aes

aes is the RustCrypto project’s implementation of the Advanced Encryption Standard, providing the raw AES-128/192/256 block cipher function as a no_std Rust crate. It automatically selects the fastest available backend at runtime — AES-NI and VAES on x86/x86_64, ARMv8 Cryptography Extensions on aarch64 — and falls back to a constant-time, bitsliced pure-Rust implementation when hardware acceleration isn’t available. The crate implements only the low-level block function defined by the cipher crate’s traits and is explicitly intended as a building block for higher-level constructions such as AES-GCM, not for direct use in application code.

What You Get

• Aes128, Aes192, and Aes256 block cipher types with encrypt_block/decrypt_block and parallel encrypt_blocks/decrypt_blocks APIs
• Runtime CPU-feature detection that transparently selects AES-NI, VAES (256/512-bit), or ARMv8 crypto-extension backends
• A constant-time, fixslicing-based pure-Rust software fallback with no lookup tables or data-dependent branches
• An optional hazmat module exposing low-level round-key and cipher internals for authors of higher-level constructions
• no_std support for embedded and constrained environments

Common Use Cases

• Providing the underlying block cipher for an AEAD construction such as AES-GCM or AES-GCM-SIV via the RustCrypto AEADs repository
• Implementing a block cipher mode of operation (CTR, CBC, CFB) on top of a certified primitive
• Embedded or no_std firmware that needs a constant-time AES implementation without relying on OS-level crypto libraries
• Cross-platform Rust applications that want automatic hardware acceleration without hand-rolling target-specific dispatch

Under The Hood

Architecture: The crate is organized around a public dispatch layer (lib.rs) that wraps private backend modules under src/backends/ — a portable fixslice/ implementation performing constant-time bitsliced AES purely in bitwise arithmetic, plus target-gated x86_aes/x86_vaes256/x86_vaes512 and aarch64_aes modules that call CPU AES intrinsics. Aes128/Aes192/Aes256 (and their split *Enc/*Dec halves) are thin wrapper structs holding a runtime-initialized Token (via the cpufeatures crate) plus an inner enum selecting the soft or hardware backend; KeyInit::new() checks token.aes.get() once at construction and dispatches to the matching backend, so per-block calls pay no further runtime-detection cost. A feature-gated hazmat module re-exposes backend internals for crates like aes-gcm that need direct round-key access.

Tech Stack: Pure Rust, edition 2024, MSRV 1.85, no_std. The core dependency is RustCrypto’s cipher crate (0.5) for the BlockCipherEncrypt/BlockCipherDecrypt/KeyInit trait definitions and Array/Key types; cpufeatures (0.3) provides runtime CPU-feature detection on x86/aarch64; cpubits and an optional zeroize round out the dependency list. There are no build scripts — conditional compilation (cfg_if, target_arch cfg-gates, and explicit aes_backend cfg flags) is the only configuration mechanism.

Code Quality: Tests in tests/mod.rs use the cipher crate’s block_cipher_test! macro against NESSIE test vectors, covering all three key sizes for combined, encrypt-only, and decrypt-only variants, plus a dedicated tests/hazmat.rs. Public APIs carry #![warn(missing_docs, rust_2018_idioms)], and lib.rs’s doc comment includes a full runnable usage example. Unsafe blocks around backend intrinsics are annotated with SAFETY comments tied to the verified-target-feature invariant. The crate has undergone an independent NCC Group security audit with no significant findings — a notably higher bar than typical open-source crypto code.

API Design: The public surface is deliberately minimal: Aes128/192/256 implement standard cipher-crate traits, so anyone familiar with RustCrypto’s ecosystem (aes-gcm, chacha20poly1305, etc.) gets the same KeyInit::new + encrypt_block/decrypt_block pattern with nothing crate-specific to learn. Parallel block APIs (encrypt_blocks/decrypt_blocks) extend the same trait rather than adding a separate one. The tradeoff is that this is not a beginner-friendly “just encrypt my data” API — it’s a hazmat-adjacent primitive, and the README leads with a security warning steering users toward higher-level AEAD crates instead.