Notable Changes:

1. fix(internal/sm2ec): p256Mul AMD64 ADX/BMI2 path ADOXQ chain issue #560
2. fix(sm9): reject short ciphertext to prevent panic (GHSA-4wh8-q9rv-8q9f)

⚠️ Breaking Changes

• sm2 移除 legacy 实现（#525）：删除旧的 SM2 实现路径，统一走 internal/sm2 核心实现。
• sm2 移除 key exchange early 实现（#524）：删除早期的密钥交换实现，相关 API 不再可用。
• sm2 核心下沉到 internal/sm2（#526）：重构模块结构，核心实现移入 internal/sm2，internal/sm2ec 错误信息对齐。外部公开 API 保持兼容，但引用内部路径的代码需调整。
• pkcs7 / cfca 迁移到 smx509 类型：x509.SignatureAlgorithm → smx509.SignatureAlgorithm，依赖 pkcs7/cfca 的项目需同步更新类型引用。
• smx509 CheckSignatureWithDigest 拒绝 SHA1：与 checkSignature 行为对齐，不再接受 SHA1 摘要签名。
• pkcs7 移除不安全算法测试（#527）：清理 SHA1 及不安全算法相关测试与代码路径。

✨ New Features

smx509 — 全新架构

• 从寄生式补丁架构迁移为 Go 1.25 stdlib crypto/x509 的干净 fork：以独立 smx509 包形式存在，通过 5 个声明式 patch 描述与 stdlib 基线的全部偏差（001-root-platform、010-sm2-pqc-core、020-pkcs-keys、030-sm4-pem、100-extensions）。
• SM2 / PQC 签名算法：集成 ML-DSA（44/65/87）与 SLH-DSA-SHA2-128s 后量子签名算法；SM4 PEM 加密；PKCS#8 密钥编码；verify_digest.go 提供 CheckSignatureWithDigest 供 pkcs7 兼容使用。
• 声明式测试补丁系统：scripts/smx509/gen_test_patches.go 从 stdlib 测试文件（含包名重命名）与 smx509 测试文件的差异生成测试补丁；test-patches/ 下含 010-testenv-stub、020-envvars-abs-path 两个补丁。
• smx509 升级 Skill：.github/skills/smx509-upgrade/skill.md 提供从 Go 1.N 升级到 1.N+1 的完整工作流（baseline 更新、补丁冲突分析、测试文件同步、补丁重生成）。
• CI 补丁一致性检查：新增 smx509-patch-consistency CI job，验证补丁与 stdlib baseline 同步。

cipher — GCM-SIV 认证加密模式（#523）

• RFC 8452 实现：在 cipher 包中新增通用 GCM-SIV（Synthetic Initialization Vector）AEAD 模式，适用于任何满足 cipher.Block 接口的分组密码（含 SM4、AES）。相比传统 GCM，GCM-SIV 采用"先认证后加密"的 SIV 范式：先用 POLYVAL 对明文与 AAD 生成 128 位认证标签，再与 nonce 组合成合成 IV 驱动 CTR 加密，在 nonce 误用（重复）场景下仍保持机密性与完整性，仅泄露相同明文是否相等这一信息，不会像 GCM 那样灾难性泄露认证密钥。
• 三项子能力（Issue #523 勾选项全部完成）：
  • Generic GCM SIV —— 纯 Go 通用实现，覆盖所有架构与所有分组密码；
  • Batch encryption —— 复用底层密码的批量 EncryptBlocks 能力（与 gmsm 已有的 SM4/AES batch 路径一致），提升长数据吞吐；
  • Optimize POLYVAL with CLMUL —— 在 amd64, arm64 上使用CLMUL指令加速 POLYVAL 多项式求值，与 AES-GCM 的 GHASH 优化思路对齐。

ZUC

• 无状态分块加密（ref #277）：每个 chunk 使用独立 ZUC 实例加密，子密钥由 SM3(masterKey || chunkIndex) 派生，提供 XORKeyStreamAt 支持任意字节范围解密，适用于加密视频的 HTTP Range 请求场景。
• 可寻址流 bucketing 优化：states 从 []*zucState32 改为 []zucState32（寻址速度提升 1.7×，bucket 命中时 seek 约 2ns，无 bucket 时 1.87ms）；新增 NewCipherWithBucketSizeAndCapacity 预分配；修复 32 位平台 int(c.used) 溢出问题。

