Update SM9 key exchange

CMakeLists.txt

@@ -499,7 +499,8 @@ if (ENABLE_SM9)
 		src/sm9_key.c
 		src/sm9_sign.c
 		src/sm9_enc.c
-		src/sm9_exch.c)
+		src/sm9_exch.c
+		src/sm9_cms.c)
 	list(APPEND tools
 		tools/sm9setup.c
 		tools/sm9keygen.c
@@ -703,6 +704,9 @@ if (ENABLE_QUIC)
 		message(STATUS "ENABLE_QUIC is ON")
 		add_definitions(-DENABLE_QUIC)
 		list(APPEND src src/quic.c)
+		list(APPEND tools
+			tools/quic_client.c
+			tools/quic_server.c)
 		list(APPEND tests quic)
 	else()
 		message(STATUS "ENABLE_QUIC requires ENABLE_TLS and ENABLE_SHA2; disabled")
@@ -1006,7 +1010,7 @@ endif()
 #
 set(CPACK_PACKAGE_NAME "GmSSL")
 set(CPACK_PACKAGE_VENDOR "GmSSL develop team")
-set(CPACK_PACKAGE_VERSION "3.3.0-dev.1167")
+set(CPACK_PACKAGE_VERSION "3.3.0-dev.1168")
 set(CPACK_PACKAGE_DESCRIPTION_FILE ${PROJECT_SOURCE_DIR}/README.md)
 set(CPACK_NSIS_MODIFY_PATH ON)
 include(CPack)

include/gmssl/sm9.h

@@ -52,7 +52,7 @@ int sm9_algor_from_der(int *alg, int *params, const uint8_t **in, size_t *inlen)
 #define PEM_SM9_ENC_PRIVATE_KEY		"ENCRYPTED PRIVATE KEY" //"ENCRYPTED SM9 ENC PRIVATE KEY"
 
 
-#define SM9_MAX_ID_SIZE		(SM2_MAX_ID_SIZE)
+#define SM9_MAX_ID_SIZE		(SM2_MAX_ID_LENGTH)
 
 /*
 SM9SignMasterKey ::= SEQUENCE {
@@ -237,6 +237,28 @@ int sm9_decrypt(const SM9_ENC_KEY *key, const char *id, size_t idlen,
 #define sm9_exch_master_key_generate(msk) sm9_enc_master_key_generate(msk)
 int sm9_exch_master_key_extract_key(SM9_EXCH_MASTER_KEY *master, const char *id, size_t idlen, SM9_EXCH_KEY *key);
 
+int sm9_key_exchange(int is_initiator,
+	const SM9_EXCH_MASTER_KEY *mpk,
+	const SM9_EXCH_KEY *key, const char *id, size_t idlen,
+	const char *peer_id, size_t peer_idlen,
+	const sm9_z256_t r,
+	const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
+	size_t shared_key_len, uint8_t *shared_key);
+int sm9_key_exchange_compute_confirm(int is_initiator,
+	const SM9_EXCH_MASTER_KEY *mpk,
+	const SM9_EXCH_KEY *key, const char *id, size_t idlen,
+	const char *peer_id, size_t peer_idlen,
+	const sm9_z256_t r,
+	const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
+	uint8_t confirm[32]);
+int sm9_key_exchange_verify_confirm(int is_initiator,
+	const SM9_EXCH_MASTER_KEY *mpk,
+	const SM9_EXCH_KEY *key, const char *id, size_t idlen,
+	const char *peer_id, size_t peer_idlen,
+	const sm9_z256_t r,
+	const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
+	const uint8_t confirm[32]);
+
 int sm9_exch_step_1A(const SM9_EXCH_MASTER_KEY *mpk, const char *idB, size_t idBlen, SM9_Z256_POINT *RA, sm9_z256_t rA);
 int sm9_exch_step_1B(const SM9_EXCH_MASTER_KEY *mpk, const char *idA, size_t idAlen, const char *idB, size_t idBlen,
 	const SM9_EXCH_KEY *key, const SM9_Z256_POINT *RA, SM9_Z256_POINT *RB, uint8_t *sk, size_t klen);

include/gmssl/version.h

@@ -18,7 +18,7 @@ extern "C" {
 
 
 #define GMSSL_VERSION_NUM	30300
-#define GMSSL_VERSION_STR	"GmSSL 3.3.0-dev.1167"
+#define GMSSL_VERSION_STR	"GmSSL 3.3.0-dev.1168"
 
 int gmssl_version_num(void);
 const char *gmssl_version_str(void);

src/sm9_exch.c

@@ -20,6 +20,227 @@
 
 
 
