Move AES-GCM-SIV implementation into rust/crypto

Cargo.lock

@@ -26,23 +26,6 @@ dependencies = [
  "cipher",
 ]
 
-[[package]]
-name = "aes-gcm-siv"
-version = "0.1.0"
-dependencies = [
- "aes-soft",
- "aesni",
- "cipher",
- "criterion",
- "generic-array",
- "hex",
- "libc",
- "polyval",
- "serde",
- "serde_json",
- "subtle",
-]
-
 [[package]]
 name = "aes-soft"
 version = "0.6.4"
@@ -765,7 +748,6 @@ checksum = "c7d73b3f436185384286bd8098d17ec07c9a7d2388a6599f824d8502b529702a"
 name = "libsignal-bridge"
 version = "0.1.0"
 dependencies = [
- "aes-gcm-siv",
  "async-trait",
  "device-transfer",
  "futures",
@@ -800,7 +782,6 @@ dependencies = [
 name = "libsignal-ffi"
 version = "0.3.1"
 dependencies = [
- "aes-gcm-siv",
  "async-trait",
  "device-transfer",
  "libc",
@@ -816,7 +797,6 @@ dependencies = [
 name = "libsignal-jni"
 version = "0.3.4"
 dependencies = [
- "aes-gcm-siv",
  "async-trait",
  "jni",
  "libsignal-bridge",
@@ -824,6 +804,7 @@ dependencies = [
  "log",
  "log-panics",
  "rand 0.7.3",
+ "signal-crypto",
 ]
 
 [[package]]
@@ -1690,12 +1671,18 @@ dependencies = [
 name = "signal-crypto"
 version = "0.1.0"
 dependencies = [
- "aes",
- "block-modes",
- "ctr",
+ "aes-soft",
+ "aesni",
+ "cipher",
+ "criterion",
+ "generic-array",
  "hex",
  "hmac",
+ "libc",
+ "polyval",
  "rand 0.7.3",
+ "serde",
+ "serde_json",
  "sha-1",
  "sha2",
  "subtle",

Cargo.toml

@@ -1,6 +1,5 @@
 [workspace]
 members = [
-    "rust/aes-gcm-siv",
     "rust/crypto",
     "rust/device-transfer",
     "rust/poksho",
@@ -10,7 +9,6 @@ members = [
     "rust/bridge/node",
 ]
 default-members = [
-    "rust/aes-gcm-siv",
     "rust/crypto",
     "rust/device-transfer",
     "rust/poksho",

rust/aes-gcm-siv/Cargo.toml

@@ -1,36 +0,0 @@
-#
-# Copyright (C) 2020 Signal Messenger, LLC.
-# SPDX-License-Identifier: AGPL-3.0-only
-#
-
-[package]
-name = "aes-gcm-siv"
-version = "0.1.0"
-authors = ["Jack Lloyd <jack@signal.org>"]
-edition = "2018"
-license = "AGPL-3.0-only"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-aes-soft = "0.6"
-polyval = "0.4"
-subtle = "2.3"
-cipher = "0.2"
-generic-array = "0.14"
-
-[target.'cfg(all(target_arch = "aarch64", any(target_os = "linux")))'.dependencies]
-libc = "0.2" # for getauxval
-
-[target.'cfg(any(target_arch = "x86", target_arch = "x86_64"))'.dependencies]
-aesni = { version = "0.10", features = ["nocheck"] }
-
-[dev-dependencies]
-serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
-hex = "0.4"
-criterion = "0.3"
-
-[[bench]]
-name = "aes_gcm_siv"
-harness = false

