diff --git a/.github/workflows/belt-dwp.yml b/.github/workflows/belt-dwp.yml
new file mode 100644
index 00000000..12bce42c
--- /dev/null
+++ b/.github/workflows/belt-dwp.yml
@@ -0,0 +1,69 @@
+name: belt-dwp
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/belt-dwp.yml"
+      - "aes-gcm/**"
+      - "Cargo.*"
+  push:
+    branches: master
+
+defaults:
+  run:
+    working-directory: belt-dwp
+
+env:
+  CARGO_INCREMENTAL: 0
+  RUSTFLAGS: "-Dwarnings"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        rust:
+          - 1.65.0 # MSRV
+          - stable
+        target:
+          - armv7a-none-eabi
+          - thumbv7em-none-eabi
+          - wasm32-unknown-unknown
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.rust }}
+          targets: ${{ matrix.target }}
+      - run: cargo build --no-default-features --release --target ${{ matrix.target }}
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          # 32-bit Linux
+          - target: i686-unknown-linux-gnu
+            rust: 1.72.0 # MSRV
+            deps: sudo apt update && sudo apt install gcc-multilib
+          - target: i686-unknown-linux-gnu
+            rust: stable
+            deps: sudo apt update && sudo apt install gcc-multilib
+
+          # 64-bit Linux
+          - target: x86_64-unknown-linux-gnu
+            rust: 1.72.0 # MSRV
+          - target: x86_64-unknown-linux-gnu
+            rust: stable
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.rust }}
+          targets: ${{ matrix.target }}
+      - run: ${{ matrix.deps }}
+      - run: cargo test --target ${{ matrix.target }} --release --no-default-features --lib
+      - run: cargo test --target ${{ matrix.target }} --release
+      - run: cargo test --target ${{ matrix.target }} --release --features std
+      - run: cargo test --target ${{ matrix.target }} --release --all-features
+      - run: cargo build --target ${{ matrix.target }} --benches
diff --git a/Cargo.lock b/Cargo.lock
index 7737803e..c835d381 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3,6 +3,18 @@
 #
 version = 3
 
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "arrayvec",
+ "crypto-common 0.1.6",
+ "generic-array",
+ "heapless 0.7.17",
+]
+
 [[package]]
 name = "aead"
 version = "0.6.0-pre.0"
@@ -11,8 +23,8 @@ checksum = "3de53f67567d2692f69357ee20fef7ddf7969d1dff34acefc05db91873aee0ce"
 dependencies = [
  "arrayvec",
  "blobby",
- "crypto-common",
- "heapless",
+ "crypto-common 0.2.0-pre.5",
+ "heapless 0.8.0",
 ]
 
 [[package]]
@@ -22,7 +34,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25512cae539ab9089dcbd69c4f704e787fdc8c1cea8d9daa68a9d89b02b0501f"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.5.0-pre.4",
  "cpufeatures",
 ]
 
@@ -30,9 +42,9 @@ dependencies = [
 name = "aes-gcm"
 version = "0.11.0-pre"
 dependencies = [
- "aead",
+ "aead 0.6.0-pre.0",
  "aes",
- "cipher",
+ "cipher 0.5.0-pre.4",
  "ctr",
  "ghash",
  "hex-literal",
@@ -44,9 +56,9 @@ dependencies = [
 name = "aes-gcm-siv"
 version = "0.12.0-pre"
 dependencies = [
- "aead",
+ "aead 0.6.0-pre.0",
  "aes",
- "cipher",
+ "cipher 0.5.0-pre.4",
  "ctr",
  "polyval",
  "subtle",
@@ -57,10 +69,10 @@ dependencies = [
 name = "aes-siv"
 version = "0.7.0"
 dependencies = [
- "aead",
+ "aead 0.6.0-pre.0",
  "aes",
  "blobby",
- "cipher",
+ "cipher 0.5.0-pre.4",
  "cmac",
  "ctr",
  "dbl",
@@ -89,13 +101,60 @@ dependencies = [
 name = "ascon-aead"
 version = "0.4.2"
 dependencies = [
- "aead",
+ "aead 0.6.0-pre.0",
  "ascon",
  "hex-literal",
  "subtle",
  "zeroize",
 ]
 
+[[package]]
+name = "atomic-polyfill"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cf2bce30dfe09ef0bfaef228b9d414faaf7e563035494d7fe092dba54b300f4"
+dependencies = [
+ "critical-section",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+
+[[package]]
+name = "belt-block"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9aa1eef3994e2ccd304a78fe3fea4a73e5792007f85f09b79bb82143ca5f82b"
+dependencies = [
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "belt-ctr"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f24134aff90e96a5957a77983e294f7cf9920d6aa67f89f3e846d5521c0480b"
+dependencies = [
+ "belt-block",
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "belt-dwp"
+version = "0.1.0"
+dependencies = [
+ "aead 0.5.2",
+ "belt-block",
+ "belt-ctr",
+ "hex-literal",
+ "opaque-debug",
+ "universal-hash 0.5.1",
+ "zeroize",
+]
+
 [[package]]
 name = "blobby"
 version = "0.3.1"
@@ -108,7 +167,7 @@ version = "0.11.0-pre.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ded684142010808eb980d9974ef794da2bcf97d13396143b1515e9f0fb4a10e"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.2.0-pre.5",
 ]
 
 [[package]]
@@ -130,9 +189,9 @@ checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
 name = "ccm"
 version = "0.5.0"
 dependencies = [
- "aead",
+ "aead 0.6.0-pre.0",
  "aes",
- "cipher",
+ "cipher 0.5.0-pre.4",
  "ctr",
  "hex-literal",
  "subtle",
@@ -150,7 +209,7 @@ version = "0.10.0-pre"
 source = "git+https://github.com/RustCrypto/stream-ciphers.git#fea3dd013ee9c35fba56903ad44b411957de8cb2"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.5.0-pre.4",
  "cpufeatures",
 ]
 
@@ -158,21 +217,31 @@ dependencies = [
 name = "chacha20poly1305"
 version = "0.10.1"
 dependencies = [
- "aead",
+ "aead 0.6.0-pre.0",
  "chacha20",
- "cipher",
+ "cipher 0.5.0-pre.4",
  "poly1305",
  "zeroize",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common 0.1.6",
+ "inout 0.1.3",
+]
+
 [[package]]
 name = "cipher"
 version = "0.5.0-pre.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "84fba98785cecd0e308818a87c817576a40f99d8bab6405bf422bacd3efb6c1f"
 dependencies = [
- "crypto-common",
- "inout",
+ "crypto-common 0.2.0-pre.5",
+ "inout 0.2.0-pre.4",
  "zeroize",
 ]
 
