Add SM3 support to MD #887

New issue

Open

opened 2026-08-31 08:32:29 -05:00 by ronald-cron-arm · 0 comments

ronald-cron-arm commented

2026-08-31 08:32:29 -05:00

(Migrated from github.com)

Add SM3 to MD. This is required to enable SM3 with components implemented through the mbedtls_md_* interface, like RSA-PSS, RSA PKCS#1 v1.5 ...

PSA HMAC-SM3, HKDF-SM3 and PBKDF2-HMAC-SM3 are already supported independently and do not depend on this work.

In crypto_adjust_config_support.h contrary to the other hash algorithms defines MBEDTLS_MD_SM3_VIA_PSA and MBEDTLS_MD_SOME_PSA if PSA_WANT_ALG_SM3 is defined, not just if an SM3 accelerator is available. That way the MD APIs are just wrappers around the PSA APIs and they do not need any update for SM3.

Testing:

. Information on SM3 based on md_info()
. positive testing using md_hex() and md_hex_multi() and the two test vectors from GB/T 32905-2016 (see https://datatracker.ietf.org/doc/html/draft-sca-cfrg-sm3-01 Appendix A).
. positive testing using mbedtls_md_hmac() and md_hmac_multi() and the four test vectors of GM/T 0042-2015 Appendix D.3.

Out of scope: ECDSA-SM3, RSA-PSS-SM3, RSA PKCS#1 v1.5-SM3, HMAC_DRBG-SM3 and PBKDF2-HMAC-SM3 testing.

Acceptance criteria

mbedtls_md_info_from_type(MBEDTLS_MD_SM3) returns valid SM3 metadata whencSM3 is enabled.
Generic MD hashing and HMAC operations work with SM3.
Builds without SM3 remain unaffected.
All existing test suites continue to pass.

Depends on: https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/874

Add SM3 to MD. This is required to enable SM3 with components implemented through the `mbedtls_md_*` interface, like RSA-PSS, RSA PKCS#1 v1.5 ... PSA HMAC-SM3, HKDF-SM3 and PBKDF2-HMAC-SM3 are already supported independently and do not depend on this work. In `crypto_adjust_config_support.h` contrary to the other hash algorithms defines `MBEDTLS_MD_SM3_VIA_PSA` and `MBEDTLS_MD_SOME_PSA` if `PSA_WANT_ALG_SM3` is defined, not just if an SM3 accelerator is available. That way the MD APIs are just wrappers around the PSA APIs and they do not need any update for SM3. ### Testing: . `Information on SM3` based on `md_info()` . positive testing using `md_hex()` and `md_hex_multi()` and the two test vectors from GB/T 32905-2016 (see https://datatracker.ietf.org/doc/html/draft-sca-cfrg-sm3-01 Appendix A). . positive testing using `mbedtls_md_hmac()` and `md_hmac_multi()` and the four test vectors of [GM/T 0042-2015 Appendix D.3](http://www.gmbz.org.cn/file/2018-01-10/384aaf7c-7530-4290-b314-24264065db9e.pdf). Out of scope: ECDSA-SM3, RSA-PSS-SM3, RSA PKCS#1 v1.5-SM3, HMAC_DRBG-SM3 and PBKDF2-HMAC-SM3 testing. ### Acceptance criteria - `mbedtls_md_info_from_type(MBEDTLS_MD_SM3)` returns valid SM3 metadata whencSM3 is enabled. - Generic MD hashing and HMAC operations work with SM3. - Builds without SM3 remain unaffected. - All existing test suites continue to pass. Depends on: https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/874

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto#887

No description provided.

Rows
Columns