EME2 Mode (wide-block mode)

まず既存の eme2 crate と IEEE P1619.2 ベースの設計を確認し、次にその API を RustCrypto block-modes エコシステムと比較します。報告されている AES および Serpent のテストと ciphertext-stealing の動作を確認します。合意された upstream 統合パス、互換性のある公開 API、適切なテストベクトルが揃えば完了です。

Hi everyone!

I would like to propose adding the EME2 (Encrypt-Mix-Encrypt Version 2) mode of operation to the RustCrypto workspace. I've implemented it in pure Rust based on the IEEE P1619.2 specification, and it is currently published independently on crates.io as eme2.

If merged, this would introduce the first truly wide-block encryption mode to the RustCrypto block-modes ecosystem.

Implementation Details

• Pure Rust: The current crate is written entirely in Rust.
• It is EME2, not EME: It implements the ciphertext stealing logic described in the "EME*" which is standard for the EME2. No padding required.
• Cipher Agnostic: It is successfully tested against RustCrypto's aes and serpent backends.
• Testing: Verified against self-computed test vectors. (Note: I can integrate the official IEEE 1619.2 test vectors during the PR process, IF any of you have the IEEE PDF or test vectors for EME2 which are hidden behind paywall).

API Design & Trait Compatibility

I have designed the API to be as compatible as possible with the broader RustCrypto ecosystem, but there is one necessary architectural divergence:

Because EME2 is a two-pass wide-block cipher mode, it inherently requires different logic for encryption and decryption. Therefore, it cannot implement the StreamCipher trait's .apply_keystream() method (where encryption and decryption are identical XOR operations). Instead, the crate currently exposes explicit .encrypt() and .decrypt() methods to handle the distinct multi-pass operations. There is simply NO way to squeeze EME2 into a single .apply_keystream operation per it's design.

It is documented in the crate descriptions as well as edge case with the threefish cipher.

Next Steps

I would love to upstream this into the RustCrypto organization so others can easily access a modern, wide-block mode.

Are the maintainers open to a Pull Request for this? If so, I am more than happy to open PR request or hear recommendation before submitting.