mirror of
https://github.com/guanzhi/GmSSL.git
synced 2026-05-07 08:56:17 +08:00
Update SM9
This commit is contained in:
Zhi Guan
15
src/hex.c
15
src/hex.c
@@ -240,3 +240,18 @@ void gmssl_secure_clear(void *ptr, size_t len)
|
||||
{
|
||||
memset_func(ptr, 0, len);
|
||||
}
|
||||
|
||||
int mem_is_zero(const uint8_t *buf, size_t len)
|
||||
{
|
||||
int ret = 1;
|
||||
size_t i;
|
||||
for (i = 0; i < len; i++) {
|
||||
if (buf[i]) ret = 0;
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
92
src/sm3_kdf.c
Normal file
92
src/sm3_kdf.c
Normal file
@@ -0,0 +1,92 @@
|
||||
/*
|
||||
* Copyright (c) 2014 - 2021 The GmSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the GmSSL Project.
|
||||
* (http://gmssl.org/)"
|
||||
*
|
||||
* 4. The name "GmSSL Project" must not be used to endorse or promote
|
||||
* products derived from this software without prior written
|
||||
* permission. For written permission, please contact
|
||||
* guanzhi1980@gmail.com.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "GmSSL"
|
||||
* nor may "GmSSL" appear in their names without prior written
|
||||
* permission of the GmSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the GmSSL Project
|
||||
* (http://gmssl.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE GmSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE GmSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
|
||||
#include <string.h>
|
||||
#include <gmssl/sm3.h>
|
||||
#include <gmssl/endian.h>
|
||||
#include <gmssl/error.h>
|
||||
|
||||
|
||||
void sm3_kdf_init(SM3_KDF_CTX *ctx, size_t outlen)
|
||||
{
|
||||
sm3_init(&ctx->sm3_ctx);
|
||||
ctx->outlen = outlen;
|
||||
}
|
||||
|
||||
void sm3_kdf_update(SM3_KDF_CTX *ctx, const uint8_t *data, size_t datalen)
|
||||
{
|
||||
sm3_update(&ctx->sm3_ctx, data, datalen);
|
||||
}
|
||||
|
||||
void sm3_kdf_finish(SM3_KDF_CTX *ctx, uint8_t *out)
|
||||
{
|
||||
SM3_CTX sm3_ctx;
|
||||
size_t outlen = ctx->outlen;
|
||||
uint8_t counter_be[4];
|
||||
uint8_t dgst[SM3_DIGEST_SIZE];
|
||||
uint32_t counter = 1;
|
||||
size_t len;
|
||||
|
||||
while (outlen) {
|
||||
PUTU32(counter_be, counter);
|
||||
counter++;
|
||||
|
||||
sm3_ctx = ctx->sm3_ctx;
|
||||
sm3_update(&sm3_ctx, counter_be, sizeof(counter_be));
|
||||
sm3_finish(&sm3_ctx, dgst);
|
||||
|
||||
len = outlen < SM3_DIGEST_SIZE ? outlen : SM3_DIGEST_SIZE;
|
||||
memcpy(out, dgst, len);
|
||||
out += len;
|
||||
outlen -= len;
|
||||
}
|
||||
|
||||
memset(&sm3_ctx, 0, sizeof(SM3_CTX));
|
||||
memset(dgst, 0, sizeof(dgst));
|
