Re: [PATCH] crypto: Introduce SM4 symmetric cipher algorithm

["Daniel P. Berrangé" <berrange@redhat.com>]

On Mon, Nov 27, 2023 at 11:55:34PM +0800, Hyman Huang wrote:
> Introduce the SM4 cipher algorithms (OSCCA GB/T 32907-2016).
> 
> SM4 (GBT.32907-2016) is a cryptographic standard issued by the
> Organization of State Commercial Administration of China (OSCCA)
> as an authorized cryptographic algorithms for the use within China.

Just out of interest, what part of QEMU are you needing to use
SM4 with ? Is it for a LUKS block driver cipher ?

> 
> Signed-off-by: Hyman Huang <yong.huang@smartx.com>
> ---
>  crypto/block-luks.c             |  7 ++++++
>  crypto/cipher-gcrypt.c.inc      |  4 ++++

Looking at the gcrypt code, SM4 is only supported in >= 1.9.0 

QEMU min version is 1.8.0, so you'll need to modify meson.build
to check whether SM4 is supported and put conditionals in this
file

>  crypto/cipher-nettle.c.inc      | 42 +++++++++++++++++++++++++++++++++

Looking at the nettle code, SM4 is only supported in unreleased
versions thus far.

So again will need a meson.build check and conditionals.

>  crypto/cipher.c                 |  2 ++
>  qapi/crypto.json                |  5 +++-
>  tests/unit/test-crypto-cipher.c | 11 +++++++++
>  6 files changed, 70 insertions(+), 1 deletion(-)


> diff --git a/qapi/crypto.json b/qapi/crypto.json
> index fd3d46ebd1..95fa10bb6d 100644
> --- a/qapi/crypto.json
> +++ b/qapi/crypto.json
> @@ -94,6 +94,8 @@
>  #
>  # @twofish-256: Twofish with 256 bit / 32 byte keys
>  #
> +# @sm4: SM4 with 128 bit / 16 byte keys (since 8.2)

We're in feature freeze for 8.2, so mark this 9.0 as that'll be the
next available release this could be merged for.

> +#
>  # Since: 2.6
>  ##
>  { 'enum': 'QCryptoCipherAlgorithm',
> @@ -102,7 +104,8 @@
>             'des', '3des',
>             'cast5-128',
>             'serpent-128', 'serpent-192', 'serpent-256',
> -           'twofish-128', 'twofish-192', 'twofish-256']}
> +           'twofish-128', 'twofish-192', 'twofish-256',
> +           'sm4']}
>  
>  ##
>  # @QCryptoCipherMode:
> diff --git a/tests/unit/test-crypto-cipher.c b/tests/unit/test-crypto-cipher.c
> index d9d9d078ff..80a4984e43 100644
> --- a/tests/unit/test-crypto-cipher.c
> +++ b/tests/unit/test-crypto-cipher.c
> @@ -382,6 +382,17 @@ static QCryptoCipherTestData test_data[] = {
>          .plaintext = "90afe91bb288544f2c32dc239b2635e6",
>          .ciphertext = "6cb4561c40bf0a9705931cb6d408e7fa",
>      },
> +    {
> +        /* SM4, GB/T 32907-2016, Appendix A.1 */
> +        .path = "/crypto/cipher/sm4",
> +        .alg = QCRYPTO_CIPHER_ALG_SM4,
> +        .mode = QCRYPTO_CIPHER_MODE_ECB,
> +        .key = "0123456789abcdeffedcba9876543210",
> +        .plaintext  =
> +            "0123456789abcdeffedcba9876543210",
> +        .ciphertext =
> +            "681edf34d206965e86b3e94f536e4246",
> +    },
>      {
>          /* #1 32 byte key, 32 byte PTX */
>          .path = "/crypto/cipher/aes-xts-128-1",
> -- 
> 2.39.1
> 

With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|