Update SM9

CMakeLists.txt

@@ -45,6 +45,7 @@ add_library(
 	src/sm2_lib.c
 	src/sm3.c
 	src/sm3_hmac.c
+	src/sm3_kdf.c
 	src/sm4_common.c
 	src/sm4_enc.c
 	src/sm4_modes.c

include/gmssl/mem.h

@@ -58,6 +58,7 @@ void gmssl_memxor(void *r, const void *a, const void *b, size_t len);
 int gmssl_secure_memcmp(const volatile void * volatile in_a, const volatile void * volatile in_b, size_t len);
 void gmssl_secure_clear(void *ptr, size_t len);
 
+int mem_is_zero(const uint8_t *buf, size_t len);
 
 
 #endif

include/gmssl/sm3.h

@@ -91,6 +91,16 @@ void sm3_hmac(const uint8_t *key, size_t keylen,
 	uint8_t mac[SM3_HMAC_SIZE]);
 
 
+typedef struct {
+	SM3_CTX sm3_ctx;
+	size_t outlen;
+} SM3_KDF_CTX;
+
+void sm3_kdf_init(SM3_KDF_CTX *ctx, size_t outlen);
+void sm3_kdf_update(SM3_KDF_CTX *ctx, const uint8_t *data, size_t datalen);
+void sm3_kdf_finish(SM3_KDF_CTX *ctx, uint8_t *out);
+
+
 #ifdef __cplusplus
 }
 #endif

include/gmssl/sm9.h

@@ -268,7 +268,7 @@ void sm9_twist_point_add(sm9_twist_point_t *R, const sm9_twist_point_t *P, const
 void sm9_twist_point_sub(sm9_twist_point_t *R, const sm9_twist_point_t *P, const sm9_twist_point_t *Q);
 void sm9_twist_point_add_full(sm9_twist_point_t *R, const sm9_twist_point_t *P, const sm9_twist_point_t *Q);
 void sm9_twist_point_mul(sm9_twist_point_t *R, const sm9_bn_t k, const sm9_twist_point_t *P);
-void sm9_twist_point_mul_G(sm9_twist_point_t *R, const sm9_bn_t k);
+void sm9_twist_point_mul_generator(sm9_twist_point_t *R, const sm9_bn_t k);
 
 void sm9_eval_g_tangent(sm9_fp12_t num, sm9_fp12_t den, const sm9_twist_point_t *P, const sm9_point_t *Q);
 void sm9_eval_g_line(sm9_fp12_t num, sm9_fp12_t den, const sm9_twist_point_t *T, const sm9_twist_point_t *P, const sm9_point_t *Q);
@@ -302,9 +302,20 @@ int sm9_fn_equ(const sm9_fn_t a, const sm9_fn_t b);
 void sm9_fn_rand(sm9_fn_t r);
 void sm9_fp12_to_bytes(const sm9_fp12_t a, uint8_t buf[32 * 12]);
 
+int sm9_fn_from_hash(sm9_fn_t h, const uint8_t Ha[40]);
 
 int sm9_hash1(sm9_bn_t h1, const char *id, size_t idlen, uint8_t hid);
 
+int sm9_point_to_bytes(const sm9_point_t *P, uint8_t out[32 * 2]);
+int sm9_point_from_bytes(sm9_point_t *P, const uint8_t in[32 * 2]);
+int sm9_twist_point_to_bytes(const sm9_twist_point_t *P, uint8_t out[32 * 2]);
+int sm9_twist_point_from_bytes(sm9_twist_point_t *P, const uint8_t in[32 * 2]);
+
+
+
+
+
+
 // set the same value as sm2
 #define SM9_MAX_ID_BITS		65535
 #define SM9_MAX_ID_SIZE		(SM9_MAX_ID_BITS/8)
@@ -332,24 +343,29 @@ typedef struct {
 int sm9_sign_master_key_generate(SM9_SIGN_MASTER_KEY *master);
 int sm9_sign_master_key_extract_key(SM9_SIGN_MASTER_KEY *master, const char *id, size_t idlen, SM9_SIGN_KEY *key);
 