||||
}
|
||||
@@ -1687,7 +1687,7 @@ void sm9_twist_point_mul(sm9_twist_point_t *R, const sm9_bn_t k, const sm9_twist
|
||||
sm9_twist_point_copy(R, Q);
|
||||
}
|
||||
|
||||
void sm9_twist_point_mul_G(sm9_twist_point_t *R, const sm9_bn_t k)
|
||||
void sm9_twist_point_mul_generator(sm9_twist_point_t *R, const sm9_bn_t k)
|
||||
{
|
||||
sm9_twist_point_mul(R, k, SM9_P2);
|
||||
}
|
||||
@@ -1927,3 +1927,78 @@ void sm9_pairing(sm9_fp12_t r, const sm9_twist_point_t *Q, const sm9_point_t *P)
|
||||
sm9_final_exponent(r, r);
|
||||
}
|
||||
|
||||
void sm9_fn_add(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)
|
||||
{
|
||||
}
|
||||
|
||||
void sm9_fn_sub(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)
|
||||
{
|
||||
}
|
||||
|
||||
void sm9_fn_mul(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)
|
||||
{
|
||||
}
|
||||
|
||||
void sm9_fn_inv(sm9_fn_t r, const sm9_fn_t a)
|
||||
{
|
||||
}
|
||||
|
||||
int sm9_fn_is_zero(const sm9_fn_t a)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
void sm9_fn_rand(sm9_fn_t r)
|
||||
{
|
||||
// FIXME: add impl
|
||||
}
|
||||
|
||||
int sm9_fn_equ(const sm9_fn_t a, const sm9_fn_t b)
|
||||
{
|
||||
// FIXME: add impl
|
||||
return 1;
|
||||
}
|
||||
|
||||
// for H1() and H2()
|
||||
// h = (Ha mod (n-1)) + 1; h in [1, n-1], n is the curve order, Ha is 40 bytes from hash
|
||||
int sm9_fn_from_hash(sm9_fn_t h, const uint8_t Ha[40])
|
||||
{
|
||||
return 1;
|
||||
}
|
||||
|
||||
void sm9_fp12_to_bytes(const sm9_fp12_t a, uint8_t buf[32 * 12])
|
||||
{
|
||||
// FIXME: add impl
|
||||
}
|
||||
|
||||
int sm9_point_to_bytes(const sm9_point_t *P, uint8_t out[32 * 2])
|
||||
{
|
||||
// FIXME
|
||||
return 1;
|
||||
}
|
||||
|
||||
int sm9_point_from_bytes(sm9_point_t *P, const uint8_t in[32 * 2])
|
||||
{
|
||||
// FIXME
|
||||
return 1;
|
||||
}
|
||||
|
||||
int sm9_twist_point_to_bytes(const sm9_twist_point_t *P, uint8_t out[32 * 2])
|
||||
{
|
||||
// FIXME
|
||||
return 1;
|
||||
}
|
||||
|
||||
int sm9_twist_point_from_bytes(sm9_twist_point_t *P, const uint8_t in[32 * 2])
|
||||
{
|
||||
// FIXME
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
107
src/sm9_key.c
107
src/sm9_key.c
@@ -54,116 +54,99 @@
|
||||
#include <gmssl/error.h>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
// generate h1 in [1, n-1]
|
||||
int sm9_hash1(sm9_bn_t h1, const char *id, size_t idlen, uint8_t hid)
|
||||
{
|
||||
sm9_fn_t h;
|
||||
SM3_CTX ctx1;
|
||||
SM3_CTX ctx2;
|
||||
|
||||
SM3_CTX ctx;
|
||||
uint8_t prefix[1] = {0x01};
|
||||
