diff --git a/include/gmssl/dylib.h b/include/gmssl/dylib.h
index c2aefaa82..5fa91e8db 100644
--- a/include/gmssl/dylib.h
+++ b/include/gmssl/dylib.h
@@ -31,6 +31,17 @@ typedef HMODULE dylib_handle_t;
 #define dylib_error_str()		""
 
 
+#elif defined(__ZEPHYR__)
+
+/* Zephyr RTOS doesn't support dynamic loading */
+typedef void *dylib_handle_t;
+
+#define dylib_load_library(so_path)	NULL
+#define dylib_get_function(handle,name)	NULL
+#define dylib_close_library(handle)
+#define dylib_error_str()		"Dynamic loading not supported on Zephyr"
+
+
 #else
 
 #include <dlfcn.h>
diff --git a/include/gmssl/socket.h b/include/gmssl/socket.h
index 926d22b7b..e53585a29 100644
--- a/include/gmssl/socket.h
+++ b/include/gmssl/socket.h
@@ -38,6 +38,21 @@ typedef int tls_socklen_t;
 #define tls_socket_close(sock)			closesocket(sock)
 #define tls_socket_wait()			Sleep(1)
 
+#elif defined(__ZEPHYR__)
+
+/* Zephyr-specific socket definitions - minimal for crypto-only usage */
+#include <zephyr/kernel.h>
+
+typedef int tls_socket_t;
+typedef ssize_t tls_ret_t;
+typedef int tls_socklen_t;
+
+/* Stub implementations - not functional for actual networking */
+#define tls_socket_send(sock,buf,len,flags)	(-1)
+#define tls_socket_recv(sock,buf,len,flags)	(-1)
+#define tls_socket_close(sock)			(-1)
+#define tls_socket_wait()			k_sleep(K_MSEC(1))
+
 #else
 
 #include <fcntl.h>
diff --git a/src/hex.c b/src/hex.c
index 9c58e9cd2..d8530e193 100644
--- a/src/hex.c
+++ b/src/hex.c
@@ -101,7 +101,7 @@ static int hexchar2int(char c)
 	else return -1;
 }
 
-int hex2bin(const char *in, size_t inlen, uint8_t *out)
+static int hex2bin(const char *in, size_t inlen, uint8_t *out)
 {
 	int c;
 	if (inlen % 2) {
diff --git a/zephyr/CMakeLists.txt b/zephyr/CMakeLists.txt
new file mode 100644
index 000000000..564cf490c
--- /dev/null
+++ b/zephyr/CMakeLists.txt
@@ -0,0 +1,181 @@
+if(CONFIG_GMSSL)
+  zephyr_interface_library_named(GmSSL)
+
+  zephyr_library()
+  
+  # Core sources - always included
+  zephyr_library_sources(
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/version.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/debug.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm4.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm4_cbc.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm4_ctr.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm4_gcm.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm3.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm3_hmac.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm3_kdf.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm3_pbkdf2.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm3_digest.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_z256.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_z256_table.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_key.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_sign.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_enc.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_exch.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm9_z256.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm9_z256_table.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm9_key.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm9_sign.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm9_enc.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm9_exch.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/zuc.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/zuc_modes.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/block_cipher.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/digest.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/hmac.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/hkdf.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/gf128.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/ghash.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm4_cbc_sm3_hmac.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm4_ctr_sm3_hmac.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/pkcs8.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/ec.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/rsa.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/asn1.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/hex.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/base64.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/pem.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/x509_alg.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/x509_cer.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/x509_ext.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/x509_req.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/x509_crl.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/x509_new.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/cms.c
+    ${ZEPHYR_CURRENT_MODULE_DIR}/src/file.c
+  )
+
+  # TLS and networking sources - only include if needed
+  if(CONFIG_GMSSL_TLS)
+    zephyr_library_sources(
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/socket.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/tls.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/tls_ext.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/tls_trace.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/tlcp.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/tls12.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/tls13.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/http.c
+    )
+  endif()
+
+  # Include file.c separately since it's duplicated
+  if(NOT CONFIG_GMSSL_TLS)
