abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-08-06 11:53:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

Update tools help

Browse Source
This commit is contained in:
Zhi Guan
2026-06-26 18:06:53 +08:00
parent e43f9e306d
commit a77feb2b4c
25 changed files with 256 additions and 217 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tools/certgen.c
View File

@@ -111,12 +111,12 @@ static char *usage =
" gmssl sm2keygen -pass P@ssw0rd -out rootcakey.pem\n"
"\n"
" gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN ROOTCA -days 3650 \\\n"
" -key rootcakey.pem -pass P@ssw0rd \\\n"
" -ca -path_len_constraint 6 \\\n"
" -key_usage keyCertSign -key_usage cRLSign \\\n"
" -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
" -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
" -out rootcacert.pem\n"
" -key rootcakey.pem -pass P@ssw0rd \\\n"
" -ca -path_len_constraint 6 \\\n"
" -key_usage keyCertSign -key_usage cRLSign \\\n"
" -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
" -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
" -out rootcacert.pem\n"
"\n";

21
tools/gmssl.c
View File

@@ -160,10 +160,18 @@ static const char *options =
" sm3 Generate SM3 hash\n"
" sm3hmac Generate SM3 HMAC tag\n"
" sm3_pbkdf2 Hash password into key using PBKDF2 algoritm\n"
" sm4 Encrypt or decrypt with SM4\n"
" sm4_gcm Encrypt or decrypt with SM4 GCM\n"
#ifdef ENABLE_SM4_ECB
" sm4_ecb Encrypt or decrypt with SM4 ECB\n"
#endif
" sm4_cbc Encrypt or decrypt with SM4 CBC\n"
#ifdef ENABLE_SM4_CFB
" sm4_cfb Encrypt or decrypt with SM4 CFB\n"
#endif
#ifdef ENABLE_SM4_OFB
" sm4_ofb Encrypt or decrypt with SM4 OFB\n"
#endif
" sm4_ctr Encrypt or decrypt with SM4 CTR\n"
" sm4_gcm Encrypt or decrypt with SM4 GCM\n"
#ifdef ENABLE_SM4_CCM
" sm4_ccm Encrypt or decrypt with SM4 CCM\n"
#endif
@@ -173,15 +181,6 @@ static const char *options =
#ifdef ENABLE_SM4_FF1
" sm4_ff1 Encrypt or decrypt digits with SM4 FF1\n"
#endif
#ifdef ENABLE_SM4_ECB
" sm4_ecb Encrypt or decrypt with SM4 ECB\n"
#endif
#ifdef ENABLE_SM4_CFB
" sm4_cfb Encrypt or decrypt with SM4 CFB\n"
#endif
#ifdef ENABLE_SM4_OFB
" sm4_ofb Encrypt or decrypt with SM4 OFB\n"
#endif
#ifdef ENABLE_SM4_CBC_MAC
" sm4_cbc_mac Generate SM4 CBC-MAC\n"
#endif

24
tools/reqsign.c
View File

@@ -112,12 +112,12 @@ static char *usage =
"\n"
" gmssl sm2keygen -pass P@ssw0rd -out rootcakey.pem\n"
" gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN ROOTCA -days 3650 \\\n"
" -key rootcakey.pem -pass P@ssw0rd \\\n"
" -ca -path_len_constraint 6 \\\n"
" -key_usage keyCertSign -key_usage cRLSign \\\n"
" -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
" -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
" -out rootcacert.pem\n"
" -key rootcakey.pem -pass P@ssw0rd \\\n"
" -ca -path_len_constraint 6 \\\n"
" -key_usage keyCertSign -key_usage cRLSign \\\n"
" -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
" -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
" -out rootcacert.pem\n"
"\n"
" # Generate sub-CA certificate request\n"
"\n"
@@ -127,12 +127,12 @@ static char *usage =
" # Sign certificate request to generate sub-CA certificate\n"
"\n"
" gmssl reqsign -in careq.pem -serial_len 12 -days 365 \\\n"
" -cacert rootcacert.pem -key rootcakey.pem -pass P@ssw0rd \\\n"
" -ca -path_len_constraint 0 \\\n"
" -key_usage keyCertSign -key_usage cRLSign \\\n"
" -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
" -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
" -out cacert.pem\n"
" -cacert rootcacert.pem -key rootcakey.pem -pass P@ssw0rd \\\n"
" -ca -path_len_constraint 0 \\\n"
" -key_usage keyCertSign -key_usage cRLSign \\\n"
" -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
" -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
" -out cacert.pem\n"
"\n";
static int ext_key_usage_set(int *usages, const char *usage_name)

