v1.11.0

2026-08-01 — RustCrypto aead 0.6 trait fit for SM4-GCM / SM4-CCM (additive, opt-in). New sm4::Sm4Gcm and sm4::Sm4Ccm<M, N> as thin wrappers over the inherent AEAD paths, behind aead-traits = ["sm4-aead", "dep:aead"] — the backlog item parked since v0.11 while upstream sat on 0.6.0-rc; aead 0.6.1 is now stable at MSRV 1.85. Implements KeySizeUser / KeyInit / AeadCore / AeadInOut (the Vec-returning Aead arrives free via blanket impl). No new dudect target (wrappers add no cryptography; secret-touching bodies are the same code); new differential fuzz target fuzz_sm4_aead_traits (census 32 → 33). Default build byte-identical; C ABI surface stays 104.

v1.10.0

Not published. Assurance cycle: migrate the gmssl interop suite to GmSSL 3.2.0 subcommands and wire an interop-gmssl CI job at a pinned oracle tag (closes audit F16 — the suite had been self-skipping in CI); dedupe the constant-time PKCS#7 unpad; strengthen four DER fuzz targets to byte-idempotence; fuzz census 30 → 32. No published crate's runtime output changes, so crates.io skips 1.10.0 (the v0.14 / v0.17–v0.23 precedent). Changes ship with 1.11.0.

v1.9.0

2026-06-16 — TLCP toolkit C FFI, the cadence cycle that closes the TLCP arc. Exposes the accumulated toolkit — v1.6 key schedule and no-confirmation SM2-KX, v1.7 record protection, v1.8 chain/pair verification — through the gmcrypto-c ABI, so a C caller can drive a full TLCP handshake end to end (KX → key schedule → record → cert-verify). 19 new symbols, 2 opaque handles, 7 consts: 85 → 104 entry points. A thin shim by design — every failure is one GMCRYPTO_ERR, deprotect adds no logic (the Lucky13 work stays in core), and the not-authentication disclaimer is loud in gmcrypto.h. c_smoke 84 → 97 including a bad-pad ≡ bad-MAC single-ERR oracle test; no new dudect target; census stays 30. Default build byte-identical.

v1.8.0

2026-06-14 — TLCP certificate-pair / chain verification (the last core cycle): x509::verify_chain walks a caller-ordered chain — per-edge SM2 signature and raw-Name linking, intermediate CA-ness, termination at a caller-trusted anchor, refusal of any unknown critical extension (RFC 5280 §4.2), an optional validity window, and a depth cap — plus tlcp::chain::verify_pair for the double-cert profile (role key-usage, leaf-not-CA, and pair binding to one actual CA). This is signature verification, not validation and not server authentication: endpoint identity binding stays the caller's, permanently. No new dudect target (public inputs only); fuzz census 29 → 30. Pure-core / no_std; default build byte-identical.

v1.7.0

2026-06-14 — TLCP record protection (the second code cycle): tlcp::record, byte-in/byte-out protect / deprotect for the four SM2-family suites. SM4-CBC record is Lucky13-hardened — constant-time over the inner-hash SM3 compression count, a fixed 256-byte pad-validity scan, and a data-independent MAC extraction; bad padding still runs the full MAC and returns a single None. Record bytes cross-validated byte-for-byte against OpenSSL EVP SM4-CBC + GmSSL sm3hmac and GmSSL sm4 -gcm. New dudect gate ct_tlcp_cbc_deprotect; fuzz census 27 → 29. Additive minor, no new dependency; default build byte-identical. (key, seq) uniqueness is the caller's contract — the stateless primitives cannot detect reuse.

v1.6.0

2026-06-13 — the first code cycle of TLCP (GB/T 38636): the tlcp::key_schedule (the TLS-1.2-style PRF over HMAC-SM3 — master secret, key block, Finished verify-data) plus no-confirmation SM2 key-exchange completers on the existing sm2-key-exchange typestates. New opt-in tlcp feature (pure-core, no_std); key-schedule KATs from OpenSSL 3.x TLS1-PRF with digest:SM3. No new dudect target; the confirmed key-exchange flow is unchanged and remains the default. Default build byte-identical.

v1.5.0

Not published. The TLCP decomposition design cycle — scope and gap-mapping only, no output change. crates.io skips it; its plan ships with 1.6.0.

v1.4.0

2026-06-12 — the C ABI for X.509-with-SM2, on the usual core-in-vN / FFI-in-vN+1 cadence (72 → 85 FFI entry points): an opaque certificate handle, signature verify, and raw copy-out accessors. The no-trust-decisions contract crosses the ABI intact. The core build is identical to 1.3.0.

v1.3.0

2026-06-11 — X.509-with-SM2: strict-DER parse of a v3 leaf certificate (GM/T 0015 profile) plus SM2-with-SM3 signature verification over the exact wire tbsCertificate bytes. No trust decisions — no chain building, no clock, no extension interpretation, no revocation. New opt-in x509 feature on gmcrypto-core (no new dependency); a new fuzz target (fuzz_x509, census 26 → 27) and no new dudect target — certificate verification consumes only public inputs. Default build byte-identical; all three crates bump lockstep to 1.3.0.

v1.2.0

2026-06-11 — the C ABI for SM2 key exchange, on the usual core-in-vN / FFI-in-vN+1 cadence (63 → 72 FFI entry points). The GM/T 0003.5 recommended-curve KAT reproduces byte-for-byte through the C ABI, and FFI↔Rust handshakes cross-check in both directions. The core build is identical to 1.1.0 — with this, the SM2 family is complete in both Rust and C.

v1.1.0

2026-06-10 — SM2 key exchange (GM/T 0003.3) with key confirmation — the missing third of the SM2 family, after sign and encrypt. Opt-in sm2-key-exchange feature; a new gated dudect target (ct_sm2_key_exchange) and fuzz target (fuzz_sm2_kx). The default-features build is byte-identical to 1.0.1; cargo-semver-checks passes as non-breaking.

v1.0.1

2026-06-03 — patch: the v1.0 readiness cleanup. No API / ABI / wire change (cargo-public-api + cargo-semver-checks stayed green; a 1.0.0 consumer upgrades freely). Fixes the C ABI gmcrypto_version() (it returned a stale 0.4.0) and lands docs + CI hardening — an x86_64 SIMD test job, ECB-misuse warnings on the raw single-block API, and dependency-coupling disclosures.

v1.0.0

2026-06-01 — first stable release: all three crates published lockstep at =1.0.0. The only published migration is 0.16 → 1.0; the runtime wire output (SM2 signatures / ciphertexts, SM4 mode bytes) is byte-identical to 0.16.0 (KAT + gmssl 3.1.1 interop 11/11), so the breaking changes are API shape only. From 1.0, cargo-semver-checks gates forward breaking changes.

0.17 – 0.23

Not published. Assurance & API-finalization cycles — public-API freeze with a cargo-public-api drift-check, crypto-bigint decoupled from the always-on surface, and a multi-model adversarial pre-1.0 re-audit. crates.io skips them; their changes ship together in 1.0.0.

v0.16.0

2026-05-29 — multi-sector SM4-XTS C FFI; every cipher mode now reachable from C / C++ / Go / Zig / Python.

v0.15.0

2026-05-28 — in-place multi-sector (disk) SM4-XTS helper; pure-core, opt-in sm4-xts.

v0.14.0

Not published. A cargo-fuzz parser-fuzzing sweep (16 targets, zero crashes) merged as assurance — no output change, no version bump.

Earlier releases (v0.6.0 – v0.13.0)

v0.13.0

2026-05-24 — single-shot SM4-XTS C ABI (the deferred FFI half of v0.12); default build byte-unchanged.

v0.12.0

2026-05-23 — SM4-XTS core (GB/T 17964-2021): single-shot, full ciphertext stealing, byte-identical to OpenSSL SM4-XTS (xts_standard=GB); opt-in sm4-xts.

v0.11.0

2026-05-23 — RustCrypto trait fit on digest 0.11 / cipher 0.5; outputs byte-identical (KAT + gmssl 3.1.1).

v0.10.0

2026-05-21 — streaming SM4-GCM AEAD FFI (C / C++ / Go / Zig / Python).

v0.9.0

2026-05-17 — GCM tag-length parameterization, incremental-input buffered GCM, single-shot AEAD C FFI.

v0.8.0

2026-05-15 — AEAD core: single-shot SM4-GCM + SM4-CCM, constant-time GHASH.

v0.7.0

2026-05-14 — user-callable cipher modes: public batch APIs, single-shot & streaming SM4-CTR.

v0.6.0

2026-05-14 — AVX2 sbox_x32, NEON sbox_x16, CBC-decrypt fanout.

← gm-crypto-rs ← All work