+    zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/file.c)
+  endif()
+
+  # Platform-specific random sources
+  zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/zephyr/rand_ze.c)
+
+  # Conditional sources based on Kconfig
+  zephyr_library_sources_ifdef(CONFIG_GMSSL_SM4_ECB ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm4_ecb.c)
+  zephyr_library_sources_ifdef(CONFIG_GMSSL_SM4_OFB ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm4_ofb.c)
+  zephyr_library_sources_ifdef(CONFIG_GMSSL_SM4_CFB ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm4_cfb.c)
+  zephyr_library_sources_ifdef(CONFIG_GMSSL_SM4_CCM ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm4_ccm.c)
+  zephyr_library_sources_ifdef(CONFIG_GMSSL_SM4_XTS ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm4_xts.c)
+  zephyr_library_sources_ifdef(CONFIG_GMSSL_SM4_CBC_MAC ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm4_cbc_mac.c)
+  zephyr_library_sources_ifdef(CONFIG_GMSSL_SM3_XMSS ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm3_xmss.c)
+  zephyr_library_sources_ifdef(CONFIG_GMSSL_SHA1 ${ZEPHYR_CURRENT_MODULE_DIR}/src/sha1.c)
+  
+  if(CONFIG_GMSSL_SHA2)
+    zephyr_library_sources(
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sha256.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sha512.c
+    )
+  endif()
+  
+  if(CONFIG_GMSSL_AES)
+    zephyr_library_sources(
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/aes.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/aes_modes.c
+    )
+  endif()
+  
+  zephyr_library_sources_ifdef(CONFIG_GMSSL_CHACHA20 ${ZEPHYR_CURRENT_MODULE_DIR}/src/chacha20.c)
+  
+  if(CONFIG_GMSSL_SDF)
+    zephyr_library_sources(
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sdf/sdf.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sdf/sdf_lib.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sdf/sdf_meth.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sdf/sdf_ext.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sdf/sdf_sansec.c
+    )
+  endif()
+
+  if(CONFIG_GMSSL_SM2_EXTS)
+    zephyr_library_sources(
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_key_share.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_recover.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_blind.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_ring.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_elgamal.c
+      ${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_commit.c
+    )
+  endif()
+
+  # Architecture-specific optimizations
+  if(CONFIG_GMSSL_SM2_ARM64)
+    enable_language(ASM)
+    zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_z256_arm64.S)
+  endif()
+
+  if(CONFIG_GMSSL_SM9_ARM64)
+    enable_language(ASM)
+    zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/sm9_z256_arm64.S)
+  endif()
+
+  if(CONFIG_GMSSL_GMUL_ARM64)
+    zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/gf128_arm64.c)
+  endif()
+
+  if(CONFIG_GMSSL_SM2_AMD64)
+    enable_language(ASM)
+    zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/sm2_z256_amd64.S)
+  endif()
+
+  # Compiler definitions based on Kconfig
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SMALL_FOOTPRINT ENABLE_SMALL_FOOTPRINT)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_TEST_SPEED ENABLE_TEST_SPEED)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM2_ALGOR_ID_ENCODE_NULL ENABLE_SM2_ALGOR_ID_ENCODE_NULL)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_ASM_UNDERSCORE_PREFIX ENABLE_ASM_UNDERSCORE_PREFIX)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_TLS_DEBUG ENABLE_TLS_DEBUG)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM2_ENC_PRE_COMPUTE ENABLE_SM2_ENC_PRE_COMPUTE)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM2_ARM64 ENABLE_SM2_ARM64)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM3_ARM64 ENABLE_SM3_ARM64)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM4_ARM64 ENABLE_SM4_ARM64)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM4_CE ENABLE_SM4_CE)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM9_ARM64 ENABLE_SM9_ARM64)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_GMUL_ARM64 ENABLE_GMUL_ARM64)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM4_AVX2 ENABLE_SM4_AVX2)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM4_AESNI ENABLE_SM4_AESNI)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM2_AMD64 ENABLE_SM2_AMD64)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM3_SSE ENABLE_SM3_SSE)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM4_CTR_AESNI_AVX ENABLE_SM4_CTR_AESNI_AVX)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM4_ECB ENABLE_SM4_ECB)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM4_OFB ENABLE_SM4_OFB)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM4_CFB ENABLE_SM4_CFB)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM4_CCM ENABLE_SM4_CCM)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SM4_XTS ENABLE_SM4_XTS)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SHA1 ENABLE_SHA1)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SHA2 ENABLE_SHA2)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_AES ENABLE_AES)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_CHACHA20 ENABLE_CHACHA20)
+  zephyr_compile_definitions_ifdef(CONFIG_GMSSL_SDF ENABLE_SDF)
+
+  # Include directories
+  zephyr_include_directories(${ZEPHYR_CURRENT_MODULE_DIR}/include)
+
+  target_link_libraries(GmSSL INTERFACE zephyr_interface)
+
+endif()
diff --git a/zephyr/Kconfig b/zephyr/Kconfig
new file mode 100644
index 000000000..3fcca71f1
--- /dev/null
+++ b/zephyr/Kconfig
@@ -0,0 +1,199 @@
+# Copyright (c) 2025 SysFly Co.
