Fixes from the crate-by-crate review of release/0.1.3alpha (reports 1–15)

.github/workflows/aes-ct-asm.yml

@@ -0,0 +1,26 @@
+name: AES Constant-Time Assembly
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: aes-ct-asm-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  aes-ct-asm:
+    if: github.repository == 'bcgit/bc-rust'
+    name: aes-ct-asm
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install nightly with rust-src
+        run: rustup toolchain install nightly --profile minimal --component rust-src
+
+      - name: Check the round-key widening assembly on Cortex-M0 and RISC-V 32I
+        run: ./dev_scripts/check_aes_ct_asm.sh

.gitignore

@@ -21,3 +21,4 @@ custom_mutants_output/
 !.claude/agents/
 .claude/settings.local.json
 .claude 2/
+dev_scripts/aes_ct_harness/Cargo.lock

CLAUDE.md

@@ -43,7 +43,8 @@ Revisit this section at the first non-alpha release.
 
 - Builds on Rust **stable**: there is no toolchain pin, and no crate enables a `#![feature(...)]` gate, so
   nightly-only tooling (`-Z` flags and the like) is not available. CI builds, tests and docs on stable; only the
-  `rustfmt` job installs nightly.
+  `rustfmt` job and the AES assembly check (`-Zbuild-std=core` for targets without a shipped `core`) install
+  nightly.
 - 2024 edition (set workspace-wide in the root `Cargo.toml`).
 - Minimum Rust is 1.88: `rust-version` in the root `Cargo.toml`, inherited by `bouncycastle-utils` (the crate that
   needs it, for `slice::as_chunks`) and so enforced for every crate that depends on it.
@@ -326,12 +327,15 @@ external vector suites — is specified in QUALITY_AND_STYLE.md and CONTRIBUTING
 
 ## CI
 
-Five workflows under `.github/workflows/`, all triggered by pull requests:
+Six workflows under `.github/workflows/`, all triggered by pull requests:
 
 - `rust-build.yml`: `cargo build --workspace --all-targets --all-features` on stable.
 - `rust-test.yml`: `cargo test --all` on stable.
 - `rust-style.yml`: `cargo fmt --all --check` on **nightly** rustfmt, so format before every commit.
 - `rust-docs.yml`: `cargo doc --all` on stable.
+- `aes-ct-asm.yml`: `dev_scripts/check_aes_ct_asm.sh` on **nightly** with `rust-src`: builds
+  `dev_scripts/aes_ct_harness` for thumbv6m and riscv32i and greps the assembly of the AES round-key
+  widening for a multiply, call or branch (see the comment on `PlaneWord::splat` in the aes crate).
 - `publish_doc_benches_to_ghpages.yaml`: builds rustdoc and runs `quality_stats.sh`; on `main` it also
   publishes docs and code stats to GitHub Pages (`https://bcgit.github.io/bc-rust/`). Its bench step is
   commented out because the benches are too slow on the hosted runner, so benchmark figures come from a

README.md

@@ -124,6 +124,20 @@ You can build the main library and the `bc-rust` command-line utility with:
 cargo build -p cli
 ```
 
+The utility exposes every primitive as a streaming stdin-to-stdout subcommand; `bc-rust --help`
+lists them and `bc-rust <subcommand> --help` the flags. For example:
+
+```
+echo -n abc | target/debug/bc-rust sha256 -x
+target/debug/bc-rust rng --len 32 > key.bin
+target/debug/bc-rust aes256-gcm -d encrypt --key-file key.bin < plain > cipher
+target/debug/bc-rust aes256-gcm -d decrypt --key-file key.bin < cipher
+```
+
+Values given inline (`--key`, `--iv`, ...) are hex; files are raw bytes, or hex text with the global
+`--hex-input` flag. The shell tests under `cli/tests/` (`cli/tests/test_all.sh`) show every
+subcommand in use.
+
 Or you can build a single sub-crate by name, for example:
 
 ```

cli/src/aes_ccm_cmd.rs

@@ -45,7 +45,6 @@
 //!
 //! The output layout is Sec 6.1 step 8's own: `ciphertext || tag`.
 
