記錄 Windows 下編譯一個(gè)開(kāi)源 SM9 簽名驗(yàn)簽 C 程序的過(guò)程

1、KDF.h/*Note: Codes here were downloaded from: /templates/Download/index.aspx?nodeid=71. The disclaimer was published on the link: /Upload/accessory/20175/201755105494041082.pdf . The codes were slightly modified to pass the check of C complier.*/ /* FileName: KDF.h Version: KDF_V1.1 Date: Sep 24,201

2、6 Description: This headfile provides KDF function needed in SM2 algorithm Function List: 1.SM3_256 /calls SM3_init, SM3_process and SM3_done to calculate hash value 2.SM3_init /init the SM3 state 3.SM3_process /compress the the first len/64 blocks of the message 4.SM3_done /compress the rest messag

3、e and output the hash value 5.SM3_compress /called by SM3_process and SM3_done, compress a single block of message 6.BiToW /called by SM3_compress,to calculate W from Bi 7.WToW1 /called by SM3_compress, calculate W from W 8.CF /called by SM3_compress, to calculate CF function. 9.BigEndian /called by

4、 SM3_compress and SM3_done.GM/T 0004-2012 requires to usebig-endian. /if CPU uses little-endian, BigEndian function is a necessary call tochange the /little-endian format into big-endian format. 10.SM3_KDF /calls SM3_init, SM3_process and SM3_done to generate key stream History: 1. Date: Sep 18,2016

5、 Modification: Adding notes to all the functions*/ #ifndef HEADER_KDF_H#define HEADER_KDF_H #include #define SM2_WORDSIZE 8#define SM2_NUMBITS 256#define SM2_NUMWORD (SM2_NUMBITS / SM2_WORDSIZE) /32 #define SM3_len 256#define SM3_T1 0 x79CC4519#define SM3_T2 0 x7A879D8A#define SM3_IVA 0 x7380166f#de

6、fine SM3_IVB 0 x4914b2b9#define SM3_IVC 0 x172442d7#define SM3_IVD 0 xda8a0600#define SM3_IVE 0 xa96f30bc#define SM3_IVF 0 x163138aa#define SM3_IVG 0 xe38dee4d#define SM3_IVH 0 xb0fb0e4e /* Various logical functions */#define SM3_p1(x) (x SM3_rotl32(x, 15) SM3_rotl32(x, 23)#define SM3_p0(x) (x SM3_r

7、otl32(x, 9) SM3_rotl32(x, 17)#define SM3_ff0(a, b, c) (a b c)#define SM3_ff1(a, b, c) (a & b) | (a & c) | (b & c)#define SM3_gg0(e, f, g) (e f g)#define SM3_gg1(e, f, g) (e & f) | (e) & g)#define SM3_rotl32(x, n) (x) (32 - n)#define SM3_rotr32(x, n) (x) n) | (x) (32 - n) typedef struct unsigned long

8、 state8; unsigned long length; unsigned long curlen; unsigned char buf64; SM3_STATE; void CF(unsigned long Wj, unsigned long Wj1, unsigned long V);void BigEndian(unsigned char src, unsigned int bytelen, unsigned char des);void SM3_init(SM3_STATE *md);void SM3_compress(SM3_STATE *md);void SM3_process

9、(SM3_STATE *md, unsigned char *buf, int len);void SM3_done(SM3_STATE *md, unsigned char hash);void SM3_256(unsigned char buf, int len, unsigned char hash);void SM3_KDF(unsigned char Z, unsigned short zlen, unsigned short klen, unsigned char K); #endifKDF.c/*Note: Codes here were downloaded from: /te

10、mplates/Download/index.aspx?nodeid=71. The disclaimer was published on the link: /Upload/accessory/20175/201755105494041082.pdf . The codes were slightly modified to pass the check of C complier.*/ #include #include KDF.h /* Function: BiToW Description: calculate W from Bi Calls: Called By: SM3_comp

11、ress Input: Bi16 /a block of a message Output: W68 Return: null Others:*/void BiToW(unsigned long Bi, unsigned long W) int i; unsigned long tmp; for (i = 0; i = 15; i+) Wi = Bii; for (i = 16; i = 67; i+) tmp = Wi - 16 Wi - 9 SM3_rotl32(Wi - 3, 15); Wi = SM3_p1(tmp) (SM3_rotl32(Wi - 13, 7) Wi - 6; /*

