Crate purecrypto 

purecrypto — a cryptography toolkit written entirely in Rust, depending on no foreign code.

The crate is built in layers, from the bottom up:

1. Constant-time primitives (ct) — branchless boolean logic, equality, selection and ordering. Everything secret-dependent rests on this layer. Its sibling zeroize wipes secrets with volatile stores.
2. Hashing, symmetric ciphers, constant-time bignum arithmetic, asymmetric keys (RSA, ECDSA, EdDSA, X25519/X448, finite-field DH), the post-quantum schemes ML-KEM, ML-DSA, SLH-DSA, Falcon, LMS and XMSS, ASN.1, X.509 and PKCS#12, HPKE, and the TLS / DTLS / QUIC engines — each behind its own Cargo feature.

purecrypto is usable as a Rust library, a C library, and a standalone command-line tool.

no_std

The crate is #![no_std] at its core. The alloc feature pulls in the alloc crate for heap-backed types, and the std feature (enabled by default, implies alloc) adds the pieces that genuinely need the operating system, such as file I/O, the CLI, and system randomness. Build with --no-default-features for a bare no_std target.

Hardware acceleration does not depend on std on x86_64: SHA-NI, AES-NI, PCLMULQDQ and the AVX2/AVX-512 kernels of the hash and cipher modules are selected at run time from CPUID (with the XGETBV OS-support check for the AVX state). On aarch64 a std build asks the OS; a no_std one uses the SHA-1/SHA-256/SHA-512 instructions when the target enables them at compile time (-C target-feature=+sha2,+sha3), while the other aarch64 kernels (AES, PMULL, NEON) and the multi-buffer kernels behind the post-quantum schemes still require std.

Modules

ascon

Ascon lightweight cryptography (NIST SP 800-232).

bignum

Constant-time big-integer arithmetic.

bls

Opt-in: enable the bls feature (a large, niche surface; off by default).

bls12_377

Opt-in: enable the bls12-377 feature (off by default). Allocator-free.

bn254

Opt-in: enable the bn254 feature (off by default). Allocator-free.

chunked

Opt-in: enable the chunked feature (niche; off by default).

cipher

Symmetric ciphers.

ct

Constant-time primitives.

der

Minimal ASN.1 DER (Distinguished Encoding Rules) reader and writer.

dh

Finite-field Diffie-Hellman over RFC 3526 MODP safe-prime groups, RFC 4419 group-exchange (caller-supplied custom group), and explicit prime-order-subgroup groups (RFC 5114, ANSI X9.42) via DhGroup::from_params.

dsa

Opt-in: enable the dsa feature (legacy interop only; off by default).

dtls

DTLS (Datagram TLS) — RFC 6347 (DTLS 1.2) and RFC 9147 (DTLS 1.3).

ec

Elliptic-curve cryptography.

falcon

Falcon (FN-DSA) signatures — Falcon-512 and Falcon-1024: key generation, signing, and verification.

ffi

C ABI for purecrypto (the ffi feature).

fpe

Opt-in: enable the fpe feature (niche; off by default).

hash

Cryptographic hash functions.

hpke

Hybrid Public Key Encryption (HPKE, RFC 9180).

jose

JOSE: JSON Web Key (RFC 7517), JSON Web Signature (RFC 7515) and JSON Web Encryption (RFC 7516) with the RFC 7518 / RFC 8037 algorithms.

kdf

Key-derivation functions.

key

Unified asymmetric-key traits.

lms

LMS / HSS stateful hash-based signatures (RFC 8554, NIST SP 800-208).

mac

Standalone message authentication codes.

mldsa

ML-DSA — the Module-Lattice Digital Signature Algorithm (FIPS 204), the standardized form of Dilithium.

mlkem

ML-KEM — the FIPS 203 module-lattice key-encapsulation mechanism (the standardized form of Kyber), in all three parameter sets:

pkcs12

PKCS#12 / PFX (RFC 7292) personal-information exchange archives — the .p12 / .pfx files that bundle a private key together with its certificate chain under a single password.

quic

QUIC v1 (RFC 9000) and v2 (RFC 9369) — transport layer over UDP, secured by TLS 1.3 keys per RFC 9001. Includes RFC 9002 loss recovery + congestion control, RFC 9221 unreliable datagram extension and RFC 9368 compatible version negotiation.

rng

Random number generation.

rsa

RSA.

signature_registry

Re-exported at the crate root: the signature-algorithm registry that X.509 chain validation and TLS 1.3 CertificateVerify both dispatch through. Gated on the x509 feature (which pulls in the SPKI parsers and the underlying primitives). A registry of digital-signature algorithms, and a whitelist policy controlling which algorithms a verifier accepts.

slhdsa

SLH-DSA — the Stateless Hash-Based Digital Signature Algorithm (FIPS 205), the standardized form of SPHINCS+.

tls

Transport Layer Security — TLS 1.2 (RFC 5246, AEAD suites per RFC 7905 + Extended Master Secret per RFC 7627), TLS 1.3 (RFC 8446) including session resumption, 0-RTT, and key update — and a unified Config / Connection that also drives DTLS 1.2 / 1.3 (see crate::dtls) and is reused by the QUIC stack (crate::quic) through an internal handshake-seam.

x509

X.509 v3 certificates (RFC 5280), built on the der and rsa layers.

xmss

XMSS / XMSS^MT stateful hash-based signatures (RFC 8391, NIST SP 800-208).

zeroize

Secret wiping: the Zeroize trait, the ZeroizeOnDrop marker and the Zeroizing guard.

zkp

Zero-knowledge and commitment extensions over secp256k1.

Macros

dispatch_digest

Bridges a runtime HashAlgorithm into code that is generic over a compile-time Digest type: runs $body once per algorithm, with $d aliased to that algorithm’s concrete hasher.