rust/aes-gcm-siv/README.md

@@ -1,27 +0,0 @@
-# Overview
-
-aes-gcm-siv is an implementation of AES-GCM-SIV (RFC 8452) using AES-256. It
-supports runtime detection of x86 and ARMv8 instructions which accelerate the
-AES and POLYVAL computations.
-
-Work in progress.  Subject to change without notice, use outside Signal not yet recommended.
-
-# Legal things
-## Cryptography Notice
-
-This distribution includes cryptographic software. The country in which you currently reside may have restrictions on
-the import, possession, use, and/or re-export to another country, of encryption software.  BEFORE using any encryption
-software, please check your country's laws, regulations and policies concerning the import, possession, or use, and
-re-export of encryption software, to see if this is permitted.  See <http://www.wassenaar.org/> for more information.
-
-The U.S. Government Department of Commerce, Bureau of Industry and Security (BIS), has classified this software as
-Export Commodity Control Number (ECCN) 5D002.C.1, which includes information security software using or performing
-cryptographic functions with asymmetric algorithms.  The form and manner of this distribution makes it eligible for
-export under the License Exception ENC Technology Software Unrestricted (TSU) exception (see the BIS Export
-Administration Regulations, Section 740.13) for both object code and source code.
-
-## License
-
-Copyright 2020 Signal Messenger, LLC
-
-Licensed under the GPLv3: http://www.gnu.org/licenses/gpl-3.0.html

rust/aes-gcm-siv/src/error.rs

@@ -1,29 +0,0 @@
-//
-// Copyright 2020 Signal Messenger, LLC.
-// SPDX-License-Identifier: AGPL-3.0-only
-//
-
-use std::fmt;
-
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub enum Error {
-    InvalidKeySize,
-    InvalidNonceSize,
-    InvalidInputSize,
-    InvalidTag,
-}
-
-pub type Result<T> = std::result::Result<T, Error>;
-
-impl fmt::Display for Error {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        let err_msg = match self {
-            Error::InvalidKeySize => "invalid AES-GCM-SIV key size",
-            Error::InvalidNonceSize => "invalid AES-GCM-SIV nonce size",
-            Error::InvalidInputSize => "invalid AES-GCM-SIV input size",
-            Error::InvalidTag => "invalid AES-GCM-SIV tag",
-        };
-
-        write!(f, "{}", err_msg)
-    }
-}

rust/aes-gcm-siv/src/lib.rs

@@ -1,17 +0,0 @@
-//
-// Copyright 2020 Signal Messenger, LLC.
-// SPDX-License-Identifier: AGPL-3.0-only
-//
-
-#![cfg_attr(target_arch = "aarch64", feature(stdsimd))]
-#![cfg_attr(target_arch = "aarch64", feature(aarch64_target_feature))]
-#![deny(clippy::unwrap_used)]
-
-mod aes;
-mod aes_gcm_siv;
-mod cpuid;
-pub mod error;
-mod polyval;
-
-pub use crate::aes_gcm_siv::Aes256GcmSiv;
-pub use crate::error::Error;

rust/bridge/ffi/Cargo.toml

@@ -16,7 +16,6 @@ crate-type = ["staticlib"]
 
 [dependencies]
 libsignal-protocol = { path = "../../protocol" }
-aes-gcm-siv = { path = "../../aes-gcm-siv" }
 device-transfer = { path = "../../device-transfer" }
 signal-crypto = { path = "../../crypto" }
 libsignal-bridge = { path = "../shared", features = ["ffi"] }

rust/bridge/ffi/src/util.rs

@@ -3,7 +3,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 //
 
-use aes_gcm_siv::Error as AesGcmSivError;
 use device_transfer::Error as DeviceTransferError;
 use libc::{c_char, c_uchar, size_t};
 use libsignal_bridge::ffi::*;
@@ -101,7 +100,6 @@ impl From<&SignalFfiError> for SignalErrorCode {
             | SignalFfiError::Signal(SignalProtocolError::BadKeyType(_))
             | SignalFfiError::Signal(SignalProtocolError::BadKeyLength(_, _))
             | SignalFfiError::DeviceTransfer(DeviceTransferError::KeyDecodingFailed)
-            | SignalFfiError::AesGcmSiv(AesGcmSivError::InvalidKeySize)
             | SignalFfiError::SignalCrypto(SignalCryptoError::InvalidKeySize) => {
                 SignalErrorCode::InvalidKey
             }
@@ -124,7 +122,6 @@ impl From<&SignalFfiError> for SignalErrorCode {
 