12、 Function: WToW1 Description: calculate W1 from W Calls: Called By: SM3_compress Input: W68 Output: W164 Return: null Others:*/void WToW1(unsigned long W, unsigned long W1) int i; for (i = 0; i = 63; i+) W1i = Wi Wi + 4; /* Function: CF Description: calculate the CF compress function and update V Ca

13、lls: Called By: SM3_compress Input: W68 W164 V8 Output: V8 Return: null Others:*/void CF(unsigned long W, unsigned long W1, unsigned long V) unsigned long SS1; unsigned long SS2; unsigned long TT1; unsigned long TT2; unsigned long A, B, C, D, E, F, G, H; unsigned long T = SM3_T1; unsigned long FF; u

14、nsigned long GG; int j; /reg init,set ABCDEFGH=V0 A = V0; B = V1; C = V2; D = V3; E = V4; F = V5; G = V6; H = V7; for (j = 0; j = 63; j+) /SS1 if (j = 0) T = SM3_T1; else if (j = 16) T = SM3_rotl32(SM3_T2, 16); else T = SM3_rotl32(T, 1); SS1 = SM3_rotl32(SM3_rotl32(A, 12) + E + T), 7); /SS2 SS2 = SS

15、1 SM3_rotl32(A, 12); /TT1 if (j = 15) FF = SM3_ff0(A, B, C); else FF = SM3_ff1(A, B, C); TT1 = FF + D + SS2 + *W1; W1+; /TT2 if (j = 15) GG = SM3_gg0(E, F, G); else GG = SM3_gg1(E, F, G); TT2 = GG + H + SS1 + *W; W+; /D D = C; /C C = SM3_rotl32(B, 9); /B B = A; /A A = TT1; /H H = G; /G G = SM3_rotl3

16、2(F, 19); /F F = E; /E E = SM3_p0(TT2); /update V V0 = A V0; V1 = B V1; V2 = C V2; V3 = D V3; V4 = E V4; V5 = F V5; V6 = G V6; V7 = H V7; /* Function: BigEndian Description: unsigned int endian converse.GM/T 0004-2012 requires to use big-endian. if CPU uses little-endian, BigEndian function is a nec

17、essary call to change the little-endian format into big-endian format. Calls: Called By: SM3_compress, SM3_done Input: srcbytelen bytelen Output: desbytelen Return: null Others: src and des could implies the same address*/void BigEndian(unsigned char src, unsigned int bytelen, unsigned char des) uns

18、igned char tmp = 0; unsigned long i = 0; for (i = 0; i curlen = md-length = 0; md-state0 = SM3_IVA; md-state1 = SM3_IVB; md-state2 = SM3_IVC; md-state3 = SM3_IVD; md-state4 = SM3_IVE; md-state5 = SM3_IVF; md-state6 = SM3_IVG; md-state7 = SM3_IVH; /* Function: SM3_compress Description: compress a sin

19、gle block of message Calls: BigEndian BiToW WToW1 CF Called By: SM3_256 Input: SM3_STATE *md Output: SM3_STATE *md Return: null Others:*/void SM3_compress(SM3_STATE *md) unsigned long W68; unsigned long W164; /if CPU uses little-endian, BigEndian function is a necessary call BigEndian(md-buf, 64, md

20、-buf); BiToW(unsigned long *)md-buf, W); WToW1(W, W1); CF(W, W1, md-state); /* Function: SM3_process Description: compress the first (len/64) blocks of message Calls: SM3_compress Called By: SM3_256 Input: SM3_STATE *md unsigned char buflen /the input message int len /bytelen of message Output: SM3_

21、STATE *md Return: null Others:*/void SM3_process(SM3_STATE *md, unsigned char *buf, int len) while (len-) /* copy byte */ md-bufmd-curlen = *buf+; md-curlen+; /* is 64 bytes full? */ if (md-curlen = 64) SM3_compress(md); md-length += 512; md-curlen = 0; /* Function: SM3_done Description: compress th

