Commit 3d9325c028 for openssl.org

commit 3d9325c028624cef8979164fa4f1d899696f3439
Author: Filipe <fmartns66@gmail.com>
Date:   Sat Aug 1 02:35:37 2026 -0300

    Document SM4 table-lookup side-channel risk

    Note in EVP_CIPHER-SM4(7) that SM4 implementations may use
    secret-dependent table lookups and are not guaranteed to be
    constant-time. Mention the portable C path as a concrete example
    and point to CPU capability man pages for code-path selection.

    Fixes: https://github.com/openssl/openssl/issues/31911

    Assisted-by: Cursor:composer

    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
    MergeDate: Tue Aug 11 07:02:12 2026
    (Merged from https://github.com/openssl/openssl/pull/32136)

diff --git a/doc/man7/EVP_CIPHER-SM4.pod b/doc/man7/EVP_CIPHER-SM4.pod
index a446fafb6d..b68ffc9b6a 100644
--- a/doc/man7/EVP_CIPHER-SM4.pod
+++ b/doc/man7/EVP_CIPHER-SM4.pod
@@ -39,6 +39,13 @@ L<EVP_EncryptInit(3)/PARAMETERS>.

 =head1 NOTES

+SM4 implementations in OpenSSL may use secret-dependent table lookups and
+are not guaranteed to be constant-time. In particular, the portable C
+implementation uses S-box and T-table lookups and may be vulnerable to
+cache-timing side-channel attacks. Which code path is used depends on CPU
+capabilities; see L<OPENSSL_armcap(3)>, L<OPENSSL_ia32cap(3)> and
+L<OPENSSL_riscvcap(3)>.
+
 The SM4-XTS implementation allows streaming to be performed, but each
 L<EVP_EncryptUpdate(3)> or L<EVP_DecryptUpdate(3)> call requires each input
 to be a multiple of the blocksize. Only the final EVP_EncryptUpdate() or
@@ -48,11 +55,12 @@ stealing (CTS) is used to fill the block.

 =head1 SEE ALSO

-L<provider-cipher(7)>, L<OSSL_PROVIDER-default(7)>
+L<OPENSSL_armcap(3)>, L<OPENSSL_ia32cap(3)>, L<OPENSSL_riscvcap(3)>,
+L<OSSL_PROVIDER-default(7)>, L<provider-cipher(7)>

 =head1 COPYRIGHT

-Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2021-2026 The OpenSSL Project Authors. All Rights Reserved.

 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy