diff --git a/rust/ares/Cargo.lock b/rust/ares/Cargo.lock
index 679043f..033313d 100644
--- a/rust/ares/Cargo.lock
+++ b/rust/ares/Cargo.lock
@@ -2,6 +2,43 @@
 # It is not intended for manual editing.
 version = 3
 
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac1f845298e95f983ff1944b728ae08b8cebab80d684f0a832ed0fc74dfa27e2"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
+[[package]]
+name = "aes-siv"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e08d0cdb774acd1e4dac11478b1a0c0d203134b2aab0ba25eb430de9b18f8b9"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "cmac",
+ "ctr",
+ "dbl",
+ "digest",
+ "zeroize",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.2"
@@ -21,6 +58,7 @@ checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
 name = "ares"
 version = "0.1.0"
 dependencies = [
+ "ares_crypto",
  "ares_macros",
  "ares_pma",
  "assert_no_alloc",
@@ -29,7 +67,7 @@ dependencies = [
  "cc",
  "criterion",
  "either",
- "ibig",
+ "ibig 0.3.6",
  "intmap",
  "json",
  "lazy_static",
@@ -40,7 +78,21 @@ dependencies = [
  "num-traits",
  "signal-hook",
  "static_assertions",
- "urcrypt-sys",
+]
+
+[[package]]
+name = "ares_crypto"
+version = "0.1.0"
+dependencies = [
+ "aes",
+ "aes-siv",
+ "assert_no_alloc",
+ "curve25519-dalek",
+ "ed25519-dalek",
+ "ibig 0.3.6 (registry+https://github.com/rust-lang/crates.io-index)",
+ "sha1",
+ "sha2",
+ "x25519-dalek",
 ]
 
 [[package]]
@@ -55,7 +107,7 @@ dependencies = [
 name = "ares_pma"
 version = "0.1.0"
 dependencies = [
- "bindgen 0.69.1",
+ "bindgen",
  "cc",
 ]
 
@@ -91,29 +143,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "bindgen"
-version = "0.68.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "726e4313eb6ec35d2730258ad4e15b547ee75d6afaa1361a922e78e59b7d8078"
-dependencies = [
- "bitflags 2.4.1",
- "cexpr",
- "clang-sys",
- "lazy_static",
- "lazycell",
- "log",
- "peeking_take_while",
- "prettyplease",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash",
- "shlex",
- "syn 2.0.39",
- "which",
-]
-
 [[package]]
 name = "bindgen"
 version = "0.69.1"
@@ -133,7 +162,7 @@ dependencies = [
  "regex",
  "rustc-hash",
  "shlex",
- "syn 2.0.39",
+ "syn 2.0.48",
  "which",
 ]
 
@@ -161,6 +190,15 @@ dependencies = [
  "wyz",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.14.0"
@@ -225,10 +263,20 @@ dependencies = [
 ]
 
 [[package]]
-name = "clang-sys"
-version = "1.6.1"
+name = "cipher"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c688fc74432808e3eb684cae8830a86be1d66a2bd58e1f248ed0960a590baf6f"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "clang-sys"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67523a3b4be3ce1989d607a828d036249522dd9c1c8de7f4dd2dae43a37369d1"
 dependencies = [
  "glob",
  "libc",
@@ -256,6 +304,26 @@ dependencies = [
  "os_str_bytes",
 ]
 
+[[package]]
+name = "cmac"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8543454e3c3f5126effff9cd44d562af4e31fb8ce1cc0d3dcd8f084515dbc1aa"
+dependencies = [
+ "cipher",
+ "dbl",
+ "digest",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "criterion"
 version = "0.4.0"
@@ -294,35 +362,115 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
 dependencies = [
- "cfg-if",
  "crossbeam-epoch",
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.15"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
- "autocfg",
- "cfg-if",
  "crossbeam-utils",
- "memoffset",
- "scopeguard",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.16"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
+checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "rand_core",
+ "typenum",
+]
+
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89b8c6a2e4b1f45971ad09761aafb85514a84744b67a95e32c3cc1352d1f65c"
 dependencies = [
  "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "platforms",
+ "rustc_version",
+ "subtle",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+]
+
+[[package]]
+name = "dbl"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd2735a791158376708f9347fe8faba9667589d82427ef3aed6794a8981de3d9"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f628eaec48bfd21b865dc2950cfa014450c01d2fa2b69a86c2fd5844ec523c0"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "sha2",
+ "subtle",
 ]
 
 [[package]]
@@ -333,20 +481,36 @@ checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 
 [[package]]
 name = "errno"
-version = "0.3.6"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c18ee0ed65a5f1f81cac6b1d213b69c35fa47d4252ad41f1486dbd8226fe36e"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
 dependencies = [
  "libc",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "fiat-crypto"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27573eac26f4dd11e2b1916c3fe1baa56407c83c71a773a8ba17ec0bca03b6b7"
+
 [[package]]
 name = "funty"
 version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
 [[package]]
 name = "glob"
 version = "0.3.1"
@@ -376,11 +540,11 @@ dependencies = [
 
 [[package]]
 name = "home"
-version = "0.5.5"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5444c27eef6923071f7ebcc33e3444508466a76f7a2b93da00ed6e19f30c1ddb"
+checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
 dependencies = [
- "windows-sys",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -393,6 +557,18 @@ dependencies = [
  "static_assertions",
 ]
 
+[[package]]
+name = "ibig"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1fcc7f316b2c079dde77564a1360639c1a956a23fa96122732e416cb10717bb"
+dependencies = [
+ "cfg-if",
+ "num-traits",
+ "rand",
+ "static_assertions",
+]
+
 [[package]]
 name = "indexmap"
 version = "1.9.3"
@@ -403,6 +579,15 @@ dependencies = [
  "hashbrown",
 ]
 
+[[package]]
+name = "inout"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "intmap"
 version = "1.1.0"
@@ -420,15 +605,15 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
 
 [[package]]
 name = "js-sys"
-version = "0.3.65"
+version = "0.3.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54c0c35952f67de54bb584e9fd912b3023117cbafc0a77d8f3dee1fb5f572fe8"
+checksum = "cee9c64da59eae3b50095c18d3e74f8b73c0b86d2792824ff01bbce68ba229ca"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -453,25 +638,25 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.150"
+version = "0.2.152"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
+checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
 
 [[package]]
 name = "libloading"
-version = "0.7.4"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
+checksum = "c571b676ddfc9a8c12f1f3d3085a7b163966a8fd8098a90640953ce5f6170161"
 dependencies = [
  "cfg-if",
- "winapi",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "969488b55f8ac402214f3f5fd243ebb7206cf82de60d3172994707a4bcc2b829"
+checksum = "c4cd1a83af159aa67994778be9070f0ae1bd732942279cabb14f86f986a21456"
 
 [[package]]
 name = "log"
@@ -481,9 +666,9 @@ checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
 [[package]]
 name = "memchr"
-version = "2.6.4"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
+checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
 
 [[package]]
 name = "memmap"
@@ -495,15 +680,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "memoffset"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
-dependencies = [
- "autocfg",
-]
-
 [[package]]
 name = "minimal-lexical"
 version = "0.2.1"
@@ -547,9 +723,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "oorandom"
@@ -570,10 +746,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
 
 [[package]]
-name = "pkg-config"
-version = "0.3.27"
+name = "platforms"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
+checksum = "626dec3cac7cc0e1577a2ec3fc496277ec2baa084bebad95bb6fdbfae235f84c"
 
 [[package]]
 name = "plotters"
@@ -605,28 +781,28 @@ dependencies = [
 
 [[package]]
 name = "prettyplease"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae005bd773ab59b4725093fd7df83fd7892f7d8eafb48dbd7de6e024e4215f9d"
+checksum = "a41cf62165e97c7f814d2221421dbb9afcbcdb0a88068e5ea206e19951c2cbb5"
 dependencies = [
  "proc-macro2",
- "syn 2.0.39",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.69"
+version = "1.0.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
+checksum = "95fc56cda0b5c3325f5fbbd7ff9fda9e02bb00bb3dac51252d2f1bfa1cb8cc8c"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.33"
+version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
 dependencies = [
  "proc-macro2",
 ]
@@ -708,23 +884,32 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
-name = "rustix"
-version = "0.38.21"
+name = "rustc_version"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b426b0506e5d50a7d8dafcf2e81471400deb602392c7dd110815afb4eaf02a3"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72e572a5e8ca657d7366229cdde4bd14c4eb5499a9573d4d366fe1b599daa316"
 dependencies = [
  "bitflags 2.4.1",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "ryu"
-version = "1.0.15"
+version = "1.0.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
+checksum = "f98d2aa92eebf49b69786be48e4477826b256916e84a57ff2a4f21923b48eb4c"
 
 [[package]]
 name = "same-file"
@@ -736,42 +921,64 @@ dependencies = [
 ]
 
 [[package]]
-name = "scopeguard"
-version = "1.2.0"
+name = "semver"
+version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+checksum = "b97ed7a9823b74f99c7742f5336af7be5ecd3eeafcb1507d1fa93347b1d589b0"
 
 [[package]]
 name = "serde"
-version = "1.0.192"
+version = "1.0.195"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bca2a08484b285dcb282d0f67b26cadc0df8b19f8c12502c13d966bf9482f001"
+checksum = "63261df402c67811e9ac6def069e4786148c4563f4b50fd4bf30aa370d626b02"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.192"
+version = "1.0.195"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6c7207fbec9faa48073f3e3074cbe553af6ea512d7c21ba46e434e70ea9fbc1"
+checksum = "46fe8f8603d81ba86327b23a2e9cdf49e1255fb94a4c5f297f6ee0547178ea2c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.48",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.108"
+version = "1.0.111"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
+checksum = "176e46fa42316f18edd598015a5166857fc835ec732f5215eac6b7bdbf0a84f4"
 dependencies = [
  "itoa",
  "ryu",
  "serde",
 ]
 
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "shlex"
 version = "1.2.0"
@@ -797,12 +1004,24 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
+[[package]]
+name = "subtle"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
+
 [[package]]
 name = "syn"
 version = "1.0.109"
@@ -816,9 +1035,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.39"
+version = "2.0.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a"
+checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -847,6 +1066,12 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "typenum"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.12"
@@ -854,14 +1079,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
-name = "urcrypt-sys"
-version = "0.1.1"
+name = "version_check"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ced751f95a527a3458eb67c75e4ae7093d41585edaa7565f5769101502473019"
-dependencies = [
- "bindgen 0.68.1",
- "pkg-config",
-]
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
 [[package]]
 name = "walkdir"
@@ -875,9 +1096,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.88"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7daec296f25a1bae309c0cd5c29c4b260e510e6d813c286b19eaadf409d40fce"
+checksum = "0ed0d4f68a3015cc185aff4db9506a015f4b96f95303897bfa23f846db54064e"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -885,24 +1106,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.88"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e397f4664c0e4e428e8313a469aaa58310d302159845980fd23b0f22a847f217"
+checksum = "1b56f625e64f3a1084ded111c4d5f477df9f8c92df113852fa5a374dbda78826"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.48",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.88"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5961017b3b08ad5f3fe39f1e79877f8ee7c23c5e5fd5eb80de95abc41f1f16b2"
+checksum = "0162dbf37223cd2afce98f3d0785506dcb8d266223983e4b5b525859e6e182b2"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -910,28 +1131,28 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.88"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5353b8dab669f5e10f5bd76df26a9360c748f054f862ff5f3f8aae0c7fb3907"
+checksum = "f0eb82fcb7930ae6219a7ecfd55b217f5f0893484b7a13022ebb2b2bf20b5283"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.39",
+ "syn 2.0.48",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.88"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d046c5d029ba91a1ed14da14dca44b68bf2f124cfbaf741c54151fdb3e0750b"
+checksum = "7ab9b36309365056cd639da3134bf87fa8f3d86008abf99e612384a6eecd459f"
 
