emmansun · emmansun · Oct 13, 2025 · Oct 13, 2025
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -37,12 +37,12 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.29.5
+        uses: github/codeql-action/init@e296a935590eb16afc0c0108289f68c87e2a89a5 # v3.29.5
         with:
           languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.29.5
+        uses: github/codeql-action/autobuild@e296a935590eb16afc0c0108289f68c87e2a89a5 # v3.29.5
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.29.5
+        uses: github/codeql-action/analyze@e296a935590eb16afc0c0108289f68c87e2a89a5 # v3.29.5
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -44,7 +44,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
@@ -78,6 +78,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.29.5
+        uses: github/codeql-action/upload-sarif@e296a935590eb16afc0c0108289f68c87e2a89a5 # v3.29.5
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/test_loong64.yml b/.github/workflows/test_loong64.yml
@@ -0,0 +1,44 @@
+# This workflow will build a golang project
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go
+
+name: loong64-qemu
+
+on:
+  push:
+    branches: [ "develop", "main" ]
+  pull_request:
+    branches: [ "develop", "main" ]
+
+permissions:
+  contents: read
+
+jobs:
+
+  test:
+    strategy:
+      matrix:
+        go-version: [1.24.x]
+        arch: [loong64]  
+    runs-on: ubuntu-latest
+    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
+    - name: Set up Go
+      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      with:
+        go-version: ${{ matrix.go-version }}
+
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+
+    - name: Check out code
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+    - name: Test
+      run: go test -v -short ./internal/...
+      env:
+        GODEBUG: x509sha1=1
+        GOARCH: ${{ matrix.arch }}      
diff --git a/.github/workflows/test_riscv64.yaml b/.github/workflows/test_riscv64.yaml
@@ -1,44 +0,0 @@
-# This workflow will build a golang project
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go
-
-name: riscv64-qemu
-
-on:
-  push:
-    branches: [ "develop", "main" ]
-  pull_request:
-    branches: [ "develop", "main" ]
-
-permissions:
-  contents: read
-
-jobs:
-
-  test:
-    strategy:
-      matrix:
-        go-version: [1.23.x]
-        arch: [riscv64]  
-    runs-on: ubuntu-latest
-    steps:
-    - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-      with:
-        egress-policy: audit
-
-    - name: Set up Go
-      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
-      with:
-        go-version: ${{ matrix.go-version }}
-
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
-
-    - name: Check out code
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-    - name: Test
-      run: go test -v -short ./internal/...
-      env:
-        GODEBUG: x509sha1=1
-        GOARCH: ${{ matrix.arch }}      

diff --git a/cipher/gxm.go b/cipher/gxm.go
@@ -2,6 +2,10 @@
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
 
+// References:
+// GM/T 0001.4-2024 ZUC stream cipher algorithm - Part 4: Aunthenticated encryption mechanisms
+//   Chapter 6: ZUC-GXM
+
 package cipher
 
 import (

diff --git a/cipher/mur.go b/cipher/mur.go
@@ -2,6 +2,10 @@
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
 
+// References:
+// GM/T 0001.4-2024 ZUC stream cipher algorithm - Part 4: Aunthenticated encryption mechanisms
+//   Chapter 7: ZUC-MUR
+
 package cipher
 
