abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-09-22 21:34:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

Support HSS/XMSS/XMSSMT certificate, CSR, and CRL

Browse Source 
LMS and SPHINCS+ do not have official OID, so officially supported by X.509
This commit is contained in:
Zhi Guan
2026-01-18 21:13:58 +08:00
parent e8eb873c47
commit 05ba2f8e54
8 changed files with 263 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
tools/certgen.c
View File

@@ -19,13 +19,14 @@
#include <gmssl/hex.h>
#include <gmssl/x509.h>
#include <gmssl/x509_ext.h>
#include <gmssl/x509_alg.h>
static const char *options =
"[-C str] [-ST str] [-L str] [-O str] [-OU str] -CN str"
" -serial_len num"
" -days num"
" -key pem -pass pass"
" -key pem [-algor str] [-pass pass]"
" [-sm2_id str | -sm2_id_hex hex]"
" [-gen_authority_key_id]"
" [-gen_subject_key_id]"
@@ -45,6 +46,7 @@ static char *usage =
" -serial_len num Serial number length in bytes\n"
" -days num Validity peroid in days\n"
" -key file Private key file in PEM format\n"
" -algor str Public key algorithm\n"
" -pass pass Password for decrypting private key file\n"
" -sm2_id str Signer's ID in SM2 signature algorithm\n"
" -sm2_id_hex hex Signer's ID in hex format\n"
@@ -154,8 +156,9 @@ int certgen_main(int argc, char **argv)
// Private Key
FILE *keyfp = NULL;
char *pass = NULL;
SM2_KEY sm2_key;
X509_KEY x509_key;
int algor = OID_ec_public_key;
int sign_algor = OID_sm2sign_with_sm3;
char signer_id[SM2_MAX_ID_LENGTH + 1] = {0};
size_t signer_id_len = 0;
@@ -264,6 +267,13 @@ int certgen_main(int argc, char **argv)
fprintf(stderr, "%s: open '%s' failure : %s\n", prog, str, strerror(errno));
goto end;
}
} else if (!strcmp(*argv, "-algor")) {
if (--argc < 1) goto bad;
str = *(++argv);
if ((algor = x509_public_key_algor_from_name(str)) == OID_undef) {
fprintf(stderr, "%s: invalid algor '%s'\n", prog, str);
goto end;
}
} else if (!strcmp(*argv, "-pass")) {
if (--argc < 1) goto bad;
pass = *(++argv);
@@ -390,24 +400,25 @@ bad:
printf("usage: gmssl %s %s\n\n", prog, options);
goto end;
}
if (!pass) {
if (!pass && algor != OID_ec_public_key) {
fprintf(stderr, "%s: option `-pass` required\n", prog);
printf("usage: gmssl %s %s\n\n", prog, options);
goto end;
}
if (sm2_private_key_info_decrypt_from_pem(&sm2_key, pass, keyfp) != 1) {
if (x509_private_key_from_file(&x509_key, algor, pass, keyfp) != 1) {
fprintf(stderr, "%s: load private key failed\n", prog);
goto end;
}
if (x509_key_get_sign_algor(&x509_key, &sign_algor) != 1) {
fprintf(stderr, "%s: inner error\n", prog);
goto end;
}
if (!signer_id_len) {
strcpy(signer_id, SM2_DEFAULT_ID);
signer_id_len = strlen(SM2_DEFAULT_ID);
}
if (x509_key_set_sm2_key(&x509_key, &sm2_key) != 1) {
//
goto end;
}
// Serial
if (rand_bytes(serial, sizeof(serial)) != 1) {
@@ -508,7 +519,7 @@ bad:
if (x509_cert_sign_to_der(
X509_version_v3,
serial, serial_len,
OID_sm2sign_with_sm3,
sign_algor,
name, namelen,
not_before, not_after,
name, namelen,
@@ -530,7 +541,7 @@ bad:
if (x509_cert_sign_to_der(
X509_version_v3,
serial, serial_len,
OID_sm2sign_with_sm3,
sign_algor,
name, namelen,
not_before, not_after,
name, namelen,
@@ -550,7 +561,7 @@ bad:
ret = 0;
end:
gmssl_secure_clear(&sm2_key, sizeof(SM2_KEY));
x509_key_cleanup(&x509_key);
if (cert) free(cert);
if (keyfp) fclose(keyfp);
if (outfile && outfp) fclose(outfp);