It's nice to know there are a few "safe" Rust crypto primitives (especially the `ChaCha20+Poly1305` which is also found in `libsodium`):<p>* AES/GCM: <a href="https://github.com/RustCrypto/AEADs/tree/master/aes-gcm" rel="nofollow">https://github.com/RustCrypto/AEADs/tree/master/aes-gcm</a><p>* ChaCha20+Poly1305: <a href="https://github.com/RustCrypto/AEADs/tree/master/chacha20poly1305" rel="nofollow">https://github.com/RustCrypto/AEADs/tree/master/chacha20poly...</a><p>Quoting from the "key findings" of that report:<p>> NCC Group did not find any vulnerability in the audited crates.
>
> The RustCrypto implementations use all the recommended techniques to achieve constant-time implementations; in particular, the fallback AES implementation (to be used when there are no usable hardware AES opcodes) uses bitslicing to avoid any table lookups at secret-dependent addresses. Similarly, received authentication tags are compared with constant-time comparison functions.
>
> A few cosmetic remarks, mostly related to potential performance improvements, have been assembled into RustCrypto.<p>----<p>It seems that the audited code includes also:<p>* `aes-gcm` and `chacha20poly1305`: <a href="https://github.com/RustCrypto/AEADs/tree/a15698fdba23ffb17b84d9ecaa2c9c80706ecf03" rel="nofollow">https://github.com/RustCrypto/AEADs/tree/a15698fdba23ffb17b8...</a><p>* `aes` from RustCrypto/block-ciphers: <a href="https://github.com/RustCrypto/block-ciphers/tree/e385f1ebb2ec48547194e51c5193309ee328d93b" rel="nofollow">https://github.com/RustCrypto/block-ciphers/tree/e385f1ebb2e...</a><p>* `chacha20` and `salsa20-core`: <a href="https://github.com/RustCrypto/stream-ciphers/tree/1235638004c21dee4e76af4cc932cf1cd815e8f9" rel="nofollow">https://github.com/RustCrypto/stream-ciphers/tree/1235638004...</a><p>* `aead`, `stream-cipher` and `universal-hash`: <a href="https://github.com/RustCrypto/traits/tree/4569d256f02ac0ecefa393baf225fb4a6df35875" rel="nofollow">https://github.com/RustCrypto/traits/tree/4569d256f02ac0ecef...</a><p>* `ghash`, `poly1305` and `polyval`: <a href="https://github.com/RustCrypto/universal-hashes/tree/1ab06bd79542e75490468b227dd3c2cbe42d3d92" rel="nofollow">https://github.com/RustCrypto/universal-hashes/tree/1ab06bd7...</a>