Module arch 

Hardware crypto intrinsics behind safe wrappers: AES-NI, PCLMULQDQ, SHA-NI, ARMv8 AES/PMULL (owned by the simoom-tls work). Hardware crypto intrinsics behind safe wrappers, with runtime detection, and the operating system’s random number source.

• AES (AesHw): AES-NI on x86-64, the ARMv8 Cryptography Extension on aarch64. Round keys come from the caller (the portable, constant-time key schedule in simoom-tls), so only the rounds run here.
• GHASH (GhashHw): PCLMULQDQ on x86-64, PMULL on aarch64, with the powers H^1..H^8 precomputed so eight blocks share one reduction.
• AES-GCM bulk (aes_gcm_seal, aes_gcm_open): CTR and GHASH fused, eight blocks per step.
• SHA-256 (sha256_blocks): SHA-NI on x86-64, the ARMv8 SHA-2 instructions on aarch64.
• Randomness (os_random): getrandom(2) on Linux and Android, getentropy(3) on the BSDs and macOS, BCryptGenRandom on Windows.

A value of AesHw or GhashHw exists only if the CPU has the instructions (the constructors check), so every method can call the #[target_feature] code without asking again. All these instructions run in constant time: no table lookups, no data-dependent branches.

Structs

AesHw

Expanded AES round keys for the hardware AES path (AES-128 or AES-256).

GhashHw

GHASH key with the powers H^1..H^8 precomputed for the carry-less multiply path.

Functions

aes_gcm_open

AES-GCM bulk decryption: absorbs the ciphertext data into y, then decrypts it in place.

aes_gcm_seal

AES-GCM bulk encryption: encrypts data in place in CTR mode starting at counter block ctr (incremented as a 32-bit big-endian counter, left at the next value) and absorbs the ciphertext into the GHASH state y.

aes_gcm_vaes

AES-GCM bulk encryption or decryption with VAES and VPCLMULQDQ over the longest prefix of data that is a whole number of 128-byte groups: two blocks per instruction, eight blocks per GHASH reduction. Same contract as aes_gcm_seal and aes_gcm_open for that prefix; returns the number of bytes processed (0 without the instructions: the caller then uses those functions for everything).

bigint_mont_mul

The core of a Montgomery multiplication for big integers with MULX/ADCX/ADOX (interleaved CIOS, four limbs per loop step): leaves t = a * b * 2^(-64 n) mod m, plus possibly m, in t[..n] and its top bit in t[n], where n = m.len(); the caller makes the final conditional subtraction. Requires n a non-zero multiple of 4, a and b of n limbs below m, t at least n + 2 limbs (overwritten), and m0inv = -m^-1 mod 2^64. Returns false (and does nothing) without MULX/ADX or when the sizes do not fit. Constant time.

chacha20_xor

ChaCha20 keystream XOR with SIMD (x86-64: AVX2 eight blocks per step, SSSE3 four), over the longest prefix of data that is a whole number of 256-byte groups. Block counters start at counter. Returns the number of bytes processed (0 if the CPU has no SIMD path); the caller handles the rest.

disable_hardware

Turns the hardware paths off (true) or back on, process-wide, so tests and benchmarks can exercise the portable fallbacks. Values built while enabled keep working.

fe25519_add

a + b modulo 2^255 - 19 on 4 x 64-bit limbs, for inputs below 2^256 (result below 2^256, not fully reduced): a carry out of bit 256 is folded back as 38, twice. Constant time.

fe25519_mul

Multiplication modulo p = 2^255 - 19 on 4 x 64-bit limbs, for any inputs below 2^256: the result is below 2^256 and congruent to a * b (not fully reduced). Constant time; None without MULX/ADX. The high half of the product is folded in times 38 (2^256 = 38 mod p).

fe25519_mul121666

a * 121666 modulo 2^255 - 19 on 4 x 64-bit limbs (see fe25519_mul); the X25519 ladder’s (A + 2) / 4 constant. None without MULX.

fe25519_sqr

Squaring modulo 2^255 - 19 (see fe25519_mul).

fe25519_sub

a - b modulo 2^255 - 19 on 4 x 64-bit limbs (see fe25519_add): a borrow is folded back as -38, twice.

has_aes

True if the CPU has AES round instructions (AES-NI or ARMv8 AES).

has_clmul

True if the CPU has a 64x64-bit carry-less multiply (PCLMULQDQ or PMULL).

has_mulx

True if the CPU has MULX (BMI2) and ADCX/ADOX (ADX), for the Montgomery kernels below.

has_sha256

True if the CPU has SHA-256 instructions (SHA-NI or ARMv8 SHA-2).

has_vaes

True if the CPU has VAES and VPCLMULQDQ with AVX2 (Zen 3, Ice Lake and later).

opaque

Returns x unchanged, hidden from the optimizer, so a mask derived from secret bits cannot be turned back into a branch (LLVM may otherwise rewrite masked selection as a conditional jump). Unlike core::hint::black_box the value stays in a register.

os_random

Fills buf from the operating system’s cryptographically secure random source. Returns false if the source failed (callers must treat that as fatal, never fall back to weaker randomness).

p256_add

P-256 field addition a + b mod p for a and b below p, in constant time (ADC, SBB and a CMOV select; every x86-64 CPU has them). Values stay in registers.

p256_mul_mont

P-256 field multiplication in Montgomery form (R = 2^256): a * b * R^-1 mod p for a and b below p = 2^256 - 2^224 + 2^192 + 2^96 - 1, in constant time; None without MULX/ADX. The product uses the two ADX carry chains; the reduction uses the shape of p (the multiplier of each step is the low limb itself, and q * p is shifts and subtractions, no multiplication).

p256_order_mul_mont

Multiplication modulo the P-256 group order n in Montgomery form: a * b * 2^-256 mod n for a and b below n, in constant time; None without MULX/ADX.

p256_sqr_mont

P-256 field squaring in Montgomery form: a * a * R^-1 mod p for a below p, in constant time; None without MULX/ADX. Six cross products doubled plus four squares.

p256_sub

P-256 field subtraction a - b mod p for a and b below p, in constant time (see p256_add): the borrow becomes a mask that selects p to add back.

poly1305_blocks

Absorbs the longest prefix of data that is a whole number of 64-byte groups into the Poly1305 accumulator, with AVX2: four 16-byte blocks (each with the 2^128 bit) per step in four lanes of radix-2^26 limbs, Horner’s rule with r^4 in each lane and a final multiplication of the lanes by r^4, r^3, r^2 and r. h is the accumulator and rpow holds r, r^2, r^3, r^4, all as five 26-bit limbs (limbs a little above 2^26 are fine; the result has the same form). Returns the number of bytes absorbed: 0 without AVX2. Constant time.

sha256_blocks

Runs the SHA-256 compression function over whole 64-byte blocks with the CPU’s SHA instructions. Returns false (and does nothing) if the CPU lacks them or blocks.len() is not a multiple of 64.