 [[package]]
 name = "web-sys"
-version = "0.3.65"
+version = "0.3.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5db499c5f66323272151db0e666cd34f78617522fb0c1604d31a27c50c206a85"
+checksum = "50c24a44ec86bb68fbecd1b3efed7e85ea5621b39b35ef2766b66cd984f8010f"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -986,7 +1207,16 @@ version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.0",
 ]
 
 [[package]]
@@ -995,13 +1225,28 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a18201040b24831fbb9e4eb208f8892e1f50a37feb53cc7ff887feb8f50e7cd"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.0",
+ "windows_aarch64_msvc 0.52.0",
+ "windows_i686_gnu 0.52.0",
+ "windows_i686_msvc 0.52.0",
+ "windows_x86_64_gnu 0.52.0",
+ "windows_x86_64_gnullvm 0.52.0",
+ "windows_x86_64_msvc 0.52.0",
 ]
 
 [[package]]
@@ -1010,42 +1255,84 @@ version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7764e35d4db8a7921e09562a0304bf2f93e0a51bfccee0bd0bb0b666b015ea"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbaa0368d4f1d2aaefc55b6fcfee13f41544ddf36801e793edbbfd7d7df075ef"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a28637cb1fa3560a16915793afb20081aba2c92ee8af57b4d5f28e4b3e7df313"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffe5e8e31046ce6230cc7215707b816e339ff4d4d67c65dffa206fd0f7aa7b9a"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d6fa32db2bc4a2f5abeacf2b69f7992cd09dca97498da74a151a3132c26befd"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a657e1e9d3f514745a572a6846d3c7aa7dbe1658c056ed9c3344c4109a6949e"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
+
 [[package]]
 name = "wyz"
 version = "0.5.1"
@@ -1054,3 +1341,19 @@ checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
 dependencies = [
  "tap",
 ]
+
+[[package]]
+name = "x25519-dalek"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb66477291e7e8d2b0ff1bcb900bf29489a9692816d79874bea351e7a8b6de96"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
diff --git a/rust/ares/Cargo.toml b/rust/ares/Cargo.toml
index 2b3cfe6..3d7ec25 100644
--- a/rust/ares/Cargo.toml
+++ b/rust/ares/Cargo.toml
@@ -11,6 +11,7 @@ edition = "2018"
 
 # Please keep these alphabetized
 [dependencies]
+ares_crypto = { path = "../ares_crypto" }
 ares_macros = { path = "../ares_macros" }
 # Use this when debugging requires the debug printfs in the PMA
 # ares_pma = { path = "../ares_pma", features=["debug_prints"] }
@@ -32,7 +33,6 @@ num-derive = "0.3"
 num-traits = "0.2"
 signal-hook = "0.3"
 static_assertions = "1.1.0"
-urcrypt-sys = "0.1.1"
 
 [build-dependencies]
 autotools = "0.2.6"
diff --git a/rust/ares/benches/cue_pill.rs b/rust/ares/benches/cue_pill.rs
index f7e9834..70a13dc 100644
--- a/rust/ares/benches/cue_pill.rs
+++ b/rust/ares/benches/cue_pill.rs
@@ -57,7 +57,7 @@ fn main() -> io::Result<()> {
     let f_out = OpenOptions::new()
         .read(true)
         .write(true)
-        .create(true)
+        .truncate(true)
         .open(output_filename)?;
     f_out.set_len((jammed_output.size() << 3) as u64)?;
     unsafe {
diff --git a/rust/ares/src/jets/lock/aes.rs b/rust/ares/src/jets/lock/aes.rs
index 0a6f9c4..26d166b 100644
--- a/rust/ares/src/jets/lock/aes.rs
+++ b/rust/ares/src/jets/lock/aes.rs
@@ -2,13 +2,12 @@ use crate::interpreter::Context;
 use crate::jets::bits::util::met;
 use crate::jets::util::slot;
 use crate::jets::{JetErr, Result};
-use crate::noun::{IndirectAtom, Noun};
-use urcrypt_sys::*;
+use crate::noun::Noun;
 
 crate::gdb!();
 
 //  Note:   The Hoon code for these functions doesn't explicitly check key
-//          sizes. However, the implementations of these functions in urcrypt
+//          sizes. However, the implementations of these functions in ares_crypto
 //          have fixed maximum key sizes, therefore we must punt if the key is
 //          too large.
 
@@ -16,17 +15,15 @@ pub fn jet_siva_en(context: &mut Context, subject: Noun) -> Result {
     let stack = &mut context.stack;
     let txt = slot(subject, 6)?.as_atom()?;
     let key = slot(subject, 60)?.as_atom()?;
-    let atoms = slot(subject, 61)?;
+    let ads = slot(subject, 61)?;
 
     if met(3, key) > 32 {
         Err(JetErr::Punt)
     } else {
-        unsafe {
-            let (mut _key_ida, key_bytes) = IndirectAtom::new_raw_mut_bytes(stack, 32);
-            key_bytes[0..key.as_bytes().len()].copy_from_slice(key.as_bytes());
+        let key_bytes = &mut [0u8; 32];
+        key_bytes[0..key.as_bytes().len()].copy_from_slice(key.as_bytes());
 
-            util::_siv_en(stack, key_bytes, atoms, txt, urcrypt_aes_siva_en)
-        }
+        util::_siv_en::<32>(stack, key_bytes, ads, txt)
     }
 }
 
@@ -41,12 +38,10 @@ pub fn jet_siva_de(context: &mut Context, subject: Noun) -> Result {
     if met(3, key) > 32 {
         Err(JetErr::Punt)
     } else {
-        unsafe {
-            let (mut _key_ida, key_bytes) = IndirectAtom::new_raw_mut_bytes(stack, 32);
-            key_bytes[0..key.as_bytes().len()].copy_from_slice(key.as_bytes());
+        let key_bytes = &mut [0u8; 32];
+        key_bytes[0..key.as_bytes().len()].copy_from_slice(key.as_bytes());
 
-            util::_siv_de(stack, key_bytes, ads, iv, len, txt, urcrypt_aes_siva_de)
-        }
+        util::_siv_de::<32>(stack, key_bytes, ads, iv, len, txt)
     }
 }
 
@@ -54,17 +49,15 @@ pub fn jet_sivb_en(context: &mut Context, subject: Noun) -> Result {
     let stack = &mut context.stack;
     let txt = slot(subject, 6)?.as_atom()?;
     let key = slot(subject, 60)?.as_atom()?;
-    let atoms = slot(subject, 61)?;
+    let ads = slot(subject, 61)?;
 
     if met(3, key) > 48 {
         Err(JetErr::Punt)
     } else {
-        unsafe {
-            let (mut _key_ida, key_bytes) = IndirectAtom::new_raw_mut_bytes(stack, 48);
-            key_bytes[0..key.as_bytes().len()].copy_from_slice(key.as_bytes());
+        let key_bytes = &mut [0u8; 48];
+        key_bytes[0..key.as_bytes().len()].copy_from_slice(key.as_bytes());
 
-            util::_siv_en(stack, key_bytes, atoms, txt, urcrypt_aes_sivb_en)
-        }
+        util::_siv_en::<48>(stack, key_bytes, ads, txt)
     }
 }
 
@@ -79,12 +72,10 @@ pub fn jet_sivb_de(context: &mut Context, subject: Noun) -> Result {
     if met(3, key) > 48 {
         Err(JetErr::Punt)
     } else {
-        unsafe {
-            let (mut _key_ida, key_bytes) = IndirectAtom::new_raw_mut_bytes(stack, 48);
-            key_bytes[0..key.as_bytes().len()].copy_from_slice(key.as_bytes());
+        let key_bytes = &mut [0u8; 48];
+        key_bytes[0..key.as_bytes().len()].copy_from_slice(key.as_bytes());
 
-            util::_siv_de(stack, key_bytes, ads, iv, len, txt, urcrypt_aes_sivb_de)
-        }
+        util::_siv_de::<48>(stack, key_bytes, ads, iv, len, txt)
     }
 }
 
@@ -92,17 +83,15 @@ pub fn jet_sivc_en(context: &mut Context, subject: Noun) -> Result {
     let stack = &mut context.stack;
     let txt = slot(subject, 6)?.as_atom()?;
     let key = slot(subject, 60)?.as_atom()?;
-    let atoms = slot(subject, 61)?;
+    let ads = slot(subject, 61)?;
 
     if met(3, key) > 64 {
         Err(JetErr::Punt)
     } else {
-        unsafe {
-            let (mut _key_ida, key_bytes) = IndirectAtom::new_raw_mut_bytes(stack, 64);
-            key_bytes[0..key.as_bytes().len()].copy_from_slice(key.as_bytes());
+        let key_bytes = &mut [0u8; 64];
+        key_bytes[0..key.as_bytes().len()].copy_from_slice(key.as_bytes());
 
-            util::_siv_en(stack, key_bytes, atoms, txt, urcrypt_aes_sivc_en)
-        }
+        util::_siv_en::<64>(stack, key_bytes, ads, txt)
     }
 }
 
@@ -117,12 +106,10 @@ pub fn jet_sivc_de(context: &mut Context, subject: Noun) -> Result {
     if met(3, key) > 64 {
         Err(JetErr::Punt)
     } else {
-        unsafe {
-            let (mut _key_ida, key_bytes) = IndirectAtom::new_raw_mut_bytes(stack, 64);
-            key_bytes[0..key.as_bytes().len()].copy_from_slice(key.as_bytes());
+        let key_bytes = &mut [0u8; 64];
+        key_bytes[0..key.as_bytes().len()].copy_from_slice(key.as_bytes());
 
-            util::_siv_de(stack, key_bytes, ads, iv, len, txt, urcrypt_aes_sivc_de)
-        }
+        util::_siv_de::<64>(stack, key_bytes, ads, iv, len, txt)
     }
 }
 
@@ -133,48 +120,35 @@ mod util {
     use crate::jets::{JetErr, Result};
     use crate::mem::NockStack;
     use crate::noun::{Atom, IndirectAtom, Noun, D, T};
-    use std::ptr::null_mut;
+    use ares_crypto::aes_siv::{ac_aes_siv_de, ac_aes_siv_en};
     use std::result;
-    use urcrypt_sys::urcrypt_aes_siv_data;
 
-    type UrcryptSiv = unsafe extern "C" fn(
-        *mut u8,
-        usize,
-        *mut urcrypt_aes_siv_data,
-        usize,
-        *mut u8,
-        *mut u8,
-        *mut u8,
-    ) -> i32;
+    /// Associated data for AES-SIV functions.
+    struct AcAesSivData {
+        bytes: *mut u8,
+        length: usize,
+    }
 
-    /// Encodes the list of atoms.
-    ///
-    /// # Arguments
-    ///
-    /// * `stack` - the active NockStack
-    /// * `atoms` - the list of atoms to allocate
-    ///
-    fn _allocate_atoms(
+    /// Allocates a noun list as an array of AesSivData structs on the NockStack
+    /// for use as associated data in AES-SIV functions.
+    fn _allocate_ads(
         stack: &mut NockStack,
-        mut atoms: Noun,
-    ) -> result::Result<&'static mut [urcrypt_aes_siv_data], JetErr> {
-        if unsafe { atoms.raw_equals(D(0)) } {
+        mut ads: Noun,
+    ) -> result::Result<&'static mut [AcAesSivData], JetErr> {
+        if unsafe { ads.raw_equals(D(0)) } {
             return Ok(&mut []);
         }
 
-        // measure
-        let length = list::util::lent(atoms)?;
+        let length = list::util::lent(ads)?;
 
-        // allocate
-        let siv_data: &mut [urcrypt_aes_siv_data] = unsafe {
-            let ptr = stack.struct_alloc::<urcrypt_aes_siv_data>(length);
+        let siv_data: &mut [AcAesSivData] = unsafe {
+            let ptr = stack.struct_alloc::<AcAesSivData>(length);
             std::slice::from_raw_parts_mut(ptr, length)
         };
 
-        // encode
         unsafe {
             for item in siv_data.iter_mut().take(length) {
-                let cell = atoms.as_cell()?;
+                let cell = ads.as_cell()?;
                 let head = cell.head().as_atom()?;
                 let bytes = head.as_bytes();
                 let len = met(3, head);
@@ -185,59 +159,42 @@ mod util {
                 item.length = bytes.len();
                 item.bytes = atom.data_pointer_mut() as *mut u8;
 
-                atoms = cell.tail();
+                ads = cell.tail();
             }
         }
 
         Ok(siv_data)
     }
 
-    pub fn _siv_en(
+    pub fn _siv_en<const N: usize>(
         stack: &mut NockStack,
-        key: &mut [u8],
+        key: &mut [u8; N],
         ads: Noun,
         txt: Atom,
-        fun: UrcryptSiv,
     ) -> Result {
         unsafe {
-            let siv_data = _allocate_atoms(stack, ads)?;
+            let ac_siv_data = _allocate_ads(stack, ads)?;
+            let siv_data: &mut [&mut [u8]] = std::slice::from_raw_parts_mut(
+                ac_siv_data.as_mut_ptr() as *mut &mut [u8],
+                ac_siv_data.len(),
+            );
 
             let txt_len = met(3, txt);
-            let txt_ptr = match txt_len {
-                0 => null_mut::<u8>(),
-                _ => {
-                    let (_, txt_bytes) = IndirectAtom::new_raw_mut_bytes(stack, txt_len);
-                    txt_bytes[0..txt_len].copy_from_slice(&(txt.as_bytes()[0..txt_len]));
-                    txt_bytes.as_mut_ptr()
-                }
-            };
 
-            let (mut iv, iv_bytes) = IndirectAtom::new_raw_mut_bytes(stack, 16);
+            let (mut iv, iv_bytes) = IndirectAtom::new_raw_mut_bytearray::<16, NockStack>(stack);
 
+            // We match on length here and elsewhere where a similar pattern is followed
+            // to avoid panicking when a zero length is passed to IndirectAtom::new_raw_mut_bytes.
             match txt_len {
                 0 => {
-                    fun(
-                        txt_ptr,
-                        txt_len,
-                        siv_data.as_mut_ptr(),
-                        siv_data.len(),
-                        key.as_mut_ptr(),
-                        iv_bytes.as_mut_ptr(),
-                        null_mut::<u8>(),
-                    );
+                    ac_aes_siv_en::<N>(key, &mut [], siv_data, iv_bytes, &mut [0u8; 0]).unwrap();
                     Ok(T(stack, &[iv.normalize_as_atom().as_noun(), D(0), D(0)]))
                 }
                 _ => {
+                    let (_txt_ida, txt_bytes) = IndirectAtom::new_raw_mut_bytes(stack, txt_len);
+                    txt_bytes.copy_from_slice(&txt.as_bytes()[0..txt_len]);
                     let (mut out_atom, out_bytes) = IndirectAtom::new_raw_mut_bytes(stack, txt_len);
-                    fun(
-                        txt_ptr,
-                        txt_len,
-                        siv_data.as_mut_ptr(),
-                        siv_data.len(),
-                        key.as_mut_ptr(),
-                        iv_bytes.as_mut_ptr(),
-                        out_bytes.as_mut_ptr(),
-                    );
+                    ac_aes_siv_en::<N>(key, txt_bytes, siv_data, iv_bytes, out_bytes).unwrap();
                     Ok(T(
                         stack,
                         &[
@@ -251,42 +208,42 @@ mod util {
         }
     }
 
-    pub fn _siv_de(
+    pub fn _siv_de<const N: usize>(
         stack: &mut NockStack,
-        key: &mut [u8],
+        key: &mut [u8; N],
         ads: Noun,
         iv: Atom,
         len: Atom,
         txt: Atom,
-        fun: UrcryptSiv,
     ) -> Result {
         unsafe {
             let txt_len = match len.as_direct() {
                 Ok(direct) => direct.data() as usize,
                 Err(_) => return Err(BAIL_FAIL),
             };
-            let (_, txt_bytes) = IndirectAtom::new_raw_mut_bytes(stack, txt_len);
-            txt_bytes[0..txt_len].copy_from_slice(&(txt.as_bytes()[0..txt_len]));
 
-            let (_iv_ida, iv_bytes) = IndirectAtom::new_raw_mut_bytes(stack, 16);
-            iv_bytes[0..16].copy_from_slice(&(iv.as_bytes()[0..16]));
+            let iv_bytes = &mut [0u8; 16];
+            iv_bytes.copy_from_slice(&iv.as_bytes()[0..16]);
 
-            let siv_data = _allocate_atoms(stack, ads)?;
+            let ac_siv_data = _allocate_ads(stack, ads)?;
+            let siv_data: &mut [&mut [u8]] = std::slice::from_raw_parts_mut(
+                ac_siv_data.as_mut_ptr() as *mut &mut [u8],
+                ac_siv_data.len(),
+            );
 
             let (mut out_atom, out_bytes) = IndirectAtom::new_raw_mut_bytes(stack, txt_len);
-            fun(
-                if txt_len == 0 {
-                    null_mut::<u8>()
-                } else {
-                    txt_bytes.as_mut_ptr()
-                },
-                txt_len,
-                siv_data.as_mut_ptr(),
-                siv_data.len(),
-                key.as_mut_ptr(),
-                iv_bytes.as_mut_ptr(),
-                out_bytes.as_mut_ptr(),
-            );
+
+            match txt_len {
+                0 => {
+                    ac_aes_siv_de::<N>(key, &mut [], siv_data, iv_bytes, &mut [0u8; 0]).unwrap();
+                }
+                _ => {
+                    let (_txt_ida, txt_bytes) = IndirectAtom::new_raw_mut_bytes(stack, txt_len);
+                    txt_bytes.copy_from_slice(&txt.as_bytes()[0..txt_len]);
+                    ac_aes_siv_de::<N>(key, txt_bytes, siv_data, iv_bytes, out_bytes).unwrap();
+                }
+            }
+
             Ok(T(stack, &[D(0), out_atom.normalize_as_atom().as_noun()]))
         }
     }
@@ -377,6 +334,22 @@ mod tests {
     pub fn test_sivb_en() {
         let c = &mut init_context();
 
+        /*
+        > (~(en sivb:aes:crypto [key=0x0 vec=~]) txt=0x0)
+        [p=0x8fb.4085.a9b9.3662.ab44.f911.e47e.9ccd q=0 r=0x0]
+         */
+        fn sample(_s: &mut NockStack) -> Noun {
+            D(0)
+        }
+        fn context(s: &mut NockStack) -> Noun {
+            let sample = T(s, &[D(0), D(0)]);
+            T(s, &[D(0), sample, D(0)])
+        }
+
+        let siv = A(&mut c.stack, &ubig!(0x8fb4085a9b93662ab44f911e47e9ccd));
+        let res = T(&mut c.stack, &[siv, D(0), D(0x0)]);
+        assert_jet_in_door(c, jet_sivb_en, &[sample], &[context], res);
+
         /* RFC 5297
          * https://datatracker.ietf.org/doc/html/rfc5297#appendix-A
          */
@@ -404,6 +377,22 @@ mod tests {
     pub fn test_sivc_en() {
         let c = &mut init_context();
 
+        /*
+        > (~(en sivc:aes:crypto [key=0x0 vec=~]) txt=0x0)
+        [p=0x2c6a.abc5.bb25.1140.e221.d70b.fb31.c519 q=0 r=0x0]
+         */
+        fn sample(_s: &mut NockStack) -> Noun {
+            D(0)
+        }
+        fn context(s: &mut NockStack) -> Noun {
+            let sample = T(s, &[D(0), D(0)]);
+            T(s, &[D(0), sample, D(0)])
+        }
+
+        let siv = A(&mut c.stack, &ubig!(0x2c6aabc5bb251140e221d70bfb31c519));
+        let res = T(&mut c.stack, &[siv, D(0), D(0x0)]);
+        assert_jet_in_door(c, jet_sivc_en, &[sample], &[context], res);
+
         /* RFC 5297
          * https://datatracker.ietf.org/doc/html/rfc5297#appendix-A
          */
diff --git a/rust/ares/src/jets/lock/ed.rs b/rust/ares/src/jets/lock/ed.rs
index 87ef91c..0ff2d26 100644
--- a/rust/ares/src/jets/lock/ed.rs
+++ b/rust/ares/src/jets/lock/ed.rs
@@ -2,8 +2,9 @@ use crate::interpreter::Context;
 use crate::jets::bits::util::met;
 use crate::jets::util::{slot, BAIL_EXIT};
 use crate::jets::{JetErr, Result};
+use crate::mem::NockStack;
 use crate::noun::{IndirectAtom, Noun, NO, YES};
-use urcrypt_sys::*;
+use ares_crypto::ed25519::{ac_ed_puck, ac_ed_shar, ac_ed_sign, ac_ed_veri};
 
 crate::gdb!();
 
@@ -11,21 +12,17 @@ pub fn jet_puck(context: &mut Context, subject: Noun) -> Result {
     let stack = &mut context.stack;
     let sed = slot(subject, 6)?.as_atom()?;
 
-    if met(3, sed) > 32 {
+    let sed_len = met(3, sed);
+    if sed_len > 32 {
         return Err(BAIL_EXIT);
     }
 
     unsafe {
-        // allocate 32 byte buffer on
-        let sed_buffer = &mut [0u8; 32] as *mut u8;
-        let sed_bytes = sed.as_bytes();
+        let sed_bytes = &mut [0u8; 32];
+        sed_bytes[0..sed_len].copy_from_slice(&(sed.as_bytes())[0..sed_len]);
 
-        // we need to copy because the atom might be less than 32 bytes and urcrypt expects a
-        // 32-byte buffer
-        std::ptr::copy_nonoverlapping(sed_bytes.as_ptr(), sed_buffer, sed_bytes.len());
-
-        let (mut pub_ida, pub_key) = IndirectAtom::new_raw_mut_bytes(stack, 32);
-        urcrypt_ed_puck(sed_buffer as *const u8, pub_key.as_mut_ptr());
+        let (mut pub_ida, pub_key) = IndirectAtom::new_raw_mut_bytearray::<32, NockStack>(stack);
+        ac_ed_puck(sed_bytes, pub_key);
 
         Ok(pub_ida.normalize_as_atom().as_noun())
     }
@@ -47,8 +44,8 @@ pub fn jet_shar(context: &mut Context, subject: Noun) -> Result {
     }
 
     unsafe {
-        let (_, public) = IndirectAtom::new_raw_mut_bytes(stack, 32);
-        let (_, secret) = IndirectAtom::new_raw_mut_bytes(stack, 32);
+        let public = &mut [0u8; 32];
+        let secret = &mut [0u8; 32];
 
         let pub_bytes = pub_key.as_bytes();
         let sec_bytes = sec_key.as_bytes();
@@ -56,8 +53,8 @@ pub fn jet_shar(context: &mut Context, subject: Noun) -> Result {
         public[0..pub_bytes.len()].copy_from_slice(pub_bytes);
         secret[0..sec_bytes.len()].copy_from_slice(sec_bytes);
 
