abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-05-07 08:56:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
Gorachya
2024-03-13 15:43:27 +08:00
committed by GitHub
parent 0d5eb5f21e
commit 6150965c16
4 changed files with 4302 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files

248
src/sm9_alg.c
View File

@@ -166,9 +166,6 @@ int sm9_bn_cmp(const sm9_bn_t a, const sm9_bn_t b)
return 0;
}
void sm9_bn_copy(sm9_bn_t r, const sm9_bn_t a)
{
memcpy(r, a, sizeof(sm9_bn_t));
@@ -328,6 +325,87 @@ void sm9_barrett_bn_sub(sm9_barrett_bn_t ret, const sm9_barrett_bn_t a, const sm
}
}
// w = -p^-1 mod 2^256 = 0xafd2bac5558a13b3966a4b291522b137181ae39613c8dbaf892bc42c2f2ee42b
// 2^512 mod p = 0x2ea795a656f62fbde479b522d6706e7b88f8105fae1a5d3f27dea312b417e2d2
const sm9_bn_t SM9_W = {0x2f2ee42b, 0x892bc42c, 0x13c8dbaf, 0x181ae396, 0x1522b137, 0x966a4b29, 0x558a13b3, 0xafd2bac5};
const sm9_bn_t SM9_2e512modp = {0xb417e2d2, 0x27dea312, 0xae1a5d3f, 0x88f8105f, 0xd6706e7b, 0xe479b522, 0x56f62fbd, 0x2ea795a6};
void sm9_fp_to_mont(sm9_fp_t r, const sm9_fp_t a)
{
sm9_fp_mul_mont(r, a, SM9_2e512modp);
}
void sm9_fp_from_mont(sm9_fp_t r, const sm9_fp_t a)
{
sm9_fp_mul_mont(r, a, SM9_ONE);
}
void sm9_bn_mul(sm9_bn_t r1, sm9_bn_t r2, const sm9_bn_t a, const sm9_bn_t b)
{
int i, j;
uint64_t s[16];
uint64_t w;
for (i = 0; i < 16; i++) {
s[i] = 0;
}
for (i = 0; i < 8; i++) {
w = 0;
for (j = 0; j < 8; j++) {
w += s[i + j] + a[i] * b[j];
s[i + j] = w & 0xffffffff;
w >>= 32;
}
s[i + 8] = w;
}
for (i = 0; i < 8; i++) {
r1[i] = s[i]; // low 256
r2[i] = s[i + 8]; // high 256
}
}
void sm9_bn_add_512(sm9_bn_t r1, sm9_bn_t r2,
const sm9_bn_t a1, const sm9_bn_t a2,
const sm9_bn_t b1, const sm9_bn_t b2)
{
int i, over;
r1[0] = a1[0] + b1[0];
for (i = 1; i < 8; i++) {
r1[i] = a1[i] + b1[i] + (r1[i-1] >> 32);
}
r2[0] = a2[0] + b2[0] + (r1[7] >> 32);
for (i = 1; i < 8; i++) {
r2[i] = a2[i] + b2[i] + (r2[i-1] >> 32);
}
for (i = 0; i < 7; i++) {
r1[i] &= 0xffffffff;
r2[i] &= 0xffffffff;
}
r1[7] &= 0xffffffff;
}
void sm9_fp_mul_mont(sm9_fp_t r, const sm9_fp_t a, const sm9_fp_t b)
{
sm9_bn_t z1, z2, u1, u2;
int i, j;
// z = x * y mod 2^256
sm9_bn_mul(z1, z2, a, b);
// u = z * w mod 2^256
sm9_bn_mul(u1, u2, z1, SM9_W);
// s = (x * y + u * p)
sm9_bn_mul(u1, u2, u1, SM9_P);
sm9_bn_add_512(z1, r, z1, z2, u1, u2);
if (sm9_bn_cmp(r, SM9_P) >= 0) {
sm9_bn_sub(r, r, SM9_P);
}
}
void sm9_fp_mul(sm9_fp_t r, const sm9_fp_t a, const sm9_fp_t b)
