Pure Native Implementations

Side-channel claim limit. Nothing on this page claims constant-time behaviour or side-channel resistance for any target: the side-channel harness covers nothing (finding A48) and no measurement exists. The Rust and C cores are designed for constant time and unmeasured; managed runtimes (JIT, GC, bounds checks) make no timing claim. Where this page names constant-time or side-channel techniques, in prose or in code, they are design intent or recommendations, not measured properties.

Overview

MetaMUI Crypto Primitives provides pure native implementations of all cryptographic algorithms without relying on external cryptographic libraries. This approach ensures:

• Consistent behavior across all platforms
• Complete control over the implementation
• No supply chain risks from external dependencies
• Easier auditing of the entire codebase
• Better performance optimization opportunities

Implementation Status

✅ Pure Implementations

The following algorithms are implemented purely in each language without external crypto dependencies:

Symmetric Encryption

• AES-256: Pure implementation in all languages
  • Rust: metamui-aes-256 with native feature (default)
  • Python: metamui_crypto.aes256
  • TypeScript: @metamui/crypto-aes256
  • Swift: MetaMUIAES-256
  • Kotlin: id.metamui.crypto.aes256
  • WASM: metamui-crypto-aes-256 (native implementation)

Hash Functions

• SHA-256/512: Pure implementations
• Blake2b/Blake2s: Pure implementations
• Blake3: Pure implementation
• SHAKE-256: Pure implementation

Asymmetric Cryptography

• Ed25519: Pure implementation
• Sr25519: Pure implementation
• X25519: Pure implementation

Post-Quantum Cryptography

• Falcon-512: Pure implementation
• ML-KEM-768: Pure implementation
• Dilithium: Pure implementation
• NTRU Prime: Pure implementation

🔧 Implementation Details

AES-256 Implementation

All AES-256 implementations follow the same structure:

1. Key Expansion: Rijndael key schedule for 256-bit keys
2. Block Operations:
   • SubBytes (S-box substitution)
   • ShiftRows
   • MixColumns (except final round)
   • AddRoundKey
3. Modes of Operation:
   • ECB (Electronic Codebook) - not recommended
   • CBC (Cipher Block Chaining) with PKCS#7 padding
   • CTR (Counter) mode
   • GCM (Galois/Counter Mode) for authenticated encryption

Performance Optimizations

1. Lookup Tables: Precomputed multiplication tables for MixColumns
2. Constant-Time Operations: not claimed (unmeasured, A48)
3. Memory Management: Automatic zeroization of sensitive data
4. Batch Processing: Optimized for processing multiple blocks

Security Considerations

Constant-Time Operations

Constant-time behaviour and side-channel resistance are not claimed for any target (unmeasured, A48); what follows is design intent only:

// Example: Constant-time Galois field multiplication
fn gmul(a: u8, b: u8) -> u8 {
    let mut result = 0u8;
    let mut aa = a;
    
    for i in 0..8 {
        // Constant-time conditional XOR
        let mask = ((b >> i) & 1).wrapping_neg();
        result ^= aa & mask;
        
        // Constant-time reduction
        let high_bit_mask = ((aa >> 7) & 1).wrapping_neg();
        aa = (aa << 1) ^ (0x1b & high_bit_mask);
    }
    
    result
}

Memory Security

All implementations ensure sensitive data is cleared from memory:

• Rust: Uses zeroize trait
• Python: Custom secure clear implementation
• TypeScript: secureClear function
• Swift: Automatic clearing in deinit
• Kotlin: Arrays filled with zeros after use

Migration Guide

From External Dependencies

If you were using external crypto libraries, migration is straightforward:

Rust

// Before (with external feature)
use metamui_aes_256::{Aes256Gcm, Aes256Key};

// After (native implementation - default)
use metamui_aes_256::{aes256::Aes256Core, Aes256Key};

let aes = Aes256Core::new(key.as_bytes());
let ciphertext = aes.encrypt_cbc(&iv, plaintext);

Python

# No change needed - always pure implementation
from metamui_crypto.aes256 import AES256

aes = AES256(key)
ciphertext = aes.encrypt_cbc(iv, plaintext)

Testing

All pure implementations are tested against:

1. Official test vectors from NIST and other standards bodies
2. Cross-language compatibility tests
3. Timing attack resistance tests
4. Memory safety tests

Performance

Pure implementations are optimized for performance:

• Python: Multiplication tables for MixColumns
• Rust: Optimized with inline functions and minimal allocations
• TypeScript: Web-optimized with efficient array operations
• Swift: Leverages Swift’s performance optimizations
• Kotlin: JVM-optimized implementation

Future Improvements

1. SIMD Optimizations: Parallel processing of multiple blocks
2. Hardware Acceleration: Optional use of AES-NI when available
3. Further Optimization: Bitsliced implementations for better performance

Contributing

When contributing new algorithms:

1. Implement as pure native code without external crypto dependencies
2. Follow the existing patterns for memory management
3. Include comprehensive test vectors
4. Ensure constant-time operations where applicable
5. Document any platform-specific optimizations