-        let (mut shar_ida, shar) = IndirectAtom::new_raw_mut_bytes(stack, 32);
-        urcrypt_ed_shar(public.as_ptr(), secret.as_ptr(), shar.as_mut_ptr());
+        let (mut shar_ida, shar) = IndirectAtom::new_raw_mut_bytearray::<32, NockStack>(stack);
+        ac_ed_shar(public, secret, shar);
 
         Ok(shar_ida.normalize_as_atom().as_noun())
     }
@@ -70,62 +67,54 @@ pub fn jet_sign(context: &mut Context, subject: Noun) -> Result {
 
     unsafe {
         let sed_bytes = sed.as_bytes();
-        if sed_bytes.len() > 32 {
+        let sed_len = sed_bytes.len();
+        if sed_len > 32 {
             return Err(BAIL_EXIT);
         };
+        let seed = &mut [0u8; 32];
+        seed[0..sed_len].copy_from_slice(sed_bytes);
 
-        let msg_bytes = &(msg.as_bytes())[0..met(3, msg)]; // drop trailing zeros
+        let (mut sig_ida, sig) = IndirectAtom::new_raw_mut_bytearray::<64, NockStack>(stack);
 
-        let (mut _seed_ida, seed) = IndirectAtom::new_raw_mut_bytes(stack, 32);
-        seed.copy_from_slice(sed_bytes);
-
-        let (mut sig_ida, sig) = IndirectAtom::new_raw_mut_bytes(stack, 64);
-        urcrypt_ed_sign(
-            msg_bytes.as_ptr(),
-            msg_bytes.len(),
-            seed.as_ptr(),
-            sig.as_mut_ptr(),
-        );
-        sig.reverse(); // LSB first
+        let msg_len = met(3, msg);
+        if msg_len > 0 {
+            let (_msg_ida, message) = IndirectAtom::new_raw_mut_bytes(stack, msg_len);
+            message.copy_from_slice(&msg.as_bytes()[0..msg_len]);
+            ac_ed_sign(message, seed, sig);
+        } else {
+            ac_ed_sign(&[0u8; 0], seed, sig);
+        }
 
+        sig.reverse();
         Ok(sig_ida.normalize_as_atom().as_noun())
     }
 }
 
-pub fn jet_veri(context: &mut Context, subject: Noun) -> Result {
-    let stack = &mut context.stack;
+pub fn jet_veri(_context: &mut Context, subject: Noun) -> Result {
     let sig = slot(subject, 12)?.as_atom()?;
     let msg = slot(subject, 26)?.as_atom()?;
     let puk = slot(subject, 27)?.as_atom()?;
 
-    unsafe {
-        // Both are size checked by Hoon, but without crashing
-        let sig_bytes = sig.as_bytes();
-        if sig_bytes.len() > 64 {
-            return Ok(NO);
-        };
+    // Both are size checked by Hoon, but without crashing
+    let sig_bytes = sig.as_bytes();
+    if sig_bytes.len() > 64 {
+        return Ok(NO);
+    };
+    let signature = &mut [0u8; 64];
+    signature[0..sig_bytes.len()].copy_from_slice(sig_bytes);
 
-        let pub_bytes = puk.as_bytes();
-        if pub_bytes.len() > 32 {
-            return Ok(NO);
-        };
+    let pub_bytes = puk.as_bytes();
+    if pub_bytes.len() > 32 {
+        return Ok(NO);
+    };
+    let public_key = &mut [0u8; 32];
+    public_key[0..pub_bytes.len()].copy_from_slice(pub_bytes);
 
-        let (mut _sig_ida, signature) = IndirectAtom::new_raw_mut_bytes(stack, 64);
-        signature.copy_from_slice(sig_bytes);
-        let (mut _pub_ida, public_key) = IndirectAtom::new_raw_mut_bytes(stack, 32);
-        public_key.copy_from_slice(pub_bytes);
+    let message = &(msg.as_bytes())[0..met(3, msg)]; // drop trailing zeros
 
-        let message = &(msg.as_bytes())[0..met(3, msg)]; // drop trailing zeros
+    let valid = ac_ed_veri(message, public_key, signature);
 
-        let valid = urcrypt_ed_veri(
-            message.as_ptr(),
-            message.len(),
-            public_key.as_ptr(),
-            signature.as_ptr(),
-        );
-
-        Ok(if valid { YES } else { NO })
-    }
+    Ok(if valid { YES } else { NO })
 }
 
 #[cfg(test)]
@@ -142,6 +131,13 @@ mod tests {
     fn test_puck() {
         let c = &mut init_context();
 
+        let sam = A(&mut c.stack, &ubig!(_0x0));
+        let ret = A(
+            &mut c.stack,
+            &ubig!(_0x29da598ba148c03aa643e21d77153265730d6f2ad0a8a3622da4b6cebc276a3b),
+        );
+        assert_jet(c, jet_puck, sam, ret);
+
         let sam = A(
             &mut c.stack,
             &ubig!(_0x607fae1c03ac3b701969327b69c54944c42cec92f44a84ba605afdef9db1619d),
@@ -157,6 +153,10 @@ mod tests {
     fn test_shar() {
         let c = &mut init_context();
 
+        let sam = T(&mut c.stack, &[D(0), D(0)]);
+        let ret = A(&mut c.stack, &ubig!(_0x0));
+        assert_jet(c, jet_shar, sam, ret);
+
         let sam = T(&mut c.stack, &[D(234), D(234)]);
         let ret = A(
             &mut c.stack,
@@ -176,6 +176,10 @@ mod tests {
         let c = &mut init_context();
 
         unsafe {
+            let sam = T(&mut c.stack, &[D(0), D(0)]);
+            let ret = A(&mut c.stack, &ubig!(_0x8f895b3cafe2c9506039d0e2a66382568004674fe8d237785092e40d6aaf483e4fc60168705f31f101596138ce21aa357c0d32a064f423dc3ee4aa3abf53f803));
+            assert_jet(c, jet_sign, sam, ret);
+
             let message = D(0x72);
 
             let sed_ubig =
@@ -213,6 +217,9 @@ mod tests {
         let c = &mut init_context();
 
         unsafe {
+            let sam = T(&mut c.stack, &[D(0), D(0), D(0)]);
+            assert_jet(c, jet_veri, sam, NO);
+
             let sig_ubig = ubig!(_0x92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00);
             let sig_bytes = sig_ubig.to_be_bytes();
             let signature =
diff --git a/rust/ares/src/jets/lock/sha.rs b/rust/ares/src/jets/lock/sha.rs
index a4746ee..63db027 100644
--- a/rust/ares/src/jets/lock/sha.rs
+++ b/rust/ares/src/jets/lock/sha.rs
@@ -3,7 +3,7 @@ use crate::jets::bits::util::met;
 use crate::jets::util::{slot, BAIL_FAIL};
 use crate::jets::Result;
 use crate::noun::{IndirectAtom, Noun};
-use urcrypt_sys::*;
+use ares_crypto::sha::{ac_sha1, ac_shal, ac_shas, ac_shay};
 
 crate::gdb!();
 
@@ -13,21 +13,23 @@ pub fn jet_shas(context: &mut Context, subject: Noun) -> Result {
     let sal = slot(sam, 2)?.as_atom()?;
     let ruz = slot(sam, 3)?.as_atom()?;
 
-    let sal_bytes = &(sal.as_bytes())[0..met(3, sal)]; // drop trailing zeros
-    let (mut _salt_ida, salt) = unsafe { IndirectAtom::new_raw_mut_bytes(stack, sal_bytes.len()) };
-    salt.copy_from_slice(sal_bytes);
-
-    let message = &(ruz.as_bytes())[0..met(3, ruz)]; // drop trailing zeros
-
     unsafe {
         let (mut out_ida, out) = IndirectAtom::new_raw_mut_bytes(stack, 32);
-        urcrypt_shas(
-            salt.as_mut_ptr(),
-            salt.len(),
-            message.as_ptr(),
-            message.len(),
-            out.as_mut_ptr(),
-        );
+
+        let sal_bytes = &(sal.as_bytes())[0..met(3, sal)]; // drop trailing zeros
+        let (mut _salt_ida, salt) = IndirectAtom::new_raw_mut_bytes(stack, sal_bytes.len());
+        salt.copy_from_slice(sal_bytes);
+
+        let msg_len = met(3, ruz);
+        if msg_len > 0 {
+            let msg_bytes = &(ruz.as_bytes())[0..msg_len];
+            let (_msg_ida, msg) = IndirectAtom::new_raw_mut_bytes(stack, msg_bytes.len());
+            msg.copy_from_slice(msg_bytes);
+            ac_shas(msg, salt, out);
+        } else {
+            ac_shas(&mut [], salt, out);
+        }
+
         Ok(out_ida.normalize_as_atom().as_noun())
     }
 }
@@ -35,12 +37,21 @@ pub fn jet_shas(context: &mut Context, subject: Noun) -> Result {
 pub fn jet_shax(context: &mut Context, subject: Noun) -> Result {
     let stack = &mut context.stack;
     let sam = slot(subject, 6)?;
-    let msg = sam.as_atom()?;
-    let len = met(3, msg);
+    let ruz = sam.as_atom()?;
+    let msg_len = met(3, ruz);
 
     unsafe {
         let (mut ida, out) = IndirectAtom::new_raw_mut_bytes(stack, 32);
-        urcrypt_shay(msg.as_bytes().as_ptr(), len, out.as_mut_ptr());
+
+        if msg_len > 0 {
+            let msg_bytes = &(ruz.as_bytes())[0..msg_len];
+            let (_msg_ida, msg) = IndirectAtom::new_raw_mut_bytes(stack, msg_bytes.len());
+            msg.copy_from_slice(msg_bytes);
+            ac_shay(msg, out);
+        } else {
+            ac_shay(&mut [], out);
+        }
+
         Ok(ida.normalize_as_atom().as_noun())
     }
 }
@@ -48,19 +59,30 @@ pub fn jet_shax(context: &mut Context, subject: Noun) -> Result {
 pub fn jet_shay(context: &mut Context, subject: Noun) -> Result {
     let stack = &mut context.stack;
     let sam = slot(subject, 6)?;
-    let wid = slot(sam, 2)?.as_atom()?;
-    let dat = slot(sam, 3)?.as_atom()?;
+    let len = slot(sam, 2)?.as_atom()?;
+    let ruz = slot(sam, 3)?.as_atom()?;
 
-    let width = match wid.as_direct() {
+    let length = match len.as_direct() {
         Ok(direct) => direct.data() as usize,
         Err(_) => return Err(BAIL_FAIL),
     };
-
-    let message = dat.as_bytes();
+    let msg_len = met(3, ruz);
 
     unsafe {
         let (mut out_ida, out) = IndirectAtom::new_raw_mut_bytes(stack, 32);
-        urcrypt_shay(message.as_ptr(), width, out.as_mut_ptr());
+        if length == 0 {
+            ac_shay(&mut [], out);
+        } else if msg_len >= length {
+            let (mut _msg_ida, msg) = IndirectAtom::new_raw_mut_bytes(stack, length);
+            msg.copy_from_slice(&(ruz.as_bytes())[0..length]);
+            ac_shay(msg, out);
+        } else {
+            let msg_bytes = &(ruz.as_bytes())[0..msg_len];
+            let (mut _msg_ida, msg) = IndirectAtom::new_raw_mut_bytes(stack, length);
+            msg[0..msg_len].copy_from_slice(msg_bytes);
+            ac_shay(msg, out);
+        }
+
         Ok(out_ida.normalize_as_atom().as_noun())
     }
 }
@@ -68,41 +90,61 @@ pub fn jet_shay(context: &mut Context, subject: Noun) -> Result {
 pub fn jet_shal(context: &mut Context, subject: Noun) -> Result {
     let stack = &mut context.stack;
     let sam = slot(subject, 6)?;
-    let wid = slot(sam, 2)?.as_atom()?;
-    let dat = slot(sam, 3)?.as_atom()?;
+    let len = slot(sam, 2)?.as_atom()?;
+    let ruz = slot(sam, 3)?.as_atom()?;
 
-    let width = match wid.as_direct() {
+    let length = match len.as_direct() {
         Ok(direct) => direct.data() as usize,
         Err(_) => return Err(BAIL_FAIL),
     };
-
-    let message = &(dat.as_bytes())[0..met(3, dat)]; // drop trailing zeros
+    let msg_len = met(3, ruz);
 
     unsafe {
-        let (mut ida, out) = IndirectAtom::new_raw_mut_bytes(stack, 64);
-        urcrypt_shal(message.as_ptr(), width, out.as_mut_ptr());
-        Ok(ida.normalize_as_atom().as_noun())
+        let (mut out_ida, out) = IndirectAtom::new_raw_mut_bytes(stack, 64);
+        if length == 0 {
+            ac_shal(&mut [], out);
+        } else if msg_len >= length {
+            let (mut _msg_ida, msg) = IndirectAtom::new_raw_mut_bytes(stack, length);
+            msg.copy_from_slice(&(ruz.as_bytes())[0..length]);
+            ac_shal(msg, out);
+        } else {
+            let msg_bytes = &(ruz.as_bytes())[0..msg_len];
+            let (mut _msg_ida, msg) = IndirectAtom::new_raw_mut_bytes(stack, length);
+            msg[0..msg_len].copy_from_slice(msg_bytes);
+            ac_shal(msg, out);
+        }
+
+        Ok(out_ida.normalize_as_atom().as_noun())
     }
 }
 
 pub fn jet_sha1(context: &mut Context, subject: Noun) -> Result {
     let stack = &mut context.stack;
     let sam = slot(subject, 6)?;
-    let wid = slot(sam, 2)?.as_atom()?;
-    let dat = slot(sam, 3)?.as_atom()?;
+    let len = slot(sam, 2)?.as_atom()?;
+    let ruz = slot(sam, 3)?.as_atom()?;
 
-    let width = match wid.as_direct() {
+    let length = match len.as_direct() {
         Ok(direct) => direct.data() as usize,
         Err(_) => return Err(BAIL_FAIL),
     };
+    let msg_len = met(3, ruz);
 
     unsafe {
-        let msg_bytes = dat.as_bytes();
-        let (mut _msg_ida, msg) = IndirectAtom::new_raw_mut_bytes(stack, msg_bytes.len());
-        msg.copy_from_slice(msg_bytes);
-
         let (mut out_ida, out) = IndirectAtom::new_raw_mut_bytes(stack, 20);
-        urcrypt_sha1(msg.as_mut_ptr(), width, out.as_mut_ptr());
+        if length == 0 {
+            ac_sha1(&mut [], out);
+        } else if msg_len >= length {
+            let (mut _msg_ida, msg) = IndirectAtom::new_raw_mut_bytes(stack, length);
+            msg.copy_from_slice(&(ruz.as_bytes())[0..length]);
+            ac_sha1(msg, out);
+        } else {
+            let msg_bytes = &(ruz.as_bytes())[0..msg_len];
+            let (mut _msg_ida, msg) = IndirectAtom::new_raw_mut_bytes(stack, length);
+            msg[0..msg_len].copy_from_slice(msg_bytes);
+            ac_sha1(msg, out);
+        }
+
         Ok(out_ida.normalize_as_atom().as_noun())
     }
 }
@@ -118,6 +160,14 @@ mod tests {
     fn test_shas() {
         let c = &mut init_context();
 
+        let sam = T(&mut c.stack, &[D(1), D(0)]);
+        assert_jet_ubig(
+            c,
+            jet_shas,
+            sam,
+            ubig!(_0x4abac214e1e95fe0c60df79d09cbd05454a4cb958683e02318aa147f2a5e6d60),
+        );
+
         let sam = T(&mut c.stack, &[D(1), D(1)]);
         assert_jet_ubig(
             c,
@@ -155,6 +205,13 @@ mod tests {
     fn test_shax() {
         let c = &mut init_context();
 
+        assert_jet_ubig(
+            c,
+            jet_shax,
+            D(0), // ''
+            ubig!(_0x55b852781b9995a44c939b64e441ae2724b96f99c8f4fb9a141cfc9842c4b0e3),
+        );
+
         assert_jet_ubig(
             c,
             jet_shax,
@@ -196,6 +253,13 @@ mod tests {
     fn test_shay() {
         let c = &mut init_context();
 
+        let sam = T(&mut c.stack, &[D(0), D(0)]);
+        let ret = A(
+            &mut c.stack,
+            &ubig!(_0x55b852781b9995a44c939b64e441ae2724b96f99c8f4fb9a141cfc9842c4b0e3),
+        );
+        assert_jet(c, jet_shay, sam, ret);
+
         let sam = T(&mut c.stack, &[D(1), D(0)]);
         let ret = A(
             &mut c.stack,
@@ -243,20 +307,28 @@ mod tests {
     fn test_shal() {
         let c = &mut init_context();
 
-        let sam = T(&mut c.stack, &[D(1), D(1)]);
+        let sam = T(&mut c.stack, &[D(0), D(0)]);
         assert_jet_ubig(
             c,
             jet_shal,
             sam,
-            ubig!(_0x39e3d936c6e31eaac08fcfcfe7bb443460c61c0bd5b74408c8bcc35a6b8d6f5700bdcddeaa4b466ae65f8fb67f67ca62dc34149e1d44d213ddfbc13668b6547b)
+            ubig!(_0x3eda27f97a3238a5817a4147bd31b9632fec7e87d21883ffb0f2855d3cd1d047cee96cd321a9f483dc15570b05e420d607806dd6502854f1bdb8ef7e35e183cf)
         );
 
-        let sam = T(&mut c.stack, &[D(1), D(2)]);
+        let sam = T(&mut c.stack, &[D(1), D(0)]);
         assert_jet_ubig(
             c,
             jet_shal,
             sam,
-            ubig!(_0xcadc698fca01cf2935f760278554b4e61f35453975a5bb45389003159bc8485b7018dd8152d9cc23b6e9dd91b107380b9d14ddbf9cc037ee53a857b6c948b8fa)
+            ubig!(_0xee1069e3f03884c3e5d457253423844a323c29eb4cde70630b58c3712a804a70221d35d9506e242c9414ff192e283dd6caa4eff86a457baf93d68189024d24b8)
+        );
+
+        let sam = T(&mut c.stack, &[D(0), D(1)]);
+        assert_jet_ubig(
+            c,
+            jet_shal,
+            sam,
+            ubig!(_0x3eda27f97a3238a5817a4147bd31b9632fec7e87d21883ffb0f2855d3cd1d047cee96cd321a9f483dc15570b05e420d607806dd6502854f1bdb8ef7e35e183cf)
         );
 
         let wid = A(
@@ -282,20 +354,28 @@ mod tests {
     fn test_sha1() {
         let c = &mut init_context();
 
-        let sam = T(&mut c.stack, &[D(1), D(1)]);
+        let sam = T(&mut c.stack, &[D(0), D(0)]);
         assert_jet_ubig(
             c,
             jet_sha1,
             sam,
-            ubig!(_0xbf8b4530d8d246dd74ac53a13471bba17941dff7),
+            ubig!(_0xda39a3ee5e6b4b0d3255bfef95601890afd80709),
         );
 
-        let sam = T(&mut c.stack, &[D(1), D(2)]);
+        let sam = T(&mut c.stack, &[D(1), D(0)]);
         assert_jet_ubig(
             c,
             jet_sha1,
             sam,
-            ubig!(_0xc4ea21bb365bbeeaf5f2c654883e56d11e43c44e),
+            ubig!(_0x5ba93c9db0cff93f52b521d7420e43f6eda2784f),
+        );
+
+        let sam = T(&mut c.stack, &[D(0), D(1)]);
+        assert_jet_ubig(
+            c,
+            jet_sha1,
+            sam,
+            ubig!(_0xda39a3ee5e6b4b0d3255bfef95601890afd80709),
         );
 
         let wid = A(
diff --git a/rust/ares/src/mem.rs b/rust/ares/src/mem.rs
index a67e755..15a69de 100644
--- a/rust/ares/src/mem.rs
+++ b/rust/ares/src/mem.rs
@@ -878,6 +878,109 @@ impl NockStack {
             }
         }
     }
+
+    /**
+     * Debugging
+     *
+     * The below functions are useful for debugging NockStack issues. */
+
+    /**
+     * Walk down the NockStack, printing frames. Absolutely no safety checks are peformed, as the
+     * purpose is to discover garbage data; just print pointers until the bottom of the NockStack
+     * (i.e. a null frame pointer) is encountered. Possible to crash, if a frame pointer gets
+     * written over.
+     */
+    pub fn print_frames(&mut self) {
+        let mut fp = self.frame_pointer;
+        let mut sp = self.stack_pointer;
+        let mut ap = self.alloc_pointer;
+        let mut c = 0u64;
+
+        eprintln!("\r start = {:p}", self.start);
+
+        loop {
+            c += 1;
+
+            eprintln!("\r {}:", c);
+            eprintln!("\r frame_pointer = {:p}", fp);
+            eprintln!("\r stack_pointer = {:p}", sp);
+            eprintln!("\r alloc_pointer = {:p}", ap);
+
+            if fp.is_null() {
+                break;
+            }
+
+            unsafe {
+                if fp < ap {
+                    sp = *(fp.sub(STACK + 1) as *mut *mut u64);
+                    ap = *(fp.sub(ALLOC + 1) as *mut *mut u64);
+                    fp = *(fp.sub(FRAME + 1) as *mut *mut u64);
+                } else {
+                    sp = *(fp.add(STACK) as *mut *mut u64);
+                    ap = *(fp.add(ALLOC) as *mut *mut u64);
+                    fp = *(fp.add(FRAME) as *mut *mut u64);
+                }
+            }
+        }
+    }
+
+    /**
+     * Sanity check every frame of the NockStack. Most useful paired with a gdb session set to
+     * catch rust_panic.
+     */
+    pub fn assert_sane(&mut self) {
+        let start = self.start;
+        let limit = unsafe { self.start.add(self.size) };
+        let mut fp = self.frame_pointer;
+        let mut sp = self.stack_pointer;
+        let mut ap = self.alloc_pointer;
+        let mut ought_west: bool = fp < ap;
+
+        loop {
+            // fp is null iff sp is null
+            assert!(!(fp.is_null() ^ sp.is_null()));
+
+            // ap should never be null
+            assert!(!ap.is_null());
+
+            if fp.is_null() {
+                break;
+            }
+
+            // all pointers must be between start and size
+            assert!(fp as *const u64 >= start);
+            assert!(fp as *const u64 <= limit);
+            assert!(sp as *const u64 >= start);
+            assert!(sp as *const u64 <= limit);
+            assert!(ap as *const u64 >= start);
+            assert!(ap as *const u64 <= limit);
+
+            // frames should flip between east-west correctly
+            assert!((fp < ap) == ought_west);
+
+            // sp should be between fp and ap
+            if ought_west {
+                assert!(sp >= fp);
+                assert!(sp < ap);
+            } else {
+                assert!(sp <= fp);
+                assert!(sp > ap);
+            }
+
+            unsafe {
+                if ought_west {
+                    sp = *(fp.sub(STACK + 1) as *mut *mut u64);
+                    ap = *(fp.sub(ALLOC + 1) as *mut *mut u64);
+                    fp = *(fp.sub(FRAME + 1) as *mut *mut u64);
+                } else {
+                    sp = *(fp.add(STACK) as *mut *mut u64);
+                    ap = *(fp.add(ALLOC) as *mut *mut u64);
+                    fp = *(fp.add(FRAME) as *mut *mut u64);
+                }
+            }
+            ought_west = !ought_west;
+        }
+    }
 }
 
 impl NounAllocator for NockStack {
diff --git a/rust/ares/src/noun.rs b/rust/ares/src/noun.rs
index 114b7d8..39066fa 100644
--- a/rust/ares/src/noun.rs
+++ b/rust/ares/src/noun.rs
@@ -436,6 +436,15 @@ impl IndirectAtom {
         (noun, from_raw_parts_mut(ptr as *mut u8, size))
     }
 