{
uint64_t s[18];
@@ -583,21 +661,36 @@ void sm9_fp2_neg(sm9_fp2_t r, const sm9_fp2_t a)
sm9_fp_neg(r[1], a[1]);
}
void sm9_fp2_a_mul_u(sm9_fp2_t r, sm9_fp2_t a) {
sm9_fp_t r0;
sm9_fp_dbl(r0, a[1]);
sm9_fp_neg(r0, r0);
sm9_fp_copy(r[1], a[0]);
sm9_fp_copy(r[0], r0);
}
void sm9_fp2_mul(sm9_fp2_t r, const sm9_fp2_t a, const sm9_fp2_t b)
{
sm9_fp_t r0, r1, t;
sm9_fp_add(r0, a[0], a[1]);
sm9_fp_add(t, b[0], b[1]);
sm9_fp_mul(r1, t, r0);
// r0 = a0 * b0 - 2 * a1 * b1
sm9_fp_mul(r0, a[0], b[0]);
sm9_fp_mul(t, a[1], b[1]);
// r1 = (a0 + a1) * (b0 + b1) - a0 * b0 - a1 * b1
sm9_fp_sub(r1, r1, r0);
sm9_fp_sub(r1, r1, t);
// r0
sm9_fp_dbl(t, t);
sm9_fp_sub(r0, r0, t);
// r1 = a0 * b1 + a1 * b0
sm9_fp_mul(r1, a[0], b[1]);
sm9_fp_mul(t, a[1], b[0]);
sm9_fp_add(r1, r1, t);
sm9_fp_copy(r[0], r0);
sm9_fp_copy(r[1], r1);
}
@@ -631,16 +724,17 @@ void sm9_fp2_mul_fp(sm9_fp2_t r, const sm9_fp2_t a, const sm9_fp_t k)
void sm9_fp2_sqr(sm9_fp2_t r, const sm9_fp2_t a)
{
sm9_fp_t r0, r1, t;
// a0^2 - 2 * a1^2
sm9_fp_sqr(r0, a[0]);
sm9_fp_sqr(t, a[1]);
sm9_fp_dbl(t, t);
sm9_fp_sub(r0, r0, t);
sm9_fp_t r0, r1, c0, c1;
// r0 = (a0 + a1) * (a0 - 2a1) + a0 * a1
sm9_fp_mul(r1, a[0], a[1]);
sm9_fp_add(c0, a[0], a[1]);
sm9_fp_dbl(c1, a[1]);
sm9_fp_sub(c1, a[0], c1);
sm9_fp_mul(r0, c0, c1);
sm9_fp_add(r0, r0, r1);
// r1 = 2 * a0 * a1
sm9_fp_mul(r1, a[0], a[1]);
sm9_fp_dbl(r1, r1);
sm9_bn_copy(r[0], r0);
@@ -835,18 +929,38 @@ void sm9_fp4_neg(sm9_fp4_t r, const sm9_fp4_t a)
sm9_fp2_neg(r[1], a[1]);
}
void sm9_fp4_div2(sm9_fp4_t r, const sm9_fp4_t a)
{
sm9_fp2_div2(r[0], a[0]);
sm9_fp2_div2(r[1], a[1]);
}
void sm9_fp4_a_mul_v(sm9_fp4_t r, sm9_fp4_t a) {
sm9_fp2_t r0;
sm9_fp2_a_mul_u(r0, a[1]);
sm9_fp2_copy(r[1], a[0]);
sm9_fp2_copy(r[0], r0);
}
void sm9_fp4_mul(sm9_fp4_t r, const sm9_fp4_t a, const sm9_fp4_t b)
{
sm9_fp2_t r0, r1, t;
sm9_fp2_add(r0, a[0], a[1]);
sm9_fp2_add(t, b[0], b[1]);
sm9_fp2_mul(r1, t, r0);
sm9_fp2_mul(r0, a[0], b[0]);
sm9_fp2_mul_u(t, a[1], b[1]);
sm9_fp2_mul(t, a[1], b[1]);
sm9_fp2_sub(r1, r1, r0);
sm9_fp2_sub(r1, r1, t);
sm9_fp2_a_mul_u(t, t);
sm9_fp2_add(r0, r0, t);
sm9_fp2_mul(r1, a[0], b[1]);
sm9_fp2_mul(t, a[1], b[0]);
sm9_fp2_add(r1, r1, t);
sm9_fp2_copy(r[0], r0);
sm9_fp2_copy(r[1], r1);
}
@@ -883,12 +997,18 @@ void sm9_fp4_sqr(sm9_fp4_t r, const sm9_fp4_t a)
{
sm9_fp2_t r0, r1, t;
sm9_fp2_add(r1, a[0], a[1]);
sm9_fp2_sqr(r1, r1);
sm9_fp2_sqr(r0, a[0]);