44
tools/sm2exch.c
View File

@@ -80,36 +80,36 @@ static const char *options =
" gmssl sm2keygen -pass P@ssw0rd -out alice.pem -pubout alicepub.pem\n"
" gmssl sm2keygen -pass P@ssw0rd -out bob.pem -pubout bobpub.pem\n"
" gmssl sm2exch -stage init \\\n"
" -exch_keyout alice_ra.pem -exch_pass P@ssw0rd -out ra.hex\n"
" -exch_keyout alice_ra.pem -exch_pass P@ssw0rd -out ra.hex\n"
" gmssl sm2exch -stage respond \\\n"
" -key bob.pem -pass P@ssw0rd -id Bob \\\n"
" -peer_pubkey alicepub.pem -peer_id Alice -in ra.hex \\\n"
" -exch_keyout bob_rb.pem -exch_pass P@ssw0rd \\\n"
" -secret_state_out bob_secret_state.hex -out rb_sb.hex\n"
" -key bob.pem -pass P@ssw0rd -id Bob \\\n"
" -peer_pubkey alicepub.pem -peer_id Alice -in ra.hex \\\n"
" -exch_keyout bob_rb.pem -exch_pass P@ssw0rd \\\n"
" -secret_state_out bob_secret_state.hex -out rb_sb.hex\n"
" gmssl sm2exch -stage confirm \\\n"
" -key alice.pem -pass P@ssw0rd -id Alice \\\n"
" -peer_pubkey bobpub.pem -peer_id Bob \\\n"
" -exch_key alice_ra.pem -exch_pass P@ssw0rd -in rb_sb.hex \\\n"
" -keylen 48 -keyout alice_shared_key.hex -out sa.hex\n"
" -key alice.pem -pass P@ssw0rd -id Alice \\\n"
" -peer_pubkey bobpub.pem -peer_id Bob \\\n"
" -exch_key alice_ra.pem -exch_pass P@ssw0rd -in rb_sb.hex \\\n"
" -keylen 48 -keyout alice_shared_key.hex -out sa.hex\n"
" gmssl sm2exch -stage finish \\\n"
" -key bob.pem -pass P@ssw0rd -id Bob \\\n"
" -peer_pubkey alicepub.pem -peer_id Alice \\\n"
" -exch_key bob_rb.pem -exch_pass P@ssw0rd \\\n"
" -secret_state bob_secret_state.hex -in sa.hex \\\n"
" -keylen 48 -keyout bob_shared_key.hex\n"
" -key bob.pem -pass P@ssw0rd -id Bob \\\n"
" -peer_pubkey alicepub.pem -peer_id Alice \\\n"
" -exch_key bob_rb.pem -exch_pass P@ssw0rd \\\n"
" -secret_state bob_secret_state.hex -in sa.hex \\\n"
" -keylen 48 -keyout bob_shared_key.hex\n"
"\n"
"Certificate workflow:\n"
"\n"
" gmssl sm2exch -stage respond \\\n"
" -key bob_enc_key.pem -pass P@ssw0rd -id Bob \\\n"
" -peer_cert alice_enc_cert.pem -peer_id Alice -in ra.hex \\\n"
" -exch_keyout bob_rb.pem -exch_pass P@ssw0rd \\\n"
" -secret_state_out bob_secret_state.hex -out rb_sb.hex\n"
" -key bob_enc_key.pem -pass P@ssw0rd -id Bob \\\n"
" -peer_cert alice_enc_cert.pem -peer_id Alice -in ra.hex \\\n"
" -exch_keyout bob_rb.pem -exch_pass P@ssw0rd \\\n"
" -secret_state_out bob_secret_state.hex -out rb_sb.hex\n"
" gmssl sm2exch -stage confirm \\\n"
" -key alice_enc_key.pem -pass P@ssw0rd -id Alice \\\n"
" -peer_cert bob_enc_cert.pem -peer_id Bob \\\n"
" -exch_key alice_ra.pem -exch_pass P@ssw0rd -in rb_sb.hex \\\n"
" -keyout alice_shared_key.hex -out sa.hex\n"
" -key alice_enc_key.pem -pass P@ssw0rd -id Alice \\\n"
" -peer_cert bob_enc_cert.pem -peer_id Bob \\\n"
" -exch_key alice_ra.pem -exch_pass P@ssw0rd -in rb_sb.hex \\\n"
" -keyout alice_shared_key.hex -out sa.hex\n"
"\n"
"Notes\n"
"\n"