22、e rest message that the SM3_process has left behind Calls: SM3_compress Called By: SM3_256 Input: SM3_STATE *md Output: unsigned char *hash Return: null Others:*/void SM3_done(SM3_STATE *md, unsigned char hash) int i; unsigned char tmp = 0; /* increase the bit length of the message */ md-length += m

23、d-curlen bufmd-curlen = 0 x80; md-curlen+; /* if the length is currently above 56 bytes, appends zeros till it reaches 64 bytes, compress the current block, creat a new block by appending zeros and length,and then compress it */ if (md-curlen 56) for (; md-curlen bufmd-curlen = 0; md-curlen+; SM3_co

24、mpress(md); md-curlen = 0; /* if the length is less than 56 bytes, pad upto 56 bytes of zeroes */ for (; md-curlen bufmd-curlen = 0; md-curlen+; /* since all messages are under 232 bits we mark the top bits zero */ for (i = 56; i bufi = 0; /* append length */ md-buf63 = md-length & 0 xff; md-buf62 =

25、 (md-length 8) & 0 xff; md-buf61 = (md-length 16) & 0 xff; md-buf60 = (md-length 24) & 0 xff; SM3_compress(md); /* copy output */ memcpy(hash, md-state, SM3_len / 8); BigEndian(hash, SM3_len / 8, hash); /if CPU uses little-endian, BigEndian function is a necessary call /* Function: SM3_256 Descripti

26、on: calculate a hash value from a given message Calls: SM3_init SM3_process SM3_done Called By: Input: unsigned char buflen /the input message int len /bytelen of the message Output: unsigned char hash32 Return: null Others:*/void SM3_256(unsigned char buf, int len, unsigned char hash) SM3_STATE md;

27、 SM3_init(&md); SM3_process(&md, buf, len); SM3_done(&md, hash); /* Function: SM3_KDF Description: key derivation function Calls: SM3_init SM3_process SM3_done Called By: Input: unsigned char Zzlen unsigned short zlen /bytelen of Z unsigned short klen /bytelen of K Output: unsigned char Kklen /share

28、d secret key Return: null Others:*/void SM3_KDF(unsigned char Z, unsigned short zlen, unsigned short klen, unsigned char K) unsigned short i, j, t; unsigned int bitklen; SM3_STATE md; unsigned char HaSM2_NUMWORD; unsigned char ct4 = 0, 0, 0, 1; bitklen = klen * 8; if (bitklen % SM2_NUMBITS) t = bitk

29、len / SM2_NUMBITS + 1; else t = bitklen / SM2_NUMBITS; /s4: K=Ha1|Ha2|. for (i = 1; i TWIST = MR_SEXTIC_M) zzn2_inv(&r); / could be precalculated zzn2_mul(&r, &r, &w); /w=r*r zzn2_conj(&x, &x); zzn2_mul(&w, &x, &x); zzn2_conj(&y, &y); zzn2_mul(&w, &r, &w); zzn2_mul(&w, &y, &y); zzn2_conj(&z, &z); ec

30、n2_setxyz(&x, &y, &z, &A); /* Function: zzn2_pow Description: regular zzn2 powering see zzn2.cpp for details in MIRACL c+ source file Calls: MIRACL functions Called By: set_frobenius_constant Input: zzn2 x,big k Output: null Return: zzn2 Others:*/zzn2 zzn2_pow(zzn2 x, big k) int i, j, nb, n, nbw, nz

31、s; big zero; zzn2 res, u2, t16; zero = mirvar(0); res.a = mirvar(0); res.b = mirvar(0); u2.a = mirvar(0); u2.b = mirvar(0); if (zzn2_iszero(&x) zzn2_zero(&res); return res; if (size(k) = 0) zzn2_from_int(1, &res); return res; if (size(k) = 1) return x; / Prepare table for windowing zzn2_mul(&x, &x,

32、&u2); t0.a = mirvar(0); t0.b = mirvar(0); zzn2_copy(&x, &t0); for (i = 1; i 1) for (i = nb - 2; i = 0;) /Note new parameter of window_size=5. Default to 5, but reduce to 4 (or even 3) to save RAM n = mr_window(k, i, &nbw, &nzs, 5); for (j = 0; j 0) zzn2_mul(&res, &tn / 2, &res); i -= nbw; if (nzs) f