sm9_fp2_sqr_u(t, a[1]);
sm9_fp2_sqr(t, a[1]);
sm9_fp2_sub(r1, r1, r0);
sm9_fp2_sub(r1, r1, t);
sm9_fp2_a_mul_u(t, t);
sm9_fp2_add(r0, r0, t);
sm9_fp2_mul(r1, a[0], a[1]);
sm9_fp2_dbl(r1, r1);
sm9_fp2_copy(r[0], r0);
sm9_fp2_copy(r[1], r1);
}
@@ -1101,25 +1221,34 @@ void sm9_fp12_neg(sm9_fp12_t r, const sm9_fp12_t a)
void sm9_fp12_mul(sm9_fp12_t r, const sm9_fp12_t a, const sm9_fp12_t b)
{
sm9_fp4_t r0, r1, r2, t;
sm9_fp4_t r0, r1, r2, t, k0, k1, m0, m1, m2;
sm9_fp4_mul(r0, a[0], b[0]);
sm9_fp4_mul_v(t, a[1], b[2]);
sm9_fp4_add(r0, r0, t);
sm9_fp4_mul_v(t, a[2], b[1]);
sm9_fp4_add(r0, r0, t);
sm9_fp4_mul(m0, a[0], b[0]);
sm9_fp4_mul(m1, a[1], b[1]);
sm9_fp4_mul(m2, a[2], b[2]);
sm9_fp4_add(k0, a[1], a[2]);
sm9_fp4_add(k1, b[1], b[2]);
sm9_fp4_mul(t, k0, k1);
sm9_fp4_sub(t, t, m1);
sm9_fp4_sub(t, t, m2);
sm9_fp4_a_mul_v(t, t);
sm9_fp4_add(r0, t, m0);
sm9_fp4_mul(r1, a[0], b[1]);
sm9_fp4_mul(t, a[1], b[0]);
sm9_fp4_add(r1, r1, t);
sm9_fp4_mul_v(t, a[2], b[2]);
sm9_fp4_add(r1, r1, t);
sm9_fp4_add(k0, a[0], a[2]);
sm9_fp4_add(k1, b[0], b[2]);
sm9_fp4_mul(t, k0, k1);
sm9_fp4_sub(t, t, m0);
sm9_fp4_sub(t, t, m2);
sm9_fp4_add(r2, t, m1);
sm9_fp4_mul(r2, a[0], b[2]);
sm9_fp4_mul(t, a[1], b[1]);
sm9_fp4_add(r2, r2, t);
sm9_fp4_mul(t, a[2], b[0]);
sm9_fp4_add(r2, r2, t);
sm9_fp4_add(k0, a[0], a[1]);
sm9_fp4_add(k1, b[0], b[1]);
sm9_fp4_mul(t, k0, k1);
sm9_fp4_sub(t, t, m0);
sm9_fp4_sub(t, t, m1);
sm9_fp4_a_mul_v(m2, m2);
sm9_fp4_add(r1, t, m2);
sm9_fp4_copy(r[0], r0);
sm9_fp4_copy(r[1], r1);
@@ -1150,41 +1279,6 @@ void sm9_fp12_mul(sm9_fp12_t r, const sm9_fp12_t a, const sm9_fp12_t b)
// sm9_fp4_copy(r[2], r2);
// }
void sm9_fp4_div2(sm9_fp4_t r, const sm9_fp4_t a)
{
sm9_fp2_div2(r[0], a[0]);
sm9_fp2_div2(r[1], a[1]);
}
void sm9_fp2_a_mul_u(sm9_fp2_t r, sm9_fp2_t a) {
sm9_fp_t r0, a0, a1;
sm9_fp_copy(a0, a[0]);
sm9_fp_copy(a1, a[1]);
//r0 = -2 * a1
sm9_fp_dbl(r0, a1);
sm9_fp_neg(r0, r0);
sm9_fp_copy(r[0], r0);
//r1 = a0
sm9_fp_copy(r[1], a0);
}
void sm9_fp4_a_mul_v(sm9_fp4_t r, sm9_fp4_t a) {
sm9_fp2_t r0, a0, a1;
sm9_fp2_copy(a0, a[0]);
sm9_fp2_copy(a1, a[1]);
//r0 = a1 * u
sm9_fp2_a_mul_u(r0, a1);
sm9_fp2_copy(r[0], r0);
//r1 = a0
sm9_fp2_copy(r[1], a0);
}
void sm9_fp12_sqr(sm9_fp12_t r, const sm9_fp12_t a)
{
sm9_fp4_t h0, h1, h2, t;

2458
src/sm9_z256_alg.c Normal file
View File

File diff suppressed because it is too large Load Diff

1157
src/sm9_z256_key.c Normal file
View File

File diff suppressed because it is too large Load Diff

516
src/sm9_z256_lib.c Normal file
View File

@@ -0,0 +1,516 @@
/*
* Copyright 2014-2022 The GmSSL Project. All Rights Reserved.
*
* Licensed under the Apache License, Version 2.0 (the License); you may
* not use this file except in compliance with the License.
*
* http://www.apache.org/licenses/LICENSE-2.0
*/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <stdint.h>
#include <gmssl/mem.h>
#include <gmssl/sm3.h>
#include <gmssl/sm9_z256.h>
#include <gmssl/asn1.h>
#include <gmssl/error.h>
extern const sm9_z256_t SM9_Z256_ZERO;
extern const sm9_z256_t SM9_Z256_N;
extern const SM9_Z256_POINT *SM9_Z256_MONT_P1;
extern const SM9_Z256_TWIST_POINT *SM9_Z256_MONT_P2;
int sm9_signature_to_der(const SM9_SIGNATURE *sig, uint8_t **out, size_t *outlen)
{
uint8_t hbuf[32];
uint8_t Sbuf[65];
size_t len = 0;
sm9_z256_fn_to_bytes(sig->h, hbuf);
sm9_z256_point_to_uncompressed_octets(&sig->S, Sbuf);
if (asn1_octet_string_to_der(hbuf, sizeof(hbuf), NULL, &len) != 1
|| asn1_bit_octets_to_der(Sbuf, sizeof(Sbuf), NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_octet_string_to_der(hbuf, sizeof(hbuf), out, outlen) != 1
|| asn1_bit_octets_to_der(Sbuf, sizeof(Sbuf), out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int sm9_signature_from_der(SM9_SIGNATURE *sig, const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *d;
size_t dlen;
const uint8_t *h;
size_t hlen;
const uint8_t *S;
size_t Slen;
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (asn1_octet_string_from_der(&h, &hlen, &d, &dlen) != 1
|| asn1_bit_octets_from_der(&S, &Slen, &d, &dlen) != 1
|| asn1_check(hlen == 32) != 1
|| asn1_check(Slen == 65) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
if (sm9_z256_fn_from_bytes(sig->h, h) != 1
|| sm9_z256_point_from_uncompressed_octets(&sig->S, S) != 1) {
error_print();
return -1;
}
return 1;
}
int sm9_sign_init(SM9_SIGN_CTX *ctx)
{
const uint8_t prefix[1] = { SM9_HASH2_PREFIX };
sm3_init(&ctx->sm3_ctx);
sm3_update(&ctx->sm3_ctx, prefix, sizeof(prefix));
return 1;
}
int sm9_sign_update(SM9_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
{
sm3_update(&ctx->sm3_ctx, data, datalen);
return 1;
}
int sm9_sign_finish(SM9_SIGN_CTX *ctx, const SM9_SIGN_KEY *key, uint8_t *sig, size_t *siglen)
{
SM9_SIGNATURE signature;
if (sm9_do_sign(key, &ctx->sm3_ctx, &signature) != 1) {
error_print();
return -1;
}
*siglen = 0;
if (sm9_signature_to_der(&signature, &sig, siglen) != 1) {
error_print();
return -1;
}
return 1;
}
int sm9_do_sign(const SM9_SIGN_KEY *key, const SM3_CTX *sm3_ctx, SM9_SIGNATURE *sig)
{
sm9_z256_t r;
sm9_z256_fp12 g;
uint8_t wbuf[32 * 12];
SM3_CTX ctx = *sm3_ctx;
SM3_CTX tmp_ctx;
uint8_t ct1[4] = {0,0,0,1};
uint8_t ct2[4] = {0,0,0,2};
uint8_t Ha[64];
// A1: g = e(P1, Ppubs)
sm9_z256_pairing(g, &key->Ppubs, SM9_Z256_MONT_P1);
do {
// A2: rand r in [1, N-1]
if (sm9_z256_fn_rand(r) != 1) {
error_print();
return -1;
}
// Only for testing
//sm9_z256_from_hex(r, "00033C8616B06704813203DFD00965022ED15975C662337AED648835DC4B1CBE");
// A3: w = g^r
sm9_z256_fp12_pow(g, g, r);
sm9_z256_fp12_to_bytes(g, wbuf);
// A4: h = H2(M || w, N)
sm3_update(&ctx, wbuf, sizeof(wbuf));
tmp_ctx = ctx;
sm3_update(&ctx, ct1, sizeof(ct1));
sm3_finish(&ctx, Ha);
sm3_update(&tmp_ctx, ct2, sizeof(ct2));
sm3_finish(&tmp_ctx, Ha + 32);
sm9_z256_fn_from_hash(sig->h, Ha);
// A5: l = (r - h) mod N, if l = 0, goto A2
sm9_z256_fn_sub(r, r, sig->h);
} while (sm9_z256_fn_is_zero(r));
// A6: S = l * dsA
sm9_z256_point_mul(&sig->S, r, &key->ds);
gmssl_secure_clear(&r, sizeof(r));
gmssl_secure_clear(&g, sizeof(g));
gmssl_secure_clear(wbuf, sizeof(wbuf));
gmssl_secure_clear(&tmp_ctx, sizeof(tmp_ctx));
gmssl_secure_clear(Ha, sizeof(Ha));
return 1;
}
int sm9_verify_init(SM9_SIGN_CTX *ctx)
{
const uint8_t prefix[1] = { SM9_HASH2_PREFIX };
sm3_init(&ctx->sm3_ctx);
sm3_update(&ctx->sm3_ctx, prefix, sizeof(prefix));
return 1;
}
int sm9_verify_update(SM9_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
{
sm3_update(&ctx->sm3_ctx, data, datalen);
return 1;
}
int sm9_verify_finish(SM9_SIGN_CTX *ctx, const uint8_t *sig, size_t siglen,
const SM9_SIGN_MASTER_KEY *mpk, const char *id, size_t idlen)
{
int ret;
SM9_SIGNATURE signature;
if (sm9_signature_from_der(&signature, &sig, &siglen) != 1
|| asn1_length_is_zero(siglen) != 1) {
error_print();
return -1;
}
if ((ret = sm9_do_verify(mpk, id, idlen, &ctx->sm3_ctx, &signature)) < 0) {
error_print();
return -1;
}
return ret;
}
int sm9_do_verify(const SM9_SIGN_MASTER_KEY *mpk, const char *id, size_t idlen,
const SM3_CTX *sm3_ctx, const SM9_SIGNATURE *sig)
{
sm9_z256_t h1;
sm9_z256_t h2;
sm9_z256_fp12 g;
sm9_z256_fp12 t;
sm9_z256_fp12 u;
sm9_z256_fp12 w;
SM9_Z256_TWIST_POINT P;
uint8_t wbuf[32 * 12];
SM3_CTX ctx = *sm3_ctx;
SM3_CTX tmp_ctx;
uint8_t ct1[4] = {0,0,0,1};
uint8_t ct2[4] = {0,0,0,2};
uint8_t Ha[64];
