The dbl crate contains an implementation of doubling / multiply-by-x for the polynomial x^128 + x^7 + x^2 + x + 1 over GF(2^128).

It's used in aes-siv, cmac, pmac, and ocb3. The same polynomial is used by GHASH, although the ghash crate doesn't use it because it's implemented in terms of POLYVAL, which uses the "reverse" polynomial.

The question is does it deserve its own crate, or is it trivial enough to simply be vendored as needed?

It might make more sense if we provided e.g. SIMD implementations which operate in parallel over multiple blocks.