diff --git a/docs/conf_common.py b/docs/conf_common.py
index 3d4e209b3d6..676fb0aa3a2 100644
--- a/docs/conf_common.py
+++ b/docs/conf_common.py
@@ -404,6 +404,7 @@ conditional_include_dict = {
     'SOC_DIG_SIGN_SUPPORTED': ['api-reference/peripherals/ds.rst'],
     'SOC_ECDSA_SUPPORTED': ['api-reference/peripherals/ecdsa.rst'],
     'SOC_HMAC_SUPPORTED': ['api-reference/peripherals/hmac.rst'],
+    'SOC_SHA_SUPPORT_SM3': ['api-reference/peripherals/sm3.rst'],
     'SOC_GDMA_SUPPORT_CRC': ['api-reference/peripherals/async_crc.rst'],
     'SOC_ASYNC_MEMCPY_SUPPORTED': ['api-reference/peripherals/async_memcpy.rst'],
     'SOC_DMA2D_SUPPORTED': ['api-reference/peripherals/async_color_convert.rst'],
diff --git a/docs/doxygen/Doxyfile b/docs/doxygen/Doxyfile
index 6664e6a81ae..e92f3482276 100644
--- a/docs/doxygen/Doxyfile
+++ b/docs/doxygen/Doxyfile
@@ -271,6 +271,7 @@ INPUT = \
     $(PROJECT_PATH)/components/esp_ringbuf/include/freertos/ringbuf.h \
     $(PROJECT_PATH)/components/esp_rom/include/esp_rom_sys.h \
     $(PROJECT_PATH)/components/esp_security/include/esp_ds.h \
+    $(PROJECT_PATH)/components/esp_security/include/esp_sm3.h \
     $(PROJECT_PATH)/components/esp_system/include/esp_debug_helpers.h \
     $(PROJECT_PATH)/components/esp_system/include/esp_expression_with_stack.h \
     $(PROJECT_PATH)/components/esp_system/include/esp_freertos_hooks.h \
diff --git a/docs/en/api-reference/peripherals/index.rst b/docs/en/api-reference/peripherals/index.rst
index 7e4c551a434..3934c850953 100644
--- a/docs/en/api-reference/peripherals/index.rst
+++ b/docs/en/api-reference/peripherals/index.rst
@@ -42,6 +42,7 @@ Peripherals API
     :SOC_GPSPI_SUPPORTED: sdspi_host
     :SOC_SDIO_SLAVE_SUPPORTED: sdio_slave
     :SOC_SDM_SUPPORTED: sdm
+    :SOC_SHA_SUPPORT_SM3: sm3
     :SOC_SPI_FLASH_SUPPORTED: spi_flash/index
     :SOC_GPSPI_SUPPORTED: spi_master
     :SOC_GPSPI_SUPPORTED: spi_slave
diff --git a/docs/en/api-reference/peripherals/sm3.rst b/docs/en/api-reference/peripherals/sm3.rst
new file mode 100644
index 00000000000..02ac8395efd
--- /dev/null
+++ b/docs/en/api-reference/peripherals/sm3.rst
@@ -0,0 +1,77 @@
+SM3 Hash Accelerator
+====================
+
+:link_to_translation:`zh_CN:[中文]`
+
+SM3 (GM/T 0004-2012) is a cryptographic hash function of the Chinese ShangMi (SM) standards. It reads the message in 64-byte blocks and produces a 256-bit digest, comparable to SHA-256. On {IDF_TARGET_NAME}, the SHA accelerator computes SM3 in hardware.
+
+The ``esp_sm3`` API is the only interface to the SM3 hardware. SM3 is not available through the Mbed TLS or PSA Crypto APIs.
+
+.. only:: esp32s31
+
+    An eFuse (``DIS_SM_CRYPT``) can disable all the SM crypto functions permanently. On a chip with this eFuse set, :cpp:func:`esp_sm3_create` and :cpp:func:`esp_sm3` return :c:macro:`ESP_ERR_NOT_SUPPORTED`. Always check the return value.