@@ -181,7 +250,7 @@ name = "cmac"
 version = "0.8.0-pre"
 source = "git+https://github.com/RustCrypto/MACs.git#43cc597a8881d6924ae56bb22edf19600e981e3e"
 dependencies = [
- "cipher",
+ "cipher 0.5.0-pre.4",
  "dbl",
  "digest",
 ]
@@ -195,6 +264,23 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "critical-section"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7059fff8937831a9ae6f0fe4d658ffabf58f2ca96aa9dec1c889f936f705f216"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "rand_core",
+ "typenum",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.2.0-pre.5"
@@ -211,7 +297,7 @@ name = "ctr"
 version = "0.10.0-pre"
 source = "git+https://github.com/RustCrypto/block-modes.git#532a46166bcc74bf718ca351cc3b5a86a2fcb2a3"
 dependencies = [
- "cipher",
+ "cipher 0.5.0-pre.4",
 ]
 
 [[package]]
@@ -227,7 +313,7 @@ dependencies = [
 name = "deoxys"
 version = "0.1.0"
 dependencies = [
- "aead",
+ "aead 0.6.0-pre.0",
  "aes",
  "hex-literal",
  "subtle",
@@ -241,7 +327,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "065d93ead7c220b85d5b4be4795d8398eac4ff68b5ee63895de0a3c1fb6edf25"
 dependencies = [
  "block-buffer",
- "crypto-common",
+ "crypto-common 0.2.0-pre.5",
  "subtle",
 ]
 
@@ -249,14 +335,24 @@ dependencies = [
 name = "eax"
 version = "0.5.0"
 dependencies = [
- "aead",
+ "aead 0.6.0-pre.0",
  "aes",
- "cipher",
+ "cipher 0.5.0-pre.4",
  "cmac",
  "ctr",
  "subtle",
 ]
 
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.12"
@@ -278,6 +374,15 @@ dependencies = [
  "polyval",
 ]
 
+[[package]]
+name = "hash32"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0c35f58762feb77d74ebe43bdbc3210f09be9fe6742234d573bacc26ed92b67"
+dependencies = [
+ "byteorder",
+]
+
 [[package]]
 name = "hash32"
 version = "0.3.1"
@@ -287,13 +392,26 @@ dependencies = [
  "byteorder",
 ]
 
+[[package]]
+name = "heapless"
+version = "0.7.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdc6457c0eb62c71aac4bc17216026d8410337c4126773b9c5daba343f17964f"
+dependencies = [
+ "atomic-polyfill",
+ "hash32 0.2.1",
+ "rustc_version",
+ "spin",
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "heapless"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad"
 dependencies = [
- "hash32",
+ "hash32 0.3.1",
  "stable_deref_trait",
 ]
 
@@ -312,6 +430,15 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "inout"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "inout"
 version = "0.2.0-pre.4"
@@ -328,13 +455,23 @@ version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
 
+[[package]]
+name = "lock_api"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
 [[package]]
 name = "ocb3"
 version = "0.1.0"
 dependencies = [
- "aead",
+ "aead 0.6.0-pre.0",
  "aes",
- "cipher",
+ "cipher 0.5.0-pre.4",
  "ctr",
  "hex-literal",
  "subtle",
@@ -352,7 +489,7 @@ name = "pmac"
 version = "0.8.0-pre"
 source = "git+https://github.com/RustCrypto/MACs.git#43cc597a8881d6924ae56bb22edf19600e981e3e"
 dependencies = [
- "cipher",
+ "cipher 0.5.0-pre.4",
  "dbl",
  "digest",
 ]
@@ -365,7 +502,7 @@ checksum = "c6c08e786072ace4e4498d7e477e9f8f9ea1a64f1a981ca17be7dc4df1361011"
 dependencies = [
  "cpufeatures",
  "opaque-debug",
- "universal-hash",
+ "universal-hash 0.6.0-pre.0",
 ]
 
 [[package]]
@@ -377,7 +514,7 @@ dependencies = [
  "cfg-if",
  "cpufeatures",
  "opaque-debug",
- "universal-hash",
+ "universal-hash 0.6.0-pre.0",
 ]
 
 [[package]]
@@ -407,6 +544,36 @@ dependencies = [
  "getrandom",
 ]
 
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "semver"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.0"
@@ -442,16 +609,32 @@ version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common 0.1.6",
+ "subtle",
+]
+
 [[package]]
 name = "universal-hash"
 version = "0.6.0-pre.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a05336f34009f6bb1c24794e2c04df87f4a0ced7a091692e395119f34fd3f4c5"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.2.0-pre.5",
  "subtle",
 ]
 
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
 [[package]]
 name = "wasi"
 version = "0.11.0+wasi-snapshot-preview1"
diff --git a/Cargo.toml b/Cargo.toml
index dfbd126b..96574e7e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,6 +9,7 @@ members = [
     "deoxys",
     "eax",
     "ocb3",
+    "belt-dwp"
 ]
 resolver = "2"
 
diff --git a/README.md b/README.md
index bf56003a..45bc00ef 100644
--- a/README.md
+++ b/README.md
@@ -16,17 +16,18 @@ crate.
 