33、or (j = 0; j GT P is a point of order q in G1. Q(x,y) is a point of order q in G2. Note that P is a point on the sextic twist of the curve over Fp2, Q(x,y) is a point on the curve over the base field Fp see ake12bnx.cpp for details in MIRACL c+ source file Calls: MIRACL functions,zzn12_init,g,q_powe

34、r_frobenius zzn12_copy,zzn12_conj,zzn12_div,zzn12_powq,zzn12_inverse Called By: ecap Input: ecn2 P,big Qx,big Qy,big x,zzn2 X Output: zzn12 *r Return: FALSE: r=0 TRUE: correct calculation Others:*/BOOL fast_pairing(ecn2 P, big Qx, big Qy, big x, zzn2 X, zzn12 *r) int i, nb; big n, zero, negify_x; ec

35、n2 A, KA; zzn12 t0, x0, x1, x2, x3, x4, x5, res; zero = mirvar(0); n = mirvar(0); negify_x = mirvar(0); A.x.a = mirvar(0); A.x.b = mirvar(0); A.y.a = mirvar(0); A.y.b = mirvar(0); A.z.a = mirvar(0); A.z.b = mirvar(0); A.marker = MR_EPOINT_INFINITY; KA.x.a = mirvar(0); KA.x.b = mirvar(0); KA.y.a = mi

36、rvar(0); KA.y.b = mirvar(0); KA.z.a = mirvar(0); KA.z.b = mirvar(0); KA.marker = MR_EPOINT_INFINITY; zzn12_init(&t0); zzn12_init(&x0); zzn12_init(&x1); zzn12_init(&x2); zzn12_init(&x3); zzn12_init(&x4); zzn12_init(&x5); zzn12_init(&res); premult(x, 6, n); incr(n, 2, n); /n=(6*x+2); if (mr_compare(x,

37、 zero) 0) /x= 0; i-) zzn12_mul(res, res, &res); zzn12_mul(res, g(&A, &A, Qx, Qy), &res); if (mr_testbit(n, i) zzn12_mul(res, g(&A, &P, Qx, Qy), &res); / Combining ideas due to Longa, Aranha et al. and Naehrig ecn2_copy(&P, &KA); q_power_frobenius(KA, X); if (mr_compare(x, zero) return (Qy-y)-slope.(

38、Qx-x) see ake12bnx.cpp for details in MIRACL c+ source file Calls: MIRACL functions,zzn12_init Called By: g Input: ecn2 A,ecn2 *C,ecn2 *B,zzn2 slope,zzn2 extra,BOOL Doubling,big Qx,big Qy Output: Return: zzn12 Others:*/zzn12 line(ecn2 A, ecn2 *C, ecn2 *B, zzn2 slope, zzn2 extra, BOOL Doubling, big Q

39、x, big Qy) zzn12 res; zzn2 X, Y, Z, Z2, U, QY, CZ; big QX; QX = mirvar(0); X.a = mirvar(0); X.b = mirvar(0); Y.a = mirvar(0); Y.b = mirvar(0); Z.a = mirvar(0); Z.b = mirvar(0); Z2.a = mirvar(0); Z2.b = mirvar(0); U.a = mirvar(0); U.b = mirvar(0); QY.a = mirvar(0); QY.b = mirvar(0); CZ.a = mirvar(0);

40、 CZ.b = mirvar(0); zzn12_init(&res); ecn2_getz(C, &CZ); / Thanks to A. Menezes for pointing out this optimization. if (Doubling) ecn2_get(&A, &X, &Y, &Z); zzn2_mul(&Z, &Z, &Z2); /Z2=Z*Z /X=slope*X-extra zzn2_mul(&slope, &X, &X); zzn2_sub(&X, &extra, &X); zzn2_mul(&CZ, &Z2, &U); /(-(Z*Z*slope)*Qx); n

41、res(Qx, QX); zzn2_mul(&Z2, &slope, &Y); zzn2_smul(&Y, QX, &Y); zzn2_negate(&Y, &Y); if (get_mip()-TWIST = MR_SEXTIC_M) / multiplied across by i to simplify zzn2_from_big(Qy, &QY); zzn2_txx(&QY); zzn2_mul(&U, &QY, &QY); zzn4_from_zzn2s(&QY, &X, &res.a); zzn2_copy(&Y, &(res.c.b); if (get_mip()-TWIST =

