Simple ciphers: stream + symmetric cipher unification off the release branch, plus SHA-512/t for any t by dghgit · Pull Request #133 · bcgit/bc-rust

dghgit · 2026-09-16T04:56:40Z

Consolidates the stacked pair #113 (feature/stream-cipher → release/0.1.3alpha) and #115
(feature/symmetric-cipher → feature/stream-cipher) into a single branch off the release
branch, and adds the SHA-512/t work on top.

feature/simple-ciphers was built by branching from release/0.1.3alpha and merging
feature/stream-cipher then feature/symmetric-cipher; both merges fast-forwarded, so the
content below the two new commits is exactly what #113 and #115 already carried — this is a
re-packaging, not new review surface. #113 (+21,938) and #115 (+2,310) sum to roughly the
+23,499 here.

New in this PR, on top of those two

core: SecurityStrength::from_bits / from_bytes become const fn (3912434) — two
keywords, no behaviour change. Needed so an associated const can derive a strength from a const
generic; split out ahead of the feature per CLAUDE.md's scope-of-changes rule.

sha2: SHA512t<T> is usable for every t FIPS 180-4 s. 5.3.6 defines a hash for (785dbef).
Previously only T = 224 and T = 256 had parameter impls, so nothing else could be named.

The t-value checks are back, and they are the spec's. b11f8f6 had narrowed sha512t_h0 to
100 <= t < 512 and emitted a fixed three digits, since only 224 and 256 were reachable. With
arbitrary t reachable that would produce the "0256" spelling s. 5.3.6 explicitly forbids —
and hence the wrong IV — for every t below 100. The one- and two-digit branches are restored
and check_t asserts the section's own rule: positive, < 512, not 384.
One deviation, documented: t must be a multiple of 8, because Hash is byte-oriented and
a 100-bit digest has no representation here. BC Java's SHA512tDigest imposes the identical
restriction, so the two libraries accept the same set of truncations.
Unapproved truncations are gated the way ElectronicCodeBook::ENCRYPTION_APPROVED gates
two-key TDEA: SHA512tParams::<T>::FIPS_APPROVED is public and SHA512Internal::new asserts it
in an inline const, so an unapproved t is a compile error at the call site and
new_allow_unapproved_t() is the deliberate way in. That also blocks Default, which keeps an
unapproved truncation out of generic code by accident.
ALG_NAME, OUTPUT_LEN and MAX_SECURITY_STRENGTH are derived from t, with const
assertions pinning them to the values 224 and 256 previously had by hand.

Verification

cargo test --workspace: 943 passed, 0 failed (was 923). cargo fmt --check clean; no new
clippy warnings. Both new commits build independently.
Spec text read from a freshly downloaded FIPS 180-4, not from recall.
Test vectors cross-checked against BC Java's SHA512tDigest, an independent implementation:
eight truncations (8, 16, 24, 88, 96, 104, 264, 504) spanning all three decimal branches, over
the FIPS 180-4 Appendix C messages plus the one-million-'a' case. The 224/256 rows in the same
table match the NIST-published values.
cargo mutants on the changed files: 259 mutants — 180 caught, 5 timeout-kills, 69 unviable,
5 missed. All five missed are the pre-existing XOR/OR equivalences already annotated at their
sites in ch, maj and do_final_internal; no new missed mutants.

Note for reviewers

Adding const to a public core function is a forward compatibility commitment, and
SHA512tParams is currently its only caller. The alternative was a private copy of the rounding
ladder inside sha2, free to drift from the real one — happy to switch if the API-surface cost is
the greater worry.

🤖 Generated with Claude Code

… and CLI wiring (PR #89)

… bits in the MSBs, unused low bits ignored

…ke the other hashes

… sites

…ptor with multi-block and one-shot methods (PR #107)

…-free bit-sliced AES permutation (PR #105)

…nd aes*-cbc CLI subcommands (PR #106)

…ryptor/PaddedDecryptor) (PR #97)

…me lengths, AES_CBC_* aliases, simpler CLI (PR #109)

…mmands and shared block-mode CLI (PR #111)

…locks8, SymmetricCipherEncryptor/Decryptor (from feature/sm4); CFB follows suit

…cb CLI subcommands; block-mode CLI generic over INIT_DATA_LEN

…S_PADS; SymmetricCipherEncryptor::do_final reports its output length

…with API changes and per-commit summaries

…rams/HashMLDSAParams/MLKEMParams traits, one impl per parameter set (#117)

…eamCipherDecryptor pair, shaped like the block cipher pair (in place, any length, generated init data); TestFrameworkStreamCipher implemented in place of its todo!()

… and Cfb8 (SP 800-38A Sec 6.3, s = 8) is added, with AES_CFB8_* aliases, aes*-cfb8 CLI subcommands and a shared stream-mode CLI

…, CFB8 is added, and the StreamCipher trait is replaced by the split encryptor/decryptor pair; re-measured throughput and mutation figures

…inst real AES at all three key lengths, not only the toy permutation

…th picks the counter width (max 4 bytes) and which errors rather than repeat a counter, with AES_CTR_* aliases and aes*-ctr CLI subcommands

… the nonce-plus-counter construction, pinning the 1, 2 and 3-byte counter widths that the ACVP and OpenSSL vectors cannot reach

… notes (PR #87)

… their HMAC variants

…not already on this branch

… and CLI wiring (PR #89)

… bits in the MSBs, unused low bits ignored

…ke the other hashes

… sites

…ptor with multi-block and one-shot methods (PR #107)

…crate

ounsworth · 2026-09-30T18:40:33Z

@@ -1,76 +1,267 @@
 //! Generic behaviour tests for the symmetric cipher traits.


This, and key_stream.rs should move to the bouncycastle-cipher crate, once that refactor has been done to create it.

ounsworth · 2026-09-30T19:18:38Z

@@ -8,5 +8,7 @@

 pub mod errors;
 pub mod key_material;
+pub mod security_strength;
+pub mod stream_cipher;


Remove, after refactor.

…symmetric_ciphers.rs into aead.rs and block_cipher.rs, turn core's aead_tagged_tests into a runner driven by AES-GCM, and move the buffering-toy test of core's default one-shots back to core/tests Assisted-by: Claude:claude-fable-5-1

Note: crypto/aes/src/padded_mode.rs's PaddedMode is the same unsealed projection pattern this replaces in ascon; it can be de-duplicated onto core's Direction::Select in a follow-up, which is deliberately not bundled here. Assisted-by: Claude:claude-fable-5-1 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…and the byte-slice helpers) into feature/simple-ciphers Replaces core::hint::black_box with a volatile store/load barrier used by Condition::select/negate/swap/is_in_list, ct_eq_bytes, ct_eq_zero_bytes and conditional_copy_bytes. Adds ct_eq_bytes_mask and has conditional_copy_bytes take a Condition<u32> so ML-KEM implicit rejection never passes the secret through a bool. Sets rust-version = "1.88". Closes #128. Assisted-by: Claude Code:claude-fable-5-1 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…a backslash -- a backslash that is not the of an escaped byte is reported as InvalidHexCharacter at its own index, with regression tests for the trailing, lone and mid-input cases. Assisted-by: Claude:claude-fable-5-1

… into feature/simple-ciphers

… > file` is now exactly N bytes. Newline preserved for -x Assisted-by: Claude:claude-fable-5-1

…e 5.1

ounsworth · 2026-10-01T02:47:04Z

@@ -2,6 +2,7 @@
 name = "bouncycastle-utils"
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true


Note-to-self: huh?

ounsworth · 2026-10-01T02:47:26Z

+// msp430 and avr; another backend gets no such promise. `core::hint::black_box`, used
+// previously, is weaker still: its documentation calls it "best-effort" and says it "does not
+// offer any guarantees for cryptographic or security purposes".
+// ---------------------------------------------------------------------------------------------


Note-to-self: read and make sure it makes sense.

ounsworth · 2026-10-01T03:20:36Z

@@ -1,3 +1,11 @@
+mod aes_cbc_cmd;


Note-to-self: leaving un-viewed until I check the ascon bits

…ith the CLAUDE.md pointer updated to match Assisted-by: Claude Code:claude-fable-5-1 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

bouncycastle_core::hazmat defines the term; each crate with hazmat items declares pub mod hazmat and never re-exports out of it. Moved, paths only: ElectronicCodeBook, KeyStream and do_hazardous_operations in core; AESInternal and AES_ECB_* in aes; CtrKeyStream and Ecb in modes. ML-KEM's encaps_internal becomes hazmat::EncapsWithRandomness and HashDRBG80090A::new_unititialized becomes hazmat::NewUninitialized (typo fixed), as extension traits so the call needs the hazmat import. No logic change, no mutation run owed; test count 1040 before and after. Assisted-by: Claude Code:claude-fable-5-1 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