+
+menuconfig GMSSL
+	bool "GmSSL support"
+	help
+	  This option enables the GmSSL cryptography library.
+
+if GMSSL
+
+config GMSSL_SMALL_FOOTPRINT
+	bool "Enable small code size"
+	help
+	  Enable small code size optimization for GmSSL.
+
+config GMSSL_TEST_SPEED
+	bool "Enable test speed"
+	help
+	  Enable test speed benchmarks.
+
+config GMSSL_SM2_ALGOR_ID_ENCODE_NULL
+	bool "Enable SM2 AlgorithmIdentifier encode NULL"
+	help
+	  Enable AlgorithmIdentifier with algorithm sm2sign_with_sm3 encode a NULL object as parameters.
+
+config GMSSL_ASM_UNDERSCORE_PREFIX
+	bool "Add prefix underscore to assembly symbols"
+	default y
+	help
+	  Add prefix `_` to assembly symbols.
+
+config GMSSL_TLS_DEBUG
+	bool "Enable TLS debug"
+	help
+	  Enable TLS and TLCP print debug messages.
+
+config GMSSL_SM2_ENC_PRE_COMPUTE
+	bool "Enable SM2 encryption precomputing"
+	default y
+	help
+	  Enable SM2 encryption precomputing optimization.
+
+# Architecture-specific optimizations
+config GMSSL_SM2_ARM64
+	bool "Enable SM2 ARM64 assembly"
+	depends on ARM64
+	help
+	  Enable SM2_Z256 ARMv8 assembly implementation.
+
+config GMSSL_SM3_ARM64
+	bool "Enable SM3 ARM64 optimization"
+	depends on ARM64
+	help
+	  Enable SM3 Arm Neon implementation (10% faster on Apple M2).
+
+config GMSSL_SM4_ARM64
+	bool "Enable SM4 ARM64 assembly"
+	depends on ARM64
+	help
+	  Enable SM4 AARCH64 assembly implementation.
+
+config GMSSL_SM4_CE
+	bool "Enable SM4 ARM CE assembly"
+	depends on ARM64
+	help
+	  Enable SM4 ARM CE assembly implementation.
+
+config GMSSL_SM9_ARM64
+	bool "Enable SM9 ARM64 assembly"
+	depends on ARM64
+	help
+	  Enable SM9_Z256 ARMv8 assembly implementation.
+
+config GMSSL_GMUL_ARM64
+	bool "Enable GF(2^128) multiplication ARM64"
+	depends on ARM64
+	help
+	  Enable GF(2^128) Multiplication AArch64 assembly.
+
+# x86_64 optimizations
+config GMSSL_SM4_AVX2
+	bool "Enable SM4 AVX2 implementation"
+	depends on X86_64
+	help
+	  Enable SM4 AVX2 8x implementation.
+
+config GMSSL_SM4_AESNI
+	bool "Enable SM4 AES-NI implementation"
+	depends on X86_64
+	help
+	  Enable SM4 AES-NI (4x) implementation.
