Add SM2 support to the Rust wolfCrypt wrapper by somes · Pull Request #10743 · wolfSSL/wolfssl

somes · 2026-06-19T15:10:34Z

Description

Add SM2 support to the Rust wolfCrypt wrapper.

This adds:

SM2 key generation
Shared-secret derivation
SM2 digest creation
Hash signing and verification
Capability detection for the available SM2 APIs
SM2 integration and error-path tests

The implementation reuses the existing ECC key ownership and allocation model.

Testing

Tested against a local wolfSSL master and wolfSM build with SM2 enabled. WOLFSSL_PREFIX was configured to reference this installation.

cargo test \
  --features alloc,rand_core,aead,cipher,digest,mac,signature,password-hash,kem \
  -- --test-threads=1

cargo clippy \
  --features alloc,rand_core,aead,cipher,digest,mac,signature,password-hash,kem

All 7 SM2 integration tests pass. The complete Rust wrapper test suite, including documentation tests, also passes.

Clippy completes successfully. The remaining warnings originate from bindgen-generated bindings.

Checklist

added tests
updated/added doxygen — not applicable; the Rust API includes Rustdoc documentation
updated appropriate READMEs
Updated manual and documentation — not applicable

wolfSSL-Bot · 2026-06-19T15:12:05Z

Can one of the admins verify this patch?

dgarske · 2026-06-19T18:08:18Z

Hi @somes , thank you for this code contribution. I have asked @holtrop-wolfssl to look it over. Can you tell us more about your project and use of our Rust wrapper? In order to accept this code we need to have a signed contributor agreement. Please email support at wolfssl dot com and reference this pull request.
Thanks, David Garske, wolfSSL

Copilot

Pull request overview

Adds SM2 support to the wolfssl-wolfcrypt Rust wrapper, aligning with the crate’s existing pattern of capability detection via build.rs-emitted cfg(...) flags and reusing the existing ECC key allocation/ownership model.

Changes:

Introduces a new wolfssl_wolfcrypt::sm2 module exposing SM2 keygen, shared-secret derivation, digest creation, and hash sign/verify.
Extends build.rs capability scanning and bindgen header set to detect and bind SM2 APIs when present.
Adds SM2 integration and error-path tests, plus README/CHANGELOG and distribution manifest updates.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
wrapper/rust/wolfssl-wolfcrypt/tests/test_sm2.rs	Adds SM2 integration tests for keygen, digest, sign/verify, shared secret, and small-buffer error paths.
wrapper/rust/wolfssl-wolfcrypt/src/sm2.rs	New SM2 Rust wrapper built on the existing `ECC` key wrapper and wolfCrypt SM2 APIs.
wrapper/rust/wolfssl-wolfcrypt/src/lib.rs	Exposes the new `sm2` module behind `cfg(sm2)`.
wrapper/rust/wolfssl-wolfcrypt/src/ecc.rs	Adds crate-private `ECC::new()` / `ECC::new_ex()` constructors for allocating an unpopulated ECC key (used by SM2).
wrapper/rust/wolfssl-wolfcrypt/README.md	Documents SM2 as supported functionality.
wrapper/rust/wolfssl-wolfcrypt/headers.h	Adds `wolfssl/wolfcrypt/sm2.h` to bindgen’s header set.
wrapper/rust/wolfssl-wolfcrypt/CHANGELOG.md	Notes the new SM2 wrapper module.
wrapper/rust/wolfssl-wolfcrypt/build.rs	Adds SM2 symbol-based cfg detection (`sm2`, `sm2_dh`, `sm2_sign`, `sm2_verify`, `sm2_digest`).
wrapper/rust/include.am	Includes the new SM2 source and test files in distribution manifests.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2026-06-19T18:18:49Z

somes · 2026-06-19T23:17:55Z

Thank you.

I am learning about microcontrollers and embedded development, and I have hardware security devices such as a YubiKey and a GM3000 token. I would like to experiment with building a similar USB security token using an RP2040.

The goal is to better understand how this kind of hardware works, including smart-card-like workflows, CCID/PIV-style communication, and Chinese cryptographic algorithms such as SM2, SM3, and SM4.

