Merge p256/p384keygen to eckeygen

CMakeLists.txt

@@ -537,7 +537,6 @@ if (ENABLE_SECP256R1)
 	endif()
 	add_definitions(-DENABLE_SECP256R1)
 	list(APPEND src src/bn.c src/secp256r1.c)
-	list(APPEND tools tools/p256keygen.c)
 	list(APPEND tests bn secp256r1 secp256r1_key ecdsa)
 endif()
 
@@ -555,6 +554,10 @@ if (ENABLE_SECP384R1)
 	list(APPEND tests secp384r1 secp384r1_key secp384r1_ecdsa)
 endif()
 
+if (ENABLE_SECP256R1 OR ENABLE_SECP384R1)
+	list(APPEND tools tools/eckeygen.c)
+endif()
+
 if (ENABLE_LMS)
 	message(STATUS "ENABLE_LMS is ON")
 	add_definitions(-DENABLE_LMS)
@@ -1019,7 +1022,7 @@ endif()
 #
 set(CPACK_PACKAGE_NAME "GmSSL")
 set(CPACK_PACKAGE_VENDOR "GmSSL develop team")
-set(CPACK_PACKAGE_VERSION "3.3.0-dev.1182")
+set(CPACK_PACKAGE_VERSION "3.3.0-dev.1183")
 set(CPACK_PACKAGE_DESCRIPTION_FILE ${PROJECT_SOURCE_DIR}/README.md)
 set(CPACK_NSIS_MODIFY_PATH ON)
 include(CPack)

cmake/tool_cert.cmake

@@ -33,10 +33,10 @@ endfunction()
 
 function(gmssl_generate_p256_key key_file export_file)
 	if(export_file)
-		gmssl_run(bin/gmssl p256keygen -pass ${GMSSL_TEST_PASS} -out "${key_file}" -export "${export_file}")
+		gmssl_run(bin/gmssl eckeygen -curve secp256r1 -pass ${GMSSL_TEST_PASS} -out "${key_file}" -export "${export_file}")
 		gmssl_require_generated_file("${export_file}")
 	else()
-		gmssl_run(bin/gmssl p256keygen -pass ${GMSSL_TEST_PASS} -out "${key_file}")
+		gmssl_run(bin/gmssl eckeygen -curve secp256r1 -pass ${GMSSL_TEST_PASS} -out "${key_file}")
 	endif()
 	gmssl_require_generated_file("${key_file}")
 endfunction()

include/gmssl/passwd.h

@@ -16,8 +16,7 @@
 extern "C" {
 #endif
 
-
+int gmssl_read_password(const char *prompt, char *pass, size_t passlen, int do_confirm);
-int gmssl_read_password(const char *prompt, char *pass, size_t passlen);
 
 
 #ifdef __cplusplus

include/gmssl/version.h

@@ -18,7 +18,7 @@ extern "C" {
 
 
 #define GMSSL_VERSION_NUM	30300
-#define GMSSL_VERSION_STR	"GmSSL 3.3.0-dev.1182"
+#define GMSSL_VERSION_STR	"GmSSL 3.3.0-dev.1183"
 
 int gmssl_version_num(void);
 const char *gmssl_version_str(void);

src/passwd.c

@@ -8,6 +8,7 @@
  */
 
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
 #include <limits.h>
 #include <gmssl/mem.h>
@@ -63,9 +64,52 @@ static int gmssl_password_read_line(FILE *in, FILE *out, const char *prompt, cha
 	return 1;
 }
 
+static int gmssl_password_read(FILE *in, FILE *out, const char *prompt,
+	char *pass, size_t passlen, int do_confirm)
+{
+	char *confirm = NULL;
+	int ret = -1;
+
+	ret = gmssl_password_read_line(in, out, prompt, pass, passlen);
+	fputc('\n', out);
+	fflush(out);
+	if (ret != 1) {
+		goto end;
+	}
+
+	if (do_confirm) {
+		if (!(confirm = malloc(passlen))) {
+			error_print();
+			goto end;
+		}
+		ret = gmssl_password_read_line(in, out, "Confirm: ", confirm, passlen);
+		fputc('\n', out);
+		fflush(out);
+		if (ret != 1) {
+			goto end;
+		}
+		if (strcmp(pass, confirm) != 0) {
+			error_print();
+			goto end;
+		}
+	}
+
+	ret = 1;
+
+end:
+	if (ret != 1) {
+		gmssl_secure_clear(pass, passlen);
+	}
+	if (confirm) {
+		gmssl_secure_clear(confirm, passlen);
+		free(confirm);
+	}
+	return ret;
+}
+
 #if defined(_WIN32)
 
