First SM9 release

SM9 setup/keygen/sign/verify has been tested. See example codes `demos/sm9/`.

crypto/sm9/build.info

@@ -1,3 +1,3 @@
 LIBS=../../libcrypto
 SOURCE[../../libcrypto]=sm9_lib.c sm9_err.c sm9_asn1.c sm9_params.c \
-	sm9_setup.c sm9_keygen.c sm9_sign.c sm9_enc.c sm9_rate.c
+	sm9_setup.c sm9_keygen.c sm9_sign.c sm9_enc.c sm9_exch.c sm9_rate.c

crypto/sm9/sm9_asn1.c

@@ -116,3 +116,55 @@ int SM9PublicKey_gmtls_encode(SM9PublicKey *pk, unsigned char key[1024])
 {
 	return 0;
 }
+
+#ifndef OPENSSL_NO_STDIO
+SM9MasterSecret *d2i_SM9MasterSecret_fp(FILE *fp, SM9MasterSecret **msk)
+{
+	return ASN1_item_d2i_fp(ASN1_ITEM_rptr(SM9MasterSecret), fp, msk);
+}
+
+int i2d_SM9MasterSecret_fp(FILE *fp, SM9MasterSecret *msk)
+{
+	return ASN1_item_i2d_fp(ASN1_ITEM_rptr(SM9MasterSecret), fp, msk);
+}
+
+SM9PublicParameters *d2i_SM9PublicParameters_fp(FILE *fp, SM9PublicParameters **mpk)
+{
+	return ASN1_item_d2i_fp(ASN1_ITEM_rptr(SM9PublicParameters), fp, mpk);
+}
+
+int i2d_SM9PublicParameters_fp(FILE *fp, SM9PublicParameters *mpk)
+{
+	return ASN1_item_i2d_fp(ASN1_ITEM_rptr(SM9PublicParameters), fp, mpk);
+}
+
+SM9PrivateKey *d2i_SM9PrivateKey_fp(FILE *fp, SM9PrivateKey **sk)
+{
+	return ASN1_item_d2i_fp(ASN1_ITEM_rptr(SM9PrivateKey), fp, sk);
+}
+
+int i2d_SM9PrivateKey_fp(FILE *fp, SM9PrivateKey *sk)
+{
+	return ASN1_item_i2d_fp(ASN1_ITEM_rptr(SM9PrivateKey), fp, sk);
+}
+
+SM9Signature *d2i_SM9Signature_fp(FILE *fp, SM9Signature **sig)
+{
+	return ASN1_item_d2i_fp(ASN1_ITEM_rptr(SM9Signature), fp, sig);
+}
+
+int i2d_SM9Signature_fp(FILE *fp, SM9Signature *sig)
+{
+	return ASN1_item_i2d_fp(ASN1_ITEM_rptr(SM9Signature), fp, sig);
+}
+
+SM9Ciphertext *d2i_SM9Ciphertext_fp(FILE *fp, SM9Ciphertext **c)
+{
+	return ASN1_item_d2i_fp(ASN1_ITEM_rptr(SM9Ciphertext), fp, c);
+}
+
+int i2d_SM9Ciphertext_fp(FILE *fp, SM9Ciphertext *c)
+{
+	return ASN1_item_i2d_fp(ASN1_ITEM_rptr(SM9Ciphertext), fp, c);
+}
+#endif

crypto/sm9/sm9_enc.c

@@ -392,8 +392,8 @@ int SM9_encrypt(int type,
 		key[i] ^= in[i];
 	}
 
-	/* C3 = MAC(K2, C2) */
-	if (!HMAC(md, key + inlen, EVP_MD_size(md), key, inlen, mac, &maclen)) {
+	/* C3 = Hv(C2||K2) */
+	if (!EVP_Digest(key, keylen, mac, &maclen, md, NULL)) {
 		SM9err(SM9_F_SM9_ENCRYPT, ERR_R_EVP_LIB);
 		goto end;
 	}
@@ -489,8 +489,9 @@ int SM9_decrypt(int type,
 	}
 	*outlen = C2_len;
 