93
tools/sm4_cbc.c
View File

@@ -18,7 +18,7 @@
#include <gmssl/error.h>
static const char *usage = "{-encrypt|-decrypt} -key hex -iv hex [-in file] [-out file]";
static const char *usage = "{-encrypt|-decrypt} -key hex -iv hex [-pkcs7_padding] [-in file] [-out file]";
static const char *options =
"\n"
@@ -28,16 +28,20 @@ static const char *options =
" -decrypt Decrypt\n"
" -key hex Symmetric key in HEX format\n"
" -iv hex IV in HEX format\n"
" -in file | stdin Input data\n"
" -pkcs7_padding Enable PKCS#7 padding\n"
" Encrypt input can be any byte length; decrypt input must be a multiple of 16 bytes\n"
" -in file | stdin Input data. Without `-pkcs7_padding`, input length must be a multiple of 16 bytes\n"
" -out file | stdout Output data\n"
"\n"
"Examples\n"
"\n"
" $ TEXT=`gmssl rand -outlen 20 -hex`\n"
" $ KEY=`gmssl rand -outlen 16 -hex`\n"
" $ IV=`gmssl rand -outlen 16 -hex`\n"
" $ echo -n $TEXT | gmssl sm4_cbc -encrypt -key $KEY -iv $IV -out sm4_cbc_ciphertext.bin\n"
" $ gmssl sm4_cbc -decrypt -key $KEY -iv $IV -in sm4_cbc_ciphertext.bin\n"
" KEY=`gmssl rand -outlen 16 -hex`\n"
" IV=`gmssl rand -outlen 16 -hex`\n"
" echo -n 0123456789abcdef | gmssl sm4_cbc -encrypt -key $KEY -iv $IV -out sm4_cbc_ciphertext.bin\n"
" gmssl sm4_cbc -decrypt -key $KEY -iv $IV -in sm4_cbc_ciphertext.bin\n"
"\n"
" echo -n abc | gmssl sm4_cbc -encrypt -pkcs7_padding -key $KEY -iv $IV -out sm4_cbc_ciphertext.bin\n"
" gmssl sm4_cbc -decrypt -pkcs7_padding -key $KEY -iv $IV -in sm4_cbc_ciphertext.bin\n"
"\n";
int sm4_cbc_main(int argc, char **argv)
@@ -49,16 +53,25 @@ int sm4_cbc_main(int argc, char **argv)
char *ivhex = NULL;
char *infile = NULL;
char *outfile = NULL;
int pkcs7_padding = 0;
uint8_t key[16];
size_t keylen;
uint8_t iv[16];
size_t ivlen;
FILE *infp = stdin;
FILE *outfp = stdout;
SM4_KEY sm4_key;
SM4_CBC_CTX ctx;
uint8_t buf[4096];
uint8_t outbuf[4096];
uint8_t block[16];
size_t block_nbytes = 0;
size_t inlen;
size_t outlen;
size_t nblocks;
size_t len;
size_t left;
size_t inpos;
argc--;
argv++;
@@ -108,6 +121,8 @@ int sm4_cbc_main(int argc, char **argv)
fprintf(stderr, "gmssl %s: invalid IV hex digits\n", prog);
goto end;
}
} else if (!strcmp(*argv, "-pkcs7_padding")) {
pkcs7_padding = 1;
} else if (!strcmp(*argv, "-in")) {
if (--argc < 1) goto bad;
infile = *(++argv);
@@ -147,33 +162,74 @@ bad:
goto end;
}
if (enc) {
if (pkcs7_padding && enc) {
if (sm4_cbc_encrypt_init(&ctx, key, iv) != 1) {
error_print();
goto end;
}
} else {
} else if (pkcs7_padding) {
if (sm4_cbc_decrypt_init(&ctx, key, iv) != 1) {
error_print();
goto end;
}
} else if (enc) {
sm4_set_encrypt_key(&sm4_key, key);
} else {
sm4_set_decrypt_key(&sm4_key, key);
}
while ((inlen = fread(buf, 1, sizeof(buf), infp)) > 0) {
if (enc) {
if (pkcs7_padding && enc) {
if (sm4_cbc_encrypt_update(&ctx, buf, inlen, buf, &outlen) != 1) {
error_print();
goto end;
}
} else {
} else if (pkcs7_padding) {
if (sm4_cbc_decrypt_update(&ctx, buf, inlen, buf, &outlen) != 1) {
error_print();
goto end;
}
} else {
outlen = 0;
inpos = 0;
if (block_nbytes) {
left = sizeof(block) - block_nbytes;
if (inlen < left) {
memcpy(block + block_nbytes, buf, inlen);
block_nbytes += inlen;
continue;
}
memcpy(block + block_nbytes, buf, left);
if (enc) {
sm4_cbc_encrypt_blocks(&sm4_key, iv, block, 1, outbuf);
} else {
sm4_cbc_decrypt_blocks(&sm4_key, iv, block, 1, outbuf);
}
outlen = sizeof(block);
inpos = left;
block_nbytes = 0;
}
nblocks = (inlen - inpos) / sizeof(block);
len = nblocks * sizeof(block);
if (len) {
if (enc) {
sm4_cbc_encrypt_blocks(&sm4_key, iv, buf + inpos, nblocks, outbuf + outlen);
} else {
sm4_cbc_decrypt_blocks(&sm4_key, iv, buf + inpos, nblocks, outbuf + outlen);
}
outlen += len;
inpos += len;
}
if (inlen > inpos) {
block_nbytes = inlen - inpos;
memcpy(block, buf + inpos, block_nbytes);
}
}
if (fwrite(buf, 1, outlen, outfp) != outlen) {
if (fwrite(pkcs7_padding ? buf : outbuf, 1, outlen, outfp) != outlen) {
fprintf(stderr, "gmssl %s: output failure : %s\n", prog, strerror(errno));
goto end;
}
@@ -183,16 +239,22 @@ bad:
goto end;
}
if (enc) {
if (pkcs7_padding && enc) {
if (sm4_cbc_encrypt_finish(&ctx, buf, &outlen) != 1) {
error_print();
goto end;
}
} else {
} else if (pkcs7_padding) {
if (sm4_cbc_decrypt_finish(&ctx, buf, &outlen) != 1) {
error_print();
goto end;
}
} else {
if (block_nbytes) {
fprintf(stderr, "gmssl %s: input length must be multiple of 16 bytes when PKCS#7 padding is not enabled\n", prog);
goto end;
}
outlen = 0;
}
if (fwrite(buf, 1, outlen, outfp) != outlen) {
fprintf(stderr, "gmssl %s: output failure : %s\n", prog, strerror(errno));
@@ -204,7 +266,10 @@ bad:
end:
gmssl_secure_clear(key, sizeof(key));
gmssl_secure_clear(iv, sizeof(iv));
gmssl_secure_clear(&sm4_key, sizeof(sm4_key));
gmssl_secure_clear(&ctx, sizeof(ctx));
gmssl_secure_clear(outbuf, sizeof(outbuf));
gmssl_secure_clear(block, sizeof(block));
gmssl_secure_clear(buf, sizeof(buf));
if (infile && infp) fclose(infp);
if (outfile && outfp) fclose(outfp);