+
+config GMSSL_SM2_AMD64
+	bool "Enable SM2 AMD64 assembly"
+	depends on X86_64
+	help
+	  Enable SM2_Z256 X86_64 assembly implementation.
+
+config GMSSL_SM3_SSE
+	bool "Enable SM3 SSE assembly"
+	depends on X86_64
+	help
+	  Enable SM3 SSE assembly implementation.
+
+config GMSSL_SM4_CTR_AESNI_AVX
+	bool "Enable SM4 CTR AESNI+AVX assembly"
+	depends on X86_64
+	help
+	  Enable SM4 CTR AESNI+AVX assembly implementation.
+
+# SM4 modes
+config GMSSL_SM4_ECB
+	bool "Enable SM4 ECB mode"
+	default y
+	help
+	  Enable SM4 ECB mode support.
+
+config GMSSL_SM4_OFB
+	bool "Enable SM4 OFB mode"
+	default y
+	help
+	  Enable SM4 OFB mode support.
+
+config GMSSL_SM4_CFB
+	bool "Enable SM4 CFB mode"
+	default y
+	help
+	  Enable SM4 CFB mode support.
+
+config GMSSL_SM4_CCM
+	bool "Enable SM4 CCM mode"
+	default y
+	help
+	  Enable SM4 CCM mode support.
+
+config GMSSL_SM4_XTS
+	bool "Enable SM4 XTS mode"
+	default y
+	help
+	  Enable SM4 XTS mode support.
+
+config GMSSL_SM4_CBC_MAC
+	bool "Enable SM4-CBC-MAC"
+	default y
+	help
+	  Enable SM4-CBC-MAC support.
+
+# Extensions
+config GMSSL_SM2_EXTS
+	bool "Enable SM2 Extensions"
+	help
+	  Enable SM2 Extensions support.
+
+config GMSSL_SM3_XMSS
+	bool "Enable SM3-XMSS signature"
+	default y
+	help
+	  Enable SM3-XMSS signature support.
+
+# Additional algorithms
+config GMSSL_SHA1
+	bool "Enable SHA1"
+	default y
+	help
+	  Enable SHA1 hash algorithm.
+
+config GMSSL_SHA2
+	bool "Enable SHA2"
+	default y
+	help
+	  Enable SHA2 family hash algorithms.
+
+config GMSSL_AES
+	bool "Enable AES"
+	default y
+	help
+	  Enable AES encryption algorithm.
+
+config GMSSL_CHACHA20
+	bool "Enable ChaCha20"
+	default y
+	help
+	  Enable ChaCha20 encryption algorithm.
+
+# Hardware support
+config GMSSL_SDF
+	bool "Enable SDF module"
+	default y
+	help
+	  Enable SDF (Secure Data Format) module.
+
+config GMSSL_TLS
+	bool "Enable TLS and networking support"
+	default n
+	help
+	  Enable TLS, TLCP, and networking functionality.
+	  Requires POSIX networking headers.
+
+endif # GMSSL
+
diff --git a/zephyr/module.yml b/zephyr/module.yml
new file mode 100644
index 000000000..cbff6a1ae
--- /dev/null
+++ b/zephyr/module.yml
@@ -0,0 +1,3 @@
+build:
+  cmake: zephyr
+  kconfig: zephyr/Kconfig
diff --git a/zephyr/rand_ze.c b/zephyr/rand_ze.c
new file mode 100644
index 000000000..83e43a313
--- /dev/null
+++ b/zephyr/rand_ze.c
@@ -0,0 +1,37 @@
+/*
+ *  Copyright 2014-2022 The GmSSL Project. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the License); you may
+ *  not use this file except in compliance with the License.
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ */
+
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <gmssl/rand.h>
+#include <gmssl/error.h>
+#include <zephyr/random/random.h>
+
+#define RAND_MAX_BUF_SIZE 4096
+
+int rand_bytes(uint8_t *buf, size_t len)
+{
+	if (!buf) {
+		error_print();
+		return -1;
+	}
+	if (len > RAND_MAX_BUF_SIZE) {
+		error_print();
+		return -1;
+	}
+	if (!len) {
+		return 0;
+	}
+
+	sys_rand_get(buf, len);
+
+	return 1;
+}