CHANGELOG.md

Changelog

0.8.1 - 2026-08-11

• Align canonical install examples and the security support matrix with rscrypto 0.8.0.

• Allow Argon2idPassword and ScryptPassword to generate canonical PHC records from a caller-owned entropy source without enabling getrandom. Add exact-width HMAC-SHA256 verification for protocols that specify a 64-bit truncated tag.

0.8.0 - 2026-08-02

• Authenticate CI tool downloads and package-manager installs.

• Avoid duplicate Ed25519 secret expansion and repeated HKDF prefix-state copies without changing outputs.

• Bound default password-record PBKDF2 verification work while keeping raw derivation and compatibility policies unbounded. Custom record policies can set an explicit ceiling with verify_with_policy_bounded or verify_password_with_policy_bounded.

• Argon2 and scrypt password verification now reject noncanonical or over-budget PHC records before decoding, allocating, or running a KDF. The pre-1.0 API is split into verifier-owned Argon2idPassword and ScryptPassword records and raw derive operations with valid-by-construction parameters; legacy public PHC parsing, unbounded verification, builder, version-selection, and caller-supplied-salt password helpers have been removed.

• Changed-test planning now runs the workspace test suite when planner output is unavailable, invalid, or ambiguous; only a valid explicit empty scope skips tests.

• Clear ECDSA accelerated reduction and inversion scratch after use.

• Clear ML-KEM secret SHA-3 and SHAKE state after use.

• Clear portable AEAD authentication state after use.

• Clear RSA private-key validation buffers on every return path.

• Collapse RapidHash to portable RapidHash64, RapidStreamHasher, RapidHasher, RapidSeededState, and fallible RapidRandomState. Remove the RapidHash alias, 128-bit/native-endian variants, RapidBuildHasher, duplicate cores, placeholder dispatch, and direct/default RapidHasher construction; collection hashers now come from an explicit state.

• Constant-time release evidence now inspects production equality paths in final linked binaries and binds disassembly, symbols, timing, formal results, provenance, and hashes to the exact release commit and build configuration.

• Correct AES-GCM-SIV RFC input bounds.

• Correct cSHAKE and KMAC byte padding at exact rate boundaries.

• Correct x86 CRC-16 and CRC-24 four-way tails, x86 and POWER capability detection, and cached initialization after a panic.

• Document Ascon-AEAD128 per-key nonce, data, and failed-decryption limits from final SP 800-232.

• Fix diag builds when CRC-32 and CRC-64 are enabled independently.

• Immutable releases now bind a protected tag and exact commit to a deterministic source archive, crate, evidence, checksums, and pinned toolchain in an attested manifest.

• Reduce RapidHash overhead for fixed-size collection keys without changing hash outputs or allocation behavior.

• Development and CI now use libcrux ML-KEM 0.0.10, removing vulnerable libcrux-secrets and libcrux-sha3 releases from the locked oracle graph.

• Make cryptographic boundaries misuse-resistant: keyed BLAKE2 uses validated borrowed key types and variable outputs fail with typed errors, normal AEAD sealing owns nonce issuance while caller nonces require an expert import, entropy and platform override failures no longer panic, and diagnostic or dangerous capabilities no longer clutter the crate root.

• Normalize RSA CRT exponents before private operations.

• Secret comparison is now owned by fixed-size cryptographic key, tag, and shared-secret types. The public generic ConstantTimeEq trait, arbitrary-slice comparison helper, and slice/array implementations have been removed; SecretBytes and SecretVec no longer provide equality.

• Preserve a scalar declassification boundary for fixed-size secret-owner equality so optimized x86 builds remain covered by constant-time binary proofs.

• Rebind reusable RSA scratch state when switching between same-width keys.

• Panic before absorbing SHA-384, SHA-512, or SHA-512/256 input that would exceed the FIPS 180-4 length field instead of wrapping the encoded bit length.

• Reject RSA private-key imports with nonstandard-width factors or factors that fail probable-prime screening.

• Release validation now separates routine assurance from exact-commit evidence, completes focused RSA Miri proofs within the gate, and avoids redundant feature and fuzz execution.

• Remove the unselected diagnostic-only AArch64 Poly1305 kernel and unused ML-KEM phase benchmarks. Production dispatch, portable fallbacks, retained constant-time probes, FIPS 203 behavior, and cryptographic outputs are unchanged.

• Remove unselected architecture kernels and unused diagnostic hooks. Production dispatch and portable fallbacks are unchanged.

• Releases now include an attested snapshot of the enforced default-branch controls, and maintainers can detect live ruleset drift before tagging with just check-repository-controls.

• Require security-strength KMAC tags in default verification APIs and provide explicit primitive verification for protocol-defined shorter tags.

• Release notes now contain only reviewed user-facing entries from .changes/; commit history is no longer appended as generated changelog noise.

• Secret-bearing fixed-size keys, shared secrets, keypairs, authentication tags, and keyed BLAKE3 outputs no longer implement PartialEq or Eq. Their inherent ct_eq methods return an opaque CtDecision; callers must explicitly consume it with declassify() when revealing equality is intended. Verification APIs continue to return an opaque Result. Diagnostic HMAC and Ascon tag-comparison helpers now return CtDecision instead of bool. Custom Mac implementations must now provide verify; Mac::Tag no longer requires Eq.

• Secret-bearing HMAC, HKDF, KMAC, and PBKDF2 states no longer implement Clone. Keyed BLAKE2 parameter builders and the variable-output Blake2b state also no longer do, because they can retain a MAC key. The Mac trait no longer requires Clone; reuse or share one owner, or construct another keyed state explicitly.

  Secret-bearing SHA/HMAC, Ed25519, Keccak, BLAKE2, and BLAKE3 temporaries now clear at their actual finalization, reset, transfer, or drop boundary, including keyed XOF and parallel heap scratch. The optimized zeroization gate covers success, error, early-return, move, reuse, and drop shapes. Secret-key hex and generic ECDSA random-source errors no longer echo input or payload bytes through Debug, Display, or the standard error-source chain. Their public fields and variants still allow explicit recovery when callers deliberately inspect them.

• The check and check-all recipes now report formatting and lockfile drift without modifying pre-existing source or Cargo.lock changes.

• RSA JWT/JWS verification is now bound to one verifier-owned RsaJwtAlgorithm. Peer-controlled alg metadata can only match that fixed policy; string-to-profile helpers and runtime algorithm-name signing and verification APIs have been removed.

• Verify imported assembly and cryptographic test vectors against immutable upstream sources and deterministic transforms.

0.7.8 - 2026-07-15

Security and compatibility

• Hardened P-256 and P-384 signing so secret arithmetic remains fixed-work on s390x and RISC-V and caller blinding is established before secret-selected points enter field arithmetic. Extended release evidence to cover the affected native timing and assembly paths.
• Private RSA DER exports now return SecretVec, which wipes its allocation on drop and requires into_unprotected_vec() for ordinary extraction. Secret keys, shared secrets, keypairs, and AEAD cipher contexts no longer implement Clone; use duplicate_secret() when another owned secret is required.
• Constant-time claims are now limited to configurations with passing evidence in the matching attested release bundle; ct.toml records intent rather than proof by itself.

APIs and performance

• Added HKDF-SHA512, HMAC-SHA3, KMAC128, standalone Poly1305, cSHAKE128, getrandom key-generation helpers, allocating AEAD helpers, generic signature traits, and focused AEAD, signature, RSA, and ML-KEM examples.
• Replaced heap-buffered RapidHash and XXH3 streaming with fixed-size, allocation-free state. Added collection-oriented RapidHash support and XXH3-128 streaming, with accelerated long streams on AVX2, AVX-512, NEON, VSX, and z/Vector.

Release assurance

• Release artifacts now include provenance-attested crate and constant-time evidence bundles. Signed tags require successful exact-commit CI, unified Cargo graph assurance, SemVer checks, constant-time evidence, RSA evidence, package integrity checks, and crates.io Trusted Publishing approval.
• Consolidated CI ownership and change selection around cargo-rail's compiler-backed Cargo graph, while retaining complete native and cross-target correctness gates.

0.6.4 - 2026-07-07

• Added the trusted release-publishing gate and updated workflow validation for cargo-rail 0.15.
• Refreshed the development lockfile to remove the crossbeam-epoch advisory from test tooling.
• Updated the ECDSA differential-test oracles for the current p256 behavior.

0.6.2 - 2026-07-04

🏗️ Build

• route CT tooling through a Python compatibility shim ci: refresh runs-on action pin workspace: refresh fast hash and AWS-LC dependency locks benchmarks: refresh performance overview artifacts crypto: fix ChaCha20-Poly1305 lint and aarch64 ML-KEM asm tests (6f9dae8)
• decouple asm ownership check from task notes (c31d405)
• scope dev-machine recipes and ignore task notebooks (7236a1f)

👷 CI

• pin Wasmtime install for no_std wasm suite auth: restore aarch64 ML-KEM basemul asm test helper (86fac6f)

📦 Other Changes

• benchmarks: refresh July 4 performance overview and chart (878999c)
• auth: harden RSA private CRT arithmetic aead: gate forced ChaCha20 kernels on runtime caps (596498f)
• auth: fix aarch64 ML-KEM bounded SampleNTT stores (73eb536)
• crypto: revert aarch64 ML-KEM matrix XOF split route (6e0a871)
• crypto: route aarch64 ML-KEM matrix XOF around x3 hybrid (7cefb0d)
• Revert "crypto: feed aarch64 ML-KEM sampler from triple SHAKE state" (bc21ad6)
• auth: batch aarch64 ML-KEM fused chunk accumulation (81f2184)
• hashes: revert regressing aarch64 Keccak x3 assembly (342356e)
• hashes: add owned aarch64 Keccak x3 assembly (481105a)
• hashes: restore aarch64 Keccak hybrid batch dispatch (4887c16)
• hashes: route aarch64 Keccak batches through paired SHA3 lanes (bad0bc6)
• auth: batch aarch64 ML-KEM triple rejection parsing (dae2b42)
• auth: keep AArch64 ML-KEM SampleNTT asm on Linux (883f255)
• auth: add bounded AArch64 ML-KEM SampleNTT tail parser bench: expose ML-KEM three-block sampler diagnostics (a74f9cb)
• aead: restore x86 and POWER ChaCha20-Poly1305 open fast paths bench: expose x86 ChaCha20-Poly1305 open diagnostic row (e05a270)
• aead: add measured Linux ChaCha20-Poly1305 fast paths (f26ef5d)
• aead: gate x86 ChaCha20-Poly1305 asm by measured thresholds (57fe253)
• auth: route x86 P-384 signing through complete comb (1bcc2d1)
• aead: batch owned AArch64 ChaCha20-Poly1305 par4 bulk (b09e389)
• aead: add owned AArch64 ChaCha20-Poly1305 par4 diagnostics bench: compare owned AArch64 ChaCha20-Poly1305 par4 rows (1ffcf00)
• auth: expose Ed25519 verify phase diagnostics bench: add Ed25519 verify phase rows (dbeff3d)
• auth: split ML-KEM-1024 row sampling by aarch64 platform bench: expose ML-KEM-1024 quad row sampler comparator (a6315a2)
• auth: batch ML-KEM-1024 materialized row sampling through quad XOF bench: compare ML-KEM-1024 row sampler schedules (77e0543)
• auth: expose ML-KEM sampler phase diagnostics bench: add ML-KEM sampler phase rows (1b3ec7c)
• auth: expose ML-KEM-1024 materialized keygen split diagnostics bench: add ML-KEM-1024 materialized matrix split rows (2f103b9)
• auth: expose forced ML-KEM keygen matrix diagnostics bench: add ML-KEM keygen matrix split rows (9843d86)
• auth: batch aarch64 ML-KEM matrix sampling through triple XOF hashes: add Linux aarch64 Keccak x3 permutation support bench: expose ML-KEM triple matrix sampling rows (22a3fda)
• auth: expose ML-KEM keygen phase diagnostics and gate K2 aarch64 accumulation bench: add ML-KEM keygen phase rows ci: add ML-KEM keygen phase selector (1379d30)
• auth: tune aarch64 ML-KEM keygen finalization (7775a8d)
• auth: route aarch64 ML-KEM NTT through owned NEON (816e919)
• auth: shortcut P-384 signing r path and delete dead x86 asm (2a54d93)
• hashes: clear x86 Blake3 and introspection clippy lints (ae22843)
• aead: tune owned AArch64 ChaCha20-Poly1305 path hashes: clear BLAKE3 diag clippy lints docs: record assembly replacement tuning decisions (c8f6bfb)
• hashes: delete Darwin SHA-2 assembly for owned aarch64 kernels aead: expose owned ChaCha20-Poly1305 diagnostic path auth: widen public RSA CIOS threshold and add portable diagnostics bench: split AEAD and RSA assembly replacement benchmarks benchmarks: refresh BLAKE3 overview and README perf chart docs: track assembly ownership notebook decisions (76f4fa3)
• hashes: retarget BLAKE3 x86 compression and expose diag kernels aead: mark AES-GCM assembly as rscrypto-owned auth: mark RSA assembly as rscrypto-owned bench: add BLAKE3 diagnostic benches and gap report build: gate assembly provenance with ledger check (e643fe5)

