Skip to content

aes: enable VAES backends by default, bump MSRV to 1.89 #580

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
newpavlov wants to merge 3 commits into
base: master
Choose a base branch
from
Open

aes: enable VAES backends by default, bump MSRV to 1.89 #580

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7f85147
aes: enable VAES backends by default, bump MSRV to 1.89
newpavlov Jul 31, 2026
03b123e
Add changelog entries
newpavlov Jul 31, 2026
2678c37
use `as_chunks`
newpavlov Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 11 additions & 11 deletions .github/workflows/aes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
strategy:
matrix:
rust:
- 1.85.0 # MSRV
- 1.89.0 # MSRV
- stable
target:
- thumbv7em-none-eabi
Expand Down Expand Up @@ -78,15 +78,15 @@ jobs:
include:
# 32-bit Linux
- target: i686-unknown-linux-gnu
rust: 1.85.0 # MSRV
rust: 1.89.0 # MSRV
deps: sudo apt update && sudo apt install gcc-multilib
- target: i686-unknown-linux-gnu
rust: stable
deps: sudo apt update && sudo apt install gcc-multilib

# 64-bit Linux
- target: x86_64-unknown-linux-gnu
rust: 1.85.0 # MSRV
rust: 1.89.0 # MSRV
- target: x86_64-unknown-linux-gnu
rust: stable
steps:
Expand Down Expand Up @@ -177,15 +177,15 @@ jobs:
include:
# 32-bit Linux
- target: i686-unknown-linux-gnu
rust: 1.85.0 # MSRV
rust: 1.89.0 # MSRV
deps: sudo apt update && sudo apt install gcc-multilib
- target: i686-unknown-linux-gnu
rust: stable
deps: sudo apt update && sudo apt install gcc-multilib

# 64-bit Linux
- target: x86_64-unknown-linux-gnu
rust: 1.85.0 # MSRV
rust: 1.89.0 # MSRV
- target: x86_64-unknown-linux-gnu
rust: stable
steps:
Expand All @@ -210,15 +210,15 @@ jobs:
include:
# 32-bit Linux
- target: i686-unknown-linux-gnu
rust: 1.85.0 # MSRV
rust: 1.89.0 # MSRV
deps: sudo apt update && sudo apt install gcc-multilib
- target: i686-unknown-linux-gnu
rust: stable
deps: sudo apt update && sudo apt install gcc-multilib

# 64-bit Linux
- target: x86_64-unknown-linux-gnu
rust: 1.85.0 # MSRV
rust: 1.89.0 # MSRV
- target: x86_64-unknown-linux-gnu
rust: stable
steps:
Expand All @@ -239,13 +239,13 @@ jobs:
include:
# ARM64
- target: aarch64-unknown-linux-gnu
rust: 1.85.0 # MSRV
rust: 1.89.0 # MSRV
- target: aarch64-unknown-linux-gnu
rust: stable

# PPC32
- target: powerpc-unknown-linux-gnu
rust: 1.85.0 # MSRV
rust: 1.89.0 # MSRV
- target: powerpc-unknown-linux-gnu
rust: stable
runs-on: ubuntu-latest
Expand Down Expand Up @@ -287,7 +287,7 @@ jobs:
matrix:
include:
- target: aarch64-unknown-linux-gnu
rust: 1.85.0 # MSRV
rust: 1.89.0 # MSRV
runs-on: ubuntu-latest
# Cross mounts only current package, i.e. by default it ignores workspace's Cargo.toml
defaults:
Expand Down Expand Up @@ -315,6 +315,6 @@ jobs:
- uses: RustCrypto/actions/cargo-cache@master
- uses: dtolnay/rust-toolchain@master
with:
toolchain: 1.85.0 # MSRV
toolchain: 1.89.0 # MSRV
components: clippy
- run: cargo clippy --features hazmat -- -D warnings
10 changes: 10 additions & 0 deletions aes/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## 0.9.3 (UNRELEASED)
### Changed
- MSRV bumped to 1.89 ([#580])
- VAES-256 and VAES-512 backends on x86 targets are now supported by default ([#580])