 import (

diff --git a/cipher/xts_sm4_test.go b/cipher/xts_sm4_test.go
@@ -112,6 +112,103 @@ var xtsGBTestVectors = []struct {
 		"6BC1BEE22E409F96E93D7E117393172AAE2D8A571E03AC9C9EB76FAC45AF8E5130C81C46A35CE411E5FBC1191A0A52EFF69F2445DF4F9B17",
 		"E9538251C71D7B80BBE4483FEF497BD12C5C581BD6242FC51E08964FB4F60FDB0BA42F63499279213D318D2C11F6886E903BE7F93A1B3479",
 	},
+	{
+		"44d5ed13a49771e27533cc8ece9489d757a55435b1871352ec0a08ac1933ae17",
+		"d2aa700ffb6a92b265b6177810bd5980",
+		"c36f981fc08308ff509d99149481edc2",
+		"5da5ce300ef7719ca2d833f7d0662a13",
+	},
+	{
+		"8583df5ade22061e556877d84a55fe4110fd4e49920b4b5ae6813e63b87df7d3",
+		"0bd7289a5be4b3558dacb96a7ecf36a7",
+		"754b7c9c907cd7ae5b13239e8e03494c513480f5e83ea4c93addb18f316e32b4",
+		"9debcabe66ca3a018197b61eff3381d5cdb0e9452fc959f3693d6218eafc6d30",
+	},
+	{
+		"2b92fe8bd1bb3da729cc98ad5f2b8a4ce2709a585d0094c5c67c2876f1f028bb",
+		"89d8ac4a045b0e3b9b74ca6f81f13da2",
+		"5b3191257435aa4600a385baf825e15c7fbac6bd7ba98a0ba1d0ffbfc92a71a507c0949ceef4df11bbf0db2d2ec056c2",
+		"148ada33a84e4a4dc4c79ad03e69622d1597fb50ddf1a66b52adae76af0c868d7b29bf1befb5d795dc494c947e5aec52",
+	},
+	{
+		"be9bdf5cf12600b7412366a15253806cde35bb38e576eb2047eec5b821368cd0",
+		"cbe9e40015df52bdd394603ed11d0cc7",
+		"7695db9a872fa6c315ff47a94b6957d3c5737e5538c3161d5d8f71a70b30c1cac8a8d91cc85dea460aaf36d5e272debc15c6a0c41bc522d826e555be48bf046e",
+		"e5e810c239019cf50135acd60e30f3f10981486cb5f60f220966e54e71f676c6d529d74ee902e16dc0021c009c26a5e143c4ebb7429720e4a1527c3fdec7e058",
+	},
+	{
+		"dacb6342586202826d4078a20579951f21396c4ed74efda349e557b0bce0c15f",
+		"5e1d5f6eed82c04da8abeee6f416cf88",
+		"6e857aeac5f36165222eed4077df4c74327360cd5050112de5445cf4299e692608754c94a1c8c6cd985513d3df26e5780a6a286baa0679f8af0487297d89e83cdc61571635238145880542e0a0b0cb9d",
+		"9b2adabe119edf424b25ff31c952307408c145d7cd7ae83a8fc7a79c387118fb0be89e9658e1d9a83d7919dd9d195a3621237d3baaef3525a58b56519ac64d1f62144450238c7e3a0edc9e1fcb54bfee",
+	},
+
+	{
+		"333acfd23c56069a1fa847b203c7cdcb0a58b24c56bc314a21d4970a9157b389",
+		"945169fe067e7b1086867109d8b7aeab",
+		"522e5cc779fa9e2b6f63cc24f8473199",
+		"23dddf9157de113632cece38f08ac559",
+	},
+	{
+		"a9393c96678a8c1229c0ef2ad15be58f4e6dc7c98491eb8e03c8cd7e0f63d3c8",
+		"f7f270e9982f98ea035088338efddae8",
+		"4ff591ca8f2344328bd14dc1128639d793bd913d9f0f6bc45e323e3077e61bda",
+		"87f1e44f90a4075c60466628c7815bb786483f1954c54c37ff2bd4f98b2a912b",
