chore(deps): migrate direct encoding deps to simd (#6690)

crates/kms/src/backup/drill.rs

@@ -945,7 +945,7 @@ async fn tree_digest(root: &Path) -> Result<ContentDigest> {
             lines.push(format!(
                 "{relative}\u{1f}{}\u{1f}{modified}\u{1f}{}",
                 metadata.len(),
-                hex::encode(Sha256::digest(&content))
+                hex_simd::encode_to_string(Sha256::digest(&content), hex_simd::AsciiCase::Lower)
             ));
         }
         lines.sort();
@@ -1199,7 +1199,7 @@ mod tests {
         let text = String::from_utf8(encoded.clone()).expect("evidence is utf-8");
         assert!(!text.contains(DRILL_MASTER_KEY), "the evidence must not carry the master key");
         assert!(
-            !text.contains(&hex::encode([0x37u8; 32])),
+            !text.contains(&hex_simd::encode_to_string([0x37u8; 32], hex_simd::AsciiCase::Lower)),
             "the evidence must not carry backup KEK material"
         );
 

crates/kms/src/backup/local_export.rs

@@ -568,7 +568,10 @@ pub(crate) fn compute_master_key_verifier(master_key: &str, salt: Option<&[u8]>,
     let mut hasher = Sha256::new();
     hasher.update(&framing);
     hasher.update(derived.as_slice());
-    Ok(format!("{prefix}{}", hex::encode(hasher.finalize())))
+    Ok(format!(
+        "{prefix}{}",
+        hex_simd::encode_to_string(hasher.finalize(), hex_simd::AsciiCase::Lower)
+    ))
 }
 
 /// The bundle-level protection label is the weakest state observed across

crates/kms/src/backup/local_restore.rs

@@ -72,7 +72,7 @@ use aes_gcm::{
     Aes256Gcm, Nonce,
     aead::{Aead, KeyInit},
 };
-use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64};
+use base64_simd::STANDARD as BASE64;
 use serde::{Deserialize, Serialize};
 use std::path::{Path, PathBuf};
 use tokio::fs;
@@ -640,7 +640,7 @@ fn decode_key_record(
         return Err(BackupError::corrupted(format!("bundled key record '{stem}' carries no key material")).into());
     }
     let material =
-        Zeroizing::new(BASE64.decode(&probe.encrypted_key_material).map_err(|error| {
+        Zeroizing::new(BASE64.decode_to_vec(&probe.encrypted_key_material).map_err(|error| {
             BackupError::corrupted(format!("bundled key record '{stem}' material is not valid base64: {error}"))
         })?);
     if !allowed_modes.contains(&protection_mode(probe.at_rest_protection)) {

crates/kms/src/backup/manifest.rs

@@ -69,7 +69,7 @@ impl ContentDigest {
     pub fn sha256_of(bytes: &[u8]) -> Self {
         Self {
             algorithm: DigestAlgorithm::Sha256,
-            hex: hex::encode(Sha256::digest(bytes)),
+            hex: hex_simd::encode_to_string(Sha256::digest(bytes), hex_simd::AsciiCase::Lower),
         }
     }