0.6.1 - 2026-06-24

📦 Other Changes

• crypto: validate platform overrides and gate s390x AEGIS (83bcde8)

0.6.0 - 2026-06-23

👷 CI

• bump checkout and tool action pins workspace: refresh getrandom lockfiles benchmarks: refresh Linux benchmark scorecard (5e34396)

📦 Other Changes

• auth: add Darwin aarch64 ML-KEM assembly paths (7832c94)
• Revert "auth: add aarch64 ML-KEM quad rejection parser" (133627a)
• auth: port aarch64 ML-KEM k3 basemul schedule (2d65c61)
• auth: port aarch64 ML-KEM k4 basemul schedule (abcf8d8)
• Revert "auth: reschedule aarch64 ML-KEM basemul accumulation" (5bd2052)
• auth: tighten aarch64 ML-KEM inverse final scale (551f1b6)
• auth: unroll aarch64 ML-KEM inverse NTT asm (2d725d0)
• auth: precompute aarch64 ML-KEM inverse reducers (7271015)
• auth: include inverse add asm in aarch64 gate filter (766132e)
• auth: add Linux aarch64 ML-KEM inverse NTT asm diagnostics (133b8b6)
• Revert "auth: fuse aarch64 ML-KEM inverse NTT final scale" (5c79304)
• auth: dispatch fused ML-KEM1024 PKE matrix path (369e422)
• auth: compact ML-KEM fused rejection into NEON chunks (9708c1d)
• auth: add aarch64 K2 ML-KEM row-dot path (e28eaee)
• hashes: use paired SHA3 fallback for aarch64 quad Keccak (d712967)
• crypto: add aarch64 triple SHAKE path for ML-KEM sampling (2f00fa7)
• auth: feed fused ML-KEM products from compact aarch64 rejection (a05a23b)
• auth: compact aarch64 ML-KEM rejection lanes (13a50c8)
• auth: add aarch64 ML-KEM rejection parser (951be2c)
• Revert "hashes: route aarch64 Keccak x4 through SHA3 pairs" (7e81d7f)
• auth: keep aarch64 ML-KEM sample candidates in registers (5a94fbe)
• auth: parse aarch64 ML-KEM sample tails from XOF state (75b1551)
• hashes: schedule Linux aarch64 ML-KEM batching (9c6ecb9)
• hashes: add Linux aarch64 SVE2-SHA3 Keccak x4 (315cc93)
• auth: parse aarch64 ML-KEM quad samples from XOF state (56e234a)
• auth: add aarch64 ML-KEM SampleNTT NEON extractor (c7c2d89)
• auth: fuse aarch64 ML-KEM K-way accumulate (95ea2e5)
• auth: tighten aarch64 ML-KEM product-domain reduction (bf5bfe5)
• auth: vectorize aarch64 ML-KEM product-domain conversion (c665306)
• auth: fix aarch64 ML-KEM NTT canonicalization (1e41083)
• auth: dispatch Linux aarch64 ML-KEM NTT asm (67cee6d)
• auth: add fused aarch64 ML-KEM basemul diagnostics (67caab7)
• auth: vectorize s390x ML-KEM product-domain conversion (6453f04)
• auth: batch s390x ML-KEM dot products under CT roots (4b8f7f4)
• auth: prove s390x ML-KEM vector kernels in CT artifacts (26f80ac)
• auth: add s390x z/Vector ML-KEM NTT kernels (39cfe62)
• auth: use materialized ML-KEM matrix path on s390x (420517b)
• auth: fix s390x ML-KEM barrier build mode (75e7d0a)
• auth: harden s390x ML-KEM constant-time arithmetic (446e3d4)

0.5.0 - 2026-06-14

📝 Documentation

• prepare public docs for v0.5.0 release (1ba0795)

📦 Other Changes

• auth: fix RSA-2048 leakage fixture policy (c8f6886)
• crypto: harden secret handling and CT validation paths ci: scope CT evidence to required primitives and repair macOS RSA fixtures docs: align migration guidance with hardened verification defaults bench: refresh crypto benches for typed APIs checksum: clarify CRC64 reference constants workspace: align feature metadata and lockfiles for CT tooling (30ddfb6)

0.4.1 - 2026-06-13

📝 Documentation

• make public docs user-facing and add ECDSA migration guides benchmarks: refresh 2026-06-12 benchmark evidence (4a3f4e8)

📦 Other Changes

• auth: route RSA blinding inverse through fixed scratch (a33fc67)
• auth: route macOS aarch64 HKDF-SHA256 through SHA2 compression hashes: batch Apple SHA3 Keccak absorb blocks bench: scale README perf chart axis from benchmark data benchmarks: refresh 2026-06-12 benchmark evidence (f9ab35f)
• auth: harden HMAC pads against AArch64 SVE division ci: disable native RISC-V Rust cache restore (62be628)
• auth: harden ECDSA P-256/P-384 CT backends ci: add ECDSA DudeCT diagnostics and target-scoped CT policy (82db892)
• auth: add ECDSA P-256/P-384 signing and CT coverage (f24375d)

0.4.0 - 2026-06-09

🏗️ Build

• add light and full push preflight commands ci: harden BINSEC solver setup and CT diagnostics (5a8c2eb)

👷 CI

• load BINSEC proof relocation sections (6421da9)
• build BINSEC proof harnesses as non-PIE (783eac4)
• preinstall BINSEC solver system packages (df71e54)
• harden manual CT DudeCT filters (55ca702)
• add s390x AES AEAD DudeCT trace cases (53812a5)
• add AES-GCM-SIV DudeCT trace cases (5e6a24f)
• add DudeCT filters for targeted CT runs (fcc326e)
• scope RSA CT evidence and pass BINSEC SMT timeout auth: harden RSA modular import fixed-width output (c93dc79)

📦 Other Changes

• workspace: refresh release package metadata, ignore rules, and lockfile pins ci: bump action pins and harden check, coverage, and fuzz scripts docs: align release docs, CT policy, examples, and module snippets with 0.4.0 benchmarks: refresh 2026-06-09 overview and README perf chart (147c747)
• aead: align aegis256 AES helper cfgs on POWER and s390x ci: repair CT asm heuristic parsing and RISC-V BINSEC policy docs: narrow RISC-V CT evidence claims (7dbf097)
• crypto: harden asm dispatch and backend equivalence gates (643dd44)
• aead: batch s390x AES-GCM-SIV CTR keystream blocks ci: route AES AEAD CT evidence through secret-only probes (e9676b7)
• hashes: fix Blake2b diag multiblock oracle (053c810)
• auth: clear CT helper slice lints hashes: clear Blake2b diagnostic slice lints (32f0e12)
• auth: align RSA keygen with FIPS 186-5 A.1.3 (5ceb703)

0.3.1 - 2026-06-01

📦 Other Changes

• workspace: enable cargo-rail release publishing (bb7ec88)
• bench: add Ascon coverage and refresh HMAC measurement shape (b06b946)

0.3.0 - 2026-05-28

🏗️ Build

• allow dev-only RustCrypto rsa audit oracle (ea83045)

👷 CI

• focus Miri on UB-risk coverage (c358b72)
• harden weekly validation timeouts and SHA3 fuzz build (0705bfd)
• scope workflow cancellation and widen native lane timeouts (26845c8)
• ignore dev-only rsa audit advisory and refresh action pins workspace: refresh dependency lockfile (9ea0db1)

📦 Other Changes

• auth: drop brittle RSA scratch allocation setup count (ee4c7fb)
• workspace: refresh RSA package metadata and docs benchmarks: refresh 2026-05-27 Linux scorecard bench: add RSA scorecard row to README chart auth: clear RSA public clippy lints (e65cb1c)
• auth: clear RSA portable-only clippy lints (cc12c7c)
• auth: defer RSA public Montgomery precompute and widen 8192-bit verify backends (3b2a991)
• auth: complete RSA private ops, protocols, and assembly backends (218d15c)
• workspace: allow dev-only RustCrypto rsa advisory oracle (8a7d608)
• auth: add RSA verifier, vectors, fuzzing, and Ed25519 assembly backends bench: add RSA verification benchmarks and fixtures workspace: wire RSA dependencies and tracked fuzz corpora (a3d1e79)
• workspace: refresh README release snippets and local asset ignores (1d838fe)
• workspace: fix fuzz support path dependency and refresh locks ci: refresh weekly action pins (a906007)

0.2.0 - 2026-05-17

📦 Other Changes

• benchmarks: refresh 2026-05-17 release scorecard (3a3a479)
• aead: fuse POWER AES-GCM CTR and GHASH paths hashes: route x86 SHA-256 native streaming before compile-time kernels bench: reuse HMAC state in SHA-384 and SHA-512 benches build: parameterize Linux dev machine just aliases (1c30a68)
• bench: cfg-gate aead kernel bench by arch (2cc1000)
• benchmarks: refresh overview and harden chart parsing (36b252b)
• aead: extend aarch64 AEAD assembly to Linux auth: add s2n-bignum X25519 assembly backends hashes: remove AES hash primitive from fast hashes bench: drop gxhash competitor benches and fix X25519 aws-lc output benchmarks: refresh benchmark overview after full extraction workspace: drop AES-hash feature and competitor deps (59b2b37)
• aead: fuse aarch64 ChaCha20-Poly1305 and batch Poly1305 NEON (7609841)
• aead: fuse x86 AES-GCM assembly with vector counters (56f75c5)
• aead: add AArch64 and x86-64 AES-GCM assembly kernels benchmarks: refresh AES-GCM status (11ebc4a)
• crypto: drop s390x target-feature inline hints (ff3060e)
• aead: drop aarch64 AES-GCM scheduling barrier (4702023)
• aead: format aarch64 AES-GCM chunk helpers (31339f2)
• aead: batch AES-GCM and GCM-SIV arch kernels (2088e3f)
• bench: fix AEAD required feature gate build: restore s390x inline target-feature gate (48c75d6)
• aead: route AES-GCM through backend-wide GHASH and s390x CTR batching workspace: gate examples and benches by required features ci: include AES-128 GCM benches in CI selectors benchmarks: refresh benchmark overview for expanded AEAD coverage (16983ef)
• workspace: gate gxhash dev-dependency on AES SIMD targets bench: skip gxhash competitor rows on unsupported targets (dc3cf94)
• aead: ship AES-128-GCM and AES-128-GCM-SIV with full SIMD kernel coverage hashes: add Blake3KeyedHash type with constant-time equality bench: add aws-lc-rs, ring, dryoc, gxhash, ahash, and foldhash competitor rows workspace: wire competitor dev-deps, ungate internal hex module, refresh docs (0a39948)
• workspace: sharpen adoption docs and publish migration guides (30f9846)