I initially integrated SM2 into my Rust project by calling the functions in libwolfssl.a directly through FFI. After discovering the wolfssl-wolfcrypt crate, I decided to add SM2 support so that I could use the existing Rust wrapper instead of relying on my own FFI layer.

Please let me know if any additional details would be helpful. I have contacted wolfSSL support to complete the contributor agreement.

holtrop-wolfssl · 2026-06-22T21:06:19Z

Thanks for the contribution.

When I run the Rust unit tests with sm2 enabled (./configure --enable-all --enable-sm2), two of them are failing:

---- test_sm2_create_digest stdout ----

thread 'test_sm2_create_digest' panicked at tests/test_sm2.rs:31:6:
Error creating SM2 digest: -173
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

---- test_sm2_sign_and_verify stdout ----

thread 'test_sm2_sign_and_verify' panicked at tests/test_sm2.rs:49:6:
Error creating SM2 digest: -173

What setup did you use to test this (wolfssl & wolfsm versions, ./configure flags, etc.)?

somes · 2026-06-23T00:18:59Z

Thanks for the contribution.

When I run the Rust unit tests with sm2 enabled (./configure --enable-all --enable-sm2), two of them are failing:
---- test_sm2_create_digest stdout ----

thread 'test_sm2_create_digest' panicked at tests/test_sm2.rs:31:6:
Error creating SM2 digest: -173
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

---- test_sm2_sign_and_verify stdout ----

thread 'test_sm2_sign_and_verify' panicked at tests/test_sm2.rs:49:6:
Error creating SM2 digest: -173
What setup did you use to test this (wolfssl & wolfsm versions, ./configure flags, etc.)?

Thank you for your reply.

You may need to add --enable-sm3

# wolfssl 5.9.1
# wolfsm c380205


# linux
# failures:
#     test_sm2_create_digest
#     test_sm2_sign_and_verify
make clean; make distclean; ./configure --enable-all --enable-sm2 --enable-static --disable-shared && make -j4

# linux
# passed
make clean; make distclean; ./configure --enable-all --enable-sm2 --enable-sm3 --enable-static --disable-shared && make -j4

# linux
# passed
make clean; make distclean; ./configure --enable-all --enable-sm2 --enable-sm3 --enable-sp --enable-static --disable-shared && make -j4

# linux
# passed
make clean; make distclean; ./configure --enable-sm2 --enable-sm3 --enable-sp --enable-cryptonly --enable-static --disable-shared && make -j4


# windows
# passed
make clean; make distclean; CFLAGS="-DWOLFSSL_RSA_KEY_CHECK" ./configure --enable-all --disable-crl-monitor --enable-sm2 --enable-sm3 --enable-sp --enable-static --disable-shared --host=x86_64-w64-mingw32 && make -j4

# windows
# passed
make clean; make distclean; CFLAGS="-DWOLFSSL_RSA_KEY_CHECK" ./configure --enable-sm2 --enable-sm3 --enable-sp --enable-cryptonly --enable-static --disable-shared --host=x86_64-w64-mingw32 && make -j4

somes · 2026-06-23T01:13:09Z

Thanks for the review!

I’ll address the requested changes today or tomorrow.

I’m also working on some additional key lifecycle functions locally, and I’ll push an update after I finish testing them.

holtrop-wolfssl · 2026-06-23T01:48:30Z

Thanks for the contribution.
When I run the Rust unit tests with sm2 enabled (./configure --enable-all --enable-sm2), two of them are failing:
---- test_sm2_create_digest stdout ----

thread 'test_sm2_create_digest' panicked at tests/test_sm2.rs:31:6:
Error creating SM2 digest: -173
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

---- test_sm2_sign_and_verify stdout ----

thread 'test_sm2_sign_and_verify' panicked at tests/test_sm2.rs:49:6:
Error creating SM2 digest: -173
What setup did you use to test this (wolfssl & wolfsm versions, ./configure flags, etc.)?

Thank you for your reply.