+static int sm9_key_exchange_compute_g(int is_initiator,
+	const SM9_EXCH_MASTER_KEY *mpk,
+	const SM9_EXCH_KEY *key,
+	const sm9_z256_t r,
+	const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
+	uint8_t g1[32 * 12], uint8_t g2[32 * 12], uint8_t g3[32 * 12],
+	uint8_t ra[65], uint8_t rb[65])
+{
+	sm9_z256_fp12_t G1, G2, G3;
+	const SM9_Z256_POINT *RA;
+	const SM9_Z256_POINT *RB;
+	const SM9_Z256_POINT *check_R;
+	int ret = -1;
+
+	if (!mpk || !key || !r || !R || !peer_R || !g1 || !g2 || !g3 || !ra || !rb) {
+		error_print();
+		return -1;
+	}
+
+	if (is_initiator) {
+		RA = R;
+		RB = peer_R;
+		check_R = RB;
+	} else {
+		RA = peer_R;
+		RB = R;
+		check_R = RA;
+	}
+	if (!sm9_z256_point_is_on_curve(RA) || !sm9_z256_point_is_on_curve(RB)) {
+		error_print();
+		goto end;
+	}
+
+	if (is_initiator) {
+		sm9_z256_pairing(G1, sm9_z256_twist_generator(), &mpk->Ppube);
+		sm9_z256_fp12_pow(G1, G1, r);
+		sm9_z256_pairing(G2, &key->de, check_R);
+		sm9_z256_fp12_pow(G3, G2, r);
+	} else {
+		sm9_z256_pairing(G1, &key->de, check_R);
+		sm9_z256_pairing(G2, sm9_z256_twist_generator(), &mpk->Ppube);
+		sm9_z256_fp12_pow(G2, G2, r);
+		sm9_z256_fp12_pow(G3, G1, r);
+	}
+
+	sm9_z256_point_to_uncompressed_octets(RA, ra);
+	sm9_z256_point_to_uncompressed_octets(RB, rb);
+	sm9_z256_fp12_to_bytes(G1, g1);
+	sm9_z256_fp12_to_bytes(G2, g2);
+	sm9_z256_fp12_to_bytes(G3, g3);
+
+	ret = 1;
+
+end:
+	gmssl_secure_clear(&G1, sizeof(G1));
+	gmssl_secure_clear(&G2, sizeof(G2));
+	gmssl_secure_clear(&G3, sizeof(G3));
+	return ret;
+}
+
+int sm9_key_exchange(int is_initiator,
+	const SM9_EXCH_MASTER_KEY *mpk,
+	const SM9_EXCH_KEY *key, const char *id, size_t idlen,
+	const char *peer_id, size_t peer_idlen,
+	const sm9_z256_t r,
+	const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
+	size_t shared_key_len, uint8_t *shared_key)
+{
+	uint8_t g1[32 * 12], g2[32 * 12], g3[32 * 12];
+	uint8_t ra[65], rb[65];
+	const char *idA = is_initiator ? id : peer_id;
+	const char *idB = is_initiator ? peer_id : id;
+	size_t idAlen = is_initiator ? idlen : peer_idlen;
+	size_t idBlen = is_initiator ? peer_idlen : idlen;
+	SM3_KDF_CTX kdf_ctx;
+	int ret = -1;
+
+	if (!id || !peer_id || !shared_key_len || !shared_key) {
+		error_print();
+		return -1;
+	}
+	if (idlen > SM9_MAX_ID_SIZE || peer_idlen > SM9_MAX_ID_SIZE) {
+		error_print();
+		return -1;
+	}
+	if (sm9_key_exchange_compute_g(is_initiator, mpk, key,
+		r, R, peer_R, g1, g2, g3, ra, rb) != 1) {
+		error_print();
+		goto end;
+	}
+
+	sm3_kdf_init(&kdf_ctx, shared_key_len);
+	sm3_kdf_update(&kdf_ctx, (uint8_t *)idA, idAlen);
+	sm3_kdf_update(&kdf_ctx, (uint8_t *)idB, idBlen);
+	sm3_kdf_update(&kdf_ctx, ra + 1, 64);
+	sm3_kdf_update(&kdf_ctx, rb + 1, 64);
+	sm3_kdf_update(&kdf_ctx, g1, sizeof(g1));
+	sm3_kdf_update(&kdf_ctx, g2, sizeof(g2));
+	sm3_kdf_update(&kdf_ctx, g3, sizeof(g3));
+	sm3_kdf_finish(&kdf_ctx, shared_key);
+
+	if (mem_is_zero(shared_key, shared_key_len)) {
+		error_print();
+		goto end;
+	}
+
+	ret = 1;
+
+end:
+	gmssl_secure_clear(g1, sizeof(g1));
+	gmssl_secure_clear(g2, sizeof(g2));
+	gmssl_secure_clear(g3, sizeof(g3));
+	gmssl_secure_clear(ra, sizeof(ra));
+	gmssl_secure_clear(rb, sizeof(rb));
+	gmssl_secure_clear(&kdf_ctx, sizeof(kdf_ctx));
+	return ret;
+}
+
+static int sm9_key_exchange_compute_confirm_ex(int is_initiator,
+	const SM9_EXCH_MASTER_KEY *mpk,
+	const SM9_EXCH_KEY *key, const char *id, size_t idlen,
+	const char *peer_id, size_t peer_idlen,
+	const sm9_z256_t r,
+	const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
+	int is_initiator_confirm, uint8_t confirm[32])
+{
+	uint8_t g1[32 * 12], g2[32 * 12], g3[32 * 12];
+	uint8_t ra[65], rb[65];
+	const char *idA = is_initiator ? id : peer_id;
+	const char *idB = is_initiator ? peer_id : id;
+	size_t idAlen = is_initiator ? idlen : peer_idlen;
+	size_t idBlen = is_initiator ? peer_idlen : idlen;
+	uint8_t hash[32];
+	uint8_t prefix = is_initiator_confirm ? 0x83 : 0x82;
+	SM3_CTX ctx;
+	int ret = -1;
+
+	if (!id || !peer_id || !confirm) {
+		error_print();
+		return -1;
+	}
+	if (idlen > SM9_MAX_ID_SIZE || peer_idlen > SM9_MAX_ID_SIZE) {
+		error_print();
+		return -1;
+	}
+	if (sm9_key_exchange_compute_g(is_initiator, mpk, key,
+		r, R, peer_R, g1, g2, g3, ra, rb) != 1) {
+		error_print();
+		goto end;
+	}
+
+	sm3_init(&ctx);
+	sm3_update(&ctx, g2, sizeof(g2));
+	sm3_update(&ctx, g3, sizeof(g3));
+	sm3_update(&ctx, (uint8_t *)idA, idAlen);
+	sm3_update(&ctx, (uint8_t *)idB, idBlen);
+	sm3_update(&ctx, ra + 1, 64);
+	sm3_update(&ctx, rb + 1, 64);
+	sm3_finish(&ctx, hash);
+
+	sm3_init(&ctx);
+	sm3_update(&ctx, &prefix, sizeof(prefix));
+	sm3_update(&ctx, g1, sizeof(g1));
+	sm3_update(&ctx, hash, sizeof(hash));
+	sm3_finish(&ctx, confirm);
+
+	ret = 1;
+
+end:
+	gmssl_secure_clear(g1, sizeof(g1));
+	gmssl_secure_clear(g2, sizeof(g2));
+	gmssl_secure_clear(g3, sizeof(g3));
+	gmssl_secure_clear(ra, sizeof(ra));
+	gmssl_secure_clear(rb, sizeof(rb));
+	gmssl_secure_clear(hash, sizeof(hash));
+	gmssl_secure_clear(&ctx, sizeof(ctx));
+	return ret;
+}
+
+int sm9_key_exchange_compute_confirm(int is_initiator,
+	const SM9_EXCH_MASTER_KEY *mpk,
+	const SM9_EXCH_KEY *key, const char *id, size_t idlen,
+	const char *peer_id, size_t peer_idlen,
+	const sm9_z256_t r,
+	const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
+	uint8_t confirm[32])
+{
+	if (sm9_key_exchange_compute_confirm_ex(is_initiator, mpk, key, id, idlen,
+		peer_id, peer_idlen, r, R, peer_R, is_initiator, confirm) != 1) {
+		error_print();
+		return -1;
+	}
+	return 1;
+}
+
+int sm9_key_exchange_verify_confirm(int is_initiator,
+	const SM9_EXCH_MASTER_KEY *mpk,
+	const SM9_EXCH_KEY *key, const char *id, size_t idlen,
+	const char *peer_id, size_t peer_idlen,
+	const sm9_z256_t r,
+	const SM9_Z256_POINT *R, const SM9_Z256_POINT *peer_R,
+	const uint8_t confirm[32])
+{
+	uint8_t expected[32];
+	int ret;
+
+	if (!confirm) {
+		error_print();
+		return -1;
+	}
+	if (sm9_key_exchange_compute_confirm_ex(is_initiator, mpk, key, id, idlen,
+		peer_id, peer_idlen, r, R, peer_R, !is_initiator, expected) != 1) {
+		error_print();
+		return -1;
+	}
+
+	ret = gmssl_secure_memcmp(expected, confirm, sizeof(expected)) == 0 ? 1 : 0;
+	gmssl_secure_clear(expected, sizeof(expected));
+	return ret;
+}
+
 int sm9_exch_step_1A(const SM9_EXCH_MASTER_KEY *mpk, const char *idB, size_t idBlen, SM9_Z256_POINT *RA, sm9_z256_t rA)
 {
 	// A1: Q = H1(ID_B||hid,N) * P1 + Ppube
@@ -174,5 +395,3 @@ int sm9_exch_step_2B()
 	// B8: S2 = Hash(0x83 || g1 || Hash(g2 || g3 || ID_A || ID_B || RA || RB)), check S2 = SA [optional]
 	return 1;
 }
-
-