+	},
+	{
+		"9426c54c418d07f100f26016c5cad1cb2f469216d9bda47c6866c9f85521d7f8",
+		"e28a14e9c764a78a1e7354130ddcd7cc",
+		"2d3ed9737dbdf5bffd5742cc02f873fbc1c8d1491dd56f7f3e6d5aaaec2fb445921f6c452eb1c25504036a208ee90a76",
+		"68365d5c967d148a15ee0bbb9ee8638ec650c7a15958dc62f3e4022a1124f70261fbe1e63ce0285c44adae5913d6cba7",
+	},
+	{
+		"dacb6342586202826d4078a20579951f21396c4ed74efda349e557b0bce0c15f",
+		"5e1d5f6eed82c04da8abeee6f416cf88",
+		"6e857aeac5f36165222eed4077df4c74327360cd5050112de5445cf4299e692608754c94a1c8c6cd985513d3df26e5780a6a286baa0679f8af0487297d89e83cdc61571635238145880542e0a0b0cb9d",
+		"9b2adabe119edf424b25ff31c952307408c145d7cd7ae83a8fc7a79c387118fb0be89e9658e1d9a83d7919dd9d195a3621237d3baaef3525a58b56519ac64d1f62144450238c7e3a0edc9e1fcb54bfee",
+	},
+	{
+		"ea48a93f24aea80baa23e8a67dcca012a0465da1ac5e7e0ee93ec7b1df9cba0c",
+		"7d9b9bd09442c0247e1460c7527c00fa",
+		"76bc9058ee987a66b2d4241a964a8f68ef3736ee1f7338df6ddf9332edc0b098a305625c0cd137cf9177ba65c4bed39a26bf08435dcf94a504f7090abf162cd3",
+		"563fdbdca43ef880a814ee8a0bd3982626e537841a6553f7f3622cabf3890a6b7e1ba948316fb3b3b85c07be461e77de1efdc82aeea94d2dc17e4f4b2cbcf46f",
+	},
+	{
+		"8453754ae26dc10d9f916104e179fe21ef55250225d294767cb85f45e355ea29",
+		"00c04c0cc23599e2688db0e21f29e7a0",
+		"28143fd3a0692a616d786c604f0ecb18e211e4842e14a06a45292c87995d01a456d4b77ad2a6570956ba78dc5714c8f8f5176cf75be8f57c2d5a415a6b159ae6c1b333d0e59dab354ee6d190d41bff6b",
+		"622cc9a0fdbd33b9181c2f7da010b293cbe5f984391c749d69cd0d2da738e020c5a1e705e8ce0469ceab96bca14d659be4bc00ae29018a919a3d94d34fe14ec63d63d801384f9ba92f590fff2b1b7935",
+	},
+	{
+		"6b78efdd766e4860577f60994c22a82c265c5c285487c45ffc59bee4388ba8ed",
+		"d2da470cbfa01095f9973031863002bc",
+		"73eb1e74f32b3059085058dcde1c5d037b20a072f9de27c5d6cc68e6d75a00f005f93706677dbe057d95bddeacad3791f35f20f48318badfee515b3ce87de3d9d8559541ca418b8110e1706752e40cad09fcb44a9b7a1b8d8c61f2859e2ed398",
+		"1db52c865a5ba9eac18ce21e16781f5c571625fd505a726f6d2136e2cef4ac85046b6d9d9d2c344505600cecbb0c52f402c8709e640df765939c783b93d3a5344920d6df581b8a65830eb6438fbc7dffe91344dbe215df0820f355000e4ff8bd",
+	},
+	{
+		"2107c4d9ac6dc4a5274929ffb4fee356a18b02038186d843cb857a0c30196cbc",
+		"7f08d8067ba0e4e253702a047948c469",
+		"3966a773061ba822b5b6c46e9e6bec26cad2c6d9d272036d041668a3b72873975e2ea659c3127e335e1cff722539f1700a0e486cacfc11ef62c2047fb6a971b04bc07f017e8302a965adc034cb1353292e5ffd27583f1765e35f569f85f2b363f486cd84e38860700209fc5a29cbc888",