-use std::io::{self, Read};
 use std::process::exit;
 
 use bouncycastle::aes::{AES128Key, AES192Key, AES256Key};
@@ -55,7 +54,6 @@ use bouncycastle::core::key_material::KeyMaterial;
 use bouncycastle::core::symmetric_key::{
     AeadDeclaredDecryptionKey, AeadDeclaredEncryptionKey, FromKeyMaterial,
 };
-use bouncycastle::hex;
 
 use crate::helpers;
 use crate::helpers::block_mode_helpers::{CipherDirection, load_key};
@@ -89,6 +87,7 @@ impl CcmKeys<32> for Aes256 {
 }
 
 /// AES-128 CCM. See the module docs and the subcommand help.
+#[allow(clippy::too_many_arguments)] // one flag per input, each inline or from a file
 pub(crate) fn aes128_ccm_cmd(
     action: &CipherDirection,
     key: &Option<String>,
@@ -113,6 +112,7 @@ pub(crate) fn aes128_ccm_cmd(
 }
 
 /// AES-192 CCM. See [`aes128_ccm_cmd`].
+#[allow(clippy::too_many_arguments)] // one flag per input, each inline or from a file
 pub(crate) fn aes192_ccm_cmd(
     action: &CipherDirection,
     key: &Option<String>,
@@ -137,6 +137,7 @@ pub(crate) fn aes192_ccm_cmd(
 }
 
 /// AES-256 CCM. See [`aes128_ccm_cmd`].
+#[allow(clippy::too_many_arguments)] // one flag per input, each inline or from a file
 pub(crate) fn aes256_ccm_cmd(
     action: &CipherDirection,
     key: &Option<String>,
@@ -165,10 +166,10 @@ pub(crate) fn aes256_ccm_cmd(
 /// Unlike the key there is no entropy question here: Sec 5.3 asks for uniqueness, not randomness,
 /// so an all-zero nonce is a perfectly valid *first* nonce and only a repeat is a problem.
 ///
-/// `--nonce-file` reads raw bytes ([`helpers::read_from_file_raw`]), not the hex-or-raw guess
-/// [`helpers::read_from_file`] uses for keys: a repeated nonce under one key is fatal for CCM (see
-/// the module docs), so two distinct binary nonce files that happen to look like hex text of the
-/// same value must not silently collapse to the same nonce.
+/// `--nonce-file` reads raw bytes (hex only under the global `--hex-input`), never a guess from
+/// the contents: a repeated nonce under one key is fatal for CCM (see the module docs), so two
+/// distinct binary nonce files that happen to look like hex text of the same value must not
+/// silently collapse to the same nonce.
 ///
 /// For the same reason a trailing newline is **not** stripped: a 13-byte file ending in `0x0a` and
 /// the 12-byte file without it are two different nonces, and silently treating them as one would
@@ -178,8 +179,8 @@ pub(crate) fn aes256_ccm_cmd(
 /// is not a silent one; the bytes are still used exactly as they are.
 fn load_nonce(nonce: &Option<String>, nonce_file: &Option<String>) -> Vec<u8> {
     let bytes = if let Some(file) = nonce_file {
-        let bytes = helpers::read_from_file_raw(file);
-        if bytes.last() == Some(&b'\n') {
+        let bytes = helpers::read_input_file(file);
+        if !helpers::hex_input() && bytes.last() == Some(&b'\n') {
             eprintln!(
                 "Warning: nonce file '{file}' ends with a newline byte (0x0a), which is used as \
                  part of the nonce."
@@ -191,10 +192,7 @@ fn load_nonce(nonce: &Option<String>, nonce_file: &Option<String>) -> Vec<u8> {
         }
         bytes
     } else if let Some(v) = nonce {
-        hex::decode(v).unwrap_or_else(|_| {
-            eprintln!("Error: nonce is not valid hex.");
-            exit(-1)
-        })
+        helpers::decode_hex_arg(v, "nonce")
     } else {
         eprintln!("Error: --nonce or --nonce-file must be supplied. CCM has no generated nonce;");
         eprintln!("       see the subcommand help for why, and for the uniqueness requirement.");
@@ -215,31 +213,20 @@ fn load_nonce(nonce: &Option<String>, nonce_file: &Option<String>) -> Vec<u8> {
 /// Loads the AAD from `--aad-file` (raw bytes, never hex-decoded) or `--aad` (hex); the file wins
 /// if both are given, as for `aes*-gcm`. Empty if neither is given.
 fn load_aad(aad: &Option<String>, aad_file: &Option<String>) -> Vec<u8> {
-    if let Some(path) = aad_file {
-        helpers::read_from_file_raw(path)
-    } else if let Some(v) = aad {
-        hex::decode(v).unwrap_or_else(|_| {
-            eprintln!("Error: associated data is not valid hex. Use --aad-file for raw bytes.");
-            exit(-1)
-        })
-    } else {
-        Vec::new()
+    match (aad_file, aad) {
+        (Some(path), _) => helpers::read_input_file(path),
+        (None, Some(v)) => helpers::decode_hex_arg(v, "aad"),
+        (None, None) => Vec::new(),
     }
 }
 
-/// Reads all of stdin. See the module docs on why this is not a streaming command.
-fn read_all_stdin() -> Vec<u8> {
-    let mut input = Vec::new();
-    io::stdin().read_to_end(&mut input).expect("Failed to read from stdin");
-    input
-}
-
 /// Turns the runtime nonce and tag lengths into the mode's const generic parameters.
 ///
 /// `NONCE_LEN` and `TAG_LEN` are const parameters of the key type -- that is what makes A.1's
 /// length conditions compile-time checks rather than runtime ones -- so a command-line value has to
 /// be matched into one of the permitted instantiations. The two nested matches are the price of
 /// that, and they are exhaustive over A.1's sets: 7 nonce lengths x 7 tag lengths.
+#[allow(clippy::too_many_arguments)] // the three key lengths' inputs, already parsed
 fn run<F: CcmKeys<KEY_LEN>, const KEY_LEN: usize>(
     action: &CipherDirection,
     key: &KeyMaterial<KEY_LEN>,
@@ -262,7 +249,8 @@ fn run<F: CcmKeys<KEY_LEN>, const KEY_LEN: usize>(
 
     let nonce_bytes = load_nonce(nonce, nonce_file);
     let aad = load_aad(aad, aad_file);
-    let input = read_all_stdin();
+    // See the module docs on why this is not a streaming command.
+    let input = helpers::read_stdin_all();
     let encrypt = matches!(action, CipherDirection::Encrypt);
 
     macro_rules! with_tag_len {

cli/src/aes_gcm_cmd.rs

@@ -19,6 +19,7 @@ use bouncycastle::aes::{AES128Key, AES192Key, AES256Key};
 use bouncycastle::cipher::modes::GCM;
 use bouncycastle::core::symmetric_key::{AeadDecryptionKey, AeadEncryptionKey};
 
+#[allow(clippy::too_many_arguments)] // one flag per input, each inline or from a file
 pub(crate) fn aes128_gcm_cmd(
     action: &CipherDirection,
     key: &Option<String>,
@@ -38,6 +39,7 @@ pub(crate) fn aes128_gcm_cmd(
     );
 }
 
+#[allow(clippy::too_many_arguments)] // one flag per input, each inline or from a file
 pub(crate) fn aes192_gcm_cmd(
     action: &CipherDirection,
     key: &Option<String>,
@@ -57,6 +59,7 @@ pub(crate) fn aes192_gcm_cmd(
     );
 }
 
+#[allow(clippy::too_many_arguments)] // one flag per input, each inline or from a file
 pub(crate) fn aes256_gcm_cmd(
     action: &CipherDirection,
     key: &Option<String>,