From 2af26fb728ce08533af6b65c548490605ddbf50c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E5=AD=90=E9=93=AD?= Date: Mon, 24 Mar 2025 19:55:53 +0800 Subject: [PATCH] =?UTF-8?q?=E5=8A=A0=E5=AF=86=E8=B0=83=E6=95=B4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- internal/pkg/cmb/sm.go | 19 - internal/pkg/cmbv2/model/model.go | 34 + internal/pkg/cmbv2/sm2.go | 387 ++++++++++ internal/pkg/cmbv2/sm2_test.go | 63 ++ internal/pkg/cmbv2/utils/p256.go | 1143 +++++++++++++++++++++++++++++ internal/pkg/cmbv2/utils/pkcs8.go | 329 +++++++++ internal/pkg/cmbv2/utils/utils.go | 209 ++++++ internal/pkg/cmbv2/utils/x509.go | 38 + 8 files changed, 2203 insertions(+), 19 deletions(-) delete mode 100644 internal/pkg/cmb/sm.go create mode 100644 internal/pkg/cmbv2/model/model.go create mode 100644 internal/pkg/cmbv2/sm2.go create mode 100644 internal/pkg/cmbv2/sm2_test.go create mode 100644 internal/pkg/cmbv2/utils/p256.go create mode 100644 internal/pkg/cmbv2/utils/pkcs8.go create mode 100644 internal/pkg/cmbv2/utils/utils.go create mode 100644 internal/pkg/cmbv2/utils/x509.go diff --git a/internal/pkg/cmb/sm.go b/internal/pkg/cmb/sm.go deleted file mode 100644 index 97cdece..0000000 --- a/internal/pkg/cmb/sm.go +++ /dev/null @@ -1,19 +0,0 @@ -package cmb - -import ( - sm22 "voucher/internal/pkg/cmb/sm2" -) - -type Smx struct { - Sm *sm22.Sm2 -} - -func NewSmx(privateKey, publicKey string) (*Smx, error) { - return &Smx{ - Sm: sm22.NewSm2().SetHexPrivateKey(privateKey).SetHexPublicKey(publicKey), - }, nil -} - -func (s *Smx) Sign(input string) { - -} diff --git a/internal/pkg/cmbv2/model/model.go b/internal/pkg/cmbv2/model/model.go new file mode 100644 index 0000000..56189ba --- /dev/null +++ b/internal/pkg/cmbv2/model/model.go @@ -0,0 +1,34 @@ +package model + +import ( + "crypto/elliptic" + "math/big" +) + +var ( + One = new(big.Int).SetInt64(1) + DefaultUid = []byte{0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38} + VerifyFalse = []byte{0x30} + VerifyTrue = []byte{0x31} +) + +type CipherType int32 + +const ( + C1C2C3 CipherType = 1 + C1C3C2 CipherType = 2 +) + +type PublicKey struct { + elliptic.Curve + X, Y *big.Int +} + +type PrivateKey struct { + *PublicKey + D *big.Int +} + +type Signature struct { + R, S *big.Int +} diff --git a/internal/pkg/cmbv2/sm2.go b/internal/pkg/cmbv2/sm2.go new file mode 100644 index 0000000..a40ba7e --- /dev/null +++ b/internal/pkg/cmbv2/sm2.go @@ -0,0 +1,387 @@ +package cmbv2 + +import ( + "bytes" + "crypto/elliptic" + "crypto/rand" + "encoding/asn1" + "encoding/base64" + "encoding/hex" + "fmt" + "github.com/ZZMarquis/gm/sm4" + "io" + "math/big" + "strings" + "voucher/internal/pkg/cmb/sm2/sdk" + "voucher/internal/pkg/cmbv2/model" + "voucher/internal/pkg/cmbv2/utils" +) + +type Cmb struct { + publicKey *model.PublicKey + privateKey *model.PrivateKey + + cipherType model.CipherType + c3Len int + uid []byte + + sdk sdk.SDK + + sm2P256 *utils.Sm2P256Curve +} + +func NewCmb(privateKey, sopPublicKey string) (*Cmb, error) { + cmb := &Cmb{ + c3Len: 32, + uid: model.DefaultUid, + cipherType: model.C1C3C2, + + sdk: sdk.NewBaseSdk(), + } + + sm2P256 := utils.NewP256Sm2() + cmb.sm2P256 = &sm2P256 + + if err := cmb.setHexPrivateKey(privateKey); err != nil { + return nil, err + } + + if err := cmb.setHexPublicKey(sopPublicKey); err != nil { + return nil, err + } + + return cmb, nil +} + +func (s *Cmb) setHexPublicKey(hexStr string) error { + + d, err := hex.DecodeString(hexStr) + if err != nil { + return fmt.Errorf("publicKey is not hex string: %s", err.Error()) + } + + s.publicKey, err = utils.HexToPublicKey(s.sm2P256, d) + if err != nil { + return fmt.Errorf("parse publicKey err: %+v", err) + } + + return nil +} + +func (s *Cmb) setHexPrivateKey(hexStr string) error { + + d, err := hex.DecodeString(hexStr) + if err != nil { + return fmt.Errorf("privateKey is not hex string: %s", err.Error()) + } + + s.privateKey, err = utils.HexToPrivateKey(s.sm2P256, d) + if err != nil { + return fmt.Errorf("parse privateKey err: %+v", err) + } + + return nil +} + +func (s *Cmb) Encrypt(input []byte) (string, error) { + + if input == nil { + return "", fmt.Errorf("加密元数据 is empty") + } + + sm4Key := utils.GenerateSM4Key() + iv := utils.GetSM4IV() + + encryptedBody, err := sm4.CBCEncrypt(sm4Key, iv, utils.Padding(input, 1)) + + keyAndIv := utils.AssemblingByteArray(sm4Key, iv) + + data := []byte(base64.StdEncoding.EncodeToString(keyAndIv)) + + kvTmp, err := s.encrypt(data) + if err != nil { + return "", err + } + + return fmt.Sprintf("%s|%s", base64.StdEncoding.EncodeToString([]byte(kvTmp)), base64.StdEncoding.EncodeToString(encryptedBody)), nil +} + +func (s *Cmb) encrypt(data []byte) ([]byte, error) { + + c2 := make([]byte, len(data)) + copy(c2, data) + + var c1 []byte + var kx, ky *big.Int + for { + k, err := rand.Int(rand.Reader, s.publicKey.Params().N) + if err != nil { + return nil, fmt.Errorf("rand error: %v", err) + } + c1x, c1y := s.publicKey.Curve.ScalarBaseMult(k.Bytes()) + c1 = elliptic.Marshal(s.publicKey.Curve, c1x, c1y) + kx, ky = s.publicKey.Curve.ScalarMult(s.publicKey.X, s.publicKey.Y, k.Bytes()) + + err = s.sdk.Kdf(s.publicKey, kx, ky, c2) + if err != nil { + return nil, fmt.Errorf("kdf error: %v", err) + } + if s.encrypted(c2, data) { + break + } + } + + c3 := s.sdk.CalculateHash(kx, data, ky) + + c1Len := len(c1) + c2Len := len(c2) + c3Len := len(c3) + + toData := make([]byte, c1Len+c2Len+c3Len) + + if s.cipherType == model.C1C2C3 { + copy(toData[:c1Len], c1) + copy(toData[c1Len:c1Len+c2Len], c2) + copy(toData[c1Len+c2Len:], c3) + } else if s.cipherType == model.C1C3C2 { + copy(toData[:c1Len], c1) + copy(toData[c1Len:c1Len+c3Len], c3) + copy(toData[c1Len+c3Len:], c2) + } else { + return nil, fmt.Errorf("cipher type not support") + } + + return toData, nil +} + +func (s *Cmb) encrypted(encData []byte, in []byte) bool { + encDataLen := len(encData) + + for i := 0; i != encDataLen; i++ { + if encData[i] != in[i] { + return true + } + } + + return false +} + +func (s *Cmb) Decrypt(input string) (string, error) { + + tmpDataArr := strings.Split(input, "|") + if len(tmpDataArr) != 2 { + return "", fmt.Errorf("数据格式错误") + } + + keyAndIvStr := tmpDataArr[0] + encryptedBody := tmpDataArr[1] + + data, err := base64.StdEncoding.DecodeString(keyAndIvStr) + if err != nil { + return "", fmt.Errorf("data is not base64 string: %s", err.Error()) + } + + kvBase64Tmp, err := s.decrypt(data) + if err != nil { + return "", err + } + + kvTmp, err := base64.StdEncoding.DecodeString(kvBase64Tmp) + if err != nil { + return "", err + } + + if len(kvTmp) != 33 { + return "", fmt.Errorf("iv长度不等于33") + } + + plainKey := kvTmp[0:16] + plainIv := kvTmp[17:33] + + data2, err := base64.StdEncoding.DecodeString(encryptedBody) + if err != nil { + return "", err + } + + plainText, err := sm4.CBCDecrypt(plainKey, plainIv, data2) + if err != nil { + return "", err + } + + return string(utils.Padding(plainText, 0)), nil +} + +func (s *Cmb) decrypt(data []byte) (string, error) { + + c1Len := 65 + C1Byte := make([]byte, c1Len) + copy(C1Byte, data[:c1Len]) + + x, y := elliptic.Unmarshal(s.privateKey.Curve, C1Byte) + dBC1X, dBC1Y := s.privateKey.Curve.ScalarMult(x, y, s.privateKey.D.Bytes()) + + c2Len := len(data) - c1Len - s.c3Len + c2 := make([]byte, c2Len) + c3 := make([]byte, s.c3Len) + + if s.cipherType == model.C1C2C3 { + copy(c2, data[c1Len:c1Len+c2Len]) + copy(c3, data[c1Len+c2Len:]) + } else if s.cipherType == model.C1C3C2 { + copy(c3, data[c1Len:c1Len+s.c3Len]) + copy(c2, data[c1Len+s.c3Len:]) + } else { + return "", fmt.Errorf("cipher type not support") + } + + if err := s.sdk.Kdf(s.privateKey.Curve, dBC1X, dBC1Y, c2); err != nil { + return "", fmt.Errorf("kdf error: %v", err) + } + + u := s.sdk.CalculateHash(dBC1X, c2, dBC1Y) + if bytes.Compare(u, c3) == 0 { + return string(c2), nil + } + + return "", fmt.Errorf("decrypt error") +} + +func (s *Cmb) Sign(input []byte) (string, error) { + + signData, err := s.sign(input) + + if err != nil { + return "", err + } + + return base64.StdEncoding.EncodeToString(signData), nil +} + +func (s *Cmb) sign(data []byte) ([]byte, error) { + + z := s.sdk.GetZ(s.privateKey.PublicKey.X, s.privateKey.PublicKey.Y, s.uid) + e := s.sdk.GetE(z, data) + + c := s.privateKey.PublicKey.Curve + N := c.Params().N + + if N.Sign() == 0 { + return nil, fmt.Errorf("invalid curve order") + } + + var k, r, sb *big.Int + var err error + for { + for { + k, err = s.randFieldElement(c, rand.Reader) + if err != nil { + return nil, fmt.Errorf("randFieldElement: %+v", err) + } + r, _ = s.privateKey.Curve.ScalarBaseMult(k.Bytes()) + r.Add(r, e) + r.Mod(r, N) + if r.Sign() != 0 { + if t := new(big.Int).Add(r, k); t.Cmp(N) != 0 { + break + } + } + } + rD := new(big.Int).Mul(s.privateKey.D, r) + sb = new(big.Int).Sub(k, rD) + d1 := new(big.Int).Add(s.privateKey.D, model.One) + d1Inv := new(big.Int).ModInverse(d1, N) + sb.Mul(sb, d1Inv) + sb.Mod(sb, N) + if sb.Sign() != 0 { + break + } + } + + signature := model.Signature{R: r, S: sb} + + si, err := asn1.Marshal(signature) + if err != nil { + return nil, fmt.Errorf("asn1.Marshal: %+v", err) + } + + return si, nil +} + +func (s *Cmb) randFieldElement(c elliptic.Curve, random io.Reader) (k *big.Int, err error) { + params := c.Params() + b := make([]byte, params.BitSize/8+8) + _, err = io.ReadFull(random, b) + if err != nil { + return + } + k = new(big.Int).SetBytes(b) + n := new(big.Int).Sub(params.N, model.One) + k.Mod(k, n) + k.Add(k, model.One) + return +} + +func (s *Cmb) Verify(input, sign string) (bool, error) { + + signBytes, err := base64.StdEncoding.DecodeString(sign) + if err != nil { + return false, fmt.Errorf("signature is not base64 string: %s", err.Error()) + } + + signature := model.Signature{} + _, err = asn1.Unmarshal(signBytes, &signature) + if err != nil { + return false, fmt.Errorf("signature is not asn1: %s", err.Error()) + } + + ok := s.verify([]byte(input), signature) + + if !ok { + return false, nil + } + + return true, nil +} + +func (s *Cmb) verifyBool(data []byte) bool { + if bytes.Equal(data, model.VerifyTrue) { + return true + } + return false +} + +func (s *Cmb) verify(data []byte, signature model.Signature) bool { + + c := s.publicKey.Curve + N := c.Params().N + + if signature.R.Cmp(model.One) < 0 || signature.S.Cmp(model.One) < 0 { + return s.verifyBool(model.VerifyFalse) + } + + if signature.R.Cmp(N) >= 0 || signature.S.Cmp(N) >= 0 { + return s.verifyBool(model.VerifyFalse) + } + + z := s.sdk.GetZ(s.publicKey.X, s.publicKey.Y, s.uid) + e := s.sdk.GetE(z, data) + t := new(big.Int).Add(signature.R, signature.S) + t.Mod(t, N) + + if t.Sign() == 0 { + return s.verifyBool(model.VerifyFalse) + } + + var x *big.Int + x1, y1 := c.ScalarBaseMult(signature.S.Bytes()) + x2, y2 := c.ScalarMult(s.publicKey.X, s.publicKey.Y, t.Bytes()) + x, _ = c.Add(x1, y1, x2, y2) + + x.Add(x, e) + x.Mod(x, N) + if x.Cmp(signature.R) == 0 { + return s.verifyBool(model.VerifyTrue) + } + + return s.verifyBool(model.VerifyFalse) +} diff --git a/internal/pkg/cmbv2/sm2_test.go b/internal/pkg/cmbv2/sm2_test.go new file mode 100644 index 0000000..266d671 --- /dev/null +++ b/internal/pkg/cmbv2/sm2_test.go @@ -0,0 +1,63 @@ +package cmbv2 + +import ( + "testing" +) + +func TestCmb_EncryptDecrypt(t *testing.T) { + priKey := "8d39ff3d2559258c163f4510f082727f51531e1953ab203d5ab1ea4a6d94fd73" + pukKey := "04d827a7dbaaa358ce45b8c7794a7f54819f5c175005a702370e47f135ef6f5f9732758b1474f218419fe9e87f90c28c3b05f08254c651db27df35fae67b77b2e4" + + n, err := NewCmb(priKey, pukKey) + if err != nil { + t.Errorf("NewCmb() error = %v", err) + return + } + + content := `{"name":"zhangxx","phoneNo":"137xxxxxxxx"}` + + got, err := n.Encrypt([]byte(content)) + if err != nil { + t.Errorf("Encrypt() error = %v", err) + return + } + + t.Log(got) + + got2, err := n.Decrypt(got) + if err != nil { + t.Errorf("Decrypt() error = %v", err) + return + } + + t.Log(got2) +} + +func TestCmb_SignVerify(t *testing.T) { + priKey := "8d39ff3d2559258c163f4510f082727f51531e1953ab203d5ab1ea4a6d94fd73" + pukKey := "04d827a7dbaaa358ce45b8c7794a7f54819f5c175005a702370e47f135ef6f5f9732758b1474f218419fe9e87f90c28c3b05f08254c651db27df35fae67b77b2e4" + + n, err := NewCmb(priKey, pukKey) + if err != nil { + t.Errorf("NewCmb() error = %v", err) + return + } + + content := `{"name":"zhangxx","phoneNo":"137xxxxxxxx"}` + + got, err := n.Sign([]byte(content)) + if err != nil { + t.Errorf("Sign() error = %v", err) + return + } + + t.Log(got) + + got2, err := n.Verify(content, got) + if err != nil { + t.Errorf("Verify() error = %v", err) + return + } + + t.Log(got2) +} diff --git a/internal/pkg/cmbv2/utils/p256.go b/internal/pkg/cmbv2/utils/p256.go new file mode 100644 index 0000000..ffc5881 --- /dev/null +++ b/internal/pkg/cmbv2/utils/p256.go @@ -0,0 +1,1143 @@ +package utils + +import ( + "crypto/elliptic" + "math/big" + "sync" +) + +type Sm2P256Curve struct { + RInverse *big.Int + *elliptic.CurveParams + a, b, gx, gy sm2P256FieldElement + A *big.Int +} + +var initOnce sync.Once +var sm2P256 Sm2P256Curve + +type sm2P256FieldElement [9]uint32 +type sm2P256LargeFieldElement [17]uint64 + +const ( + bottom28Bits = 0xFFFFFFF + bottom29Bits = 0x1FFFFFFF +) + +func NewP256Sm2() Sm2P256Curve { + initOnce.Do(initP256Sm2) + return sm2P256 +} + +func initP256Sm2() { + sm2P256.CurveParams = &elliptic.CurveParams{Name: "SM2-P-256"} // sm2 + sm2P256.A, _ = new(big.Int).SetString("FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC", 16) + //SM2椭 椭 圆 曲 线 公 钥 密 码 算 法 推 荐 曲 线 参 数 + sm2P256.P, _ = new(big.Int).SetString("FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFF", 16) + sm2P256.N, _ = new(big.Int).SetString("FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123", 16) + sm2P256.B, _ = new(big.Int).SetString("28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E93", 16) + sm2P256.Gx, _ = new(big.Int).SetString("32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7", 16) + sm2P256.Gy, _ = new(big.Int).SetString("BC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0", 16) + sm2P256.RInverse, _ = new(big.Int).SetString("7ffffffd80000002fffffffe000000017ffffffe800000037ffffffc80000002", 16) + sm2P256.BitSize = 256 + sm2P256FromBig(&sm2P256.a, sm2P256.A) + sm2P256FromBig(&sm2P256.gx, sm2P256.Gx) + sm2P256FromBig(&sm2P256.gy, sm2P256.Gy) + sm2P256FromBig(&sm2P256.b, sm2P256.B) +} + +func (curve Sm2P256Curve) Params() *elliptic.CurveParams { + return sm2P256.CurveParams +} + +// y^2 = x^3 + ax + b +func (curve Sm2P256Curve) IsOnCurve(X, Y *big.Int) bool { + var a, x, y, y2, x3 sm2P256FieldElement + + sm2P256FromBig(&x, X) + sm2P256FromBig(&y, Y) + + sm2P256Square(&x3, &x) // x3 = x ^ 2 + sm2P256Mul(&x3, &x3, &x) // x3 = x ^ 2 * x + sm2P256Mul(&a, &curve.a, &x) // a = a * x + sm2P256Add(&x3, &x3, &a) + sm2P256Add(&x3, &x3, &curve.b) + + sm2P256Square(&y2, &y) // y2 = y ^ 2 + return sm2P256ToBig(&x3).Cmp(sm2P256ToBig(&y2)) == 0 +} + +func zForAffine(x, y *big.Int) *big.Int { + z := new(big.Int) + if x.Sign() != 0 || y.Sign() != 0 { + z.SetInt64(1) + } + return z +} + +func (curve Sm2P256Curve) Add(x1, y1, x2, y2 *big.Int) (*big.Int, *big.Int) { + var X1, Y1, Z1, X2, Y2, Z2, X3, Y3, Z3 sm2P256FieldElement + + z1 := zForAffine(x1, y1) + z2 := zForAffine(x2, y2) + sm2P256FromBig(&X1, x1) + sm2P256FromBig(&Y1, y1) + sm2P256FromBig(&Z1, z1) + sm2P256FromBig(&X2, x2) + sm2P256FromBig(&Y2, y2) + sm2P256FromBig(&Z2, z2) + sm2P256PointAdd(&X1, &Y1, &Z1, &X2, &Y2, &Z2, &X3, &Y3, &Z3) + return sm2P256ToAffine(&X3, &Y3, &Z3) +} + +func (curve Sm2P256Curve) Double(x1, y1 *big.Int) (*big.Int, *big.Int) { + var X1, Y1, Z1 sm2P256FieldElement + + z1 := zForAffine(x1, y1) + sm2P256FromBig(&X1, x1) + sm2P256FromBig(&Y1, y1) + sm2P256FromBig(&Z1, z1) + sm2P256PointDouble(&X1, &Y1, &Z1, &X1, &Y1, &Z1) + return sm2P256ToAffine(&X1, &Y1, &Z1) +} + +func (curve Sm2P256Curve) ScalarMult(x1, y1 *big.Int, k []byte) (*big.Int, *big.Int) { + var X, Y, Z, X1, Y1 sm2P256FieldElement + sm2P256FromBig(&X1, x1) + sm2P256FromBig(&Y1, y1) + scalar := sm2GenrateWNaf(k) + scalarReversed := WNafReversed(scalar) + sm2P256ScalarMult(&X, &Y, &Z, &X1, &Y1, scalarReversed) + return