 ## Crates
 
-| Name                 | Algorithm                    | Crates.io | Documentation | MSRV |
-|----------------------|------------------------------|-----------|---------------|-------|
-| [`aes-gcm-siv`]      | [AES-GCM-SIV]                | [![crates.io](https://img.shields.io/crates/v/aes-gcm-siv.svg)](https://crates.io/crates/aes-gcm-siv) | [![Documentation](https://docs.rs/aes-gcm-siv/badge.svg)](https://docs.rs/aes-gcm-siv) | 1.51 |
-| [`aes-gcm`]          | [AES-GCM]                    | [![crates.io](https://img.shields.io/crates/v/aes-gcm.svg)](https://crates.io/crates/aes-gcm) | [![Documentation](https://docs.rs/aes-gcm/badge.svg)](https://docs.rs/aes-gcm) | 1.51 |
-| [`aes-siv`]          | [AES-SIV]                    | [![crates.io](https://img.shields.io/crates/v/aes-siv.svg)](https://crates.io/crates/aes-siv) | [![Documentation](https://docs.rs/aes-siv/badge.svg)](https://docs.rs/aes-siv) | 1.51 |
-| [`ascon-aead`]       | [Ascon]                      | [![crates.io](https://img.shields.io/crates/v/ascon-aead.svg)](https://crates.io/crates/ascon-aead) | [![Documentation](https://docs.rs/ascon-aead/badge.svg)](https://docs.rs/ascon-aead) | 1.56 |
-| [`ccm`]              | [CCM]                        | [![crates.io](https://img.shields.io/crates/v/ccm.svg)](https://crates.io/crates/ccm) | [![Documentation](https://docs.rs/ccm/badge.svg)](https://docs.rs/ccm) | 1.41 |
-| [`chacha20poly1305`] | [(X)ChaCha20Poly1305]        | [![crates.io](https://img.shields.io/crates/v/chacha20poly1305.svg)](https://crates.io/crates/chacha20poly1305) | [![Documentation](https://docs.rs/chacha20poly1305/badge.svg)](https://docs.rs/chacha20poly1305) | 1.56 |
-| [`deoxys`]           | [Deoxys-I/II]                | [![crates.io](https://img.shields.io/crates/v/deoxys.svg)](https://crates.io/crates/deoxys) | [![Documentation](https://docs.rs/deoxys/badge.svg)](https://docs.rs/deoxys) | 1.51 |
-| [`eax`]              | [EAX]                        | [![crates.io](https://img.shields.io/crates/v/eax.svg)](https://crates.io/crates/eax) | [![Documentation](https://docs.rs/eax/badge.svg)](https://docs.rs/eax) | 1.41 |
-| [`mgm`]              | [MGM]                        | [![crates.io](https://img.shields.io/crates/v/mgm.svg)](https://crates.io/crates/mgm) | [![Documentation](https://docs.rs/mgm/badge.svg)](https://docs.rs/mgm) | 1.41 |
+| Name                 | Algorithm             | Crates.io                                                                                                       | Documentation                                                                                    | MSRV |
+|----------------------|-----------------------|-----------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|------|
+| [`aes-gcm-siv`]      | [AES-GCM-SIV]         | [![crates.io](https://img.shields.io/crates/v/aes-gcm-siv.svg)](https://crates.io/crates/aes-gcm-siv)           | [![Documentation](https://docs.rs/aes-gcm-siv/badge.svg)](https://docs.rs/aes-gcm-siv)           | 1.51 |
+| [`aes-gcm`]          | [AES-GCM]             | [![crates.io](https://img.shields.io/crates/v/aes-gcm.svg)](https://crates.io/crates/aes-gcm)                   | [![Documentation](https://docs.rs/aes-gcm/badge.svg)](https://docs.rs/aes-gcm)                   | 1.51 |
+| [`aes-siv`]          | [AES-SIV]             | [![crates.io](https://img.shields.io/crates/v/aes-siv.svg)](https://crates.io/crates/aes-siv)                   | [![Documentation](https://docs.rs/aes-siv/badge.svg)](https://docs.rs/aes-siv)                   | 1.51 |
+| [`ascon-aead`]       | [Ascon]               | [![crates.io](https://img.shields.io/crates/v/ascon-aead.svg)](https://crates.io/crates/ascon-aead)             | [![Documentation](https://docs.rs/ascon-aead/badge.svg)](https://docs.rs/ascon-aead)             | 1.56 |
+| [`belt-dwp`]         | [BeltDwp]             | [![crates.io](https://img.shields.io/crates/v/belt-dwp.svg)](https://crates.io/crates/belt-dwp)                 | [![Documentation](https://docs.rs/belt-dwp/badge.svg)](https://docs.rs/belt-dwp)                 | 1.56 |
+| [`ccm`]              | [CCM]                 | [![crates.io](https://img.shields.io/crates/v/ccm.svg)](https://crates.io/crates/ccm)                           | [![Documentation](https://docs.rs/ccm/badge.svg)](https://docs.rs/ccm)                           | 1.41 |
+| [`chacha20poly1305`] | [(X)ChaCha20Poly1305] | [![crates.io](https://img.shields.io/crates/v/chacha20poly1305.svg)](https://crates.io/crates/chacha20poly1305) | [![Documentation](https://docs.rs/chacha20poly1305/badge.svg)](https://docs.rs/chacha20poly1305) | 1.56 |
+| [`deoxys`]           | [Deoxys-I/II]         | [![crates.io](https://img.shields.io/crates/v/deoxys.svg)](https://crates.io/crates/deoxys)                     | [![Documentation](https://docs.rs/deoxys/badge.svg)](https://docs.rs/deoxys)                     | 1.51 |
+| [`eax`]              | [EAX]                 | [![crates.io](https://img.shields.io/crates/v/eax.svg)](https://crates.io/crates/eax)                           | [![Documentation](https://docs.rs/eax/badge.svg)](https://docs.rs/eax)                           | 1.41 |
+| [`mgm`]              | [MGM]                 | [![crates.io](https://img.shields.io/crates/v/mgm.svg)](https://crates.io/crates/mgm)                           | [![Documentation](https://docs.rs/mgm/badge.svg)](https://docs.rs/mgm)                           | 1.41 |
 
 ## MSRV Policy
 
@@ -37,8 +38,8 @@ done with a minor version bump.
 
 All crates licensed under either of
 
- * [Apache License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0)
- * [MIT license](http://opensource.org/licenses/MIT)
+* [Apache License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0)
+* [MIT license](http://opensource.org/licenses/MIT)
 
 at your option.
 
