November 8, 2026 · kixelated

Vibe Slopped Cryptography

I’m one of the OG “rewrite it in Rust” guys. I love Rust.

Unfortunately, I wrote my last line of Rust 6 months ago. I still want Claude to write everything in Rust, but it’s difficult when rustc turns my desktop into lava.

I spent some tokens investigating on how to speed up builds for MoQ. One finding was that aws-lc-rs takes 60s+ to build. wtf why does a single crate take a full minute to build?

Despite the suffix, aws-lc-rs is actually a C library in disguise. Same with the next best crypto library: ring. wtf is C doing in my Rust library.

I did what any sane software engineer does in current_year, I pulled a 9-year old gaming PC out of the closet, installed Claude, and ran /goal rewrite it in rust *.

* and a lot of assembly

WOW FAST

rind is vibe slopped crypto. This statement alone should fill me with mortal dread, but AI is advancing so quickly that it’s no longer absurd.

Not only was Opus able to make builds faster, it made the runtime faster too.

^ This is a big deal because AES-128-GCM is the most popular TLS cipher suite by far. Even this relatively tiny reduction in CPU usage has huge impact when multiplied across every HTTPS request in the world*.

Rind started as fork of Graviola and quickly morphed into a monsterish combination of ring and aws-lc-rs (both fork BoringSSL, a fork of OpenSSL). Bits of libcrux were throw in there for good measure.

The engineers who developed these libraries are smarter than me. But I have a credit card in current_year and don’t need to be smart any more.

* this benchmark is HTTP/3 specific. HTTP/1 and HTTP/2 use different payload sizes.

WOW FAST

Rust gets dunked on for compile speeds but nerds forget that C/C++ can also be terrible.

Most of the time these builds are cached anyway but IDK it’s still nice to see smaller number. PSA You should be using mbx for Rust instead of complaining on Twitter about cargo target sizee and build times.

Also it’s nice from a maintainer point of view because aws-lc-rs does not compile on a lot of machines. rind doesn’t support every architecture yet either only because I don’t have test hardware.

Wow fast

Having accomplished my goal of making MoQ faster, I let my 9-year-old gaming PC take a vacation. This poor machine was awoken from retirement and forced to run crypto benchmarks.

lul jk I ran: /goal: Support every algorithm, and make it the fastest.

AI is really fucking good at benchmarks. Moments like this fill me with dread as a professional software engineer.

A decade ago, I wasted weeks speeding up Go’s crypto. I was that guy, hand-writing assembly to use the PCLMULQDQ instruction for massive performance gains (AES-GCM). It didn’t even get merged because I insisted on trying to change the Go API like an idiot.

I should have just waited a decade for Opus 5.5 instead. idiot.

Lean into Lean

But does it actually work? How can we build confidence?

I saw an Anthropic blog post about formal verification. Like most programmers, I don’t even test my code, let alone formally verify it. But I figured I’d play along and waste a few more tokens chasing the dragon.

Because like, if you can prove the vibe slop is correct, it’s no longer vibe slop right?

Many of these implementations are faster AND formally verified. Including the afformentioned AES-GCM (the goat). At least according to Claude so grain of salt folks.

My goal is to get every algorithm formally proven. Claude says that will take years.

If only there was somebody in the audience works for a frontier lab and wants some easy marketting piece. Steal the glory from the cryptographers instead of the mathematicians.

Please Donate Tokens

If it sounds like I’m desparate and begging for more tokens, ur right.

So I came up with a plan. I decided the best way to get tokens is to rage bait.

Bun is SUPER SLOW.
Holy shit it’s like REALLY SLOW.
Imagine doing super common stuff like TLS certificate generation in Bun.
Super SLOW.

I threw Deprecated Deno in just because it uses RustCrypto. Oh man, I used to hate RustCrypto back when I was a programmer. Do not use it, even though they registered official sounding crates like aes and rsa.

Anyway, back to dunking on JS runtimes for being slow at things they weren’t designed to do, like cryptography:

Did the rage bait work? Login to your work account, choose the unreleased model, then /quest-spawn to work on the backlog I planned.

k thx

try it?

Up to you, it depends on your tolerance for vibe slop. This is cryptography so it’s dangerous to get wrong.

But as Sun Tzu once said: yolo

# safer/faster API
rind = "0.3"

# if you use ring
ring = { package = "rind-ring", version = "0.17" }

# if you use rustls
rustls = { version = "0.23", default-features = false, features = ["std", "tls12"] }
rind-rustls = "0.23"

# if you use aws-lc-rs
aws-lc-rs = { package = "rind-aws-lc-rs", version = "1" }

There’s other adapters too if you’re lazy. Or just tell Mr AI to migrate to the rind API.

The Bill

All of this crypto jizz, it must have been expensive, right?

This took my 9-year old desktop PC… 12 days. And much of that was waiting for a usage reset.

The total was about $4.2k at API pricing. But API pricing is a meme.

That’s right, my credit card made the internet a better place* for $40. It’s ridiculous.

* Assuming anybody actually uses this library.

FIN

Real talk: Programming is dead. We had a good run.

Many of these crypto libraries have been hand optimized by some of the smartest people I know (cryptography nerds). And they get completely blown out of the water by a vibe coder.

I know we still need humans to tell the AI to do dumb shit. Like to rewrite libraries in Rust. I know that AI is still terrible at anything involving user experience.

But like, for how much longer?