AES_CBC_* and AES_ECB_* were written through aes's own PaddedMode trait, the same unsealed direction projection that 64f3923 replaced in ascon; they now use Direction::Select and the trait and its module go. Type aliases only, no behaviour change, no mutation run owed; test count 1040 before and after. Assisted-by: Claude Code:claude-fable-5-1 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…make unbuffered the default

…ng to be sub-modules of a new crate bouncycastle-cipher. Assisted-by: claude-fable-5.1

StreamCipher loses its R: RNG type parameter (which it had to have because bouncycastle-core couldn't depend on bouncycastle-rng): do_encrypt_init now draws from HashDRBG_SHA512::new_from_os(), as Cbc, Gcm and Ccm do. Assisted-by: claude-opus-5-5

…al contract tests move to tests/ No behaviour change. Assisted-by: Claude:claude-fable-5-1

…-utils, with the component layer for composing suspended states Assised-by:claude-fable-5-1

ounsworth · 2026-10-02T03:09:15Z

+    /// that has to see the whole message before it can process any of it (see
+    /// [`AEADCipherEncryptor`]), may also return [`SymmetricCipherError::GenericError`] if the
+    /// input would exceed it.
+    fn do_encrypt_out(


We have provided a do_encrypt_out, but not a do_encrypt() -> Vec<u8>. Create one, wrapped in a #[cargo(alloc)]` that we can clean up later after Jason's pattern lands.

Ditto for the AEAD trait -- most of the things there needs to be twinned.

…nstead of buffering the message (PR #164) CcmEncryptor / CcmDecryptor no longer hold a copy of the payload, which gave them a stack footprint that grew with the message. DATA_LEN is now the exact payload length, committed to B0 at init, so the streaming methods release every byte as it arrives, FINAL_LEN is the tag, and the decryptor holds back only the bytes past the frame as the possible inline tag. More than DATA_LEN is refused at the update and less at the final, on both sides. The AES aliases are renamed AES_CCM_*_Packet, CCM_MAX_BUFFER_LEN is gone, and a value is now the Ccm state plus the AAD capacity at any DATA_LEN. The inherent Ccm API, which takes the lengths per message, is unchanged. The AEAD one-shots and finals follow the library's trailing `_out` convention (encrypt_detached_out, decrypt_with_aad_out, do_final_detached_out and so on) across core, cipher, aes and ascon, and the AEADCipherEncryptor trait docs are rewritten for a calling application. QUALITY_AND_STYLE gains the rule that public API docs carry no implementation detail. Suspend-and-resume round-trip tests cover every mode, adapter and AES alias, and the shared test framework takes a fixed message length so it can drive the fixed-frame pair. Review fixes folded in: CcmDecryptor::decrypt_out_max_len is `ciphertext_len.min(DATA_LEN)`, so a short inline C through the one-shots reaches the final and is DecryptionFailed rather than OutputBufferTooSmall, with a test at DATA_LEN = 32; the adapters' update docs say a refused non-empty call still ends the AAD phase; and three wording errors in the rewritten trait docs are fixed. cargo mutants over crypto/cipher/src/modes/ccm.rs with the cipher and aes tests: 313 mutants, 231 caught, 78 unviable, 2 timeouts that are real kills, 2 missed (the OR/XOR equivalence in format_b0's flags octet). Assisted-by: Claude:claude-fable-5-1 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

ounsworth · 2026-10-02T19:11:39Z

+//! root: this crate holds the traits, and `bouncycastle-aes` and `bouncycastle_cipher::modes` hold their
+//! implementors. The safe adapters that wrap them -- `bouncycastle_cipher::stream::StreamCipher`
+//! over a [`KeyStream`], the modes over an [`ElectronicCodeBook`] -- are not hazmat and stay where
+//! they are.


