1 /*
2 * Copyright 2014-2022 The GmSSL Project. All Rights Reserved.
3 *
4 * Licensed under the Apache License, Version 2.0 (the License); you may
5 * not use this file except in compliance with the License.
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 */
9
10
11
12 #include <stdio.h>
13 #include <string.h>
14 #include <stdlib.h>
15 #include <gmssl/mem.h>
16 #include <gmssl/sm2.h>
17 #include <gmssl/sm3.h>
18 #include <gmssl/asn1.h>
19 #include <gmssl/error.h>
20 #include <gmssl/endian.h>
21
22 #define print_bn(str,a) sm2_bn_print(stderr,0,4,str,a)
23
sm2_do_sign_ex(const SM2_KEY * key,int fixed_outlen,const uint8_t dgst[32],SM2_SIGNATURE * sig)24 int sm2_do_sign_ex(const SM2_KEY *key, int fixed_outlen, const uint8_t dgst[32], SM2_SIGNATURE *sig)
25 {
26 SM2_JACOBIAN_POINT _P, *P = &_P;
27 SM2_BN d;
28 SM2_BN e;
29 SM2_BN k;
30 SM2_BN x;
31 SM2_BN r;
32 SM2_BN s;
33
34 retry:
35 sm2_bn_from_bytes(d, key->private_key);
36
37 // e = H(M)
38 sm2_bn_from_bytes(e, dgst); //print_bn("e", e);
39 // e被重用了，注意retry的位置！
40
41 // rand k in [1, n - 1]
42 do {
43 sm2_fn_rand(k);
44 } while (sm2_bn_is_zero(k));
45 //print_bn("k", k);
46
47 // (x, y) = kG
48 sm2_jacobian_point_mul_generator(P, k);
49 sm2_jacobian_point_get_xy(P, x, NULL);
50 //print_bn("x", x);
51
52
53 // r = e + x (mod n)
54 sm2_fn_add(r, e, x); //print_bn("r = e + x (mod n)", r);
55
56 /* if r == 0 or r + k == n re-generate k */
57 if (sm2_bn_is_zero(r)) {
58 goto retry;
59 }
60 sm2_bn_add(x, r, k);
61 if (sm2_bn_cmp(x, SM2_N) == 0) {
62 goto retry;
63 }
64
65 /* s = ((1 + d)^-1 * (k - r * d)) mod n */
66
67 sm2_fn_mul(e, r, d); //print_bn("r*d", e);
68 sm2_fn_sub(k, k, e); //print_bn("k-r*d", k);
69 sm2_fn_add(e, SM2_ONE, d); //print_bn("1 +d", e);
70 sm2_fn_inv(e, e); //print_bn("(1+d)^-1", e);
71 sm2_fn_mul(s, e, k); //print_bn("s = ((1 + d)^-1 * (k - r * d)) mod n", s);
72
73 sm2_bn_to_bytes(r, sig->r); //print_bn("r", r);
74 sm2_bn_to_bytes(s, sig->s); //print_bn("s", s);
75
76 if (fixed_outlen) {
77 uint8_t buf[72];
78 uint8_t *p = buf;
79 size_t len = 0;
80 sm2_signature_to_der(sig, &p, &len);
81 if (len != 71) {
82 goto retry;
83 }
84 }
85
86 gmssl_secure_clear(d, sizeof(d));
87 gmssl_secure_clear(e, sizeof(e));
88 gmssl_secure_clear(k, sizeof(k));
89 gmssl_secure_clear(x, sizeof(x));
90 return 1;
91 }
92
sm2_do_sign(const SM2_KEY * key,const uint8_t dgst[32],SM2_SIGNATURE * sig)93 int sm2_do_sign(const SM2_KEY *key, const uint8_t dgst[32], SM2_SIGNATURE *sig)
94 {
95 return sm2_do_sign_ex(key, 0, dgst, sig);
96 }
97
sm2_do_verify(const SM2_KEY * key,const uint8_t dgst[32],const SM2_SIGNATURE * sig)98 int sm2_do_verify(const SM2_KEY *key, const uint8_t dgst[32], const SM2_SIGNATURE *sig)
99 {
100 SM2_JACOBIAN_POINT _P, *P = &_P;
101 SM2_JACOBIAN_POINT _R, *R = &_R;
102 SM2_BN r;
103 SM2_BN s;
104 SM2_BN e;
105 SM2_BN x;
106 SM2_BN t;
107
108 // parse signature values
109 sm2_bn_from_bytes(r, sig->r); //print_bn("r", r);