0.1.1 - 2026-05-02

🏗️ Build

• trim tests/testdata/benches from published crate include list docs: fix README quick start imports and add Xxh3 FastHash trait workspace: wire README into doctest harness via ReadmeDoctests hook (f16a44f)

0.1.0 - 2026-05-02

🐛 Bug Fixes

• cicd issues around Blake3 kernel selection and unused s390x gating (621e80b)
• AESE for subword during key expansion (09f2ace)
• removing the dead code 'square_wide' in favor the the 'square_and_negate_d_wide'. (8f4dc6c)
• removing the dead code around IFMA cleanup (04c3c41)
• auth: reduce before second mul in AVX2 double — vpmuludq ×19 overflow (bda61b6)
• auth: revert AVX2 verify dispatch — AVX2 Straus has a latent bug (af32c11)
• auth: remove broken IFMA field arithmetic — vpmadd52luq truncates products to 52 bits (4880a42)
• aead: emit raw VCIPH bytes on s390x — LLVM lacks the mnemonic and .insn vrr ignores %v operands (f161381)
• s390x accel: vciph {out}, {block}, {rk} with vreg register class (81f5125)
• aead: pin AEGIS-256 s390x VCIPH registers to V0-V2 (4b15ae5)
• wrap x86_64 intrinsic bodies in unsafe blocks (3c8602c)
• gate platform-specific test helpers to silence warnings on s390x/power aead: add aes-256-gcm-siv with portable constant-time aes and polyval (7d4ef59)
• strict_* arithmetic across checksum module (a11c7cd)
• add #[cfg_attr(miri, ignore)] to hashes prefetch inline-asm tests (824c2c2)
• gate bench streaming_dispatch_info behind parallel feature (e10f9b1)
• IBM runner clippy lint fix (fe78b48)
• tuning workflow, shape (03ed73e)
• tuning workflow (3230e85)
• ci - rustfmt fix (660a8af)
• checksum: add missing extern crate imports in crc32 x86_64 tests (08dc6e4)
• platform/backend: refactor platform && add backend; fix UB in no_std dispatcher (dbf2e3b)
• checksum: align x86_64 SIMD CRC implementations with ARM approach (a088d2d)

🏗️ Build

• pin nightly-2026-04-18; raise MSRV to 1.95.0 and trim stale nightly gates checksum: use cold_path for tiny CRC oneshots (def943a)

👷 CI

• drop coverage smoke and capture fuzz workspace coverage via per-invocation cargo-llvm-cov build: trim rail.toml comments (89b2c72)
• anchor pre-push hook on repository root (1290bb1)
• harden action upgrades, pre-push checks, and fuzz coverage build: route just update through action refs and fuzz manifests (f382065)
• restore all weekly fuzz corpora for total Codecov coverage (483906e)
• upload total llvm-cov coverage and widen weekly timeouts workspace: make fuzz targets replayable under llvm-cov checksum: skip CRC32 VPCLMUL tests under Miri (fb8b926)
• harden weekly validation and scoped fuzz coverage (cb06972)
• harden weekly validation and scoped fuzz coverage (101da93)
• keep native quality lanes on the shipped library surface (c8cdce5)
• constrain riscv64 runner concurrency and skip rustdoc (0fedbdf)
• bump cargo-rail to 0.13.0; adopt unknown file policy; update docs perf: batch riscv AES CTR, restore blake3 small-XOF path, and retune aarch64 sha256 checksum: split CRC oneshots into inline-always fast path + cold dispatch (6b61463)
• surface real feature-matrix compile errors (f2c2b50)
• adopt cargo-rail 0.11 scope-driven planner flow (face19d)
• remove redundant unsafe blocks across all SIMD modules, fix ppc64 doc comment and s390x dead code hashes: split blake3 control modules and cut non-kernel update overhead checksums: improve the usage of the 'strict_*' for all algys (06ced8f)
• fix blake3 selector planning for comp/kernels bench scopes (3ee8585)
• block unscoped hashes/comp bench runs and selector fallback (3cbfa0c)
• installing the weekly.yaml toolchains and tools (miri/cargo fuzz) (85524dd)

📝 Documentation

• rewrite release.md with full test/security inventory and focused v0.1.0 plan (6850028)

