[dghgit]

Summary

Adds bouncycastle-camellia: a constant-time, table-free, low-memory Camellia block cipher (RFC 3713), ported from Bouncy Castle Java's CamelliaEngine/CamelliaLightEngine, on the key objects of #172: Camellia128Key<M>, Camellia192Key<M> and Camellia256Key<M> over the engines Camellia128Internal and friends.

Rebased onto feature/key-rework-memory (#172) on 2026-10-25 and ported to its key-object design; the base is now that branch. The review round of PR #140 is applied here in the last three commits: the keys' leftover MAC-key path is gone, the CLI matches the AES commands, the Memory Usage table is measured, the style and nit items are fixed, and the Wycheproof CAMELLIA-CCM suite runs through the mode traits. The four-mode scope (no AEAD roles) is unchanged.

Description

• All four S-boxes are Boolean circuits (SBOX1 found by exhaustive search, reusing the Boyar-Peralta AES non-linear section via a field isomorphism; SBOX2-4 are bit-rotations of it, done as plane renumberings).
• Bit-sliced over 32-bit planes, four blocks at a time.
• CamelliaKey<P, M> mirrors AESKey: the key holds the mode's state, its workers borrow it, and which role pair a key carries is decided by its mode. The crate aliases CBC, CFB, CFB8 and CTR (Camellia_CBC_128<'k, Dir, Pad>, Camellia_CFB_128<'k, Dir>, ...); the keys carry the symmetric and block role pairs only, which cover those four modes; the engines implement ModeNames for all nine, so the mode types over them are named, but a key under GCM, CCM, CMAC or ECB<Blocks> has no role. Keys and engines implement PartialEq / Eq in constant time over the expanded schedule, as on Key object rework: the traits lose their constructors, every mode gets a key, and workers borrow the key #172.
• CLI subcommands camellia{128,192,256}-{cbc,cfb,cfb8,ctr}, through the key objects, with the aes*-* contract: camellia*-cbc is CBC<PKCS7> at any length, every command takes --iv/--iv-file (the IV or nonce is in band otherwise) and -d/--direction.

Scope and Risk

New crate only; the shared changes it carries (the bouncycastle-camellia workspace entry, the umbrella re-export, the memory bench) are additive. No behavioural change to AES or other existing ciphers.

Validation

• RFC 3713 Appendix A vectors; all 3840 NTT CRYPTREC t_camellia.txt vectors; BC Java's own CamelliaTest vectors, through the engines. OpenSSL CBC and CFB128 vectors, RFC 5528's nine CTR vectors (through a reference built from the SP 800-38A equations, which the CTR keys are held to) and the CFB8 equations through the keys; Wycheproof CBC-PKCS5 (216 cases, 144 invalid) through Camellia*Key<CBC<PKCS7>>, and Wycheproof camellia_ccm_test.json (486 of 552 cases dispatchable, those within SP 800-38C A.1's nonce and tag sets) through the CCM mode traits over the engines.
• Shared frameworks over the keys: TestFrameworkFromKeyMaterial for every mode, and the block, symmetric and stream suites.
• cargo test --workspace: all passing; cargo test --workspace --all-targets --no-run builds the benches; cargo +nightly fmt --check clean. The CLI integration tests pin the OpenSSL CBC and CFB vectors through the binary in both directions, encryption under --iv.
• cargo mutants -p bouncycastle-camellia after the review fixes: 577 mutants, 537 caught, 27 unviable, 13 missed (the same XOR/OR equivalences in ortho::swap, p, fl, flinv, the S-box layer and join as before).

AI Usage Statement

• Yes, non-trivial code changes were generated by AI

Assisted-by: Claude:claude-sonnet-5
Assisted-by: Claude:claude-mythos-5-1

🤖 Generated with Claude Code

[ounsworth]

We had agreed not to add more ciphers until we get through reviewing and locking in the overall architecture via the AES work. Closing this PR for now.

[dghgit]

The review round of PR #140 applied here, in 63275706, e690b87b and c415e08c (branch head c415e08c):

1. Key roles. as_cipher_key and the _ => arms are gone from the three constructors, and check_key_type with them: the permutation's own validation is the same check for every mode that has a role. A scoped cargo mutants on key.rs is 0 missed. The four-mode scope is unchanged; the Wycheproof gap is closed on it: camellia_ccm_test.json runs through the CCM mode traits over the engines (486 of 552 cases, those within SP 800-38C A.1's nonce and tag sets at the three key lengths; the rest counted as unsupported as the AES suite does), beside the CBC-PKCS5 file the crate already ran.
2. CLI. camellia*-cbc is CBC<PKCS7> at any length; all twelve commands take --iv/--iv-file and -d/--direction. The CLI tests pin encryption now: camellia*-cbc encrypt --iv reproduces the OpenSSL CBC chains plus the PKCS7 block (computed from the permutation of the key's length) and camellia*-cfb encrypt --iv reproduces the CFB chains exactly.
3. Heading is # 🚨 Security Considerations 🚨, anchor updated.
4. Memory Usage tabulates measured per-entry-point stack per key length (new 464/592/592 B, one- and four-block 96 B, two-block 112 B), by the same method and toolchain as the SM4 table, with the same caveat about the AES figures.
5. The three public-behaviour unit tests moved to alg_name_tests.rs or went; the Sec 2.3.3 subkey-swap pin stays.
   6–13. Manifest comment, the sm4 citation in bitslice.rs, BlockPermutation attributions, ECB<PKCS7> in the key docs, "An Camellia", the CLI test citations, and every doc line within 100 columns.
6. cargo mutants -p bouncycastle-camellia after the changes: 577 mutants, 537 caught, 27 unviable, 13 missed, the same XOR/OR equivalences as before. PR description updated.

cargo test --workspace, --all-targets --no-run, rustdoc with warnings denied and rustfmt are clean.