-int gmssl_read_password(const char *prompt, char *pass, size_t passlen)
+int gmssl_read_password(const char *prompt, char *pass, size_t passlen, int do_confirm)
 {
 	FILE *in = NULL;
 	FILE *out = NULL;
@@ -98,14 +142,12 @@ int gmssl_read_password(const char *prompt, char *pass, size_t passlen)
 		goto end;
 	}
 
-	ret = gmssl_password_read_line(in, out, prompt, pass, passlen);
+	ret = gmssl_password_read(in, out, prompt, pass, passlen, do_confirm);
 
 	if (!SetConsoleMode(in_handle, old_mode)) {
 		error_print();
 		ret = -1;
 	}
-	fputc('\n', out);
-	fflush(out);
 
 end:
 	if (in) fclose(in);
@@ -116,7 +158,7 @@ end:
 
 #else
 
-int gmssl_read_password(const char *prompt, char *pass, size_t passlen)
+int gmssl_read_password(const char *prompt, char *pass, size_t passlen, int do_confirm)
 {
 	FILE *tty = NULL;
 	int fd;
@@ -148,14 +190,12 @@ int gmssl_read_password(const char *prompt, char *pass, size_t passlen)
 		goto end;
 	}
 
-	ret = gmssl_password_read_line(tty, tty, prompt, pass, passlen);
+	ret = gmssl_password_read(tty, tty, prompt, pass, passlen, do_confirm);
 
 	if (tcsetattr(fd, TCSAFLUSH, &old_termios) < 0) {
 		error_print();
 		ret = -1;
 	}
-	fputc('\n', tty);
-	fflush(tty);
 
 end:
 	if (tty) fclose(tty);

tools/certgen.c

@@ -414,8 +414,8 @@ bad:
 		goto end;
 	}
 	if (!pass && algor != OID_ec_public_key) {
-		if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass,
+		if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-			passbuf, sizeof(passbuf)) != 1) {
+			passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 	}

tools/cmsdecrypt.c

@@ -112,8 +112,8 @@ bad:
 		fprintf(stderr, "%s: '-key' option required\n", prog);
 		goto end;
 	}
-	if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass,
+	if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 0) != 1) {
 		goto end;
 	}
 	if (!certfile) {

tools/cmssign.c

@@ -107,8 +107,8 @@ bad:
 		fprintf(stderr, "%s: '-key' option required\n", prog);
 		goto end;
 	}
-	if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass,
+	if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 0) != 1) {
 		goto end;
 	}
 	if (!certfile) {

tools/crlgen.c

@@ -259,8 +259,8 @@ bad:
 	}
 
 	if (!pass && x509_pub.algor == OID_ec_public_key) {
-		if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass,
+		if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-			passbuf, sizeof(passbuf)) != 1) {
+			passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 	}

tools/eckeygen.c

@@ -17,26 +17,50 @@
 #include "passwd.h"
 
 
-static const char *usage = "[-pass str] [-out pem] [-pubout pem]\n";
+static const char *usage = "-curve str [-pass str] [-out pem] [-pubout pem]\n";
 
 static const char *options =
 "Options\n"
 "\n"
+"    -curve str                 EC curve name, supported curves: secp256r1, prime256v1, secp384r1\n"
+"                               SM2 is not supported by this command, use `sm2keygen` instead\n"
 "    -pass pass                  Password to encrypt the private key, prompt if not given\n"
 "    -out pem                    Output password-encrypted PKCS #8 private key in PEM format\n"
 "    -pubout pem                 Output public key in PEM format\n"
-"    -export pem                 Output non-encrypted PKCS#8 private key in PEM format\n"
+"    -export pem                 Output non-encrypted EC private key in PEM format\n"
 "\n"
 "Examples\n"
 "\n"
-"    gmssl p256keygen -pass P@ssw0rd -out p256.pem\n"
+"    gmssl eckeygen -curve secp256r1 -pass P@ssw0rd -out p256.pem\n"
-"    gmssl p256keygen -pass P@ssw0rd -out p256.pem -pubout p256pub.pem\n"
+"    gmssl eckeygen -curve secp384r1 -pass P@ssw0rd -out p384.pem -pubout p384pub.pem\n"
 "\n";
 
-int p256keygen_main(int argc, char **argv)
+static int eckeygen_curve_from_name(const char *name)
+{
+	if (!name) {
+		return OID_undef;
+	}
+	if (!strcmp(name, "sm2") || !strcmp(name, "sm2p256v1")) {
+		return OID_sm2;
+	}
+#ifdef ENABLE_SECP256R1
+	if (!strcmp(name, "secp256r1") || !strcmp(name, "prime256v1")) {
+		return OID_secp256r1;
+	}
+#endif
+#ifdef ENABLE_SECP384R1
+	if (!strcmp(name, "secp384r1")) {
+		return OID_secp384r1;
+	}
+#endif
+	return OID_undef;
+}
+
+int eckeygen_main(int argc, char **argv)
 {
 	int ret = 1;
 	char *prog = argv[0];
+	char *curve_name = NULL;
 	char *pass = NULL;
 	char passbuf[GMSSL_PASSWORD_MAX_SIZE] = {0};
 	char *outfile = NULL;
@@ -45,8 +69,8 @@ int p256keygen_main(int argc, char **argv)
 	FILE *outfp = stdout;
 	FILE *puboutfp = stdout;
 	FILE *exportfp = NULL;
-	int curve_oid = OID_secp256r1;
+	int curve_oid = OID_undef;
-	X509_KEY key;
+	X509_KEY key = {0};
 
 	argc--;
 	argv++;
@@ -62,6 +86,9 @@ int p256keygen_main(int argc, char **argv)
 			printf("%s\n", options);
 			ret = 0;
 			goto end;
+		} else if (!strcmp(*argv, "-curve")) {
+			if (--argc < 1) goto bad;
+			curve_name = *(++argv);
 		} else if (!strcmp(*argv, "-pass")) {
 			if (--argc < 1) goto bad;
 			pass = *(++argv);
@@ -98,8 +125,22 @@ bad:
 		argv++;
 	}
 
-	if (gmssl_tool_get_password(prog, "Password to encrypt private key", outfile, &pass,
+	if (!curve_name) {
-		passbuf, sizeof(passbuf)) != 1) {
+		fprintf(stderr, "gmssl %s: option '-curve' required\n", prog);
+		goto end;
+	}
+	curve_oid = eckeygen_curve_from_name(curve_name);
+	if (curve_oid == OID_sm2) {
+		fprintf(stderr, "gmssl %s: SM2 curve is not supported, use `sm2keygen` instead\n", prog);
+		goto end;
+	}
+	if (curve_oid == OID_undef) {
+		fprintf(stderr, "gmssl %s: unsupported curve '%s'\n", prog, curve_name);
+		goto end;
+	}
+
+	if (gmssl_tool_get_password(prog, "pass", outfile, &pass,
+		passbuf, sizeof(passbuf), 1) != 1) {
 		goto end;
 	}
 
@@ -116,7 +157,22 @@ bad:
 		goto end;
 	}
 	if (exportfp) {
-		if (secp256r1_private_key_to_pem(&key.u.secp256r1_key, exportfp) != 1) {
+		switch (curve_oid) {
+#ifdef ENABLE_SECP256R1
+		case OID_secp256r1:
+			ret = secp256r1_private_key_to_pem(&key.u.secp256r1_key, exportfp);
+			break;
+#endif
+#ifdef ENABLE_SECP384R1
+		case OID_secp384r1:
+			ret = secp384r1_private_key_to_pem(&key.u.secp384r1_key, exportfp);
+			break;
+#endif
+		default:
+			ret = -1;
+			break;
+		}
+		if (ret != 1) {
 			fprintf(stderr, "gmssl %s: inner failure\n", prog);
 			goto end;
 		}
@@ -129,5 +185,6 @@ end:
 	gmssl_secure_clear(passbuf, sizeof(passbuf));
 	if (outfile && outfp) fclose(outfp);
 	if (puboutfile && puboutfp) fclose(puboutfp);
+	if (exportfile && exportfp) fclose(exportfp);
 	return ret;
 }