SM2

• 确定性 SM2 签名（#520）：支持 RFC 6979 风格的确定性签名，避免随机数质量依赖。

CPU 特性检测

• GFNI 独立检测：GFNI 作为独立特性（CPUID.07H:ECX[bit 8]），不再绑定 AVX-512，可与 VEX 编码（AVX/AVX2）配合使用。
• SM3 / SM4 硬件指令检测：通过 CPUID.07H:ECX（AVX10 子叶）检测 SM3（bit 1）与 SM4（bit 2）硬件支持。

keccakx4（新增内部包）

• 4 路 Keccak-f[1600] 置换：internal/keccakx4 提供 AVX2、LASX（Loong64）SIMD 实现，并提供纯 Go 回退（permute4Generic），用于并行哈希场景。

🚀 Performance

ML-KEM（#503、#507）

• ppc64le（VMX/VSX）支持：新增 POWER8+ 的 VMX 向量化实现，采用 Barrett 归约（shift-4 trick）替代 Montgomery，8 系数/指令。NTT 前向约 3×、polyAddAssign 约 4×（相对 generic Go）。
• CBD2/3 采样优化：VSPLTISW 常量生成优化，常量表从 128 字节压缩到 96 字节。
• sampleNTTx4：4 路并行 NTT 采样。

ML-DSA（#500、#501）

• Loong64（LASX）NTT / 逆 NTT：完整实现 LA464 架构的 16 系数/寄存器向量化 NTT 与逆 NTT，复用 AVX2 的 twiddle 表，XVMUH.H 提供精确 16 位有符号乘高。
• polyInfinityNorm LASX 变体：polyInfinityNormLASX 与 polyInfinityNormSignedLASX。

SM2 椭圆曲线

• internal/sm2ec POWER9 优化：补充栈帧布局说明，优化 POWER9 上的 SM2 椭圆曲线运算汇编。
• Loong64 LSX/LASX优化。

GCM-SIV

• amd64和arm64 上 POLYVAL 通过 CLMUL实现；批量加密复用底层 block cipher 的 EncryptBlocks 路径，长数据吞吐显著优于逐块调用。

SM3/SM9

• Loong64 LSX/LASX优化。

SM4

• Loong64 查表法优化

🔧 CI / Dependencies

• StepSecurity 加固 GitHub Actions（#512）：全仓库 workflow 注入 step-security/harden-runner。
• golang.org/x/crypto：0.51.0 → 0.52.0（#506）。
• github/codeql-action：4.35.5 → 4.36.0 → 4.36.1（#504、#515）。
• docker/setup-qemu-action：4.0.0 → 4.1.0（#508）。
• actions/checkout：5.0.1 → 6.0.3（#518）。
• actions/cache：4.3.0 → 5.0.5（#516）。
• step-security/harden-runner：2.19.3 → 2.19.4（#517）。
• 新增 Loong64 ML-DSA CI 测试矩阵。

📦 升级指南

1. Go 版本：建议使用 Go 1.25+。
2. smx509 类型迁移：pkcs7/cfca 调用方需将 x509.SignatureAlgorithm 替换为 smx509.SignatureAlgorithm。总之，不再支持与Go标准库x509中类型的混用。
3. SHA1 策略：smx509 CheckSignatureWithDigest 不再接受 SHA1；若业务仍依赖 SHA1 签名验证，需在调用前显式处理或降级。
4. ZUC 新能力：若需 HTTP Range 友好的加密流，使用新增的无状态分块 cipher（XORKeyStreamAt）；可寻址流可通过 NewCipherWithBucketSizeAndCapacity 预分配以获得更优 seek 性能。
5. 后量子算法跨平台：ML-KEM 现支持 amd64(AVX2)、arm64(NEON)、loong64(LASX)、ppc64le(VMX)；ML-DSA 现支持 amd64(AVX2)、arm64(NEON)、loong64(LASX)。
6. GCM-SIV：对 nonce 唯一性难以保证的场景，可用 cipher 包新增的 GCM-SIV AEAD 替代 SM4-GCM；注意其加密性能略低于 SM4-GCM（未做 SM4+CMUL 融合），解密性能基本持平；相同 (明文, AAD) 对会产生相同密文，天然支持内容去重但不宜用于需明文不可链接的场景。

v0.43.0

This release delivers major performance improvements across ML-KEM (arm64/amd64), ML-DSA (arm64/amd64), SM9 pairing, ZUC, and SM4, alongside two new packages (rand and tls13), an enhanced DRBG strategy mode, and internal API refinements.

