OxiCrypto 0.3.0 Released — All 12 FIPS 205 SLH-DSA Parameter Sets, TLS 1.3 AEAD Negotiation, and a Bcrypt Panic-DoS Fixed

FIPS 205 defines twelve SLH-DSA parameter sets. OxiCrypto shipped ten of them for two releases straight — the pinned slh-dsa dependency had the last two the whole time, nobody had wired them up.

Today we released OxiCrypto 0.3.0 — the release that closes that gap, completes the TLS 1.3 cipher-suite negotiation quartet with a new negotiate_aead, adds coverage-guided fuzzing across four previously-untested crates (and fixes a fifth that turned out not to even build), gives every sub-crate that lacked one a runnable example, and closes a panic-DoS in bcrypt hash verification.

No OpenSSL. No BoringSSL. No ring, no aws-lc-rs in the default closure. No FFI. No -sys crates. OxiCrypto 0.3.0 still compiles to a single static binary (or WASM) with zero apt-get install and no C toolchain — exactly as it has since 0.2.0.

Why OxiCrypto 0.3.0 is a game changer

Even a mature Pure Rust crypto stack accumulates quiet gaps once you look for them:

A post-quantum signature scheme advertised as “SLH-DSA support” that’s actually missing 2 of its 12 FIPS 205 parameter sets is a silent portfolio hole — the upstream crate had Shake192s/Shake192f sitting right there, unused, because nobody had finished wiring them through the workspace’s impl_slh_dsa_param! macro.
Three of four TLS 1.3 cipher-suite legs (MAC, signature, key exchange) already resolved from a wire identifier via negotiate_mac/negotiate_sig/negotiate_kex — but the fourth leg, the AEAD that actually touches every byte of every record, was left for every caller to hand-roll.
Nine of fourteen crates in the workspace had zero runnable examples. The only way to see a working call was to read a test file.
Four of the highest-risk untrusted-input surfaces — AEAD unsealing, HMAC truncated-tag verification, PQ key-share wire decoding, bcrypt hash-string parsing — had no fuzz coverage at all. Worse, the one fuzz crate that did exist (oxicrypto-hash) turned out not to build: cargo build from inside it failed outright for lack of its own [workspace] table.
A bcrypt hash string sourced from outside the process — read from a database, say — that happened to contain a multi-byte UTF-8 character landing on one of the format’s fixed byte offsets triggered a Rust string-slicing panic instead of a clean rejection. That’s a denial-of-service vector on any verification path that trusts external input, which is most of them.

OxiCrypto 0.3.0 ends all of that.

All 12 of 12 FIPS 205 parameter sets, finally. SlhDsaShake192s/SlhDsaShake192f (security category 3, SHAKE) land via the existing impl_slh_dsa_param! macro, with SK/VK/signature length constants and key-size + sign/verify/tamper tests, same as the other ten.
The fourth negotiation leg. negotiate_aead(suite: TlsCipherSuite) -> Result<Box<dyn Aead>, CryptoError> in a new oxicrypto-aead::tls module resolves any of the five TLS 1.3 cipher suites (RFC 8446 §B.4) straight to a boxed Aead — no OxiTLS crate dependency required.
A fuzz suite that actually runs. Four new coverage-guided cargo-fuzz harnesses (oxicrypto-aead, oxicrypto-mac, oxicrypto-pq, oxicrypto-kdf) plus a fix that makes the pre-existing oxicrypto-hash fuzz crate buildable at all — all five were smoke-tested from tens of thousands to 1M+ iterations with zero crashes.
Nine new runnable examples, one per previously-example-less sub-crate, each a real cargo run -p <crate> --example <name>-verified walkthrough of that crate’s headline API.
The bcrypt panic is closed, with an ASCII gate applied independently in all three call paths (bcrypt_verify, parse_bcrypt_string, extract_hash_part) so no code path depends on call order.
A silent-truncation bug in the post-quantum wire format is now a typed error instead. PqKeyShare::to_wire returns Result<Vec<u8>, CryptoError> and rejects an oversized payload instead of wrapping its 2-byte length field.