uint8_t ct1[4] = {0x00, 0x00, 0x00, 0x01};
|
||||
uint8_t ct2[4] = {0x00, 0x00, 0x00, 0x02};
|
||||
uint8_t buf[64];
|
||||
uint8_t Ha[64];
|
||||
|
||||
sm3_init(&ctx1);
|
||||
sm3_update(&ctx1, prefix, sizeof(prefix));
|
||||
sm3_update(&ctx1, (uint8_t *)id, idlen);
|
||||
sm3_update(&ctx1, &hid, 1);
|
||||
ctx2 = ctx1;
|
||||
sm3_update(&ctx1, ct1, sizeof(ct1));
|
||||
sm3_update(&ctx2, ct2, sizeof(ct2));
|
||||
sm3_finish(&ctx1, buf);
|
||||
sm3_finish(&ctx2, buf + 32);
|
||||
sm3_init(&ctx);
|
||||
sm3_update(&ctx, prefix, sizeof(prefix));
|
||||
sm3_update(&ctx, (uint8_t *)id, idlen);
|
||||
sm3_update(&ctx, &hid, 1);
|
||||
sm3_update(&ctx, ct1, sizeof(ct1));
|
||||
sm3_finish(&ctx, Ha);
|
||||
|
||||
// 这个buflen == 64，我们要将长为40的部分取出来，模 N-1 再加1
|
||||
return -1;
|
||||
sm3_init(&ctx);
|
||||
sm3_update(&ctx, prefix, sizeof(prefix));
|
||||
sm3_update(&ctx, (uint8_t *)id, idlen);
|
||||
sm3_update(&ctx, &hid, 1);
|
||||
sm3_update(&ctx, ct2, sizeof(ct2));
|
||||
sm3_finish(&ctx, Ha + 32);
|
||||
|
||||
sm9_fn_from_hash(h1, Ha);
|
||||
return 1;
|
||||
}
|
||||
|
||||
void sm9_fn_add(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)
|
||||
{
|
||||
}
|
||||
|
||||
void sm9_fn_sub(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)
|
||||
{
|
||||
}
|
||||
|
||||
void sm9_fn_mul(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)
|
||||
{
|
||||
}
|
||||
|
||||
void sm9_fn_inv(sm9_fn_t r, const sm9_fn_t a)
|
||||
{
|
||||
}
|
||||
|
||||
int sm9_fn_is_zero(const sm9_fn_t a)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
int sm9_sign_master_key_generate(SM9_SIGN_MASTER_KEY *master)
|
||||
int sm9_sign_master_key_generate(SM9_SIGN_MASTER_KEY *msk)
|
||||
{
|
||||
// k = rand(1, n-1)
|
||||
//sm9_bn_rand_range(master->ks, SM9_N);
|
||||
sm9_fn_rand(msk->ks);
|
||||
|
||||
// Ppubs = k * P2 in E'(F_p^2)
|
||||
sm9_twist_point_mul_G(&master->Ppubs, master->ks);
|
||||
sm9_twist_point_mul_generator(&msk->Ppubs, msk->ks);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int sm9_enc_master_key_generate(SM9_ENC_MASTER_KEY *master)
|
||||
int sm9_enc_master_key_generate(SM9_ENC_MASTER_KEY *msk)
|
||||
{
|
||||
// k = rand(1, n-1)
|
||||
//sm9_bn_rand_range(master->ke, SM9_N);
|
||||
sm9_fn_rand(msk->ke);
|
||||
|
||||
// Ppube = ke * P1 in E(F_p)
|
||||
sm9_point_mul_generator(&master->Ppube, master->ke);
|
||||
sm9_point_mul_generator(&msk->Ppube, msk->ke);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int sm9_sign_master_key_extract_key(SM9_SIGN_MASTER_KEY *master, const char *id, size_t idlen, SM9_SIGN_KEY *key)