42、 MR_SEXTIC_D) zzn2_smul(&U, Qy, &QY); zzn4_from_zzn2s(&QY, &X, &res.a); zzn2_copy(&Y, &(res.b.b); else /slope*X-Y*Z ecn2_getxy(B, &X, &Y); zzn2_mul(&slope, &X, &X); zzn2_mul(&Y, &CZ, &Y); zzn2_sub(&X, &Y, &X); /(-slope*Qx) nres(Qx, QX); zzn2_smul(&slope, QX, &Z); zzn2_negate(&Z, &Z); if (get_mip()-T

43、WIST = MR_SEXTIC_M) zzn2_from_big(Qy, &QY); zzn2_txx(&QY); zzn2_mul(&CZ, &QY, &QY); zzn4_from_zzn2s(&QY, &X, &res.a); zzn2_copy(&Z, &(res.c.b); if (get_mip()-TWIST = MR_SEXTIC_D) zzn2_smul(&CZ, Qy, &QY); zzn4_from_zzn2s(&QY, &X, &res.a); zzn2_copy(&Z, &(res.b.b); return res; /* Function: g Descripti

44、on: Add A=A+B (or A=A+A),Return line function value see ake12bnx.cpp for details in MIRACL c+ source file Calls: MIRACL functions,zzn12_init,line Called By: Input: ecn2 *A,ecn2 *B,big Qx,big Qy Output: Return: zzn12 Others:*/zzn12 g(ecn2 *A, ecn2 *B, big Qx, big Qy) zzn2 lam, extra; BOOL Doubling; e

45、cn2 P; zzn12 res; lam.a = mirvar(0); lam.b = mirvar(0); extra.a = mirvar(0); extra.b = mirvar(0); P.x.a = mirvar(0); P.x.b = mirvar(0); P.y.a = mirvar(0); P.y.b = mirvar(0); P.z.a = mirvar(0); P.z.b = mirvar(0); P.marker = MR_EPOINT_INFINITY; zzn12_init(&res); ecn2_copy(A, &P); Doubling = ecn2_add2(

46、B, A, &lam, &extra); if (A-marker = MR_EPOINT_INFINITY) zzn4_from_int(1, &res.a); ler = FALSE; res.unitary = TRUE; else res = line(P, A, B, lam, extra, Doubling, Qx, Qy); return res; /* Function: set_frobenius_constant Description: calculate frobenius_constant X see ake12bnx.cpp for details in MIRAC

47、L c+ source file Calls: MIRACL functions,zzn2_pow Called By: SM9_init Input: NULL Output: zzn2 *X Return: NULL Others:*/void set_frobenius_constant(zzn2 *X) big p, zero, one, two; p = mirvar(0); zero = mirvar(0); one = mirvar(0); two = mirvar(0); convert(0, zero); convert(1, one); convert(2, two); m

48、ip = get_mip(); copy(mip-modulus, p); switch (get_mip()-pmod8) case 5: zzn2_from_bigs(zero, one, X); / = (sqrt(-2)(p-1)/2 break; case 3: zzn2_from_bigs(one, one, X); / = (1+sqrt(-1)(p-1)/2 break; case 7: zzn2_from_bigs(two, one, X); / = (2+sqrt(-1)(p-1)/2 default: break; decr(p, 1, p); subdiv(p, 6,

49、p); *X = zzn2_pow(*X, p); /* Function: ecap Description: caculate Rate pairing see ake12bnx.cpp for details in MIRACL c+ source file Calls: MIRACL functions,fast_pairing Called By: SM9_Sign,SM9_Verify Input: ecn2 P,epoint *Q,big x,zzn2 X Output: zzn12 *r Return: FALSE: calculation error TRUE: correc

50、t calculation Others:*/BOOL ecap(ecn2 P, epoint *Q, big x, zzn2 X, zzn12 *r) BOOL Ok; big Qx, Qy; Qx = mirvar(0); Qy = mirvar(0); ecn2_norm(&P); epoint_get(Q, Qx, Qy); Ok = fast_pairing(P, Qx, Qy, x, X, r); if (Ok) return TRUE; return FALSE; /* Function: member Description: ctest if a zzn12 element