sm2P256ToAffine(&X, &Y, &Z) +} + +func (curve Sm2P256Curve) ScalarBaseMult(k []byte) (*big.Int, *big.Int) { + var scalarReversed [32]byte + var X, Y, Z sm2P256FieldElement + + sm2P256GetScalar(&scalarReversed, k) + sm2P256ScalarBaseMult(&X, &Y, &Z, &scalarReversed) + return sm2P256ToAffine(&X, &Y, &Z) +} + +var sm2P256Precomputed = [9 * 2 * 15 * 2]uint32{ + 0x830053d, 0x328990f, 0x6c04fe1, 0xc0f72e5, 0x1e19f3c, 0x666b093, 0x175a87b, 0xec38276, 0x222cf4b, + 0x185a1bba, 0x354e593, 0x1295fac1, 0xf2bc469, 0x47c60fa, 0xc19b8a9, 0xf63533e, 0x903ae6b, 0xc79acba, + 0x15b061a4, 0x33e020b, 0xdffb34b, 0xfcf2c8, 0x16582e08, 0x262f203, 0xfb34381, 0xa55452, 0x604f0ff, + 0x41f1f90, 0xd64ced2, 0xee377bf, 0x75f05f0, 0x189467ae, 0xe2244e, 0x1e7700e8, 0x3fbc464, 0x9612d2e, + 0x1341b3b8, 0xee84e23, 0x1edfa5b4, 0x14e6030, 0x19e87be9, 0x92f533c, 0x1665d96c, 0x226653e, 0xa238d3e, + 0xf5c62c, 0x95bb7a, 0x1f0e5a41, 0x28789c3, 0x1f251d23, 0x8726609, 0xe918910, 0x8096848, 0xf63d028, + 0x152296a1, 0x9f561a8, 0x14d376fb, 0x898788a, 0x61a95fb, 0xa59466d, 0x159a003d, 0x1ad1698, 0x93cca08, + 0x1b314662, 0x706e006, 0x11ce1e30, 0x97b710, 0x172fbc0d, 0x8f50158, 0x11c7ffe7, 0xd182cce, 0xc6ad9e8, + 0x12ea31b2, 0xc4e4f38, 0x175b0d96, 0xec06337, 0x75a9c12, 0xb001fdf, 0x93e82f5, 0x34607de, 0xb8035ed, + 0x17f97924, 0x75cf9e6, 0xdceaedd, 0x2529924, 0x1a10c5ff, 0xb1a54dc, 0x19464d8, 0x2d1997, 0xde6a110, + 0x1e276ee5, 0x95c510c, 0x1aca7c7a, 0xfe48aca, 0x121ad4d9, 0xe4132c6, 0x8239b9d, 0x40ea9cd, 0x816c7b, + 0x632d7a4, 0xa679813, 0x5911fcf, 0x82b0f7c, 0x57b0ad5, 0xbef65, 0xd541365, 0x7f9921f, 0xc62e7a, + 0x3f4b32d, 0x58e50e1, 0x6427aed, 0xdcdda67, 0xe8c2d3e, 0x6aa54a4, 0x18df4c35, 0x49a6a8e, 0x3cd3d0c, + 0xd7adf2, 0xcbca97, 0x1bda5f2d, 0x3258579, 0x606b1e6, 0x6fc1b5b, 0x1ac27317, 0x503ca16, 0xa677435, + 0x57bc73, 0x3992a42, 0xbab987b, 0xfab25eb, 0x128912a4, 0x90a1dc4, 0x1402d591, 0x9ffbcfc, 0xaa48856, + 0x7a7c2dc, 0xcefd08a, 0x1b29bda6, 0xa785641, 0x16462d8c, 0x76241b7, 0x79b6c3b, 0x204ae18, 0xf41212b, + 0x1f567a4d, 0xd6ce6db, 0xedf1784, 0x111df34, 0x85d7955, 0x55fc189, 0x1b7ae265, 0xf9281ac, 0xded7740, + 0xf19468b, 0x83763bb, 0x8ff7234, 0x3da7df8, 0x9590ac3, 0xdc96f2a, 0x16e44896, 0x7931009, 0x99d5acc, + 0x10f7b842, 0xaef5e84, 0xc0310d7, 0xdebac2c, 0x2a7b137, 0x4342344, 0x19633649, 0x3a10624, 0x4b4cb56, + 0x1d809c59, 0xac007f, 0x1f0f4bcd, 0xa1ab06e, 0xc5042cf, 0x82c0c77, 0x76c7563, 0x22c30f3, 0x3bf1568, + 0x7a895be, 0xfcca554, 0x12e90e4c, 0x7b4ab5f, 0x13aeb76b, 0x5887e2c, 0x1d7fe1e3, 0x908c8e3, 0x95800ee, + 0xb36bd54, 0xf08905d, 0x4e73ae8, 0xf5a7e48, 0xa67cb0, 0x50e1067, 0x1b944a0a, 0xf29c83a, 0xb23cfb9, + 0xbe1db1, 0x54de6e8, 0xd4707f2, 0x8ebcc2d, 0x2c77056, 0x1568ce4, 0x15fcc849, 0x4069712, 0xe2ed85f, + 0x2c5ff09, 0x42a6929, 0x628e7ea, 0xbd5b355, 0xaf0bd79, 0xaa03699, 0xdb99816, 0x4379cef, 0x81d57b, + 0x11237f01, 0xe2a820b, 0xfd53b95, 0x6beb5ee, 0x1aeb790c, 0xe470d53, 0x2c2cfee, 0x1c1d8d8, 0xa520fc4, + 0x1518e034, 0xa584dd4, 0x29e572b, 0xd4594fc, 0x141a8f6f, 0x8dfccf3, 0x5d20ba3, 0x2eb60c3, 0x9f16eb0, + 0x11cec356, 0xf039f84, 0x1b0990c1, 0xc91e526, 0x10b65bae, 0xf0616e8, 0x173fa3ff, 0xec8ccf9, 0xbe32790, + 0x11da3e79, 0xe2f35c7, 0x908875c, 0xdacf7bd, 0x538c165, 0x8d1487f, 0x7c31aed, 0x21af228, 0x7e1689d, + 0xdfc23ca, 0x24f15dc, 0x25ef3c4, 0x35248cd, 0x99a0f43, 0xa4b6ecc, 0xd066b3, 0x2481152, 0x37a7688, + 0x15a444b6, 0xb62300c, 0x4b841b, 0xa655e79, 0xd53226d, 0xbeb348a, 0x127f3c2, 0xb989247, 0x71a277d, + 0x19e9dfcb, 0xb8f92d0, 0xe2d226c, 0x390a8b0, 0x183cc462, 0x7bd8167, 0x1f32a552, 0x5e02db4, 0xa146ee9, + 0x1a003957, 0x1c95f61, 0x1eeec155, 0x26f811f, 0xf9596ba, 0x3082bfb, 0x96df083, 0x3e3a289, 0x7e2d8be, + 0x157a63e0, 0x99b8941, 0x1da7d345, 0xcc6cd0, 0x10beed9a, 0x48e83c0, 0x13aa2e25, 0x7cad710, 0x4029988, + 0x13dfa9dd, 0xb94f884, 0x1f4adfef, 0xb88543, 0x16f5f8dc, 0xa6a67f4, 0x14e274e2, 0x5e56cf4, 0x2f24ef, + 0x1e9ef967, 0xfe09bad, 0xfe079b3, 0xcc0ae9e, 0xb3edf6d, 0x3e961bc, 0x130d7831, 0x31043d6, 0xba986f9, + 0x1d28055, 0x65240ca, 0x4971fa3, 0x81b17f8, 0x11ec34a5, 0x8366ddc, 0x1471809, 0xfa5f1c6, 0xc911e15, + 0x8849491, 0xcf4c2e2, 0x14471b91, 0x39f75be, 0x445c21e, 0xf1585e9, 0x72cc11f, 0x4c79f0c, 0xe5522e1, + 0x1874c1ee, 0x4444211, 0x7914884, 0x3d1b133, 0x25ba3c, 0x4194f65, 0x1c0457ef, 0xac4899d, 0xe1fa66c, + 0x130a7918, 0x9b8d312, 0x4b1c5c8, 0x61ccac3, 0x18c8aa6f, 0xe93cb0a, 0xdccb12c, 0xde10825, 0x969737d, + 0xf58c0c3, 0x7cee6a9, 0xc2c329a, 0xc7f9ed9, 0x107b3981, 0x696a40e, 0x152847ff, 0x4d88754, 0xb141f47, + 0x5a16ffe, 0x3a7870a, 0x18667659, 0x3b72b03, 0xb1c9435, 0x9285394, 0xa00005a, 0x37506c, 0x2edc0bb, + 0x19afe392, 0xeb39cac, 0x177ef286, 0xdf87197, 0x19f844ed, 0x31fe8, 0x15f9bfd, 0x80dbec, 0x342e96e, + 0x497aced, 0xe88e909, 0x1f5fa9ba, 0x530a6ee, 0x1ef4e3f1, 0x69ffd12, 0x583006d, 0x2ecc9b1, 0x362db70, + 0x18c7bdc5, 0xf4bb3c5, 0x1c90b957, 0xf067c09, 0x9768f2b, 0xf73566a, 0x1939a900, 0x198c38a, 0x202a2a1, + 0x4bbf5a6, 0x4e265bc, 0x1f44b6e7, 0x185ca49, 0xa39e81b, 0x24aff5b, 0x4acc9c2, 0x638bdd3, 0xb65b2a8, + 0x6def8be, 0xb94537a, 0x10b81dee, 0xe00ec55, 0x2f2cdf7, 0xc20622d, 0x2d20f36, 0xe03c8c9, 0x898ea76, + 0x8e3921b, 0x8905bff, 0x1e94b6c8, 0xee7ad86, 0x154797f2, 0xa620863, 0x3fbd0d9, 0x1f3caab, 0x30c24bd, + 0x19d3892f, 0x59c17a2, 0x1ab4b0ae, 0xf8714ee, 0x90c4098, 0xa9c800d, 0x1910236b, 0xea808d3, 0x9ae2f31, + 0x1a15ad64, 0xa48c8d1, 0x184635a4, 0xb725ef1, 0x11921dcc, 0x3f866df, 0x16c27568, 0xbdf580a, 0xb08f55c, + 0x186ee1c, 0xb1627fa, 0x34e82f6, 0x933837e, 0xf311be5, 0xfedb03b, 0x167f72cd, 0xa5469c0, 0x9c82531, + 0xb92a24b, 0x14fdc8b, 0x141980d1, 0xbdc3a49, 0x7e02bb1, 0xaf4e6dd, 0x106d99e1, 0xd4616fc, 0x93c2717, + 0x1c0a0507, 0xc6d5fed, 0x9a03d8b, 0xa1d22b0, 0x127853e3, 0xc4ac6b8, 0x1a048cf7, 0x9afb72c, 0x65d485d, + 0x72d5998, 0xe9fa744, 0xe49e82c, 0x253cf80, 0x5f777ce, 0xa3799a5, 0x17270cbb, 0xc1d1ef0, 0xdf74977, + 0x114cb859, 0xfa8e037, 0xb8f3fe5, 0xc734cc6, 0x70d3d61, 0xeadac62, 0x12093dd0, 0x9add67d, 0x87200d6, + 0x175bcbb, 0xb29b49f, 0x1806b79c, 0x12fb61f, 0x170b3a10, 0x3aaf1cf, 0xa224085, 0x79d26af, 0x97759e2, + 0x92e19f1, 0xb32714d, 0x1f00d9f1, 0xc728619, 0x9e6f627, 0xe745e24, 0x18ea4ace, 0xfc60a41, 0x125f5b2, + 0xc3cf512, 0x39ed486, 0xf4d15fa, 0xf9167fd, 0x1c1f5dd5, 0xc21a53e, 0x1897930, 0x957a112, 0x21059a0, + 0x1f9e3ddc, 0xa4dfced, 0x8427f6f, 0x726fbe7, 0x1ea658f8, 0x2fdcd4c, 0x17e9b66f, 0xb2e7c2e, 0x39923bf, + 0x1bae104, 0x3973ce5, 0xc6f264c, 0x3511b84, 0x124195d7, 0x11996bd, 0x20be23d, 0xdc437c4, 0x4b4f16b, + 0x11902a0, 0x6c29cc9, 0x1d5ffbe6, 0xdb0b4c7, 0x10144c14, 0x2f2b719, 0x301189, 0x2343336, 0xa0bf2ac, +} + +func sm2P256GetScalar(b *[32]byte, a []byte) { + var scalarBytes []byte + + n := new(big.Int).SetBytes(a) + if n.Cmp(sm2P256.N) >= 0 { + n.Mod(n, sm2P256.N) + scalarBytes = n.Bytes() + } else { + scalarBytes = a + } + for i, v := range scalarBytes { + b[len(scalarBytes)-(1+i)] = v + } +} + +func sm2P256PointAddMixed(xOut, yOut, zOut, x1, y1, z1, x2, y2 *sm2P256FieldElement) { + var z1z1, z1z1z1, s2, u2, h, i, j, r, rr, v, tmp sm2P256FieldElement + + sm2P256Square(&z1z1, z1) + sm2P256Add(&tmp, z1, z1) + + sm2P256Mul(&u2, x2, &z1z1) + sm2P256Mul(&z1z1z1, z1, &z1z1) + sm2P256Mul(&s2, y2, &z1z1z1) + sm2P256Sub(&h, &u2, x1) + sm2P256Add(&i, &h, &h) + sm2P256Square(&i, &i) + sm2P256Mul(&j, &h, &i) + sm2P256Sub(&r, &s2, y1) + sm2P256Add(&r, &r, &r) + sm2P256Mul(&v, x1, &i) + + sm2P256Mul(zOut, &tmp, &h) + sm2P256Square(&rr, &r) + sm2P256Sub(xOut, &rr, &j) + sm2P256Sub(xOut, xOut, &v) + sm2P256Sub(xOut, xOut, &v) + + sm2P256Sub(&tmp, &v, xOut) + sm2P256Mul(yOut, &tmp, &r) + sm2P256Mul(&tmp, y1, &j) + sm2P256Sub(yOut, yOut, &tmp) + sm2P256Sub(yOut, yOut, &tmp) +} + +// sm2P256CopyConditional sets out=in if mask = 0xffffffff in constant time. +// +// On entry: mask is either 0 or 0xffffffff. +func sm2P256CopyConditional(out, in *sm2P256FieldElement, mask uint32) { + for i := 0; i < 9; i++ { + tmp := mask & (in[i] ^ out[i]) + out[i] ^= tmp + } +} + +// sm2P256SelectAffinePoint sets {out_x,out_y} to the index'th entry of table. +// On entry: index < 16, table[0] must be zero. +func sm2P256SelectAffinePoint(xOut, yOut *sm2P256FieldElement, table []uint32, index uint32) { + for i := range xOut { + xOut[i] = 0 + } + for i := range yOut { + yOut[i] = 0 + } + + for i := uint32(1); i < 16; i++ { + mask := i ^ index + mask |= mask >> 2 + mask |= mask >> 1 + mask &= 1 + mask-- + for j := range xOut { + xOut[j] |= table[0] & mask + table = table[1:] + } + for j := range yOut { + yOut[j] |= table[0] & mask + table = table[1:] + } + } +} + +// sm2P256SelectJacobianPoint sets {out_x,out_y,out_z} to the index'th entry of +// table. +// On entry: index < 16, table[0] must be zero. +func sm2P256SelectJacobianPoint(xOut, yOut, zOut *sm2P256FieldElement, table *[16][3]sm2P256FieldElement, index uint32) { + for i := range xOut { + xOut[i] = 0 + } + for i := range yOut { + yOut[i] = 0 + } + for i := range zOut { + zOut[i] = 0 + } + + // The implicit value at index 0 is all zero. We don't need to perform that + // iteration of the loop because we already set out_* to zero. + for i := uint32(1); i < 16; i++ { + mask := i ^ index + mask |= mask >> 2 + mask |= mask >> 1 + mask &= 1 + mask-- + for j := range xOut { + xOut[j] |= table[i][0][j] & mask + } + for j := range yOut { + yOut[j] |= table[i][1][j] & mask + } + for j := range zOut { + zOut[j] |= table[i][2][j] & mask + } + } +} + +// sm2P256GetBit returns the bit'th bit of scalar. +func sm2P256GetBit(scalar *[32]uint8, bit uint) uint32 { + return uint32(((scalar[bit>>3]) >> (bit & 7)) & 1) +} + +// sm2P256ScalarBaseMult sets {xOut,yOut,zOut} = scalar*G where scalar is a +// little-endian number. Note that the value of scalar must be less than the +// order of the group. +func sm2P256ScalarBaseMult(xOut, yOut, zOut *sm2P256FieldElement, scalar *[32]uint8) { + nIsInfinityMask := ^uint32(0) + var px, py, tx, ty, tz sm2P256FieldElement + var pIsNoninfiniteMask, mask, tableOffset uint32 + + for i := range xOut { + xOut[i] = 0 + } + for i := range yOut { + yOut[i] = 0 + } + for i := range zOut { + zOut[i] = 0 + } + + // The loop adds bits at positions 0, 64, 128 and 192, followed by + // positions 32,96,160 and 224 and does this 32 times. + for i := uint(0); i < 32; i++ { + if i != 0 { + sm2P256PointDouble(xOut, yOut, zOut, xOut, yOut, zOut) + } + tableOffset = 0 + for j := uint(0); j <= 32; j += 32 { + bit0 := sm2P256GetBit(scalar, 31-i+j) + bit1 := sm2P256GetBit(scalar, 95-i+j) + bit2 := sm2P256GetBit(scalar, 159-i+j) + bit3 := sm2P256GetBit(scalar, 223-i+j) + index := bit0 | (bit1 << 1) | (bit2 << 2) | (bit3 << 3) + + sm2P256SelectAffinePoint(&px, &py, sm2P256Precomputed[tableOffset:], index) + tableOffset += 30 * 9 + + // Since scalar is less than the order of the group, we know that + // {xOut,yOut,zOut} != {px,py,1}, unless both are zero, which we handle + // below. + sm2P256PointAddMixed(&tx, &ty, &tz, xOut, yOut, zOut, &px, &py) + // The result of pointAddMixed is incorrect if {xOut,yOut,zOut} is zero + // (a.k.a. the point at infinity). We handle that situation by + // copying the point from the table. + sm2P256CopyConditional(xOut, &px, nIsInfinityMask) + sm2P256CopyConditional(yOut, &py, nIsInfinityMask) + sm2P256CopyConditional(zOut, &sm2P256Factor[1], nIsInfinityMask) + + // Equally, the result is also wrong if the point from the table is + // zero, which happens when the index is zero. We handle that by + // only copying from {tx,ty,tz} to {xOut,yOut,zOut} if index != 0. + pIsNoninfiniteMask = nonZeroToAllOnes(index) + mask = pIsNoninfiniteMask & ^nIsInfinityMask + sm2P256CopyConditional(xOut, &tx, mask) + sm2P256CopyConditional(yOut, &ty, mask) + sm2P256CopyConditional(zOut, &tz, mask) + // If p was not zero, then n is now non-zero. + nIsInfinityMask &^= pIsNoninfiniteMask + } + } +} + +func sm2P256PointToAffine(xOut, yOut, x, y, z *sm2P256FieldElement) { + var zInv, zInvSq sm2P256FieldElement + + zz := sm2P256ToBig(z) + zz.ModInverse(zz, sm2P256.P) + sm2P256FromBig(&zInv, zz) + + sm2P256Square(&zInvSq, &zInv) + sm2P256Mul(xOut, x, &zInvSq) + sm2P256Mul(&zInv, &zInv, &zInvSq) + sm2P256Mul(yOut, y, &zInv) +} + +func sm2P256ToAffine(x, y, z *sm2P256FieldElement) (xOut, yOut *big.Int) { + var xx, yy sm2P256FieldElement + + sm2P256PointToAffine(&xx, &yy, x, y, z) + return sm2P256ToBig(&xx), sm2P256ToBig(&yy) +} + +var sm2P256Factor = []sm2P256FieldElement{ + sm2P256FieldElement{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, + sm2P256FieldElement{0x2, 0x0, 0x1FFFFF00, 0x7FF, 0x0, 0x0, 0x0, 0x2000000, 0x0}, + sm2P256FieldElement{0x4, 0x0, 0x1FFFFE00, 0xFFF, 0x0, 0x0, 0x0, 0x4000000, 0x0}, + sm2P256FieldElement{0x6, 0x0, 0x1FFFFD00, 0x17FF, 0x0, 0x0, 0x0, 0x6000000, 0x0}, + sm2P256FieldElement{0x8, 0x0, 0x1FFFFC00, 0x1FFF, 0x0, 0x0, 0x0, 0x8000000, 0x0}, + sm2P256FieldElement{0xA, 0x0, 0x1FFFFB00, 0x27FF, 0x0, 0x0, 0x0, 0xA000000, 0x0}, + sm2P256FieldElement{0xC, 0x0, 0x1FFFFA00, 0x2FFF, 0x0, 0x0, 0x0, 0xC000000, 0x0}, + sm2P256FieldElement{0xE, 0x0, 0x1FFFF900, 0x37FF, 0x0, 0x0, 0x0, 0xE000000, 0x0}, + sm2P256FieldElement{0x10, 0x0, 0x1FFFF800, 0x3FFF, 0x0, 0x0, 0x0, 0x0, 0x01}, +} + +func sm2P256Scalar(b *sm2P256FieldElement, a int) { + sm2P256Mul(b, b, &sm2P256Factor[a]) +} + +// (x3, y3, z3) = (x1, y1, z1) + (x2, y2, z2) +func sm2P256PointAdd(x1, y1, z1, x2, y2, z2, x3, y3, z3 *sm2P256FieldElement) { + var u1, u2, z22, z12, z23, z13, s1, s2, h, h2, r, r2, tm sm2P256FieldElement + + if sm2P256ToBig(z1).Sign() == 0 { + sm2P256Dup(x3, x2) + sm2P256Dup(y3, y2) + sm2P256Dup(z3, z2) + return + } + + if sm2P256ToBig(z2).Sign() == 0 { + sm2P256Dup(x3, x1) + sm2P256Dup(y3, y1) + sm2P256Dup(z3, z1) + return + } + + sm2P256Square(&z12, z1) // z12 = z1 ^ 2 + sm2P256Square(&z22, z2) // z22 = z2 ^ 2 + + sm2P256Mul(&z13, &z12, z1) // z13 = z1 ^ 3 + sm2P256Mul(&z23, &z22, z2) // z23 = z2 ^ 3 + + sm2P256Mul(&u1, x1, &z22) // u1 = x1 * z2 ^ 2 + sm2P256Mul(&u2, x2, &z12) // u2 = x2 * z1 ^ 2 + + sm2P256Mul(&s1, y1, &z23) // s1 = y1 * z2 ^ 3 + sm2P256Mul(&s2, y2, &z13) // s2 = y2 * z1 ^ 3 + + if sm2P256ToBig(&u1).Cmp(sm2P256ToBig(&u2)) == 0 && + sm2P256ToBig(&s1).Cmp(sm2P256ToBig(&s2)) == 0 { + sm2P256PointDouble(x1, y1, z1, x1, y1, z1) + } + + sm2P256Sub(&h, &u2, &u1) // h = u2 - u1 + sm2P256Sub(&r, &s2, &s1) // r = s2 - s1 + + sm2P256Square(&r2, &r) // r2 = r ^ 2 + sm2P256Square(&h2, &h) // h2 = h ^ 2 + + sm2P256Mul(&tm, &h2, &h) // tm = h ^ 3 + sm2P256Sub(x3, &r2, &tm) + sm2P256Mul(&tm, &u1, &h2) + sm2P256Scalar(&tm, 2) // tm = 2 * (u1 * h ^ 2) + sm2P256Sub(x3, x3, &tm) // x3 = r ^ 2 - h ^ 3 - 2 * u1 * h ^ 2 + + sm2P256Mul(&tm, &u1, &h2) // tm = u1 * h ^ 2 + sm2P256Sub(&tm, &tm, x3) // tm = u1 * h ^ 2 - x3 + sm2P256Mul(y3, &r, &tm) + sm2P256Mul(&tm, &h2, &h) // tm = h ^ 3 + sm2P256Mul(&tm, &tm, &s1) // tm = s1 * h ^ 3 + sm2P256Sub(y3, y3, &tm) // y3 = r * (u1 * h ^ 2 - x3) - s1 * h ^ 3 + + sm2P256Mul(z3, z1, z2) + sm2P256Mul(z3, z3, &h) // z3 = z1 * z3 * h +} + +// (x3, y3, z3) = (x1, y1, z1)- (x2, y2, z2) +func sm2P256PointSub(x1, y1, z1, x2, y2, z2, x3, y3, z3 *sm2P256FieldElement) { + var u1, u2, z22, z12, z23, z13, s1, s2, h, h2, r, r2, tm sm2P256FieldElement + y := sm2P256ToBig(y2) + zero := new(big.Int).SetInt64(0) + y.Sub(zero, y) + sm2P256FromBig(y2, y) + + if sm2P256ToBig(z1).Sign() == 0 { + sm2P256Dup(x3, x2) + sm2P256Dup(y3, y2) + sm2P256Dup(z3, z2) + return + } + + if sm2P256ToBig(z2).Sign() == 0 { + sm2P256Dup(x3, x1) + sm2P256Dup(y3, y1) + sm2P256Dup(z3, z1) + return + } + + sm2P256Square(&z12, z1) // z12 = z1 ^ 2 + sm2P256Square(&z22, z2) // z22 = z2 ^ 2 + + sm2P256Mul(&z13, &z12, z1) // z13 = z1 ^ 3 + sm2P256Mul(&z23, &z22, z2) // z23 = z2 ^ 3 + + sm2P256Mul(&u1, x1, &z22) // u1 = x1 * z2 ^ 2 + sm2P256Mul(&u2, x2, &z12) // u2 = x2 * z1 ^ 2 + + sm2P256Mul(&s1, y1, &z23) // s1 = y1 * z2 ^ 3 + sm2P256Mul(&s2, y2, &z13) // s2 = y2 * z1 ^ 3 + + if sm2P256ToBig(&u1).Cmp(sm2P256ToBig(&u2)) == 0 && + sm2P256ToBig(&s1).Cmp(sm2P256ToBig(&s2)) == 0 { + sm2P256PointDouble(x1, y1, z1, x1, y1, z1) + } + + sm2P256Sub(&h, &u2, &u1) // h = u2 - u1 + sm2P256Sub(&r, &s2, &s1) // r = s2 - s1 + + sm2P256Square(&r2, &r) // r2 = r ^ 2 + sm2P256Square(&h2, &h) // h2 = h ^ 2 + + sm2P256Mul(&tm, &h2, &h) // tm = h ^ 3 + sm2P256Sub(x3, &r2, &tm) + sm2P256Mul(&tm, &u1, &h2) + sm2P256Scalar(&tm, 2) // tm = 2 * (u1 * h ^ 2) + sm2P256Sub(x3, x3, &tm) // x3 = r ^ 2 - h ^ 3 - 2 * u1 * h ^ 2 + + sm2P256Mul(&tm, &u1, &h2) // tm = u1 * h ^ 2 + sm2P256Sub(&tm, &tm, x3) // tm = u1 * h ^ 2 - x3 + sm2P256Mul(y3, &r, &tm) + sm2P256Mul(&tm, &h2, &h) // tm = h ^ 3 + sm2P256Mul(&tm, &tm, &s1) // tm = s1 * h ^ 3 + sm2P256Sub(y3, y3, &tm) // y3 = r * (u1 * h ^ 2 - x3) - s1 * h ^ 3 + + sm2P256Mul(z3, z1, z2) + sm2P256Mul(z3, z3, &h) // z3 = z1 * z3 * h +} + +func sm2P256PointDouble(x3, y3, z3, x, y, z *sm2P256FieldElement) { + var s, m, m2, x2, y2, z2, z4, y4, az4 sm2P256FieldElement + + sm2P256Square(&x2, x) // x2 = x ^ 2 + sm2P256Square(&y2, y) // y2 = y ^ 2 + sm2P256Square(&z2, z) // z2 = z ^ 2 + + sm2P256Square(&z4, z) // z4 = z ^ 2 + sm2P256Mul(&z4, &z4, z) // z4 = z ^ 3 + sm2P256Mul(&z4, &z4, z) // z4 = z ^ 4 + + sm2P256Square(&y4, y) // y4 = y ^ 2 + sm2P256Mul(&y4, &y4, y) // y4 = y ^ 3 + sm2P256Mul(&y4, &y4, y) // y4 = y ^ 4 + sm2P256Scalar(&y4, 8) // y4 = 8 * y ^ 4 + + sm2P256Mul(&s, x, &y2) + sm2P256Scalar(&s, 4) // s = 4 * x * y ^ 2 + + sm2P256Dup(&m, &x2) + sm2P256Scalar(&m, 3) + sm2P256Mul(&az4, &sm2P256.a, &z4) + sm2P256Add(&m, &m, &az4) // m = 3 * x ^ 2 + a * z ^ 4 + + sm2P256Square(&m2, &m) // m2 = m ^ 2 + + sm2P256Add(z3, y, z) + sm2P256Square(z3, z3) + sm2P256Sub(z3, z3, &z2) + sm2P256Sub(z3, z3, &y2) // z' = (y + z) ^2 - z ^ 2 - y ^ 2 + + sm2P256Sub(x3, &m2, &s) + sm2P256Sub(x3, x3, &s) // x' = m2 - 2 * s + + sm2P256Sub(y3, &s, x3) + sm2P256Mul(y3, y3, &m) + sm2P256Sub(y3, y3, &y4) // y' = m * (s - x') - 8 * y ^ 4 +} + +// p256Zero31 is 0 mod p. +var sm2P256Zero31 = sm2P256FieldElement{0x7FFFFFF8, 0x3FFFFFFC, 0x800003FC, 0x3FFFDFFC, 0x7FFFFFFC, 0x3FFFFFFC, 0x7FFFFFFC, 0x37FFFFFC, 0x7FFFFFFC} + +// c = a + b +func sm2P256Add(c, a, b *sm2P256FieldElement) { + carry := uint32(0) + for i := 0; ; i++ { + c[i] = a[i] + b[i] + c[i] += carry + carry = c[i] >> 29 + c[i] &= bottom29Bits + i++ + if i == 9 { + break + } + c[i] = a[i] + b[i] + c[i] += carry + carry = c[i] >> 28 + c[i] &= bottom28Bits + } + sm2P256ReduceCarry(c, carry) +} + +// c = a - b +func sm2P256Sub(c, a, b *sm2P256FieldElement) { + var carry uint32 + + for i := 0; ; i++ { + c[i] = a[i] - b[i] + c[i] += sm2P256Zero31[i] + c[i] += carry + carry = c[i] >> 29 + c[i] &= bottom29Bits + i++ + if i == 9 { + break + } + c[i] = a[i] - b[i] + c[i] += sm2P256Zero31[i] + c[i] += carry + carry = c[i] >> 28 + c[i] &= bottom28Bits + } + sm2P256ReduceCarry(c, carry) +} + +// c = a * b +func sm2P256Mul(c, a, b *sm2P256FieldElement) { + var tmp sm2P256LargeFieldElement + + tmp[0] = uint64(a[0]) * uint64(b[0]) + tmp[1] = uint64(a[0])*(uint64(b[1])<<0) + + uint64(a[1])*(uint64(b[0])<<0) + tmp[2] = uint64(a[0])*(uint64(b[2])<<0) + + uint64(a[1])*(uint64(b[1])<<1) + + uint64(a[2])*(uint64(b[0])<<0) + tmp[3] = uint64(a[0])*(uint64(b[3])<<0) + + uint64(a[1])*(uint64(b[2])<<0) + + uint64(a[2])*(uint64(b[1])<<0) + + uint64(a[3])*(uint64(b[0])<<0) + tmp[4] = uint64(a[0])*(uint64(b[4])<<0) + + uint64(a[1])*(uint64(b[3])<<1) + + uint64(a[2])*(uint64(b[2])<<0) + + uint64(a[3])*(uint64(b[1])<<1) + + uint64(a[4])*(uint64(b[0])<<0) + tmp[5] = uint64(a[0])*(uint64(b[5])<<0) + + uint64(a[1])*(uint64(b[4])<<0) + + uint64(a[2])*(uint64(b[3])<<0) + + uint64(a[3])*(uint64(b[2])<<0) + + uint64(a[4])*(uint64(b[1])<<0) + + uint64(a[5])*(uint64(b[0])<<0) + tmp[6] = uint64(a[0])*(uint64(b[6])<<0) + + uint64(a[1])*(uint64(b[5])<<1) + + uint64(a[2])*(uint64(b[4])<<0) + + uint64(a[3])*(uint64(b[3])<<1) + + uint64(a[4])*(uint64(b[2])<<0) + + uint64(a[5])*(uint64(b[1])<<1) + + uint64(a[6])*(uint64(b[0])<<0) + tmp[7] = uint64(a[0])*(uint64(b[7])<<0) + + uint64(a[1])*(uint64(b[6])<<0) + + uint64(a[2])*(uint64(b[5])<<0) + + uint64(a[3])*(uint64(b[4])<<0) + + uint64(a[4])*(uint64(b[3])<<0) + + uint64(a[5])*(uint64(b[2])<<0) + + uint64(a[6])*(uint64(b[1])<<0) + + uint64(a[7])*(uint64(b[0])<<0) + // tmp[8] has the greatest value but doesn't overflow. See logic in + // p256Square. + tmp[8] = uint64(a[0])*(uint64(b[8])<<0) + + uint64(a[1])*(uint64(b[7])<<1) + + uint64(a[2])*(uint64(b[6])<<0) + + uint64(a[3])*(uint64(b[5])<<1) + + uint64(a[4])*(uint64(b[4])<<0) + + uint64(a[5])*(uint64(b[3])<<1) + + uint64(a[6])*(uint64(b[2])<<0) + + uint64(a[7])*(uint64(b[1])<<1) + + uint64(a[8])*(uint64(b[0])<<0) + tmp[9] = uint64(a[1])*(uint64(b[8])<<0) + + uint64(a[2])*(uint64(b[7])<<0) + + uint64(a[3])*(uint64(b[6])<<0) + + uint64(a[4])*(uint64(b[5])<<0) + + uint64(a[5])*(uint64(b[4])<<0) + + uint64(a[6])*(uint64(b[3])<<0) + + uint64(a[7])*(uint64(b[2])<<0) + + uint64(a[8])*(uint64(b[1])<<0) + tmp[10] = uint64(a[2])*(uint64(b[8])<<0) + + uint64(a[3])*(uint64(b[7])<<1) + + uint64(a[4])*(uint64(b[6])<<0) + + uint64(a[5])*(uint64(b[5])<<1) + + uint64(a[6])*(uint64(b[4])<<0) + + uint64(a[7])*(uint64(b[3])<<1) + + uint64(a[8])*(uint64(b[2])<<0) + tmp[11] = uint64(a[3])*(uint64(b[8])<<0) + + uint64(a[4])*(uint64(b[7])<<0) + + uint64(a[5])*(uint64(b[6])<<0) + + uint64(a[6])*(uint64(b[5])<<0) + + uint64(a[7])*(uint64(b[4])<<0) + + uint64(a[8])*(uint64(b[3])<<0) + tmp[12] = uint64(a[4])*(uint64(b[8])<<0) + + uint64(a[5])*(uint64(b[7])<<1) + + uint64(a[6])*(uint64(b[6])<<0) + + uint64(a[7])*(uint64(b[5])<<1) + + uint64(a[8])*(uint64(b[4])<<0) + tmp[13] = uint64(a[5])*(uint64(b[8])<<0) + + uint64(a[6])*(uint64(b[7])<<0) + + uint64(a[7])*(uint64(b[6])<<0) + + uint64(a[8])*(uint64(b[5])<<0) + tmp[14] = uint64(a[6])*(uint64(b[8])<<0) + + uint64(a[7])*(uint64(b[7])<<1) + + uint64(a[8])*(uint64(b[6])<<0) + tmp[15] = uint64(a[7])*(uint64(b[8])<<0) + + uint64(a[8])*(uint64(b[7])<<0) + tmp[16] = uint64(a[8]) * (uint64(b[8]) << 0) + sm2P256ReduceDegree(c, &tmp) +} + +// b = a * a +func sm2P256Square(b, a *sm2P256FieldElement) { + var tmp sm2P256LargeFieldElement + + tmp[0] = uint64(a[0]) * uint64(a[0]) + tmp[1] = uint64(a[0]) * (uint64(a[1]) << 1) + tmp[2] = uint64(a[0])*(uint64(a[2])<<1) + + uint64(a[1])*(uint64(a[1])<<1) + tmp[3] = uint64(a[0])*(uint64(a[3])<<1) + + uint64(a[1])*(uint64(a[2])<<1) + tmp[4] = uint64(a[0])*(uint64(a[4])<<1) + + uint64(a[1])*(uint64(a[3])<<2) + + uint64(a[2])*uint64(a[2]) + tmp[5] = uint64(a[0])*(uint64(a[5])<<1) + + uint64(a[1])*(uint64(a[4])<<1) + + uint64(a[2])*(uint64(a[3])<<1) + tmp[6] = uint64(a[0])*(uint64(a[6])<<1) + + uint64(a[1])*(uint64(a[5])<<2) + + uint64(a[2])*(uint64(a[4])<<1) + + uint64(a[3])*(uint64(a[3])<<1) + tmp[7] = uint64(a[0])*(uint64(a[7])<<1) + + uint64(a[1])*(uint64(a[6])<<1) + + uint64(a[2])*(uint64(a[5])<<1) + + uint64(a[3])*(uint64(a[4])<<1) + // tmp[8] has the greatest value of 2**61 + 2**60 + 2**61 + 2**60 + 2**60, + // which is < 2**64 as required. + tmp[8] = uint64(a[0])*(uint64(a[8])<<1) + + uint64(a[1])*(uint64(a[7])<<2) + + uint64(a[2])*(uint64(a[6])<<1) + + uint64(a[3])*(uint64(a[5])<<2) + + uint64(a[4])*uint64(a[4]) + tmp[9] = uint64(a[1])*(uint64(a[8])<<1) + + uint64(a[2])*(uint64(a[7])<<1) + + uint64(a[3])*(uint64(a[6])<<1) + + uint64(a[4])*(uint64(a[5])<<1) + tmp[10] = uint64(a[2])*(uint64(a[8])<<1) + + uint64(a[3])*(uint64(a[7])<<2) + + uint64(a[4])*(uint64(a[6])<<1) + + uint64(a[5])*(uint64(a[5])<<1) + tmp[11] = uint64(a[3])*(uint64(a[8])<<1) + + uint64(a[4])*(uint64(a[7])<<1) + + uint64(a[5])*(uint64(a[6])<<1) + tmp[12] = uint64(a[4])*(uint64(a[8])<<1) + + uint64(a[5])*(uint64(a[7])<<2) + + uint64(a[6])*uint64(a[6]) + tmp[13] = uint64(a[5])*(uint64(a[8])<<1) + + uint64(a[6])*(uint64(a[7])<<1) + tmp[14] = uint64(a[6])*(uint64(a[8])<<1) + + uint64(a[7])*(uint64(a[7])<<1) + tmp[15] = uint64(a[7]) * (uint64(a[8]) << 1) + tmp[16] = uint64(a[8]) * uint64(a[8]) + sm2P256ReduceDegree(b, &tmp) +} + +// nonZeroToAllOnes returns: +// +// 0xffffffff for 0 < x <= 2**31 +// 0 for x == 0 or x > 2**31. +func nonZeroToAllOnes(x uint32) uint32 { + return ((x - 1) >> 31) - 1 +} + +var sm2P256Carry = [8 * 9]uint32{ + 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, + 0x2, 0x0, 0x1FFFFF00, 0x7FF, 0x0, 0x0, 0x0, 0x2000000, 0x0, + 0x4, 0x0, 0x1FFFFE00, 0xFFF, 0x0, 0x0, 0x0, 0x4000000, 0x0, + 0x6, 0x0, 