tests/sm9test.c

@@ -1031,6 +1031,10 @@ int test_sm9_z256_exchange()
 	size_t klen = 0x10;
 	uint8_t skA[200];
 	uint8_t skB[200];
+	uint8_t skA_new[200];
+	uint8_t skB_new[200];
+	uint8_t SA[32];
+	uint8_t SB[32];
 	sm9_z256_from_hex(msk.ke, hex_kex);
 	sm9_z256_point_mul_generator(&(msk.Ppube), msk.ke);
 	if (sm9_exch_master_key_extract_key(&msk, (char *)idA, sizeof(idA), &keyA) < 0) goto err; ++j;
@@ -1051,6 +1055,37 @@ int test_sm9_z256_exchange()
 		}
 	} ++j;
 
+	if (sm9_key_exchange(1, &msk, &keyA, (char *)idA, sizeof(idA), (char *)idB, sizeof(idB),
+			rA, &RA, &RB, klen, skA_new) != 1
+		|| sm9_key_exchange(0, &msk, &keyB, (char *)idB, sizeof(idB), (char *)idA, sizeof(idA),
+			randB, &RB, &RA, klen, skB_new) != 1) {
+		goto err;
+	} ++j;
+	if (memcmp(skA, skA_new, klen) != 0 || memcmp(skB, skB_new, klen) != 0
+		|| memcmp(skA_new, skB_new, klen) != 0) {
+		printf("New SM9 key exchange API is not interoperable with step API\n");
+		goto err;
+	} ++j;
+
+	if (sm9_key_exchange_compute_confirm(1, &msk, &keyA, (char *)idA, sizeof(idA), (char *)idB, sizeof(idB),
+			rA, &RA, &RB, SA) != 1
+		|| sm9_key_exchange_compute_confirm(0, &msk, &keyB, (char *)idB, sizeof(idB), (char *)idA, sizeof(idA),
+			randB, &RB, &RA, SB) != 1) {
+		goto err;
+	} ++j;
+	if (sm9_key_exchange_verify_confirm(1, &msk, &keyA, (char *)idA, sizeof(idA), (char *)idB, sizeof(idB),
+			rA, &RA, &RB, SB) != 1
+		|| sm9_key_exchange_verify_confirm(0, &msk, &keyB, (char *)idB, sizeof(idB), (char *)idA, sizeof(idA),
+			randB, &RB, &RA, SA) != 1) {
+		goto err;
+	} ++j;
+
+	SB[0] ^= 0x01;
+	if (sm9_key_exchange_verify_confirm(1, &msk, &keyA, (char *)idA, sizeof(idA), (char *)idB, sizeof(idB),
+			rA, &RA, &RB, SB) != 0) {
+		goto err;
+	} ++j;
+
 	printf("%s() ok\n", __FUNCTION__);
 	return 1;
 err: