--- title: Investigating why RustCrypto is slow: Deep dive into... description: A deep dive into why RustCrypto's AES-256-GCM implementation is slower than alternatives like aws-lc-rs and stdx/crypto, despite recent VAES512 and ARMv8 AES... canonical: https://daily.dev/posts/investigating-why-rustcrypto-is-slow-deep-dive-into-simd-instructions-and-hardware-acceleration-tnhvapubj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Investigating why RustCrypto is slow: Deep dive into SIMD instructions and hardware acceleration | daily.dev og:description: A deep dive into why RustCrypto's AES-256-GCM implementation is slower than alternatives like aws-lc-rs and stdx/crypto, despite recent VAES512 and ARMv8 AES... og:url: https://daily.dev/posts/investigating-why-rustcrypto-is-slow-deep-dive-into-simd-instructions-and-hardware-acceleration-tnhvapubj og:image: https://api.daily.dev/og/posts/TNhvAPubJ.png og:image:alt: Investigating why RustCrypto is slow: Deep dive into SIMD instructions and hardware acceleration og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Investigating why RustCrypto is slow: Deep dive into SIMD instructions and hardware acceleration **[Sylvain Kerkour](https://daily.dev/sources/kerkour)** · 13 min read · 0 upvotes · 0 comments ## Summary A deep dive into why RustCrypto's AES-256-GCM implementation is slower than alternatives like aws-lc-rs and stdx/crypto, despite recent VAES512 and ARMv8 AES instruction support. The root cause is a two-pass architecture: RustCrypto first encrypts with AES-CTR, then computes the GHash authentication tag separately, causing expensive repeated loads and stores to SIMD registers. The fix is interleaving encryption and hashing in a single pass, keeping data hot in SIMD registers. The post also covers SIMD fundamentals in Rust — load/compute/store patterns, intrinsics via core::arch, register counts, and how algorithms like ChaCha20 and BLAKE3 achieve full speed through parallelism. The author notes that 37% of cryptographic library vulnerabilities are memory safety issues, making pure Rust a compelling replacement for C and assembly in crypto code. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is RustCrypto's AES-256-GCM slower than aws-lc-rs or stdx/crypto even with AVX-512 support? RustCrypto's AES-GCM performs two separate passes over the data: one for AES-CTR encryption and one for GHash authentication tag computation. Each pass requires loading data into SIMD registers and storing it back to memory, incurring significant latency penalties twice. Alternatives like stdx/crypto interleave encryption and hashing in a single pass, keeping data hot in SIMD registers and avoiding the redundant memory round-trips. _Rust crypto performance trade-offs like this one surface regularly for developers building secure systems — daily.dev keeps that conversation in one place._ ### How do I use SIMD intrinsics in pure Rust for cryptographic algorithms? Rust exposes architecture-specific SIMD intrinsics through the core::arch module. You annotate functions with #[target_feature(enable = "avx2")] (or the relevant ISA), then use types like __m256i for 256-bit AVX2 registers and functions like _mm256_add_epi32 or _mm256_xor_si256 for operations. The pattern is load data into vector registers, perform parallel computation, then store results back to memory — minimizing load/store operations keeps data hot in registers. _Developers writing SIMD-accelerated Rust find the latest ecosystem patterns and library releases on daily.dev._ ### What percentage of vulnerabilities in cryptographic libraries are memory safety issues? More than 37% of vulnerabilities in cryptographic libraries are memory safety issues. This statistic supports the argument that C and assembly implementations of cryptographic primitives carry significant risk, and that pure Rust — which eliminates entire classes of memory safety bugs — is a compelling replacement for security-critical crypto code. _For developers choosing between Rust and C/assembly for crypto work, daily.dev surfaces the research and real-world cases that inform that decision._ ## Similar posts on daily.dev - [SIMD programming in pure Rust](https://daily.dev/posts/simd-programming-in-pure-rust-idnkdlsse) · Hacker News · 2 upvotes · 0 comments - [Why is calling my asm function from Rust slower than calling it from C?](https://daily.dev/posts/why-is-calling-my-asm-function-from-rust-slower-than-calling-it-from-c--h7khzgipm) · Lobsters · 0 upvotes · 0 comments - [Implementing FMA and finding bugs in C and Rust standard libraries](https://daily.dev/posts/implementing-fma-and-finding-bugs-in-c-and-rust-standard-libraries-kdjaxc6j0) · Lobsters · 0 upvotes · 1 comments --- Tags: [#performance](https://daily.dev/tags/performance), [#rust](https://daily.dev/tags/rust), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/investigating-why-rustcrypto-is-slow-deep-dive-into-simd-instructions-and-hardware-acceleration-tnhvapubj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Investigating why RustCrypto is slow: Deep dive into SIMD instructions and hardware acceleration","url":"https://daily.dev/posts/investigating-why-rustcrypto-is-slow-deep-dive-into-simd-instructions-and-hardware-acceleration-tnhvapubj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/investigating-why-rustcrypto-is-slow-deep-dive-into-simd-instructions-and-hardware-acceleration-tnhvapubj"},"datePublished":"2026-08-11T08:56:26.512Z","dateModified":"2026-08-11T09:32:05.818Z","description":"A deep dive into why RustCrypto's AES-256-GCM implementation is slower than alternatives like aws-lc-rs and stdx/crypto, despite recent VAES512 and ARMv8 AES...","image":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","thumbnailUrl":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","isAccessibleForFree":true,"articleSection":"Sylvain Kerkour","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sylvain Kerkour","logo":"https://media.daily.dev/image/upload/s--3ngWt4Yp--/f_auto,q_auto/v1786438308/logos/kerkour?_a=BAMAMicg0","url":"https://daily.dev/sources/kerkour"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/investigating-why-rustcrypto-is-slow-deep-dive-into-simd-instructions-and-hardware-acceleration-tnhvapubj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"performance,rust,cryptography","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sylvain Kerkour","item":"https://daily.dev/sources/kerkour"},{"@type":"ListItem","position":3,"name":"Investigating why RustCrypto is slow: Deep dive into SIMD instructions and hardware acceleration"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/investigating-why-rustcrypto-is-slow-deep-dive-into-simd-instructions-and-hardware-acceleration-tnhvapubj#faq","mainEntity":[{"@type":"Question","name":"Why is RustCrypto's AES-256-GCM slower than aws-lc-rs or stdx/crypto even with AVX-512 support?","acceptedAnswer":{"@type":"Answer","text":"RustCrypto's AES-GCM performs two separate passes over the data: one for AES-CTR encryption and one for GHash authentication tag computation. Each pass requires loading data into SIMD registers and storing it back to memory, incurring significant latency penalties twice. Alternatives like stdx/crypto interleave encryption and hashing in a single pass, keeping data hot in SIMD registers and avoiding the redundant memory round-trips. Rust crypto performance trade-offs like this one surface regularly for developers building secure systems — daily.dev keeps that conversation in one place."}},{"@type":"Question","name":"How do I use SIMD intrinsics in pure Rust for cryptographic algorithms?","acceptedAnswer":{"@type":"Answer","text":"Rust exposes architecture-specific SIMD intrinsics through the core::arch module. You annotate functions with #[target_feature(enable = \"avx2\")] (or the relevant ISA), then use types like __m256i for 256-bit AVX2 registers and functions like _mm256_add_epi32 or _mm256_xor_si256 for operations. The pattern is load data into vector registers, perform parallel computation, then store results back to memory — minimizing load/store operations keeps data hot in registers. Developers writing SIMD-accelerated Rust find the latest ecosystem patterns and library releases on daily.dev."}},{"@type":"Question","name":"What percentage of vulnerabilities in cryptographic libraries are memory safety issues?","acceptedAnswer":{"@type":"Answer","text":"More than 37% of vulnerabilities in cryptographic libraries are memory safety issues. This statistic supports the argument that C and assembly implementations of cryptographic primitives carry significant risk, and that pure Rust — which eliminates entire classes of memory safety bugs — is a compelling replacement for security-critical crypto code. For developers choosing between Rust and C/assembly for crypto work, daily.dev surfaces the research and real-world cases that inform that decision."}}]} ```