HACL*, Vale and EverCrypt
Direct answerHACL* is a library of cryptographic primitives verified in F* for memory safety, functional correctness and secret independence, with Vale providing verified assembly and EverCrypt a unified API. Its code runs in Firefox, the Linux kernel, mbedTLS and WireGuard.
- Maintainer
- Project Everest (Inria Prosecco, Microsoft Research, CMU)
- Website
- https://hacl-star.github.io
- Repository
- https://github.com/hacl-star/hacl-star
- Category
- Verified implementations
- Targets
- C and assembly primitivesFirefox NSSLinux kernelmbedTLSWireGuard
- Approach
- Verified C extracted from F* (HACL*) and verified assembly (Vale), unified in EverCrypt
- Access
- Open source
- Status (2026-09-13)
- Maintained; post-quantum work moved to libcrux/hax
What HACL*, Vale and EverCrypt does
HACL* proved that verified cryptography can be deployed at internet scale. Its lineage continues in libcrux and hax for post-quantum algorithms.
Where it is strong
- Broadest deployment of any verified library.
- Memory safety, correctness and constant-time in one framework.
- Agile multiplexing in EverCrypt.
Limits and caveats
- Classical primitives; post-quantum lives in libcrux.
- F* expertise required to extend.
- Extraction toolchain is complex.
When to choose it
Use HACL* when you need verified classical primitives as a library; use hax/libcrux for post-quantum.
Who works with HACL*, Vale and EverCrypt
No firm on this index lists HACL*, Vale and EverCrypt as a core tool yet; the firms below cover the same problem class.
Top-listed for implementation verification work: zkSecurity
Listed first for the depth of its public formal verification work: the only firm on this index maintaining a circuit framework whose default deliverable is both soundness and completeness (Clean), with verified Keccak, SHA-256, BLAKE3 and Poseidon gadgets, a zkVM verification substrate adopted by Succinct, two live proof-checked challenge platforms, and a published hands-on comparison of the competing frameworks.
Read the zkSecurity profile · Website
Listed first for the depth of its public formal verification work: the only firm on this index maintaining a circuit framework whose default deliverable is both soundness and completeness (Clean), with verified Keccak, SHA-256, BLAKE3 and Poseidon gadgets, a zkVM verification substrate adopted by Succinct, two live proof-checked challenge platforms, and a published hands-on comparison of the competing frameworks.
Read the zkSecurity profile · Website
Related frameworks in Verified implementations
Jasmin and libjade, hax, Cryptol and SAW, Fiat-Crypto, Aeneas, Kani, CBMC, CryptoLine, Verus.