Add SM4 cipher (GB/T 32907-2016) support from SM4 enabled mbed TLS library#2424
Add SM4 cipher (GB/T 32907-2016) support from SM4 enabled mbed TLS library#2424Low-power wants to merge 2 commits into
Conversation
|
For any cipher change, please go to https://github.com/shadowsocks/shadowsocks-org/issues |
|
Using SM4 for anti-censoring...This PR could definitely piss off those officers of OSCCA 🤣 |
Maybe anti-(NSA's)censoring🤣 |
|
Since the old repository I hosted my Mbed TLS fork has long gone, I republished the repository at https://github.com/Low-power/mbedtls/tree/mbedtls-2.7-sm4 for anyone interested in that. |
- https://datatracker.ietf.org/doc/html/rfc8998 - shadowsocks/shadowsocks-libev#2424 If anyone interested in trying these non-standard ciphers, please take some time to get some background knowledge about the SM Cipher Suites.
- https://datatracker.ietf.org/doc/html/rfc8998 - shadowsocks/shadowsocks-libev#2424 If anyone interested in trying these non-standard ciphers, please take some time to get some background knowledge about the SM Cipher Suites.
|
Thanks for the SM4 (GB/T 32907-2016) support. This has drifted and now conflicts with master: it still patches the removed |
|
I didn't find the mbed TLS cipher availability checks in current CMake scripts, as previously implemented in |
There was a problem hiding this comment.
Pull request overview
This PR adds SM4 cipher identifiers to shadowsocks-libev’s supported cipher lists so builds using an SM4-enabled mbed TLS can select sm4-128-ctr (stream) and sm4-128-gcm (AEAD), and it advertises the new ciphers in --help.
Changes:
- Add SM4 stream cipher entries (
sm4-128-cbc,sm4-128-ctr) and bumpSTREAM_CIPHER_NUM. - Add SM4 AEAD entry (
sm4-128-gcm) and bumpAEAD_CIPHER_NUM. - Update CLI usage text to list the SM4 ciphers.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/utils.c | Advertises SM4 ciphers in CLI usage output. |
| src/stream.h | Increases stream cipher count to accommodate SM4 entries. |
| src/stream.c | Adds SM4 stream cipher names, mbed TLS mappings, and nonce/key sizes. |
| src/aead.h | Increases AEAD cipher count to accommodate SM4-GCM. |
| src/aead.c | Adds SM4-GCM to AEAD lists and routes it through the mbed TLS AEAD path. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "camellia-192-cfb", | ||
| "camellia-256-cfb", | ||
| "sm4-128-cbc", | ||
| "sm4-128-ctr", | ||
| "cast5-cfb", |
| static const int supported_aead_ciphers_key_size[AEAD_CIPHER_NUM] = { | ||
| 16, 24, 32, 32, | ||
| 16, 24, 32, 16, 32, | ||
| #ifdef FS_HAVE_XCHACHA20IETF | ||
| 32 | ||
| #endif |
… in AEAD cipher table PR #2424 review comment fix: supported_aead_ciphers_tag_size was not updated when sm4-128-gcm was added, causing chacha20-ietf-poly1305 and xchacha20-ietf-poly1305 to receive a zero tag size, breaking AEAD encryption/decryption.
Hello.
There is a SM4 cipher support for mbed TLS in pull request Mbed-TLS/mbedtls#1165 some years. Unfortunately that pull request was still left unmerged and became outdated in current mbed TLS versions; however I still managed to merge that pull request into the long term support branch 2.7, and with this minor modification to shadowsocks-libev, the SM4 ciphers appears fully functional in shadowsocks-libev.
The implemented ciphers in shadowsocks-libev are
sm4-128-cbc,sm4-128-ctrandsm4-128-gcm.Until Mbed-TLS/mbedtls#1165 can be merged, mbed TLS woudn't offically supporting SM4 cipher, however I opened this pull request for discuss whether to check a downstream version of mbed TLS of this SM4 support, in shadowsocks-libev.
My mbed TLS branch with SM4 support merged is available at https://git.nsscn.top/Low-power/mbedtls/tree/mbedtls-2.7-sm4