110 sm2_bn_from_bytes(s, sig->s); //print_bn("s", s);
111 if (sm2_bn_is_zero(r) == 1
112 || sm2_bn_cmp(r, SM2_N) >= 0
113 || sm2_bn_is_zero(s) == 1
114 || sm2_bn_cmp(s, SM2_N) >= 0) {
115 error_print();
116 return -1;
117 }
118
119 // parse public key
120 sm2_jacobian_point_from_bytes(P, (const uint8_t *)&key->public_key);
121 //print_point("P", P);
122
123 // t = r + s (mod n)
124 // check t != 0
125 sm2_fn_add(t, r, s); //print_bn("t = r + s (mod n)", t);
126 if (sm2_bn_is_zero(t)) {
127 error_print();
128 return -1;
129 }
130
131 // Q = s * G + t * P
132 sm2_jacobian_point_mul_sum(R, t, P, s);
133 sm2_jacobian_point_get_xy(R, x, NULL);
134 //print_bn("x", x);
135
136 // e = H(M)
137 // r' = e + x (mod n)
138 sm2_bn_from_bytes(e, dgst); //print_bn("e = H(M)", e);
139 sm2_fn_add(e, e, x); //print_bn("e + x (mod n)", e);
140
141
142 // check if r == r'
143 if (sm2_bn_cmp(e, r) != 0) {
144 return 0;
145 }
146 return 1;
147 }
148
sm2_signature_to_der(const SM2_SIGNATURE * sig,uint8_t ** out,size_t * outlen)149 int sm2_signature_to_der(const SM2_SIGNATURE *sig, uint8_t **out, size_t *outlen)
150 {
151 size_t len = 0;
152 if (!sig) {
153 return 0;
154 }
155 if (asn1_integer_to_der(sig->r, 32, NULL, &len) != 1
156 || asn1_integer_to_der(sig->s, 32, NULL, &len) != 1
157 || asn1_sequence_header_to_der(len, out, outlen) != 1
158 || asn1_integer_to_der(sig->r, 32, out, outlen) != 1
159 || asn1_integer_to_der(sig->s, 32, out, outlen) != 1) {
160 error_print();
161 return -1;
162 }
163 return 1;
164 }
165
sm2_signature_from_der(SM2_SIGNATURE * sig,const uint8_t ** in,size_t * inlen)166 int sm2_signature_from_der(SM2_SIGNATURE *sig, const uint8_t **in, size_t *inlen)
167 {
168 int ret;
169 const uint8_t *d;
170 size_t dlen;
171 const uint8_t *r;
172 size_t rlen;
173 const uint8_t *s;
174 size_t slen;
175
176 if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
177 if (ret < 0) error_print();
178 return ret;
179 }
180 if (asn1_integer_from_der(&r, &rlen, &d, &dlen) != 1
181 || asn1_integer_from_der(&s, &slen, &d, &dlen) != 1
182 || asn1_length_le(rlen, 32) != 1
183 || asn1_length_le(slen, 32) != 1
184 || asn1_length_is_zero(dlen) != 1) {
185 error_print();
186 return -1;
187 }
188 memset(sig, 0, sizeof(*sig));
189 memcpy(sig->r + 32 - rlen, r, rlen); // 需要测试当r, s是比较小的整数时
190 memcpy(sig->s + 32 - slen, s, slen);
191 return 1;
192 }
193
sm2_signature_print(FILE * fp,int fmt,int ind,const char * label,const uint8_t * a,size_t alen)194 int sm2_signature_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *a, size_t alen)
195 {
196 SM2_SIGNATURE sig;
197 format_print(fp, fmt, ind, "%s\n", label);
198 ind += 4;
199 if (sm2_signature_from_der(&sig, &a, &alen) != 1
200 || asn1_length_is_zero(alen) != 1) {
201 error_print();
202 return -1;
203 }
204 format_bytes(fp, fmt, ind, "r", sig.r, 32);
205 format_bytes(fp, fmt, ind, "s", sig.s, 32);
206 return 1;
207 }
208
209 #define SM2_SIGNATURE_MAX_DER_SIZE 77
210