-typedef struct {
-	SM3_CTX sm3_ctx;
-	SM9_SIGN_KEY key;
-} SM9_SIGN_CTX;
 
 typedef struct {
 	sm9_fn_t h;
 	sm9_point_t S;
 } SM9_SIGNATURE;
 
+int sm9_do_sign(const SM9_SIGN_KEY *key, const SM3_CTX *sm3_ctx, SM9_SIGNATURE *sig);
+int sm9_do_verify(const SM9_SIGN_MASTER_KEY *mpk, const char *id, size_t idlen,
+	const SM3_CTX *sm3_ctx, const SM9_SIGNATURE *sig);
+
+
+typedef struct {
+	SM3_CTX sm3_ctx;
+} SM9_SIGN_CTX;
+
 int sm9_sign_init(SM9_SIGN_CTX *ctx);
 int sm9_sign_update(SM9_SIGN_CTX *ctx, const uint8_t *data, size_t datalen);
-int sm9_sign_finish(SM9_SIGN_CTX *ctx, SM9_SIGN_KEY *key, SM9_SIGNATURE *sig);
+int sm9_sign_finish(SM9_SIGN_CTX *ctx, const SM9_SIGN_KEY *key, uint8_t *sig, size_t *siglen);
 
 int sm9_verify_init(SM9_SIGN_CTX *ctx);
 int sm9_verify_update(SM9_SIGN_CTX *ctx, const uint8_t *data, size_t datalen);
-int sm9_verify_finish(SM9_SIGN_CTX *ctx, const SM9_SIGNATURE *sig,
+int sm9_verify_finish(SM9_SIGN_CTX *ctx, const uint8_t *sig, size_t siglen,
-	const SM9_SIGN_MASTER_KEY *master_public, const char *id, size_t idlen);
+	const SM9_SIGN_MASTER_KEY *mpk, const char *id, size_t idlen);
 
 
 typedef struct {
@@ -365,7 +381,12 @@ typedef struct {
 int sm9_enc_master_key_generate(SM9_ENC_MASTER_KEY *master);
 int sm9_enc_master_key_extract_key(SM9_ENC_MASTER_KEY *master, const char *id, size_t idlen, SM9_ENC_KEY *key);
 
-
+int sm9_kem_encrypt(const SM9_ENC_MASTER_KEY *mpk, const char *id, size_t idlen, size_t klen, uint8_t *kbuf, uint8_t cbuf[64]);
+int sm9_kem_decrypt(const SM9_ENC_KEY *key, const char *id, size_t idlen, const uint8_t cbuf[64], size_t klen, uint8_t *kbuf);
+int sm9_do_encrypt(const SM9_ENC_MASTER_KEY *mpk, const char *id, size_t idlen,
+	const uint8_t *in, size_t inlen, uint8_t C1[64], uint8_t *C2, uint8_t C3[32]);
+int sm9_do_decrypt(const SM9_ENC_KEY *key, const char *id, size_t idlen,
+	const uint8_t C1[64], const uint8_t *C2, size_t C2len, const uint8_t C3[32], uint8_t *out);
 
 #  ifdef  __cplusplus
 }

src/hex.c

@@ -240,3 +240,18 @@ void gmssl_secure_clear(void *ptr, size_t len)
 {
 	memset_func(ptr, 0, len);
 }
+
+int mem_is_zero(const uint8_t *buf, size_t len)
+{
+	int ret = 1;
+	size_t i;
+	for (i = 0; i < len; i++) {
+		if (buf[i]) ret = 0;
+	}
+	return ret;
+}
+
+
+
+
+