|
||||
int sm9_sign_master_key_extract_key(SM9_SIGN_MASTER_KEY *msk, const char *id, size_t idlen, SM9_SIGN_KEY *key)
|
||||
{
|
||||
sm9_fn_t t;
|
||||
|
||||
// t1 = H1(ID || hid, N) + ks
|
||||
sm9_hash1(t, id, idlen, SM9_HID_SIGN);
|
||||
sm9_fn_add(t, t, master->ks);
|
||||
sm9_fn_add(t, t, msk->ks);
|
||||
if (sm9_fn_is_zero(t)) {
|
||||
// 这是一个严重问题，意味着整个msk都需要作废了
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
// t2 = ks * t1^-1
|
||||
sm9_fn_inv(t, t);
|
||||
sm9_fn_mul(t, t, master->ks);
|
||||
sm9_fn_mul(t, t, msk->ks);
|
||||
|
||||
// ds = t2 * P1
|
||||
sm9_point_mul_generator(&key->ds, t);
|
||||
key->Ppubs = msk->Ppubs;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int sm9_enc_master_key_extract_key(SM9_ENC_MASTER_KEY *master, const char *id, size_t idlen,
|
||||
int sm9_enc_master_key_extract_key(SM9_ENC_MASTER_KEY *msk, const char *id, size_t idlen,
|
||||
SM9_ENC_KEY *key)
|
||||
{
|
||||
sm9_fn_t t;
|
||||
|
||||
// t1 = H1(ID || hid, N) + ke
|
||||
sm9_hash1(t, id, idlen, SM9_HID_ENC);
|
||||
sm9_fn_add(t, t, master->ke);
|
||||
sm9_fn_add(t, t, msk->ke);
|
||||
if (sm9_fn_is_zero(t)) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
// t2 = ke * t1^-1
|
||||
sm9_fn_inv(t, t);
|
||||
sm9_fn_mul(t, t, master->ke);
|
||||
sm9_twist_point_mul_G(&key->de, t);
|
||||
sm9_fn_mul(t, t, msk->ke);
|
||||
|
||||
// de = t2 * P2
|
||||
sm9_twist_point_mul_generator(&key->de, t);
|
||||
key->Ppube = msk->Ppube;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
232
src/sm9_lib.c
232
src/sm9_lib.c
@@ -1,4 +1,4 @@
|
||||
/*
|
||||
/*
|
||||
* Copyright (c) 2014 - 2020 The GmSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -50,27 +50,12 @@
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdint.h>
|
||||
#include <gmssl/mem.h>
|
||||
#include <gmssl/sm3.h>
|
||||
#include <gmssl/sm9.h>
|
||||
#include <gmssl/error.h>
|
||||
|
||||
|
||||
void sm9_fn_rand(sm9_fn_t r)
|
||||
{
|
||||
// FIXME: add impl
|
||||
}
|
||||
|
||||
int sm9_fn_equ(const sm9_fn_t a, const sm9_fn_t b)
|
||||
{
|
||||
// FIXME: add impl
|
||||
return 1;
|
||||
}
|
||||
|
||||
void sm9_fp12_to_bytes(const sm9_fp12_t a, uint8_t buf[32 * 12])
|
||||
{
|
||||
// FIXME: add impl
|
||||
}
|
||||
|
||||
int sm9_sign_init(SM9_SIGN_CTX *ctx)
|
||||
{
|
||||
const uint8_t prefix[1] = {0x02};
|
||||
@@ -85,26 +70,56 @@ int sm9_sign_update(SM9_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
|
||||
return 1;
|
||||
}
|
||||
|
||||
int sm9_sign_finish(SM9_SIGN_CTX *ctx, SM9_SIGN_KEY *key, SM9_SIGNATURE *sig)
|
||||
int sm9_sign_finish(SM9_SIGN_CTX *ctx, const SM9_SIGN_KEY *key, uint8_t *sig, size_t *siglen)
|
||||
{
|
||||
return -1;
|
||||
}
|
||||
|
||||
int sm9_do_sign(const SM9_SIGN_KEY *key, const SM3_CTX *sm3_ctx, SM9_SIGNATURE *sig)
|
||||
{
|
||||
sm9_fn_t r;
|
||||
sm9_fn_t h;
|
||||
sm9_fp12_t g;
|
||||
sm9_fp12_t w;
|
||||
uint8_t wbuf[32 * 12];
|
||||
uint8_t dgst[32];
|
||||
SM3_CTX ctx = *sm3_ctx;
|
||||
SM3_CTX tmp_ctx;
|
||||
uint8_t ct1[4] = {0,0,0,1};
|
||||
uint8_t ct2[4] = {0,0,0,2};
|
||||
uint8_t Ha[64];
|
||||
|
||||
// A1: g = e(P1, Ppubs)
|
||||
sm9_pairing(g, &key->Ppubs, SM9_P1);
|
||||
|
||||
do {
|
||||
// A2: rand r in [1, N-1]
|
||||
sm9_fn_rand(r);
|
||||
sm9_fp12_pow(w, g, r);
|
||||
sm9_fp12_to_bytes(w, wbuf);
|
||||
sm3_update(&ctx->sm3_ctx, wbuf, sizeof(wbuf));
|
||||
sm3_finish(&ctx->sm3_ctx, dgst);
|
||||
// do H2() staff, generate output sig->h
|
||||
sm9_fn_sub(r, r, h);
|
||||
|
||||
// A3: w = g^r
|
||||
sm9_fp12_pow(g, g, r);
|
||||
sm9_fp12_to_bytes(g, wbuf);
|
||||
|
||||
// A4: h = H2(M || w, N)
|
||||
sm3_update(&ctx, wbuf, sizeof(wbuf));
|
||||
tmp_ctx = ctx;
|
||||
sm3_update(&ctx, ct1, sizeof(ct1));
|
||||
sm3_finish(&ctx, Ha);
|
||||
sm3_update(&tmp_ctx, ct2, sizeof(ct2));
|
||||
sm3_finish(&tmp_ctx, Ha + 32);
|
||||
sm9_fn_from_hash(sig->h, Ha);
|
||||
|
||||
// A5: l = (r - h) mod N, if l = 0, goto A2
|
||||
sm9_fn_sub(r, r, sig->h);
|
||||
|
||||
} while (sm9_fn_is_zero(r));
|
||||
|
||||
// A6: S = l * dsA
|
||||
sm9_point_mul(&sig->S, r, &key->ds);
|
||||
|
||||
gmssl_secure_clear(&r, sizeof(r));
|
||||
gmssl_secure_clear(&g, sizeof(g));
|
||||
gmssl_secure_clear(wbuf, sizeof(wbuf));
|
||||
gmssl_secure_clear(&tmp_ctx, sizeof(tmp_ctx));
|
||||
gmssl_secure_clear(Ha, sizeof(Ha));
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -122,9 +137,14 @@ int sm9_verify_update(SM9_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
|
||||
return 1;
|
||||
}
|
||||
|
||||
// 签名的时候
|
||||
int sm9_verify_finish(SM9_SIGN_CTX *ctx, const SM9_SIGNATURE *sig,
|
||||
const SM9_SIGN_MASTER_KEY *master_public, const char *id, size_t idlen)
|
||||
int sm9_verify_finish(SM9_SIGN_CTX *ctx, const uint8_t *sig, size_t siglen,
|
||||
const SM9_SIGN_MASTER_KEY *mpk, const char *id, size_t idlen)
|
||||
{
|
||||
return -1;
|
||||
}
|
||||
|
||||
int sm9_do_verify(const SM9_SIGN_MASTER_KEY *mpk, const char *id, size_t idlen,
|
||||
const SM3_CTX *sm3_ctx, const SM9_SIGNATURE *sig)
|
||||
{
|
||||
sm9_fn_t h1;
|
||||
sm9_fn_t h2;