51、is of order q test rq = r(p+1-t) =1, so test rp=r(t-1) see ake12bnx.cpp for details in MIRACL c+ source file Calls: MIRACL functions,zzn12_init,zzn12_copy,zzn12_powq Called By: SM9_Sign,SM9_Verify Input: zzn12 r,big x,zzn2 F Output: NULL Return: FALSE: zzn12 element is not of order q TRUE: zzn12 ele

52、ment is of order q Others:*/BOOL member(zzn12 r, big x, zzn2 F) zzn12 w; big six; six = mirvar(0); zzn12_init(&w); convert(6, six); zzn12_copy(&r, &w); /w=r zzn12_powq(F, &w); r = zzn12_pow(r, x); r = zzn12_pow(r, x); r = zzn12_pow(r, six); / t-1=6x2 if (zzn4_compare(&w.a, &r.a) & zzn4_compare(&w.a,

53、 &r.a) & zzn4_compare(&w.a, &r.a) return TRUE; return FALSE;zzn12_operatoin.h/*Note: Codes here were downloaded from: /templates/Download/index.aspx?nodeid=71. The disclaimer was published on the link: /Upload/accessory/20175/201755105494041082.pdf . The codes were slightly modified to pass the chec

54、k of C complier.*/ /* File name: zzn12_operation.h Version: Date: Dec 15,2016 Description: this code is achieved according to zzn12a.h and zzn12a.cpp in MIRCAL C+ sourcefile writen by M. Scott. so,see zzn12a.h and zzn12a.cpp for details. this code define one struct zzn12,and based on it give many fu

55、ctions. Function List: 1.zzn12_init /Initiate struct zzn12 2.zzn12_copy /copy one zzn12 to another 3.zzn12_mul /z=x*y,achieve multiplication with two zzn12 4.zzn12_conj /achieve conjugate complex 5.zzn12_inverse /element inversion 6.zzn12_powq / 7.zzn12_div /division operation 8.zzn12_pow /regular z

56、zn12 powering Notes:*/ #ifndef HEADER_ZZN12_OPERATION_H#define HEADER_ZZN12_OPERATION_H #include miracl.h typedef struct zzn4 a, b, c; BOOL unitary; / unitary property means that fast squaring can be used, and inversions are just conjugates BOOL miller; / miller property means that arithmetic on thi

57、s instance can ignore multiplications / or divisions by constants - as instance will eventually be raised to (p-1). zzn12; void zzn12_init(zzn12 *x);void zzn12_copy(zzn12 *x, zzn12 *y);zzn12_mul(zzn12 x, zzn12 y, zzn12 *z);void zzn12_conj(zzn12 *x, zzn12 *y);zzn12 zzn12_inverse(zzn12 w);void zzn12_p

58、owq(zzn2 F, zzn12 *y);void zzn12_div(zzn12 x, zzn12 y, zzn12 *z);zzn12 zzn12_pow(zzn12 x, big k); #endifzzn12_operation.c/*Note: Codes here were downloaded from: /templates/Download/index.aspx?nodeid=71. The disclaimer was published on the link: /Upload/accessory/20175/201755105494041082.pdf . The c

59、odes were slightly modified to pass the check of C complier.*/ #include zzn12_operation.h zzn2 X; /Frobniues constant /* Function: zzn12_init Description: Initiate struct zzn12 Calls: MIRACL functions Called By: Input: zzn12 *x Output: null Return: null Others:*/void zzn12_init(zzn12 *x) x-a.a.a = m

60、irvar(0); x-a.a.b = mirvar(0); x-a.b.a = mirvar(0); x-a.b.b = mirvar(0); x-a.unitary = FALSE; x-b.a.a = mirvar(0); x-b.a.b = mirvar(0); x-b.b.a = mirvar(0); x-b.b.b = mirvar(0); x-b.unitary = FALSE; x-c.a.a = mirvar(0); x-c.a.b = mirvar(0); x-c.b.a = mirvar(0); x-c.b.b = mirvar(0); x-c.unitary = FAL