src/sm3_kdf.c

@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2014 - 2021 The GmSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the GmSSL Project.
+ *    (http://gmssl.org/)"
+ *
+ * 4. The name "GmSSL Project" must not be used to endorse or promote
+ *    products derived from this software without prior written
+ *    permission. For written permission, please contact
+ *    guanzhi1980@gmail.com.
+ *
+ * 5. Products derived from this software may not be called "GmSSL"
+ *    nor may "GmSSL" appear in their names without prior written
+ *    permission of the GmSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the GmSSL Project
+ *    (http://gmssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE GmSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE GmSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include <string.h>
+#include <gmssl/sm3.h>
+#include <gmssl/endian.h>
+#include <gmssl/error.h>
+
+
+void sm3_kdf_init(SM3_KDF_CTX *ctx, size_t outlen)
+{
+	sm3_init(&ctx->sm3_ctx);
+	ctx->outlen = outlen;
+}
+
+void sm3_kdf_update(SM3_KDF_CTX *ctx, const uint8_t *data, size_t datalen)
+{
+	sm3_update(&ctx->sm3_ctx, data, datalen);
+}
+
+void sm3_kdf_finish(SM3_KDF_CTX *ctx, uint8_t *out)
+{
+	SM3_CTX sm3_ctx;
+	size_t outlen = ctx->outlen;
+	uint8_t counter_be[4];
+	uint8_t dgst[SM3_DIGEST_SIZE];
+	uint32_t counter = 1;
+	size_t len;
+
+	while (outlen) {
+		PUTU32(counter_be, counter);
+		counter++;
+
+		sm3_ctx = ctx->sm3_ctx;
+		sm3_update(&sm3_ctx, counter_be, sizeof(counter_be));
+		sm3_finish(&sm3_ctx, dgst);
+
+		len = outlen < SM3_DIGEST_SIZE ? outlen : SM3_DIGEST_SIZE;
+		memcpy(out, dgst, len);
+		out += len;
+		outlen -= len;
+	}
+
+	memset(&sm3_ctx, 0, sizeof(SM3_CTX));
+	memset(dgst, 0, sizeof(dgst));
+}

src/sm9_alg.c

@@ -1687,7 +1687,7 @@ void sm9_twist_point_mul(sm9_twist_point_t *R, const sm9_bn_t k, const sm9_twist
 	sm9_twist_point_copy(R, Q);
 }
 
-void sm9_twist_point_mul_G(sm9_twist_point_t *R, const sm9_bn_t k)
+void sm9_twist_point_mul_generator(sm9_twist_point_t *R, const sm9_bn_t k)
 {
 	sm9_twist_point_mul(R, k, SM9_P2);
 }
@@ -1927,3 +1927,78 @@ void sm9_pairing(sm9_fp12_t r, const sm9_twist_point_t *Q, const sm9_point_t *P)
 	sm9_final_exponent(r, r);
 }
 
+void sm9_fn_add(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)
+{
+}
+
+void sm9_fn_sub(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)
+{
+}
+
+void sm9_fn_mul(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)
+{
+}
+
+void sm9_fn_inv(sm9_fn_t r, const sm9_fn_t a)
+{
+}
+
+int sm9_fn_is_zero(const sm9_fn_t a)
+{
+	return 0;
+}
+void sm9_fn_rand(sm9_fn_t r)
+{
+	// FIXME: add impl
+}
+
+int sm9_fn_equ(const sm9_fn_t a, const sm9_fn_t b)
+{
+	// FIXME: add impl
+	return 1;
+}
+
+// for H1() and H2()
+// h = (Ha mod (n-1)) + 1;  h in [1, n-1], n is the curve order, Ha is 40 bytes from hash
+int sm9_fn_from_hash(sm9_fn_t h, const uint8_t Ha[40])
+{
+	return 1;
+}
+
+void sm9_fp12_to_bytes(const sm9_fp12_t a, uint8_t buf[32 * 12])
+{
+	// FIXME: add impl
+}
+
+int sm9_point_to_bytes(const sm9_point_t *P, uint8_t out[32 * 2])
+{
+	// FIXME
+	return 1;
+}
+
+int sm9_point_from_bytes(sm9_point_t *P, const uint8_t in[32 * 2])
+{
+	// FIXME
+	return 1;
+}
+
+int sm9_twist_point_to_bytes(const sm9_twist_point_t *P, uint8_t out[32 * 2])
+{
+	// FIXME
+	return 1;
+}
+
+int sm9_twist_point_from_bytes(sm9_twist_point_t *P, const uint8_t in[32 * 2])
+{
+	// FIXME
+	return 1;
+}
+
+
+
+
+
+
+
+
+