sm2_sign_ex(const SM2_KEY * key,int fixed_outlen,const uint8_t dgst[32],uint8_t * sig,size_t * siglen)211 int sm2_sign_ex(const SM2_KEY *key, int fixed_outlen, const uint8_t dgst[32], uint8_t *sig, size_t *siglen)
212 {
213 SM2_SIGNATURE signature;
214 uint8_t *p;
215
216 if (!key
217 || !dgst
218 || !sig
219 || !siglen) {
220 error_print();
221 return -1;
222 }
223
224 p = sig;
225 *siglen = 0;
226 if (sm2_do_sign_ex(key, fixed_outlen, dgst, &signature) != 1
227 || sm2_signature_to_der(&signature, &p, siglen) != 1) {
228 error_print();
229 return -1;
230 }
231 return 1;
232 }
233
sm2_sign(const SM2_KEY * key,const uint8_t dgst[32],uint8_t * sig,size_t * siglen)234 int sm2_sign(const SM2_KEY *key, const uint8_t dgst[32], uint8_t *sig, size_t *siglen)
235 {
236 return sm2_sign_ex(key, 0, dgst, sig, siglen);
237 }
238
sm2_verify(const SM2_KEY * key,const uint8_t dgst[32],const uint8_t * sig,size_t siglen)239 int sm2_verify(const SM2_KEY *key, const uint8_t dgst[32], const uint8_t *sig, size_t siglen)
240 {
241 int ret;
242 SM2_SIGNATURE signature;
243 const uint8_t *p;
244 size_t len;
245
246 if (!key
247 || !dgst
248 || !sig
249 || !siglen) {
250 error_print();
251 return -1;
252 }
253
254 p = sig;
255 if (sm2_signature_from_der(&signature, &p, &siglen) != 1
256 || asn1_length_is_zero(siglen) != 1) {
257 error_print();
258 return -1;
259 }
260 if ((ret = sm2_do_verify(key, dgst, &signature)) != 1) {
261 if (ret < 0) error_print();
262 return ret;
263 }
264 return 1;
265 }
266
267 extern void sm3_compress_blocks(uint32_t digest[8], const uint8_t *data, size_t blocks);
268
sm2_compute_z(uint8_t z[32],const SM2_POINT * pub,const char * id,size_t idlen)269 int sm2_compute_z(uint8_t z[32], const SM2_POINT *pub, const char *id, size_t idlen)
270 {
271 SM3_CTX ctx;
272 uint8_t zin[18 + 32 * 6] = {
273 0x00, 0x80,
274 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,
275 0xFF,0xFF,0xFF,0xFE,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
276 0xFF,0xFF,0xFF,0xFF,0x00,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFC,
277 0x28,0xE9,0xFA,0x9E,0x9D,0x9F,0x5E,0x34,0x4D,0x5A,0x9E,0x4B,0xCF,0x65,0x09,0xA7,
278 0xF3,0x97,0x89,0xF5,0x15,0xAB,0x8F,0x92,0xDD,0xBC,0xBD,0x41,0x4D,0x94,0x0E,0x93,
279 0x32,0xC4,0xAE,0x2C,0x1F,0x19,0x81,0x19,0x5F,0x99,0x04,0x46,0x6A,0x39,0xC9,0x94,
280 0x8F,0xE3,0x0B,0xBF,0xF2,0x66,0x0B,0xE1,0x71,0x5A,0x45,0x89,0x33,0x4C,0x74,0xC7,
281 0xBC,0x37,0x36,0xA2,0xF4,0xF6,0x77,0x9C,0x59,0xBD,0xCE,0xE3,0x6B,0x69,0x21,0x53,
282 0xD0,0xA9,0x87,0x7C,0xC6,0x2A,0x47,0x40,0x02,0xDF,0x32,0xE5,0x21,0x39,0xF0,0xA0,
283 };
284
285 if (!z || !pub || !id) {
286 error_print();
287 return -1;
288 }
289
290 memcpy(&zin[18 + 32 * 4], pub->x, 32);
291 memcpy(&zin[18 + 32 * 5], pub->y, 32);
292
293 sm3_init(&ctx);
294 if (strcmp(id, SM2_DEFAULT_ID) == 0) {
295 sm3_update(&ctx, zin, sizeof(zin));
296 } else {
297 uint8_t idbits[2];
298 idbits[0] = (uint8_t)(idlen >> 5);
299 idbits[1] = (uint8_t)(idlen << 3);