+    /// Create an indirect atom backed by a fixed-size array
+    pub unsafe fn new_raw_mut_bytearray<'a, const N: usize, A: NounAllocator>(
+        allocator: &mut A,
+    ) -> (Self, &'a mut [u8; N]) {
+        let word_size = (std::mem::size_of::<[u8; N]>() + 7) >> 3;
+        let (noun, ptr) = Self::new_raw_mut_zeroed(allocator, word_size);
+        (noun, &mut *(ptr as *mut [u8; N]))
+    }
+
     /** Size of an indirect atom in 64-bit words */
     pub fn size(&self) -> usize {
         unsafe { *(self.to_raw_pointer().add(1)) as usize }
diff --git a/rust/ares/src/serf.rs b/rust/ares/src/serf.rs
index 00e83b3..3aa8031 100644
--- a/rust/ares/src/serf.rs
+++ b/rust/ares/src/serf.rs
@@ -143,7 +143,7 @@ impl Context {
         snapshot: Option<Snapshot>,
         constant_hot_state: &[HotEntry],
     ) -> Self {
-        let mut stack = NockStack::new(1024 << 10 << 10, 0);
+        let mut stack = NockStack::new(4096 << 10 << 10, 0);
         let newt = Newt::new();
         let cache = Hamt::<Noun>::new(&mut stack);
 