src/sm9_key.c

@@ -54,116 +54,99 @@
 #include <gmssl/error.h>
 
 
-
-
-
 // generate h1 in [1, n-1]
 int sm9_hash1(sm9_bn_t h1, const char *id, size_t idlen, uint8_t hid)
 {
-	sm9_fn_t h;
+	SM3_CTX ctx;
-	SM3_CTX ctx1;
-	SM3_CTX ctx2;
-
 	uint8_t prefix[1] = {0x01};
 	uint8_t ct1[4] = {0x00, 0x00, 0x00, 0x01};
 	uint8_t ct2[4] = {0x00, 0x00, 0x00, 0x02};
-	uint8_t buf[64];
+	uint8_t Ha[64];
 
-	sm3_init(&ctx1);
+	sm3_init(&ctx);
-	sm3_update(&ctx1, prefix, sizeof(prefix));
+	sm3_update(&ctx, prefix, sizeof(prefix));
-	sm3_update(&ctx1, (uint8_t *)id, idlen);
+	sm3_update(&ctx, (uint8_t *)id, idlen);
-	sm3_update(&ctx1, &hid, 1);
+	sm3_update(&ctx, &hid, 1);
-	ctx2 = ctx1;
+	sm3_update(&ctx, ct1, sizeof(ct1));
-	sm3_update(&ctx1, ct1, sizeof(ct1));
+	sm3_finish(&ctx, Ha);
-	sm3_update(&ctx2, ct2, sizeof(ct2));
-	sm3_finish(&ctx1, buf);
-	sm3_finish(&ctx2, buf + 32);
 
-	// 这个buflen == 64，我们要将长为40的部分取出来，模 N-1  再加1
+	sm3_init(&ctx);
-	return -1;
+	sm3_update(&ctx, prefix, sizeof(prefix));
+	sm3_update(&ctx, (uint8_t *)id, idlen);
+	sm3_update(&ctx, &hid, 1);
+	sm3_update(&ctx, ct2, sizeof(ct2));
+	sm3_finish(&ctx, Ha + 32);
+
+	sm9_fn_from_hash(h1, Ha);
+	return 1;
 }
 
-void sm9_fn_add(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)
+int sm9_sign_master_key_generate(SM9_SIGN_MASTER_KEY *msk)
-{
-}
-
-void sm9_fn_sub(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)
-{
-}
-
-void sm9_fn_mul(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)
-{
-}
-
-void sm9_fn_inv(sm9_fn_t r, const sm9_fn_t a)
-{
-}
-
-int sm9_fn_is_zero(const sm9_fn_t a)
-{
-	return 0;
-}
-
-int sm9_sign_master_key_generate(SM9_SIGN_MASTER_KEY *master)
 {
 	// k = rand(1, n-1)
-	//sm9_bn_rand_range(master->ks, SM9_N);
+	sm9_fn_rand(msk->ks);
 
 	// Ppubs = k * P2 in E'(F_p^2)
-	sm9_twist_point_mul_G(&master->Ppubs, master->ks);
+	sm9_twist_point_mul_generator(&msk->Ppubs, msk->ks);
 
 	return 1;
 }
 
-int sm9_enc_master_key_generate(SM9_ENC_MASTER_KEY *master)
+int sm9_enc_master_key_generate(SM9_ENC_MASTER_KEY *msk)
 {
 	// k = rand(1, n-1)
-	//sm9_bn_rand_range(master->ke, SM9_N);
+	sm9_fn_rand(msk->ke);
 
 	// Ppube = ke * P1 in E(F_p)
-	sm9_point_mul_generator(&master->Ppube, master->ke);
+	sm9_point_mul_generator(&msk->Ppube, msk->ke);
 
 	return 1;
 }
 
-int sm9_sign_master_key_extract_key(SM9_SIGN_MASTER_KEY *master, const char *id, size_t idlen, SM9_SIGN_KEY *key)
+int sm9_sign_master_key_extract_key(SM9_SIGN_MASTER_KEY *msk, const char *id, size_t idlen, SM9_SIGN_KEY *key)
 {
 	sm9_fn_t t;
 