             SignalFfiError::Signal(SignalProtocolError::CiphertextMessageTooShort(_))
             | SignalFfiError::Signal(SignalProtocolError::InvalidCiphertext)
-            | SignalFfiError::AesGcmSiv(AesGcmSivError::InvalidTag)
             | SignalFfiError::SignalCrypto(SignalCryptoError::InvalidTag) => {
                 SignalErrorCode::InvalidCiphertext
             }
@@ -159,7 +156,6 @@ impl From<&SignalFfiError> for SignalErrorCode {
             }
 
             SignalFfiError::Signal(SignalProtocolError::InvalidArgument(_))
-            | SignalFfiError::AesGcmSiv(_)
             | SignalFfiError::SignalCrypto(_) => SignalErrorCode::InvalidArgument,
 
             SignalFfiError::Signal(SignalProtocolError::ApplicationCallbackError(_, _)) => {

rust/bridge/jni/Cargo.toml

@@ -16,7 +16,7 @@ crate-type = ["cdylib"]
 
 [dependencies]
 libsignal-protocol = { path = "../../protocol" }
-aes-gcm-siv = { path = "../../aes-gcm-siv" }
+signal-crypto = { path = "../../crypto" }
 libsignal-bridge = { path = "../shared", features = ["jni"] }
 async-trait = "0.1.41"
 jni = "0.19"

rust/bridge/shared/Cargo.toml

@@ -12,7 +12,6 @@ license = "AGPL-3.0-only"
 
 [dependencies]
 libsignal-protocol = { path = "../../protocol" }
-aes-gcm-siv = { path = "../../aes-gcm-siv" }
 signal-crypto = { path = "../../crypto" }
 device-transfer = { path = "../../device-transfer" }
 libsignal-bridge-macros = { path = "macros" }

rust/bridge/shared/src/aes_gcm_siv.rs

@@ -1,49 +0,0 @@
-//
-// Copyright 2021 Signal Messenger, LLC.
-// SPDX-License-Identifier: AGPL-3.0-only
-//
-
-use ::aes_gcm_siv;
-use aes_gcm_siv::error::Result;
-use aes_gcm_siv::Aes256GcmSiv;
-use libsignal_bridge_macros::*;
-
-use crate::support::*;
-use crate::*;
-
-bridge_handle!(Aes256GcmSiv, clone = false);
-
-#[bridge_fn]
-fn Aes256GcmSiv_New(key: &[u8]) -> Result<Aes256GcmSiv> {
-    aes_gcm_siv::Aes256GcmSiv::new(&key)
-}
-
-#[bridge_fn_buffer]
-fn Aes256GcmSiv_Encrypt<T: Env>(
-    env: T,
-    aes_gcm_siv: &Aes256GcmSiv,
-    ptext: &[u8],
-    nonce: &[u8],
-    associated_data: &[u8],
-) -> Result<T::Buffer> {
-    let mut buf = Vec::with_capacity(ptext.len() + 16);
-    buf.extend_from_slice(ptext);
-
-    let gcm_tag = aes_gcm_siv.encrypt(&mut buf, &nonce, &associated_data)?;
-    buf.extend_from_slice(&gcm_tag);
-
-    Ok(env.buffer(buf))
-}
-
-#[bridge_fn_buffer]
-fn Aes256GcmSiv_Decrypt<T: Env>(
-    env: T,
-    aes_gcm_siv: &Aes256GcmSiv,
-    ctext: &[u8],
-    nonce: &[u8],
-    associated_data: &[u8],
-) -> Result<T::Buffer> {
-    let mut buf = ctext.to_vec();
-    aes_gcm_siv.decrypt_with_appended_tag(&mut buf, &nonce, &associated_data)?;
-    Ok(env.buffer(buf))
-}

rust/bridge/shared/src/crypto.rs

@@ -12,6 +12,42 @@ use crate::*;
 