diff --git a/rust/ares_crypto/Cargo.lock b/rust/ares_crypto/Cargo.lock
new file mode 100644
index 0000000..4610dce
--- /dev/null
+++ b/rust/ares_crypto/Cargo.lock
@@ -0,0 +1,794 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac1f845298e95f983ff1944b728ae08b8cebab80d684f0a832ed0fc74dfa27e2"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
+[[package]]
+name = "aes-siv"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e08d0cdb774acd1e4dac11478b1a0c0d203134b2aab0ba25eb430de9b18f8b9"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "cmac",
+ "ctr",
+ "dbl",
+ "digest",
+ "zeroize",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "ares_crypto"
+version = "0.1.0"
+dependencies = [
+ "aes",
+ "aes-siv",
+ "assert_no_alloc",
+ "curve25519-dalek",
+ "ed25519-dalek",
+ "ibig",
+ "rand",
+ "sha1",
+ "sha2",
+ "urcrypt-sys",
+ "x25519-dalek",
+]
+
+[[package]]
+name = "assert_no_alloc"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55ca83137a482d61d916ceb1eba52a684f98004f18e0cafea230fe5579c178a3"
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bindgen"
+version = "0.68.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "726e4313eb6ec35d2730258ad4e15b547ee75d6afaa1361a922e78e59b7d8078"
+dependencies = [
+ "bitflags",
+ "cexpr",
+ "clang-sys",
+ "lazy_static",
+ "lazycell",
+ "log",
+ "peeking_take_while",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "syn",
+ "which",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "clang-sys"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67523a3b4be3ce1989d607a828d036249522dd9c1c8de7f4dd2dae43a37369d1"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "cmac"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8543454e3c3f5126effff9cd44d562af4e31fb8ce1cc0d3dcd8f084515dbc1aa"
+dependencies = [
+ "cipher",
+ "dbl",
+ "digest",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "rand_core",
+ "typenum",
+]
+
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89b8c6a2e4b1f45971ad09761aafb85514a84744b67a95e32c3cc1352d1f65c"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "platforms",
+ "rustc_version",
+ "subtle",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dbl"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd2735a791158376708f9347fe8faba9667589d82427ef3aed6794a8981de3d9"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f628eaec48bfd21b865dc2950cfa014450c01d2fa2b69a86c2fd5844ec523c0"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "sha2",
+ "subtle",
+]
+
+[[package]]
+name = "either"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+
+[[package]]
+name = "errno"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27573eac26f4dd11e2b1916c3fe1baa56407c83c71a773a8ba17ec0bca03b6b7"
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
+
+[[package]]
+name = "home"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "ibig"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1fcc7f316b2c079dde77564a1360639c1a956a23fa96122732e416cb10717bb"
+dependencies = [
+ "cfg-if",
+ "num-traits",
+ "rand",
+ "static_assertions",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
+[[package]]
+name = "libc"
+version = "0.2.152"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
+
+[[package]]
+name = "libloading"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c571b676ddfc9a8c12f1f3d3085a7b163966a8fd8098a90640953ce5f6170161"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4cd1a83af159aa67994778be9070f0ae1bd732942279cabb14f86f986a21456"
+
+[[package]]
+name = "log"
+version = "0.4.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+
+[[package]]
+name = "memchr"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+
+[[package]]
+name = "peeking_take_while"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69d3587f8a9e599cc7ec2c00e331f71c4e69a5f9a4b8a6efd5b07466b9736f9a"
+
+[[package]]
+name = "platforms"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "626dec3cac7cc0e1577a2ec3fc496277ec2baa084bebad95bb6fdbfae235f84c"
+
+[[package]]
+name = "prettyplease"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a41cf62165e97c7f814d2221421dbb9afcbcdb0a88068e5ea206e19951c2cbb5"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95fc56cda0b5c3325f5fbbd7ff9fda9e02bb00bb3dac51252d2f1bfa1cb8cc8c"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "regex"
+version = "1.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72e572a5e8ca657d7366229cdde4bd14c4eb5499a9573d4d366fe1b599daa316"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97ed7a9823b74f99c7742f5336af7be5ecd3eeafcb1507d1fa93347b1d589b0"
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7cee0529a6d40f580e7a5e6c495c8fbfe21b7b52795ed4bb5e62cdf92bc6380"
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "subtle"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
+
+[[package]]
+name = "syn"
+version = "2.0.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "typenum"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "urcrypt-sys"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ced751f95a527a3458eb67c75e4ae7093d41585edaa7565f5769101502473019"
+dependencies = [
+ "bindgen",
+ "pkg-config",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.0",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a18201040b24831fbb9e4eb208f8892e1f50a37feb53cc7ff887feb8f50e7cd"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.0",
+ "windows_aarch64_msvc 0.52.0",
+ "windows_i686_gnu 0.52.0",
+ "windows_i686_msvc 0.52.0",
+ "windows_x86_64_gnu 0.52.0",
+ "windows_x86_64_gnullvm 0.52.0",
+ "windows_x86_64_msvc 0.52.0",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7764e35d4db8a7921e09562a0304bf2f93e0a51bfccee0bd0bb0b666b015ea"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbaa0368d4f1d2aaefc55b6fcfee13f41544ddf36801e793edbbfd7d7df075ef"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a28637cb1fa3560a16915793afb20081aba2c92ee8af57b4d5f28e4b3e7df313"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffe5e8e31046ce6230cc7215707b816e339ff4d4d67c65dffa206fd0f7aa7b9a"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d6fa32db2bc4a2f5abeacf2b69f7992cd09dca97498da74a151a3132c26befd"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a657e1e9d3f514745a572a6846d3c7aa7dbe1658c056ed9c3344c4109a6949e"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
+
+[[package]]
+name = "x25519-dalek"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb66477291e7e8d2b0ff1bcb900bf29489a9692816d79874bea351e7a8b6de96"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
diff --git a/rust/ares_crypto/Cargo.toml b/rust/ares_crypto/Cargo.toml
new file mode 100644
index 0000000..e2b895b
--- /dev/null
+++ b/rust/ares_crypto/Cargo.toml
@@ -0,0 +1,37 @@
+[package]
+name = "ares_crypto"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+assert_no_alloc = "1.1.2"
+# use this when debugging requires allocation (e.g. eprintln)
+# assert_no_alloc = {version="1.1.2", features=["warn_debug"]}
+ibig = "0.3.6"
+
+# ed25519
+curve25519-dalek = {version = "4.1.1", default-features = false, optional = true }
+ed25519-dalek = { version = "2.1.0", default-features = false, optional = true }
+x25519-dalek = { version = "2.0.0", features = ["static_secrets"], default-features = false, optional = true}
+
+# aes_siv
+aes = { version = "0.8.3", default-features = false, optional = true }
+aes-siv = { version = "0.7.0", default-features = false, optional = true }
+
+# sha
+sha1 = { version = "0.10.6", default-features = false, optional = true }
+sha2 = { version = "0.10.8", default-features = false, optional = true }
+
+# test_vs_urcrypt
+rand = { version = "0.8.4", default-features = false, features = ["getrandom"], optional = true }
+urcrypt-sys = { version = "0.1.1", optional = true }
+
+[features]
+# XX turn off test_vs_urcrypt after development
+default = ["aes_siv", "ed25519", "sha"]
+aes_siv = ["aes", "aes-siv"]
+ed25519 = ["curve25519-dalek", "ed25519-dalek", "x25519-dalek"]
+sha = ["sha1", "sha2"]
+test_vs_urcrypt = ["urcrypt-sys", "rand"]
diff --git a/rust/ares_crypto/src/aes_siv.rs b/rust/ares_crypto/src/aes_siv.rs
new file mode 100644
index 0000000..c540938
--- /dev/null
+++ b/rust/ares_crypto/src/aes_siv.rs
@@ -0,0 +1,277 @@
+use aes_siv::aead::{generic_array::GenericArray, KeyInit};
+use aes_siv::siv::{Aes128Siv, Aes256Siv, CmacSiv};
+
+use aes::Aes192;
+type Aes192Siv = CmacSiv<Aes192>;
+
+#[derive(Debug)]
+pub enum Error {
+    InvalidKeyLength,
+    InvalidOutputLength,
+    InvalidHeadersLength,
+    CipherNotAuthentic,
+}
+
+/// AES-SIV encryption function.
+pub fn ac_aes_siv_en<const N: usize>(
+    key: &mut [u8; N],
+    message: &mut [u8],
+    data: &mut [&mut [u8]],
+    iv: &mut [u8; 16],
+    out: &mut [u8],
+) -> Result<(), Error> {
+    key.reverse();
+    message.reverse();
+    for item in data.iter_mut() {
+        item.reverse();
+    }
+
+    let iv_tag;
+    if N == 32 {
+        if let Ok(mut cipher) = Aes128Siv::new_from_slice(key) {
+            match cipher.encrypt_in_place_detached(data, message) {
+                Ok(tag) => iv_tag = tag,
+                Err(_) => return Err(Error::InvalidOutputLength),
+            }
+        } else {
+            return Err(Error::InvalidKeyLength);
+        }
+    } else if N == 48 {
+        if let Ok(mut cipher) = Aes192Siv::new_from_slice(key) {
+            match cipher.encrypt_in_place_detached(data, message) {
+                Ok(tag) => iv_tag = tag,
+                Err(_) => return Err(Error::InvalidOutputLength),
+            }
+        } else {
+            return Err(Error::InvalidKeyLength);
+        }
+    } else if N == 64 {
+        if let Ok(mut cipher) = Aes256Siv::new_from_slice(key) {
+            match cipher.encrypt_in_place_detached(data, message) {
+                Ok(tag) => iv_tag = tag,
+                Err(_) => return Err(Error::InvalidOutputLength),
+            }
+        } else {
+            return Err(Error::InvalidKeyLength);
+        }
+    } else {
+        return Err(Error::InvalidKeyLength);
+    }
+    let mut iv_slice = iv_tag.as_slice().to_owned();
+    iv_slice.reverse();
+    iv.copy_from_slice(&iv_slice);
+    key.reverse();
+    message.reverse();
+    out[0..message.len()].copy_from_slice(message);
+    Ok(())
+}
+
+/// AES-SIV decryption function.
+pub fn ac_aes_siv_de<const N: usize>(
+    key: &mut [u8; N],
+    message: &mut [u8],
+    data: &mut [&mut [u8]],
+    iv: &mut [u8; 16],
+    out: &mut [u8],
+) -> Result<(), Error> {
+    key.reverse();
+    message.reverse();
+    iv.reverse();
+    for item in data.iter_mut() {
+        item.reverse();
+    }
+
+    let iv_array = GenericArray::from_slice(iv);
+    if N == 32 {
+        if let Ok(mut cipher) = Aes128Siv::new_from_slice(key) {
+            match cipher.decrypt_in_place_detached(data, message, iv_array) {
+                Ok(_) => (),
+                Err(_) => return Err(Error::CipherNotAuthentic),
+            }
+        } else {
+            return Err(Error::InvalidKeyLength);
+        }
+    } else if N == 48 {
+        if let Ok(mut cipher) = Aes192Siv::new_from_slice(key) {
+            match cipher.decrypt_in_place_detached(data, message, iv_array) {
+                Ok(_) => (),
+                Err(_) => return Err(Error::CipherNotAuthentic),
+            }
+        } else {
+            return Err(Error::InvalidKeyLength);
+        }
+    } else if N == 64 {
+        if let Ok(mut cipher) = Aes256Siv::new_from_slice(key) {
+            match cipher.decrypt_in_place_detached(data, message, iv_array) {
+                Ok(_) => (),
+                Err(_) => return Err(Error::CipherNotAuthentic),
+            }
+        } else {
+            return Err(Error::InvalidKeyLength);
+        }
+    } else {
+        return Err(Error::InvalidKeyLength);
+    }
+    key.reverse();
+    message.reverse();
+    out.copy_from_slice(message);
+    Ok(())
+}
+
+#[cfg(test)]
+#[cfg(feature = "test_vs_urcrypt")]
+/// Compare the results of the ares_crypto functions with the corresponding
+/// urcrypt functions. To run, use `cargo test --features test_vs_urcrypt`
+/// from the `ares/rust/ares_crypto` directory.
+mod urcrypt_tests {
+    use super::ac_aes_siv_en;
+    use aes_siv::aead::rand_core::CryptoRngCore;
+    use rand::rngs::OsRng;
+    use urcrypt_sys::{
+        urcrypt_aes_siv_data, urcrypt_aes_siva_en, urcrypt_aes_sivb_en, urcrypt_aes_sivc_en,
+    };
+
+    #[test]
+    fn test_aes_siva_en() {
+        let mut uc_key = [0u8; 32];
+        let mut uc_message = [0u8; 56];
+        let mut uc_iv = [0u8; 16];
+        let mut uc_bytes = [0u8; 32];
+        let mut osrng = OsRng;
+        let csprng = osrng.as_rngcore();
+        csprng.fill_bytes(&mut uc_key);
+        csprng.fill_bytes(&mut uc_message);
+        csprng.fill_bytes(&mut uc_bytes);
+        let mut uc_data: [urcrypt_aes_siv_data; 1] = [urcrypt_aes_siv_data {
+            bytes: uc_bytes.as_mut_ptr(),
+            length: uc_bytes.len(),
+        }];
+        let mut uc_out = [0u8; 56];
+
+        let mut ac_key = uc_key;
+        let mut ac_message = uc_message;
+        let mut ac_iv = [0u8; 16];
+        let mut ac_bytes = uc_bytes;
+        let ac_data: &mut [&mut [u8]] = &mut [&mut ac_bytes];
+        let mut ac_out = [0u8; 56];
+
+        unsafe {
+            urcrypt_aes_siva_en(
+                uc_message.as_mut_ptr(),
+                uc_message.len(),
+                uc_data.as_mut_ptr(),
+                uc_data.len(),
+                uc_key.as_mut_ptr(),
+                uc_iv.as_mut_ptr(),
+                uc_out.as_mut_ptr(),
+            )
+        };
+
+        ac_aes_siv_en::<32>(
+            &mut ac_key,
+            &mut ac_message,
+            ac_data,
+            &mut ac_iv,
+            &mut ac_out,
+        )
+        .unwrap();
+
+        assert_eq!(ac_out, uc_out);
+    }
+
+    #[test]
+    fn test_aes_sivb_en() {
+        let mut uc_key = [0u8; 48];
+        let mut uc_message = [0u8; 56];
+        let mut uc_iv = [0u8; 16];
+        let mut uc_bytes = [0u8; 32];
+        let mut osrng = OsRng;
+        let csprng = osrng.as_rngcore();
+        csprng.fill_bytes(&mut uc_key);
+        csprng.fill_bytes(&mut uc_message);
+        csprng.fill_bytes(&mut uc_bytes);
+        let mut uc_data: [urcrypt_aes_siv_data; 1] = [urcrypt_aes_siv_data {
+            bytes: uc_bytes.as_mut_ptr(),