|
||||
@@ -134,23 +154,163 @@ int sm9_verify_finish(SM9_SIGN_CTX *ctx, const SM9_SIGNATURE *sig,
|
||||
sm9_fp12_t w;
|
||||
sm9_twist_point_t P;
|
||||
uint8_t wbuf[32 * 12];
|
||||
SM3_CTX ctx = *sm3_ctx;
|
||||
SM3_CTX tmp_ctx;
|
||||
uint8_t ct1[4] = {0,0,0,1};
|
||||
uint8_t ct2[4] = {0,0,0,2};
|
||||
uint8_t Ha[64];
|
||||
|
||||
sm9_pairing(g, &master_public->Ppubs, SM9_P1);
|
||||
// B1: check h in [1, N-1]
|
||||
|
||||
// B2: check S in G1
|
||||
|
||||
// B3: g = e(P1, Ppubs)
|
||||
sm9_pairing(g, &mpk->Ppubs, SM9_P1);
|
||||
|
||||
// B4: t = g^h
|
||||
sm9_fp12_pow(t, g, sig->h);
|
||||
|
||||
// B5: h1 = H1(ID || hid, N)
|
||||
sm9_hash1(h1, id, idlen, SM9_HID_SIGN);
|
||||
sm9_twist_point_mul_G(&P, h1);
|
||||
sm9_twist_point_add(&P, &P, &master_public->Ppubs);
|
||||
|
||||
// B6: P = h1 * P2 + Ppubs
|
||||
sm9_twist_point_mul_generator(&P, h1);
|
||||
sm9_twist_point_add(&P, &P, &mpk->Ppubs);
|
||||
|
||||
// B7: u = e(S, P)
|
||||
sm9_pairing(u, &P, &sig->S);
|
||||
|
||||
// B8: w = u * t
|
||||
sm9_fp12_mul(w, u, t);
|
||||
sm9_fp12_to_bytes(w, wbuf);
|
||||
|
||||
sm3_update(&ctx->sm3_ctx, wbuf, sizeof(wbuf));
|
||||
// convert h2
|
||||
|
||||
// B9: h2 = H2(M || w, N), check h2 == h
|
||||
sm3_update(&ctx, wbuf, sizeof(wbuf));
|
||||
tmp_ctx = ctx;
|
||||
sm3_update(&ctx, ct1, sizeof(ct1));
|
||||
sm3_finish(&ctx, Ha);
|
||||
sm3_update(&tmp_ctx, ct2, sizeof(ct2));
|
||||
sm3_finish(&tmp_ctx, Ha + 32);
|
||||
sm9_fn_from_hash(h2, Ha);
|
||||
if (sm9_fn_equ(h2, sig->h) != 1) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int sm9_kem_encrypt(const SM9_ENC_MASTER_KEY *mpk, const char *id, size_t idlen,
|
||||
size_t klen, uint8_t *kbuf, uint8_t cbuf[64])
|
||||
{
|
||||
sm9_fn_t r;
|
||||
sm9_fp12_t w;
|
||||
sm9_point_t C;
|
||||
uint8_t wbuf[32 * 12];
|
||||
SM3_KDF_CTX kdf_ctx;
|
||||
|
||||
// A1: Q = H1(ID||hid,N) * P1 + Ppube
|
||||
sm9_hash1(r, id, idlen, SM9_HID_EXCH);
|
||||
sm9_point_mul(&C, r, SM9_P1);
|
||||
sm9_point_add(&C, &C, &mpk->Ppube);
|
||||
|
||||
do {
|
||||
// A2: rand r in [1, N-1]
|
||||
sm9_fn_rand(r);
|
||||
|
||||
// A3: C1 = r * Q
|
||||
sm9_point_mul(&C, r, &C);
|
||||
sm9_point_to_bytes(&C, cbuf);
|
||||
|
||||
// A4: g = e(Ppube, P2)
|
||||
sm9_pairing(w, SM9_P2, &mpk->Ppube);
|
||||
|
||||
// A5: w = g^r
|
||||
sm9_fp12_pow(w, w, r);
|
||||
sm9_fp12_to_bytes(w, wbuf);
|
||||
|
||||
// A6: K = KDF(C || w || ID_B, klen), if K == 0, goto A2
|
||||
sm3_kdf_init(&kdf_ctx, klen);
|
||||
sm3_kdf_update(&kdf_ctx, cbuf, 64);
|
||||