@@ -68,6 +69,7 @@ dual licensed as above, without any additional terms or conditions.
 [`aes-gcm-siv`]: https://github.com/RustCrypto/AEADs/tree/master/aes-gcm-siv
 [`aes-siv`]: https://github.com/RustCrypto/AEADs/tree/master/aes-siv
 [`ascon-aead`]: https://github.com/RustCrypto/AEADs/tree/master/ascon-aead
+[`belt-dwp`]: https://github.com/RustCrypto/AEADs/tree/master/belt-dwp
 [`ccm`]: https://github.com/RustCrypto/AEADs/tree/master/ccm
 [`chacha20poly1305`]: https://github.com/RustCrypto/AEADs/tree/master/chacha20poly1305
 [`deoxys`]: https://github.com/RustCrypto/AEADs/tree/master/deoxys
@@ -84,4 +86,5 @@ dual licensed as above, without any additional terms or conditions.
 [Deoxys-I/II]: https://sites.google.com/view/deoxyscipher
 [EAX]: https://en.wikipedia.org/wiki/EAX_mode
 [MGM]: https://eprint.iacr.org/2019/123.pdf
+[BeltDwp]: https://apmi.bsu.by/assets/files/std/belt-spec372.pdf
 [(X)ChaCha20Poly1305]: https://tools.ietf.org/html/rfc8439
diff --git a/belt-dwp/Cargo.toml b/belt-dwp/Cargo.toml
new file mode 100644
index 00000000..30028029
--- /dev/null
+++ b/belt-dwp/Cargo.toml
@@ -0,0 +1,37 @@
+[package]
+name = "belt-dwp"
+version = "0.1.0"
+description = "Pure Rust implementation of the Belt-DWP authenticated encryption algorithm (STB 34.101.31-2020)"
+edition = "2021"
+license = "Apache-2.0 OR MIT"
+readme = "README.md"
+documentation = "https://docs.rs/belt-dwp"
+repository = "https://github.com/RustCrypto/AEADs/tree/master/belt-dwp"
+keywords = ["aead", "belt-dwp"]
+categories = ["cryptography", "no-std"]
+rust-version = "1.56"
+
+[dependencies]
+aead = { version = "0.5", default-features = false }
+zeroize = { version = "1.7", default-features = false }
+universal-hash = { version = "0.5" }
+opaque-debug = { version = "0.3" }
+
+belt-block = { version = "0.1" }
+belt-ctr = { version = "0.1"}
+
+[dev-dependencies]
+hex-literal = "0.4"
+
+[features]
+default       = ["alloc", "getrandom"]
+std           = ["aead/std", "alloc"]
+alloc         = ["aead/alloc"]
+arrayvec      = ["aead/arrayvec"]
+getrandom     = ["aead/getrandom", "rand_core"]
+heapless      = ["aead/heapless"]
+rand_core     = ["aead/rand_core"]
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
\ No newline at end of file
diff --git a/belt-dwp/README.md b/belt-dwp/README.md
new file mode 100644
index 00000000..958c3ada
--- /dev/null
+++ b/belt-dwp/README.md
@@ -0,0 +1,59 @@
+# RustCrypto: BeltDwp
+
+[![crate][crate-image]][crate-link]
+[![Docs][docs-image]][docs-link]
+![Apache2/MIT licensed][license-image]
+![Rust Version][rustc-image]
+[![Project Chat][chat-image]][chat-link]
+[![Build Status][build-image]][build-link]
+
+Pure Rust implementation of **BeltDwp** ([STB 34.101.31-2020][1]): an
+[Authenticated Encryption with Associated Data (AEAD)][2].
+
+[Documentation][docs-link]
+
+## About
+
+BeltDwp is republic of Belarus standard for authenticated encryption with associated data.
+
+## Security Notes
+
+No security audits of this crate have ever been performed, and it has not been thoroughly assessed to ensure its operation is constant-time on common CPU architectures.
+
+USE AT YOUR OWN RISK!
+
+## License
+
+Licensed under either of:
+
+* [Apache License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0)
+* [MIT license](http://opensource.org/licenses/MIT)
+
+at your option.
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally submitted
+for inclusion in the work by you, as defined in the Apache-2.0 license, shall be
+dual licensed as above, without any additional terms or conditions.
+
+[//]: # (badges)
+
+[crate-image]: https://buildstats.info/crate/belt-dwp
+[crate-link]: https://crates.io/crates/belt-dwp
+[docs-image]: https://docs.rs/belt-dwp/badge.svg
+[docs-link]: https://docs.rs/belt-dwp/
+[license-image]: https://img.shields.io/badge/license-Apache2.0/MIT-blue.svg
+[rustc-image]: https://img.shields.io/badge/rustc-1.56+-blue.svg
+[chat-image]: https://img.shields.io/badge/zulip-join_chat-blue.svg
+[chat-link]: https://rustcrypto.zulipchat.com/#narrow/stream/260038-AEADs
+[downloads-image]: https://img.shields.io/crates/d/chacha20poly1305.svg
+[build-image]: https://github.com/RustCrypto/AEADs/workflows/belt-dwp/badge.svg?branch=master&event=push
+[build-link]: https://github.com/RustCrypto/AEADs/actions
+
+[//]: # (general links)
+
+[1]: https://apmi.bsu.by/assets/files/std/belt-spec372.pdf
+[2]: https://en.wikipedia.org/wiki/Authenticated_encryption
+[3]: https://github.com/RustCrypto/stream-ciphers/tree/master/belt-dwp
+[4]: https://github.com/RustCrypto/universal-hashes/tree/master/belt-dwp
\ No newline at end of file
diff --git a/belt-dwp/src/gf.rs b/belt-dwp/src/gf.rs
new file mode 100644
index 00000000..b7ef95ac
--- /dev/null
+++ b/belt-dwp/src/gf.rs
@@ -0,0 +1,46 @@
+use aead::generic_array::{ArrayLength, GenericArray};
+
+mod utils;
+
+pub(crate) mod gf128_soft64;
+
+pub trait GfElement {
+    type N: ArrayLength<u8>;
+
+    fn new() -> Self;
+    fn into_bytes(self) -> GenericArray<u8, Self::N>;
+    fn mul_sum(&mut self, a: &GenericArray<u8, Self::N>, b: &GenericArray<u8, Self::N>);
+}
+
+/// Tests from Appendix A, table 18 of [STB 34.101.31-2020](https://apmi.bsu.by/assets/files/std/belt-spec372.pdf)
+#[test]
+fn test_a18() {
+    use crate::gf::gf128_soft64::Element;
+    use aead::consts::U16;
+    use hex_literal::hex;
+
+    type Block = GenericArray<u8, U16>;
+
+    let test_vectors = [
+        (
+            hex!("34904055 11BE3297 1343724C 5AB793E9"),
+            hex!("22481783 8761A9D6 E3EC9689 110FB0F3"),
+            hex!("0001D107 FC67DE40 04DC2C80 3DFD95C3"),
+        ),
+        (
+            hex!("703FCCF0 95EE8DF1 C1ABF8EE 8DF1C1AB"),
+            hex!("2055704E 2EDB48FE 87E74075 A5E77EB1"),
+            hex!("4A5C9593 8B3FE8F6 74D59BC1 EB356079"),
+        ),
+    ];
+    for (u, v, w) in test_vectors {
+        let a = Block::clone_from_slice(&u);
+        let b = Block::clone_from_slice(&v);
+        let c = Block::clone_from_slice(&w);
+
+        let mut elem = Element::new();
+        elem.mul_sum(&a, &b);
+
+        assert_eq!(c, elem.into_bytes());
+    }
+}
diff --git a/belt-dwp/src/gf/gf128_soft64.rs b/belt-dwp/src/gf/gf128_soft64.rs
new file mode 100644
index 00000000..275af0e8
--- /dev/null
+++ b/belt-dwp/src/gf/gf128_soft64.rs
@@ -0,0 +1,104 @@
+use core::ops::{Add, Mul};
+
+use aead::{consts::U16, generic_array::GenericArray};
+
+use super::{utils::bmul64, GfElement};
+
+#[derive(Copy, Clone, Debug, Default, Eq, PartialEq)]
+pub struct Element(u64, u64);
+
+type Block = GenericArray<u8, U16>;
+
+impl GfElement for Element {
+    type N = U16;
+
+    #[inline(always)]
+    fn new() -> Self {
+        Self(0, 0)
+    }
+
+    #[inline(always)]
+    fn into_bytes(self) -> Block {
+        let mut block = Block::default();
+        block[8..].copy_from_slice(&self.0.to_le_bytes());
+        block[..8].copy_from_slice(&self.1.to_le_bytes());
+        block
+    }
+
+    #[allow(clippy::many_single_char_names)]
+    fn mul_sum(&mut self, a: &Block, b: &Block) {
+        let [a1, a0] = from_block(a);
+        let [b1, b0] = from_block(b);
+
+        let a2 = a1 ^ a0;
+        let b2 = b1 ^ b0;
+
+        // Multiply using Karatsuba multiplication
+        let c = bmul64(a1, b1);
+        let d = bmul64(a0, b0);
+        let e = bmul64(a2, b2);
+        let t = c ^ d ^ e;
+        let v0 = d as u64;
+        let v1 = ((d >> 64) ^ t) as u64;
+        let v2 = (c ^ (t >> 64)) as u64;
+        let v3 = (c >> 64) as u64;
+
+        // reduce over polynominal f(w) = w^128 + w^7 + w^2 + w + 1
+        let d = v2 ^ (v3 >> 63) ^ (v3 >> 62) ^ (v3 >> 57);
+        self.1 ^= v0 ^ d ^ (d << 1) ^ (d << 2) ^ (d << 7);
+        self.0 ^= v1 ^ v3 ^ (v3 << 1) ^ (v3 << 2) ^ (v3 << 7) ^ (d >> 63) ^ (d >> 62) ^ (d >> 57);
+    }
+}
+
+impl From<u128> for Element {
+    fn from(x: u128) -> Self {
+        Self((x >> 64) as u64, x as u64)
+    }
+}
+
+impl From<Block> for Element {
+    fn from(block: Block) -> Self {
+        let [a, b] = from_block(&block);
+        Self(a, b)
+    }
+}
+
+impl From<Element> for Block {
+    fn from(element: Element) -> Self {
+        element.into_bytes()
+    }
+}
+
+impl From<&Block> for Element {
+    fn from(block: &Block) -> Self {
+        let [a, b] = from_block(block);
+        Self(a, b)
+    }
+}
+
+#[inline(always)]
+fn from_block(block: &Block) -> [u64; 2] {
+    let (a, b) = block.split_at(8);
+    [
+        u64::from_le_bytes(b.try_into().unwrap()),
+        u64::from_le_bytes(a.try_into().unwrap()),
+    ]
+}
+
+impl Add for Element {
+    type Output = Self;
+
+    fn add(self, rhs: Self) -> Self {
+        Self(self.0 ^ rhs.0, self.1 ^ rhs.1)
+    }
+}
+
+impl Mul for Element {
+    type Output = Self;
+
+    fn mul(self, rhs: Self) -> Self {
+        let mut res = Self::new();
+        res.mul_sum(&self.into_bytes(), &rhs.into_bytes());
+        res
+    }
+}
diff --git a/belt-dwp/src/gf/utils.rs b/belt-dwp/src/gf/utils.rs
new file mode 100644
index 00000000..0c7b7f97
--- /dev/null
+++ b/belt-dwp/src/gf/utils.rs
@@ -0,0 +1,30 @@
+#![allow(unused)]
+use core::num::Wrapping;
+
+/// Multiplication in GF(2)[X], truncated to the low 64-bits, with “holes”
+/// (sequences of zeroes) to avoid carry spilling.
+///
+/// When carries do occur, they wind up in a "hole" and are subsequently masked
+/// out of the result.
+pub(super) fn bmul64(x: u64, y: u64) -> u128 {
+    let x0 = Wrapping((x & 0x1111_1111_1111_1111) as u128);
+    let x1 = Wrapping((x & 0x2222_2222_2222_2222) as u128);
+    let x2 = Wrapping((x & 0x4444_4444_4444_4444) as u128);
+    let x3 = Wrapping((x & 0x8888_8888_8888_8888) as u128);
+    let y0 = Wrapping((y & 0x1111_1111_1111_1111) as u128);
+    let y1 = Wrapping((y & 0x2222_2222_2222_2222) as u128);
+    let y2 = Wrapping((y & 0x4444_4444_4444_4444) as u128);
+    let y3 = Wrapping((y & 0x8888_8888_8888_8888) as u128);
+
+    let mut z0 = ((x0 * y0) ^ (x1 * y3) ^ (x2 * y2) ^ (x3 * y1)).0;
+    let mut z1 = ((x0 * y1) ^ (x1 * y0) ^ (x2 * y3) ^ (x3 * y2)).0;
+    let mut z2 = ((x0 * y2) ^ (x1 * y1) ^ (x2 * y0) ^ (x3 * y3)).0;
+    let mut z3 = ((x0 * y3) ^ (x1 * y2) ^ (x2 * y1) ^ (x3 * y0)).0;
+
+    z0 &= 0x1111_1111_1111_1111_1111_1111_1111_1111;