+            length: uc_bytes.len(),
+        }];
+        let mut uc_out = [0u8; 56];
+
+        let mut ac_key = uc_key;
+        let mut ac_message = uc_message;
+        let mut ac_iv = [0u8; 16];
+        let mut ac_bytes = uc_bytes;
+        let ac_data: &mut [&mut [u8]] = &mut [&mut ac_bytes];
+        let mut ac_out = [0u8; 56];
+
+        unsafe {
+            urcrypt_aes_sivb_en(
+                uc_message.as_mut_ptr(),
+                uc_message.len(),
+                uc_data.as_mut_ptr(),
+                uc_data.len(),
+                uc_key.as_mut_ptr(),
+                uc_iv.as_mut_ptr(),
+                uc_out.as_mut_ptr(),
+            )
+        };
+
+        ac_aes_siv_en::<48>(
+            &mut ac_key,
+            &mut ac_message,
+            ac_data,
+            &mut ac_iv,
+            &mut ac_out,
+        )
+        .unwrap();
+
+        assert_eq!(ac_out, uc_out);
+    }
+
+    #[test]
+    fn test_aes_sivc_en() {
+        let mut uc_key = [0u8; 64];
+        let mut uc_message = [0u8; 56];
+        let mut uc_iv = [0u8; 16];
+        let mut uc_bytes = [0u8; 32];
+        let mut osrng = OsRng;
+        let csprng = osrng.as_rngcore();
+        csprng.fill_bytes(&mut uc_key);
+        csprng.fill_bytes(&mut uc_message);
+        csprng.fill_bytes(&mut uc_bytes);
+        let mut uc_data: [urcrypt_aes_siv_data; 1] = [urcrypt_aes_siv_data {
+            bytes: uc_bytes.as_mut_ptr(),
+            length: uc_bytes.len(),
+        }];
+        let mut uc_out = [0u8; 56];
+
+        let mut ac_key = uc_key;
+        let mut ac_message = uc_message;
+        let mut ac_iv = [0u8; 16];
+        let mut ac_bytes = uc_bytes;
+        let ac_data: &mut [&mut [u8]] = &mut [&mut ac_bytes];
+        let mut ac_out = [0u8; 56];
+
+        unsafe {
+            urcrypt_aes_sivc_en(
+                uc_message.as_mut_ptr(),
+                uc_message.len(),
+                uc_data.as_mut_ptr(),
+                uc_data.len(),
+                uc_key.as_mut_ptr(),
+                uc_iv.as_mut_ptr(),
+                uc_out.as_mut_ptr(),
+            )
+        };
+
+        ac_aes_siv_en::<64>(
+            &mut ac_key,
+            &mut ac_message,
+            ac_data,
+            &mut ac_iv,
+            &mut ac_out,
+        )
+        .unwrap();
+
+        assert_eq!(ac_out, uc_out);
+    }
+}
diff --git a/rust/ares_crypto/src/ed25519.rs b/rust/ares_crypto/src/ed25519.rs
new file mode 100644
index 0000000..54b9083
--- /dev/null
+++ b/rust/ares_crypto/src/ed25519.rs
@@ -0,0 +1,199 @@
+use curve25519_dalek::edwards::CompressedEdwardsY;
+use ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey};
+use x25519_dalek::{PublicKey, StaticSecret};
+
+/// Generate a public key from the given seed and write it to the given output slice.
+pub fn ac_ed_puck(seed: &mut [u8; 32], out: &mut [u8; 32]) {
+    let signing_key = SigningKey::from_bytes(seed);
+    let verifying_key = signing_key.verifying_key();
+    *out = verifying_key.to_bytes();
+}
+
+/// Perform a key exchange between the given public key and the private key of
+/// the keypair generate from the given seed, writing the resulting shared key
+/// to the given output slice.
+pub fn ac_ed_shar(public: &[u8; 32], seed: &[u8; 32], out: &mut [u8; 32]) {
+    let self_key = SigningKey::from_bytes(seed);
+    let self_secret = StaticSecret::from(self_key.to_scalar_bytes());
+
+    if let Ok(compressed_ed_pt) = CompressedEdwardsY::from_slice(public) {
+        if let Some(ed_pt) = compressed_ed_pt.decompress() {
+            let public_key = PublicKey::from(ed_pt.to_montgomery().to_bytes());
+            let shared_secret = self_secret.diffie_hellman(&public_key);
+            *out = shared_secret.to_bytes();
+        }
+    }
+}
+
+/// Sign a message with the given seed and write the resulting signature to the
+/// given output slice.
+pub fn ac_ed_sign(msg: &[u8], seed: &[u8; 32], out: &mut [u8; 64]) {
+    let signing_key = SigningKey::from_bytes(seed);
+    let signature = signing_key.sign(msg);
+    *out = signature.to_bytes();
+}
+
+/// Verify a signature of the given message with the given public key.
+pub fn ac_ed_veri(msg: &[u8], public: &[u8; 32], signature: &[u8; 64]) -> bool {
+    if let Ok(verifying_key) = VerifyingKey::from_bytes(public) {
+        verifying_key
+            .verify(msg, &Signature::from_bytes(signature))
+            .is_ok()
+    } else {
+        false
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use ibig::ubig;
+
+    use super::{ac_ed_puck, ac_ed_sign, ac_ed_veri};
+
+    #[test]
+    fn test_ed_puck() {
+        let mut seed: [u8; 32] = [0; 32];
+        let mut public_key: [u8; 32] = [0; 32];
+        ac_ed_puck(&mut seed, &mut public_key);
+        assert_eq!(
+            public_key,
+            [
+                59, 106, 39, 188, 206, 182, 164, 45, 98, 163, 168, 208, 42, 111, 13, 115, 101, 50,
+                21, 119, 29, 226, 67, 166, 58, 192, 72, 161, 139, 89, 218, 41
+            ]
+        );
+    }
+
+    // #[test]
+    // fn test_ed_shar() {
+    // }
+
+    #[test]
+    fn test_ed_sign() {
+        // from https://datatracker.ietf.org/doc/html/rfc8032#section-7.1
+        let msg = b"Ares has long exerted a pull on the human imagination.";
+        let seed_src = &ubig!(_0x4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb)
+            .to_le_bytes();
+        let mut seed: [u8; 32] = [0; 32];
+        seed.copy_from_slice(seed_src);
+        let mut signature: [u8; 64] = [0; 64];
+        ac_ed_sign(msg, &seed, &mut signature);
+        let constant_signature = [
+            112, 132, 235, 218, 21, 180, 5, 48, 145, 211, 212, 153, 255, 229, 198, 165, 64, 140,
+            246, 27, 0, 97, 185, 143, 180, 10, 38, 68, 200, 71, 231, 108, 141, 26, 97, 207, 199,
+            204, 0, 123, 250, 161, 182, 92, 48, 116, 144, 42, 204, 6, 199, 162, 10, 66, 173, 185,
+            155, 96, 240, 56, 224, 187, 160, 1,
+        ];
+
+        assert_eq!(signature, constant_signature);
+    }
+
+    #[test]
+    fn test_ed_veri() {
+        let msg = b"The erratically moving red star in the sky was seen as sinister or violent by the ancients.";
+
+        let mut seed = [42; 32];
+        let mut public_key: [u8; 32] = [0; 32];
+        ac_ed_puck(&mut seed, &mut public_key);
+
+        let mut signature: [u8; 64] = [0; 64];
+        ac_ed_sign(msg, &seed, &mut signature);
+
+        let valid = ac_ed_veri(msg, &public_key, &signature);
+
+        assert!(valid);
+    }
+}
+
+#[cfg(test)]
+#[cfg(feature = "test_vs_urcrypt")]
+/// Compare the results of the ares_crypto functions with the corresponding
+/// urcrypt functions. To run, use `cargo test --features test_vs_urcrypt`
+/// from the `ares/rust/ares_crypto` directory.
+mod urcrypt_tests {
+    use super::{ac_ed_puck, ac_ed_shar, ac_ed_sign, ac_ed_veri};
+    use ibig::ubig;
+    use urcrypt_sys::{urcrypt_ed_puck, urcrypt_ed_shar, urcrypt_ed_sign, urcrypt_ed_veri};
+
+    #[test]
+    fn test_ed_puck() {
+        let mut seed: [u8; 32] = [42; 32];
+
+        let mut uc_out: [u8; 32] = [0; 32];
+        unsafe { urcrypt_ed_puck(seed.as_ptr(), uc_out.as_mut_ptr()) };
+
+        let mut ac_out: [u8; 32] = [0; 32];
+        ac_ed_puck(&mut seed, &mut ac_out);
+
+        assert_eq!(ac_out, uc_out);
+    }
+
+    #[test]
+    fn test_ed_shar() {
+        let public_key_src =
+            &ubig!(_0xd75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a)
+                .to_le_bytes();
+        let mut public_key: [u8; 32] = [0; 32];
+        public_key.copy_from_slice(public_key_src);
+
+        let seed_src = &ubig!(_0x4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb)
+            .to_le_bytes();
+        let mut seed: [u8; 32] = [0; 32];
+        seed.copy_from_slice(seed_src);
+
+        let mut uc_out: [u8; 32] = [0; 32];
+        unsafe { urcrypt_ed_shar(public_key.as_ptr(), seed.as_ptr(), uc_out.as_mut_ptr()) };
+
+        let mut ac_out: [u8; 32] = [0; 32];
+        ac_ed_shar(&public_key, &seed, &mut ac_out);
+
+        assert_eq!(ac_out, uc_out);
+    }
+
+    #[test]
+    fn test_ed_sign() {
+        let msg = b"The Greeks identified it with Ares, the god of war.";
+
+        let seed_src = &ubig!(_0x4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb)
+            .to_le_bytes();
+        let mut seed: [u8; 32] = [0; 32];
+        seed.copy_from_slice(seed_src);
+
+        let mut uc_out: [u8; 64] = [0; 64];
+        unsafe { urcrypt_ed_sign(msg.as_ptr(), msg.len(), seed.as_ptr(), uc_out.as_mut_ptr()) };
+
+        let mut ac_out: [u8; 64] = [0; 64];
+        ac_ed_sign(msg, &seed, &mut ac_out);
+
+        assert_eq!(ac_out, uc_out);
+    }
+
+    #[test]
+    fn test_ed_veri() {
+        let msg = b"The Babylonians named it after Nergal, god of the underworld.";
+
+        let seed_src = &ubig!(_0x4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb)
+            .to_le_bytes();
+        let mut seed: [u8; 32] = [0; 32];
+        seed.copy_from_slice(seed_src);
+
+        let mut public_key: [u8; 32] = [0; 32];
+        ac_ed_puck(&mut seed, &mut public_key);
+
+        let mut signature: [u8; 64] = [0; 64];
+        ac_ed_sign(msg, &seed, &mut signature);
+
+        let uc_out = unsafe {
+            urcrypt_ed_veri(
+                msg.as_ptr(),
+                msg.len(),
+                public_key.as_ptr(),
+                signature.as_ptr(),
+            )
+        };
+
+        let ac_out = ac_ed_veri(msg, &public_key, &signature);
+
+        assert_eq!(ac_out, uc_out);
+    }
+}
diff --git a/rust/ares_crypto/src/lib.rs b/rust/ares_crypto/src/lib.rs
new file mode 100644
index 0000000..0942dba
--- /dev/null
+++ b/rust/ares_crypto/src/lib.rs
@@ -0,0 +1,8 @@
+#[cfg(feature = "aes_siv")]
+pub mod aes_siv;
+
+#[cfg(feature = "ed25519")]
+pub mod ed25519;
+
+#[cfg(feature = "sha")]
+pub mod sha;
diff --git a/rust/ares_crypto/src/sha.rs b/rust/ares_crypto/src/sha.rs
new file mode 100644
index 0000000..51eedde
--- /dev/null
+++ b/rust/ares_crypto/src/sha.rs
@@ -0,0 +1,118 @@
+use sha1::{Digest, Sha1};
+use sha2::{Sha256, Sha512};
+
+/// Hashes a message using SHA-1.
+pub fn ac_sha1(message: &mut [u8], out: &mut [u8]) {
+    message.reverse();
+    let mut hasher = Sha1::new();
+    hasher.update(message);
+    let mut result = hasher.finalize();
+    result.reverse();
+    out.copy_from_slice(&result);
+}
+
+/// Hashes a message using SHA-256.
+pub fn ac_shay(message: &mut [u8], out: &mut [u8]) {
+    let mut hasher = Sha256::new();
+    hasher.update(message);
+    let result = hasher.finalize();
+    out.copy_from_slice(&result);
+}
+
+/// Hashes a message using SHA-512.
+pub fn ac_shal(message: &mut [u8], out: &mut [u8]) {
+    let mut hasher = Sha512::new();
+    hasher.update(message);
+    let result = hasher.finalize();
+    out.copy_from_slice(&result);
+}
+
+/// Hashes a message and salt using SHA-256.
+pub fn ac_shas(message: &mut [u8], salt: &mut [u8], out: &mut [u8]) {
+    let mut mid: [u8; 32] = [0; 32];
+    ac_shay(message, &mut mid);
+
+    if salt.len() > 32 {
+        for i in 0..32 {
+            salt[i] ^= mid[i];
+        }
+        ac_shay(salt, out);
+    } else {
+        for i in 0..salt.len() {
+            mid[i] ^= salt[i];
+        }
+        ac_shay(&mut mid, out);
+    }
+}
+
+#[cfg(test)]
+#[cfg(feature = "test_vs_urcrypt")]
+/// Compare the results of the ares_crypto functions with the corresponding
+/// urcrypt functions. To run, use `cargo test --features test_vs_urcrypt`
+/// from the `ares/rust/ares_crypto` directory.
+mod urcrypt_tests {
+    use super::{ac_sha1, ac_shal, ac_shas, ac_shay};
+    use urcrypt_sys::{urcrypt_sha1, urcrypt_shal, urcrypt_shas, urcrypt_shay};
+
+    #[test]
+    fn test_sha1() {
+        let mut message: [u8; 32] = [42; 32];
+
+        let mut uc_out: [u8; 20] = [0; 20];
+        unsafe { urcrypt_sha1(message.as_mut_ptr(), message.len(), uc_out.as_mut_ptr()) };
+
+        let mut ac_out: [u8; 20] = [0; 20];
+        ac_sha1(&mut message, &mut ac_out);
+
+        assert_eq!(ac_out, uc_out);
+    }
+
+    #[test]
+    fn test_shay() {
+        let mut message: [u8; 32] = [42; 32];
+
+        let mut uc_out: [u8; 32] = [0; 32];
+        unsafe { urcrypt_shay(message.as_mut_ptr(), message.len(), uc_out.as_mut_ptr()) };
+
+        let mut ac_out: [u8; 32] = [0; 32];
+        ac_shay(&mut message, &mut ac_out);
+
+        assert_eq!(ac_out, uc_out);
+    }
+
+    #[test]
+    fn test_shal() {
+        let mut message: [u8; 32] = [42; 32];
+
+        let mut uc_out: [u8; 64] = [0; 64];
+        unsafe { urcrypt_shal(message.as_mut_ptr(), message.len(), uc_out.as_mut_ptr()) };
+
+        let mut ac_out: [u8; 64] = [0; 64];
+        ac_shal(&mut message, &mut ac_out);
+
+        assert_eq!(ac_out, uc_out);
+    }
+
+    #[test]
+    fn test_shas() {
+        let mut message: [u8; 32] = [42; 32];
+
+        let mut uc_salt: [u8; 32] = [43; 32];
+        let mut uc_out: [u8; 32] = [0; 32];
+        unsafe {
+            urcrypt_shas(
+                uc_salt.as_mut_ptr(),
+                uc_salt.len(),
+                message.as_ptr(),
+                message.len(),
+                uc_out.as_mut_ptr(),
+            )
+        };
+
+        let mut ac_salt: [u8; 32] = [43; 32];
+        let mut ac_out: [u8; 32] = [0; 32];
+        ac_shas(&mut message, &mut ac_salt, &mut ac_out);
+
+        assert_eq!(ac_out, uc_out);
+    }
+}
diff --git a/rust/ares_pma/c-src/btree.c b/rust/ares_pma/c-src/btree.c
index ab266b4..24dff2f 100644
--- a/rust/ares_pma/c-src/btree.c
+++ b/rust/ares_pma/c-src/btree.c
@@ -122,7 +122,7 @@ off2addr(vaof_t off)
 #define BT_NUMMETAS 2                     /* 2 metapages */
 #define BT_META_SECTION_WIDTH (BT_NUMMETAS * BT_PAGESIZE)
 #define BT_ADDRSIZE (BT_PAGESIZE << BT_PAGEWORD)
-#define PMA_GROW_SIZE_p (1024)
+#define PMA_GROW_SIZE_p (10000000)
 #define PMA_GROW_SIZE_b (BT_PAGESIZE * PMA_GROW_SIZE_p)
 
 #define BT_NOPAGE 0
diff --git a/rust/flake.nix b/rust/flake.nix
index f311b0c..aefd21a 100644
--- a/rust/flake.nix
+++ b/rust/flake.nix
@@ -35,6 +35,7 @@
             pkgs.llvmPackages.clang
             pkgs.pkg-config
             pkgs.urcrypt
+            pkgs.glibc.static
           ] ++
             (nixpkgs.lib.lists.optional (parsedSystem.kernel.name != "darwin") pkgs.gdb); # nixpkgs won't build gdb for darwin
         };