Adjust / shorten this.

ounsworth · 2026-10-02T19:12:18Z

+/// Errors from [`Suspendable`](crate::traits::Suspendable) and
+/// [`SuspendableKeyed`](crate::traits::SuspendableKeyed). Defined in `bouncycastle-utils` next to
+/// the version-header helpers that raise it, and re-exported here with the other error types.
+pub use bouncycastle_utils::suspendable_state::SuspendableError;


This should be moved here, not re-imported.

dghgit and others added 30 commits September 6, 2026 12:30

sm3: add bouncycastle-sm3 (GB/T 32905-2016) and HMAC-SM3 with factory…

fa0be5d

… and CLI wiring (PR #89)

Partial bytes follow ASN.1 BIT STRING order (X.690 s. 8.6.2): message…

34d7953

… bits in the MSBs, unused low bits ignored

release notes: SM3 partial bytes follow the ASN.1 BIT STRING order li…

1140a61

…ke the other hashes

sha2, sm3: document the surviving cargo-mutants equivalences at their…

1ad97fd

… sites

core: split BlockCipher into block-aligned BlockCipherEncryptor/Decry…

fe6fd58

…ptor with multi-block and one-shot methods (PR #107)

aes-lowmemory: add bouncycastle-aes-lowmemory, a constant-time, table…

58a1fed

…-free bit-sliced AES permutation (PR #105)

modes: add BlockPermutation trait, bouncycastle-modes with AES CBC, a…

aa9454d

…nd aes*-cbc CLI subcommands (PR #106)

padding: add Padding trait and bouncycastle-padding (PKCS7, PaddedEnc…

f56802e

…ryptor/PaddedDecryptor) (PR #97)

core, modes, aes-lowmemory: in-place block cipher API with compile-ti…

78a4021

…me lengths, AES_CBC_* aliases, simpler CLI (PR #109)

modes: add AES CFB128 mode with AES_CFB_* aliases, aes*-cfb CLI subco…

c5f60fb

…mmands and shared block-mode CLI (PR #111)

core: ElectronicCodeBook (was BlockPermutation), slice block hooks, b…

2c0567e

…locks8, SymmetricCipherEncryptor/Decryptor (from feature/sm4); CFB follows suit

modes: add Ecb (SP 800-38A Sec 6.1) with AES_ECB_* aliases and aes*-e…

157b1c8

…cb CLI subcommands; block-mode CLI generic over INIT_DATA_LEN

padding: add NoPadding (errors when asked to pad) with Padding::ALWAY…

f6cb787

…S_PADS; SymmetricCipherEncryptor::do_final reports its output length

skills: add commit-range-report, a Markdown report of a commit range …

a1c4e41

…with API changes and per-commit summaries

mldsa, mlkem: replace the const-generic turbofish with sealed MLDSAPa…

9c65521

…rams/HashMLDSAParams/MLKEMParams traits, one impl per parameter set (#117)

core: replace StreamCipher with the split StreamCipherEncryptor / Str…

57dd3d0

…eamCipherDecryptor pair, shaped like the block cipher pair (in place, any length, generated init data); TestFrameworkStreamCipher implemented in place of its todo!()

modes: Cfb becomes a stream cipher taking any length with no padding,…

97ac6e3

… and Cfb8 (SP 800-38A Sec 6.3, s = 8) is added, with AES_CFB8_* aliases, aes*-cfb8 CLI subcommands and a shared stream-mode CLI

release notes: CFB becomes a stream cipher with a short final segment…

5c73617

…, CFB8 is added, and the StreamCipher trait is replaced by the split encryptor/decryptor pair; re-measured throughput and mutation figures

modes: pin the single-call vs chunked equivalence of Cfb and Cfb8 aga…

e2b534d

…inst real AES at all three key lengths, not only the toy permutation

modes: add Ctr (SP 800-38A Sec 6.5), a stream cipher whose nonce leng…

f72bfe6

…th picks the counter width (max 4 bytes) and which errors rather than repeat a counter, with AES_CTR_* aliases and aes*-ctr CLI subcommands

modes: cross-check Ctr against BC Java's SICBlockCipher, which shares…

0404ab9

… the nonce-plus-counter construction, pinning the 1, 2 and 3-byte counter widths that the ACVP and OpenSSL vectors cannot reach

sha2: partial-bit messages, compile-time IVs, CAVP SHAVS tests (PR #88)

921e2b5

sha3: partial-byte fixes, CAVP SHA3VS tests, mem-usage bench, release…

7b4e7fc

… notes (PR #87)

sha2, hmac: add SHA-512/224 and SHA-512/256 (FIPS 180-4 s. 5.3.6) and…

c34c2f9

… their HMAC variants

rng: use core::fmt in hash_drbg80090a.rs; the only part of PRs #92-#95 …

7df74a6

…not already on this branch

sm3: add bouncycastle-sm3 (GB/T 32905-2016) and HMAC-SM3 with factory…

ac896e2

… and CLI wiring (PR #89)

