block-ciphers

It's nice to know there are a few "safe" Rust crypto primitives (especially the `ChaCha20+Poly1305` which is also found in `libsodium`): * AES/GCM: https://github.com/RustCrypto/AEADs/tree/master/aes-gcm * ChaCha20+Poly1305: https://github.com/RustCrypto/AEADs/tree/master/chacha20poly... Quoting from the "key findings" of that report: > NCC Group did not find any vulnerability in the audited crates. > > The RustCrypto implementations use all the recommended techniques to achieve constant-time implementations; in particular, the fallback AES implementation (to be used when there are no usable hardware AES opcodes) uses bitslicing to avoid any table lookups at secret-dependent addresses. Similarly, received authentication tags are compared with constant-time comparison functions. > > A few cosmetic remarks, mostly related to potential perfo

I don't know about openssl's status on old / weak platforms. People who need AES without hardware AES instructions should be using BearSSL code or the rust code that has been reviewed by the author of BearSSL (see e.g. https://github.com/RustCrypto/block-ciphers/issues/65).