+	// t1 = H1(ID || hid, N) + ks
 	sm9_hash1(t, id, idlen, SM9_HID_SIGN);
-	sm9_fn_add(t, t, master->ks);
+	sm9_fn_add(t, t, msk->ks);
 	if (sm9_fn_is_zero(t)) {
+		// 这是一个严重问题，意味着整个msk都需要作废了
 		error_print();
 		return -1;
 	}
+
+	// t2 = ks * t1^-1
 	sm9_fn_inv(t, t);
-	sm9_fn_mul(t, t, master->ks);
+	sm9_fn_mul(t, t, msk->ks);
+
+	// ds = t2 * P1
 	sm9_point_mul_generator(&key->ds, t);
+	key->Ppubs = msk->Ppubs;
+
 	return 1;
 }
 
-int sm9_enc_master_key_extract_key(SM9_ENC_MASTER_KEY *master, const char *id, size_t idlen,
+int sm9_enc_master_key_extract_key(SM9_ENC_MASTER_KEY *msk, const char *id, size_t idlen,
 	SM9_ENC_KEY *key)
 {
 	sm9_fn_t t;
 
+	// t1 = H1(ID || hid, N) + ke
 	sm9_hash1(t, id, idlen, SM9_HID_ENC);
-	sm9_fn_add(t, t, master->ke);
+	sm9_fn_add(t, t, msk->ke);
 	if (sm9_fn_is_zero(t)) {
 		error_print();
 		return -1;
 	}
+
+	// t2 = ke * t1^-1
 	sm9_fn_inv(t, t);
-	sm9_fn_mul(t, t, master->ke);
+	sm9_fn_mul(t, t, msk->ke);
-	sm9_twist_point_mul_G(&key->de, t);
+
+	// de = t2 * P2
+	sm9_twist_point_mul_generator(&key->de, t);
+	key->Ppube = msk->Ppube;
+
 	return 1;
 }
-
-
-
-
-
-
-
-
-

src/sm9_lib.c

@@ -1,4 +1,4 @@
-/*
+/*
  * Copyright (c) 2014 - 2020 The GmSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -50,27 +50,12 @@
 #include <string.h>
 #include <stdlib.h>
 #include <stdint.h>
+#include <gmssl/mem.h>
 #include <gmssl/sm3.h>
 #include <gmssl/sm9.h>
 #include <gmssl/error.h>
 
 
-void sm9_fn_rand(sm9_fn_t r)
-{
-	// FIXME: add impl
-}
-
-int sm9_fn_equ(const sm9_fn_t a, const sm9_fn_t b)
-{
-	// FIXME: add impl
-	return 1;
-}
-
-void sm9_fp12_to_bytes(const sm9_fp12_t a, uint8_t buf[32 * 12])
-{
-	// FIXME: add impl
-}
-
 int sm9_sign_init(SM9_SIGN_CTX *ctx)
 {
 	const uint8_t prefix[1] = {0x02};
@@ -85,26 +70,56 @@ int sm9_sign_update(SM9_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
 	return 1;
 }
 
-int sm9_sign_finish(SM9_SIGN_CTX *ctx, SM9_SIGN_KEY *key, SM9_SIGNATURE *sig)
+int sm9_sign_finish(SM9_SIGN_CTX *ctx, const SM9_SIGN_KEY *key, uint8_t *sig, size_t *siglen)
+{
+	return -1;
+}
+
+int sm9_do_sign(const SM9_SIGN_KEY *key, const SM3_CTX *sm3_ctx, SM9_SIGNATURE *sig)
 {
 	sm9_fn_t r;
-	sm9_fn_t h;
 	sm9_fp12_t g;
-	sm9_fp12_t w;
 	uint8_t wbuf[32 * 12];
-	uint8_t dgst[32];
+	SM3_CTX ctx = *sm3_ctx;
+	SM3_CTX tmp_ctx;
+	uint8_t ct1[4] = {0,0,0,1};
+	uint8_t ct2[4] = {0,0,0,2};
+	uint8_t Ha[64];
 