Partial bytes follow ASN.1 BIT STRING order (X.690 s. 8.6.2): message…

f34858d

… bits in the MSBs, unused low bits ignored

release notes: SM3 partial bytes follow the ASN.1 BIT STRING order li…

46e2e79

…ke the other hashes

sha2, sm3: document the surviving cargo-mutants equivalences at their…

607cfa7

… sites

core: split BlockCipher into block-aligned BlockCipherEncryptor/Decry…

4ca1274

…ptor with multi-block and one-shot methods (PR #107)

ounsworth reviewed Sep 30, 2026

View reviewed changes

Comment thread crypto/cipher/src/stream.rs

Refactored to move all AES tests out of the modes crate into the aes …

941743b

…crate

ounsworth reviewed Sep 30, 2026

View reviewed changes

ounsworth and others added 8 commits September 30, 2026 14:47

Tweaked docs for AES_CBC

dc6f5af

Merge branch 'feature/simple-ciphers' of git.bouncycastle.org:bc-rust…

af10fde

… into feature/simple-ciphers

cli: rng no longer appends a newline to binary output -- `rng --len N…

ed341fb

… > file` is now exactly N bytes. Newline preserved for -x Assisted-by: Claude:claude-fable-5-1

Converted cli/tests to be bash tests. Written entirely by claude/fabl…

26af712

…e 5.1

ounsworth reviewed Oct 1, 2026

View reviewed changes

ounsworth and others added 11 commits September 30, 2026 22:43

aes docs tweaks

3e2a6b9

QUALITY_AND_STYLE: add Docs "Proportion" and "Release Notes" rules, w…

9219216

…ith the CLAUDE.md pointer updated to match Assisted-by: Claude Code:claude-fable-5-1 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Swapped around the AES_CCM convenience types to remove direction and …

fa3186d

…make unbuffered the default

BIG REFACTOR: folded crates bouncycastle-modes and bouncycastle-paddi…

8dff255

…ng to be sub-modules of a new crate bouncycastle-cipher. Assisted-by: claude-fable-5.1

Adding wycheproof test harnesses for AES_CBC and AES_GCM

7f985aa

aes, cipher: doc fixes from the house-rules review, and the AESIntern…

4c8179a

…al contract tests move to tests/ No behaviour change. Assisted-by: Claude:claude-fable-5-1

utils, core: move suspendable_state out of core and into bouncycastle…

5ee8db0

…-utils, with the component layer for composing suspended states Assised-by:claude-fable-5-1

Implemented SuspendableKeyed for AES

28f6e34

ounsworth reviewed Oct 2, 2026

View reviewed changes

Navigation Menu

Simple ciphers: stream + symmetric cipher unification off the release branch, plus SHA-512/t for any t - #133

Simple ciphers: stream + symmetric cipher unification off the release branch, plus SHA-512/t for any t#133
dghgit wants to merge 254 commits into
release/0.1.3alphafrom
feature/simple-ciphers

dghgit commented Sep 16, 2026

Uh oh!

Uh oh!

ounsworth Sep 30, 2026 •

edited

Loading

Uh oh!

ounsworth Sep 30, 2026

Uh oh!

ounsworth Oct 1, 2026

Uh oh!

ounsworth Oct 1, 2026 •

edited

Loading

Uh oh!

ounsworth Oct 1, 2026

Uh oh!

ounsworth Oct 2, 2026

Uh oh!

ounsworth Oct 2, 2026 •

edited

Loading

Uh oh!

ounsworth Oct 2, 2026

Uh oh!

ounsworth Oct 2, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -1,76 +1,267 @@
		//! Generic behaviour tests for the symmetric cipher traits.

Conversation

dghgit commented Sep 16, 2026

New in this PR, on top of those two

Verification

Note for reviewers

Uh oh!

Uh oh!

ounsworth Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ounsworth Sep 30, 2026

Choose a reason for hiding this comment

Uh oh!

ounsworth Oct 1, 2026

Choose a reason for hiding this comment

Uh oh!

ounsworth Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ounsworth Oct 1, 2026

Choose a reason for hiding this comment

Uh oh!

ounsworth Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

ounsworth Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ounsworth Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

ounsworth Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ounsworth Sep 30, 2026 •

edited

Loading

ounsworth Oct 1, 2026 •

edited

Loading

ounsworth Oct 2, 2026 •

edited

Loading