17
tools/sm4_cbc_mac.c
View File

@@ -20,11 +20,12 @@
static const char *usage = "-key hex [-in file | -in_str str] [-bin|-hex] [-out file]";
static const char *help =
"\n"
"Options\n"
"\n"
" -key hex Hex string of the MAC key, 16 bytes\n"
" -in_str str Input as text string\n"
" -in file | stdin Input file path\n"
" -in_str str Input as text string, any byte length is accepted\n"
" -in file | stdin Input file path, any byte length is accepted\n"
" `-in_str` and `-in` should not be used together\n"
" If neither `-in` nor `-in_str` specified, read from stdin\n"
" -hex Output MAC-tag as hex string (by default)\n"
@@ -34,20 +35,20 @@ static const char *help =
"\n"
"Examples\n"
"\n"
" KEY_HEX=`gmssl rand -outlen 16 -hex`\n"
" gmssl sm4_cbc_mac -key $KEY_HEX -in_str abc\n"
" KEY=`gmssl rand -outlen 16 -hex`\n"
" gmssl sm4_cbc_mac -key $KEY -in_str abc\n"
"\n"
" gmssl sm4_cbc_mac -key $KEY_HEX -in_str abc -bin\n"
" gmssl sm4_cbc_mac -key $KEY -in_str abc -bin\n"
"\n"
" gmssl sm4_cbc_mac -key $KEY_HEX -in /path/to/file\n"
" gmssl sm4_cbc_mac -key $KEY -in /path/to/file\n"
"\n"
" When reading from stdin, make sure the trailing newline character is removed\n"
"\n"
" Linux/Mac:\n"
" echo -n abc | gmssl sm4_cbc_mac -key $KEY_HEX\n"
" echo -n abc | gmssl sm4_cbc_mac -key $KEY\n"
"\n"
" Windows:\n"
" C:\\> echo |set/p=\"abc\" | gmssl sm4_cbc_mac -key 11223344556677881122334455667788\n"
" echo |set/p=\"abc\" | gmssl sm4_cbc_mac -key 11223344556677881122334455667788\n"
"\n";
int sm4_cbc_mac_main(int argc, char **argv)

14
tools/sm4_ccm.c
View File

@@ -21,6 +21,7 @@
static const char *usage = "{-encrypt|-decrypt} -key hex -iv hex [-aad str| -aad_hex hex] [-taglen num] [-in file] [-out file]";
static const char *options =
"\n"
"Options\n"
"\n"
" -encrypt Encrypt\n"
@@ -30,17 +31,16 @@ static const char *options =
" -aad str Authenticated-only message\n"
" -aad_hex hex Authenticated-only data in HEX format\n"
" -taglen num MAC tag length, 4 to 16 bytes\n"
" -in file | stdin Input data\n"
" -in file | stdin Input data. Encrypt input can be any byte length within CCM limits\n"
" Decrypt input is ciphertext || tag and must be at least taglen bytes\n"
" -out file | stdout Output data\n"
"\n"
"Examples\n"
"\n"
" $ TEXT=`gmssl rand -outlen 20 -hex`\n"
" $ KEY=`gmssl rand -outlen 16 -hex`\n"
" $ IV=`gmssl rand -outlen 12 -hex`\n"
" $ AAD=\"The AAD Data\"\n"
" $ echo -n $TEXT | gmssl sm4_ccm -encrypt -key $KEY -iv $IV -aad $AAD -out sm4_ccm_ciphertext.bin\n"
" $ gmssl sm4_ccm -decrypt -key $KEY -iv $IV -aad $AAD -in sm4_ccm_ciphertext.bin\n"
" KEY=`gmssl rand -outlen 16 -hex`\n"
" IV=`gmssl rand -outlen 12 -hex`\n"
" echo -n abc | gmssl sm4_ccm -encrypt -key $KEY -iv $IV -aad_hex 001122 -out sm4_ccm_ciphertext.bin\n"
" gmssl sm4_ccm -decrypt -key $KEY -iv $IV -aad_hex 001122 -in sm4_ccm_ciphertext.bin\n"
"\n";
static uint8_t *read_content(FILE *infp, size_t *outlen, const char *prog)

19
tools/sm4_cfb.c
View File

@@ -29,22 +29,21 @@ static const char *options =
" -decrypt Decrypt\n"
" -key hex Symmetric key in HEX format\n"
" -iv hex IV in HEX format\n"
" -in file | stdin Input data\n"
" -in file | stdin Input data, any byte length is accepted\n"
" -out file | stdout Output data\n"
"\n"
"Examples\n"
"\n"
" $ TEXT=`gmssl rand -outlen 20 -hex`\n"
" $ KEY=`gmssl rand -outlen 16 -hex`\n"
" $ IV=`gmssl rand -outlen 16 -hex`\n"
" $ echo -n $TEXT | gmssl sm4_cfb -encrypt -key $KEY -iv $IV -out sm4_cfb128_ciphertext.bin\n"
" $ gmssl sm4_cfb -decrypt -key $KEY -iv $IV -in sm4_cfb128_ciphertext.bin\n"
" KEY=`gmssl rand -outlen 16 -hex`\n"
" IV=`gmssl rand -outlen 16 -hex`\n"
" echo -n abc | gmssl sm4_cfb -encrypt -key $KEY -iv $IV -out sm4_cfb128_ciphertext.bin\n"
" gmssl sm4_cfb -decrypt -key $KEY -iv $IV -in sm4_cfb128_ciphertext.bin\n"
"\n"
" $ echo -n $TEXT | gmssl sm4_cfb -sbytes 1 -encrypt -key $KEY -iv $IV -out sm4_cfb8_ciphertext.bin\n"
" $ gmssl sm4_cfb -sbytes 1 -decrypt -key $KEY -iv $IV -in sm4_cfb8_ciphertext.bin\n"
" echo -n abc | gmssl sm4_cfb -sbytes 1 -encrypt -key $KEY -iv $IV -out sm4_cfb8_ciphertext.bin\n"
" gmssl sm4_cfb -sbytes 1 -decrypt -key $KEY -iv $IV -in sm4_cfb8_ciphertext.bin\n"
"\n"
" $ echo -n $TEXT | gmssl sm4_cfb -sbytes 8 -encrypt -key $KEY -iv $IV -out sm4_cfb64_ciphertext.bin\n"
" $ gmssl sm4_cfb -sbytes 8 -decrypt -key $KEY -iv $IV -in sm4_cfb64_ciphertext.bin\n"
" echo -n 01234567 | gmssl sm4_cfb -sbytes 8 -encrypt -key $KEY -iv $IV -out sm4_cfb64_ciphertext.bin\n"
" gmssl sm4_cfb -sbytes 8 -decrypt -key $KEY -iv $IV -in sm4_cfb64_ciphertext.bin\n"
"\n";
int sm4_cfb_main(int argc, char **argv)