300 sm3_update(&ctx, idbits, 2);
301 sm3_update(&ctx, (uint8_t *)id, idlen);
302 sm3_update(&ctx, zin + 18, 32 * 6);
303 }
304 sm3_finish(&ctx, z);
305 return 1;
306 }
307
sm2_sign_init(SM2_SIGN_CTX * ctx,const SM2_KEY * key,const char * id,size_t idlen)308 int sm2_sign_init(SM2_SIGN_CTX *ctx, const SM2_KEY *key, const char *id, size_t idlen)
309 {
310 if (!ctx || !key) {
311 error_print();
312 return -1;
313 }
314 ctx->key = *key;
315 sm3_init(&ctx->sm3_ctx);
316
317 if (id) {
318 uint8_t z[SM3_DIGEST_SIZE];
319 if (idlen <= 0 || idlen > SM2_MAX_ID_LENGTH) {
320 error_print();
321 return -1;
322 }
323 sm2_compute_z(z, &key->public_key, id, idlen);
324 sm3_update(&ctx->sm3_ctx, z, sizeof(z));
325 }
326 return 1;
327 }
328
sm2_sign_update(SM2_SIGN_CTX * ctx,const uint8_t * data,size_t datalen)329 int sm2_sign_update(SM2_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
330 {
331 if (!ctx) {
332 error_print();
333 return -1;
334 }
335 if (data && datalen > 0) {
336 sm3_update(&ctx->sm3_ctx, data, datalen);
337 }
338 return 1;
339 }
340
sm2_sign_finish(SM2_SIGN_CTX * ctx,uint8_t * sig,size_t * siglen)341 int sm2_sign_finish(SM2_SIGN_CTX *ctx, uint8_t *sig, size_t *siglen)
342 {
343 int ret;
344 uint8_t dgst[SM3_DIGEST_SIZE];
345
346 if (!ctx || !sig || !siglen) {
347 error_print();
348 return -1;
349 }
350 sm3_finish(&ctx->sm3_ctx, dgst);
351 if ((ret = sm2_sign(&ctx->key, dgst, sig, siglen)) != 1) {
352 if (ret < 0) error_print();
353 return ret;
354 }
355 return 1;
356 }
357
sm2_verify_init(SM2_SIGN_CTX * ctx,const SM2_KEY * key,const char * id,size_t idlen)358 int sm2_verify_init(SM2_SIGN_CTX *ctx, const SM2_KEY *key, const char *id, size_t idlen)
359 {
360 if (!ctx || !key) {
361 error_print();
362 return -1;
363 }
364 ctx->key = *key;
365 sm3_init(&ctx->sm3_ctx);
366
367 if (id) {
368 uint8_t z[SM3_DIGEST_SIZE];
369 if (idlen <= 0 || idlen > SM2_MAX_ID_LENGTH) {
370 error_print();
371 return -1;
372 }
373 sm2_compute_z(z, &key->public_key, id, idlen);
374 sm3_update(&ctx->sm3_ctx, z, sizeof(z));
375 }
376 return 1;
377 }
378
sm2_verify_update(SM2_SIGN_CTX * ctx,const uint8_t * data,size_t datalen)379 int sm2_verify_update(SM2_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
380 {
381 if (!ctx) {
382 error_print();
383 return -1;
384 }
385 if (data && datalen > 0) {
386 sm3_update(&ctx->sm3_ctx, data, datalen);
387 }
388 return 1;
389 }
390
sm2_verify_finish(SM2_SIGN_CTX * ctx,const uint8_t * sig,size_t siglen)391 int sm2_verify_finish(SM2_SIGN_CTX *ctx, const uint8_t *sig, size_t siglen)
392 {
393 int ret;
394 uint8_t dgst[SM3_DIGEST_SIZE];
395
396 if (!ctx || !sig) {
397 error_print();
398 return -1;
399 }
400 sm3_finish(&ctx->sm3_ctx, dgst);
401 if ((ret = sm2_verify(&ctx->key, dgst, sig, siglen)) != 1) {
402 if (ret < 0) error_print();
403 return ret;
404 }
405 return 1;
406 }
407
sm2_kdf(const uint8_t * in,size_t inlen,size_t outlen,uint8_t * out)408 int sm2_kdf(const uint8_t *in, size_t inlen, size_t outlen, uint8_t *out)