+
+One-Shot Digest
+---------------
+
+Use :cpp:func:`esp_sm3` when the whole message is in one buffer:
+
+.. code-block:: c
+
+    #include "esp_sm3.h"
+
+    uint8_t digest[ESP_SM3_DIGEST_LEN];
+
+    esp_err_t err = esp_sm3(message, message_len, digest, sizeof(digest));
+    if (err != ESP_OK) {
+        // No digest was written. Handle the error.
+    }
+
+Streaming Digest
+----------------
+
+Use the context functions when the message arrives in parts:
+
+.. code-block:: c
+
+    #include "esp_sm3.h"
+
+    uint8_t digest[ESP_SM3_DIGEST_LEN];
+    esp_sm3_ctx_handle_t ctx = NULL;
+
+    esp_err_t err = esp_sm3_create(&ctx);
+    if (err != ESP_OK) {
+        return err;
+    }
+
+    err = esp_sm3_update(ctx, part1, part1_len);
+    if (err == ESP_OK) {
+        err = esp_sm3_update(ctx, part2, part2_len);
+    }
+    if (err == ESP_OK) {
+        err = esp_sm3_finish(ctx, digest, sizeof(digest));
+    }
+
+    esp_sm3_delete(ctx);
+
+:cpp:func:`esp_sm3_create` allocates the context and writes the handle to ``ctx``. If the function returns :c:macro:`ESP_ERR_NO_MEM` or :c:macro:`ESP_ERR_NOT_SUPPORTED`, it writes NULL to ``ctx``. The context is opaque. The application must not read or write it.
+
+:cpp:func:`esp_sm3_delete` erases the message bytes and the digest state. Then it frees the context. The handle is not valid after the call. If the application does not call this function, the context stays allocated.
+
+Call :cpp:func:`esp_sm3_delete` after :cpp:func:`esp_sm3_finish`. Call it also to abandon an operation.
+
+Concurrency
+-----------
+
+:cpp:func:`esp_sm3_update` and :cpp:func:`esp_sm3_finish` acquire the SHA peripheral. They hold it only while the hardware processes a message block, and they release it before they return. :cpp:func:`esp_sm3_create` and :cpp:func:`esp_sm3_delete` never touch the peripheral.
+
+:cpp:func:`esp_sm3_update` acquires the peripheral only when the new bytes complete at least one 64-byte block. A call with fewer bytes copies them into the context and returns. :cpp:func:`esp_sm3_finish` always acquires the peripheral, because the padding completes the last block.
+
+An operation can therefore stay open for a long time at no cost to other users of the peripheral. Operations with different contexts can run in parallel from different tasks.
+
+Do not use one context from two tasks at the same time.
+
+API Reference
+-------------
+
+.. include-build-file:: inc/esp_sm3.inc
diff --git a/docs/zh_CN/api-reference/peripherals/index.rst b/docs/zh_CN/api-reference/peripherals/index.rst
index 344b23e76a4..b116c0047ee 100644
--- a/docs/zh_CN/api-reference/peripherals/index.rst
