refactor(crypto): remove unused SM2 and SM3 support

[Federico2014]

What does this PR do?

This PR removes the unused SM2 signing and SM3 hashing implementations, eliminates the runtime crypto engine switch, and simplifies the signing and hashing APIs to use ECKey and SHA-256 directly.

It updates the dependent actuator, chainbase, common, consensus, framework, crypto, and plugin call sites. It also removes the crypto.engine configuration and Toolkit --sm2 option, updates documentation, and adjusts the related tests.

Why are these changes required?

SM2 and SM3 are not used by the supported default node configuration. Maintaining the alternate crypto path adds duplicated logic, configuration ambiguity, and unnecessary maintenance overhead.

The cross-module changes are required because the removed algorithm-selection parameters were propagated through hashing, signing, transaction, block, consensus, Keystore, and Toolkit APIs.

This PR has been tested by:

• Unit Tests: focused common configuration, framework crypto and Keystore, and plugin Keystore tests
• Build Verification: framework and plugin production/test compilation
• Manual Testing: Not performed

Follow up

None.

Extra details

The supported ECKey and SHA-256 consensus behavior remains unchanged. This PR does not change database formats, does not require a hard fork, and preserves compatibility with standard ECKey Keystore files.

The removed crypto.engine configuration, SM2/SM3 APIs, SM2 Keystore handling, and Toolkit --sm2 option are no longer supported.

This implementation follows the direction of tronprotocol#6627 and closes #51.

---

Summary by cubic

Removes SM2/SM3 and the runtime crypto engine, standardizing all signing to ECKey and hashing to SHA-256. Simplifies APIs, deletes unused code, and updates call sites, tests, configs, and Toolkit.

• Refactors

  • Deleted SM2/SM3 code paths (SM2, SM2Signer, related tests/utilities).
  • SignUtils now always uses ECKey; removed engine flags.
  • Sha256Hash now always does SHA-256; removed SM3 and boolean overloads (of/hash/create).
  • Removed CommonParameter.cryptoEngine, MiscConfig.cryptoEngine, and Constant.ECKey_ENGINE.
  • Dropped crypto.engine from reference.conf and config.conf.
  • Removed Toolkit --sm2 option; CLI rejects it.
  • Updated hashing/signing calls across actuator, chainbase, common, consensus, framework, plugins.
  • Removed plugin CryptoUitls and SM3 test helper Sha256Sm3Hash.

• Migration

  • Remove any use of crypto.engine and --sm2; ECKey + SHA-256 is the only path.
  • Update method signatures: SignUtils.fromPrivate(byte[]), SignUtils.getGeneratedRandomSign(SecureRandom), Wallet.decrypt(String, WalletFile), WalletUtils.loadCredentials(String, File), and Sha256Hash.of/hash/create(...) without engine params.
  • No DB format changes or fork risk; existing ECKey keystores remain compatible.

^{Written for commit 6540280. Summary will update on new commits.}

Summary by CodeRabbit

• Breaking Changes

  • Removed SM2 signing and verification support.
  • Removed the crypto.engine configuration and --sm2 keystore option.
  • Simplified keystore and wallet operations to use standard EC cryptography.

• Improvements

  • Standardized hashing on SHA-256 for transactions, blocks, messages, addresses, and keystore checksums.
  • Improved consistency of transaction IDs, signature validation, and address recovery.

• Bug Fixes

  • Unsupported SM2 commands are now rejected.
  • Added validation for ambiguous keystore updates.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR removes SM2/SM3 support and the crypto.engine switch. Cryptographic APIs now use ECKey and SHA-256 directly. Production callers, configuration, keystore tools, documentation, plugins, and tests are updated accordingly.

Changes

Cryptography cleanup

Layer / File(s)	Summary
Simplified cryptographic APIs common/..., crypto/..., plugins/...	Sha256Hash and SignUtils no longer select algorithms through boolean parameters. SM2-specific APIs and implementations are removed.
Production caller migration actuator/..., chainbase/..., consensus/..., framework/..., plugins/...	Transaction, block, message, VM, consensus, wallet, RPC, Merkle, and database hashing and signing use ECKey and SHA-256 defaults.
Configuration and keystore updates common/..., framework/..., crypto/..., plugins/..., docs/...	Crypto-engine configuration, keystore algorithm flags, and --sm2 command options are removed.
Test updates framework/src/test/..., plugins/src/test/..., common/src/test/...	Tests use the revised APIs, remove SM2/SM3 coverage, and verify rejection of the removed --sm2 option.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related issues

• [Feature] Enhance SM2 security and simplify signing model #18 — Concerns the same SM2/SM3 and crypto-engine abstraction, but proposes hardening instead of removal.
• Federico2014/bn128-ipc#1 — Directly concerns removing SM2/SM3 support and the crypto-engine configuration.
• [Feature] Enhance ECKey validation and key handling #47 — Concerns removal of legacy crypto-provider configuration around EC key handling.

Possibly related PRs

• Federico2014/java-tron#49 — Modifies cryptographic validation and block and transaction signature paths.
• Federico2014/java-tron#52 — Modifies CommonParameter, SignUtils, and PBFT signature recovery.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR removes SM2/SM3, engine configuration, boolean dispatch, and related keystore paths, but it does not show required golden-vector regression coverage [#51].	Add golden-vector tests for transaction IDs, block IDs, signatures, addresses, hashes, and Merkle roots to verify byte-for-byte ECKey compatibility [#51].
Docstring Coverage	⚠️ Warning	Docstring coverage is 23.08% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The production, test, configuration, plugin, and documentation changes support removal of SM2/SM3 and the crypto engine switch [#51].
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary change: removal of unused SM2 and SM3 cryptographic support.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/remove-sm2-sm3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

All reported issues were addressed across 95 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.