Module crypto 

Cryptographic primitives, all std-only and written for constant time on secret data.

Modules

aes

AES-128 and AES-256 encryption (FIPS-197): the hardware path (AES-NI, ARMv8 AES) when the CPU has it, otherwise a constant-time bitsliced implementation.

bigint

Multi-precision arithmetic on little-endian u64 limb slices: Montgomery multiplication (CIOS), modular add/sub with branch-free final reduction, modular exponentiation. Used by RSA (variable size) and the NIST curves (fixed size).

chacha

ChaCha20, Poly1305 and the ChaCha20-Poly1305 AEAD (RFC 8439). Constant time: only additions, rotations and XORs on secret data; Poly1305 uses 64x64-bit multiplies.

ec

Generic NIST curve code (short Weierstrass, a = -3), used for P-384 ECDSA. P-256 has its own faster implementation in p256.

ed25519

Ed25519 signatures (RFC 8032, PureEdDSA).

gcm

AES-GCM (NIST SP 800-38D) with 96-bit nonces and 128-bit tags.

p256

NIST P-256: ECDH, ECDSA signing (RFC 6979 nonces) and verification.

rng

Cryptographically secure random numbers: a ChaCha20 DRBG with fast key erasure, seeded and periodically reseeded from the operating system (simoom_sys::arch::os_random).

rsa

RSA signatures: PKCS#1 v1.5 and RSASSA-PSS (RFC 8017) verify and sign.

sha2

SHA-256, SHA-384 and SHA-512 (FIPS 180-4), HMAC (RFC 2104) and HKDF (RFC 5869).

x25519

X25519 (RFC 7748). Shared secrets use the constant-time Montgomery ladder; public keys use the Ed25519 fixed-base table (constant time) and the birational map u = (1 + y) / (1 - y), which is several times faster than the ladder.