diff --git a/sm4/cbc_amd64.go b/sm4/cbc_amd64.go
index eeeb2ad..b7c7cce 100644
--- a/sm4/cbc_amd64.go
+++ b/sm4/cbc_amd64.go
@@ -28,13 +28,13 @@ func (x *cbc) BlockSize() int { return BlockSize }
 
 func (x *cbc) CryptBlocks(dst, src []byte) {
 	if len(src)%BlockSize != 0 {
-		panic("crypto/cipher: input not full blocks")
+		panic("cipher: input not full blocks")
 	}
 	if len(dst) < len(src) {
-		panic("crypto/cipher: output smaller than input")
+		panic("cipher: output smaller than input")
 	}
 	if smcipher.InexactOverlap(dst[:len(src)], src) {
-		panic("crypto/cipher: invalid buffer overlap")
+		panic("cipher: invalid buffer overlap")
 	}
 	if len(src) == 0 {
 		return
diff --git a/sm4/ctr_amd64.go b/sm4/ctr_amd64.go
index 6a1f2c8..27582a2 100644
--- a/sm4/ctr_amd64.go
+++ b/sm4/ctr_amd64.go
@@ -78,10 +78,10 @@ func (x *ctr) refill() {
 
 func (x *ctr) XORKeyStream(dst, src []byte) {
 	if len(dst) < len(src) {
-		panic("crypto/cipher: output smaller than input")
+		panic("cipher: output smaller than input")
 	}
 	if smcipher.InexactOverlap(dst[:len(src)], src) {
-		panic("crypto/cipher: invalid buffer overlap")
+		panic("cipher: invalid buffer overlap")
 	}
 	for len(src) > 0 {
 		if x.outUsed >= len(x.out)-BlockSize {
diff --git a/sm4/gcm_amd64.go b/sm4/gcm_amd64.go
index 79e3c90..7ad1ea6 100644
--- a/sm4/gcm_amd64.go
+++ b/sm4/gcm_amd64.go
@@ -76,15 +76,15 @@ func (g *gcm) Overhead() int {
 
 func (g *gcm) Seal(dst, nonce, plaintext, data []byte) []byte {
 	if len(nonce) != g.nonceSize {
-		panic("crypto/cipher: incorrect nonce length given to GCM")
+		panic("cipher: incorrect nonce length given to GCM")
 	}
 	if uint64(len(plaintext)) > ((1<<32)-2)*uint64(g.cipher.BlockSize()) {
-		panic("crypto/cipher: message too large for GCM")
+		panic("cipher: message too large for GCM")
 	}
 
 	ret, out := smcipher.SliceForAppend(dst, len(plaintext)+g.tagSize)
 	if smcipher.InexactOverlap(out, plaintext) {
-		panic("crypto/cipher: invalid buffer overlap")
+		panic("cipher: invalid buffer overlap")
 	}
 
 	var counter, tagMask [gcmBlockSize]byte
@@ -106,12 +106,12 @@ var errOpen = errors.New("cipher: message authentication failed")
 
 func (g *gcm) Open(dst, nonce, ciphertext, data []byte) ([]byte, error) {
 	if len(nonce) != g.nonceSize {
-		panic("crypto/cipher: incorrect nonce length given to GCM")
+		panic("cipher: incorrect nonce length given to GCM")
 	}
 	// Sanity check to prevent the authentication from always succeeding if an implementation
 	// leaves tagSize uninitialized, for example.
 	if g.tagSize < gcmMinimumTagSize {
-		panic("crypto/cipher: incorrect GCM tag size")
+		panic("cipher: incorrect GCM tag size")
 	}
 
 	if len(ciphertext) < g.tagSize {
@@ -135,7 +135,7 @@ func (g *gcm) Open(dst, nonce, ciphertext, data []byte) ([]byte, error) {
 
 	ret, out := smcipher.SliceForAppend(dst, len(ciphertext))
 	if smcipher.InexactOverlap(out, ciphertext) {
-		panic("crypto/cipher: invalid buffer overlap")
+		panic("cipher: invalid buffer overlap")
 	}
 
 	if subtle.ConstantTimeCompare(expectedTag[:g.tagSize], tag) != 1 {
diff --git a/sm4/sm4_gcm.go b/sm4/sm4_gcm.go
index bf19f44..baebd81 100644
--- a/sm4/sm4_gcm.go
+++ b/sm4/sm4_gcm.go
@@ -57,10 +57,10 @@ func (g *gcmAsm) Overhead() int {
 // details.
 func (g *gcmAsm) Seal(dst, nonce, plaintext, data []byte) []byte {
 	if len(nonce) != g.nonceSize {
-		panic("crypto/cipher: incorrect nonce length given to GCM")
+		panic("cipher: incorrect nonce length given to GCM")
 	}
 	if uint64(len(plaintext)) > ((1<<32)-2)*BlockSize {
-		panic("crypto/cipher: message too large for GCM")
+		panic("cipher: message too large for GCM")
 	}
 
 	var counter, tagMask [gcmBlockSize]byte
@@ -84,7 +84,7 @@ func (g *gcmAsm) Seal(dst, nonce, plaintext, data []byte) []byte {
 
 	ret, out := smcipher.SliceForAppend(dst, len(plaintext)+g.tagSize)
 	if smcipher.InexactOverlap(out[:len(plaintext)], plaintext) {
-		panic("crypto/cipher: invalid buffer overlap")
+		panic("cipher: invalid buffer overlap")
 	}
 
 	if len(plaintext) > 0 {
@@ -101,12 +101,12 @@ func (g *gcmAsm) Seal(dst, nonce, plaintext, data []byte) []byte {
 // for details.
 func (g *gcmAsm) Open(dst, nonce, ciphertext, data []byte) ([]byte, error) {
 	if len(nonce) != g.nonceSize {
-		panic("crypto/cipher: incorrect nonce length given to GCM")
+		panic("cipher: incorrect nonce length given to GCM")
 	}
 	// Sanity check to prevent the authentication from always succeeding if an implementation
 	// leaves tagSize uninitialized, for example.
 	if g.tagSize < gcmMinimumTagSize {
-		panic("crypto/cipher: incorrect GCM tag size")
+		panic("cipher: incorrect GCM tag size")
 	}
 
 	if len(ciphertext) < g.tagSize {
@@ -140,7 +140,7 @@ func (g *gcmAsm) Open(dst, nonce, ciphertext, data []byte) ([]byte, error) {
 
 	ret, out := smcipher.SliceForAppend(dst, len(ciphertext))
 	if smcipher.InexactOverlap(out, ciphertext) {
-		panic("crypto/cipher: invalid buffer overlap")
+		panic("cipher: invalid buffer overlap")
 	}
 	if len(ciphertext) > 0 {
 		gcmSm4Data(&g.bytesProductTable, ciphertext, &expectedTag)