Technical Deep Dive: parameter-set completion, the fourth negotiation leg, and a fuzz suite that builds

SLH-DSA completion (oxicrypto-pq). The pinned slh-dsa 0.2.0-rc.5 dependency already implemented Shake192s/Shake192f; OxiCrypto’s own impl_slh_dsa_param! macro just hadn’t been pointed at them yet. Wiring them through gives every one of FIPS 205’s twelve (hash family × size × speed) combinations — SHA2/SHAKE, 128/192/256-bit, small/fast — a matching SlhDsa* type in the crate.
negotiate_aead — oxicrypto-aead::tls. TlsCipherSuite covers the five TLS 1.3 suites, with from_iana_name/wire_code for parsing and serializing the wire identifier, and aead_name_for_suite as a pure naming helper. negotiate_aead maps Aes128GcmSha256/Aes256GcmSha384/Chacha20Poly1305Sha256/Aes128CcmSha256 to their AEAD implementations, and returns CryptoError::UnsupportedAlgorithm — not a silently wrong 16-byte-tag substitute — for Aes128Ccm8Sha256, whose 8-byte truncated tag this crate doesn’t yet implement. The module mirrors oxicrypto_mac::negotiate_mac, oxicrypto_sig::negotiate_sig, and oxicrypto_kex::negotiate_kex exactly, so a TLS 1.3 stack now resolves every leg of a cipher suite through the same pattern.
The fuzz suite. fuzz_sealed_box_open_no_panic and fuzz_key_unwrap_no_panic (oxicrypto-aead) exercise open_box and the RFC 3394 aes{128,256}_key_unwrap. fuzz_hmac_truncated_no_panic (oxicrypto-mac) is a direct regression guard for the truncated-HMAC panics fixed back in 0.2.1. fuzz_pq_key_share_from_wire (oxicrypto-pq) round-trips PqKeyShare::from_wire/decode-re-encode. fuzz_bcrypt_verify_no_panic (oxicrypto-kdf) is a direct regression guard for the bcrypt fix below. Each fuzz/Cargo.toml carries its own [workspace] table — the exact thing oxicrypto-hash’s pre-existing fuzz crate was missing, which is why cargo metadata from inside it had been failing with “current package believes it’s in a workspace when it’s not.”
The bcrypt fix and the PQ wire-format hardening. bcrypt_verify/parse_bcrypt_string/extract_hash_part previously validated only the byte length of a hash string before indexing into it as &str (&hash_part[..22] and similar). A multi-byte character straddling that offset panicked with Rust’s “byte index N is not a char boundary” instead of erroring. The fix, ensure_ascii_hash, is justified because bcrypt’s modular-crypt format and base64 alphabet are ASCII-only by definition — so rejecting non-ASCII input outright is correct, not merely defensive. Separately, PqKeyShare::to_wire used to compute its 2-byte wire length field as len as u16, which wraps silently for a payload over 65535 bytes; it’s now Result-returning and rejects that case with CryptoError::Encoding. No currently-defined PqGroup produces a payload anywhere near that size, but the encode helpers accept arbitrary caller-supplied byte slices, so the bound wasn’t guaranteed by the type system.

Getting Started

cargo add oxicrypto

[dependencies]
oxicrypto = "0.3.0"

# Post-quantum primitives (off by default):
oxicrypto = { version = "0.3.0", features = ["pq-preview"] }

Hashing:

use oxicrypto::{blake3, sha256, sha512};

let digest = sha256(b"hello world");
let digest = sha512(b"hello world");
let digest = blake3(b"hello world");

Resolving a TLS 1.3 cipher suite straight to an AEAD — the new part in 0.3.0:

use oxicrypto_aead::{negotiate_aead, TlsCipherSuite};

let aead = negotiate_aead(TlsCipherSuite::Aes256GcmSha384)?;
assert_eq!(aead.name(), "AES-256-GCM");
assert_eq!(aead.key_len(), 32);
assert_eq!(aead.nonce_len(), 12);
assert_eq!(aead.tag_len(), 16);

Every sub-crate now has a runnable, headline-API example:

cargo run -p oxicrypto-aead --example aead_basics
cargo run -p oxicrypto-sig --example sig_basics
cargo run -p oxicrypto-pq --example pq_basics --features pq-preview

What’s New in 0.3.0

Added: SlhDsaShake192s/SlhDsaShake192f, completing all 12 FIPS 205 parameter sets; the negotiate_aead TLS 1.3 cipher-suite resolver in a new oxicrypto-aead::tls module; four new cargo-fuzz harnesses across AEAD/MAC/PQ/KDF; runnable examples/ for all 9 previously-example-less sub-crates; workspace-root rustfmt.toml/clippy.toml (MSRV pinned to 1.89 in clippy.toml); a TODO.md for oxicrypto-cipher, the one crate that was missing one.
Changed (breaking): PqKeyShare::to_wire now returns Result<Vec<u8>, CryptoError> instead of Vec<u8>, rejecting an over-u16::MAX-byte payload instead of silently truncating the wire length field. deny.toml’s ring ban now carries a scoped exception for oxicrypto-bench’s dev-only comparative benchmarks. .gitignore’s fuzz/ patterns widened to match the five per-crate fuzz/ directories instead of only a nonexistent top-level one. oxicode bumped 0.2.4 → 0.2.6.
Fixed: a broken rustdoc intra-doc link in the new tls module (referenced a crate oxicrypto-aead doesn’t depend on) that broke RUSTDOCFLAGS="-D warnings" cargo doc; the previously-non-buildable oxicrypto-hash fuzz crate now builds like its four new siblings.
Security: a byte/char-boundary panic in bcrypt_verify/parse_bcrypt_string/extract_hash_part on non-ASCII input — a panic-DoS on any path verifying a bcrypt hash sourced from outside the process — fixed with an ASCII gate applied independently in all three functions.
1627 tests pass with cargo nextest run --workspace (default features), plus 26 passing doctests.

