EME2 Mode (wide-block mode)

[hacer-bark]

Hi everyone!

I would like to propose adding the EME2 (Encrypt-Mix-Encrypt Version 2) mode of operation to the RustCrypto workspace. I've implemented it in pure Rust based on the IEEE P1619.2 specification, and it is currently published independently on crates.io as eme2.

If merged, this would introduce the first truly wide-block encryption mode to the RustCrypto block-modes ecosystem.

Implementation Details

• Pure Rust: The current crate is written entirely in Rust.
• It is EME2, not EME: It implements the ciphertext stealing logic described in the "EME*" which is standard for the EME2. No padding required.
• Cipher Agnostic: It is successfully tested against RustCrypto's aes and serpent backends.
• Testing: Verified against self-computed test vectors. (Note: I can integrate the official IEEE 1619.2 test vectors during the PR process, IF any of you have the IEEE PDF or test vectors for EME2 which are hidden behind paywall).

API Design & Trait Compatibility

I have designed the API to be as compatible as possible with the broader RustCrypto ecosystem, but there is one necessary architectural divergence:

Because EME2 is a two-pass wide-block cipher mode, it inherently requires different logic for encryption and decryption. Therefore, it cannot implement the StreamCipher trait's .apply_keystream() method (where encryption and decryption are identical XOR operations). Instead, the crate currently exposes explicit .encrypt() and .decrypt() methods to handle the distinct multi-pass operations. There is simply NO way to squeeze EME2 into a single .apply_keystream operation per it's design.

It is documented in the crate descriptions as well as edge case with the threefish cipher.

Next Steps

I would love to upstream this into the RustCrypto organization so others can easily access a modern, wide-block mode.

Are the maintainers open to a Pull Request for this? If so, I am more than happy to open PR request or hear recommendation before submitting.