11
tools/sm4_ctr.c
View File

@@ -28,16 +28,15 @@ static const char *options =
" -decrypt Decrypt\n"
" -key hex Symmetric key in HEX format\n"
" -iv hex IV in HEX format\n"
" -in file | stdin Input data\n"
" -in file | stdin Input data, any byte length is accepted\n"
" -out file | stdout Output data\n"
"\n"
"Examples\n"
"\n"
" $ TEXT=`gmssl rand -outlen 20 -hex`\n"
" $ KEY=`gmssl rand -outlen 16 -hex`\n"
" $ IV=`gmssl rand -outlen 16 -hex`\n"
" $ echo -n $TEXT | gmssl sm4_ctr -key $KEY -iv $IV -out sm4_ctr_ciphertext.bin\n"
" $ gmssl sm4_ctr -key $KEY -iv $IV -in sm4_ctr_ciphertext.bin\n"
" KEY=`gmssl rand -outlen 16 -hex`\n"
" IV=`gmssl rand -outlen 16 -hex`\n"
" echo -n abc | gmssl sm4_ctr -encrypt -key $KEY -iv $IV -out sm4_ctr_ciphertext.bin\n"
" gmssl sm4_ctr -decrypt -key $KEY -iv $IV -in sm4_ctr_ciphertext.bin\n"
"\n";
int sm4_ctr_main(int argc, char **argv)

9
tools/sm4_ecb.c
View File

@@ -27,15 +27,14 @@ static const char *options =
" -encrypt Encrypt\n"
" -decrypt Decrypt\n"
" -key hex Symmetric key in HEX format\n"
" -in file | stdin Input data\n"
" -in file | stdin Input data, length must be a multiple of 16 bytes\n"
" -out file | stdout Output data\n"
"\n"
"Examples\n"
"\n"
" $ TEXT=`gmssl rand -outlen 32 -hex`\n"
" $ KEY=`gmssl rand -outlen 16 -hex`\n"
" $ echo -n $TEXT | gmssl sm4_ecb -encrypt -key $KEY -out sm4_ecb_ciphertext.bin\n"
" $ gmssl sm4_ecb -decrypt -key $KEY -in sm4_ecb_ciphertext.bin\n"
" KEY=`gmssl rand -outlen 16 -hex`\n"
" echo -n 0123456789abcdef | gmssl sm4_ecb -encrypt -key $KEY -out sm4_ecb_ciphertext.bin\n"
" gmssl sm4_ecb -decrypt -key $KEY -in sm4_ecb_ciphertext.bin\n"
"\n";
int sm4_ecb_main(int argc, char **argv)

12
tools/sm4_ff1.c
View File

@@ -34,9 +34,15 @@ static const char *options =
" -decrypt Decrypt\n"
" -key hex SM4 key in HEX format\n"
" -tweak hex FF1 tweak in HEX format\n"
" -digits digits Input digits, default from stdin\n"
" -idcard Input is a Chinese resident identity card number\n"
" -bankcard Input is a bank card number with Luhn check digit\n"
" -digits digits Input digits, default from stdin. Length must be 8 to 18 digits\n"
" -idcard Input is a Chinese resident identity card number, 18 characters\n"
" -bankcard Input is a bank card number with Luhn check digit, 9 to 19 digits\n"
"\n"
"Examples\n"
"\n"
" KEY=`gmssl rand -outlen 16 -hex`\n"
" CIPHERTEXT=`gmssl sm4_ff1 -encrypt -key $KEY -digits 0123456789012345`\n"
" gmssl sm4_ff1 -decrypt -key $KEY -digits $CIPHERTEXT\n"
"\n";
static uint8_t *read_content(FILE *infp, size_t *outlen, const char *prog)

14
tools/sm4_gcm.c
View File

@@ -21,6 +21,7 @@
static const char *usage = "{-encrypt|-decrypt} -key hex -iv hex [-aad str| -aad_hex hex] [-taglen num] [-in file] [-out file]";
static const char *options =
"\n"
"Options\n"
"\n"
" -encrypt Encrypt\n"
@@ -30,17 +31,16 @@ static const char *options =
" -aad str Authenticated-only message\n"
" -aad_hex hex Authenticated-only data in HEX format\n"
" -taglen num MAC tag length, default 16 bytes\n"
" -in file | stdin Input data\n"
" -in file | stdin Input data. Encrypt input can be any byte length\n"
" Decrypt input is ciphertext || tag and must be at least taglen bytes\n"
" -out file | stdout Output data\n"
"\n"
"Examples\n"
"\n"
" $ TEXT=`gmssl rand -outlen 20 -hex`\n"
" $ KEY=`gmssl rand -outlen 16 -hex`\n"
" $ IV=`gmssl rand -outlen 12 -hex`\n"
" $ AAD=\"The AAD Data\"\n"
" $ echo -n $TEXT | gmssl sm4_gcm -encrypt -key $KEY -iv $IV -aad $AAD -out sm4_gcm_ciphertext.bin\n"
" $ gmssl sm4_gcm -decrypt -key $KEY -iv $IV -aad $AAD -in sm4_gcm_ciphertext.bin\n"
" KEY=`gmssl rand -outlen 16 -hex`\n"
" IV=`gmssl rand -outlen 12 -hex`\n"
" echo -n abc | gmssl sm4_gcm -encrypt -key $KEY -iv $IV -aad_hex 001122 -out sm4_gcm_ciphertext.bin\n"
" gmssl sm4_gcm -decrypt -key $KEY -iv $IV -aad_hex 001122 -in sm4_gcm_ciphertext.bin\n"
"\n";
int sm4_gcm_main(int argc, char **argv)