tools/gmssl.c

@@ -101,8 +101,8 @@ extern int sctverify_main(int argc, char **argv);
 extern int quic_client_main(int argc, char **argv);
 extern int quic_server_main(int argc, char **argv);
 #endif
-#ifdef ENABLE_SECP256R1
+#if defined(ENABLE_SECP256R1) || defined(ENABLE_SECP384R1)
-extern int p256keygen_main(int argc, char **argv);
+extern int eckeygen_main(int argc, char **argv);
 #endif
 #ifdef ENABLE_LMS
 extern int lmskeygen_main(int argc, char **argv);
@@ -225,8 +225,8 @@ static const char *options =
 	"  cmsdecrypt        Decrypt CMS EnvelopedData\n"
 	"  cmsparse          Parse CMS (cryptographic message syntax) file\n"
 #endif
-#ifdef ENABLE_SECP256R1
+#if defined(ENABLE_SECP256R1) || defined(ENABLE_SECP384R1)
-	"  p256keygen        Generate P-256 (secp256r1, prime256v1) keypair\n"
+	"  eckeygen          Generate EC keypair on a named curve\n"
 #endif
 #ifdef ENABLE_LMS
 	"  lmskeygen         Generate LMS-SM3 (Leighton-Micali Signature) keypair\n"
@@ -450,9 +450,9 @@ int main(int argc, char **argv)
 		} else if (!strcmp(*argv, "quic_server")) {
 			return quic_server_main(argc, argv);
 #endif
-#ifdef ENABLE_SECP256R1
+#if defined(ENABLE_SECP256R1) || defined(ENABLE_SECP384R1)
-		} else if (!strcmp(*argv, "p256keygen")) {
+		} else if (!strcmp(*argv, "eckeygen")) {
-			return p256keygen_main(argc, argv);
+			return eckeygen_main(argc, argv);
 #endif
 #ifdef ENABLE_LMS
 		} else if (!strcmp(*argv, "lmskeygen")) {

tools/ocspsign.c

@@ -406,8 +406,8 @@ bad:
 		goto end;
 	}
 	if (!pass && signer_pub.algor == OID_ec_public_key) {
-		if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass,
+		if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-			passbuf, sizeof(passbuf)) != 1) {
+			passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 	}

tools/passwd.c

@@ -13,16 +13,16 @@
 
 
 int gmssl_tool_read_password(const char *prog, const char *label,
-	const char *file, char *pass, size_t passlen)
+	const char *file, char *pass, size_t passlen, int do_confirm)
 {
 	char prompt[512];
 	int len;
 
 	if (!prog) prog = "gmssl";
-	if (!label) label = "Password";
+	if (!label) label = "pass";
 
 	if (file && file[0]) {
-		len = snprintf(prompt, sizeof(prompt), "gmssl %s: %s '%s': ", prog, label, file);
+		len = snprintf(prompt, sizeof(prompt), "gmssl %s: %s %s: ", prog, label, file);
 	} else {
 		len = snprintf(prompt, sizeof(prompt), "gmssl %s: %s: ", prog, label);
 	}
@@ -30,11 +30,11 @@ int gmssl_tool_read_password(const char *prog, const char *label,
 		return -1;
 	}
 
-	return gmssl_read_password(prompt, pass, passlen);
+	return gmssl_read_password(prompt, pass, passlen, do_confirm);
 }
 
 int gmssl_tool_get_password(const char *prog, const char *label,
-	const char *file, char **pass, char *passbuf, size_t passlen)
+	const char *file, char **pass, char *passbuf, size_t passlen, int do_confirm)
 {
 	if (!pass || !passbuf) {
 		return -1;
@@ -42,7 +42,7 @@ int gmssl_tool_get_password(const char *prog, const char *label,
 	if (*pass) {
 		return 1;
 	}
-	if (gmssl_tool_read_password(prog, label, file, passbuf, passlen) != 1) {
+	if (gmssl_tool_read_password(prog, label, file, passbuf, passlen, do_confirm) != 1) {
 		return -1;
 	}
 	*pass = passbuf;

tools/passwd.h

@@ -20,9 +20,9 @@ extern "C" {
 #define GMSSL_PASSWORD_MAX_SIZE 256
 
 int gmssl_tool_read_password(const char *prog, const char *label,
-	const char *file, char *pass, size_t passlen);
+	const char *file, char *pass, size_t passlen, int do_confirm);
 int gmssl_tool_get_password(const char *prog, const char *label,
-	const char *file, char **pass, char *passbuf, size_t passlen);
+	const char *file, char **pass, char *passbuf, size_t passlen, int do_confirm);
 
 
 #ifdef __cplusplus

tools/quic_server.c

@@ -773,8 +773,8 @@ bad:
 		fprintf(stderr, "%s: -cert and -key required\n", prog);
 		return 1;
 	}
-	if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass,
+	if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 0) != 1) {
 		return 1;
 	}
 

tools/reqgen.c

@@ -64,7 +64,7 @@ static char *usage =
 "    gmssl sm2keygen -pass P@ssw0rd -out sm2key.pem\n"
 "    gmssl reqgen -CN www.gmssl.org -key sm2key.pem -pass P@ssw0rd -out sm2req.pem\n"
 "\n"
-"    gmssl p256keygen -pass P@ssw0rd -out p256key.pem\n"
+"    gmssl eckeygen -curve secp256r1 -pass P@ssw0rd -out p256key.pem\n"
 "    gmssl reqgen -CN www.gmssl.org -key p256key.pem -pass P@ssw0rd -out p256req.pem\n"
 "\n";
 
@@ -217,8 +217,8 @@ bad:
 	}
 
 	if (!pass && algor == OID_ec_public_key) {
-		if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass,
+		if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-			passbuf, sizeof(passbuf)) != 1) {
+			passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 	}

tools/reqsign.c

@@ -473,8 +473,8 @@ bad:
 		goto end;
 	}
 	if (!pass && issuer_public_key.algor == OID_ec_public_key) {
-		if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass,
+		if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-			passbuf, sizeof(passbuf)) != 1) {
+			passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 	}

tools/sdfdecrypt.c

@@ -141,8 +141,8 @@ bad:
 		fprintf(stderr, "gmssl %s: '-key' option required\n", prog);
 		goto end;
 	}
-	if (gmssl_tool_get_password(prog, "Password to access SDF private key", NULL, &pass,
+	if (gmssl_tool_get_password(prog, "pass", NULL, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 0) != 1) {
 		goto end;
 	}
 

tools/sdfsign.c

@@ -127,8 +127,8 @@ bad:
 		fprintf(stderr, "gmssl %s: '-key' option required\n", prog);
 		goto end;
 	}
-	if (gmssl_tool_get_password(prog, "Password to access SDF private key", NULL, &pass,
+	if (gmssl_tool_get_password(prog, "pass", NULL, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 0) != 1) {
 		goto end;
 	}
 

tools/sdftest.c

@@ -2204,8 +2204,8 @@ bad:
 		fprintf(stderr, "gmssl %s: option `-lib` missing\n", prog);
 		goto end;
 	}
-	if (gmssl_tool_get_password(prog, "Password to access SDF private key", NULL, &pass,
+	if (gmssl_tool_get_password(prog, "pass", NULL, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 0) != 1) {
 		goto end;
 	}
 

tools/sdfutil.c

@@ -145,8 +145,8 @@ bad:
 			fprintf(stderr, "%s: invalid key index\n", prog);
 			goto end;
 		}
-		if (gmssl_tool_get_password(prog, "Password to access SDF private key", NULL, &pass,
+		if (gmssl_tool_get_password(prog, "pass", NULL, &pass,
-			passbuf, sizeof(passbuf)) != 1) {
+			passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 		if (sdf_load_sign_key(&dev, &key, keyindex, pass) != 1) {
@@ -171,8 +171,8 @@ bad:
 			fprintf(stderr, "%s: invalid key index\n", prog);
 			goto end;
 		}
-		if (gmssl_tool_get_password(prog, "Password to access SDF private key", NULL, &pass,
+		if (gmssl_tool_get_password(prog, "pass", NULL, &pass,
-			passbuf, sizeof(passbuf)) != 1) {
+			passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 		if (sdf_load_sign_key(&dev, &key, keyindex, pass) != 1) {