+    z1 &= 0x2222_2222_2222_2222_2222_2222_2222_2222;
+    z2 &= 0x4444_4444_4444_4444_4444_4444_4444_4444;
+    z3 &= 0x8888_8888_8888_8888_8888_8888_8888_8888;
+
+    z0 | z1 | z2 | z3
+}
diff --git a/belt-dwp/src/ghash.rs b/belt-dwp/src/ghash.rs
new file mode 100644
index 00000000..3290b23c
--- /dev/null
+++ b/belt-dwp/src/ghash.rs
@@ -0,0 +1,77 @@
+use aead::{consts::U1, consts::U16, KeyInit, KeySizeUser};
+use belt_block::cipher::{BlockSizeUser, ParBlocksSizeUser};
+use universal_hash::{Reset, UhfBackend, UhfClosure, UniversalHash};
+
+use crate::gf::gf128_soft64::Element;
+
+/// GHASH keys (16-bytes)
+pub type Key = universal_hash::Key<GHash>;
+
+/// GHASH blocks (16-bytes)
+pub type Block = universal_hash::Block<GHash>;
+
+/// GHASH tags (16-bytes)
+pub type Tag = universal_hash::Block<GHash>;
+
+#[derive(Clone)]
+pub struct GHash {
+    s: Element,
+    h: Element,
+}
+
+impl KeySizeUser for GHash {
+    type KeySize = U16;
+}
+
+impl BlockSizeUser for GHash {
+    type BlockSize = U16;
+}
+
+impl KeyInit for GHash {
+    fn new(h: &Key) -> Self {
+        Self::new_with_init_block(h, 0)
+    }
+}
+
+impl GHash {
+    pub(crate) fn new_with_init_block(h: &Key, s: u128) -> Self {
+        Self {
+            s: Element::from(s),
+            h: Element::from(h),
+        }
+    }
+
+    pub(crate) fn xor_s(&mut self, x: &Block) {
+        self.s = self.s + Element::from(x);
+    }
+}
+
+impl ParBlocksSizeUser for GHash {
+    type ParBlocksSize = U1;
+}
+
+impl UhfBackend for GHash {
+    fn proc_block(&mut self, x: &Block) {
+        self.s = (self.s + Element::from(x)) * self.h;
+    }
+}
+
+impl UniversalHash for GHash {
+    fn update_with_backend(&mut self, f: impl UhfClosure<BlockSize = Self::BlockSize>) {
+        f.call(self)
+    }
+
+    /// Get GHASH output
+    #[inline]
+    fn finalize(self) -> Tag {
+        (self.s * self.h).into()
+    }
+}
+
+impl Reset for GHash {
+    fn reset(&mut self) {
+        self.s = Element::default();
+    }
+}
+
+opaque_debug::implement!(GHash);
diff --git a/belt-dwp/src/lib.rs b/belt-dwp/src/lib.rs
new file mode 100644
index 00000000..8e5ac945
--- /dev/null
+++ b/belt-dwp/src/lib.rs
@@ -0,0 +1,266 @@
+#![no_std]
+#![cfg_attr(docsrs, feature(doc_cfg))]
+#![doc = include_str!("../README.md")]
+#![doc(
+    html_logo_url = "https://raw.githubusercontent.com/RustCrypto/meta/master/logo.svg",
+    html_favicon_url = "https://raw.githubusercontent.com/RustCrypto/meta/master/logo.svg"
+)]
+#![warn(missing_docs, rust_2018_idioms)]
+
+//! # Usage
+//!
+//! Simple usage (allocating, no associated data):
+//!
+#![cfg_attr(all(feature = "getrandom", feature = "std"), doc = "```")]
+#![cfg_attr(not(all(feature = "getrandom", feature = "std")), doc = "```ignore")]
+//! # fn main() -> Result<(), Box<dyn std::error::Error>> {
+//! use belt_dwp::{
+//!     aead::{Aead, AeadCore, KeyInit, OsRng},
+//!     BeltDwp, Nonce
+//! };
+//!
+//! let key = BeltDwp::generate_key(&mut OsRng);
+//! let cipher = BeltDwp::new(&key);
+//! let nonce = BeltDwp::generate_nonce(&mut OsRng); // 128-bits; unique per message
+//! let ciphertext = cipher.encrypt(&nonce, b"plaintext message".as_ref())?;
+//! let plaintext = cipher.decrypt(&nonce, ciphertext.as_ref())?;
+//! assert_eq!(&plaintext, b"plaintext message");
+//! # Ok(())
+//! # }
+//! ```
+//!
+//! ## In-place Usage (eliminates `alloc` requirement)
+//!
+//! This crate has an optional `alloc` feature which can be disabled in e.g.
+//! microcontroller environments that don't have a heap.
+//!
+//! The [`AeadInPlace::encrypt_in_place`] and [`AeadInPlace::decrypt_in_place`]
+//! methods accept any type that impls the [`aead::Buffer`] trait which
+//! contains the plaintext for encryption or ciphertext for decryption.
+//!
+//! Note that if you enable the `heapless` feature of this crate,
+//! you will receive an impl of [`aead::Buffer`] for `heapless::Vec`
+//! (re-exported from the [`aead`] crate as [`aead::heapless::Vec`]),
+//! which can then be passed as the `buffer` parameter to the in-place encrypt
+//! and decrypt methods:
+//!
+#![cfg_attr(
+    all(feature = "getrandom", feature = "heapless", feature = "std"),
+    doc = "```"
+)]
+#![cfg_attr(
+    not(all(feature = "getrandom", feature = "heapless", feature = "std")),
+    doc = "```ignore"
+)]
+//! # fn main() -> Result<(), Box<dyn std::error::Error>> {
+//! use belt_dwp::{
+//!     aead::{AeadInPlace, KeyInit, OsRng, heapless::Vec},
+//!     BeltDwp, Nonce
+//! };
+//!
+//! let key = BeltDwp::generate_key(&mut OsRng);
+//! let cipher = BeltDwp::new(&key);
+//! let nonce = Nonce::from_slice(b"unique nonce1234"); // 128-bits; unique per message
+//!
+//! let mut buffer: Vec<u8, 128> = Vec::new(); // Note: buffer needs 16-bytes overhead for auth tag
+//! buffer.extend_from_slice(b"plaintext message");
+//!
+//! // Encrypt `buffer` in-place, replacing the plaintext contents with ciphertext
+//! cipher.encrypt_in_place(nonce, b"", &mut buffer)?;
+//!
+//! // `buffer` now contains the message ciphertext
+//! assert_ne!(&buffer, b"plaintext message");
+//!
+//! // Decrypt `buffer` in-place, replacing its ciphertext context with the original plaintext