Highlights

• New rand package: cryptographically secure random number generator backed by GM/T 0105-2021 Hash-DRBG, with multi-source entropy hardening (OS, CPU jitter, and hash loop noise) and on-startup self-test
• New tls13 package: TLS 1.3 key exchange primitives (including SM2/ECDH/X25519/Hybrid ECDH + ML-KEM support)
• SM9 pairing speedup: G2 precomputation reduces Miller loop cost by ~27% and full pairing cost by ~15% when the G2 point (private/public key) is fixed
• ML-KEM arm64 NEON optimizations: compress/encode (4/5/10/11-bit), decompress/decode, rejUniform, sampleNTT, ringCompressAndEncode1
• ML-KEM amd64 AVX2 optimizations: compress/encode (10/11-bit), sampleNTT with precomputed twiddles
• ML-DSA arm64 NEON optimizations: bitUnpack (signed 2^17/2^19), vectorMakeHint, nttMatRowVecMul
• ML-DSA amd64 AVX2 optimizations: batch 2 (second wave of functions)
• DRBG strategy mode (DrbgMode interface): separates GM/T 0105-2021 from NIST SP 800-90A behaviour without modifying core DRBG logic
• DRBG API refinement: Generate now returns (reseedRequired bool, err error) instead of conflating a control-flow signal with an error value
• SM4 ppc64 fixes: test case correctness fixes for big-endian ppc64 GCM
• ZUC asm improvements: amd64/arm64 LFSR restore optimized for readability and performance
• s390x bigmod: vector addMulVVWy implementation

New Packages

rand

A drop-in replacement for crypto/rand backed by a per-CPU GM/T 0105-2021 Hash-DRBG pool. Key properties:

• Entropy hardening: OS, CPU jitter, and hash loop noise entropy source
• On-startup DRBG known-answer self-test (GM/T 0105-2021 test vectors)
• Automatic reseed on counter/time interval expiry
• rand.Reader and rand.Read as the primary API surface

tls13

Key exchange primitives for TLS 1.3, including SM2, ECDH (P-256/P-384/P-521), X25519 and Hybrid ECDH + ML-KEM.

Performance

SM9 (internal/sm9/bn256)

G2 precomputation (PrecomputeG2 / PairPrecomp) caches all 77 line evaluation coefficients for a fixed G2 twist point, eliminating G2 point arithmetic from the Miller loop at pairing time.

Applied automatically to EncryptPrivateKey (lazy-init on first use via sync.Once) and gen2Precomp (package-level precomputed Gen2).

GT.ScalarMult / GT.ScalarBaseMult now delegate to ScalarMultGT (4-bit window + Cyclo6Squares), replacing the previous binary gfP12.Exp with general squaring.

ML-KEM arm64 NEON (internal/mlkem)

Extensive NEON vectorization of polynomial compress/encode/decode paths, sample and rejection functions. See PR #479 for details.

ML-KEM amd64 AVX2 (internal/mlkem)

AVX2 optimizations for compress/encode (10/11-bit), sampleNTT with precomputed twiddle factors (PR #478).

ML-DSA arm64 NEON (internal/mldsa)

NEON implementations of bitUnpackSignedTwoPower17, bitUnpackSignedTwoPower19, vectorMakeHint, nttMatRowVecMul (PR #481).

ML-DSA amd64 AVX2 (internal/mldsa)

Second wave of AVX2 functions (PR #480), with qMinusZetasMontgomeryAVX2 reordered to avoid VPERMQ.

ZUC Assembly

• arm64: LFSR restore (RESTORE_LFSR) optimized
• amd64: LFSR restore optimized, improved code readability

s390x Bigmod

Vector implementation of addMulVVWy (PR #430).