sm3_kdf_update(&kdf_ctx, wbuf, sizeof(wbuf));
|
||||
sm3_kdf_update(&kdf_ctx, (uint8_t *)id, idlen);
|
||||
sm3_kdf_finish(&kdf_ctx, kbuf);
|
||||
|
||||
} while (mem_is_zero(kbuf, klen) == 1);
|
||||
|
||||
gmssl_secure_clear(&r, sizeof(r));
|
||||
gmssl_secure_clear(&w, sizeof(w));
|
||||
gmssl_secure_clear(&C, sizeof(C));
|
||||
gmssl_secure_clear(wbuf, sizeof(wbuf));
|
||||
gmssl_secure_clear(&kdf_ctx, sizeof(kdf_ctx));
|
||||
|
||||
// A7: output (K, C)
|
||||
return 1;
|
||||
}
|
||||
|
||||
int sm9_kem_decrypt(const SM9_ENC_KEY *key, const char *id, size_t idlen, const uint8_t cbuf[64],
|
||||
size_t klen, uint8_t *kbuf)
|
||||
{
|
||||
sm9_fp12_t w;
|
||||
sm9_point_t C;
|
||||
uint8_t wbuf[32 * 12];
|
||||
SM3_KDF_CTX kdf_ctx;
|
||||
|
||||
// B1: check C in G1
|
||||
if (sm9_point_from_bytes(&C, cbuf) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
// B2: w = e(C, de);
|
||||
sm9_pairing(w, &key->de, &C);
|
||||
|
||||
// B3: K = KDF(C || w || ID, klen)
|
||||
sm3_kdf_init(&kdf_ctx, klen);
|
||||
sm3_kdf_update(&kdf_ctx, cbuf, 64);
|
||||
sm3_kdf_update(&kdf_ctx, wbuf, sizeof(wbuf));
|
||||
sm3_kdf_update(&kdf_ctx, (uint8_t *)id, idlen);
|
||||
sm3_kdf_finish(&kdf_ctx, kbuf);
|
||||
|
||||
if (mem_is_zero(kbuf, klen) != 1) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
|
||||
gmssl_secure_clear(&w, sizeof(w));
|
||||
gmssl_secure_clear(&C, sizeof(C));
|
||||
gmssl_secure_clear(wbuf, sizeof(wbuf));
|
||||
gmssl_secure_clear(&kdf_ctx, sizeof(kdf_ctx));
|
||||
|
||||
// B4: output K
|
||||
return 1;
|
||||
}
|
||||
|
||||
int sm9_do_encrypt(const SM9_ENC_MASTER_KEY *mpk, const char *id, size_t idlen,
|
||||
const uint8_t *in, size_t inlen,
|
||||
uint8_t C1[64], uint8_t *C2, uint8_t C3[32])
|
||||
{
|
||||
uint8_t K[inlen + 32];
|
||||
|
||||
sm9_kem_encrypt(mpk, id, idlen, sizeof(K), K, C1);
|
||||
gmssl_memxor(C2, K, in, inlen);
|
||||
sm3_hmac(K + inlen, 32, C2, inlen, C3);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int sm9_do_decrypt(const SM9_ENC_KEY *key, const char *id, size_t idlen,
|
||||
const uint8_t C1[64], const uint8_t *C2, size_t C2len, const uint8_t C3[32],
|
||||
uint8_t *out)
|
||||
{
|
||||
uint8_t K[C2len + 32];
|
||||
uint8_t mac[32];
|
||||
|
||||
sm9_kem_decrypt(key, id, idlen, C1, sizeof(K), K);
|
||||
sm3_hmac(K + C2len, 32, C2, C2len, mac);
|
||||
if (gmssl_secure_memcmp(C3, mac, sizeof(mac)) != 0) {
|
||||
error_print();
|
||||
return -1;
|
||||
}
|
||||
gmssl_memxor(out, K, C2, C2len);
|
||||
return 1;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user