 bridge_handle!(CryptographicHash, mut = true, ffi = false, node = false);
 bridge_handle!(CryptographicMac, mut = true, ffi = false, node = false);
+bridge_handle!(Aes256GcmSiv, clone = false);
+
+#[bridge_fn]
+fn Aes256GcmSiv_New(key: &[u8]) -> Result<Aes256GcmSiv> {
+    Aes256GcmSiv::new(&key)
+}
+
+#[bridge_fn_buffer]
+fn Aes256GcmSiv_Encrypt<T: Env>(
+    env: T,
+    aes_gcm_siv: &Aes256GcmSiv,
+    ptext: &[u8],
+    nonce: &[u8],
+    associated_data: &[u8],
+) -> Result<T::Buffer> {
+    let mut buf = Vec::with_capacity(ptext.len() + 16);
+    buf.extend_from_slice(ptext);
+
+    let gcm_tag = aes_gcm_siv.encrypt(&mut buf, &nonce, &associated_data)?;
+    buf.extend_from_slice(&gcm_tag);
+
+    Ok(env.buffer(buf))
+}
+
+#[bridge_fn_buffer]
+fn Aes256GcmSiv_Decrypt<T: Env>(
+    env: T,
+    aes_gcm_siv: &Aes256GcmSiv,
+    ctext: &[u8],
+    nonce: &[u8],
+    associated_data: &[u8],
+) -> Result<T::Buffer> {
+    let mut buf = ctext.to_vec();
+    aes_gcm_siv.decrypt_with_appended_tag(&mut buf, &nonce, &associated_data)?;
+    Ok(env.buffer(buf))
+}
 
 #[bridge_fn(ffi = false, node = false)]
 fn CryptographicHash_New(algo: String) -> Result<CryptographicHash> {

rust/bridge/shared/src/ffi/convert.rs

@@ -262,13 +262,6 @@ impl<T: ResultTypeInfo> ResultTypeInfo for Result<T, SignalProtocolError> {
     }
 }
 
-impl<T: ResultTypeInfo> ResultTypeInfo for Result<T, aes_gcm_siv::Error> {
-    type ResultType = T::ResultType;
-    fn convert_into(self) -> SignalFfiResult<Self::ResultType> {
-        T::convert_into(self?)
-    }
-}
-
 impl<T: ResultTypeInfo> ResultTypeInfo for Result<T, device_transfer::Error> {
     type ResultType = T::ResultType;
     fn convert_into(self) -> SignalFfiResult<Self::ResultType> {

rust/bridge/shared/src/ffi/error.rs

@@ -6,7 +6,6 @@
 use std::convert::TryFrom;
 use std::fmt;
 
-use aes_gcm_siv::Error as AesGcmSivError;
 use device_transfer::Error as DeviceTransferError;
 use libsignal_protocol::*;
 use signal_crypto::Error as SignalCryptoError;
@@ -15,7 +14,6 @@ use signal_crypto::Error as SignalCryptoError;
 #[derive(Debug)]
 pub enum SignalFfiError {
     Signal(SignalProtocolError),
-    AesGcmSiv(AesGcmSivError),
     DeviceTransfer(DeviceTransferError),
     SignalCrypto(SignalCryptoError),
     InsufficientOutputSize(usize, usize),
@@ -29,9 +27,6 @@ impl fmt::Display for SignalFfiError {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match self {
             SignalFfiError::Signal(s) => write!(f, "{}", s),
-            SignalFfiError::AesGcmSiv(c) => {
-                write!(f, "AES-GCM-SIV operation failed: {}", c)
-            }
             SignalFfiError::DeviceTransfer(c) => {
                 write!(f, "Device transfer operation failed: {}", c)
             }
@@ -59,12 +54,6 @@ impl From<SignalProtocolError> for SignalFfiError {
     }
 }
 
-impl From<AesGcmSivError> for SignalFfiError {
-    fn from(e: AesGcmSivError) -> SignalFfiError {
-        SignalFfiError::AesGcmSiv(e)
-    }
-}
-
 impl From<DeviceTransferError> for SignalFfiError {
     fn from(e: DeviceTransferError) -> SignalFfiError {
         SignalFfiError::DeviceTransfer(e)

rust/bridge/shared/src/jni/convert.rs

@@ -366,13 +366,6 @@ impl<T: ResultTypeInfo> ResultTypeInfo for Result<T, SignalProtocolError> {
     }
 }
 