11
tools/sm4_ofb.c
View File

@@ -28,16 +28,15 @@ static const char *options =
" -decrypt Decrypt\n"
" -key hex Symmetric key in HEX format\n"
" -iv hex IV in HEX format\n"
" -in file | stdin Input data\n"
" -in file | stdin Input data, any byte length is accepted\n"
" -out file | stdout Output data\n"
"\n"
"Examples\n"
"\n"
" $ TEXT=`gmssl rand -outlen 32 -hex`\n"
" $ KEY=`gmssl rand -outlen 16 -hex`\n"
" $ IV=`gmssl rand -outlen 16 -hex`\n"
" $ echo -n $TEXT | gmssl sm4_ofb -encrypt -key $KEY -iv $IV -out sm4_ofb_ciphertext.bin\n"
" $ gmssl sm4_ofb -decrypt -key $KEY -iv $IV -in sm4_ofb_ciphertext.bin\n"
" KEY=`gmssl rand -outlen 16 -hex`\n"
" IV=`gmssl rand -outlen 16 -hex`\n"
" echo -n abc | gmssl sm4_ofb -encrypt -key $KEY -iv $IV -out sm4_ofb_ciphertext.bin\n"
" gmssl sm4_ofb -decrypt -key $KEY -iv $IV -in sm4_ofb_ciphertext.bin\n"
"\n";
int sm4_ofb_main(int argc, char **argv)

14
tools/sm4_xts.c
View File

@@ -21,6 +21,7 @@
static const char *usage = "{-encrypt|-decrypt} -key hex -iv hex -data_unit_size num [-in file] [-out file]";
static const char *options =
"\n"
"Options\n"
"\n"
" -encrypt Encrypt\n"
@@ -28,16 +29,17 @@ static const char *options =
" -key hex Symmetric key in HEX format, 32 bytes\n"
" -iv hex IV (tweak in XTS), 16 bytes\n"
" -data_unit_size num Encrypted disk sector size, typically 512 or 4096 bytes\n"
" -in file | stdin Input data\n"
" Input and output lengths must be multiples of this size\n"
" -in file | stdin Input data, length must be a multiple of data_unit_size\n"
" -out file | stdout Output data\n"
"\n"
"Examples\n"
"\n"
" $ DATA=`gmssl rand -outlen 2048`\n"
" $ KEY=`gmssl rand -outlen 32 -hex`\n"
" $ IV=`gmssl rand -outlen 16 -hex`\n"
" $ echo -n $DATA | gmssl sm4_xts -encrypt -key $KEY -iv $IV -data_unit_size 512 -out sm4_xts_ciphertext.bin\n"
" $ gmssl sm4_xts -decrypt -key $KEY -iv $IV -data_unit_size 512 -in sm4_xts_ciphertext.bin\n"
" KEY=`gmssl rand -outlen 32 -hex`\n"
" IV=`gmssl rand -outlen 16 -hex`\n"
" gmssl rand -outlen 512 -out sm4_xts_plaintext.bin\n"
" gmssl sm4_xts -encrypt -key $KEY -iv $IV -data_unit_size 512 -in sm4_xts_plaintext.bin -out sm4_xts_ciphertext.bin\n"
" gmssl sm4_xts -decrypt -key $KEY -iv $IV -data_unit_size 512 -in sm4_xts_ciphertext.bin -out sm4_xts_decrypted.bin\n"
"\n";
int sm4_xts_main(int argc, char **argv)

28
tools/sm9exch.c
View File

@@ -69,26 +69,26 @@ static const char *options =
"Examples\n"
"\n"
" gmssl sm9setup -alg sm9encrypt -pass P@ssw0rd \\\n"
" -out sm9_msk.pem -pubout sm9_mpk.pem\n"
" -out sm9_msk.pem -pubout sm9_mpk.pem\n"
" gmssl sm9keygen -alg sm9keyagreement -in sm9_msk.pem -inpass P@ssw0rd \\\n"
" -id Alice -out alice.pem -outpass 123456\n"
" -id Alice -out alice.pem -outpass 123456\n"
" gmssl sm9keygen -alg sm9keyagreement -in sm9_msk.pem -inpass P@ssw0rd \\\n"
" -id Bob -out bob.pem -outpass 123456\n"
" -id Bob -out bob.pem -outpass 123456\n"
" gmssl sm9exch -stage init \\\n"
" -pubmaster sm9_mpk.pem -peer_id Bob \\\n"
" -exch_keyout alice_ra.pem -out ra.hex\n"
" -pubmaster sm9_mpk.pem -peer_id Bob \\\n"
" -exch_keyout alice_ra.pem -out ra.hex\n"
" gmssl sm9exch -stage respond \\\n"
" -pubmaster sm9_mpk.pem -key bob.pem -pass 123456 -id Bob \\\n"
" -peer_id Alice -in ra.hex \\\n"
" -exch_keyout bob_rb.pem -out rb_sb.hex\n"
" -pubmaster sm9_mpk.pem -key bob.pem -pass 123456 -id Bob \\\n"
" -peer_id Alice -in ra.hex \\\n"
" -exch_keyout bob_rb.pem -out rb_sb.hex\n"
" gmssl sm9exch -stage confirm \\\n"
" -pubmaster sm9_mpk.pem -key alice.pem -pass 123456 -id Alice \\\n"
" -peer_id Bob -exch_key alice_ra.pem -in rb_sb.hex \\\n"
" -keylen 48 -keyout alice_shared_key.hex -out sa.hex\n"
" -pubmaster sm9_mpk.pem -key alice.pem -pass 123456 -id Alice \\\n"
" -peer_id Bob -exch_key alice_ra.pem -in rb_sb.hex \\\n"
" -keylen 48 -keyout alice_shared_key.hex -out sa.hex\n"
" gmssl sm9exch -stage finish \\\n"
" -pubmaster sm9_mpk.pem -key bob.pem -pass 123456 -id Bob \\\n"
" -peer_id Alice -exch_key bob_rb.pem \\\n"
" -in sa.hex -keylen 48 -keyout bob_shared_key.hex\n"
" -pubmaster sm9_mpk.pem -key bob.pem -pass 123456 -id Bob \\\n"
" -peer_id Alice -exch_key bob_rb.pem \\\n"
" -in sa.hex -keylen 48 -keyout bob_shared_key.hex\n"
"\n"
"Notes\n"
"\n"

