fuzz build stream_frames