I believe I've got a working implementation of AES Counter mode for AVR (specifically the ATMega328pb) in 18K of ROM and ~192 bytes of RAM.

That's... not horrible.

And it's very table driven and uses an expanded "working" key, so I think it should be pretty fast. The implementation is cribbed from Bouncycastle's Fast AES engine, with my own implementation of counter mode (which is pretty simple).

I'll throw the source into the Files here just to prove I'm doing something, but I'm not quite ready yet to make a GitHub repository.

Next step is to try and figure out how to implement an SD card reader, which means an SPI SD block interface and a USB block device mashup. And hopefully cram it in less than 12K of ROM. Fun!