0x1FFFFD00, 0x17FF, 0x0, 0x0, 0x0, 0x6000000, 0x0, + 0x8, 0x0, 0x1FFFFC00, 0x1FFF, 0x0, 0x0, 0x0, 0x8000000, 0x0, + 0xA, 0x0, 0x1FFFFB00, 0x27FF, 0x0, 0x0, 0x0, 0xA000000, 0x0, + 0xC, 0x0, 0x1FFFFA00, 0x2FFF, 0x0, 0x0, 0x0, 0xC000000, 0x0, + 0xE, 0x0, 0x1FFFF900, 0x37FF, 0x0, 0x0, 0x0, 0xE000000, 0x0, +} + +// carry < 2 ^ 3 +func sm2P256ReduceCarry(a *sm2P256FieldElement, carry uint32) { + a[0] += sm2P256Carry[carry*9+0] + a[2] += sm2P256Carry[carry*9+2] + a[3] += sm2P256Carry[carry*9+3] + a[7] += sm2P256Carry[carry*9+7] +} + +func sm2P256ReduceDegree(a *sm2P256FieldElement, b *sm2P256LargeFieldElement) { + var tmp [18]uint32 + var carry, x, xMask uint32 + + // tmp + // 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 ... + // 29 | 28 | 29 | 28 | 29 | 28 | 29 | 28 | 29 | 28 | 29 ... + tmp[0] = uint32(b[0]) & bottom29Bits + tmp[1] = uint32(b[0]) >> 29 + tmp[1] |= (uint32(b[0]>>32) << 3) & bottom28Bits + tmp[1] += uint32(b[1]) & bottom28Bits + carry = tmp[1] >> 28 + tmp[1] &= bottom28Bits + for i := 2; i < 17; i++ { + tmp[i] = (uint32(b[i-2] >> 32)) >> 25 + tmp[i] += (uint32(b[i-1])) >> 28 + tmp[i] += (uint32(b[i-1]>>32) << 4) & bottom29Bits + tmp[i] += uint32(b[i]) & bottom29Bits + tmp[i] += carry + carry = tmp[i] >> 29 + tmp[i] &= bottom29Bits + + i++ + if i == 17 { + break + } + tmp[i] = uint32(b[i-2]>>32) >> 25 + tmp[i] += uint32(b[i-1]) >> 29 + tmp[i] += ((uint32(b[i-1] >> 32)) << 3) & bottom28Bits + tmp[i] += uint32(b[i]) & bottom28Bits + tmp[i] += carry + carry = tmp[i] >> 28 + tmp[i] &= bottom28Bits + } + tmp[17] = uint32(b[15]>>32) >> 25 + tmp[17] += uint32(b[16]) >> 29 + tmp[17] += uint32(b[16]>>32) << 3 + tmp[17] += carry + + for i := 0; ; i += 2 { + + tmp[i+1] += tmp[i] >> 29 + x = tmp[i] & bottom29Bits + tmp[i] = 0 + if x > 0 { + set4 := uint32(0) + set7 := uint32(0) + xMask = nonZeroToAllOnes(x) + tmp[i+2] += (x << 7) & bottom29Bits + tmp[i+3] += x >> 22 + if tmp[i+3] < 0x10000000 { + set4 = 1 + tmp[i+3] += 0x10000000 & xMask + tmp[i+3] -= (x << 10) & bottom28Bits + } else { + tmp[i+3] -= (x << 10) & bottom28Bits + } + if tmp[i+4] < 0x20000000 { + tmp[i+4] += 0x20000000 & xMask + tmp[i+4] -= set4 // 借位 + tmp[i+4] -= x >> 18 + if tmp[i+5] < 0x10000000 { + tmp[i+5] += 0x10000000 & xMask + tmp[i+5] -= 1 // 借位 + if tmp[i+6] < 0x20000000 { + set7 = 1 + tmp[i+6] += 0x20000000 & xMask + tmp[i+6] -= 1 // 借位 + } else { + tmp[i+6] -= 1 // 借位 + } + } else { + tmp[i+5] -= 1 + } + } else { + tmp[i+4] -= set4 // 借位 + tmp[i+4] -= x >> 18 + } + if tmp[i+7] < 0x10000000 { + tmp[i+7] += 0x10000000 & xMask + tmp[i+7] -= set7 + tmp[i+7] -= (x << 24) & bottom28Bits + tmp[i+8] += (x << 28) & bottom29Bits + if tmp[i+8] < 0x20000000 { + tmp[i+8] += 0x20000000 & xMask + tmp[i+8] -= 1 + tmp[i+8] -= x >> 4 + tmp[i+9] += ((x >> 1) - 1) & xMask + } else { + tmp[i+8] -= 1 + tmp[i+8] -= x >> 4 + tmp[i+9] += (x >> 1) & xMask + } + } else { + tmp[i+7] -= set7 // 借位 + tmp[i+7] -= (x << 24) & bottom28Bits + tmp[i+8] += (x << 28) & bottom29Bits + if tmp[i+8] < 0x20000000 { + tmp[i+8] += 0x20000000 & xMask + tmp[i+8] -= x >> 4 + tmp[i+9] += ((x >> 1) - 1) & xMask + } else { + tmp[i+8] -= x >> 4 + tmp[i+9] += (x >> 1) & xMask + } + } + + } + + if i+1 == 9 { + break + } + + tmp[i+2] += tmp[i+1] >> 28 + x = tmp[i+1] & bottom28Bits + tmp[i+1] = 0 + if x > 0 { + set5 := uint32(0) + set8 := uint32(0) + set9 := uint32(0) + xMask = nonZeroToAllOnes(x) + tmp[i+3] += (x << 7) & bottom28Bits + tmp[i+4] += x >> 21 + if tmp[i+4] < 0x20000000 { + set5 = 1 + tmp[i+4] += 0x20000000 & xMask + tmp[i+4] -= (x << 11) & bottom29Bits + } else { + tmp[i+4] -= (x << 11) & bottom29Bits + } + if tmp[i+5] < 0x10000000 { + tmp[i+5] += 0x10000000 & xMask + tmp[i+5] -= set5 // 借位 + tmp[i+5] -= x >> 18 + if tmp[i+6] < 0x20000000 { + tmp[i+6] += 0x20000000 & xMask + tmp[i+6] -= 1 // 借位 + if tmp[i+7] < 0x10000000 { + set8 = 1 + tmp[i+7] += 0x10000000 & xMask + tmp[i+7] -= 1 // 借位 + } else { + tmp[i+7] -= 1 // 借位 + } + } else { + tmp[i+6] -= 1 // 借位 + } + } else { + tmp[i+5] -= set5 // 借位 + tmp[i+5] -= x >> 18 + } + if tmp[i+8] < 0x20000000 { + set9 = 1 + tmp[i+8] += 0x20000000 & xMask + tmp[i+8] -= set8 + tmp[i+8] -= (x << 25) & bottom29Bits + } else { + tmp[i+8] -= set8 + tmp[i+8] -= (x << 25) & bottom29Bits + } + if tmp[i+9] < 0x10000000 { + tmp[i+9] += 0x10000000 & xMask + tmp[i+9] -= set9 // 借位 + tmp[i+9] -= x >> 4 + tmp[i+10] += (x - 1) & xMask + } else { + tmp[i+9] -= set9 // 借位 + tmp[i+9] -= x >> 4 + tmp[i+10] += x & xMask + } + } + } + + carry = uint32(0) + for i := 0; i < 8; i++ { + a[i] = tmp[i+9] + a[i] += carry + a[i] += (tmp[i+10] << 28) & bottom29Bits + carry = a[i] >> 29 + a[i] &= bottom29Bits + + i++ + a[i] = tmp[i+9] >> 1 + a[i] += carry + carry = a[i] >> 28 + a[i] &= bottom28Bits + } + a[8] = tmp[17] + a[8] += carry + carry = a[8] >> 29 + a[8] &= bottom29Bits + sm2P256ReduceCarry(a, carry) +} + +// b = a +func sm2P256Dup(b, a *sm2P256FieldElement) { + *b = *a +} + +// X = a * R mod P +func sm2P256FromBig(X *sm2P256FieldElement, a *big.Int) { + x := new(big.Int).Lsh(a, 257) + x.Mod(x, sm2P256.P) + for i := 0; i < 9; i++ { + if bits := x.Bits(); len(bits) > 0 { + X[i] = uint32(bits[0]) & bottom29Bits + } else { + X[i] = 0 + } + x.Rsh(x, 29) + i++ + if i == 9 { + break + } + if bits := x.Bits(); len(bits) > 0 { + X[i] = uint32(bits[0]) & bottom28Bits + } else { + X[i] = 0 + } + x.Rsh(x, 28) + } +} + +// X = r * R mod P +// r = X * R' mod P +func sm2P256ToBig(X *sm2P256FieldElement) *big.Int { + r, tm := new(big.Int), new(big.Int) + r.SetInt64(int64(X[8])) + for i := 7; i >= 0; i-- { + if (i & 1) == 0 { + r.Lsh(r, 29) + } else { + r.Lsh(r, 28) + } + tm.SetInt64(int64(X[i])) + r.Add(r, tm) + } + r.Mul(r, sm2P256.RInverse) + r.Mod(r, sm2P256.P) + return r +} +func WNafReversed(wnaf []int8) []int8 { + wnafRev := make([]int8, len(wnaf), len(wnaf)) + for i, v := range wnaf { + wnafRev[len(wnaf)-(1+i)] = v + } + return wnafRev +} +func sm2GenrateWNaf(b []byte) []int8 { + n := new(big.Int).SetBytes(b) + var k *big.Int + if n.Cmp(sm2P256.N) >= 0 { + n.Mod(n, sm2P256.N) + k = n + } else { + k = n + } + wnaf := make([]int8, k.BitLen()+1, k.BitLen()+1) + if k.Sign() == 0 { + return wnaf + } + var width, pow2, sign int + width, pow2, sign = 4, 16, 8 + var mask int64 = 15 + var carry bool + var length, pos int + for pos <= k.BitLen() { + if k.Bit(pos) == boolToUint(carry) { + pos++ + continue + } + k.Rsh(k, uint(pos)) + var digit int + digit = int(k.Int64() & mask) + if carry { + digit++ + } + carry = (digit & sign) != 0 + if carry { + digit -= pow2 + } + length += pos + wnaf[length] = int8(digit) + pos = int(width) + } + if len(wnaf) > length+1 { + t := make([]int8, length+1, length+1) + copy(t, wnaf[0:length+1]) + wnaf = t + } + return wnaf +} +func boolToUint(b bool) uint { + if b { + return 1 + } + return 0 +} +func abs(a int8) uint32 { + if a < 0 { + return uint32(-a) + } + return uint32(a) +} + +func sm2P256ScalarMult(xOut, yOut, zOut, x, y *sm2P256FieldElement, scalar []int8) { + var precomp [16][3]sm2P256FieldElement + var px, py, pz, tx, ty, tz sm2P256FieldElement + var nIsInfinityMask, index, pIsNoninfiniteMask, mask uint32 + + // We precompute 0,1,2,... times {x,y}. + precomp[1][0] = *x + precomp[1][1] = *y + precomp[1][2] = sm2P256Factor[1] + + for i := 2; i < 8; i += 2 { + sm2P256PointDouble(&precomp[i][0], &precomp[i][1], &precomp[i][2], &precomp[i/2][0], &precomp[i/2][1], &precomp[i/2][2]) + sm2P256PointAddMixed(&precomp[i+1][0], &precomp[i+1][1], &precomp[i+1][2], &precomp[i][0], &precomp[i][1], &precomp[i][2], x, y) + } + + for i := range xOut { + xOut[i] = 0 + } + for i := range yOut { + yOut[i] = 0 + } + for i := range zOut { + zOut[i] = 0 + } + nIsInfinityMask = ^uint32(0) + var zeroes int16 + for i := 0; i < len(scalar); i++ { + if scalar[i] == 0 { + zeroes++ + continue + } + if zeroes > 0 { + for ; zeroes > 0; zeroes-- { + sm2P256PointDouble(xOut, yOut, zOut, xOut, yOut, zOut) + } + } + index = abs(scalar[i]) + sm2P256PointDouble(xOut, yOut, zOut, xOut, yOut, zOut) + sm2P256SelectJacobianPoint(&px, &py, &pz, &precomp, index) + if scalar[i] > 0 { + sm2P256PointAdd(xOut, yOut, zOut, &px, &py, &pz, &tx, &ty, &tz) + } else { + sm2P256PointSub(xOut, yOut, zOut, &px, &py, &pz, &tx, &ty, &tz) + } + sm2P256CopyConditional(xOut, &px, nIsInfinityMask) + sm2P256CopyConditional(yOut, &py, nIsInfinityMask) + sm2P256CopyConditional(zOut, &pz, nIsInfinityMask) + pIsNoninfiniteMask = nonZeroToAllOnes(index) + mask = pIsNoninfiniteMask & ^nIsInfinityMask + sm2P256CopyConditional(xOut, &tx, mask) + sm2P256CopyConditional(yOut, &ty, mask) + sm2P256CopyConditional(zOut, &tz, mask) + nIsInfinityMask &^= pIsNoninfiniteMask + } + if zeroes > 0 { + for ; zeroes > 0; zeroes-- { + sm2P256PointDouble(xOut, yOut, zOut, xOut, yOut, zOut) + } + } +} diff --git a/internal/pkg/cmbv2/utils/pkcs8.go b/internal/pkg/cmbv2/utils/pkcs8.go new file mode 100644 index 0000000..ad7de5b --- /dev/null +++ b/internal/pkg/cmbv2/utils/pkcs8.go @@ -0,0 +1,329 @@ +package utils + +import ( + "crypto/aes" + "crypto/cipher" + "crypto/elliptic" + "crypto/hmac" + "crypto/md5" + "crypto/rand" + "crypto/sha1" + "crypto/sha256" + "crypto/sha512" + "crypto/x509/pkix" + "encoding/asn1" + "fmt" + "hash" + "math/big" + "reflect" + "voucher/internal/pkg/cmb/sm2/model" +) + +/* + * reference to RFC5959 and RFC2898 + */ + +var ( + oidPBES2 = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 5, 13} // id-PBES2(PBES2) + oidPBKDF2 = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 5, 12} // id-PBKDF2 + + oidAES128CBC = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 1, 2} + oidAES256CBC = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 1, 42} + + oidKEYMD5 = asn1.ObjectIdentifier{1, 2, 840, 113549, 2, 5} + oidKEYSHA1 = asn1.ObjectIdentifier{1, 2, 840, 113549, 2, 7} + oidKEYSHA256 = asn1.ObjectIdentifier{1, 2, 840, 113549, 2, 9} + oidKEYSHA512 = asn1.ObjectIdentifier{1, 2, 840, 113549, 2, 11} + + oidSM2 = asn1.ObjectIdentifier{1, 2, 840, 10045, 2, 1} +) + +type Sm2PrivateKey struct { + Version int + PrivateKey []byte + NamedCurveOID asn1.ObjectIdentifier `asn1:"optional,explicit,tag:0"` + PublicKey asn1.BitString `asn1:"optional,explicit,tag:1"` +} + +type pkcs8 struct { + Version int + Algo pkix.AlgorithmIdentifier + PrivateKey []byte +} + +// EncryptedPrivateKeyInfo reference to https://www.rfc-editor.org/rfc/rfc5958.txt +type EncryptedPrivateKeyInfo struct { + EncryptionAlgorithm Pbes2Algorithms + EncryptedData []byte +} + +// Pbes2Algorithms reference to https://www.ietf.org/rfc/rfc2898.txt +type Pbes2Algorithms struct { + IdPBES2 asn1.ObjectIdentifier + Pbes2Params Pbes2Params +} + +// Pbes2Params reference to https://www.ietf.org/rfc/rfc2898.txt +type Pbes2Params struct { + KeyDerivationFunc Pbes2KDfs // PBES2-KDFs + EncryptionScheme Pbes2Encs // PBES2-Encs +} + +// Pbes2KDfs reference to https://www.ietf.org/rfc/rfc2898.txt +type Pbes2KDfs struct { + IdPBKDF2 asn1.ObjectIdentifier + Pkdf2Params Pkdf2Params +} +type Pbes2Encs struct { + EncryAlgo asn1.ObjectIdentifier + IV []byte +} + +// Pkdf2Params reference to https://www.ietf.org/rfc/rfc2898.txt +type Pkdf2Params struct { + Salt []byte + IterationCount int + Prf pkix.AlgorithmIdentifier +} + +func ParsePrivateKey(bytes []byte, pwd []byte) (*model.PrivateKey, error) { + var priKey Sm2PrivateKey + var err error + if pwd == nil { + priKey, err = ParsePKCS8UnEncryptedPrivateKey(bytes) + } else { + priKey, err = ParsePKCS8EncryptedPrivateKey(bytes, pwd) + } + if err != nil { + return nil, fmt.Errorf("parse private key err: %s", err.Error()) + } + curve := NewP256Sm2() + k := new(big.Int).SetBytes(priKey.PrivateKey) + curveOrder := curve.Params().N + if k.Cmp(curveOrder) >= 0 { + return nil, fmt.Errorf("invalid elliptic curve private key value") + } + privateKey := make([]byte, (curveOrder.BitLen()+7)/8) + for len(priKey.PrivateKey) > len(privateKey) { + if priKey.PrivateKey[0] != 0 { + return nil, fmt.Errorf("invalid private key") + } + priKey.PrivateKey = priKey.PrivateKey[1:] + } + copy(privateKey[len(privateKey)-len(priKey.PrivateKey):], priKey.PrivateKey) + x, y := curve.ScalarBaseMult(privateKey) + return &model.PrivateKey{ + PublicKey: &model.PublicKey{ + Curve: curve, + X: x, + Y: y, + }, + D: k, + }, nil +} + +func ParsePKCS8UnEncryptedPrivateKey(bytes []byte) (Sm2PrivateKey, error) { + var pk pkcs8 + var priKey Sm2PrivateKey + + if _, err := asn1.Unmarshal(bytes, &pk); err != nil { + return priKey, err + } + if !reflect.DeepEqual(pk.Algo.Algorithm, oidSM2) { + return priKey, fmt.Errorf("not sm2 elliptic curve") + } + + if _, err := asn1.Unmarshal(pk.PrivateKey, &priKey); err != nil { + return priKey, fmt.Errorf("privateKey is not sm2 private key: %s", err.Error()) + } + return priKey, nil +} + +func ParsePKCS8EncryptedPrivateKey(bytes, pwd []byte) (Sm2PrivateKey, error) { + var keyInfo EncryptedPrivateKeyInfo + var priKey Sm2PrivateKey + _, err := asn1.Unmarshal(bytes, &keyInfo) + if err != nil { + return priKey, fmt.Errorf("privateKey is not sm2 encrypted private key: %s", err.Error()) + } + if !reflect.DeepEqual(keyInfo.EncryptionAlgorithm.IdPBES2, oidPBES2) { + return priKey, fmt.Errorf("x509: only support PBES2") + } + encryptionScheme := keyInfo.EncryptionAlgorithm.Pbes2Params.EncryptionScheme + keyDerivationFunc := keyInfo.EncryptionAlgorithm.Pbes2Params.KeyDerivationFunc + if !reflect.DeepEqual(keyDerivationFunc.IdPBKDF2, oidPBKDF2) { + return priKey, fmt.Errorf("x509: only support PBKDF2") + } + pkdf2Params := keyDerivationFunc.Pkdf2Params + if !reflect.DeepEqual(encryptionScheme.EncryAlgo, oidAES128CBC) && + !reflect.DeepEqual(encryptionScheme.EncryAlgo, oidAES256CBC) { + return priKey, fmt.Errorf("x509: only support AES") + } + iv := encryptionScheme.IV + salt := pkdf2Params.Salt + iter := pkdf2Params.IterationCount + encryptedKey := keyInfo.EncryptedData + var key []byte + switch { + case pkdf2Params.Prf.Algorithm.Equal(oidKEYMD5): + key = pbkdf(pwd, salt, iter, 32, md5.New) + break + case pkdf2Params.Prf.Algorithm.Equal(oidKEYSHA1): + key = pbkdf(pwd, salt, iter, 32, sha1.New) + break + case pkdf2Params.Prf.Algorithm.Equal(oidKEYSHA256): + key = pbkdf(pwd, salt, iter, 32, sha256.New) + break + case pkdf2Params.Prf.Algorithm.Equal(oidKEYSHA512): + key = pbkdf(pwd, salt, iter, 32, sha512.New) + break + default: + return priKey, fmt.Errorf("x509: unknown hash algorithm") + } + block, err := aes.NewCipher(key) + if err != nil { + return priKey, err + } + mode := cipher.NewCBCDecrypter(block, iv) + mode.CryptBlocks(encryptedKey, encryptedKey) + return ParsePKCS8UnEncryptedPrivateKey(encryptedKey) +} + +// copy from crypto/pbkdf2.go +func pbkdf(password, salt []byte, iter, keyLen int, h func() hash.Hash) []byte { + prf := hmac.New(h, password) + hashLen := prf.Size() + numBlocks := (keyLen + hashLen - 1) / hashLen + + var buf [4]byte + dk := make([]byte, 0, numBlocks*hashLen) + U := make([]byte, hashLen) + for block := 1; block <= numBlocks; block++ { + // N.B.: || means concatenation, ^ means XOR + // for each block T_i = U_1 ^ U_2 ^ ... ^ U_iter + // U_1 = PRF(password, salt || uint(i)) + prf.Reset() + prf.Write(salt) + buf[0] = byte(block >> 24) + buf[1] = byte(block >> 16) + buf[2] = byte(block >> 8) + buf[3] = byte(block) + prf.Write(buf[:4]) + dk = prf.Sum(dk) + T := dk[len(dk)-hashLen:] + copy(U, T) + + // U_n = PRF(password, U_(n-1)) + for n := 2; n <= iter; n++ { + prf.Reset() + prf.Write(U) + U = U[:0] + U = prf.Sum(U) + for x := range U { + T[x] ^= U[x] + } + } + } + return dk[:keyLen] +} + +func MarshalSm2PrivateKey(key *model.PrivateKey, pwd []byte) ([]byte, error) { + if pwd == nil { + return MarshalSm2UnEncryptedPrivateKey(key) + } + return MarshalSm2EncryptedPrivateKey(key, pwd) +} + +func MarshalSm2EncryptedPrivateKey(priKey *model.PrivateKey, pwd []byte) ([]byte, error) { + der, err := MarshalSm2UnEncryptedPrivateKey(priKey) + if err != nil { + return nil, err + } + iter := 2048 + salt := make([]byte, 8) + iv := make([]byte, 16) + rand.Reader.Read(salt) + rand.Reader.Read(iv) + key := pbkdf(pwd, salt, iter, 32, sha1.New) // 默认是SHA1 + padding := aes.BlockSize - len(der)%aes.BlockSize + if padding > 0 { + n := len(der) + der = append(der, make([]byte, padding)...) + for i := 0; i < padding; i++ { + der[n+i] = byte(padding) + } + } + encryptedKey := make([]byte, len(der)) + block, err := aes.NewCipher(key) + if err != nil { + return nil, err + } + mode := cipher.NewCBCEncrypter(block, iv) + mode.CryptBlocks(encryptedKey, der) + var algorithmIdentifier pkix.AlgorithmIdentifier + algorithmIdentifier.Algorithm = oidKEYSHA1 + algorithmIdentifier.Parameters.Tag = 5 + algorithmIdentifier.Parameters.IsCompound = false + algorithmIdentifier.Parameters.FullBytes = []byte{5, 0} + keyDerivationFunc := Pbes2KDfs{ + oidPBKDF2, + Pkdf2Params{ + salt, + iter, + algorithmIdentifier, + }, + } + encryptionScheme := Pbes2Encs{ + oidAES256CBC, + iv, + } + pbes2Algorithms := Pbes2Algorithms{ + oidPBES2, + Pbes2Params{ + keyDerivationFunc, + encryptionScheme, + }, + } + encryptedPkey := EncryptedPrivateKeyInfo{ + pbes2Algorithms, + encryptedKey, + } + return asn1.Marshal(encryptedPkey) +} + +func MarshalSm2UnEncryptedPrivateKey(key *model.PrivateKey) ([]byte, error) { + var r pkcs8 + var pri Sm2PrivateKey + var algo pkix.AlgorithmIdentifier + + algo.Algorithm = oidSM2 + algo.Parameters.Class = 0 + algo.Parameters.Tag = 6 + algo.Parameters.IsCompound = false + algo.Parameters.FullBytes = []byte{6, 8, 42, 129, 28, 207, 85, 1, 130, 45} // asn1.Marshal(asn1.ObjectIdentifier{1, 2, 156, 10197, 1, 301}) + pri.Version = 1 + pri.NamedCurveOID = oidNamedCurveP256SM2 + pri.PublicKey = asn1.BitString{Bytes: elliptic.Marshal(key.Curve, key.X, key.Y)} + pri.PrivateKey = key.D.Bytes() + r.Version = 0 + r.Algo = algo + r.PrivateKey, _ = asn1.Marshal(pri) + return asn1.Marshal(r) +} + +func MarshalSm2PublicKey(key *model.PublicKey) ([]byte, error) { + var r PKIXPublicKey + var algo pkix.AlgorithmIdentifier + + if key.Curve.Params() != NewP256Sm2().Params() { + return nil, fmt.Errorf("x509: unsupported elliptic curve") + } + algo.Algorithm = oidSM2 + algo.Parameters.Class = 0 + algo.Parameters.Tag = 6 + algo.Parameters.IsCompound = false + algo.Parameters.FullBytes = []byte{6, 8, 42, 129, 28, 207, 85, 1, 130, 45} // asn1.Marshal(asn1.ObjectIdentifier{1, 2, 156, 10197, 1, 301}) + r.Algo = algo + r.BitString = asn1.BitString{Bytes: elliptic.Marshal(key.Curve, key.X, key.Y)} + return asn1.Marshal(r) +} diff --git a/internal/pkg/cmbv2/utils/utils.go b/internal/pkg/cmbv2/utils/utils.go new file mode 100644 index 0000000..3ad3a24 --- /dev/null +++ b/internal/pkg/cmbv2/utils/utils.go @@ -0,0 +1,209 @@ +package utils + +import ( + "bytes" + "crypto/rand" + "encoding/hex" + "fmt" + "math/big" + "strings" + "voucher/internal/pkg/cmbv2/model" + "voucher/internal/pkg/helper" +) + +func GenerateSM4Key() []byte { + str := "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" + buffer := make([]byte, 16) + for i := 0; i < 16; i++ { + nextInt, _ := rand.Int(rand.Reader, big.NewInt(int64(len(str)))) + buffer[i] = str[nextInt.Int64()] + } + return buffer +} + +// GetSM4IV 获取SM4的IV +func GetSM4IV() []byte { + return RandomBytes(16) +} + +func RandomBytes(length int) []byte { + str := "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" + buffer := make([]byte, length) + for i := 0; i < 16; i++ { + nextInt, _ := rand.Int(rand.Reader, big.NewInt(int64(len(str)))) + buffer[i] = str[nextInt.Int64()] + } + return buffer +} + +func Padding(input []byte, mode int) []byte { + if input == nil { + return nil + } else { + var ret []byte + if mode == 1 { + p := 16 - len(input)%16 + ret = make([]byte, len(input)+p) + copy(ret, input) + + for i := 0; i < p; i++ { + ret[len(input)+i] = byte(p) + } + } else { + p := input[len(input)-1] + ret = make([]byte, len(input)-int(p)) + copy(ret, input[:len(input)-int(p)]) + } + + return ret + } +} + +func AssemblingByteArray(key, iv []byte) []byte { + os := make([]byte, 0) + os = append(os, key...) + os = append(os, []byte("|")...) + os = append(os, iv...) + return os +} + +func SortStructStr(req interface{}) string { + kvRows := helper.SortStructFieldsByKey(req) + + var strToBeSigned strings.Builder + for _, kv := range kvRows { + if kv.Key == "sign" { + continue + } + if kv.Value == "" { + continue + } + strToBeSigned.WriteString(fmt.Sprintf("%s=%s&", kv.Key, kv.Value)) + } + + return strings.TrimRight(strToBeSigned.String(), "&") +} + +func BigIntToByte(n *big.Int) []byte { + byteArray := n.Bytes() + + // If the bytes is not a multiple of 32, pad with zero bytes. + byteArrLen := len(byteArray) + KeyBytes := 32 + if byteArrLen == KeyBytes { + return byteArray + } + byteArray = append(make([]byte, KeyBytes-byteArrLen), byteArray...) + + // If the most significant byte's most significant bit is set, + // prepend a 0 byte to the slice to avoid being interpreted as a negative number. + if (byteArray[0] & 0x80) != 0 { + byteArray = append([]byte{0}, byteArray...) + } + return byteArray +} + +func JoinBytes(params ...[]byte) ([]byte, error) { + var buffer bytes.Buffer + for i := 0; i < len(params); i++ { + _, err := buffer.Write(params[i]) + if err != nil { + return nil, err + } + } + return buffer.Bytes(), nil +} + +func HexToPrivateKey(params *Sm2P256Curve, d []byte) (*model.PrivateKey, error) { + k := new(big.Int).SetBytes(d) + + c := NewP256Sm2() + + //params := c.Params() + n := new(big.Int).Sub(params.N, model.One) + if k.Cmp(n) >= 0 { + return nil, fmt.Errorf("privateKey is overflow") + } + + pri := &model.PrivateKey{ + PublicKey: &model.PublicKey{}, + D: nil, + } + + pri.PublicKey.Curve = c + pri.D = k + pri.PublicKey.X, pri.PublicKey.Y = c.ScalarBaseMult(k.Bytes()) + + return pri, nil +} + +func HexToPublicKey(curve *Sm2P256Curve, d []byte) (*model.PublicKey, error) { + + if len(d) == 65 && d[0] == byte(0x04) { + d = d[1:] + } + + if len(d) != 64 { + return nil, fmt.Errorf("publicKey is not 64 bytes: %d", len(d)) + } + + pub := new(model.PublicKey) + + pub.Curve = curve + + pub.X = new(big.Int).SetBytes(d[:32]) + pub.Y = new(big.Int).SetBytes(d[32:]) + + return pub, nil +} + +func PrivateKeyToHex(key *model.PrivateKey) string { + return key.D.Text(16) +} + +func PublicKeyToHex(key *model.PublicKey) string { + x := key.X.Bytes() + y := key.Y.Bytes() + if n := len(x); n < 32 { + x = append(zeroByteSlice()[:32-n], x...) + } + if n := len(y); n < 32 { + y = append(zeroByteSlice()[:32-n], y...) + } + var c []byte + c = append(c, x...) + c = append(c, y...) + c = append([]byte{0x04}, c...) + return hex.EncodeToString(c) +} + +// 32byte +func zeroByteSlice() []byte { + return []byte{ + 0, 0, 0, 0, + 0, 0, 0, 0, + 0, 0, 0, 0, + 0, 0, 0, 0, + 0, 0, 0, 0, + 0, 0, 0, 0, + 0, 0, 0, 0, + 0, 0, 0, 0, + } +} + +func HexToSignature(hexStr string) (s model.Signature, err error) { + signData, err := hex.DecodeString(hexStr) + if err != nil { + return + } + rBy := make([]byte, 33) + copy(rBy[1:], signData[:32]) + rBy[0] = 0x00 + s.R = new(big.Int).SetBytes(rBy) + + sBy := make([]byte, 33) + copy(sBy[1:], signData[32:64]) + sBy[0] = 0x00 + s.S = new(big.Int).SetBytes(sBy) + return +} diff --git a/internal/pkg/cmbv2/utils/x509.go b/internal/pkg/cmbv2/utils/x509.go new file mode 100644 index 0000000..0e091f4 --- /dev/null +++ b/internal/pkg/cmbv2/utils/x509.go @@ -0,0 +1,38 @@ +package utils + +import ( + "crypto/elliptic" + "crypto/x509/pkix" + "encoding/asn1" + "fmt" + "reflect" + "voucher/internal/pkg/cmb/sm2/model" +) + +var ( + oidNamedCurveP256SM2 = asn1.ObjectIdentifier{1, 2, 156, 10197, 1, 301} // I get the SM2 ID through parsing the pem file generated by gmssl +) + +// PKIXPublicKey reflects a PKIX public key structure. See SubjectPublicKeyInfo +// in RFC 3280. +type PKIXPublicKey struct { + Algo pkix.AlgorithmIdentifier + BitString asn1.BitString +} + +func ParsePublicKey(bytes []byte) (*model.PublicKey, error) { + var pk PKIXPublicKey + if _, err := asn1.Unmarshal(bytes, &pk); err != nil { + return nil, err + } + if !reflect.DeepEqual(pk.Algo.Algorithm, oidSM2) { + return nil, fmt.Errorf("not sm2 elliptic curve") + } + curve := NewP256Sm2() + x, y := elliptic.Unmarshal(curve, pk.BitString.Bytes) + return &model.PublicKey{ + Curve: curve, + X: x, + Y: y, + }, nil +}