+	// A1: g = e(P1, Ppubs)
 	sm9_pairing(g, &key->Ppubs, SM9_P1);
+
 	do {
+		// A2: rand r in [1, N-1]
 		sm9_fn_rand(r);
-		sm9_fp12_pow(w, g, r);
+
-		sm9_fp12_to_bytes(w, wbuf);
+		// A3: w = g^r
-		sm3_update(&ctx->sm3_ctx, wbuf, sizeof(wbuf));
+		sm9_fp12_pow(g, g, r);
-		sm3_finish(&ctx->sm3_ctx, dgst);
+		sm9_fp12_to_bytes(g, wbuf);
-		// do H2() staff, generate output sig->h
+
-		sm9_fn_sub(r, r, h);
+		// A4: h = H2(M || w, N)
+		sm3_update(&ctx, wbuf, sizeof(wbuf));
+		tmp_ctx = ctx;
+		sm3_update(&ctx, ct1, sizeof(ct1));
+		sm3_finish(&ctx, Ha);
+		sm3_update(&tmp_ctx, ct2, sizeof(ct2));
+		sm3_finish(&tmp_ctx, Ha + 32);
+		sm9_fn_from_hash(sig->h, Ha);
+
+		// A5: l = (r - h) mod N, if l = 0, goto A2
+		sm9_fn_sub(r, r, sig->h);
+
 	} while (sm9_fn_is_zero(r));
+
+	// A6: S = l * dsA
 	sm9_point_mul(&sig->S, r, &key->ds);
+
+	gmssl_secure_clear(&r, sizeof(r));
+	gmssl_secure_clear(&g, sizeof(g));
+	gmssl_secure_clear(wbuf, sizeof(wbuf));
+	gmssl_secure_clear(&tmp_ctx, sizeof(tmp_ctx));
+	gmssl_secure_clear(Ha, sizeof(Ha));
+
 	return 1;
 }
 
@@ -122,9 +137,14 @@ int sm9_verify_update(SM9_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
 	return 1;
 }
 
-// 签名的时候
+int sm9_verify_finish(SM9_SIGN_CTX *ctx, const uint8_t *sig, size_t siglen,
-int sm9_verify_finish(SM9_SIGN_CTX *ctx, const SM9_SIGNATURE *sig,
+	const SM9_SIGN_MASTER_KEY *mpk, const char *id, size_t idlen)
-	const SM9_SIGN_MASTER_KEY *master_public, const char *id, size_t idlen)
+{
+	return -1;
+}
+
+int sm9_do_verify(const SM9_SIGN_MASTER_KEY *mpk, const char *id, size_t idlen,
+	const SM3_CTX *sm3_ctx, const SM9_SIGNATURE *sig)
 {
 	sm9_fn_t h1;
 	sm9_fn_t h2;
@@ -134,23 +154,163 @@ int sm9_verify_finish(SM9_SIGN_CTX *ctx, const SM9_SIGNATURE *sig,
 	sm9_fp12_t w;
 	sm9_twist_point_t P;
 	uint8_t wbuf[32 * 12];
+	SM3_CTX ctx = *sm3_ctx;
+	SM3_CTX tmp_ctx;
+	uint8_t ct1[4] = {0,0,0,1};
+	uint8_t ct2[4] = {0,0,0,2};
+	uint8_t Ha[64];
 
-	sm9_pairing(g, &master_public->Ppubs, SM9_P1);
+	// B1: check h in [1, N-1]
+
+	// B2: check S in G1
+
+	// B3: g = e(P1, Ppubs)
+	sm9_pairing(g, &mpk->Ppubs, SM9_P1);
+
+	// B4: t = g^h
 	sm9_fp12_pow(t, g, sig->h);
+
+	// B5: h1 = H1(ID || hid, N)
 	sm9_hash1(h1, id, idlen, SM9_HID_SIGN);
-	sm9_twist_point_mul_G(&P, h1);
+
-	sm9_twist_point_add(&P, &P, &master_public->Ppubs);
+	// B6: P = h1 * P2 + Ppubs
+	sm9_twist_point_mul_generator(&P, h1);
+	sm9_twist_point_add(&P, &P, &mpk->Ppubs);
+
+	// B7: u = e(S, P)
 	sm9_pairing(u, &P, &sig->S);
+
+	// B8: w = u * t
 	sm9_fp12_mul(w, u, t);
 	sm9_fp12_to_bytes(w, wbuf);
 