### Removed
- `aes_backend = "avx256"` and `aes_backend = "avx512"` configuration flags ([#580])

[#580]: https://github.com/RustCrypto/block-ciphers/pull/580

## 0.9.2 (2026-07-27)
### Added
- `hardware_accelerated` function ([#579])
Expand Down
4 changes: 2 additions & 2 deletions aes/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ description = "Pure Rust implementation of the Advanced Encryption Standard (a.k
authors = ["RustCrypto Developers"]
license = "MIT OR Apache-2.0"
edition = "2024"
rust-version = "1.85"
rust-version = "1.89"
readme = "README.md"
documentation = "https://docs.rs/aes"
repository = "https://github.com/RustCrypto/block-ciphers"
Expand All @@ -31,7 +31,7 @@ hazmat = [] # Expose cryptographically hazardous APIs
level = "warn"
check-cfg = [
'cfg(aes_backend_soft, values("compact"))',
'cfg(aes_backend, values("soft", "avx256", "avx512"))',
'cfg(aes_backend, values("soft"))',
'cfg(cpubits, values("16", "32", "64"))'
]

Expand Down
33 changes: 11 additions & 22 deletions aes/src/backends.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,13 @@
pub(crate) mod soft;

#[cfg(all(target_arch = "aarch64", not(aes_backend = "soft")))]
pub(crate) mod aarch64_aes;

#[cfg(all(
any(target_arch = "x86_64", target_arch = "x86"),
not(aes_backend = "soft")
))]
pub(crate) mod x86_aes;

#[cfg(all(
any(aes_backend = "avx256", aes_backend = "avx512"),
any(target_arch = "x86_64", target_arch = "x86"),
not(aes_backend = "soft"),
))]
pub(crate) mod x86_vaes256;

#[cfg(all(
aes_backend = "avx512",
any(target_arch = "x86_64", target_arch = "x86"),
not(aes_backend = "soft"),
))]
pub(crate) mod x86_vaes512;
cpubits::cfg_if! {
if #[cfg(aes_backend = "soft")] {
// Do not add other backends if software backend is forced
} else if #[cfg(target_arch = "aarch64")] {
pub(crate) mod aarch64_aes;
} else if #[cfg(any(target_arch = "x86_64", target_arch = "x86"))] {
pub(crate) mod x86_aes;
pub(crate) mod x86_vaes256;
pub(crate) mod x86_vaes512;
}
}
50 changes: 21 additions & 29 deletions aes/src/backends/aarch64_aes.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ use cipher::{

mod encdec;
mod expand;
mod utils;

#[cfg(feature = "hazmat")]
pub(crate) mod hazmat;
Expand Down Expand Up @@ -36,15 +37,13 @@ pub(crate) struct Aes<const RK: usize> {
impl<const RK: usize> Aes<RK> {
#[inline]
#[target_feature(enable = "aes")]
// TODO(MSRV-1.86): remove `unsafe`
pub(crate) unsafe fn encrypt(&self, f: impl BlockCipherEncClosure<BlockSize = U16>) {
pub(crate) fn encrypt(&self, f: impl BlockCipherEncClosure<BlockSize = U16>) {
f.call(self);
}

#[inline]
#[target_feature(enable = "aes")]
// TODO(MSRV-1.86): remove `unsafe`
pub(crate) unsafe fn decrypt(&self, f: impl BlockCipherDecClosure<BlockSize = U16>) {
pub(crate) fn decrypt(&self, f: impl BlockCipherDecClosure<BlockSize = U16>) {
f.call(self);
}
}
Expand All @@ -69,7 +68,7 @@ impl<const RK: usize> BlockCipherEncBackend for Aes<RK> {
fn encrypt_par_blocks(&self, blocks: InOut<'_, '_, ParBlocks<Self>>) {
// SAFETY: this trait impl is used only by the `Self::encrypt` method marked with
// `#[target_feature(enable = "aes")]`
unsafe { encdec::encrypt_par(&self.enc_rk, blocks) };
unsafe { encdec::batch_encrypt(&self.enc_rk, blocks) };
}
}

Expand All @@ -85,7 +84,7 @@ impl<const RK: usize> BlockCipherDecBackend for Aes<RK> {
fn decrypt_par_blocks(&self, blocks: InOut<'_, '_, ParBlocks<Self>>) {
// SAFETY: this trait impl is used only by the `Self::decrypt` method marked with
// `#[target_feature(enable = "aes")]`
unsafe { encdec::decrypt_par(&self.dec_rk, blocks) };
unsafe { encdec::batch_decrypt(&self.dec_rk, blocks) };
}
}

Expand All @@ -97,25 +96,22 @@ pub(crate) struct AesEnc<const RK: usize> {
impl<const RK: usize> AesEnc<RK> {
#[inline]
#[target_feature(enable = "aes")]
// TODO(MSRV-1.86): remove `unsafe`
pub(crate) unsafe fn as_encdec(&self) -> Aes<RK> {
pub(crate) fn as_encdec(&self) -> Aes<RK> {
let enc_rk = self.enc_rk;
let dec_rk = unsafe { expand::inv_expanded_keys(&enc_rk) };
let dec_rk = expand::inv_expanded_keys(&enc_rk);
Aes { enc_rk, dec_rk }
}

#[inline]
#[target_feature(enable = "aes")]
// TODO(MSRV-1.86): remove `unsafe`
pub(crate) unsafe fn as_dec(&self) -> AesDec<RK> {
let dec_rk = unsafe { expand::inv_expanded_keys(&self.enc_rk) };
pub(crate) fn as_dec(&self) -> AesDec<RK> {
let dec_rk = expand::inv_expanded_keys(&self.enc_rk);
AesDec { dec_rk }
}

#[inline]
#[target_feature(enable = "aes")]
// TODO(MSRV-1.86): remove `unsafe`
pub(crate) unsafe fn encrypt(&self, f: impl BlockCipherEncClosure<BlockSize = U16>) {
pub(crate) fn encrypt(&self, f: impl BlockCipherEncClosure<BlockSize = U16>) {
f.call(self)
}
}
Expand All @@ -140,7 +136,7 @@ impl<const RK: usize> BlockCipherEncBackend for AesEnc<RK> {
fn encrypt_par_blocks(&self, blocks: InOut<'_, '_, ParBlocks<Self>>) {
// SAFETY: this trait impl is used only by the `Self::encrypt` method marked with
// `#[target_feature(enable = "aes")]`
unsafe { encdec::encrypt_par(&self.enc_rk, blocks) };
unsafe { encdec::batch_encrypt(&self.enc_rk, blocks) };
}
}

Expand All @@ -152,8 +148,7 @@ pub(crate) struct AesDec<const RK: usize> {
impl<const RK: usize> AesDec<RK> {
#[inline]
#[target_feature(enable = "aes")]
// TODO(MSRV-1.86): remove `unsafe`
pub(crate) unsafe fn decrypt(&self, f: impl BlockCipherDecClosure<BlockSize = U16>) {
pub(crate) fn decrypt(&self, f: impl BlockCipherDecClosure<BlockSize = U16>) {
f.call(self);
}
}
Expand All @@ -178,7 +173,7 @@ impl<const RK: usize> BlockCipherDecBackend for AesDec<RK> {
fn decrypt_par_blocks(&self, blocks: InOut<'_, '_, ParBlocks<Self>>) {
// SAFETY: this trait impl is used only by the `Self::decrypt` method marked with
// `#[target_feature(enable = "aes")]`
unsafe { encdec::decrypt_par(&self.dec_rk, blocks) };
unsafe { encdec::batch_decrypt(&self.dec_rk, blocks) };
}
}

Expand All @@ -187,31 +182,28 @@ macro_rules! impl_key_init {
impl $name {
#[inline]
#[target_feature(enable = "aes")]
// TODO(MSRV-1.86): remove `unsafe`
pub(crate) unsafe fn new(key: &[u8; $key_size]) -> Self {
let enc_rk = unsafe { expand::expand_key(key) };
let dec_rk = unsafe { expand::inv_expanded_keys(&enc_rk) };
pub(crate) fn new(key: &[u8; $key_size]) -> Self {
let enc_rk = expand::expand_key(key);
let dec_rk = expand::inv_expanded_keys(&enc_rk);
Self { enc_rk, dec_rk }
}
}

impl $name_enc {
#[inline]
#[target_feature(enable = "aes")]
// TODO(MSRV-1.86): remove `unsafe`
pub(crate) unsafe fn new(key: &[u8; $key_size]) -> Self {
let enc_rk = unsafe { expand::expand_key(key) };
pub(crate) fn new(key: &[u8; $key_size]) -> Self {
let enc_rk = expand::expand_key(key);
Self { enc_rk }
}
}

impl $name_dec {
#[inline]
#[target_feature(enable = "aes")]
// TODO(MSRV-1.86): remove `unsafe`
pub(crate) unsafe fn new(key: &[u8; $key_size]) -> Self {
let enc_rk = unsafe { expand::expand_key(key) };
let dec_rk = unsafe { expand::inv_expanded_keys(&enc_rk) };
pub(crate) fn new(key: &[u8; $key_size]) -> Self {
let enc_rk = expand::expand_key(key);
let dec_rk = expand::inv_expanded_keys(&enc_rk);
Self { dec_rk }
}
}
Expand Down
Loading