You may need to add --enable-sm3

# wolfssl 5.9.1
# wolfsm c380205


# linux
# failures:
#     test_sm2_create_digest
#     test_sm2_sign_and_verify
make clean; make distclean; ./configure --enable-all --enable-sm2 --enable-static --disable-shared && make -j4

# linux
# passed
make clean; make distclean; ./configure --enable-all --enable-sm2 --enable-sm3 --enable-static --disable-shared && make -j4

# linux
# passed
make clean; make distclean; ./configure --enable-all --enable-sm2 --enable-sm3 --enable-sp --enable-static --disable-shared && make -j4

# linux
# passed
make clean; make distclean; ./configure --enable-sm2 --enable-sm3 --enable-sp --enable-cryptonly --enable-static --disable-shared && make -j4


# windows
# passed
make clean; make distclean; CFLAGS="-DWOLFSSL_RSA_KEY_CHECK" ./configure --enable-all --disable-crl-monitor --enable-sm2 --enable-sm3 --enable-sp --enable-static --disable-shared --host=x86_64-w64-mingw32 && make -j4

# windows
# passed
make clean; make distclean; CFLAGS="-DWOLFSSL_RSA_KEY_CHECK" ./configure --enable-sm2 --enable-sm3 --enable-sp --enable-cryptonly --enable-static --disable-shared --host=x86_64-w64-mingw32 && make -j4

Are you intending that this module work with only --enable-sm2 and not --enable-sm3? I don't know much about SM2 and SM3 but it looks like SM3 might be required for this functionality anyway. If that is the case, then perhaps the cfg checks in build.rs should be updated to detect both and the sm2.rs cfg gate should check for both being enabled.

somes · 2026-06-24T03:11:15Z

Thanks for the contribution.
When I run the Rust unit tests with sm2 enabled (./configure --enable-all --enable-sm2), two of them are failing:
---- test_sm2_create_digest stdout ----

thread 'test_sm2_create_digest' panicked at tests/test_sm2.rs:31:6:
Error creating SM2 digest: -173
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

---- test_sm2_sign_and_verify stdout ----

thread 'test_sm2_sign_and_verify' panicked at tests/test_sm2.rs:49:6:
Error creating SM2 digest: -173
What setup did you use to test this (wolfssl & wolfsm versions, ./configure flags, etc.)?

Thank you for your reply.
You may need to add --enable-sm3

# wolfssl 5.9.1
# wolfsm c380205


# linux
# failures:
#     test_sm2_create_digest
#     test_sm2_sign_and_verify
make clean; make distclean; ./configure --enable-all --enable-sm2 --enable-static --disable-shared && make -j4

# linux
# passed
make clean; make distclean; ./configure --enable-all --enable-sm2 --enable-sm3 --enable-static --disable-shared && make -j4

# linux
# passed
make clean; make distclean; ./configure --enable-all --enable-sm2 --enable-sm3 --enable-sp --enable-static --disable-shared && make -j4

# linux
# passed
make clean; make distclean; ./configure --enable-sm2 --enable-sm3 --enable-sp --enable-cryptonly --enable-static --disable-shared && make -j4


# windows
# passed
make clean; make distclean; CFLAGS="-DWOLFSSL_RSA_KEY_CHECK" ./configure --enable-all --disable-crl-monitor --enable-sm2 --enable-sm3 --enable-sp --enable-static --disable-shared --host=x86_64-w64-mingw32 && make -j4

# windows
# passed
make clean; make distclean; CFLAGS="-DWOLFSSL_RSA_KEY_CHECK" ./configure --enable-sm2 --enable-sm3 --enable-sp --enable-cryptonly --enable-static --disable-shared --host=x86_64-w64-mingw32 && make -j4

Are you intending that this module work with only --enable-sm2 and not --enable-sm3? I don't know much about SM2 and SM3 but it looks like SM3 might be required for this functionality anyway. If that is the case, then perhaps the cfg checks in build.rs should be updated to detect both and the sm2.rs cfg gate should check for both being enabled.