API Changes

drbg — Breaking Change

DRBG.Generate signature changed:

// Before (v0.42.x)
Generate(b, additional []byte) error  // returned ErrReseedRequired as sentinel

// After (v0.43.0)
Generate(b, additional []byte) (reseedRequired bool, err error)

ErrReseedRequired is deprecated and retained only for source compatibility; it is no longer returned by any Generate implementation. Check the bool return value instead:

// Migration
reseedRequired, err := drbg.Generate(buf, nil)
if err != nil { /* handle real error */ }
if reseedRequired { /* call Reseed */ }

drbg — Strategy Mode (DrbgMode)

New DrbgMode interface cleanly encapsulates all behavioural differences between GM/T 0105-2021 and NIST SP 800-90A (entropy length constraints, time-based reseed, output size limits). Two pre-defined singletons: drbg.GMMode and drbg.NISTMode.

Bug Fixes

• SM4 ppc64be: Test case correctness fixes for GCM on big-endian ppc64

Internal / Documentation

• internal/sm9/bn256/README.md comprehensively documents all optimizations, tower structure, algorithm references (eprint links), and remaining improvement opportunities
• drbg.setZero renamed to drbg.zeroize, simplified to clear(data); runtime.KeepAlive(data), with a comment explaining the Go-specific memory-erasure limitations and why the historical 0xFF multi-pass pattern is unnecessary for RAM

Dependencies and CI

• github/codeql-action bumped through 4.35.5
• step-security/harden-runner bumped through 2.19.3
• CI: added ppc64be testing; re-enabled all platforms

Full Changelog

Compare: v0.42.0...v0.43.0

v0.41.1

This patch release focuses on security hardening and compatibility improvements since v0.41.0, with a key fix for SM9 input validation in decryption, key unwrapping, signature verification, and key exchange flows.

Highlights

• Hardened SM9 by rejecting infinity points in decrypt, unwrap, verify, and key exchange operations
• Improved DRBG robustness
• Added warnings for broken or weak cryptographic algorithms
• Improved certificate compatibility with support for explicit curve parameters in ECDSA certificates
• Refined documentation for SM2 and updated project README files
• Updated dependencies and CI tooling

Security

• Fixed SM9 validation to reject infinity points in sensitive cryptographic paths
• Hardened DRBG behavior
• Added warning messages for broken or weak cryptographic algorithms

Compatibility and X.509

• Added support for explicit curve parameters as defined in RFC 3279 for ECDSA certificates
• Improved SM2-related certificate handling and test coverage
• Expanded smx509 test coverage

Internal Improvements

• Refactored KDF implementation
• Switched internal random utility usage to math/rand/v2
• Cleaned up package comments for SLH-DSA, ML-DSA, and ML-KEM packages
• Removed go1.24-specific build tag constraints from several PQC packages

Documentation

• Rewrote the SM2 documentation
• Updated the English SM2 documentation
• Refreshed README and README-EN content

Dependencies and CI

• Updated golang.org/x/crypto to 0.48.0
• Updated github/codeql-action through 4.32.6
• Updated step-security/harden-runner to 2.15.1
• Updated actions/setup-go to 6.3.0
• Updated actions/upload-artifact to 7.0.0
• Updated docker/setup-qemu-action to 4.0.0

Contributors

Thanks to all contributors in this release:

• Sun Yimin
• Kevin
• dependabot[bot]

Full Changelog

Compare: v0.41.0...v0.41.1

Notable Changes:

• sm3: limit blocks processed at once in assembly #326
• all: reduce code size #413
• cbcmac: supplement function level documents
• smx509: implement policy validation #330

Notable Changes

• internal/sm2ec: optimized for loong64 and riscv64.
• internal/sm3: optimized for loong64 and riscv64.
• internal/sm9: optimized for loong64 and riscv64.
• internal/bigmod: optimized for loong64 and riscv64.

Notes:

• 从v0.40.0+开始，Go最低版本要求改为v1.24+。如果你不能升级Go版本，请继续使用老版本。
• 这次release的loong64优化不包含LSX/LASX支持，LSX/LASX支持需要Go v1.25+。

Notable Changes:

• Fix xts avx2 decryption issue with GB mode.#383
• internal/deps/cpu: support Loong64 features detection.
• nternal/nat: add missing loong64 optimization.

Notable Changes:

• cipher: initial support gxm & mur modes in GM/T 0001.4-2024 ZUC stream cipher algorithm.
• drbg: 增加了DRBG销毁内部状态的方法 by @Trisia in #378
• internal/zuc: eea supports encoding.BinaryMarshaler & encoding.BinaryUnmarshaler interfaces #375
• internal/zuc: support fast forward

@emmansun , @Trisia