// B1: check h in [1, N-1]
// B2: check S in G1
// B3: g = e(P1, Ppubs)
sm9_z256_pairing(g, &mpk->Ppubs, SM9_Z256_MONT_P1);
// B4: t = g^h
sm9_z256_fp12_pow(t, g, sig->h);
// B5: h1 = H1(ID || hid, N)
sm9_z256_hash1(h1, id, idlen, SM9_HID_SIGN);
// B6: P = h1 * P2 + Ppubs
sm9_z256_twist_point_mul_generator(&P, h1);
sm9_z256_twist_point_add_full(&P, &P, &mpk->Ppubs);
// B7: u = e(S, P)
sm9_z256_pairing(u, &P, &sig->S);
// B8: w = u * t
sm9_z256_fp12_mul(w, u, t);
sm9_z256_fp12_to_bytes(w, wbuf);
// B9: h2 = H2(M || w, N), check h2 == h
sm3_update(&ctx, wbuf, sizeof(wbuf));
tmp_ctx = ctx;
sm3_update(&ctx, ct1, sizeof(ct1));
sm3_finish(&ctx, Ha);
sm3_update(&tmp_ctx, ct2, sizeof(ct2));
sm3_finish(&tmp_ctx, Ha + 32);
sm9_z256_fn_from_hash(h2, Ha);
if (sm9_z256_fn_equ(h2, sig->h) != 1) {
return 0;
}
return 1;
}
int sm9_kem_encrypt(const SM9_ENC_MASTER_KEY *mpk, const char *id, size_t idlen,
size_t klen, uint8_t *kbuf, SM9_Z256_POINT *C)
{
sm9_z256_t r;
sm9_z256_fp12 w;
uint8_t wbuf[32 * 12];
uint8_t cbuf[65];
SM3_KDF_CTX kdf_ctx;
// A1: Q = H1(ID||hid,N) * P1 + Ppube
sm9_z256_hash1(r, id, idlen, SM9_HID_ENC);
sm9_z256_point_mul(C, r, SM9_Z256_MONT_P1);
sm9_z256_point_add(C, C, &mpk->Ppube);
do {
// A2: rand r in [1, N-1]
if (sm9_z256_fn_rand(r) != 1) {
error_print();
return -1;
}
// A3: C1 = r * Q
sm9_z256_point_mul(C, r, C);
sm9_z256_point_to_uncompressed_octets(C, cbuf);
// A4: g = e(Ppube, P2)
sm9_z256_pairing(w, SM9_Z256_MONT_P2, &mpk->Ppube);
// A5: w = g^r
sm9_z256_fp12_pow(w, w, r);
sm9_z256_fp12_to_bytes(w, wbuf);
// A6: K = KDF(C || w || ID_B, klen), if K == 0, goto A2
sm3_kdf_init(&kdf_ctx, klen);
sm3_kdf_update(&kdf_ctx, cbuf + 1, 64);
sm3_kdf_update(&kdf_ctx, wbuf, sizeof(wbuf));
sm3_kdf_update(&kdf_ctx, (uint8_t *)id, idlen);
sm3_kdf_finish(&kdf_ctx, kbuf);
} while (mem_is_zero(kbuf, klen) == 1);
gmssl_secure_clear(&r, sizeof(r));
gmssl_secure_clear(&w, sizeof(w));
gmssl_secure_clear(wbuf, sizeof(wbuf));
gmssl_secure_clear(&kdf_ctx, sizeof(kdf_ctx));
// A7: output (K, C)
return 1;
}
int sm9_kem_decrypt(const SM9_ENC_KEY *key, const char *id, size_t idlen, const SM9_Z256_POINT *C,
size_t klen, uint8_t *kbuf)
{
sm9_z256_fp12 w;
uint8_t wbuf[32 * 12];
uint8_t cbuf[65];
SM3_KDF_CTX kdf_ctx;
// B1: check C in G1
sm9_z256_point_to_uncompressed_octets(C, cbuf);
// B2: w = e(C, de);
sm9_z256_pairing(w, &key->de, C);
sm9_z256_fp12_to_bytes(w, wbuf);
// B3: K = KDF(C || w || ID, klen)
sm3_kdf_init(&kdf_ctx, klen);
sm3_kdf_update(&kdf_ctx, cbuf + 1, 64);
sm3_kdf_update(&kdf_ctx, wbuf, sizeof(wbuf));
sm3_kdf_update(&kdf_ctx, (uint8_t *)id, idlen);
sm3_kdf_finish(&kdf_ctx, kbuf);
if (mem_is_zero(kbuf, klen)) {
error_print();
return -1;
}
gmssl_secure_clear(&w, sizeof(w));
gmssl_secure_clear(wbuf, sizeof(wbuf));
gmssl_secure_clear(&kdf_ctx, sizeof(kdf_ctx));
// B4: output K
return 1;
}
int sm9_do_encrypt(const SM9_ENC_MASTER_KEY *mpk, const char *id, size_t idlen,
const uint8_t *in, size_t inlen,
SM9_Z256_POINT *C1, uint8_t *c2, uint8_t c3[SM3_HMAC_SIZE])
{
SM3_HMAC_CTX hmac_ctx;
uint8_t K[SM9_MAX_PLAINTEXT_SIZE + 32];
if (sm9_kem_encrypt(mpk, id, idlen, sizeof(K), K, C1) != 1) {
error_print();
return -1;
}
gmssl_memxor(c2, K, in, inlen);
//sm3_hmac(K + inlen, 32, c2, inlen, c3);
sm3_hmac_init(&hmac_ctx, K + inlen, SM3_HMAC_SIZE);
sm3_hmac_update(&hmac_ctx, c2, inlen);
sm3_hmac_finish(&hmac_ctx, c3);
gmssl_secure_clear(&hmac_ctx, sizeof(hmac_ctx));
return 1;
}
int sm9_do_decrypt(const SM9_ENC_KEY *key, const char *id, size_t idlen,
const SM9_Z256_POINT *C1, const uint8_t *c2, size_t c2len, const uint8_t c3[SM3_HMAC_SIZE],
uint8_t *out)
{
SM3_HMAC_CTX hmac_ctx;
uint8_t k[SM9_MAX_PLAINTEXT_SIZE + SM3_HMAC_SIZE];
uint8_t mac[SM3_HMAC_SIZE];
if (c2len > SM9_MAX_PLAINTEXT_SIZE) {
error_print();
return -1;
}
if (sm9_kem_decrypt(key, id, idlen, C1, sizeof(k), k) != 1) {
error_print();
return -1;
}
//sm3_hmac(k + c2len, SM3_HMAC_SIZE, c2, c2len, mac);
sm3_hmac_init(&hmac_ctx, k + c2len, SM3_HMAC_SIZE);
sm3_hmac_update(&hmac_ctx, c2, c2len);
sm3_hmac_finish(&hmac_ctx, mac);
gmssl_secure_clear(&hmac_ctx, sizeof(hmac_ctx));
if (gmssl_secure_memcmp(c3, mac, sizeof(mac)) != 0) {
error_print();
return -1;
}
gmssl_memxor(out, k, c2, c2len);
return 1;
}
#define SM9_ENC_TYPE_XOR 0
#define SM9_ENC_TYPE_ECB 1
#define SM9_ENC_TYPE_CBC 2
#define SM9_ENC_TYPE_OFB 4
#define SM9_ENC_TYPE_CFB 8
/*
SM9Cipher ::= SEQUENCE {
EnType INTEGER, -- 0 for XOR
C1 BIT STRING, -- uncompressed octets of ECPoint
C3 OCTET STRING, -- 32 bytes HMAC-SM3 tag
CipherText OCTET STRING,
}
*/
int sm9_ciphertext_to_der(const SM9_Z256_POINT *C1, const uint8_t *c2, size_t c2len,
const uint8_t c3[SM3_HMAC_SIZE], uint8_t **out, size_t *outlen)
{
int en_type = SM9_ENC_TYPE_XOR;
uint8_t c1[65];
size_t len = 0;
if (sm9_z256_point_to_uncompressed_octets(C1, c1) != 1) {
error_print();
return -1;
}
if (asn1_int_to_der(en_type, NULL, &len) != 1