-impl<T: ResultTypeInfo> ResultTypeInfo for Result<T, aes_gcm_siv::Error> {
-    type ResultType = T::ResultType;
-    fn convert_into(self, env: &JNIEnv) -> SignalJniResult<Self::ResultType> {
-        T::convert_into(self?, env)
-    }
-}
-
 impl<T: ResultTypeInfo> ResultTypeInfo for Result<T, device_transfer::Error> {
     type ResultType = T::ResultType;
     fn convert_into(self, env: &JNIEnv) -> SignalJniResult<Self::ResultType> {

rust/bridge/shared/src/jni/error.rs

@@ -7,7 +7,6 @@ use jni::objects::{GlobalRef, JObject, JString, JThrowable, JValue};
 use jni::{JNIEnv, JavaVM};
 use std::fmt;
 
-use aes_gcm_siv::Error as AesGcmSivError;
 use device_transfer::Error as DeviceTransferError;
 use libsignal_protocol::*;
 use signal_crypto::Error as SignalCryptoError;
@@ -18,7 +17,6 @@ use super::*;
 #[derive(Debug)]
 pub enum SignalJniError {
     Signal(SignalProtocolError),
-    AesGcmSiv(AesGcmSivError),
     DeviceTransfer(DeviceTransferError),
     SignalCrypto(SignalCryptoError),
     Jni(jni::errors::Error),
@@ -33,7 +31,6 @@ impl fmt::Display for SignalJniError {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match self {
             SignalJniError::Signal(s) => write!(f, "{}", s),
-            SignalJniError::AesGcmSiv(s) => write!(f, "{}", s),
             SignalJniError::DeviceTransfer(s) => write!(f, "{}", s),
             SignalJniError::SignalCrypto(s) => write!(f, "{}", s),
             SignalJniError::Jni(s) => write!(f, "JNI error {}", s),
@@ -59,12 +56,6 @@ impl From<SignalProtocolError> for SignalJniError {
     }
 }
 
-impl From<AesGcmSivError> for SignalJniError {
-    fn from(e: AesGcmSivError) -> SignalJniError {
-        SignalJniError::AesGcmSiv(e)
-    }
-}
-
 impl From<DeviceTransferError> for SignalJniError {
     fn from(e: DeviceTransferError) -> SignalJniError {
         SignalJniError::DeviceTransfer(e)

rust/bridge/shared/src/jni/mod.rs

@@ -8,7 +8,6 @@ extern crate jni_crate as jni;
 use jni::objects::{JThrowable, JValue};
 use jni::sys::jobject;
 
-use aes_gcm_siv::Error as AesGcmSivError;
 use device_transfer::Error as DeviceTransferError;
 use libsignal_protocol::*;
 use signal_crypto::Error as SignalCryptoError;
@@ -106,8 +105,6 @@ fn throw_error(env: &JNIEnv, error: SignalJniError) {
         }
 
         SignalJniError::Signal(SignalProtocolError::InvalidArgument(_))
-        | SignalJniError::AesGcmSiv(AesGcmSivError::InvalidInputSize)
-        | SignalJniError::AesGcmSiv(AesGcmSivError::InvalidNonceSize)
         | SignalJniError::SignalCrypto(SignalCryptoError::UnknownAlgorithm(_, _))
         | SignalJniError::SignalCrypto(SignalCryptoError::InvalidInputSize)
         | SignalJniError::SignalCrypto(SignalCryptoError::InvalidNonceSize) => {
@@ -147,7 +144,6 @@ fn throw_error(env: &JNIEnv, error: SignalJniError) {
         | SignalJniError::Signal(SignalProtocolError::SignatureValidationFailed)
         | SignalJniError::Signal(SignalProtocolError::BadKeyType(_))
         | SignalJniError::Signal(SignalProtocolError::BadKeyLength(_, _))
-        | SignalJniError::AesGcmSiv(AesGcmSivError::InvalidKeySize)
         | SignalJniError::SignalCrypto(SignalCryptoError::InvalidKeySize) => {
             "org/whispersystems/libsignal/InvalidKeyException"
         }
@@ -162,7 +158,6 @@ fn throw_error(env: &JNIEnv, error: SignalJniError) {
         | SignalJniError::Signal(SignalProtocolError::InvalidProtobufEncoding)
         | SignalJniError::Signal(SignalProtocolError::ProtobufDecodingError(_))
         | SignalJniError::Signal(SignalProtocolError::InvalidSealedSenderMessage(_))
-        | SignalJniError::AesGcmSiv(AesGcmSivError::InvalidTag)
         | SignalJniError::SignalCrypto(SignalCryptoError::InvalidTag) => {
             "org/whispersystems/libsignal/InvalidMessageException"
         }