+//! cipher.decrypt_in_place(nonce, b"", &mut buffer)?;
+//! assert_eq!(&buffer, b"plaintext message");
+//! # Ok(())
+//! # }
+//! ```
+//!
+//! Similarly, enabling the `arrayvec` feature of this crate will provide an impl of
+//! [`aead::Buffer`] for `arrayvec::ArrayVec` (re-exported from the [`aead`] crate as
+//! [`aead::arrayvec::ArrayVec`]).
+
+use aead::consts::{U0, U16, U32, U8};
+pub use aead::{self, AeadCore, AeadInPlace, Error, Key, KeyInit, KeySizeUser};
+
+use belt_block::cipher::{Block, BlockEncrypt, KeyIvInit, StreamCipher};
+use belt_block::{belt_block_raw, BeltBlock};
+use belt_ctr::BeltCtr;
+use universal_hash::UniversalHash;
+
+use crate::{
+    ghash::GHash,
+    utils::{from_u32, to_u32},
+};
+
+/// Nonce type for [`BeltDwp`]
+pub type Nonce = aead::Nonce<BeltDwp>;
+
+/// Tag type for [`BeltDwp`]
+pub type Tag = aead::Tag<BeltDwp>;
+
+mod gf;
+mod ghash;
+mod utils;
+
+/// T from the STB 34.101.31-2020
+const T: u128 = 0xE45D4A588E006D363BF5080AC8BA94B1;
+
+/// Belt-DWP authenticated encryption with associated data (AEAD) cipher, defined in
+/// STB 34.101.31-2020
+pub struct BeltDwp {
+    key: Key<BeltBlock>,
+}
+
+impl KeySizeUser for BeltDwp {
+    type KeySize = U32;
+}
+
+impl AeadInPlace for BeltDwp {
+    fn encrypt_in_place_detached(
+        &self,
+        nonce: &Nonce,
+        associated_data: &[u8],
+        buffer: &mut [u8],
+    ) -> aead::Result<Tag> {
+        Cipher::new(self.key, nonce).encrypt_in_place_detached(associated_data, buffer)
+    }
+
+    fn decrypt_in_place_detached(
+        &self,
+        nonce: &Nonce,
+        associated_data: &[u8],
+        buffer: &mut [u8],
+        tag: &Tag,
+    ) -> aead::Result<()> {
+        Cipher::new(self.key, nonce).decrypt_in_place_detached(associated_data, buffer, tag)
+    }
+}
+
+struct Cipher {
+    enc_cipher: BeltCtr,
+    mac_cipher: BeltBlock,
+    ghash: GHash,
+}
+
+impl Cipher {
+    fn new(key: Key<BeltBlock>, nonce: &Nonce) -> Self {
+        let cipher: BeltCtr = BeltCtr::new(&key, nonce);
+
+        let _s = to_u32::<4>(nonce);
+        let _k = to_u32::<8>(&key);
+        // 2.1. 𝑠 ← belt-block(𝑆, 𝐾);
+        let s = belt_block_raw(_s, &_k);
+        // 2.2. 𝑟 ← belt-block(𝑠, 𝐾);
+        let r = from_u32::<16>(&belt_block_raw(s, &_k));
+
+        Self {
+            enc_cipher: cipher,
+            mac_cipher: BeltBlock::new(&key),
+            ghash: GHash::new_with_init_block(Key::<GHash>::from_slice(&r), T),
+        }
+    }
+
+    fn encrypt_in_place_detached(
+        &mut self,
+        associated_data: &[u8],
+        buffer: &mut [u8],
+    ) -> aead::Result<Tag> {
+        let sizes_block =
+            get_sizes_block(associated_data.len() as u64 * 8, buffer.len() as u64 * 8);
+
+        // 3. For 𝑖 = 1, 2, . . . , 𝑚 do:
+        //  3.1 𝑡 ← 𝑡 ⊕ (𝐼𝑖 ‖ 0^{128−|𝐼𝑖|})
+        //  3.2 𝑡 ← 𝑡 * 𝑟.
+        self.ghash.update_padded(associated_data);
+
+        // 4. For 𝑖 = 1, 2, . . . , 𝑛 do:
+        //  4.1 𝑠 ← 𝑠 ⊞ ⟨1⟩_128
+        //  4.2 𝑌𝑖 ← 𝑋𝑖 ⊕ Lo(belt-block(𝑠, 𝐾), |𝑋𝑖|)
+        //  4.3 𝑡 ← 𝑡 ⊕ (𝑌𝑖 ‖ 0^{128−|𝑌𝑖|})
+        //  4.4 𝑡 ← 𝑡 * 𝑟.
+        buffer.chunks_mut(16).for_each(|block| {
+            self.enc_cipher.apply_keystream(block);
+            self.ghash.update_padded(block);
+        });
+
+        // 5. 𝑡 ← 𝑡 ⊕ (⟨|𝐼|⟩_64 ‖ ⟨|𝑋|⟩_64)
+        self.ghash.xor_s(&sizes_block);
+
+        // 6. 𝑡 ← belt-block(𝑡 * 𝑟, 𝐾).
+        let mut tag = self.finish_tag();
+
+        self.mac_cipher.encrypt_block(&mut tag);
+
+        Ok(*Tag::from_slice(&tag[..8]))
+    }
+
+    fn decrypt_in_place_detached(
+        &mut self,
+        associated_data: &[u8],
+        buffer: &mut [u8],
+        tag: &Tag,
+    ) -> aead::Result<()> {
+        let sizes_block =
+            get_sizes_block(associated_data.len() as u64 * 8, buffer.len() as u64 * 8);
+
+        // 3. For 𝑖 = 1, 2, . . . , 𝑚 do:
+        //  3.1 𝑡 ← 𝑡 ⊕ (𝐼𝑖 ‖ 0^{128−|𝐼𝑖|})
+        //  3.2 𝑡 ← 𝑡 * 𝑟.
+        self.ghash.update_padded(associated_data);
+        // 4. For 𝑖 = 1, 2, . . . , 𝑛 do:
+        //  4.1 𝑡 ← 𝑡 ⊕ (𝑌𝑖 ‖ 0^{128−|𝑌𝑖|})
+        //  4.2 𝑡 ← 𝑡 * 𝑟.
+        self.ghash.update_padded(buffer);
+
+        // 5. 𝑡 ← 𝑡 ⊕ (⟨|𝐼|⟩_64 ‖ ⟨|𝑋|⟩_64)
+        self.ghash.xor_s(&sizes_block);
+
+        let mut tag_exact = self.finish_tag();
+
+        // 6. 𝑡 ← belt-block(𝑡 * 𝑟, 𝐾).
+        self.mac_cipher.encrypt_block(&mut tag_exact);
+
+        // 7. If 𝑇 != Lo(𝑡, 64), return ⊥
+        if tag_exact[..8] != tag[..] {
+            return Err(aead::Error);
+        }
+
+        // 8. For 𝑖 = 1,2,...,𝑛 do:
+        // 8.1. 𝑠 ← 𝑠 ⊞ ⟨1⟩128;
+        // 8.2. 𝑋𝑖 ← 𝑌𝑖 ⊕ Lo(belt-block(𝑠, 𝐾), |𝑌𝑖|)
+        buffer.chunks_mut(16).for_each(|block| {
+            self.enc_cipher.apply_keystream(block);
+        });
+
+        Ok(())
+    }
+
+    pub(crate) fn finish_tag(&mut self) -> Block<GHash> {
+        self.ghash.finalize_reset()
+    }
+}
+
+impl KeyInit for BeltDwp {
+    fn new(key: &Key<Self>) -> Self {
+        Self { key: *key }
+    }
+}
+
+impl AeadCore for BeltDwp {
+    type NonceSize = U16;
