crypto::aes

AES, from FIPS 197.

The block cipher under the second half of WPA2/WPA3: CCMP encrypts data frames with AES in CCM mode, the GTK arrives key-wrapped with AES, and the EAPOL-Key MIC on modern APs is AES-CMAC. All of those are modes built on a single 16-byte block operation, which is what this provides — [Aes128] and [Aes256], each with encrypt_block and decrypt_block. The modes themselves live in their own modules over this one.

Side channels, stated plainly

This is a table-driven software AES: SubBytes indexes a 256-byte S-box. On a machine with a data cache that is a timing side channel on the key, and this implementation does not defend against it. Two things make that acceptable here and both are recorded rather than assumed: the ESP32 reaches the S-box in DRAM without a data cache in the desktop sense, and — the real point — the production path is the AES hardware accelerator (#33), which is constant-time. This software core is the reference the accelerator is checked against and the fallback when it is absent, exactly as the module docs describe for the hashes. Where a caller has a secret and no accelerator, that trade-off is theirs to note.

Structs

Aes128

struct Aes128(/* private */);

AES-128: a 16-byte key, 10 rounds.

Implements: Clone

Aes256

struct Aes256(/* private */);

AES-256: a 32-byte key, 14 rounds.

Implements: Clone