-	sm3_update(&ctx->sm3_ctx, wbuf, sizeof(wbuf));
+	// B9: h2 = H2(M || w, N), check h2 == h
-	// convert h2
+	sm3_update(&ctx, wbuf, sizeof(wbuf));
-
+	tmp_ctx = ctx;
+	sm3_update(&ctx, ct1, sizeof(ct1));
+	sm3_finish(&ctx, Ha);
+	sm3_update(&tmp_ctx, ct2, sizeof(ct2));
+	sm3_finish(&tmp_ctx, Ha + 32);
+	sm9_fn_from_hash(h2, Ha);
 	if (sm9_fn_equ(h2, sig->h) != 1) {
 		return 0;
 	}
+
 	return 1;
 }
 
+int sm9_kem_encrypt(const SM9_ENC_MASTER_KEY *mpk, const char *id, size_t idlen,
+	size_t klen, uint8_t *kbuf, uint8_t cbuf[64])
+{
+	sm9_fn_t r;
+	sm9_fp12_t w;
+	sm9_point_t C;
+	uint8_t wbuf[32 * 12];
+	SM3_KDF_CTX kdf_ctx;
 
+	// A1: Q = H1(ID||hid,N) * P1 + Ppube
+	sm9_hash1(r, id, idlen, SM9_HID_EXCH);
+	sm9_point_mul(&C, r, SM9_P1);
+	sm9_point_add(&C, &C, &mpk->Ppube);
+
+	do {
+		// A2: rand r in [1, N-1]
+		sm9_fn_rand(r);
+
+		// A3: C1 = r * Q
+		sm9_point_mul(&C, r, &C);
+		sm9_point_to_bytes(&C, cbuf);
+
+		// A4: g = e(Ppube, P2)
+		sm9_pairing(w, SM9_P2, &mpk->Ppube);
+
+		// A5: w = g^r
+		sm9_fp12_pow(w, w, r);
+		sm9_fp12_to_bytes(w, wbuf);
+
+		// A6: K = KDF(C || w || ID_B, klen), if K == 0, goto A2
+		sm3_kdf_init(&kdf_ctx, klen);
+		sm3_kdf_update(&kdf_ctx, cbuf, 64);
+		sm3_kdf_update(&kdf_ctx, wbuf, sizeof(wbuf));
+		sm3_kdf_update(&kdf_ctx, (uint8_t *)id, idlen);
+		sm3_kdf_finish(&kdf_ctx, kbuf);
+
+	} while (mem_is_zero(kbuf, klen) == 1);
+
+	gmssl_secure_clear(&r, sizeof(r));
+	gmssl_secure_clear(&w, sizeof(w));
+	gmssl_secure_clear(&C, sizeof(C));
+	gmssl_secure_clear(wbuf, sizeof(wbuf));
+	gmssl_secure_clear(&kdf_ctx, sizeof(kdf_ctx));
+
+	// A7: output (K, C)
+	return 1;
+}
+
+int sm9_kem_decrypt(const SM9_ENC_KEY *key, const char *id, size_t idlen, const uint8_t cbuf[64],
+	size_t klen, uint8_t *kbuf)
+{
+	sm9_fp12_t w;
+	sm9_point_t C;
+	uint8_t wbuf[32 * 12];
+	SM3_KDF_CTX kdf_ctx;
+
+	// B1: check C in G1
+	if (sm9_point_from_bytes(&C, cbuf) != 1) {
+		error_print();
+		return -1;
+	}
+
+	// B2: w = e(C, de);
+	sm9_pairing(w, &key->de, &C);
+
+	// B3: K = KDF(C || w || ID, klen)
+	sm3_kdf_init(&kdf_ctx, klen);
+	sm3_kdf_update(&kdf_ctx, cbuf, 64);
+	sm3_kdf_update(&kdf_ctx, wbuf, sizeof(wbuf));
+	sm3_kdf_update(&kdf_ctx, (uint8_t *)id, idlen);
+	sm3_kdf_finish(&kdf_ctx, kbuf);
+
+	if (mem_is_zero(kbuf, klen) != 1) {
+		error_print();
+		return -1;
+	}
+
+	gmssl_secure_clear(&w, sizeof(w));
+	gmssl_secure_clear(&C, sizeof(C));
+	gmssl_secure_clear(wbuf, sizeof(wbuf));
+	gmssl_secure_clear(&kdf_ctx, sizeof(kdf_ctx));
+
+	// B4: output K
+	return 1;
+}
+
+int sm9_do_encrypt(const SM9_ENC_MASTER_KEY *mpk, const char *id, size_t idlen,
+	const uint8_t *in, size_t inlen,
+	uint8_t C1[64], uint8_t *C2, uint8_t C3[32])
+{
+	uint8_t K[inlen + 32];
+
+	sm9_kem_encrypt(mpk, id, idlen, sizeof(K), K, C1);
+	gmssl_memxor(C2, K, in, inlen);
+	sm3_hmac(K + inlen, 32, C2, inlen, C3);
+
+	return 1;
+}
+
+int sm9_do_decrypt(const SM9_ENC_KEY *key, const char *id, size_t idlen,
+	const uint8_t C1[64], const uint8_t *C2, size_t C2len, const uint8_t C3[32],
+	uint8_t *out)
+{
+	uint8_t K[C2len + 32];
+	uint8_t mac[32];
+
+	sm9_kem_decrypt(key, id, idlen, C1, sizeof(K), K);
+	sm3_hmac(K + C2len, 32, C2, C2len, mac);
+	if (gmssl_secure_memcmp(C3, mac, sizeof(mac)) != 0) {
+		error_print();
+		return -1;
+	}
+	gmssl_memxor(out, K, C2, C2len);
+	return 1;
+}

