hardware-rust-crypto 1.0.1

Hardware-only AES-256-GCM and AES-256-GCM-SIV AEAD plus AES-256-CTR key/nonce generation (AES-NI/PCLMULQDQ, ARMv8 AES/PMULL), with compact, caller-placeable, zeroized key state.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88

hardware-rust-crypto
Copyright (c) 2026 GoDaddy Operating Company, LLC.

This product is licensed under the Apache License, Version 2.0 (see LICENSE).

This repository vendors and adapts source code from the following upstream
projects. Each entry records the exact upstream version and commit the code
was taken from, the upstream copyright holder, and the license under which the
code is used. The adapted files reference this file from their module
documentation.

--------------------------------------------------------------------------------

1. rand_aes
   - Repository: https://github.com/hasenbanck/rand_aes
   - Version: 0.7.0 (tag v0.7.0, commit 2b5be4110c5229df0b5578ced031686444496c6d)
   - Copyright: Nils Hasenbanck <nils@hasenbanck.de> and rand_aes contributors
   - License: Apache-2.0
   - Adapted code:
     - AES-256 key expansion and block encryption for x86/x86_64 (AES-NI) and
       aarch64 (ARMv8 AES/NEON):
       src/aes_gcm/aes.rs
     - AES-256-CTR-128 generator backend:
       src/random/aes_ctr.rs
   - Modifications: removed the software (fixsliced) fallback backend, runtime
     dispatch enum, boxed backend state, jump APIs, and non-AES-256 variants;
     added fallible hardware-feature gating, in-place key-schedule
     initialization, and volatile zeroization on drop.

2. ghash (RustCrypto universal-hashes)
   - Repository: https://github.com/RustCrypto/universal-hashes
   - Version: 0.5.1 (tag ghash-v0.5.1, commit 655c6cbef85b0faa7ff24c0686986cf2c27b2c6d)
   - Copyright: The RustCrypto Project Developers
   - License: Apache-2.0 OR MIT (used here under Apache-2.0)
   - Adapted code: the GHASH-to-POLYVAL mapping in
     src/aes_gcm/ghash.rs

3. polyval (RustCrypto universal-hashes)
   - Repository: https://github.com/RustCrypto/universal-hashes
   - Version: 0.6.2 (tag polyval-v0.6.2, commit 4e7d04f7c8e44f634ada8c673c8cb1672a64d374)
   - Copyright: The RustCrypto Project Developers
   - License: Apache-2.0 OR MIT (used here under Apache-2.0)
   - Adapted code: the CLMUL (x86/x86_64) and PMULL (aarch64) carryless
     multiplication backends in src/aes_gcm/ghash.rs
   - Modifications: removed the software fallback backend and the runtime
     autodetection enum.

The AES-256-GCM composition logic (J0 construction, CTR keystream application,
length-block authentication, and tag handling) in
src/aes_gcm/mod.rs is implemented from NIST SP 800-38D and the
RustCrypto `aes-gcm` crate's design, and is validated byte-for-byte against
three lineage-independent implementations - RustCrypto `aes-gcm` 0.10, `ring`
0.17, and OpenSSL 3.x (via the dev-only `openssl` crate; not part of the
published library or its dependency graph) - by the interoperability test suite.

The AES-256-GCM-SIV composition (src/aes_gcm/siv.rs) is implemented from
RFC 8452 and the RustCrypto `aes-gcm-siv` crate's design, and is validated
against the RFC 8452 known-answer vectors and RustCrypto `aes-gcm-siv` 0.11.

--------------------------------------------------------------------------------

Vendored test data (not compiled into the library):

4. Project Wycheproof AES-GCM and AES-GCM-SIV test vectors
   - Repository: https://github.com/C2SP/wycheproof
   - Version: 0.9rc5 (testvectors_v1/aes_gcm_test.json and
     testvectors_v1/aes_gcm_siv_test.json)
   - Copyright: Google LLC and Project Wycheproof contributors
   - License: Apache-2.0
   - Vendored verbatim as test data (downloaded, not transcribed):
     tests/data/wycheproof_aes_gcm.json
     tests/data/wycheproof_aes_gcm_siv.json
   - Used only by the test suite (tests/wycheproof_aes_gcm.rs and
     tests/wycheproof_aes_gcm_siv.rs) to cross-validate the AES-256-GCM and
     AES-256-GCM-SIV paths, including the SIV counter-wrap and the
     tag-rejection vectors. Not part of the published library or its
     dependency graph.

5. NIST CAVP AES-GCM test vectors
   - Source: NIST Cryptographic Algorithm Validation Program, GCM test
     vectors (gcmEncryptExtIV256.rsp and gcmDecrypt256.rsp).
   - Copyright: U.S. Government work, not subject to copyright (public domain).
   - Vendored as test data: the Keylen=256 / IVlen=96 / Taglen=128 subset,
     converted verbatim to JSON (downloaded, not transcribed):
     tests/data/nist_cavp_aes256_gcm.json
   - Used only by the test suite (tests/nist_cavp_gcm.rs). Functional
     known-answer coverage; not CAVP accreditation. Not part of the published
     library or its dependency graph.