tools/skfutil.c

@@ -197,8 +197,8 @@ bad:
 		fprintf(stderr, "%s: option '-container' required\n", prog);
 		goto end;
 	}
-	if (gmssl_tool_get_password(prog, "Password to access SKF container", container_name, &pass,
+	if (gmssl_tool_get_password(prog, "pass", container_name, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 0) != 1) {
 		goto end;
 	}
 

tools/sm2decrypt.c

@@ -107,8 +107,8 @@ bad:
 		fprintf(stderr, "gmssl %s: '-key' option required\n", prog);
 		goto end;
 	}
-	if (gmssl_tool_get_password(prog, "Password to open private key", keyfile, &pass,
+	if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 0) != 1) {
 		goto end;
 	}
 

tools/sm2exch.c

@@ -906,20 +906,18 @@ bad:
 	}
 
 	if (!strcmp(stage, "init")) {
-		if (exch_keyoutfile && gmssl_tool_get_password(prog,
+		if (exch_keyoutfile && gmssl_tool_get_password(prog, "exchpass",
-			"Password to encrypt exchange private key", exch_keyoutfile,
+			exch_keyoutfile, &exch_pass, exch_passbuf, sizeof(exch_passbuf), 1) != 1) {
-			&exch_pass, exch_passbuf, sizeof(exch_passbuf)) != 1) {
 			goto end;
 		}
 		ret = sm2exch_stage_init(exch_keyoutfile, exch_pass, outfile, format, prog);
 	} else if (!strcmp(stage, "respond")) {
-		if (keyfile && gmssl_tool_get_password(prog, "Password to open private key",
+		if (keyfile && gmssl_tool_get_password(prog, "pass",
-			keyfile, &pass, passbuf, sizeof(passbuf)) != 1) {
+			keyfile, &pass, passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
-		if (exch_keyoutfile && gmssl_tool_get_password(prog,
+		if (exch_keyoutfile && gmssl_tool_get_password(prog, "exchpass",
-			"Password to encrypt exchange private key", exch_keyoutfile,
+			exch_keyoutfile, &exch_pass, exch_passbuf, sizeof(exch_passbuf), 1) != 1) {
-			&exch_pass, exch_passbuf, sizeof(exch_passbuf)) != 1) {
 			goto end;
 		}
 		ret = sm2exch_stage_respond(keyfile, pass, pubkeyfile, certfile,
@@ -927,13 +925,12 @@ bad:
 			infile, exch_keyoutfile, exch_pass, secret_stateoutfile,
 			outfile, keylen, format, prog);
 	} else if (!strcmp(stage, "confirm")) {
-		if (keyfile && gmssl_tool_get_password(prog, "Password to open private key",
+		if (keyfile && gmssl_tool_get_password(prog, "pass",
-			keyfile, &pass, passbuf, sizeof(passbuf)) != 1) {
+			keyfile, &pass, passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
-		if (exch_keyfile && gmssl_tool_get_password(prog,
+		if (exch_keyfile && gmssl_tool_get_password(prog, "exchpass",
-			"Password to open exchange private key", exch_keyfile,
+			exch_keyfile, &exch_pass, exch_passbuf, sizeof(exch_passbuf), 0) != 1) {
-			&exch_pass, exch_passbuf, sizeof(exch_passbuf)) != 1) {
 			goto end;
 		}
 		ret = sm2exch_stage_confirm(keyfile, pass, pubkeyfile, certfile,
@@ -941,13 +938,12 @@ bad:
 			exch_keyfile, exch_pass, infile, secret_stateoutfile,
 			keyoutfile, outfile, keylen, format, prog);
 	} else if (!strcmp(stage, "finish")) {
-		if (keyfile && gmssl_tool_get_password(prog, "Password to open private key",
+		if (keyfile && gmssl_tool_get_password(prog, "pass",
-			keyfile, &pass, passbuf, sizeof(passbuf)) != 1) {
+			keyfile, &pass, passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
-		if (exch_keyfile && gmssl_tool_get_password(prog,
+		if (exch_keyfile && gmssl_tool_get_password(prog, "exchpass",
-			"Password to open exchange private key", exch_keyfile,
+			exch_keyfile, &exch_pass, exch_passbuf, sizeof(exch_passbuf), 0) != 1) {
-			&exch_pass, exch_passbuf, sizeof(exch_passbuf)) != 1) {
 			goto end;
 		}
 		ret = sm2exch_stage_finish(keyfile, pass, pubkeyfile, certfile,