tests/hash_drbgtest.c

@@ -99,7 +99,6 @@ int main(void)
 	hex_to_bytes(PR1, strlen(PR1), pr1, &pr1_len);
 	hex_to_bytes(PR2, strlen(PR2), pr2, &pr2_len);
 
-
 	hash_drbg_init(&drbg, DIGEST_sha1(),
 		entropy, entropy_len,
 		nonce, nonce_len,
@@ -111,6 +110,7 @@ int main(void)
 		|| memcmp(drbg.C, c, clen) != 0
 		|| drbg.reseed_counter != 1) {
 		printf("failed\n");
+		return 1;
 	} else {
 		printf("ok\n");
 	}
@@ -118,7 +118,6 @@ int main(void)
 	hash_drbg_reseed(&drbg, pr1, pr1_len, NULL, 0);
 	hash_drbg_generate(&drbg, NULL, 0, 640/8, out);
 
-
 	hash_drbg_reseed(&drbg, pr2, pr2_len, NULL, 0);
 	hash_drbg_generate(&drbg, NULL, 0, 640/8, out);
 

tests/sm9test.c

@@ -388,7 +388,7 @@ int test_sm9_twist_point() {
 	sm9_twist_point_add_full(&r, &p, &q); if (!sm9_twist_point_equ(&r, &s)) goto err; ++j;
 	sm9_twist_point_sub(&r, &p, &q); sm9_twist_point_from_hex(&s, hex_tpoint_sub); if (!sm9_twist_point_equ(&r, &s)) goto err; ++j;
 	sm9_twist_point_mul(&r, k, &p);  sm9_twist_point_from_hex(&s, hex_tpoint_mul); if (!sm9_twist_point_equ(&r, &s)) goto err; ++j;
-	sm9_twist_point_mul_G(&r, k);    sm9_twist_point_from_hex(&s, hex_tpoint_mulg); if (!sm9_twist_point_equ(&r, &s)) goto err; ++j;
+	sm9_twist_point_mul_generator(&r, k);    sm9_twist_point_from_hex(&s, hex_tpoint_mulg); if (!sm9_twist_point_equ(&r, &s)) goto err; ++j;
 	
 	printf("%s() ok\n", __FUNCTION__);
 	return 1;