409 {
410 SM3_CTX ctx;
411 uint8_t counter_be[4];
412 uint8_t dgst[SM3_DIGEST_SIZE];
413 uint32_t counter = 1;
414 size_t len;
415
416 while (outlen) {
417 PUTU32(counter_be, counter);
418 counter++;
419
420 sm3_init(&ctx);
421 sm3_update(&ctx, in, inlen);
422 sm3_update(&ctx, counter_be, sizeof(counter_be));
423 sm3_finish(&ctx, dgst);
424
425 len = outlen < SM3_DIGEST_SIZE ? outlen : SM3_DIGEST_SIZE;
426 memcpy(out, dgst, len);
427 out += len;
428 outlen -= len;
429 }
430
431 memset(&ctx, 0, sizeof(SM3_CTX));
432 memset(dgst, 0, sizeof(dgst));
433 return 1;
434 }
435
sm2_do_encrypt_ex(const SM2_KEY * key,int fixed_outlen,const uint8_t * in,size_t inlen,SM2_CIPHERTEXT * out)436 int sm2_do_encrypt_ex(const SM2_KEY *key, int fixed_outlen, const uint8_t *in, size_t inlen, SM2_CIPHERTEXT *out)
437 {
438 SM2_BN k;
439 SM2_JACOBIAN_POINT _P, *P = &_P;
440 SM3_CTX sm3_ctx;
441 uint8_t buf[64];
442 int i;
443
444 retry:
445 // rand k in [1, n - 1]
446 sm2_bn_rand_range(k, SM2_N);
447 if (sm2_bn_is_zero(k)) goto retry;
448
449 // C1 = k * G = (x1, y1)
450 sm2_jacobian_point_mul_generator(P, k);
451 sm2_jacobian_point_to_bytes(P, (uint8_t *)&out->point);
452
453 if (fixed_outlen) {
454 size_t xlen = 0, ylen = 0;
455 asn1_integer_to_der(out->point.x, 32, NULL, &xlen);
456 if (xlen != 34) goto retry;
457 asn1_integer_to_der(out->point.y, 32, NULL, &ylen);
458 if (ylen != 34) goto retry;
459 }
460
461 // Q = k * P = (x2, y2)
462 sm2_jacobian_point_from_bytes(P, (uint8_t *)&key->public_key);
463
464 sm2_jacobian_point_mul(P, k, P);
465
466 sm2_jacobian_point_to_bytes(P, buf);
467
468
469 // t = KDF(x2 || y2, klen)
470 sm2_kdf(buf, sizeof(buf), inlen, out->ciphertext);
471
472
473 // C2 = M xor t
474 for (i = 0; i < inlen; i++) {
475 out->ciphertext[i] ^= in[i];
476 }
477 out->ciphertext_size = (uint32_t)inlen;
478
479 // C3 = Hash(x2 || m || y2)
480 sm3_init(&sm3_ctx);
481 sm3_update(&sm3_ctx, buf, 32);
482 sm3_update(&sm3_ctx, in, inlen);
483 sm3_update(&sm3_ctx, buf + 32, 32);
484 sm3_finish(&sm3_ctx, out->hash);
485
486 return 1;
487 }
488
sm2_do_encrypt(const SM2_KEY * key,const uint8_t * in,size_t inlen,SM2_CIPHERTEXT * out)489 int sm2_do_encrypt(const SM2_KEY *key, const uint8_t *in, size_t inlen, SM2_CIPHERTEXT *out)
490 {
491 return sm2_do_encrypt_ex(key, 0, in, inlen, out);
492 }
493
sm2_do_decrypt(const SM2_KEY * key,const SM2_CIPHERTEXT * in,uint8_t * out,size_t * outlen)494 int sm2_do_decrypt(const SM2_KEY *key, const SM2_CIPHERTEXT *in, uint8_t *out, size_t *outlen)
495 {
496 uint32_t inlen;
497 SM2_BN d;
498 SM2_JACOBIAN_POINT _P, *P = &_P;
499 SM3_CTX sm3_ctx;
500 uint8_t buf[64];
501 uint8_t hash[32];
502 int i;
503
504 // FIXME: check SM2_CIPHERTEXT format
505
506 // check C1
507 sm2_jacobian_point_from_bytes(P, (uint8_t *)&in->point);
508 //point_print(stdout, P, 0, 2);
509
510 /*
511 if (!sm2_jacobian_point_is_on_curve(P)) {