tools/sm2keygen.c

@@ -87,8 +87,8 @@ bad:
 		argv++;
 	}
 
-	if (gmssl_tool_get_password(prog, "Password to encrypt private key", outfile, &pass,
+	if (gmssl_tool_get_password(prog, "pass", outfile, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 1) != 1) {
 		goto end;
 	}
 

tools/sm2sign.c

@@ -114,8 +114,8 @@ bad:
 		fprintf(stderr, "gmssl %s: '-key' option required\n", prog);
 		goto end;
 	}
-	if (gmssl_tool_get_password(prog, "Password to open private key", keyfile, &pass,
+	if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 0) != 1) {
 		goto end;
 	}
 	if (sm2_private_key_info_decrypt_from_pem(&key, pass, keyfp) != 1) {

tools/sm3_pbkdf2.c

@@ -124,8 +124,8 @@ bad:
 		argv++;
 	}
 
-	if (gmssl_tool_get_password(prog, "Password", NULL, &pass,
+	if (gmssl_tool_get_password(prog, "pass", NULL, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 1) != 1) {
 		goto end;
 	}
 	if (!salthex) {

tools/sm9decrypt.c

@@ -109,8 +109,8 @@ bad:
 		error_print();
 		goto end;
 	}
-	if (gmssl_tool_get_password(prog, "Password to open private key", keyfile, &pass,
+	if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 0) != 1) {
 		goto end;
 	}
 

tools/sm9exch.c

@@ -752,24 +752,24 @@ bad:
 		ret = sm9exch_stage_init(mpkfile, peer_id, peer_id_len,
 			exch_keyoutfile, outfile, format, prog);
 	} else if (!strcmp(stage, "respond")) {
-		if (keyfile && gmssl_tool_get_password(prog, "Password to open private key",
+		if (keyfile && gmssl_tool_get_password(prog, "pass",
-			keyfile, &pass, passbuf, sizeof(passbuf)) != 1) {
+			keyfile, &pass, passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 		ret = sm9exch_stage_respond(mpkfile, keyfile, pass, id, id_len,
 			peer_id, peer_id_len, infile, exch_keyoutfile,
 			outfile, keylen, format, prog);
 	} else if (!strcmp(stage, "confirm")) {
-		if (keyfile && gmssl_tool_get_password(prog, "Password to open private key",
+		if (keyfile && gmssl_tool_get_password(prog, "pass",
-			keyfile, &pass, passbuf, sizeof(passbuf)) != 1) {
+			keyfile, &pass, passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 		ret = sm9exch_stage_confirm(mpkfile, keyfile, pass, id, id_len,
 			peer_id, peer_id_len, exch_keyfile, infile,
 			keyoutfile, outfile, keylen, format, prog);
 	} else if (!strcmp(stage, "finish")) {
-		if (keyfile && gmssl_tool_get_password(prog, "Password to open private key",
+		if (keyfile && gmssl_tool_get_password(prog, "pass",
-			keyfile, &pass, passbuf, sizeof(passbuf)) != 1) {
+			keyfile, &pass, passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 		ret = sm9exch_stage_finish(mpkfile, keyfile, pass, id, id_len,

tools/sm9keygen.c

@@ -119,10 +119,10 @@ bad:
 		fprintf(stderr, "%s: option '-id' is required\n", prog);
 		goto end;
 	}
-	if (gmssl_tool_get_password(prog, "Password to decrypt master private key", infile,
+	if (gmssl_tool_get_password(prog, "inpass", infile,
-		&inpass, inpassbuf, sizeof(inpassbuf)) != 1
+		&inpass, inpassbuf, sizeof(inpassbuf), 0) != 1
-		|| gmssl_tool_get_password(prog, "Password to encrypt user private key", outfile,
+		|| gmssl_tool_get_password(prog, "outpass", outfile,
-		&outpass, outpassbuf, sizeof(outpassbuf)) != 1) {
+		&outpass, outpassbuf, sizeof(outpassbuf), 1) != 1) {
 		goto end;
 	}
 

