Remove aes_armv8 flag

[dani-garcia]

🎟️ Tracking

📔 Objective

This has been enabled by default in aes 0.9 already: https://github.com/RustCrypto/block-ciphers/blob/master/aes/CHANGELOG.md#changed

🚨 Breaking Changes

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the removal of the aes_armv8 rustflag from .cargo/config.toml. The flag is redundant for bitwarden-crypto, which uses aes 0.9.1 where the ARMv8 backend is enabled by default (as the PR description notes). One nuance worth confirming: the dependency tree also resolves aes 0.8.4 transitively via snow, where the flag was still doing work on aarch64.

Code Review Details

• ❓ : aes 0.8.4 (via snow) still relied on the flag for ARMv8 acceleration — confirm the aarch64 perf tradeoff on the negotiable AES-GCM Noise cipher suite is intentional (performance-only, not a security regression)
  • .cargo/config.toml:4-6

[claude]

❓ QUESTION: The tree still resolves aes 0.8.4 alongside aes 0.9.1 — was the loss of ARMv8 acceleration for the 0.8.x path intended?

Details

The default-on ARMv8 backend applies to aes 0.9, which bitwarden-crypto uses (aes 0.9.1), so removing the flag there is a no-op — good.

However, Cargo.lock also pins aes 0.8.4, pulled in transitively via snow → aes-gcm 0.10.3. In aes 0.8.x the ARMv8 hardware backend is still gated behind the aes_armv8 cfg (that gating is exactly what the 0.9 changelog removed). The AESGCM Noise cipher suite is negotiable in the IPC handshake (crates/bitwarden-ipc/src/crypto_provider/noise/handshake.rs:39-40), so on native aarch64 builds (Android arm64-v8a, iOS) that path now falls back to the software AES backend.

This is a performance regression only — the RustCrypto software AES implementation is constant-time, so there's no timing side-channel — and IPC transport is not a hot path relative to vault crypto. Just confirming this tradeoff was intentional rather than an unnoticed side effect of the second aes version. If undesired, either keep the flag or nudge snow/aes-gcm to a version on aes 0.9.

[quexten]

Android and ios do not use IPC. This can be ignored.

[github-actions]

🔍 SDK Breaking Change Detection

SDK Version: ps/remove-aes-armv8-flag (6097452)

⚠️ If breaking changes are detected, a corresponding pull request addressing them must be ready for merge in the affected client repository.

Client	Status	Details
typescript	✅ No breaking changes detected	Compilation passed with new SDK version - View Details
android	✅ No breaking changes detected	Compilation passed with new SDK version - View Details

---

Breaking change detection uses the build of the SDK from this branch, including any incompatibities pre-existing on or merged into this branch. Check the workflow logs to confirm.
Results update as workflows complete.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.09%. Comparing base (03bcd1f) to head (6097452).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1249   +/-   ##
=======================================
  Coverage   85.09%   85.09%           
=======================================
  Files         477      477           
  Lines       65934    65934           
=======================================
  Hits        56109    56109           
  Misses       9825     9825           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.