Skip to main content

Crate sm2cl

Crate sm2cl 

Source
Expand description

§SM2 Certificate Less (sm2cl)

A high-performance pure-Rust implementation of the Chinese National Standard SM2 cryptographic algorithms and GM/T 0130-2023 certificateless cryptography, adhering to the KISS (Keep It Simple, Stupid) principle.

  1. Standard SM2 Public Key Cryptography (GB/T 32918 / GM/T 0003):
    • Key pair generation, private/public key export and parsing
    • Digital signatures and verification (supports custom user ID or standard default "1234567812345678")
    • Public key encryption and private key decryption
    • GM/T 0009 standard ASN.1 DER encoding/decoding, and standard C1C3C2 / legacy C1C2C3 format conversions
  2. SM2 Certificateless Public Key Cryptography (GM/T 0130-2023):
    • KGC master key setup and master public key management
    • User secret value, secret point, and claimed public key exchange
    • User private key aggregation ($d_A = (t_A + d_A’) \bmod n$)
    • Dynamic public key synthesis without digital certificates ($P_A = W_A + [\lambda]P_{pub}$)
    • Certificateless digital signatures and verification
    • Certificateless public key encryption and decryption

§Quick Examples

§Standard SM2 Signature and Verification

use sm2cl::{KeyPair, sign, verify, Signature};

let keypair = KeyPair::generate()?;
let msg = b"Hello, SM2 standard signature!";

// Sign
let sig = sign(keypair.private_key(), msg, None)?;

// Verify
verify(keypair.public_key(), msg, None, &sig)?;

// ASN.1 DER roundtrip
let der = sig.to_der();
let parsed_sig = Signature::from_der(&der)?;
assert_eq!(sig, parsed_sig);

§Standard SM2 Encryption and Decryption

use sm2cl::{KeyPair, encrypt, decrypt, Ciphertext};

let keypair = KeyPair::generate()?;
let msg = b"Confidential message";

let cipher = encrypt(keypair.public_key(), msg)?;
let plain = decrypt(keypair.private_key(), &cipher)?;
assert_eq!(msg, plain.as_slice());

§GM/T 0130-2023 Certificateless Cryptography (No Certificates)

use sm2cl::{
    KgcMasterKey, UserSecret,
    cl_sign, cl_verify, cl_encrypt, cl_decrypt,
};

let id = "alice@example.com";
let msg = b"Certificateless message";

// 1. KGC initialization
let kgc = KgcMasterKey::generate()?;
let kgc_pub = kgc.public_key()?;

// 2. User locally generates secret and public secret point
let user_secret = UserSecret::generate()?;
let user_point = user_secret.public_point()?;

// 3. KGC generates partial private key and claimed public key WA
let (partial_key, claimed_pk) = kgc.generate_partial_key(id, &user_point)?;

// 4. User aggregates complete private key
let user_sk = user_secret.aggregate_private_key(&partial_key);

// 5. Certificateless sign and verify
let sig = cl_sign(&user_sk, &claimed_pk, &kgc_pub, id, msg)?;
cl_verify(&kgc_pub, id, &claimed_pk, msg, &sig)?;

// 6. Certificateless encrypt and decrypt
let cipher = cl_encrypt(&kgc_pub, id, &claimed_pk, msg)?;
let plain = cl_decrypt(&user_sk, &cipher)?;
assert_eq!(msg, plain.as_slice());

Re-exports§

pub use error::Result;
pub use error::Sm2Error;
pub use standard::DEFAULT_SM2_ID;
pub use standard::Ciphertext;
pub use standard::KeyPair;
pub use standard::PrivateKey;
pub use standard::PublicKey;
pub use standard::Signature;
pub use standard::decrypt;
pub use standard::encrypt;
pub use standard::encrypt;
pub use standard::encrypt_with_k;
pub use standard::sign;
pub use standard::sign;
pub use standard::sign_digest;
pub use standard::sign_digest_with_k;
pub use standard::verify;
pub use standard::verify_digest;
pub use certificateless::CertificatelessPrivateKey;
pub use certificateless::CertificatelessPublicKey;
pub use certificateless::ClaimedPublicKey;
pub use certificateless::KgcMasterKey;
pub use certificateless::KgcPublicKey;
pub use certificateless::PartialPrivateKey;
pub use certificateless::UserSecret;
pub use certificateless::UserSecretPoint;
pub use certificateless::cl_decrypt;
pub use certificateless::cl_encrypt;
pub use certificateless::cl_encrypt_with_k;
pub use certificateless::cl_sign;
pub use certificateless::cl_sign_with_k;
pub use certificateless::cl_verify;
pub use certificateless::compute_cl_digest;

Modules§

certificateless
core
error
standard