add xts-aes and aes-kw(p) algos - #99
Merged
Merged
Conversation
The previous commit drifted the SymCrypt submodule pointer from 748c20f1 (matches symcrypt-sys/VERSION.md) to 53be637. Reset it back so the check-submodule CI workflow passes and bindings are regenerated against the correct SymCrypt version.
Adds allowlist patterns for XTS-AES, AES-KW (RFC 3394), and AES-KWP (RFC 5649) functions so they get exposed by symcrypt-sys. Bindings will be regenerated via the generate_pr_label workflow.
Adds the XTS-AES (SYMCRYPT_XTS_AES_EXPANDED_KEY plus the seven XtsAes functions) and AES-KW / AES-KWP encrypt/decrypt symbols to all four arch-specific bindings files. Reverts the spacing-only tweak in the bindgen comment that was used to retrigger the regen workflow.
Makes AesInnerKey pub(crate) so other modules can reuse it for AES-based modes that share SYMCRYPT_AES_EXPANDED_KEY (AES-KW, AES-KWP). Adds a Drop impl that calls SymCryptWipe on the inner state, matching the pattern GcmInnerKey uses.
Three new modules backed by SymCrypt's native primitives: - xts: XtsAes256Key with encrypt_in_place / decrypt_in_place using a 64-bit tweak. Uses SymCryptXtsAesExpandKeyEx (FIPS-approved variant, enforcing the equality check on the two key halves). - aes_kw: AesKwKey for RFC 3394 (8-byte-aligned plaintext, output = input + 8) and AesKwpKey for RFC 5649 (any non-zero length, output rounded up to a multiple of 8 plus 8). Both reuse the AES expanded key from cipher/mod.rs. All entry points call crate::symcrypt_init() first, mirroring every other primitive in the crate. KAT tests use vectors from SymCrypt's own kat_xts.dat (IEEE 1619-2018 e/pi key) and kat_keywrap.dat (NIST ACVP test vectors). README documents the new APIs and notes that AES-KW(P) has no general-purpose Windows BCrypt equivalent today; a future BCrypt-backed variant will return a NotSupported runtime error on Windows for AES-KW(P) until the BCrypt gap is filled upstream.
- xts.rs and aes_kw.rs move from the crate root into cipher/, joining cbc alongside the shared AES expanded-key infrastructure. Public paths become symcrypt::cipher::xts and symcrypt::cipher::aes_kw. - AES-KW(P) methods renamed wrap/unwrap -> encrypt/decrypt to match the rest of the crate's cipher API (gcm, cbc) and avoid collision with Result::unwrap. The underlying algorithm is still described as wrap/unwrap in doc prose where the standards terminology applies. - aes_kw internal import uses crate::cipher::AesInnerKey to match cbc.rs's existing style. - xts.rs gains a byte-for-byte KAT test using the IEEE 1619-2018 vector at symcrypt/unittest/kat_xts.dat:178 (e||pi key, tweak 0xff, 512-byte plaintext as a single data unit). cbDataUnit == cbPlaintext for this KAT per katXtsSingle in testXts.cpp:519. - xts.rs top-of-file docs are reorganized to mirror gcm.rs: an ## Encrypt in place and ## Decrypt in place sub-section under # Examples, each a self-contained runnable doctest. gcm.rs and chacha.rs remain at the crate root for backwards compatibility; they will move under cipher/ at the next intentional breaking release.
Mirrors the cbc.rs pattern (which offers both aes_cbc_encrypt and aes_cbc_encrypt_in_place). The new methods take separate plaintext and ciphertext slices of equal length, useful when the caller wants to preserve the plaintext for retry, verification, or logging. In-place remains the natural shape for disk-sector use cases; the out-of-place variant is purely additive. AES-KW(P) deliberately does not get a corresponding pair because its output size differs from input size, making 'in place' a misnomer and the Vec-return shape match what HKDF, SP800-108, and RSA encrypt already do for variable-size outputs.
The earlier draft used the symcrypt.h header's cbSrc shorthand. Spelling it as plaintext.len() reads more naturally for Rust callers and the file's top-of-module comment already directs readers to symcrypt.h for deeper context. Also drops two stale comments that named the kat_keywrap.dat section the test vectors came from; the test bodies already cite the source.
Khang (nnmkhang)
changed the title
Khang (nnmkhang)
marked this pull request as ready for review
May 11, 2026 16:15
Steven Malis (smalis-msft)
approved these changes
May 11, 2026
Open
Mitch Lindgren (mlindgren)
approved these changes
May 21, 2026
Mitch Lindgren (mlindgren)
left a comment
Mitch Lindgren (mlindgren)
left a comment
Member
There was a problem hiding this comment.
lgtm modulo the one remaining discussion about Zeroize
Steven Malis (smalis-msft)
approved these changes
May 21, 2026
Steven Malis (smalis-msft)
left a comment
Steven Malis (smalis-msft)
left a comment
Collaborator
There was a problem hiding this comment.
shipit
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of Changes:
Breaking Changes if any:
✅ Admin Checklist
cargo test --all-featuresonWindowsandWSL.Check the Developer Guidelines in DEVELOPER.md for more info.