Tips

If your TLS stack still hand-rolls the AEAD leg of cipher-suite negotiation, replace it with negotiate_aead. It’s the last of the four negotiate_* helpers (oxicrypto_mac::negotiate_mac, oxicrypto_sig::negotiate_sig, oxicrypto_kex::negotiate_kex, now oxicrypto_aead::negotiate_aead) — resolve a whole TLS 1.3 cipher suite through the same pattern on every leg. Remember it returns Err(CryptoError::UnsupportedAlgorithm) for TLS_AES_128_CCM_8_SHA256; that 8-byte-tag variant isn’t implemented, and the function won’t silently hand you the wrong tag length instead.
Don’t know where to start with a sub-crate’s API? Run its example first. All 14 crates now have one — cargo run -p oxicrypto-kex --example kex_basics walks X25519 agreement through HKDF into a session key; oxicrypto-hash’s example additionally builds under --no-default-features to demonstrate the alloc-free surface.
If you call PqKeyShare::to_wire directly, update the call site for 0.3.0. It’s the one breaking change this release: the method now returns Result<Vec<u8>, CryptoError> instead of Vec<u8>. Every currently-defined PqGroup payload is well under the u16::MAX bound in practice, so the common case is a mechanical ? or .expect(...).
If you verify bcrypt hashes sourced from outside your process — a database, a config file, an API payload — upgrade now. Pre-0.3.0, a non-ASCII byte anywhere in the hash string could panic the verifying thread; 0.3.0 rejects it cleanly via CryptoError, and no call-site change is needed to pick up the fix.
Reach for the newly-completed SLH-DSA matrix if Shake192s/Shake192f were the gap blocking you. All 12 FIPS 205 parameter sets are now available behind pq-preview; the 18 slower -s-parameter variants remain #[ignore]-gated in the test suite (they’re slow, not unfinished) — run them explicitly if you need to exercise them locally.
Point cargo-fuzz at the new harnesses if you’re auditing untrusted-input paths. oxicrypto-aead’s fuzz_sealed_box_open_no_panic/fuzz_key_unwrap_no_panic, oxicrypto-mac’s fuzz_hmac_truncated_no_panic, oxicrypto-pq’s fuzz_pq_key_share_from_wire, and oxicrypto-kdf’s fuzz_bcrypt_verify_no_panic all build now (each fuzz/ crate has its own [workspace] table, so cargo +nightly fuzz run <target> works standalone without touching the parent workspace).

This is the foundation

OxiCrypto depends on nothing — it’s the foundation layer the rest of the COOLJAPAN cryptography stack stands on. It is already depended on by:

OxiTLS — the Pure Rust TLS stack.
OxiStore — encrypted storage; oxistore-blob-gcs signs through oxicrypto-sig, and oxistore-encrypt derives keys through oxicrypto (with an optional oxicrypto-adapter-pkcs11 bridge for HSM-backed keys).
OxiSQL — the Pure Rust SQL layer.
OxiQuic — oxiquic-crypto depends on oxicrypto’s pure/std features for QUIC’s TLS 1.3 handshake and header-protection primitives.
oxify, mielin, and oxirs — application-layer consumers spanning multiple oxicrypto-* sub-crates.
oxionnx (model signing) and oxirag (content addressing).

Around it sit sibling Pure Rust projects removing their own native dependency from the floor of the ecosystem — OxiArc (compression, replacing zip/flate2/zstd), OxiBLAS, OxiFFT, and OxiZ (the Pure Rust SMT solver).

Repository: https://github.com/cool-japan/oxicrypto

Star the repo if you want a post-quantum signature portfolio with no gaps, a TLS 1.3 negotiation surface with no leg left unresolved, and cryptographic parsers that reject bad input instead of panicking on it.

The era of a “complete” crypto crate quietly missing two parameter sets nobody checked for is over. Pure Rust cryptography is here — complete, fuzzed, and sovereign.

— KitaSan at COOLJAPAN OÜ August 6, 2026