I added a separate sm3 cfg check based on wc_InitSm3 and gated the SM3-specific SM2 digest tests on it. With --enable-all --enable-sm2 the SM2 test suite now runs 6 tests and passes; with --enable-all --enable-sm2 --enable-sm3 it runs all 9 tests and passes.

make clean; make distclean; ./configure --enable-all --enable-sm2 --enable-static --disable-shared && make -j4

cargo clean; cargo test --features alloc,rand_core,aead,cipher,digest,mac,signature,password-hash,kem --test test_sm2

running 6 tests
test test_sm2_generate ... ok
test test_sm2_set_rng ... ok
test test_sm2_set_shared_rng ... ok
test test_sm2_shared_secret ... ok
test test_sm2_shared_secret_rejects_small_buffer ... ok
test test_sm2_sign_rejects_small_buffer ... ok

test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

make clean; make distclean; ./configure --enable-all --enable-sm2 --enable-sm3 --enable-static --disable-shared && make -j4

cargo clean; cargo test --features alloc,rand_core,aead,cipher,digest,mac,signature,password-hash,kem --test test_sm2

running 9 tests
test test_sm2_create_digest_with_sm3 ... ok
test test_sm2_create_digest_with_sm3_rejects_small_buffer ... ok
test test_sm2_generate ... ok
test test_sm2_set_rng ... ok
test test_sm2_set_shared_rng ... ok
test test_sm2_shared_secret_rejects_small_buffer ... ok
test test_sm2_shared_secret ... ok
test test_sm2_sign_rejects_small_buffer ... ok
test test_sm2_sign_and_verify_with_sm3_digest ... ok

test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

The PR branch has been updated with this change.

somes · 2026-06-24T09:36:17Z

updated the SM2 tests:

removed the test_sm2_set_shared_rng test function because
test_sm2_shared_secret and test_sm2_shared_secret_rejects_small_buffer
already cover it.
added test_sm2_sign_and_verify_hash to pair with
test_sm2_sign_rejects_small_buffer.
renamed test_sm2_sign_rejects_small_buffer to
test_sm2_sign_hash_rejects_small_buffer.
reordered the functions in test_sm2.rs.

holtrop-wolfssl

Thanks for fixing up those issues.

kareem-wolfssl · 2026-06-25T20:56:47Z

Contributor agreement approved - ok to merge.

dgarske · 2026-06-25T21:45:18Z

Please hold on review/merge. Thanks

somes added 2 commits June 19, 2026 22:20

feat(rust): add SM2 wrapper

010d896

style(rust): remove redundant SM2 hash type cast

2d03079

build(rust): include SM2 files in distributions

aca1547

dgarske requested review from Copilot and holtrop-wolfssl June 19, 2026 18:08

dgarske assigned wolfSSL-Bot and holtrop-wolfssl Jun 19, 2026

Copilot started reviewing on behalf of dgarske June 19, 2026 18:12 View session

Copilot AI reviewed Jun 19, 2026

View reviewed changes

holtrop-wolfssl requested changes Jun 22, 2026

View reviewed changes

fix(rust): address SM2 review feedback

9abbf8c

somes added 3 commits June 24, 2026 15:40

test(rust): cover SM2 raw hash signatures

e93b450

test(rust): rename SM2 sign hash buffer test

0de526b

test(rust): order SM2 tests by operation

da950f0

somes force-pushed the feat/sm2-rust-wrapper branch from eaad650 to da950f0 Compare June 24, 2026 08:43

somes requested a review from holtrop-wolfssl June 24, 2026 23:06

holtrop-wolfssl approved these changes Jun 25, 2026

View reviewed changes

dgarske assigned dgarske and unassigned holtrop-wolfssl Jun 25, 2026

Uh oh!

Conversation

somes commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing

Checklist

Uh oh!

wolfSSL-Bot commented Jun 19, 2026

Uh oh!

dgarske commented Jun 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

Uh oh!

somes commented Jun 19, 2026

Uh oh!

holtrop-wolfssl commented Jun 22, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

somes commented Jun 23, 2026

Uh oh!

somes commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

holtrop-wolfssl commented Jun 23, 2026

Uh oh!

somes commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

somes commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

holtrop-wolfssl left a comment

Choose a reason for hiding this comment

Uh oh!

kareem-wolfssl commented Jun 25, 2026

Uh oh!

dgarske commented Jun 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

somes commented Jun 19, 2026 •

edited

Loading

github-actions Bot commented Jun 19, 2026 •

edited

Loading

somes commented Jun 23, 2026 •

edited

Loading

somes commented Jun 24, 2026 •

edited

Loading

somes commented Jun 24, 2026 •

edited

Loading