+		"892488ad84b4a7a49b0120281c57e772464f52689f3a8c83fcc8025c5e16cc69611bae4820ceb4028b94ef1ea745a15a77a513f8fda65f374af39e1a7d65bf905530d31e1607a972e351146d7767f523e8b8fe17cf0e184500f7164694b76ad1c301dae2b281d7c72806794aac5eeee7",
+	},
+	{
+		"5ff77a1d5b9014ccdddbc6d88d77d2b4d9294a8fcc38304badc9df2eb2eb7ffd",
+		"504fbb648d2f0c956634e4035f7d3385",
+		"5223813f694cf0ecbab8f20432e6a9a7edbd869b5633c2a37cca1ae39e3ce9a1800ce0e0311ce9891c27b10f587b510b3b1e2bbfd91cdc2fea9409e50eaf85937d28912113f245cb7986e04f40911c1b85151318abb1c07b32cfb1628d31758e188853f7e38557635b6b1cfc71349f38e817f86c664b28dddee10400f509d006",
+		"d17913f3ff7b7f1ffe8a8ae69175910931806a1b092bd5e367914580277a91c28fc6dd8a528d5e93d8fd4152563253635f1bd55a499a3c19edebe7b1267832c3d7ce9be8d51825cec10c71fee07ec2b1ccd0ede6911369da03ff86ccc39048d0f8988db2dc1769041891a2d9b6fd105b3457e24b059c9f9b50e40fdb8168391b",
+	},
+	{
+		"d1bf307714dba0903d05c2f6b0c940f6c52c8ae41f6d5e9e97cfb1230765ea6f",
+		"ad075974df40dca987931b83e3b250ce",
+		"14d27a0ca66a9bc97ab129d4a67c5e0ec7abf912e45b33136d950015a8bc359249ec916f7c39b555133a2db47be7e31ec719543f2eac0366d3d245f6e51b951094caa25b8bf5266ba8cfa4ce0eba9b2e1a2d95e10ff657d934535ec133ea86b5213c58165e3e839d30d301c7b08d6a79bf8c4c5525edfd48c2516b786f6f03fad48203d1a236ceb3cf2b2ec4facabb82",
+		"e1d22f6e294a054fd997e0037f31371c7cff1e2f17b7f78116e27d1697a62148294891ed5ecb0fce17bf94a354eb2d33227dd82ccabc2d81faa958b66e157466bb451c31668cdbba500d2db9a63e983e1e840bcd68793963e65e9780b4104f29cd641b7200ac9a2ed0a1230954bb106e161d35f2f7f1b778d7a5b1f9d1f80466a8139934dc41f681552b7f3103bee382",
+	},
+	{
+		"7b3e0ecb0299ec8dde73fa9568f65d8068759f6e85b34b74150865c430292d6f",
+		"68ad0e0a86af7016ee00a4bd43a1a7b7",
+		"4e11179e9b4c1920b44799f78f6dd67a20dee26323ccf6c5db0fed1231b0a6929c4f46448129206dd024e0ce121d93fc0a9649d828e70b9a74ecee2257bfe6277956769a41f43c58795d13e25c02004144d296032278c4e1780501289ae4c62e30a5ebf65344ddaa89fa9d97d2f556d6f5a3cc7960c55c8f95c713dd2b1c2bdd4f777bcde460d1a408f2ffb6ad1102ae660119bed54513197c2829261146ab39",
+		"7fe1e5951cf0f68f6c3c4c2cae41717f6e4ff0e93988d60a4532649f67a74cda58eec3ea0a67d1358cbf1a79eacf0ac75dd1c41dd1421be841039a1085a743c537b724408f960280f8e3db7a9288b34591ff4cef8da526e560a93feec36ac7e4da5051db968fead6ba2ae21b9f7c84ae022d46603d5d27f6368ff159d07f34dc260ff0e1334ecd467b0ab494551de76bad99fbe101f32b5e99d4c9d860303377",
+	},
 }
 