📦 Other Changes

• workspace: isolate fuzz replay from release package build: report fuzz coverage from replay manifests (46cff74)
• checksum: gate aarch64 PMULL EOR3 tables out of Miri (7d50e3b)
• workspace: satisfy fuzz support dependency audit (d9593fb)
• workspace: gate fuzz replay tests and forward AEAD support (268860c)
• auth: skip AVX-512 IFMA tests under Miri ci: preserve fuzz coverage profiles and skip empty fuzz Codecov uploads (347693d)
• workspace: prepare release metadata and split README reference docs build: harden coverage reports and refresh local validation lanes auth: adapt scrypt oracle params and simplify curve25519 square roots hashes: remove dead Ascon dispatch adapter bench: align password hashing bench with scrypt 0.12 benchmarks: prune stale raw runs and refresh overview ci: refresh pinned action SHAs (d7f65e6)
• hashes: format Keccak platform cfg (dff5817)
• aead: tighten leaf-feature cfgs for target-policy helpers auth: skip Argon2 oracle scaffolding under Miri hashes: route Keccak Miri builds through the portable permuter workspace: fix introspect features and refresh release docs benchmarks: refresh 2026-04-28 Linux CI overview (76b243d)
• crypto: split secret serde and enforce checked bit-length framing aead: narrow dispatch introspection and drop riscv64 AEGIS table fallback auth: return PHC entropy failures from random-salt hashing checksum: document riscv64 CRC unsafe blocks hashes: fast-path RapidHash empty input and inline Blake2 one-shots workspace: refresh docs, examples, and feature-matrix coverage benchmarks: refresh overview from 2026-04-28 Linux CI (0ea1b73)
• hashes: elide public Blake2 wipes and preserve keyed cleanup bench: remove Blake2 forced-kernel diagnostic benches ci: fix generic bench-quick and keep Blake2 benches off diag benchmarks: refresh overview from 2026-04-28 results (90043b7)
• hashes: split Blake2b counters and prune stale XXH3 diagnostics (f1a6e96)
• hashes: harden Blake2 zeroization and add fast-hash diagnostics bench: add CRC, SHA2, AUTH, and XXH3 diagnostic probes ci: enable diag features for SHA2, AUTH, and XXH3 benches benchmarks: refresh release benchmark overview (0da9bca)
• aead: add x86 ChaCha20 SSSE3 path and tighten AES-GCM fast paths hashes: batch Blake2 compression and tune fast-hash dispatch benchmarks: refresh 2026-04-26 CI overview (e65388d)
• aead: fix AEGIS aead-only cfg on s390x and riscv64 hashes: clear POWER RapidHash clippy lint (0047046)
• aead: add riscv64 fixslice AES fallback and tighten GCM tag path hashes: use referenced RapidHash v3 secrets on s390x and POWER benchmarks: refresh overview from 2026-04-26 CI and macOS benches (6703515)
• workspace: gate riscv64 blake3 portable SIMD feature (f5c6ff7)
• Update mod.rs (65a3c32)
• aead: retune AEGIS and AES-GCM dispatch across target backends hashes: fast-path RapidHash defaults and medium inputs auth: add random-salt PHC helpers and verification policy docs bench: gate RISC-V Blake2 diagnostics and refresh bench scripts benchmarks: refresh overview from latest CI and macOS benches workspace: clean public docs, examples, package include, and security guidance (e24d79a)
• hashes: mark losing Blake2 kernels diagnostic-only (7d2d811)
• hashes: gate losing Blake2 SIMD and add riscv64 diagnostics crypto: clear feature-gated CT and dispatch warning paths bench: add Blake2 forced-kernel comparisons ci: include Blake2 forced-kernel diagnostics workspace: narrow stale RISC-V nightly gates (b62a082)
• hashes: fix AVX-512 Blake2 compile-time dispatch ci: make CPU diagnostics pipefail-safe (70989b0)
• auth: add Argon2 family, scrypt, and PHC string format hashes: tune sha256, blake3, keccak, sha3, sha384/512, and xxh3 dispatch aead: harden chacha20 ppc64 VSX and AEAD nonce counter bench: add kmac/cshake and password-hashing benches ci: consolidate workflows and drop runson/warpbuild adapters workspace: bump deps and surface Argon2, scrypt, and PHC on the root build: refresh justfile and cargo lanes for the new test layout (2a76963)
• hashes: fix POWER sha256 correctness and ascon cfg linting (a70c659)
• hashes: restore ppc64 sha256 and tighten ascon hot paths (abfbb8f)
• workspace: split crypto backends and harden validation (1a0bf2d)
• auth: fix pbkdf2 oracle digest-version mismatch (7792145)
• checksum: keep riscv64 crc64 auto portable and drop stale riscv gates workspace: bump rayon, getrandom, and pbkdf2 deps (07a38d0)
• clippy (98eb8df)
• auth: use fixed-base Edwards path for x25519 public keys (84674be)
• blake3: byte-pack short root output and refresh benchmark overview (e8c4b66)
• hashes: fast-path one-block blake3 xof reads checksum: retune 64B dispatch thresholds on riscv64, s390x, and power10 aead: cache riscv64 aes-256-gcm-siv master key expansion bench: normalize extracted CI results and refresh overview (70856ea)
• aead: batch riscv64 vperm AES ECB blocks checksum: widen riscv64 crc64 zbc folding to 8-way hashes: fast-path xxh3-64 empty input (21a84f1)
• benchmarks: 2026-04-18 CI results, regenerate OVERVIEW, add BENCHMARKS.md (a165fd9)
• hashes/aead: fix s390x/ppc64le rotate direction bug in Blake2s and ChaCha20 (d873e91)
• hashes: clear Blake2 params clippy lints (b56684d)
• clippy (7572ff7)
• hashes: align Blake2 API, add params block, tune Blake2s NEON ror8 (3e1ea72)
• hashes: fix s390x Blake2b diagonal lane permutation (d4de4ee)
• hashes: restore ppc64le Blake2 POWER kernels ci: upgrade cargo-rail to 0.12.0 and cargo-rail-action to v4.1.1 (ab17790)
• hashes: disable ppc64le Blake2 VSX and fix s390x test unsafe (5bc3d90)
• clippy (6642a7c)
• crypto: harden Blake2/PBKDF2 and tighten AEAD fast paths (e4b7ff6)
• hashes: complete Blake2 backends and harden PBKDF2 quality gates (2453e09)
• fix AEAD/BLAKE2 warnings and cross-target unsafe lints (106b35e)
• pbkdf fix (a807fdc)
• clippy (fdf620e)
• auth: add PBKDF2-HMAC-SHA256/SHA512 with precomputed prefix states, direct compress loops, and constant-time verify APIs aead: add Hamburg vperm AES backends for s390x and riscv64 V, route AEGIS-256 and AES-256-GCM-SIV through the new RISC-V backend tier, and tighten fallback security notes hashes: add Blake2b/Blake2s implementations with portable + multi-arch kernel dispatch; optimize Blake3 XOF/oneshot block paths; reorder aarch64 SHA-256 schedule batching; bypass RVV xxh3 long-path dispatch overhead on riscv64 workspace: add blake2 dependency, wire pbkdf2/blake2b/blake2s features into bundles, and re-export new auth/hash types (4e24772)
• auth: zeroize HMAC on Drop, black_box ct barriers in KMAC/X25519, fix HKDF-SHA256 zeroize scope hashes: remove ppc64 stubs and superseded SHA-512 kernel variants, prune id_from_name, constant_time_eq in Blake3 key cache aead: add wrong-nonce/buffer-zeroed/wrong-AAD oracle tests, separate AES-128 dispatch ci: riscv64 check-only feature matrix, coverage merge summary workspace: rewrite README, self-contained trait doc examples, add serde + getrandom smoke tests (722b99f)
• api: harden key/tag security contracts, close no_std feature-matrix gaps, add oracle tests and trait docs (2c1f7c0)
• bench: infra, results, scripts, workflow, docs reorganization api: add ConstantTimeEq, to_vec, Read, BuildHasher; also optional getrandom, serde deps (1744581)
• fuzz: align scoped harnesses with the feature model (9a054b0)
• aead: fix cross-arch test import warnings (b240ab7)
• clippy (3abe206)
• clippy (6067e26)
• workspace: harden feature graph and release contracts via refining the feature selection into real leaf and bundle boundaries, split shared Curve25519 internals so x25519 stands alone, tighten checksum leaf builds, and add public API/error contract coverage. (0d4afb2)
• aead: remove inline(always) from target_feature helpers (251ae70)
• checksum: add real riscv crc ladders and split crc64 strategy hashes: blake3 fast-path short xof first-block emission aead: enforce riscv backend ladder for aes-gcm-siv (57059da)
• revert xxh3 riscv work (e810843)
• riscv: fuse XXH3 RVV stripe loop and demote CRC64 Zbc to portable (5e5da61)
• riscv: add XXH3 RVV kernel and retune CRC/AEAD dispatch thresholds (9e4ca10)
• riscv: add scalar crypto backends and enable full target validation (b6f0b27)
• lib: expose std in test builds for no_std feature-matrix lanes (bc71974)
• auth: qualify ISA detection macros and silence reduced-feature Ascon warnings (412a511)
• hashes: allow dead code for Ascon x86 batch kernels in no_std builds (d6aedaf)
• workspace: add fuzzing infrastructure and close auth performance gaps (a2d544f)
• sha256, hmac, xxh3: eliminate dispatch overhead at near-boundary sizes (ce78300)
• hkdf: raw-state expand loop to eliminate per-iteration Sha256 overhead hmac-sha256: merge compress calls and batch zeroization for small inputs docs: bench updates for Blake3 small/keyed and the (b4cf488)
• aegis256: VEX-encode x86 AES rounds and widen all HW loops to 4-block (2cfa192)
• blake3: use avx-512 compress for all x86 size classes on avx-512 cpus (2b8f600)
• blake3: use assembly compress for all x86 oneshot blocks (0da76b4)
• sha2: align kernel coverage with reachable dispatch backends (fb571ed)
• sha2: restrict kernel tests to runtime-reachable backends (342141b)
• sha2: fix truncated sha512 x86 dispatch and restore kernel coverage (602efeb)
• blake3: fix x86 XOF root-output crash and restore kernel coverage (c24b255)
• ci,auth,aead: remove namespace setup and fix cross-target validation (a801469)
• auth,hashes: tighten Ed25519 verify and speed up Ascon hash/xof (e6c36cb)
• cicd: fixing the cargo-rail interaction to trigger full builds on main (2790f5a)
• ascon: eliminate dispatch indirection and unroll permutation (7fecdee)
• bench: fixing the formatting; adding crc16-ibm and aegis workspace: bumping competitors to latest versions; adding ASCON competitor; fixing APIs for hmac/hkdf updated deps (b85cc4b)
• auth/ed25519: switch x86 AVX2 verify fallback to wNAF Straus (8a8d894)
• auth: reduce ed25519 verify and hkdf expand x86 overhead (f05b393)
• benches: cleaning up (44905e4)
• cicd: fixing the cicd failures (129b0b5)
• clippy (c6c2f96)
• clippy fix (d21aad8)
• clippy (3ea14ff)
• diagnostics for the IBM 390x accel (8d11a36)
• aead: fix AEGIS-256 s390x byte order (swap i64x2 doubleword halves) (69f16a7)
• aead: fix AEGIS-256 s390x VCIPH by pinning registers to V0-V15 (00e3f5b)
• clippy (315b66b)
• clippy (e5b7ae0)
• aead: fix AEGIS-256 s390x SIGSEGV (i64x2 vreg); keccak: aarch64 SHA3-CE single-state kernel (7aa5a9a)
• aead: hardware acceleration for AEGIS-256 on s390x/ppc64; optimize XChaCha20 + GCM-SIV small sizes (81b8ac5)
• aead: fix POWER8 AES register encoding for VSX instructions (d259d6a)
• aead: fix powerpc64le AES/POLYVAL endian handling (88ac4c3)
• docs (ab7280c)
• docs (16612ae)
• aead: hardware AES + CLMUL on s390x, powerpc64, riscv64; Apple M5 detection (05e3a3e)
• clippy/rustfmt (a41a620)
• aead: AEGIS-256 with AES-NI/AES-CE; ChaCha20 x86 SIMD transpose + vprold/vpshufb (15e89d5)
• aead: add Ascon-128 AEAD, VAES-512/VPCLMULQDQ wide paths, and POWER/s390x SIMD backends (a43fa65)
• clippy (e6476d9)
• clippy/unsafe comments (f5ee551)
• clippy (5b55ed6)
• aead: add aes-256-gcm with ghash; ed25519: optimize field arithmetic (8d4b65c)
• core: add chacha20-poly1305, cshake256, kmac256, ascon-cxof128; harden ed25519 (481cf8a)
• core: remove dead dispatch and bench scaffolding from production paths (e14540f)
• hashes: xxh3: fix register pressure — remove empty early-return, align mix32_b with xxhash-rust (75e7337)
• hashes: fused absorb-permute for Keccak — eliminate aarch64 write-then-reload round-trip (5953ebf)
• docs + cleanup: update XXH3 bench data (37L→23L), gate arch-specific dead code (e93491c)
• hashes: XXH3 flat dispatch + compile-time SIMD — eliminate branch/indirect-call overhead (9fe0cba)
• cleanup: remove dead code, redundant extern crate alloc, unused prefetch variants (3ba7578)
• hashes: XXH3 0B fast-return + SHA-3 sponge absorb bypass (4cc2228)
• clippy (3f88c3e)
• hashes: XXH3 NEON accumulate — vuzpq deinterleave, broken dep chain, stripe prefetch (961330d)
• auth: HMAC-SHA256 oneshot bypass — direct state + single dispatch resolve (f2dc11e)
• clippy (6bc5e60)
• checksum: CRC32/CRC32C aarch64 3-tier dispatch — EOR3 kernel for large buffers, hardware CRC for small (cda6a87)
• clippy (e83cfba)
• clippy (5c04df1)
• hashes: add RapidHashFast64/128, fix benchmark, optimize codegen (no-avalanche variants) (eeb8f64)
• cicd: wiring the auth bench flow (8024f9c)
• auth: add HMAC-SHA256, HKDF-SHA256, and Ed25519 + benches hashes: tune SHA-512 x86 dispatch for Zen 5 and add std-round kernels docs: add auth, aead, pqe-pqc, and release roadmaps (eb7fb87)
• hashes: xxh3 IBM POWER10 fix (0b82f15)
• xxh3: SIMD kernels for NEON, AVX2, AVX-512, POWER VSX, and s390x z/Vector (3781e87)
• checksum: override Checksum::checksum() to bypass hasher construction (4e9d67b)
• keccak: cfg-gate portable permutation by register file width (1822dd6)
• keccak: rewrite portable permutation with array-based state access (4dce302)
• sha512: stitched dual-block kernels with zero portable fallback (da307b4)
• cicd: fixing avx2 compilation issue (dc81286)
• sha512: prefer AVX2 over AVX-512VL on all x86-64 vendors (627dc00)
• sha512: rewrite AVX2 kernel with stitched dual-block architecture (5d966a2)
• workspace: clearing out old scripts that are dead checksums: lower bytewise fast-path threshold from 64 B to 7 B (da6797f)
• checksums: inline bytewise fast-path for inputs ≤ 64 B (22cd7b7)
• rscrypto: simplify public API and make dispatch introspection size-explicit (14bdbce)
• IBM s390x (ba41ca5)
• fixing clippy & cicd (0f47c9c)
• checksums: fixing the cicd issues (0b6521a)
• checksums: fixing the cicd issues on tests (bb2ee15)
• workspace: harden release gates and unify blake3 admission (a9de1e6)
• hashes: oneshot SHA-3 fast-path + scalar SHA3 CE kernel; blake3: fix XOF clippy three XOF small-output perf fix (da1fb95)
• Clippy (b32e60e)
• hashes: use portable kernel for single-state keccak on aarch64 (7e117b1)
• hashes: add raw keccakf1600 isolation bench for sponge overhead diagnosis (250a73f)
• clippy (42f4129)
• hashes: replace keccak dispatch with direct-call permuters (950698a)
• ascon: add true batched SIMD hash/xof paths (8571219)
• hashes: add SHA-256 s390x KIMD and ppc64 vshasigmaw kernels; rewrite bench suite; convert keccakf_portable from full unroll to loop (47b0bc6)
• hashes: general code efficiency (21f6cba)
• hashes: remove blake3 special-case short-xof prefix path hashes: add s390x KIMD absorb kernel, 2-state interleaved aarch64 SHA3 CE kernel, and Sha3_256::digest_pair (3e023b4)
• hashes: add x86_64 AVX-512 Keccak-f[1600] kernel; add native blake3 root-output emitters across non-x86 backends (494ebd0)
• hashes: narrow blake3 xof emit retuning to large outputs (b373504)
• hashes: decouple blake3 xof emission from streaming kernel choice (c4d8701)
• checksums: fixing the POWER10 runner issue in CICD (a13b9d7)
• checksum: remove redundant inner unsafe blocks from CRC-16 and CRC-24 x86_64 SIMD modules (ffd128a)
• checksum: remove redundant inner unsafe blocks from CRC-16 and CRC-24 x86_64 SIMD modules (662fcfb)
• checksum: add missing unsafe_op_in_unsafe_fn allow to x86_64 and power SIMD modules (6d39f4b)
• hashes: SHA-512 family peak hardware dispatch — AMD vendor-aware, s390x KIMD, ppc64 vshasigmad hashes: fixing Blake3 regressions on 4096B perf checksums: clean up (724e93d)
• hashes: wire SHA-512 family per-kernel benchmarks and SHA-384/SHA-512-256 streaming (389b6ae)
• hashes: perf: cascade AVX-512 sub-degree hash_many tail to SSE4.1 for ≤4 chunks - blake3 hashes: unify SHA-512 family compression; add aarch64 FEAT_SHA512 hardware kernel (de1fbb0)
• hashes: fix the little-endian gat for the subtree_cv on IBM runners (154032f)
• Clippy (2230eff)
• hashes: wired sha224/256 wasm/risc-v; upgraded the blake3 XOF to improve streaming perf (c10739b)
• benches: fixing the run-bench.sh script to fire w/ the 'parallel' feature for clean bench comparisons docs: update readme.md (1f6aa14)
• clippy (1b2bf2c)
• cicd: replace Python CI scripts with shell+jq (9b16f36)
• cicd: fixing the wasm runner/smoke (2fd31c6)
• clippy fixes (8e7f6d5)
• clippy fixes (04a853c)
• rscrypto: Bump MSRV to 1.94 and add Debug impls (8e5d481)
• flatten: merge workspace into single publishable crate (f54f983)
• hashes: tighten blake3 one-chunk prefix compression workspace: update gitignore (23e6fc8)
• Update mod.rs (5df7450)
• hashes: tighten blake3 short-chunk and large-input admission (8f22f83)
• checksum,hashes: restore runtime dispatch caps and wire blake3 exact-chunk aarch64 path (e1884a9)
• hashes: tighten blake3 little-endian word loads (fe4cb88)
• hashes: simplify exact blake3 chunk update paths (a93cd32)
• hashes: update exact blake3 x86 chunk prefix in place (fa4fb5b)
• hashes: narrow blake3 update hot path back to frontier-only fast case (8281724)
• hashes: split blake3 digest update slow path from hot short path (afaadd0)
• hashes: keep short blake3 streaming updates in chunk state (7c82edc)
• hashes: revert blake3 exact-chunk start-flag loop reshaping (541f1b8)
• hashes: remove per-block start-flag branching from exact blake3 updates checksum,hashes: replace stale dead_code suppressions with cfgs (89eb909)
• hashes: remove tuple return from blake3 exact-chunk x86 helper workspace: remove tune workflow and flatten hash facade (a03f378)
• hashes: add upstream-shaped portable exact-chunk blake3 update path platform: cleaning up (f236375)
• hashes: remove redundant blake3 stream kernel and flags state (0b5513d)
• tune: replace TuneKind with explicit blake3 profiles and drop dead generators hashes: split blake3 empty-frontier update from short hot path (a491791)
• platform,tune: remove platform::tune from runtime architecture hashes: add direct exact-chunk blake3 chunk-state update path (93f0b51)
• platform,tune: remove runtime tune from detection and dispatch hashes: keep blake3 exact-chunk streaming fast path x86-only (2a86f4b)
• hashes: restore simple aarch64 exact-chunk blake3 update policy workspace: fixing the facade (7530777)
• hashes: write blake3 exact-chunk state directly into chunk state (715da43)
• hashes: split blake3 chunk update hot path from general path (8bc8349)
• hashes: narrow blake3 aarch64 exact-chunk streaming update path (dab5e66)
• hashes: make blake3 aarch64 exact-chunk asm path input-alignment agnostic (6b3d5d9)
• hashes: cache blake3 stream kernel id for hasher construction (d676420)
• hashes: remove blake3 per-hasher dispatch snapshot (def58c8)
• hashes: simplify blake3 aarch64 exact-chunk update path (eb9cf4a)
• hashes: collapse blake3 exact-chunk update dispatch to one match (0136b52)
• hashes: make blake3 aarch64 exact-chunk asm path output-alignment agnostic (07d527d)
• hashes: restore correct neon exact-chunk blake3 update path (2fe90ab)
• hashes: align exact-chunk blake3 update with upstream compressor policy (d15569a)
• hashes: remove blake3 exact-chunk streaming detour (4bf5f58)
• hashes: store blake3 streaming kernels as ids in hasher state (2f17f3f)
• hashes: narrow blake3 exact-chunk xof update hot path (53f18c8)
• hashes: use size-class kernel for exact one-chunk blake3 xof updates (a9131b4)
• hashes: split blake3 xof short-root finalize from slow merge path (27eb0c2)
• hashes: cleaning up the unnecessary hashes covered either by the Rust std lib or too niche/superseded to matter (53d1b8f)
• clippy fixes; adding some kind of order to the hashes dev plan (b1c13ad)
• hashes: tighten blake3 xof short-root state and finalize path (5accb4c)
• hashes: fix blake3 BP root emitter cross-target gating (c0a783f)
• hashes: add dedicated blake3 root emitter xof path (fa0f792)
• hashes: revert blake3 streaming-only frontier and record rejection (6bf1013)
• hashes: extend blake3 short-update frontier across chunk rollover (988d4f5)
• hashes: revert blake3 frontier follow-up and record rejection (8f979bb)
• hashes: extend blake3 frontier mode across short streaming and xof setup (39de4b5)
• hashes: add blake3 frontier mode for short streaming and xof (5f80d1a)
• hashes: record blake3 lazy tree sidecar rejection (b79d5b5)
• hashes: record blake3 serial-ops snapshot rejection (13700dd)
• hashes: split blake3 serial short-update hot path from cold control flow (b6bae5c)
• hashes: split blake3 serial short-update hot path from cold control flow (4ae6bc3)
• hashes: rewrite blake3 serial streaming and xof core - reversion commit (74a6245)
• hashes: rewrite blake3 serial streaming and xof core (675f96a)
• hashes: revert blake3 serial xof rewrite and simplify failure map (13e5e77)
• hashes: rewrite blake3 serial xof setup path and add repeated-update diagnostics (d5374db)
• hashes: revert blake3 setup-state and bulk-dispatch candidate (be10196)
• hashes: shrink blake3 setup state and localize bulk dispatch (04ab0e8)
• hashes: revert blake3 hot-state and single-chunk xof candidate (05f3517)
• hashes: shrink blake3 hot state and fast-path single-chunk xof (1e5778d)
• hashes: revert blake3 compact xof reader experiment (26afe13)
• hashes: Document Blake3 candidate BA and reject checksum: fix crc64 aarch64 aes feature contracts (ea0734c)
• hashes: revert blake3 short-read and in-chunk streaming candidate && bumping latest toolchain (d9d7051)
• hashes: fix blake3 xof helper unsafe block documentation (ab1bf11)
• hashes: tighten blake3 xof short reads and in-chunk streaming updates (539d0de)
• hashes: refactor blake3 parallel batch API and fix bench clippy (dde901a)
• hashes: slim blake3 hasher state and localize parallel scratch buffers (3a5438b)
• hashes: record AZ bench results and reject candidate (df9138b)
• Revert "hashes: keep aligned blake3 pending subtrees and fast-path single-block" (f2a2cb6)
• Revert "hashes: reduce blake3 constructor dispatch overhead with shared hasher" (3b5f51d)
• hashes: split blake3 xof-phase into new finalize and drop costs (c5d3171)
• Revert "hashes: trim blake3 update/root-output fixed overhead on streaming+xof" (0b2345b)
• hashes: add phase-split blake3 xof benchmarks for update finalize and squeeze (d5d9198)
• hashes: revert AX intel avx2 stream policy and record regression (5982369)
• hashes: set blake3 intel spr/icl stream kernel to avx2 (6ba2b95)
• hashes: revert AW xof first-read fast path and record run results (2a63390)
• hashes: optimize blake3 xof short first-read squeeze path (4097712)
• hashes: revert AV pending_chunk_cv removal and record bench regression (6b9285c)
• hashes: revert blake3 candidate AU runtime-path simplification hashes: simplify blake3 streaming/xof hot path by removing deferred chunk CV (abc1a2f)
• hashes: simplify blake3 streaming/xof runtime paths (6d508e6)
• hashes/blake3: revert candidate AT after run 22645562535 regression (dc522c2)
• hashes/blake3: lock x86 tiny first-update path to stream kernel (eb61536)
• hashes/blake3: revert candidate AS after run 22638507919 regression (0e66733)
• hashes/blake3: retune x86 stream policy and bypass x86 first-update defer (6de31a0)
• hashes/blake3: revert candidate AR after run 22637943751 regression (25c6364)
• hashes/blake3: simplify chunk-state streaming update control path (1107ec6)
• hashes/blake3: revert candidate AQ after run 22636554814 regression (abf3ab8)
• hashes/blake3: add kernel-aware xof first-block root-hash fast path (bf58df9)
• hashes/blake3: revert candidate AP after run 22634499864 regression (cd597ac)
• • hashes: refactor blake3 xof_many helper arity (a780ad1)
• hashes/blake3: split xof single-block vs many-block dispatch and simplify output reader (686773a)
• hashes: revert blake3 xof reader hot-path simplification (d4ffe54)
• hashes: simplify blake3 xof reader hot path and cut short-output overhead (ec296b8)
• hashes/blake3: revert AN and record run 22601614792 xof/streaming regression (661da62)
• hashes/blake3: simplify streaming/xof hot paths and retune x86 stream kernels to avx512 (56485ac)
• hashes/blake3: revert AM linux sse41 asm wiring and record run 22600518259 regression (097edf6)
• hashes/blake3: fix linux sse41 asm data section directive (8885536)
• hashes: wire Linux SSE4.1 asm into blake3 streaming/xof hot paths (5a7df00)
• hashes/blake3: revert AL and record run 22593524598 regression (71d45a1)
• hashes: simplify blake3 xof kernel path and add x86 one-chunk streaming fast path (e7fbaf9)
• hashes/blake3: record AK xof/streaming regression from run 22588630907 (9d32656)
• Revert "hashes/blake3: debranch streaming chunk compression and simplify xof" (b0c088b)
• hashes/blake3: document AJ bench regression and reject via 70e7519 (ea7f2c5)
• Revert "hashes/blake3: use kernel-aware xof root-hash path and retune x86" (70e7519)
• hashes/blake3: record AI regression from run 22559324946 and revert decision (ddf5c5a)
• Revert "hashes: inline blake3 OutputState compress dispatch" (a787d48)
• hashes/blake3: revert AH lazy tiny xof tail-hint path; record 22556963869 regression (800445d)
• hashes/blake3: lazily optimize tiny xof init+read with single-chunk tail hint (03d9943)
• hashes/blake3: revert AG xof cached-root precompute; record 22555765324 regression (26ada2f)
• hashes/blake3: cache single-chunk xof root hash for tiny init+read path (b1f25ea)
• hashes/blake3: revert AF xof/streaming kernel changes; record 22554313539 full loss (427a819)
• hashes: retune blake3 xof finalize path and full-chunk streaming kernel selection (c3eaa72)
• hashes/blake3: revert AE xof/streaming kernel changes; record streaming regression (e3c6960)
• hashes/blake3: lift xof portable finalize path and switch x86 streaming to avx2 (dd8be8e)
• ci/bench: make BENCH_FILTER authoritative over BENCH_ONLY matching (6378a21)
• hashes/blake3: narrow single-chunk xof kernel override to Intel portable states (853fd53)
• ashes/blake3: revert AC single-chunk xof kernel override; record AB/AC rejects (450d782)
• hashes: select size-class kernel for single-chunk finalize_xof (aea12be)
• ashes: revert Blake3Xof lazy scratch-buffer initialization (19bc72b)
• hashes: lazily initialize Blake3Xof scratch buffers (bd61c53)
• hashes/blake3: optimize short streaming/xof paths and retune 64KiB+ parallel admission (b493be1)
• checksum: add aarch64 crc16 pmull+eor3 kernels and wire graviton dispatch (b34a9b9)
• hashes: promote streaming kernel after first full chunk (b160f5a)
• checksum/hashes: remove hot-path overhead in arm crc16 2way and blake3 dispatch accessors (171d60d)
• cicd: fixing the filtering issue for bench.yaml and updating blake3 work (742a11d)
• checksum: revert crc16 aarch64 2-way pointer-walk loop rewrite (aa2979c)
• checksum: optimize aarch64 crc16 PMULL hot loops with pointer-walk folding (8137efe)
• Update dispatch_tables.rs (b6e2065)
• checksum: cache crc16 dispatch/table in hasher state (b43a088)
• checksum: retune zen4 crc64 l dispatch with xz hybrid and nvme 2way (96d25b3)
• checksum,hashes: cache crc64 dispatch in hasher state, retune x86 crc tables, and add s390x short-batch blake3 fallback (2420ac8)
• hashes: revert generic one-chunk compress-inline candidate (8e78bd2)
• hashes: inline generic one-chunk final compress dispatch (99874ad)
• hashes: remove BLAKE3 exact-tree copy-back in oneshot reduction (3e9bac9)
• hashes: trim BLAKE3 oneshot exact-tree overhead for small inputs (5c52746)
• checksum: add graviton3 crc16/ccitt l hybrid dispatch (a94a8e7)
• Revert " checksum: unroll+prefetch aarch64 crc16 pmull 1-way fold loop" (91a8f07)
• checksum: retune graviton crc16 dispatch (g3 ibm hybrid, g4 m/l 2way) (04009ce)
• checksum: split graviton3/4 crc16 l-xl dispatch tables (ee3aeb0)
• checksum: retune graviton crc16 l/xl dispatch to pmull-2way (a5a2c85)
• checksum: retune intel-icl crc32/ieee s dispatch to vpclmul-2way (19a04e1)
• checksum: retune intel crc32 s dispatch (spr 2way, icl 8way) (4eab23c)
• checksum: cache crc32/crc32c auto dispatch table in hasher state (ee5eee4)
• checksum: restore icl crc32 s vpclmul and rework aarch64 crc32 xs/s hot path (db96691)
• checksum: retune intel-icl crc32 s to vpclmul-2way and document focused gap plan (3421e2a)
• checksum: revert intel-icl crc32 s dispatch to vpclmul (362bbce)
• checksum: revert Graviton4 hwcrc xs/s retune and record failed bench (2e6f938)
• checksum: split Graviton4 table and retune crc32/ieee xs/s (b0b9de7)
• Revert "checksum: cache CRC32/CRC32C dispatch in hasher state and mapping" (1c171f1)
• hashes: revert rayon-aware blake3 parallel admission and 1MiB parallel gate (8e070d1)
• hashes: make blake3 parallel admission Rayon-aware and add 1MiB parallel gate (fede7b2)
• hashes: gate avx2 one-chunk hash_many fast path by x86 tune kind (21f9c68)
• hashes: revert global avx2 one-chunk blake3 fast path and record candidate V regressions (42d10e7)
• hashes: add avx2 one-chunk exact-block hash_many fast path for blake3 oneshot (b7c7984)
• hashes: route intel-spr short oneshot to avx512 and add avx512 one-chunk asm hash_many fast path (01f80aa)
• hashes: revert candidate T avx512 short-path and record failed intel bench (f2c61ad)
• hashes: narrow blake3 avx512 short-block fast path to <=4 blocks (77997e4)
• hashes: revert candidate S short-block avx512/neon chunk-compress fast paths (43dbe5c)
• hashes: add blake3 short-block fast paths for avx512 and neon chunk compression (9f4459a)
• hashes: revert power10 dispatch and one-chunk helper devirtualization (086f99b)
• hashes: tune power10 short dispatch and devirtualize blake3 one-chunk x86/aarch64 paths (7c0b8f5)
• hashes: optimize generic BLAKE3 one-chunk path with inline dispatch and zero-copy aligned tails (ae6b775)
• hashes: add shared one-chunk BLAKE3 oneshot fast path and log candidate P results (e28c9b9)
• hashes: enable BLAKE3 vector bulk dispatch for IBM Z and POWER profiles (3a57016)
• hashes: revert noinline oneshot split and lock blake3 perf loop plan (c445215)
• hashes: split blake3 oneshot hot paths into noinline helpers (0b12fe3)
• hashes: keep short blake3 inputs portable on aarch64 server profile (99ce277)
• hashes: reverting the attempt to optimize blake3 clone by copying only initialized cv stack (649e58b)
• hashes: optimize blake3 clone by copying only initialized cv stack (c0d736b)
• Revert "hashes: remove aarch64 one-chunk helper kernel-id dispatch" (c4ae105)
• hashes: split blake3 oneshot fallback into cold helper (1434fa2)
• hashes: stop inlining blake3 root_output_oneshot into digest_oneshot_words (d21f59a)
• hashes: revert blake3 work on boundaries/policy and lock kernel-first perf plan (6bb3279)
• hashes: narrow blake3 plain 1024 first-update override to intel avx512 (84f8f07)
• hashes: add plain-mode x86 short split policy for blake3 oneshot/update (da160b9)
• Revert "hashes: add x86 exact-chunk fast path in blake3 ChunkState update" (c6b36ed)
• Revert "hashes: add block-aligned single-chunk fast path for blake3 short" (5b7497e)
• hashes: revert blake3 x86 one-chunk inline path (3f6ae9a)
• hashes: inline x86 one-chunk pre-final block compression in blake3 oneshot path (e364abb)
• hashes: unify blake3 public oneshot path for plain keyed and derive (0f1b1b8)
• hashes: add blake3 oneshot apples-to-apples attribution benches (c54a494)
• hashes: add first-update single-chunk fast path and drop s390x-specific finalize fallback (b4f785f)
• hashes: s390x fallback for 1024 single-chunk finalize (6469d31)
• hashes: candidate F fast-path blake3 single-chunk finalize root tail (934ccde)
• hashes: candidate E revert blake3 short-update escalation keep tiny finalize cleanup (62668f2)
• • hashes: candidate D optimize blake3 pristine short streaming path (b55ad17)
• hashes: revert blake3 x86 candidate-b and add candidate-c final-block fast path (8b9f3d1)
• hashes: optimize blake3 x86 one-chunk short-path compression loop (a39e33a)
• hashes: simplify blake3 short-input one-chunk hot paths (857485f)
• hashes: route server aarch64 blake3 short oneshot classes to neon (66457ee)
• hashes: add blake3 short-input attribution bench and baseline update (664401e)
• hashes: enable full blake3 gate diagnostics and record baseline tables (4d35d53)
• bench: cleaning the workflows post-tuning cleanout for the blake3 efficacy benches (fffdc9a)
• feature: adding to the tuning system in CICD; adjusting the Namespace runner to RunsOn runners. Adding guards and ensuring it's all useful. (a8ee12e)
• rscrypto: cache busting (fe99daf)
• rscrypto: tuning updates to apply and applied (c05b449)
• hashes,tune: optimize blake3 SIMD/tiny paths and calibrate tune contracts/reporting hashes: bind block/final compressors in Kernel to remove hot-path id matching; optimize tiny-path dispatch; reduce RVV vsetivli churn; streamline IBM/RISC-V parent SIMD lane loading. tune: add strict vs informational BLAKE3 contract modes, suppress false MISS for informational surfaces, and fix peak-throughput fallback when threshold-only data would report 0.00 GiB/s. workspace: update cargo-rail to v0.10.8 and refresh cargo-rail-action wiring in dev workflow. (f3a2f1b)
• rscrypto: fixing the massive stack allocation issue (e47feee)
• rscrypto: expanding the tuning engine for Blake3 (w/ extensibility in mind for future hashes) to prioritize real workloads - latency - instead of ONLY throughput. (100d5b5)
• rscrypto: profiling w/ cargo-asm, cargo-llvm-lines, and samply to try to get to the bottom of the perf story for Blake3. We're getting closer. (3c8e19d)
• rscrypto: hardening the test vectors to get a better output during failures. Cleaning up. Added a few lints to improve the perf/correctness/etc. improved the check-all command locally. (2f8a4f8)
• rscrypto: tuning applied (0144149)
• rscrypto: updating the tuning and apply pipelines to be more accurate and efficient. (6a9677b)
• rscrypto: updating the bench/tune workflows and manual UI triggers for clarity and consistency. (bccd468)
• rscrypto: committing the latest tuning for the full wheel on Blake3 so far (7ec3f49)
• rscrypto: applying the Mac M1 tuning results (6f820be)
• rscrypto: ci/tuning/platform: unify targeted lanes and harden tuning/apply pipeline (d3f8af3)
• rscrypto: fixing the license issue w/ cargo-audit (a22dfbd)
• rscrypto: fixing the tuning timeouts - fucking annoying, expensive, and sloppy on my part. (43969b4)
• rscrypto: fixing tuning engine again (2fc38aa)
• rscrypto: fixing the tuning split (0759071)
• rscrypto: tuning improvements - cleaner split, better artifacts. (0cc25be)
• rscrypto: split measurement/policy in the tuning engine to improve accuracy and efficiency. (3227b16)
• rscrypto: updating the tuning engine to hard error when the 'quick' flag is set to true. (c4e2998)
• rscrypto: fixing the tuning engine efficacy and updating the cross-arch stream misses issue w/ blake3 during tuning runs.So (37a3aa8)
• rscrypto: added Sapphire Rapids to the tuning workflow in CI (a18fc09)
• rscrypto: addressing a few more gaps in perf for the Blake3 impl across arches (28c9969)
• rscrypto: fixing the broken sse4.1 SIMD paths for x86-64 (e241e4e)
• rscrypto: wired the ASM for AVX512; brought parity to the Graviton/Neoverse Blake3 impls becasue they're targeting server chips; started to fix the 'reuse' in critical paths issue. (ddf900a)
• rscrypto: updating the benches for parity across the 'rscrypto/official/official-rayon' impls. Added the correct Blake3 tuning options so that we're not forcing one-shot on everything foolishly. Updated the hardcoded streamingTable definitions. (33ef210)
• rscrypto: addressing the weekly.yaml failures and fuzzing configuration. Added the dedicated x86-64 arches fast path for tiny XOF paths. (3bb04ec)
• rscrypto: fixing the Clippy lints for the Blake3 keyed/derive (07f4433)
• rscrypto: fixing the tiny/small keyed/derive perf for Blake3 (8c5050b)
• rscrypto: fixing the buffered benches w/ 8KB. (eecfaaf)
• rscrypto: updating the machines from AWS for CRC parity w/ the crc-fast crate. (16bed15)
• rscrypto: adding the s390x/power arches to the zig cross-compilation checks and fixing the issues. (85da199)
• rscrypto: fixing the IBM clippy warnings and test failures (61fe940)
• rscrypto: improving the IBM cache hits/speed, hopefully. (e621ace)
• rscrypto: fixing the IBM issues (f9589d0)
• rscrypto: fixing parallel streaming and parallel admission policy; updating the comparitive deps. (2c3b714)
• rscrypto: fixing the IBM specific implementations to avoid the compiler issues w/ s390x detection failures and Clippy lints (f929005)
• rscrypto: updating the Blake3 tuning (4b85dbb)
• rscrypto: updating the GHA shas and updating the codebase's tooling. (ff135a8)
• rscrypto: improving the bench.yaml (605fc60)
• rscrypto: fixing the IBM caches and removing the unnecessary unsafe code in the x86-64 code. (0cbcf39)
• rscrypto: fixing the rust toolchain for the s390x detection via the std lib on nightly. Removing the P9 in favor of P10/s390x being enough coverage. Fixing the types issue for P10 compilation. (59c83a1)
• rscrypto: fixing the tuning (e08541b)
• rscrypto: more CICD cleaning becasue AI is taking all of our jobs. (2e2e6af)
• rscrypto: fixing CICD (d779592)
• rscrypto: fixing again (7f8c21a)
• rscrypto: fixing CICD - again (b255bf4)
• rscrypto: removing the full Windows runs in the commit.yaml workflow. It's far too slow/expensive. They'll run in weekly.yaml now. (d586755)
• rscrypto: CICD fixes : ( (c281e38)
• rscrypto: CICD fixes (81a9d70)
• rscrypto: fixing the CICD (9af7eff)
• rscrypto: major infrastructure updates to esure the codebase can handle scaling and improvements over time. (f8a993e)
• rscrypto: updating the dispatch, tuning, scripts/justfile. (f00bbdb)
• rscrypto: improved the global detection and tuning systems. (e298823)
• rscrypto: finally cleaning up the CICD pipes and improving the workflows/setups/infra becasue it's starting to drift and get messy. (dc48a94)
• rscrypto: tuning improvements (6fc7931)
• rscrypto: fixing tuning (80ebf3b)
• rscrypto: swapping tuning (1b5b2c7)
• rscrypto: hashes: make blake3 parallel policy truly tuned and remove legacy dispatch/streaming overhead (54673f5)
• rscrypto: blake3/aarch64: optimize tails and keep asm chunk-compress hot on unaligned input (dd6730e)
• rscrypto: hashes/platform/backend/tune: unify BLAKE3 dispatch+policy, tighten SIMD paths, and harden ARM64 detection (2a6d906)
• rscrypto: fixing the CI issues. (38a8104)
• rscrypto: fixing CICD and fixing Linux ARM64 ASM issues w/ alignment (39b6ee1)
• rscrypto: fixing CI; fixing Linux ARM64 ASM (11d937f)
• rscrypto: fixing the IBM CICD runners setup. Fixing the ASM issue for the Linux ARM64 runner (bf72dd3)
• rscrypto: fallback to NEON when alignment isn't assured for ASM (44d6b14)
• rscrypto: fixing the CICD issues across targets for blake3 (d0daeaa)
• rscrypto: blake3 cleanup and perf wins (2ee7ef6)
• rscrypto: blake3: major performance updates to the MacOS aarch64 and general NEON paths. Added 'rayon' dep to parallelize the Blake3 multi-core run for now - a single, well audited dep isn't going to kill us in the v1. In the future, we'll look to improve on it, but for now - it's got to be. (b71e9ff)
• rscrypto: fixing the aarch64 fast paths and adding the keyed/derive streaming tiny-size fast path for x86-64. (d7d3abb)
• rscrypto: fixing the small inputs for aarch64 Blake3 (39d3bc8)
• rscrypto: fixing the Blake3 streaming vs streaming benches (f73682b)
• rscrypto: Blake3 XOF constructor for output-size-aware w/ kernel storage. (5c02d5d)
• rscrypto: cleaning up the feature flags and removing the tuning engine from prod builds (dev-only). Added the std::io UX/DX helpers for the hashes and checksums - extensible for the future work, as well. (eed0a30)
• rscrypto: fixing the compressor block and avx512 XOF asm path. (eb6bd0c)
• rscrypto: asm improvements for the Blake3 on aarch64 (258c7cc)
• rscrypto: added a dedicated global_asm! for aarch64 kernels (root + cv) to close the len == 1024 oneshot gaps on aarch64. (795be60)
• rscrypto: adding the IBM s390x/p9-p10 runners via IBM's generosity (4709c53)
• rscrypto: blake3 updates and fixes + MacOS tuning apply (7299b4d)
• rscrypto: tuning updates (4eb5288)
• rcrypto: updating Blake3 (57780e7)
• rscrypto: work on Blake3 (42bb3e8)
• rscrypto: applying tuning results (a9b42a7)
• rscrypto: CI fixes (b3f8e81)
• rscrypto: tuning failures in bench (a6db6a7)
• rscrypto: fixing tuning and working on the Blake3 x86-64 (45a314f)
• rscrypto: tuning work for Linux/Windows (aa0e4ea)
• rscrypto: extending the asm for Blake3; regen script in place. massive tuning update and efficiency update (170babe)
• rscrypto: tune apply: per-size-class winners, cross-arch stream mapping, and self-check; some cleaning and unification; implementing the s390x && risc-v runtime detection (280e22c)
• rscrypto: fixing the blake3 tuning w/ the 2D approach and improved the tuning globally for the differences between checksum/hashes. (d024b64)
• rscrypto: fixing the tuning engine for Blake3 (48c0560)
• rscrypto: tuning adjustments (c63b248)
• rscrypto: fixing the gating for AVX512 (afdce09)
• rscrypto: fixing the parent folding on AVX512 (6d9f3f1)
• rscrypto: fixed the ASM gating where AVX512_READY was too strict. (71d52dc)
• rscrypto: namespaced the rodata symbols to avoid inlining a single blob (07295d2)
• rscrypto: adding the asm for Blake3 (94c9d42)
• rscrypto: replaced the per-block compressor path for Blake3 (a3e1194)
• rscrypto: blake3 fixes (d0ef134)
• rscrypto: eliminated the SIMD cliffs and fixed x86_64 dispatch defaults (c41a1ce)
• rscrypto: updating the avx512 impl for Blake3 (4512301)
• rscrypto: x86-64 updates (262a6c5)
• rscrypto: wiring the SSE4.1 SIMD to Blake3 dispatches (ce31c7c)
• rscrypto: updating the sse4.1 blake3 (029361a)
• rscrypto: fixing clippy surrounding Blake3 updates (aaab2e0)
• rscrypto: working through the blake3 perf optimizations finally. (32254e1)
• rscrypto: cleaning, streamlining, and preparing the codebase (checksums, hashes/crypto, and hashes/fast) for the SIMD/HW instructions/accel work. Added official test vectors for all hashes and deterministic testing for all algys (db29973)
• rscrypto: adding the baseline hashes/crypto algys and hashes/fast algys; fuzzing and deterministic testing (bce02ec)
• rscrypto: fixing clippy issues (095cdd1)
• rscrypto: standing up the first version of the crypto-side hashes - pre-SIMD/HW instructions (d1da75c)
• rscrypto: adding the vectored CRC APIs and fuzz-target for it. Ran tuning and updated the codebase. (314ff77)
• rscrypto: adding the LICENSES; cleaning the codebase up after reverting to a monorepo. (a428e14)
• rscrypto: adding the Intel IceLake runner to populate that table (b8f2e0d)
• rscrypto: updating the bench.yaml for the Zen5 runner. (a61c7c9)
• rscrypto: adding the risc-v benchmarking runner (24da72e)
• rscrypto: cicd updates to bust the cargo-audit cache for Windows ARM64. (f9871cf)
• rscrypto: update to bust the cache/bin again (e9ed114)
• rscrypto: fixing the caching issues for the Windows ARM64 runner (b14b4b8)
• rscrypto: fixing the caching issue w/ the windows arm64 runner (7b1a94b)
• rscrypto: tuning (b62a733)
• rscrypto: fixing the risc-v runner label, hopefully. Looking at the results from the tuning to determine what's going on w/ the tuning engine. busting the cache for the windows arm64. (49b6e60)
• rscrypto: updating the bench.yaml and adding the RISC-V runners (b0bde6f)
• rscrypto: cleaning (3fd4b6e)
• rscrypto: added examples, contributing.md, and updated the readme.md; added introspection and hid the slice-by-4 code. updated the ENV usage and cleaned the codebase for release. added the proper AWS instances, Namespace instances, Github instances, and RISC-V instances for CICD/benching. updated the GHA pins. (2c2f176)
• rscrypto: reducing overhead (81dd7ec)
• rscrypto: fixing the off-by-one error in the double-unrolled loops (7f73666)
• rscrypto: improving the gen scripts and tuning caps safety. (e3d7efa)
• rscrypto: fixing via pre-push hook (4834a3e)
• rscrypto: adding the double-unroll and prefetching to the kernels it fits. (0d08dec)
• rscrypto: updating the tuned defaults via dispatch now that we've removed the tuned_defaults overhead and run all kernels/buffers (5cafd14)
• rscrypto: updating the codebase via removal of the old dispatch overhead and solving some tuning issues. (702c440)
• rscrypto: fixing the unused issue for x86-64; gating the extern crate alloc. (2fa87bb)
• rscrypto: fixing the tests (88ec68c)
• rscrypto: tuning (0938d5e)
• rscrypto: update for CI (eef34c9)
• rscrypto: refactor: pre-release cleanup for v0.1.0 - De-macro CRC-64 types for better auditability Replace define_crc64_type! macro with explicit implementations matching the CRC-32 pattern - Fix repository URLs in CONTRIBUTING.md - Document tuning coverage in README.md - Add platform coverage matrix showing measured vs inferred presets and list hardware we need contributions for - Remove speculative flag from Tune struct. The field added complexity without practical benefit; tuning docs now indicate extrapolated values in comments instead (f89284d)
• rscrypto: fixing the tuning engine to use the KernelSet and update the existing tables in dispatch.rs (ce9b4a5)
• rscrypto: improved performance everywhere via an architectural update. dropped the policy/runtime code for the determinism of compile-time - based on benches. (89a5dcf)
• rscrypto: tuning (179c144)
• rscrypto: improving the crc32 code and improving the bench runtime speed (c077292)
• rscrypto: fixing the generated tuning defaults (b591256)
• rscrypto: added the diagnostics for kernel selection to be certain we know what's being run and why. (f7ab9c8)
• rscrypto: pushing the tuned updates (67ee55b)
• rscrypto: added the improvements to the comp bench and DRYed out the codebase, prepping for the hashes/aead improvements. (0749f44)
• rscrypto: fix(backend,checksum): unbreak Arm EOR3 selection; remove CRC64 dispatch overhead (ffb5b47)
• rscrypto: tune: add tunable cutoff for CRC64 small kernel. Add small_kernel_max_bytes threshold to CRC64 config, allowing the tuning engine to find the optimal crossover point between the small single-lane SIMD kernel and the multi-stream folding kernels. (9d19bd4)
• rscrypto: prepping for release to OSS; fixing the dispatch issues (1f87a1f)
• rscrypto: adding the needed CONTRIBUTING.md for the community to turn in their tuning results or tuned_presets updates to cover all the arches. ensured the doctests actually ran. (94f9c60)
• rscrypto: added Intel tuning best guesses (d96958f)
• rscrypto: fixing the crc32 smoke test (88732c2)
• rscrypto: removed the 'powerpc64' naming conventions all over and replaced it w/ simply 'power'. improved the multi-stream for the risc-v, power, and s390x arches. improved the small buffer sizes. also, completed tuned defaults (with what we have access to) + tuning/apply pipeline; add multi-stream + POWER naming; fix CRC32 thresholds and small-buffer selection (9da27a9)
• rscrypto: fixing the Windows/Linux gating of the aarch64 code in CICD. (7f2d2b5)
• rscrypto: expanded crc16citt/ibm, crc24openpgp, and the tuning system. updated the former algos w/ the risc-v, power, and s390x accelerated versions. added tests; scalability. (25d1242)
• rscrypto: fixing the PCLMUL/VPCLMUL force modes for CI; fixed the streams noop issues across x86-64 and ARM64. improved the tuning engine's accuracy via stream awareness across algorithms/variants (f6a52e7)
• rscrypto: improving the mid-range crc32 variants on ARM64 (2b76bb5)
• rscrypto: updating the tuned_defaults for the systems we know. (d0908eb)
• rscrypto: tuning updates (17478ba)
• rscrypto: fixing the crc32 (ieee) implementations acceleration over multi-streams (b919fad)
• rscrypto: fixing the CI (8a2514b)
• rscrypto: fixing the tuning stats (92f10d2)
• rscrypto: cleaning up the bench.yaml manual triggers (8b205a3)
• rscrypto: building a proper fucking tuning engine for Rust crypto libraries and it's outstanding (d1131d5)
• rscrypto: checksum: add kernel equivalence fuzzing for CRC16/CRC24/CRC32 - Extends the CRC64 kernel_test pattern to all checksum variants, ensuring all SIMD backends produce identical results to the bitwise reference. (3e18faf)
• rscrypto: added the helper functions needed to clear CICD (68a22db)
• rscrypto: unifying the forced selection thought policy/kernels (408e4a0)
• rscrypto: fixing the imports (c608487)
• rscrypto: backend: reduce unsafe surface in dispatch/cache subsystem - major refactor (8513517)
• rscrypto: critical safety fixes for x86 AVX/AVX-512 detection and hybrid Intel; restore aarch64 multi-stream tuning contract (04217f1)
• rscrypto: fixing the constant assertions causing issues via Clippy; removed the CRC64 Smoke Tests from CI (e3bd5d7)
• rscrypto: updated the tuning engine significantly. added per-lane byte matching the hardware; added explicit flags and clear override chains. addressed the memory-bound crc32c on Zen4/NEON. the tuning engine offers a fully tunable checksum system... and it's benchmark driven now. fixing the tuning infrastructure in the justfile/bench.yaml, as well. (abfe822)
• rscrypto: refactored the backend/ to be much cleaner; more performant; more maintainable. updated the checksum crate to use the new architecture. rmeoved overhead. (61b3278)
• rscrypto: refactored the property tests into the proper, uniform, centralized structure they should have been from day one. refactored the kernels and dispatch to improve the readability and uniformity across the codebase. (add55d1)
• rscrypto: checksum: add cross-kernel equivalence fuzz target and testing infrastructure; executed the fuzzer and the miri tests, along w/ full test suite to validate the safety/soundness across the crate. all is well. gated a handful of property tests for Miri execution. (133b61b)
• rscrypto: added common/proptests.rs with rigorous property-based tests for all 7 CRC variants. Tests prove two fundamental invariants against our bitwise reference: (10ac73a)
• rscrypto: improving the tuning/selection logic; it sets the tone for all other implementations in the codebase - including hashes, aead, etc. (94fa770)
• rscrypto: fixing the combine overhead holding back the crc32c impl (fab0489)
• rscrypto: cleaning the bench.yaml workflow (02603c0)
• rscrypto: fixing the bench.yaml for diagnostics and tuning (e8b7bc7)
• rscrypto: tuning the checksum implementations (773a767)
• rscrypto: fix CRC32/CRC32C x86 dispatch + multistream combine; add comp-report toggle (ea792d4)
• rscrypto: scaffolded hash/ crate and blake3 module. Updated the crc bench to be sensible. (a46f892)
• rscrypto: tuning the checksum crate for performance and efficiency (1948c29)
• rscrypto: fixing w/ pre-push (64e867c)
• rscrypto: adding the CRC16CITT, CRC16IBM, and CRC24PGP initial impls. (a0091b7)
• rscrypto: alignment and parity between the CRC64 reference impls and the CRC32 impls. Checking API shapes; UX/DX; streaming. Ensuring the tests/benches are solid and preparing for the CRC16 (2) and CRC24 (pgp) impls. (f7dabe0)
• rscrypto: checksum - add dedicated crc32 fuzz target; fuzz+miri weekly on x86_64+aarch64 (bf6a046)
• rscrypto: checksum/crc32 - add POWER VPMSUM, s390x VGFM, riscv64 Zbc/Zvbc backends (8fd3d58)
• rscrypto: removing the unused return (3a6ce64)
• rscrypto: crc32: add small-buffer + aarch64 fusion parity; add crc32-tune tooling (a20c7b9)
• rscrypto: fixing the clippy issue w/ the needless return in ci (13cdc24)
• rscrypto: improving the aarch64 and x86-64 perf. cut tiny-update overhead; add SVE2-PMULL force tier. Cache CRC32/CRC32C dispatch params in std builds; remove per-update() config/caps checks. Fix aarch64 PMULL/PMULL+EOR3 stream slot mapping; add fusion min-size gate (4827b87)
• rscrypto: adding fuzzing for the crc32/crc32c and cleaned crc64 bench that's too heavy. (d478f2b)
• rscrypto: fixing the fold constants in the CRC32 (IEEE) and gated the AVX512 tests (9868cc1)
• rscrypto: removed the Windows ARM64 runner - it's not a Windows ARM64 runner. repaired a real x86-64 CI issue in the crc32 sanity check that was comparing the 16B fold-coefficient in the wrong order (high, low). (a1a6831)
• rscrypto: added the per-stream kernels and wired into the dispatch. added sse4.2 stream wrappers and aarch64 crc extensions. updated the stream selection to engage for large buffers and added correctness tests for the folding constant gen + multi-stream variants (e98cda3)
• rscrypto: fixed the cicd issue w/ crc32 (0044792)
• rscrypto: fixing the crc32 issue from CI (6c9f20e)
• rscrypto: finished wiring x86-64 wiring and clamped only when the CRC32C actually runs. The audot select for PCLMUL is present. The comp bench was updated w/ crc-fast (crc-fast-rust) comparison. (9fbe330)
• rscrypto: added HWCRC impl for CRC32 and CRC32C on aarch64; updated the x86-64 impls w/ fusion tiers as well. auto-selection wired; portable slice-by-16 software integrated (2322ea3)
• rscrypto: adding the CRC32 and CRC32C to the fold (856c25f)
• rscrypto: updating the bench.yaml to allow for tuning scripts to run w/o the need to run a full benchmark. (2f9f1a4)
• rscrypto: fixing the bits/bytes mistake for folding distances in the new VPCLMUL 4x512-bit kernel (5ef6f90)
• rscrypto: fixing the AVX512 smoke and investigated the ARM64 Windows; no real solution, though (f432d41)
• rscrypto: fixing the tuning engine/scripts; adding the 4x512-bit processing kernel. (96e81fd)
• rscrypto: adjusting thresholds for the Intel SPR triggers; adding the CPU print to the comp benches. (44cf09a)
• rscrypto: adding the 8-way folding impl for the x86-64. (9551be4)
• rscrypto: made adjustments to the fuzzing infrastructure for more control/containment; improved the target-triples selection. (2a5d6cb)
• rscrypto: fixing the fuzzer in cicd (8f01899)
• rscrypto: fixing the fuzzing/bench/weekly workflows. (ab12365)
• rscrypto: cleaning out the nightmare that was the CRC32 and CRC32C impls; adding crc-fast to the property testing suite; improving the testing/validation of the existing CRC64XZ/CRC64NVME before adding the 8-way fold we're missing. (7f5b158)
• rscrypto: fixing the -1 offset (CRC32) still broken (a5d1fac)
• rscrypto: fix the CRC-32 CLMUL fold coefficient ordering (it was backwards and wasn't allowing the larger exponent to 'shift up'. (a4635a7)
• rscrypto: fixing the CRC32 CLMUL fold coefficient exponent formula (cfa1cd6)
• rscrypto:fix(crc32): correct CLMUL fold coefficient exponents (bcf51a7)
• rscrypto: feat(crc32): implement x86_64 VPCLMUL kernels for CRC32/CRC32C (b236b61)
• rscrypto: fixing crc32 again (c444098)
• rscrypto: fixing the module inception (336f3b9)
• rscrypto: cleaning up the architecture, crc32/crc32c, and the testing. (77ce7a3)
• rscrypto: fix(crc32): use correct CLMUL selectors (0x10/0x01) for CRC-32 fold_16 (d6d189e)
• rscrypto: fixing the crc32 issue (6ebe02e)
• rscrypto: fixing the fold_8 w/ fold_width and updating the Crc32ClmulConstants for CRC32/CRC32C. (1baa646)
• rscrypto: fixing the crc32/crc32c algorithms (71195ab)
• rscrypto: fixing the CRC32/CRC32C mu tests on Linux/Windows x86-64. (f2e5dc9)
• rscrypto: crc32: fix Barrett reduction CLMUL imm8 operands in x86_64 PCLMUL (efb0c0b)
• rscrypto: updated the GHA SHAs and pinning (5aff4a4)
• rscrypto: crc32: add 7-way PCLMUL kernel, completing x86_64 PCLMUL set (d620d56)
• rscrypto: added powerpc VPMSUM; s390x VGFM 4-way; riscv ZVBC vector, ZBC scalar; removed the 'loongarch' and planned to update w/ Chobra. CRC64/xz-nvme is getting closer to the 'reference' impl we're aiming for (1303e1f)
• rscrypto: added powerpc64; updated target-triples and zig-cc scripts (6e0ce61)
• rscrypto: improving the crc64 tables (8>16) and the tuning scripts/cli workflow (e8731f4)
• rscrypto: bench and tune refinements; working on the tuning scripts. (ebfc373)
• rscrypto: added the EO3 (XOR) and multi-stream update to the aarch impl; added VPTERNLOGD impl for the x86-64. (a7d54c1)
• rscrypto: added the EOR3 kernel to automatically run on any ARMv8 CPU w/ SHA3 extensions for buffers larger than 128 bytes. (fe2127b)
• rscrypto: added 3-way fold to the arm64 arches (7f43652)
• rscrypto: fmt; fuzz updates (23584ea)
• rscrypto: fixing the check.sh script to actually cover the codebas's targets. fixed the Windows x86-64 benches to use the free runners. fixing the fuzz testing issues. (5f0e021)
• rscrypto: fmt - cicd fixes (ede4a12)
• rscrypto: more x86-64 fixes. (5d7784d)
• rscrypto: fixing the fmt again; cicd fixed (1a5d9c0)
• rscrypto: fixes to the x86/arm64 Linux CICD (17ceb99)
• rscrypto: added reference implementation for the CRC64XZ/NVME + backend/platform/traits integration + ci: full SIMD tier coverage, aarch64 Miri, tune discovery, regression detection (15f95ce)
• rscrypto: fix: Miri failure & test-fuzz.sh script fix. (a50b0ae)
• rscrypto: fix: replaced the manual 'caps = caps| x w/ idomatic caps |= x compound assignment operator (19e1483)
• rscrypto: fix: resolve CI failures across all targets (286f503)
• rscrypto: refactor is required for us to build anything worth a shit; checksum and hashes removed; added the callback macro w/o pulling in procmacro crate (4381375)
• rscrypto: backend/platform dispatch work; updated the 'indexing_slicing' lint. (1cc2adc)
• rscrypto: fix: no_std sentinel cfg issues w/ 64-bit atomics (8922f46)
• rscrypto: fix: lints/cfg issues (ae97e0d)
• rscrypto: fixed the Miri cfg issues; fixed the runtime detection && PCLMULQDQ enabled in benches (f7ef78c)
• rscrypto: fixing Miri stupidity and the cpu-native (1532ecb)
• rscrypto: added the weekly.yaml for fuzzing/etc. (9081378)
• rscrypto: fixing the Barrett reduction order; it was backwards. (1f4b4ab)
• rscrypto: added new no_std targets; removed the 'std' gate because it's just not needed and then added hand-rolled errors (51283a0)
• rscrypto: ci: fix CI failures and expand no_std target coverage; setup new Namespace 'profiles' for rscrypto, too. (625044e)
• rscrypto: fix the cicd issues; simple (632a18a)
• rscrypto: wiring the 'pre-push' hook/script. (e76634f)
• rscrypto: initial commit (3d06ff9)

⚡ Performance

• ed25519: eliminate IFMA overflow corrections in verify hot path (6434ebf)
• aead: fuse GCM-SIV + AEGIS paths, add wide POLYVAL for ARM/POWER/s390x (4423c21)
• aead: fuse AEGIS-256 init/aad/encrypt/finalize into single target_feature scope (7534fd1)
• auth: asymmetric IFMA mul eliminates reduce in double (7c741f4)
• close 4 acceleration gaps (KECCAK-2/4, SHA-2, IFMA) (aa31440)
• auth: eliminate reduce in IFMA double + static basepoint table (df53f0b)
• auth: route Ed25519 verify to AVX2 — IFMA is structurally slower (380005b)
• rapidhash native-endian reads, precomputed seed; SHA-2 volatile K, aarch64 compact loop (0034627)
• CRC32 aarch64 dispatch bypass, SHA-3 sponge output extraction; XXH3 small-input codegen overhaul — cold dispatch + typed mix16_b (09f0dc2)
• SHA-512 single-block rotation schedule + vector K addition (a291d28)
• SHA-512 Zen5 dispatch fix, Keccak θ rewrite, RapidHash codegen tune (8a23f40)
• RapidHashFast inner core, HKDF midstate cache, Ed25519 field/point optimizations RapidHash: - RapidHashFast64/128 now uses a dedicated inner-algorithm core instead of V3-no-avalanche. Size-tuned dispatch: 3-stream (49-400B), 7-stream (>400B), cold-path separation for codegen quality. Oracle: rapidhash::fast::RapidHasher. - RapidHash64/128 (standard V3) unchanged. Auth: - HKDF-SHA256: cache HmacSha256 keyed with PRK at extract time. expand() now resets (1 memcpy) instead of re-creating (2 SHA-256 compressions) per chunk. - Ed25519 field: dedicated squaring — 15 wide muls vs 25 (40% fewer). - Ed25519 point: dedicated dbl-2008-hwcd doubling — 4 sq + 4 mul, no D2 multiply. - Ed25519 point: precomputed 16-entry basepoint table with 4-bit windowed scalar mul — adds drop from ~128 to ~60. - Ed25519 verify: Straus/Shamir interleaved [s]B + [-h]A in one 256-bit scan, halving doublings from 512 to 256. (89dbfc2)
• bypass dispatch overhead for small fast-hash inputs (e12085c)
• cascade AVX-512 sub-degree tails to AVX2 for BLAKE3 hash_many and parent compression (17f47d6)
• fix BLAKE3 XOF ~250ns Drop overhead, upgrade zeroize to word-sized writes feat: add SHA-NI/SHA2 CE hardware acceleration for SHA-256/SHA-224 (9f76def)
• extend direct-assembly compress to update_general() for 128B-512B streaming (c509ce3)
• flatten BLAKE3 streaming compress call chain, eliminate overflow branch (f7a551a)
• remove pending_chunk_cv gate from BLAKE3 streaming hot path (b168ad0)
• optimize BLAKE3 streaming control path for sub-chunk updates (331bac3)
• remove cold/inline-never from blake3 streaming and XOF hot paths fix: fixing the SSSE3 issue in the weekly.yaml run/testing (9eeb7bc)
• add XOF fast path and remove hot-path cold/inline barriers; (76aa96b)
• remove legacy tune pipeline and add Blake3 CI gap gates (0549cee)

💄 Styling

• rustfmt (1c28ea2)

All notable changes to rscrypto will be documented in this file.