3
tools/tls12_client.c
View File

@@ -38,8 +38,7 @@ static const char *help =
" -server_name str Send server_name (SNI) request\n"
" -trusted_ca_keys Send trusted_ca_keys request\n"
" -renegotiation_info Send renegotiation_info extension\n"
" -renegotiation_info_scsv\n"
" Send TLS_EMPTY_RENEGOTIATION_INFO_SCSV\n"
" -renegotiation_info_scsv Send TLS_EMPTY_RENEGOTIATION_INFO_SCSV\n"
" -status_request Send status_request (OCSP Stapling) request\n"
" -get path Send a HTTP GET request and read response until close or timeout\n"
" -in file | stdin Send input data and read response until close or timeout\n"

4
tools/tls13_client.c
View File

@@ -188,7 +188,7 @@ static const char *help =
" -key pem Client's encrypted private key in PEM format\n"
" -pass str Password to decrypt private key, prompt if not given\n"
" -server_name str Send server_name (SNI) request\n"
" -signature_algorithms_cert Send signature_algorithms_cert extension\n"
" -signature_algorithms_cert Send signature_algorithms_cert extension\n"
" -certificate_authorities Send certificate_authorities extension\n"
" -status_request Send status_request (OCSP Stapling) request\n"
" -ct Send signed_certificate_timestamp (SCT) request\n"
@@ -203,7 +203,7 @@ static const char *help =
" -key_update_seq_num num Send KeyUpdate handshake after sending/receiving <num> records\n"
" -post_handshake_auth Support post_handshake_auth\n"
" -client_cert_optional Allow client send empty Certificate\n"
" -tls13_change_cipher_spec Support ChangeCipherSpec in TLS 1.3 to be compatible with middlebox\n"
" -tls13_change_cipher_spec Support ChangeCipherSpec in TLS 1.3 to be compatible with middlebox\n"
" -get path Send a HTTP GET request and read response until close or timeout\n"
" -in file | stdin Send input data and read response until close or timeout\n"
" -verbose Print TLS handshake messages\n"

2
tools/tls13_server.c
View File

@@ -46,7 +46,7 @@ static const char *help =
" -new_session_ticket num Send NewSessionTicket <num> times\n"
" -ticket_key hex Session ticket encrypt/decrypt key in HEX format\n"
" -key_update_seq_num num Send KeyUpdate handshake after sending/receiving <num> records\n"
" -tls13_change_cipher_spec Support ChangeCipherSpec in TLS 1.3 to be compatible with middlebox\n"
" -tls13_change_cipher_spec Support ChangeCipherSpec in TLS 1.3 to be compatible with middlebox\n"
" -verbose Print TLS handshake messages\n"
"\n"
#include "tls13_help.h"