tools/sm9setup.c

@@ -103,8 +103,8 @@ bad:
 		error_print();
 		goto end;
 	}
-	if (gmssl_tool_get_password(prog, "Password to encrypt master private key", outfile, &pass,
+	if (gmssl_tool_get_password(prog, "pass", outfile, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 1) != 1) {
 		goto end;
 	}
 
@@ -164,4 +164,3 @@ end:
 
 
 
-

tools/sm9sign.c

@@ -106,8 +106,8 @@ bad:
 		error_print();
 		goto end;
 	}
-	if (gmssl_tool_get_password(prog, "Password to open private key", keyfile, &pass,
+	if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-		passbuf, sizeof(passbuf)) != 1) {
+		passbuf, sizeof(passbuf), 0) != 1) {
 		goto end;
 	}
 

tools/tlcp_client.c

@@ -475,8 +475,8 @@ bad:
 			fprintf(stderr, "%s: option '-key' missing\n", prog);
 			goto end;
 		}
-		if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass,
+		if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-			passbuf, sizeof(passbuf)) != 1) {
+			passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 		if (has_ecdhe_cipher_suite) {

tools/tlcp_server.c

@@ -274,8 +274,8 @@ bad:
 		return 1;
 	}
 	for (i = signpasses_cnt; i < signkeyfiles_cnt; i++) {
-		if (gmssl_tool_read_password(prog, "Password to decrypt private key",
+		if (gmssl_tool_read_password(prog, "pass",
-			signkeyfiles[i], passbufs[i], sizeof(passbufs[i])) != 1) {
+			signkeyfiles[i], passbufs[i], sizeof(passbufs[i]), 0) != 1) {
 			goto end;
 		}
 		signpasses[i] = passbufs[i];

tools/tls12_client.c

@@ -439,8 +439,8 @@ bad:
 			fprintf(stderr, "%s: option '-key' missing\n", prog);
 			goto end;
 		}
-		if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass,
+		if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-			passbuf, sizeof(passbuf)) != 1) {
+			passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 		if (tls_ctx_set_certificate_and_key(&ctx, certfile, keyfile, pass) != 1) {

tools/tls12_server.c

@@ -301,8 +301,8 @@ bad:
 		return -1;
 	}
 	for (i = passes_cnt; i < keyfiles_cnt; i++) {
-		if (gmssl_tool_read_password(prog, "Password to decrypt private key",
+		if (gmssl_tool_read_password(prog, "pass",
-			keyfiles[i], passbufs[i], sizeof(passbufs[i])) != 1) {
+			keyfiles[i], passbufs[i], sizeof(passbufs[i]), 0) != 1) {
 			goto end;
 		}
 		passes[i] = passbufs[i];

tools/tls13_client.c

@@ -571,8 +571,8 @@ bad:
 			fprintf(stderr, "%s: option -key is required\n", prog);
 			goto end;
 		}
-		if (gmssl_tool_get_password(prog, "Password to decrypt private key", keyfile, &pass,
+		if (gmssl_tool_get_password(prog, "pass", keyfile, &pass,
-			passbuf, sizeof(passbuf)) != 1) {
+			passbuf, sizeof(passbuf), 0) != 1) {
 			goto end;
 		}
 		if (tls_ctx_add_certificate_chain_and_key(&ctx, certfile, keyfile, pass) != 1) {

tools/tls13_server.c

@@ -361,8 +361,8 @@ bad:
 		return -1;
 	}
 	for (i = passes_cnt; i < keyfiles_cnt; i++) {
-		if (gmssl_tool_read_password(prog, "Password to decrypt private key",
+		if (gmssl_tool_read_password(prog, "pass",
-			keyfiles[i], passbufs[i], sizeof(passbufs[i])) != 1) {
+			keyfiles[i], passbufs[i], sizeof(passbufs[i]), 0) != 1) {
 			goto end;
 		}
 		passes[i] = passbufs[i];