+    type TagSize = U8;
+    type CiphertextOverhead = U0;
+}
+
+/// Get the sizes block for the GHASH
+fn get_sizes_block(plain_cnt: u64, sec_cnt: u64) -> Block<GHash> {
+    let mut sizes_block: Block<GHash> = Default::default();
+
+    sizes_block[..8].copy_from_slice(&plain_cnt.to_le_bytes());
+    sizes_block[8..].copy_from_slice(&sec_cnt.to_le_bytes());
+
+    sizes_block
+}
diff --git a/belt-dwp/src/utils.rs b/belt-dwp/src/utils.rs
new file mode 100644
index 00000000..8bec06fa
--- /dev/null
+++ b/belt-dwp/src/utils.rs
@@ -0,0 +1,29 @@
+/// Helper function for transforming BelT keys and blocks from a byte array
+/// to an array of `u32`s.
+///
+/// # Panics
+/// If length of `src` is not equal to `4 * N`.
+// #[inline(always)]
+pub(crate) fn to_u32<const N: usize>(src: &[u8]) -> [u32; N] {
+    assert_eq!(src.len(), 4 * N);
+    let mut res = [0u32; N];
+    res.iter_mut()
+        .zip(src.chunks_exact(4))
+        .for_each(|(dst, src)| *dst = u32::from_le_bytes(src.try_into().unwrap()));
+    res
+}
+
+/// Helper function for transforming BelT keys and blocks from a array of `u32`s
+/// to a byte array.
+///
+/// # Panics
+/// If length of `src` is not equal to `4 * N`.
+// #[inline(always)]
+pub(crate) fn from_u32<const N: usize>(src: &[u32]) -> [u8; N] {
+    assert_eq!(N, 4 * src.len());
+    let mut res = [0u8; N];
+    src.iter()
+        .zip(res.chunks_exact_mut(4))
+        .for_each(|(src, dst)| dst.copy_from_slice(&src.to_le_bytes()));
+    res
+}
diff --git a/belt-dwp/tests/belt.rs b/belt-dwp/tests/belt.rs
new file mode 100644
index 00000000..821c3802
--- /dev/null
+++ b/belt-dwp/tests/belt.rs
@@ -0,0 +1,47 @@
+use aead::AeadInPlace;
+use belt_dwp::{BeltDwp, KeyInit};
+use hex_literal::hex;
+
+/// Test from Appendix A, tables 19-20 of [STB 34.101.31-2020](https://apmi.bsu.by/assets/files/std/belt-spec372.pdf)
+#[test]
+fn test_belt_dwp() {
+    struct TestVector {
+        i: [u8; 32],
+        k: [u8; 32],
+        s: [u8; 16],
+        x: [u8; 16],
+        y: [u8; 16],
+        t: [u8; 8],
+    }
+
+    let test_vectors = [
+        TestVector {
+            i: hex!("8504FA9D 1BB6C7AC 252E72C2 02FDCE0D 5BE3D612 17B96181 FE6786AD 716B890B"),
+            k: hex!("E9DEE72C 8F0C0FA6 2DDB49F4 6F739647 06075316 ED247A37 39CBA383 03A98BF6"),
+            s: hex!("BE329713 43FC9A48 A02A885F 194B09A1"),
+            x: hex!("B194BAC8 0A08F53B 366D008E 584A5DE4"),
+            y: hex!("52C9AF96 FF50F644 35FC43DE F56BD797"),
+            t: hex!("3B2E0AEB 2B91854B"),
+        },
+        TestVector {
+            i: hex!("C1AB7638 9FE678CA F7C6F860 D5BB9C4F F33C657B 637C306A DD4EA779 9EB23D31"),
+            k: hex!("92BD9B1C E5D14101 5445FBC9 5E4D0EF2 682080AA 227D642F 2687F934 90405511"),
+            s: hex!("7ECDA4D0 1544AF8C A58450BF 66D2E88A"),
+            x: hex!("DF181ED0 08A20F43 DCBBB936 50DAD34B"),
+            y: hex!("E12BDC1A E28257EC 703FCCF0 95EE8DF1"),
+            t: hex!("6A2C2C94 C4150DC0"),
+        },
+    ];
+
+    for vec in test_vectors {
+        let mut x = vec.x;
+        let beltdwp = BeltDwp::new_from_slice(&vec.k).unwrap();
+        let tag = beltdwp.encrypt_in_place_detached(&vec.s.into(), &vec.i, &mut x);
+        assert_eq!(vec.t, *tag.unwrap());
+        assert_eq!(vec.y, x);
+        beltdwp
+            .decrypt_in_place_detached(&vec.s.into(), &vec.i, &mut x, &tag.unwrap())
+            .unwrap();
+        assert_eq!(x, vec.x);
+    }
+}
diff --git a/benches/src/betldwp.rs b/benches/src/betldwp.rs
new file mode 100644
index 00000000..357f9a98
--- /dev/null
+++ b/benches/src/betldwp.rs
@@ -0,0 +1,48 @@
+use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
+
+use belt_dwp::aead::{Aead, KeyInit};
+use belt_dwp::BeltDwp;
+
+const KB: usize = 1024;
+
+#[cfg(not(any(target_arch = "x86_64", target_arch = "x86")))]
+type Benchmarker = Criterion;
+#[cfg(any(target_arch = "x86_64", target_arch = "x86"))]
+type Benchmarker = Criterion<criterion_cycles_per_byte::CyclesPerByte>;
+
+fn bench(c: &mut Benchmarker) {
+    let mut group = c.benchmark_group("beltdwp");
+
+    for size in &[KB, 2 * KB, 4 * KB, 8 * KB, 16 * KB] {
+        let buf = vec![0u8; *size];
+
+        group.throughput(Throughput::Bytes(*size as u64));
+
+        group.bench_function(BenchmarkId::new("encrypt", size), |b| {
+            let cipher = BeltDwp::new(&Default::default());
+            b.iter(|| cipher.encrypt(&Default::default(), &*buf))
+        });
+        group.bench_function(BenchmarkId::new("decrypt", size), |b| {
+            let cipher = BeltDwp::new(&Default::default());
+            b.iter(|| cipher.decrypt(&Default::default(), &*buf))
+        });
+    }
+
+    group.finish();
+}
+
+#[cfg(not(any(target_arch = "x86_64", target_arch = "x86")))]
+criterion_group!(
+    name = benches;
+    config = Criterion::default();
+    targets = bench
+);
+
+#[cfg(any(target_arch = "x86_64", target_arch = "x86"))]
+criterion_group!(
+    name = benches;
+    config = Criterion::default().with_measurement(criterion_cycles_per_byte::CyclesPerByte);
+    targets = bench
+);
+
+criterion_main!(benches);