-	/* check C3 == MAC(K2, C2) */
-	if (!HMAC(md, key + C2_len, EVP_MD_size(md), key, C2_len, mac, &maclen)) {
+	/* C3 = Hv(C2||K2) */
+	memcpy(key, C2, C2_len);
+	if (!EVP_Digest(key, keylen, mac, &maclen, md, NULL)) {
 		SM9err(SM9_F_SM9_DECRYPT, ERR_R_EVP_LIB);
 		goto end;
 	}

crypto/sm9/sm9_err.c

@@ -35,6 +35,7 @@ static ERR_STRING_DATA SM9_str_functs[] = {
     {ERR_FUNC(SM9_F_SM9_EXTRACT_PRIVATE_KEY), "SM9_extract_private_key"},
     {ERR_FUNC(SM9_F_SM9_EXTRACT_PUBLIC_PARAMETERS),
      "SM9_extract_public_parameters"},
+    {ERR_FUNC(SM9_F_SM9_GENERATE_KEY_EXCHANGE), "SM9_generate_key_exchange"},
     {ERR_FUNC(SM9_F_SM9_GENERATE_MASTER_SECRET),
      "SM9_generate_master_secret"},
     {ERR_FUNC(SM9_F_SM9_SIGN), "SM9_sign"},

crypto/sm9/sm9_exch.c

@@ -1,5 +1,5 @@
 /* ====================================================================
- * Copyright (c) 2016 The GmSSL Project.  All rights reserved.
+ * Copyright (c) 2016 - 2018 The GmSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,21 +52,133 @@
 #include "sm9_lcl.h"
 
 /*
- * h = H1(ID_B || hid, N)
- * Q_B = [h]P1 + P_pub
- * r_A = rand(1, N-1)
- * R_A = [r_A]Q_B
+ * compute Q = H1(peer_id) * P1 + Ppube
+ * r = rand(1, n-1)
+ * R = r * Q
+ * g = e(Ppube, P2)
+ * g1' = g2 = g^r
+ * send R to peer
  */
-SM9PublicKey *SM9_generate_key_exchange(SM9PublicParameters *mpk,
-	const char *peer_id, size_t peer_idlen, BIGNUM **r)
+int SM9_generate_key_exchange(unsigned char *R, size_t *Rlen,
+	BIGNUM *r, unsigned char *gr, size_t *grlen,
+	const char *peer_id, size_t peer_idlen,
+	SM9PrivateKey *sk, int initiator)
 {
-	return NULL;
+	int ret = 0;
+	EC_GROUP *group = NULL;
+	EC_POINT *Ppube = NULL;
+	EC_POINT *Q = NULL;
+	BN_CTX *bn_ctx = NULL;
+	BIGNUM *h = NULL;
+	const EVP_MD *md;
+	int point_form = POINT_CONVERSION_COMPRESSED;
+	const BIGNUM *p = SM9_get0_prime();
+	const BIGNUM *n = SM9_get0_order();
+	fp12_t g;
+	int len;
+
+	if (!(group = EC_GROUP_new_by_curve_name(NID_sm9bn256v1))
+		|| !(Ppube = EC_POINT_new(group))
+		|| !(Q = EC_POINT_new(group))
+		|| !(bn_ctx = BN_CTX_new())) {
+		SM9err(SM9_F_SM9_GENERATE_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
+		goto end;
+	}
+	BN_CTX_start(bn_ctx);
+	if (!fp12_init(g, bn_ctx)) {
+		SM9err(SM9_F_SM9_GENERATE_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
+		goto end;
+	}
+
+	/* r = rand(1, n-1) */
+	do {
+		if (!BN_rand_range(r, n)) {
+			SM9err(SM9_F_SM9_GENERATE_KEY_EXCHANGE, ERR_R_BN_LIB);
+			goto end;
+		}
+	} while (BN_is_zero(r));
+
+	switch (OBJ_obj2nid(sk->hash1)) {
+	case NID_sm9hash1_with_sm3:
+		md = EVP_sm3();
+		break;
+	case NID_sm9hash1_with_sha256:
+		md = EVP_sha256();
+		break;
+	default:
+		SM9err(SM9_F_SM9_GENERATE_KEY_EXCHANGE, ERR_R_SM9_LIB);
+		goto end;
+	}
+
+	/* h = H1(peer_id) */
+	if (!SM9_hash1(md, &h, peer_id, peer_idlen, SM9_HID_EXCH, n, bn_ctx)) {
+		SM9err(SM9_F_SM9_GENERATE_KEY_EXCHANGE, ERR_R_SM9_LIB);
+		goto end;
+	}
+
+	/* get Ppube from sk */
+	if (!EC_POINT_oct2point(group, Ppube, ASN1_STRING_get0_data(sk->pointPpub),
+		ASN1_STRING_length(sk->pointPpub), bn_ctx)) {
+		SM9err(SM9_F_SM9_GENERATE_KEY_EXCHANGE, ERR_R_SM9_LIB);
+		goto end;
+	}
+
+	if (!EC_POINT_mul(group, Q, h, NULL, NULL, bn_ctx)
+		/* Q = H1(peer_id) * P1 + Ppube */
+		|| !EC_POINT_add(group, Q, Q, Ppube, bn_ctx)
+		/* R = r * Q */
+		|| !EC_POINT_mul(group, Q, NULL, Q, r, bn_ctx)
+		|| (len = EC_POINT_point2oct(group, Q, point_form, R, *Rlen, bn_ctx)) <= 0) {
+	}
+	*Rlen = len;
+
+	/* g = e(Ppube, P2) */
+	if (!rate_pairing(g, NULL, Ppube, bn_ctx)) {
+		SM9err(SM9_F_SM9_GENERATE_KEY_EXCHANGE, ERR_R_SM9_LIB);
+		goto end;
+	}
+
+	/* g1' = g2 = g^r */
+	if (!fp12_pow(g, g, r, p, bn_ctx) || !fp12_to_bin(g, gr)) {
+		SM9err(SM9_F_SM9_GENERATE_KEY_EXCHANGE, ERR_R_SM9_LIB);
+		goto end;
+	}
+
+	ret = 1;
+
+end:
+	EC_GROUP_free(group);
+	EC_POINT_free(Ppube);
+	EC_POINT_free(Q);
+	if (bn_ctx) {
+		BN_CTX_end(bn_ctx);
+	}
+	BN_CTX_free(bn_ctx);
+	BN_free(h);
+	fp12_cleanup(g);
+	return ret;
 }
 
-int SM9_compute_share_key(SM9PublicParameters *mpk,
-	unsigned char *out, size_t *outlen,
-	const char *peer_id, size_t peer_idlen, SM9PublicKey *peer_exch,
-	const char *id, size_t idlen, SM9PublicKey *exch,
+/*
+ * check peer's R in E(F_p)
+ * e = g2' = g1 = e(peer_R, sk)
+ * g3' = g3 = g2'^r = g1^r = er
+ * S' = H(0x82 || g1' || H(g2' || g3' || ID_A || ID_B || R_A || R_B))
+ * SA = H(0x83 || g1' || H(g2' || g3' || ID_A || ID_B || R_A || R_B))
+ * KA = KDF(ID_A || ID_B || R_A || R_B || g1' || g2' || g3')
+ *
+ * KB = KDF(ID_A || ID_B || R_A || R_B || g1 || g2 || g3)
+ * SB = H(0x82 || g1 || Hash(g2 || g3 || ID_A || ID_B || R_A || R_B))
+ * SA'= H(0x83 || g1 || Hash(g2 || g3 || ID_A || ID_B || R_A || R_B))
+ *
+ */
+int SM9_compute_share_key(unsigned char *key, size_t keylen,
+	unsigned char *peer_mac, size_t *peer_maclen, /* compure with received peer's mac */
+	unsigned char *mac, size_t *maclen, int compute_mac, /* send to peer */
+	const unsigned char *peer_R, size_t peer_Rlen, /* recv from peer */
+	const unsigned char *R, size_t Rlen, /* cached from SM9_generate_key_exchange */
+	const BIGNUM *r, /* cached from SM9_generate_key_exchange */
+	const char *peer_id, size_t peer_idlen,
 	SM9PrivateKey *sk, int initiator)
 {
 	return 0;

crypto/sm9/sm9_sign.c

@@ -1,5 +1,5 @@
 /* ====================================================================
- * Copyright (c) 2016 The GmSSL Project.  All rights reserved.
+ * Copyright (c) 2016 - 2018 The GmSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -171,7 +171,7 @@ SM9Signature *SM9_SignFinal(EVP_MD_CTX *ctx1, SM9PrivateKey *sk)
 		ASN1_STRING_length(sk->privatePoint), bn_ctx)) {
 		SM9err(SM9_F_SM9_SIGNFINAL, SM9_R_INVALID_PRIVATE_POINT);
 		goto end;
-	}	
+	}
 	/* S = l * sk */
 	len = sizeof(buf);
 	if (!EC_POINT_mul(group, S, NULL, S, r, bn_ctx)
@@ -335,9 +335,9 @@ int SM9_VerifyFinal(EVP_MD_CTX *ctx1, const SM9Signature *sig, SM9PublicKey *pk)
 	if (BN_cmp(h, sig->h) != 0) {
 		SM9err(SM9_F_SM9_VERIFYFINAL, SM9_R_VERIFY_FAILURE);
 		ret = 0;
+		goto end;
 	}
 
-
 	ret = 1;
 
 end:
@@ -352,8 +352,8 @@ end:
 	if (bn_ctx) {
 		BN_CTX_end(bn_ctx);
 	}
-	BN_CTX_free(bn_ctx);		
-	return ret;	
+	BN_CTX_free(bn_ctx);
+	return ret;
 }
 
 int SM9_sign(int type, /* NID_[sm3 | sha256] */
@@ -393,7 +393,7 @@ int SM9_sign(int type, /* NID_[sm3 | sha256] */
 	*siglen = len;
 	ret = 1;
 
-end:	
+end:
 	EVP_MD_CTX_free(ctx);
 	SM9Signature_free(sm9sig);
 	return ret;