rust/bridge/shared/src/lib.rs

@@ -24,7 +24,6 @@ pub mod node;
 #[macro_use]
 mod support;
 
-pub mod aes_gcm_siv;
 pub mod crypto;
 pub mod protocol;
 

rust/bridge/shared/src/node/convert.rs

@@ -575,17 +575,6 @@ impl<'a, T: ResultTypeInfo<'a>> ResultTypeInfo<'a>
     }
 }
 
-impl<'a, T: ResultTypeInfo<'a>> ResultTypeInfo<'a> for Result<T, aes_gcm_siv::Error> {
-    type ResultType = T::ResultType;
-    fn convert_into(self, cx: &mut impl Context<'a>) -> NeonResult<Handle<'a, Self::ResultType>> {
-        match self {
-            Ok(value) => value.convert_into(cx),
-            // FIXME: Use a dedicated Error type?
-            Err(err) => cx.throw_error(err.to_string()),
-        }
-    }
-}
-
 impl<'a, T: ResultTypeInfo<'a>> ResultTypeInfo<'a> for Result<T, device_transfer::Error> {
     type ResultType = T::ResultType;
     fn convert_into(self, cx: &mut impl Context<'a>) -> NeonResult<Handle<'a, Self::ResultType>> {

rust/crypto/Cargo.toml

@@ -1,3 +1,8 @@
+#
+# Copyright (C) 2021 Signal Messenger, LLC.
+# SPDX-License-Identifier: AGPL-3.0-only
+#
+
 [package]
 name = "signal-crypto"
 version = "0.1.0"
@@ -5,12 +10,28 @@ authors = ["Jack Lloyd <jack@signal.org>"]
 edition = "2018"
 
 [dependencies]
-aes = "0.6"
-block-modes = "0.7"
-ctr = "0.6"
-hex = "0.4"
+aes-soft = "0.6"
+polyval = "0.4"
+subtle = "2.3"
+cipher = "0.2"
+generic-array = "0.14"
 hmac = "0.9.0"
 rand = "0.7.3"
 sha-1 = "0.9"
 sha2 = "0.9"
-subtle = "2.2.3"
+
+[target.'cfg(all(target_arch = "aarch64", any(target_os = "linux")))'.dependencies]
+libc = "0.2" # for getauxval
+
+[target.'cfg(any(target_arch = "x86", target_arch = "x86_64"))'.dependencies]
+aesni = { version = "0.10", features = ["nocheck"] }
+
+[dev-dependencies]
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+hex = "0.4"
+criterion = "0.3"
+
+[[bench]]
+name = "aes_gcm_siv"
+harness = false

rust/crypto/src/lib.rs

@@ -3,10 +3,20 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 //
 
+#![cfg_attr(target_arch = "aarch64", feature(stdsimd))]
+#![cfg_attr(target_arch = "aarch64", feature(aarch64_target_feature))]
+#![deny(clippy::unwrap_used)]
+
 mod error;
 mod hash;
 
+mod aes;
+mod aes_gcm_siv;
+mod cpuid;
+mod polyval;
+
 pub use {
+    aes_gcm_siv::Aes256GcmSiv,
     error::{Error, Result},
     hash::{CryptographicHash, CryptographicMac},
 };

rust/crypto/tests/aes_gcm_siv.rs

@@ -51,7 +51,7 @@ struct WycheproofTestSet {
     test_groups: Vec<WycheproofTestGroup>,
 }
 