|| asn1_bit_octets_to_der(c1, sizeof(c1), NULL, &len) != 1
|| asn1_octet_string_to_der(c3, SM3_HMAC_SIZE, NULL, &len) != 1
|| asn1_octet_string_to_der(c2, c2len, NULL, &len) != 1
|| asn1_sequence_header_to_der(len, out, outlen) != 1
|| asn1_int_to_der(en_type, out, outlen) != 1
|| asn1_bit_octets_to_der(c1, sizeof(c1), out, outlen) != 1
|| asn1_octet_string_to_der(c3, SM3_HMAC_SIZE, out, outlen) != 1
|| asn1_octet_string_to_der(c2, c2len, out, outlen) != 1) {
error_print();
return -1;
}
return 1;
}
int sm9_ciphertext_from_der(SM9_Z256_POINT *C1, const uint8_t **c2, size_t *c2len,
const uint8_t **c3, const uint8_t **in, size_t *inlen)
{
int ret;
const uint8_t *d;
size_t dlen;
int en_type;
const uint8_t *c1;
size_t c1len;
size_t c3len;
if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
if (ret < 0) error_print();
return ret;
}
if (asn1_int_from_der(&en_type, &d, &dlen) != 1
|| asn1_bit_octets_from_der(&c1, &c1len, &d, &dlen) != 1
|| asn1_octet_string_from_der(c3, &c3len, &d, &dlen) != 1
|| asn1_octet_string_from_der(c2, c2len, &d, &dlen) != 1
|| asn1_length_is_zero(dlen) != 1) {
error_print();
return -1;
}
if (en_type != SM9_ENC_TYPE_XOR) {
error_print();
return -1;
}
if (c1len != 65) {
error_print();
return -1;
}
if (c3len != SM3_HMAC_SIZE) {
error_print();
return -1;
}
if (sm9_z256_point_from_uncompressed_octets(C1, c1) != 1) {
error_print();
return -1;
}
return 1;
}
int sm9_encrypt(const SM9_ENC_MASTER_KEY *mpk, const char *id, size_t idlen,
const uint8_t *in, size_t inlen, uint8_t *out, size_t *outlen)
{
SM9_Z256_POINT C1;
uint8_t c2[SM9_MAX_PLAINTEXT_SIZE];
uint8_t c3[SM3_HMAC_SIZE];
if (inlen > SM9_MAX_PLAINTEXT_SIZE) {
error_print();
return -1;
}
if (sm9_do_encrypt(mpk, id, idlen, in, inlen, &C1, c2, c3) != 1) {
error_print();
return -1;
}
*outlen = 0;
if (sm9_ciphertext_to_der(&C1, c2, inlen, c3, &out, outlen) != 1) { // FIXME: when out == NULL
error_print();
return -1;
}
return 1;
}
int sm9_decrypt(const SM9_ENC_KEY *key, const char *id, size_t idlen,
const uint8_t *in, size_t inlen, uint8_t *out, size_t *outlen)
{
SM9_Z256_POINT C1;
const uint8_t *c2;
size_t c2len;
const uint8_t *c3;
if (sm9_ciphertext_from_der(&C1, &c2, &c2len, &c3, &in, &inlen) != 1
|| asn1_length_is_zero(inlen) != 1) {
error_print();
return -1;
}
*outlen = c2len;
if (!out) {
return 1;
}
if (sm9_do_decrypt(key, id, idlen, &C1, c2, c2len, c3, out) != 1) {
error_print();
return -1;
}
return 1;
}