vv0.2.1

Added

• SM2 key exchange (sm2::key_exchange module)
  • exchange_a / exchange_b: GB/T 32918.3 full key exchange protocol with confirmation hash
  • ecdh: Simple SM2-ECDH shared secret computation (TLS/rustls compatible)
  • ecdh_from_slice: Slice-based ECDH for TLS integration
  • EphemeralKey: Ephemeral key pair with ZeroizeOnDrop
• SM2 DER codec (sm2::der module)
  • sig_to_der / sig_from_der: Signature DER encoding/decoding
  • private_key_from_sec1_der: RFC 5915 SEC1 private key parsing
  • private_key_from_pkcs8_der: RFC 5958 PKCS#8 private key parsing
• SM2 convenience API (sm2 module)
  • sign_message / verify_message: One-step sign/verify with automatic Z-value computation
• HKDF-SM3 (sm3::hkdf module)
  • hkdf_extract / hkdf_expand / hkdf: RFC 5869 compatible
• SM3 Hasher enhancements
  • reset() / finalize_reset(): Streaming hasher reuse
• SM4 AEAD combined format
  • sm4_encrypt_gcm_combined / sm4_decrypt_gcm_combined: TLS format (ciphertext||tag)
  • sm4_encrypt_ccm_combined / sm4_decrypt_ccm_combined: Same format for CCM
• BLS signatures (bls module, requires alloc feature)
  • bls_keygen / bls_sign / bls_verify: minimal-signature-size variant (sig ∈ G1, pk ∈ G2)
  • bls_aggregate / bls_aggregate_verify: multi-message aggregate signatures
  • bls_fast_aggregate_verify: fast aggregate verification for same-message multi-signer
  • BlsSignature::to_bytes / from_bytes: 65-byte serialization (uncompressed G1 point)
  • BlsPubKey::to_bytes / from_bytes: 128-byte serialization (uncompressed G2 point)
• BLS threshold signatures (bls::threshold module)
  • bls_threshold_keygen: Trusted Dealer mode, Shamir polynomial secret sharing
  • bls_partial_sign / bls_combine_signatures: Lagrange interpolation based aggregation
  • Supports (t+1, n) threshold configurations
• Hash-to-Curve (bls::hash_to_curve module)
  • hash_to_g1: RFC 9380 compliant, maps arbitrary message to BN256 G1 point
  • expand_message_xmd: RFC 9380 §5.3.1, message expansion using SM3 as hash
  • map_to_curve_svdw: Shallue-van de Woestijne mapping for BN256 (a=0 curve)
• fp_sqrt in sm9::fields::fp
  • Tonelli-Shanks modular square root for SM9 BN256 Fp (p ≡ 1 mod 4)
  • fp_is_square: Euler criterion based quadratic residue test
• FPE format-preserving encryption (fpe module)
  • FpeKey: 7-round Luby-Rackoff Feistel cipher based on SM4
  • Supports 1~128 bit plaintext/ciphertext domains
  • expand_tweak: arbitrary-length tweak via SM4 hash
  • Automatic key zeroization on drop (ZeroizeOnDrop)

Security

• BLS signature DST separation: signing uses BLS_SIG_SM9G1_XMD:SM3_SVDW_RO_NUL_, PoP uses a different tag
• BN256 security note: ~100-bit actual security level documented in API docs