512 fprintf(stderr, "%s %d: invalid ciphertext\n", __FILE__, __LINE__);
513 return -1;
514 }
515 */
516
517 // d * C1 = (x2, y2)
518 sm2_bn_from_bytes(d, key->private_key);
519 sm2_jacobian_point_mul(P, d, P);
520 sm2_bn_clean(d);
521 sm2_jacobian_point_to_bytes(P, buf);
522
523 // t = KDF(x2 || y2, klen)
524 if ((inlen = in->ciphertext_size) <= 0) {
525 fprintf(stderr, "%s %d: invalid ciphertext\n", __FILE__, __LINE__);
526 return -1;
527 }
528
529 sm2_kdf(buf, sizeof(buf), inlen, out);
530
531 // M = C2 xor t
532 for (i = 0; i < inlen; i++) {
533 out[i] ^= in->ciphertext[i];
534 }
535 *outlen = inlen;
536
537 // u = Hash(x2 || M || y2)
538 sm3_init(&sm3_ctx);
539 sm3_update(&sm3_ctx, buf, 32);
540 sm3_update(&sm3_ctx, out, inlen);
541 sm3_update(&sm3_ctx, buf + 32, 32);
542 sm3_finish(&sm3_ctx, hash);
543
544 // check if u == C3
545 if (memcmp(in->hash, hash, sizeof(hash)) != 0) {
546 fprintf(stderr, "%s %d: invalid ciphertext\n", __FILE__, __LINE__);
547 return -1;
548 }
549
550 return 1;
551 }
552
sm2_ciphertext_to_der(const SM2_CIPHERTEXT * C,uint8_t ** out,size_t * outlen)553 int sm2_ciphertext_to_der(const SM2_CIPHERTEXT *C, uint8_t **out, size_t *outlen)
554 {
555 size_t len = 0;
556 if (!C) {
557 return 0;
558 }
559 if (asn1_integer_to_der(C->point.x, 32, NULL, &len) != 1
560 || asn1_integer_to_der(C->point.y, 32, NULL, &len) != 1
561 || asn1_octet_string_to_der(C->hash, 32, NULL, &len) != 1
562 || asn1_octet_string_to_der(C->ciphertext, C->ciphertext_size, NULL, &len) != 1
563 || asn1_sequence_header_to_der(len, out, outlen) != 1
564 || asn1_integer_to_der(C->point.x, 32, out, outlen) != 1
565 || asn1_integer_to_der(C->point.y, 32, out, outlen) != 1
566 || asn1_octet_string_to_der(C->hash, 32, out, outlen) != 1
567 || asn1_octet_string_to_der(C->ciphertext, C->ciphertext_size, out, outlen) != 1) {
568 error_print();
569 return -1;
570 }
571 return 1;
572 }
573
sm2_ciphertext_from_der(SM2_CIPHERTEXT * C,const uint8_t ** in,size_t * inlen)574 int sm2_ciphertext_from_der(SM2_CIPHERTEXT *C, const uint8_t **in, size_t *inlen)
575 {
576 int ret;
577 const uint8_t *d;
578 size_t dlen;
579 const uint8_t *x;
580 const uint8_t *y;
581 const uint8_t *hash;
582 const uint8_t *c;
583 size_t xlen, ylen, hashlen, clen;
584
585 if ((ret = asn1_sequence_from_der(&d, &dlen, in, inlen)) != 1) {
586 if (ret < 0) error_print();
587 return ret;
588 }
589 if (asn1_integer_from_der(&x, &xlen, &d, &dlen) != 1
590 || asn1_integer_from_der(&y, &ylen, &d, &dlen) != 1
591 || asn1_octet_string_from_der(&hash, &hashlen, &d, &dlen) != 1
592 || asn1_octet_string_from_der(&c, &clen, &d, &dlen) != 1
593 || asn1_length_le(xlen, 32) != 1
594 || asn1_length_le(ylen, 32) != 1
595 || asn1_check(hashlen == 32) != 1
596 || asn1_length_le(clen, SM2_MAX_PLAINTEXT_SIZE) != 1
597 || asn1_length_is_zero(dlen) != 1) {
598 error_print();
599 return -1;
600 }
601 memset(C, 0, sizeof(SM2_CIPHERTEXT));
602 memcpy(C->point.x + 32 - xlen, x, xlen);