37
tools/zuc_128_eea3.c
View File

@@ -21,7 +21,7 @@
static const char *usage =
"-key hex -count num -bearer num -direction num [-in file|-in_hex hex] [-out file]";
"-key hex -count num -bearer num -direction num [-in file] [-out file]";
static const char *help =
"Options\n"
@@ -30,17 +30,14 @@ static const char *help =
" -count num COUNT parameter, 32-bit integer, decimal or 0x-prefixed hex\n"
" -bearer num BEARER parameter, 5-bit integer in [0, 31]\n"
" -direction num DIRECTION parameter, 0 or 1\n"
" -in_hex hex Input bytes in HEX format\n"
" -in file | stdin Input file path\n"
" `-in_hex` and `-in` should not be used together\n"
" If neither `-in_hex` nor `-in` specified, read from stdin\n"
" -in file | stdin Input file path. If not specified, read from stdin\n"
" -out file | stdout Output ciphertext bytes. If not specified, output to stdout\n"
"\n"
"Examples\n"
"\n"
" gmssl zuc_128_eea3 -key 173d14ba5003731d7a60049470f00a29 \\\n"
" -count 0x66035492 -bearer 15 -direction 0 \\\n"
" -in_hex 6cf65340735552ab0c9752fa6f9025fe0bd675d9005875b2 -out ciphertext.bin\n"
" -in plaintext.bin -out ciphertext.bin\n"
"\n";
static int parse_uint64(const char *s, uint64_t max, uint64_t *out)
@@ -117,7 +114,6 @@ int zuc_128_eea3_main(int argc, char **argv)
int ret = 1;
char *prog = argv[0];
char *keyhex = NULL;
char *inhex = NULL;
char *infile = NULL;
char *outfile = NULL;
uint8_t key[ZUC_KEY_SIZE];
@@ -191,18 +187,7 @@ int zuc_128_eea3_main(int argc, char **argv)
}
direction = (ZUC_BIT)v;
direction_set = 1;
} else if (!strcmp(*argv, "-in_hex")) {
if (infile) {
fprintf(stderr, "gmssl %s: `-in` and `-in_hex` should not be used together\n", prog);
goto end;
}
if (--argc < 1) goto bad;
inhex = *(++argv);
} else if (!strcmp(*argv, "-in")) {
if (inhex) {
fprintf(stderr, "gmssl %s: `-in` and `-in_hex` should not be used together\n", prog);
goto end;
}
if (--argc < 1) goto bad;
infile = *(++argv);
if (!(infp = fopen(infile, "rb"))) {
@@ -237,21 +222,7 @@ bad:
goto end;
}
if (inhex) {
if (strlen(inhex) % 2) {
fprintf(stderr, "gmssl %s: invalid input hex length\n", prog);
goto end;
}
nbytes = strlen(inhex) / 2;
if (!(in = (uint8_t *)malloc(nbytes ? nbytes : 1))) {
fprintf(stderr, "gmssl %s: malloc failure\n", prog);
goto end;
}
if (hex_to_bytes(inhex, strlen(inhex), in, &inlen) != 1) {
fprintf(stderr, "gmssl %s: invalid input hex digits\n", prog);
goto end;
}
} else if (!(in = read_content(infp, &inlen, prog))) {
if (!(in = read_content(infp, &inlen, prog))) {
goto end;
}
nbytes = inlen;

39
tools/zuc_128_eia3.c
View File

@@ -21,7 +21,7 @@
static const char *usage =
"-key hex -count num -bearer num -direction num [-in file|-in_hex hex] [-hex|-bin] [-out file]";
"-key hex -count num -bearer num -direction num [-in file] [-hex|-bin] [-out file]";
static const char *help =
"Options\n"
@@ -30,10 +30,7 @@ static const char *help =
" -count num COUNT parameter, 32-bit integer, decimal or 0x-prefixed hex\n"
" -bearer num BEARER parameter, 5-bit integer in [0, 31]\n"
" -direction num DIRECTION parameter, 0 or 1\n"
" -in_hex hex Input message bytes in HEX format\n"
" -in file | stdin Input file path\n"
" `-in_hex` and `-in` should not be used together\n"
" If neither `-in_hex` nor `-in` specified, read from stdin\n"
" -in file | stdin Input file path. If not specified, read from stdin\n"
" -hex Output MAC as hex string (by default)\n"
" -bin Output MAC as binary\n"
" `-hex` and `-bin` should not be used together\n"
@@ -42,7 +39,7 @@ static const char *help =
"Examples\n"
"\n"
" gmssl zuc_128_eia3 -key 00000000000000000000000000000000 \\\n"
" -count 0 -bearer 0 -direction 0 -in_hex 00\n"
" -count 0 -bearer 0 -direction 0 -in message.bin\n"
"\n";
static int parse_uint64(const char *s, uint64_t max, uint64_t *out)
@@ -119,7 +116,6 @@ int zuc_128_eia3_main(int argc, char **argv)
int ret = 1;
char *prog = argv[0];
char *keyhex = NULL;
char *inhex = NULL;
char *infile = NULL;
char *outfile = NULL;
int outformat = 0;
@@ -128,7 +124,6 @@ int zuc_128_eia3_main(int argc, char **argv)
uint8_t *in = NULL;
size_t inlen = 0;
size_t nbits;
size_t nbytes = 0;
uint64_t v;
ZUC_UINT32 count = 0;
ZUC_UINT5 bearer = 0;
@@ -191,18 +186,7 @@ int zuc_128_eia3_main(int argc, char **argv)
}
direction = (ZUC_BIT)v;
direction_set = 1;
} else if (!strcmp(*argv, "-in_hex")) {
if (infile) {
fprintf(stderr, "gmssl %s: `-in` and `-in_hex` should not be used together\n", prog);
goto end;
}
if (--argc < 1) goto bad;
inhex = *(++argv);
} else if (!strcmp(*argv, "-in")) {
if (inhex) {
fprintf(stderr, "gmssl %s: `-in` and `-in_hex` should not be used together\n", prog);
goto end;
}
if (--argc < 1) goto bad;
infile = *(++argv);
if (!(infp = fopen(infile, "rb"))) {
@@ -249,24 +233,9 @@ bad:
goto end;
}
if (inhex) {
if (strlen(inhex) % 2) {
fprintf(stderr, "gmssl %s: invalid input hex length\n", prog);
goto end;
}
nbytes = strlen(inhex) / 2;
if (!(in = (uint8_t *)malloc(nbytes ? nbytes : 1))) {
fprintf(stderr, "gmssl %s: malloc failure\n", prog);
goto end;
}
if (hex_to_bytes(inhex, strlen(inhex), in, &inlen) != 1) {
fprintf(stderr, "gmssl %s: invalid input hex digits\n", prog);
goto end;
}
} else if (!(in = read_content(infp, &inlen, prog))) {
if (!(in = read_content(infp, &inlen, prog))) {
goto end;
}
nbytes = inlen;
nbits = inlen * 8;
macword = zuc_eia_generate_mac((ZUC_UINT32 *)in, nbits, key, count, bearer, direction);