 func TestGBXTSSample(t *testing.T) {

diff --git a/internal/bigmod/nat_asm.go b/internal/bigmod/nat_asm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !purego && (386 || amd64 || arm || arm64 || ppc64 || ppc64le || riscv64 || s390x)
+//go:build !purego && (386 || amd64 || arm || arm64 || loong64 || ppc64 || ppc64le || riscv64 || s390x)
 
 package bigmod
 

diff --git a/internal/bigmod/nat_loong64.s b/internal/bigmod/nat_loong64.s
@@ -0,0 +1,98 @@
+// Copyright 2024 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// derived from crypto/internal/fips140/bigmod/nat_riscv64.s
+
+//go:build !purego
+
+#include "textflag.h"
+
+// func addMulVVW256(z, x *uint, y uint) (c uint)
+TEXT ·addMulVVW256(SB),$0-32
+	MOVV	$4, R8
+	JMP	addMulVVWy(SB)
+
+// func addMulVVW1024(z, x *uint, y uint) (c uint)
+TEXT ·addMulVVW1024(SB),$0-32
+	MOVV	$16, R8
+	JMP	addMulVVWy(SB)
+
+// func addMulVVW1536(z, x *uint, y uint) (c uint)
+TEXT ·addMulVVW1536(SB),$0-32
+	MOVV	$24, R8
+	JMP	addMulVVWy(SB)
+
+// func addMulVVW2048(z, x *uint, y uint) (c uint)
+TEXT ·addMulVVW2048(SB),$0-32
+	MOVV	$32, R8
+	JMP	addMulVVWy(SB)
+
+TEXT addMulVVWy(SB),NOFRAME|NOSPLIT,$0
+	MOVV	z+0(FP), R4
+	MOVV	x+8(FP), R6
+	MOVV	y+16(FP), R5
+	MOVV	$0, R7
+
+	BEQ	R8, R0, done
+loop:
+	MOVV	0*8(R4), R9	    // z[0]
+	MOVV	1*8(R4), R10	// z[1]
+	MOVV	2*8(R4), R11	// z[2]
+	MOVV	3*8(R4), R12	// z[3]
+
+	MOVV	0*8(R6), R13	// x[0]
+	MOVV	1*8(R6), R14	// x[1]
+	MOVV	2*8(R6), R15	// x[2]
+	MOVV	3*8(R6), R16	// x[3]
+
+	MULHVU	R13, R5, R17	// z_hi[0] = x[0] * y
+	MULV	R13, R5, R13	// z_lo[0] = x[0] * y
+	ADDV	R13, R9, R18	// z_lo[0] = x[0] * y + z[0]
+	SGTU	R13, R18, R19
+	ADDV	R17, R19, R17	// z_hi[0] = x[0] * y + z[0]
+	ADDV	R18, R7, R9	    // z_lo[0] = x[0] * y + z[0] + c
+	SGTU	R18, R9, R19
+	ADDV	R17, R19, R7	// next c
+
+	MULHVU	R14, R5, R24	// z_hi[1] = x[1] * y
+	MULV	R14, R5, R14	// z_lo[1] = x[1] * y
+	ADDV	R14, R10, R18	// z_lo[1] = x[1] * y + z[1]
+	SGTU	R14, R18, R19
+	ADDV	R24, R19, R24	// z_hi[1] = x[1] * y + z[1]
+	ADDV	R18, R7, R10	// z_lo[1] = x[1] * y + z[1] + c
+	SGTU	R18, R10, R19
+	ADDV	R24, R19, R7	// next c
+
+	MULHVU	R15, R5, R25	// z_hi[2] = x[2] * y
+	MULV	R15, R5, R15	// z_lo[2] = x[2] * y
+	ADDV	R15, R11, R18	// z_lo[2] = x[2] * y + z[2]
+	SGTU	R15, R18, R19
+	ADDV	R25, R19, R25	// z_hi[2] = x[2] * y + z[2]
+	ADDV	R18, R7, R11	// z_lo[2] = x[2] * y + z[2] + c
+	SGTU	R18, R11, R19
+	ADDV	R25, R19, R7	// next c
+
+	MULHVU	R16, R5, R26	// z_hi[3] = x[3] * y
+	MULV	R16, R5, R16	// z_lo[3] = x[3] * y
+	ADDV	R16, R12, R18	// z_lo[3] = x[3] * y + z[3]
+	SGTU	R16, R18, R19
+	ADDV	R26, R19, R26	// z_hi[3] = x[3] * y + z[3]
+	ADDV	R18, R7, R12	// z_lo[3] = x[3] * y + z[3] + c
+	SGTU	R18, R12, R19
+	ADDV	R26, R19, R7	// next c
+
+	MOVV	R9, 0*8(R4) 	// z[0]
+	MOVV	R10, 1*8(R4)	// z[1]
+	MOVV	R11, 2*8(R4)	// z[2]
+	MOVV	R12, 3*8(R4)	// z[3]
+
+	ADDV	$32, R4
+	ADDV	$32, R6
+
+	SUBV	$4, R8
+	BNE	R8, R0, loop
+
+done:
+	MOVV	R7, c+24(FP)
+	RET
diff --git a/internal/bigmod/nat_noasm.go b/internal/bigmod/nat_noasm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build purego || !(386 || amd64 || arm || arm64 || ppc64 || ppc64le || riscv64 || s390x)
+//go:build purego || !(386 || amd64 || arm || arm64 || loong64 || ppc64 || ppc64le || riscv64 || s390x || wasm)
 
 package bigmod