603 memcpy(C->point.y + 32 - ylen, y, ylen);
604 if (sm2_point_is_on_curve(&C->point) != 1) {
605 error_print();
606 return -1;
607 }
608 memcpy(C->hash, hash, hashlen);
609 memcpy(C->ciphertext, c, clen);
610 C->ciphertext_size = (uint8_t)clen;
611 return 1;
612 }
613
sm2_ciphertext_print(FILE * fp,int fmt,int ind,const char * label,const uint8_t * a,size_t alen)614 int sm2_ciphertext_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *a, size_t alen)
615 {
616 uint8_t buf[512] = {0};
617 SM2_CIPHERTEXT *c = (SM2_CIPHERTEXT *)buf;
618 int i;
619
620 if (sm2_ciphertext_from_der(c, &a, &alen) != 1
621 || asn1_length_is_zero(alen) != 1) {
622 error_print();
623 return -1;
624 }
625 format_print(fp, fmt, ind, "%s\n", label);
626 ind += 4;
627 format_bytes(fp, fmt, ind, "XCoordinate", c->point.x, 32);
628 format_bytes(fp, fmt, ind, "YCoordinate", c->point.y, 32);
629 format_bytes(fp, fmt, ind, "HASH", c->hash, 32);
630 format_bytes(fp, fmt, ind, "CipherText", c->ciphertext, c->ciphertext_size);
631 return 1;
632 }
633
sm2_encrypt_ex(const SM2_KEY * key,int fixed_outlen,const uint8_t * in,size_t inlen,uint8_t * out,size_t * outlen)634 int sm2_encrypt_ex(const SM2_KEY *key, int fixed_outlen, const uint8_t *in, size_t inlen, uint8_t *out, size_t *outlen)
635 {
636 SM2_CIPHERTEXT C;
637
638 if (!key || !in || !out || !outlen) {
639 error_print();
640 return -1;
641 }
642 if (inlen < SM2_MIN_PLAINTEXT_SIZE || inlen > SM2_MAX_PLAINTEXT_SIZE) {
643 error_print();
644 return -1;
645 }
646 if (sm2_do_encrypt_ex(key, fixed_outlen, in, inlen, &C) != 1) {
647 error_print();
648 return -1;
649 }
650 *outlen = 0;
651 if (sm2_ciphertext_to_der(&C, &out, outlen) != 1) {
652 error_print();
653 return -1;
654 }
655 return 1;
656 }
657
sm2_encrypt(const SM2_KEY * key,const uint8_t * in,size_t inlen,uint8_t * out,size_t * outlen)658 int sm2_encrypt(const SM2_KEY *key, const uint8_t *in, size_t inlen, uint8_t *out, size_t *outlen)
659 {
660 return sm2_encrypt_ex(key, 0, in, inlen, out, outlen);
661 }
662
sm2_decrypt(const SM2_KEY * key,const uint8_t * in,size_t inlen,uint8_t * out,size_t * outlen)663 int sm2_decrypt(const SM2_KEY *key, const uint8_t *in, size_t inlen, uint8_t *out, size_t *outlen)
664 {
665 SM2_CIPHERTEXT C;
666
667 if (!key || !in || !out || !outlen) {
668 error_print();
669 return -1;
670 }
671 if (sm2_ciphertext_from_der(&C, &in, &inlen) != 1
672 || asn1_length_is_zero(inlen) != 1) {
673 error_print();
674 return -1;
675 }
676 if (sm2_do_decrypt(key, &C, out, outlen) != 1) {
677 error_print();
678 return -1;
679 }
680 return 1;
681 }
682
sm2_ecdh(const SM2_KEY * key,const SM2_POINT * peer_public,SM2_POINT * out)683 int sm2_ecdh(const SM2_KEY *key, const SM2_POINT *peer_public, SM2_POINT *out)
684 {
685 if (!key || !peer_public || !out) {
686 error_print();
687 return -1;
688 }
689 if (sm2_point_mul(out, key->private_key, peer_public) != 1) {
690 error_print();
691 return -1;
692 }
693 return 1;
694 }
695