-fn test_kat(kat: WycheproofTest) -> Result<(), aes_gcm_siv::Error> {
+fn test_kat(kat: WycheproofTest) -> Result<(), signal_crypto::Error> {
     let key = hex::decode(kat.key).expect("valid hex");
     let aad = hex::decode(kat.aad).expect("valid hex");
     let nonce = hex::decode(kat.nonce).expect("valid hex");
@@ -65,7 +65,7 @@ fn test_kat(kat: WycheproofTest) -> Result<(), aes_gcm_siv::Error> {
         wut => panic!("unknown result field {}", wut),
     };
 
-    let aes_gcm_siv = aes_gcm_siv::Aes256GcmSiv::new(&key)?;
+    let aes_gcm_siv = signal_crypto::Aes256GcmSiv::new(&key)?;
 
     let mut buf = pt.clone();
     let generated_tag = aes_gcm_siv.encrypt(&mut buf, &nonce, &aad)?;
@@ -84,7 +84,7 @@ fn test_kat(kat: WycheproofTest) -> Result<(), aes_gcm_siv::Error> {
 
         assert_eq!(
             aes_gcm_siv.decrypt(&mut buf, &nonce, &aad, &tag),
-            Err(aes_gcm_siv::Error::InvalidTag)
+            Err(signal_crypto::Error::InvalidTag)
         );
     }
 
@@ -92,7 +92,7 @@ fn test_kat(kat: WycheproofTest) -> Result<(), aes_gcm_siv::Error> {
 }
 
 #[test]
-fn wycheproof_kats() -> Result<(), aes_gcm_siv::Error> {
+fn wycheproof_kats() -> Result<(), signal_crypto::Error> {
     let kat_data = include_bytes!("data/aes_gcm_siv_test.json");
     let kats: WycheproofTestSet = serde_json::from_slice(kat_data).expect("Valid JSON");
 
@@ -169,7 +169,7 @@ impl FromStr for BoringKat {
 }
 
 #[test]
-fn boringssl_tests() -> Result<(), aes_gcm_siv::Error> {
+fn boringssl_tests() -> Result<(), signal_crypto::Error> {
     let kat_data = include_bytes!("data/boringssl.txt");
     let kat_data = String::from_utf8(kat_data.to_vec()).expect("Valid UTF-8");
 
@@ -184,7 +184,7 @@ fn boringssl_tests() -> Result<(), aes_gcm_siv::Error> {
 // This test takes several minutes when compiled without optimizations.
 #[cfg(not(debug_assertions))]
 #[test]
-fn iterated_input_test() -> Result<(), aes_gcm_siv::Error> {
+fn iterated_input_test() -> Result<(), signal_crypto::Error> {
     /*
     A test which iteratively encrypts messages with lengths between 0
     and 128K bytes, with the nonce changing every invocation. Finally
@@ -197,7 +197,7 @@ fn iterated_input_test() -> Result<(), aes_gcm_siv::Error> {
 
     let key = hex::decode("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
         .expect("valid hex");
-    let aead = aes_gcm_siv::Aes256GcmSiv::new(&key)?;
+    let aead = signal_crypto::Aes256GcmSiv::new(&key)?;
 
     let mut nonce = hex::decode("00112233445566778899aabb").expect("valid hex");
     let mut buf = vec![];
@@ -220,13 +220,13 @@ fn iterated_input_test() -> Result<(), aes_gcm_siv::Error> {
 // This test takes several minutes when compiled without optimizations.
 #[cfg(not(debug_assertions))]
 #[test]
-fn long_input_tests() -> Result<(), aes_gcm_siv::Error> {
+fn long_input_tests() -> Result<(), signal_crypto::Error> {
     /*
     128 megabyte input, then hashed down to 128 bits. Crosschecked by BoringSSL
      */
     let key = hex::decode("0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF")
         .expect("valid hex");
-    let aead = aes_gcm_siv::Aes256GcmSiv::new(&key)?;
+    let aead = signal_crypto::Aes256GcmSiv::new(&key)?;
 
     let nonce = hex::decode("00112233445566778899AABB").expect("valid hex");
     let mut buf = vec![0u8; 1024 * 1024 * 128];