gmcrypto_core/
lib.rs

1//! Constant-time-designed pure-Rust SM2 / SM3 / SM4 primitives.
2//!
3//! See the workspace `README.md` for scope, threat model, and the honest
4//! framing of the in-CI `dudect`-based timing-leak regression harness.
5//!
6//! # Modules
7//!
8//! - [`sm2`] — SM2 elliptic-curve sign / verify / encrypt / decrypt
9//!   (GB/T 32918). Comb-table fixed-base scalar mult (v0.3 W6).
10//! - [`sm3`] — SM3 hash (GB/T 32905) with streaming `new/update/finalize`.
11//! - [`sm4`] — SM4 block cipher (GB/T 32907) + CBC mode (single-shot
12//!   and v0.3 W5 streaming). v0.4 W3 adds an opt-in bitsliced
13//!   (table-less, gate-only) S-box behind the `sm4-bitsliced` feature.
14//! - [`hmac`] — HMAC-SM3 (RFC 2104), single-shot + v0.3 W5 streaming.
15//! - [`kdf`] — PBKDF2-HMAC-SM3 (RFC 8018 §5.2).
16//! - [`asn1`] — strict-canonical DER reader / writer / OID constants
17//!   (v0.3 W1); GM/T 0009 SM2 ciphertext SEQUENCE; RFC 3279 SM2
18//!   signature SEQUENCE.
19//! - [`pem`] — RFC 7468 PEM codec (v0.3 W2; hand-rolled, `no_std`).
20//! - [`spki`] — RFC 5280 `SubjectPublicKeyInfo` for SM2 (v0.3 W2).
21//! - [`sec1`] — RFC 5915 `ECPrivateKey` + SEC1 uncompressed point (v0.3 W2).
22//! - [`pkcs8`] — RFC 5958 `OneAsymmetricKey` + RFC 8018 PBES2 (v0.3 W2).
23//! - [`traits`] — in-crate `Hash` / `Mac` / `BlockCipher` traits
24//!   (v0.3 W5). v0.4 W2 adds RustCrypto-trait fit (`digest::Digest`,
25//!   `digest::Mac`, `cipher::BlockCipherEncrypt`/`BlockCipherDecrypt`)
26//!   behind the opt-in `digest-traits` / `cipher-traits` features
27//!   (migrated to `digest 0.11` / `cipher 0.5` in v0.11).
28//!
29//! # Crate features
30//!
31//! - `default` — `no_std`, `alloc`-only. No optional dependencies.
32//! - `digest-traits` — opt-in (v0.4 W2). Implements `digest::Digest` for
33//!   [`sm3::Sm3`] and `digest::Mac` for [`hmac::HmacSm3`]. Pulls
34//!   `digest = "0.11"`.
35//! - `cipher-traits` — opt-in (v0.4 W2). Implements
36//!   `cipher::{BlockCipherEncrypt, BlockCipherDecrypt, BlockSizeUser,
37//!   KeySizeUser, KeyInit}` for [`sm4::Sm4Cipher`]. Pulls `cipher = "0.5"`.
38//! - `sm4-bitsliced` — opt-in (v0.4 W3). Routes the SM4 S-box through
39//!   a bitsliced (table-less, gate-only) Itoh-Tsujii inversion in
40//!   GF(2^8). Byte-identical output to the default linear-scan path;
41//!   constant-time by construction (no table lookups, no branches on
42//!   secret bits).
43//! - `sm4-bitsliced-simd` — opt-in (v0.5 W4 scaffolding; AVX2 / NEON
44//!   intrinsic implementations land in v0.5.x). Implies
45//!   `sm4-bitsliced`. Default-off.
46//! - `crypto-bigint-scalar` — opt-in (v0.5 W5). Exposes
47//!   [`sm2::Sm2PrivateKey::from_scalar`] which takes a
48//!   `crypto_bigint::U256` directly. Default-off; the always-on
49//!   `from_bytes_be` constructor is the recommended path for callers
50//!   who don't want a transitive `crypto-bigint` dep.
51//!
52//! # `wasm32-unknown-unknown`
53//!
54//! Builds clean as of v0.4 W1. The crate is `no_std + alloc` only and
55//! does NOT pull `getrandom`'s `wasm_js` backend or `wasm-bindgen` /
56//! `js-sys` into its default dep graph. Wasm callers wire their own
57//! `rand_core::Rng` impl — see the workspace `README.md`.
58
59#![no_std]
60#![deny(missing_docs)]
61#![doc(html_root_url = "https://docs.rs/gmcrypto-core/0.5.0")]
62
63extern crate alloc;
64
65pub mod asn1;
66pub mod hmac;
67pub mod kdf;
68pub mod pem;
69pub mod pkcs8;
70pub mod sec1;
71pub mod sm2;
72pub mod sm3;
73pub mod sm4;
74pub mod spki;
75pub mod traits;
76
77/// Workspace-wide failure type (v0.5 W5).
78///
79/// Every fallible public surface in `gmcrypto-core` that does not
80/// return `Option` / `bool` / `subtle::CtOption` returns
81/// `Result<_, Error>`. The single `Failed` variant is deliberate per
82/// the **failure-mode invariant** (see `SECURITY.md`): distinguishing
83/// failure modes leaks information to padding-oracle / invalid-curve /
84/// password-oracle attackers.
85///
86/// Per-module aliases keep the established import paths working:
87/// `sm2::Error`, `pem::Error`, `pkcs8::Error` are type aliases for
88/// this one type. Prior to v0.5 these were separate per-module enums
89/// (`SignError`, `EncryptError`, `DecryptError`, `pem::Error`,
90/// `pkcs8::Error`) all with a single `Failed` variant; v0.5 unifies
91/// them per Q5.16 in `docs/v0.5-scope.md`.
92#[derive(Debug, Clone, Copy, PartialEq, Eq)]
93#[non_exhaustive]
94pub enum Error {
95    /// The operation failed. No further information is exposed —
96    /// distinguishing failure modes leaks attacker-useful signal.
97    Failed,
98}
99
100impl core::fmt::Display for Error {
101    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
102        f.write_str("gmcrypto-core operation failed")
103    }
104}
105
106impl core::error::Error for Error {}
gmcrypto_core/lib.rs

gmcrypto_core/
lib.rs