+++ b/docs/zh_CN/api-reference/peripherals/index.rst
@@ -42,6 +42,7 @@
     :SOC_GPSPI_SUPPORTED: sdspi_host
     :SOC_SDIO_SLAVE_SUPPORTED: sdio_slave
     :SOC_SDM_SUPPORTED: sdm
+    :SOC_SHA_SUPPORT_SM3: sm3
     :SOC_SPI_FLASH_SUPPORTED: spi_flash/index
     :SOC_GPSPI_SUPPORTED: spi_master
     :SOC_GPSPI_SUPPORTED: spi_slave
diff --git a/docs/zh_CN/api-reference/peripherals/sm3.rst b/docs/zh_CN/api-reference/peripherals/sm3.rst
new file mode 100644
index 00000000000..78f980b8ac6
--- /dev/null
+++ b/docs/zh_CN/api-reference/peripherals/sm3.rst
@@ -0,0 +1,77 @@
+SM3 杂凑加速器
+==============
+
+:link_to_translation:`en:[English]`
+
+SM3（GM/T 0004-2012）是中国商用密码（SM）标准中的密码杂凑算法。它以 64 字节为分组读取消息，输出 256 位摘要，与 SHA-256 相当。在 {IDF_TARGET_NAME} 上，SHA 加速器以硬件方式计算 SM3。
+
+``esp_sm3`` API 是访问 SM3 硬件的唯一接口。Mbed TLS 和 PSA Crypto API 均不提供 SM3。
+
+.. only:: esp32s31
+
+    eFuse ``DIS_SM_CRYPT`` 可永久禁用全部 SM 密码功能。在烧写了该 eFuse 的芯片上，:cpp:func:`esp_sm3_create` 和 :cpp:func:`esp_sm3` 返回 :c:macro:`ESP_ERR_NOT_SUPPORTED`。请始终检查返回值。
+
+一次性摘要
+----------
+
+当整条消息位于同一个缓冲区时，使用 :cpp:func:`esp_sm3`：
+
+.. code-block:: c
+
+    #include "esp_sm3.h"
+
+    uint8_t digest[ESP_SM3_DIGEST_LEN];
+
+    esp_err_t err = esp_sm3(message, message_len, digest, sizeof(digest));
+    if (err != ESP_OK) {
+        // 未写入摘要，请处理该错误。
+    }
+
+流式摘要
+--------
+
+当消息分多次到达时，使用上下文函数：
+
+.. code-block:: c
+
+    #include "esp_sm3.h"
+
+    uint8_t digest[ESP_SM3_DIGEST_LEN];
+    esp_sm3_ctx_handle_t ctx = NULL;
+
+    esp_err_t err = esp_sm3_create(&ctx);
+    if (err != ESP_OK) {
+        return err;
+    }
+
+    err = esp_sm3_update(ctx, part1, part1_len);
+    if (err == ESP_OK) {
+        err = esp_sm3_update(ctx, part2, part2_len);
+    }
+    if (err == ESP_OK) {
+        err = esp_sm3_finish(ctx, digest, sizeof(digest));
+    }
+
+    esp_sm3_delete(ctx);
+
+:cpp:func:`esp_sm3_create` 会分配上下文，并把句柄写入 ``ctx``。如果该函数返回 :c:macro:`ESP_ERR_NO_MEM` 或 :c:macro:`ESP_ERR_NOT_SUPPORTED`，则向 ``ctx`` 写入 NULL。上下文是不透明的，应用程序不得读写其内容。
+
+:cpp:func:`esp_sm3_delete` 会清除上下文中的消息字节和摘要状态，然后释放该上下文。调用之后句柄失效。如果应用程序不调用该函数，该上下文会一直占用内存。
+
+请在调用 :cpp:func:`esp_sm3_finish` 之后调用 :cpp:func:`esp_sm3_delete`。中止操作时同样需要调用。
+
+并发
+----
+
+:cpp:func:`esp_sm3_update` 和 :cpp:func:`esp_sm3_finish` 会占用 SHA 外设。它们仅在硬件处理消息分组期间持有该外设，并在返回前释放。:cpp:func:`esp_sm3_create` 和 :cpp:func:`esp_sm3_delete` 不会访问该外设。
+
+只有当新增字节凑满至少一个 64 字节分组时，:cpp:func:`esp_sm3_update` 才会占用该外设。字节不足时，该函数只把它们复制到上下文中并返回。:cpp:func:`esp_sm3_finish` 总会占用该外设，因为填充会凑满最后一个分组。
+
+因此，一个操作可以长时间保持打开状态，而不会给该外设的其他使用者带来开销。使用不同上下文的操作可以在不同任务中并行执行。
+
+不要在两个任务中同时使用同一个上下文。
+
+API 参考
+--------
+
+.. include-build-file:: inc/esp_sm3.inc