English

English

中文

Home

News Detail

国密SM2的调用及SM2、SM3、SM4使用场景

Issuing time:2022-12-09 08:37Author:全球芯 | glochip.comLink:http://glochip.com/news/

SM2是非对称加密算法，对应应用层程序员来说，使用逻辑和RSA一样。

他的最主要的功能：

①非对称加密；

②签名和验签

对于应用层程序员来说，必须熟悉他的使用，以及他的应用领域，一般在写一个安全的应用时，如果单单使用SM2是不安全的，基本上SM2、SM3、SM4都会同时使用。一般都是用SM4对数据内容加密，使用SM3，对内容进行摘要，再使用SM2，对摘要进行签名。这个是数据发送端做的事情。接收端，先用SM2，对摘要进行验签，验签成功后，就做到了防抵赖，对发送过来的内容进行SM3摘要，看下生成的摘要和验签后的摘要是否一致，用于防篡改。

大体逻辑就是这样的。

另外SM4在加密解密需要相同的密钥，这个我们可以通过编写密钥交换模块实现生成相同的密钥。用于SM4对称加密。

对于应用层来说，说白了就是把RSA换成SM2、把MD5换成SM3，把AES换成SM4，这下大家明白了吧。

这里使用hutool这个库进行SM2的操作！

关于非对称加密的公钥和私钥，可以使用hutool生成，也可以使用openssl生成

openssl生成SM2公钥私钥：

openssl ecparam -genkey -name SM2 -out priv.key

openssl ec -in priv.key -pubout -out pub.key

生成的密钥如下：

-----BEGIN PUBLIC KEY-----

MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE5SMhCzQHRkg5cjVY4NgnZbniyslJ

G9hsmcibn8Q/vpqUOV7jE428SuQ9qo/gH9US3oVoEC40xmmJ6yswZhG1GA==

-----END PUBLIC KEY-----

-----BEGIN EC PARAMETERS-----

BggqgRzPVQGCLQ==

-----END EC PARAMETERS-----

-----BEGIN EC PRIVATE KEY-----

MHcCAQEEIE8DQeWXexdeDsDh/e/SeZsT3SXFFxYTPvQrp2wO3Zc9oAoGCCqBHM9V

AYItoUQDQgAE5SMhCzQHRkg5cjVY4NgnZbniyslJG9hsmcibn8Q/vpqUOV7jE428

SuQ9qo/gH9US3oVoEC40xmmJ6yswZhG1GA==

-----END EC PRIVATE KEY-----

关于非对称还要注意几点：

公钥是通过私钥产生的；

公钥加密，私钥解密是加密的过程

私钥加密，公钥解密是签名的过程；

源码如下：

package cn.it1995;

import cn.hutool.core.codec.Base64;

import cn.hutool.core.util.HexUtil;

import cn.hutool.core.util.StrUtil;

import cn.hutool.crypto.SecureUtil;

import cn.hutool.crypto.SmUtil;

import cn.hutool.crypto.asymmetric.KeyType;

import cn.hutool.crypto.asymmetric.SM2;

import javax.swing.*;

import java.security.KeyPair;

public class Main {

static String txt = "Hello World";

/***

* 随机生成的密钥对加密或解密

public static void test1(){

SM2 sm2 = SmUtil.sm2();

System.out.println("私钥:" + sm2.getPrivateKey());

System.out.println("公钥:" + sm2.getPublicKey());

String encryptStr = sm2.encryptBcd(txt, KeyType.PublicKey);

String decryptStr = StrUtil.utf8Str(sm2.decryptFromBcd(encryptStr, KeyType.PrivateKey));

System.out.println("密文:" + encryptStr);

System.out.println("明文:" + decryptStr);

}

/***

* 自定义密钥对加密或解密

public static void test2(){

KeyPair pair = SecureUtil.generateKeyPair("SM2");

byte[] privateKey = pair.getPrivate().getEncoded();

byte[] publicKey = pair.getPublic().getEncoded();

System.out.println("私钥:");

for(Integer i = 0; i < privateKey.length; i++){

System.out.print(privateKey[i] + " ");

}

System.out.println();

System.out.println("公钥:");

for(Integer i = 0; i < publicKey.length; i++){

System.out.print(publicKey[i] + " ");

}

System.out.println();

SM2 sm2 = SmUtil.sm2(privateKey, publicKey);

String encryptStr = sm2.encryptBcd(txt, KeyType.PublicKey);

String decryptStr = StrUtil.utf8Str(sm2.decryptFromBcd(encryptStr, KeyType.PrivateKey));

System.out.println("密文:" + encryptStr);

System.out.println("明文:" + decryptStr);

}

/***

* 使用OpenSSL生成的SM2公钥和私钥加密或解密

public static void test3(){

String privateKey = "MHcCAQEEIE8DQeWXexdeDsDh/e/SeZsT3SXFFxYTPvQrp2wO3Zc9oAoGCCqBHM9VAYItoUQDQgAE5SMhCzQHRkg5cjVY4NgnZbniyslJG9hsmcibn8Q/vpqUOV7jE428SuQ9qo/gH9US3oVoEC40xmmJ6yswZhG1GA==";

String publicKey = "MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE5SMhCzQHRkg5cjVY4NgnZbniyslJG9hsmcibn8Q/vpqUOV7jE428SuQ9qo/gH9US3oVoEC40xmmJ6yswZhG1GA==";

SM2 sm2 = SmUtil.sm2(Base64.decode(privateKey), Base64.decode(publicKey));

String encryptStr = sm2.encryptBcd(txt, KeyType.PublicKey);

String decryptStr = StrUtil.utf8Str(sm2.decryptFromBcd(encryptStr, KeyType.PrivateKey));

System.out.println("密文:" + encryptStr);

System.out.println("明文:" + decryptStr);

}

/***

* 随机密钥签名和验签

public static void test4(){

SM2 sm2 = SmUtil.sm2();

String sign = sm2.signHex(HexUtil.encodeHexStr(txt));

System.out.println("sign:" + sign);

boolean verify = sm2.verifyHex(HexUtil.encodeHexStr(txt), sign);

System.out.println("verify:" + verify);

}

/***

* 自定义密钥对签名和验签

public static void test5(){

KeyPair pair = SecureUtil.generateKeyPair("SM2");

final SM2 sm2 = new SM2(pair.getPrivate(), pair.getPublic());

byte[] sign = sm2.sign(txt.getBytes());

System.out.println("sign");

for(Integer i = 0; i < sign.length; i++){

System.out.print(sign[i] + " ");

}

System.out.println();

boolean verify = sm2.verify(txt.getBytes(), sign);

System.out.print("verify:" + verify);

}

/**

* OpenSSL密钥对签名和验签

public static void test6(){

String privateKey = "MHcCAQEEIE8DQeWXexdeDsDh/e/SeZsT3SXFFxYTPvQrp2wO3Zc9oAoGCCqBHM9VAYItoUQDQgAE5SMhCzQHRkg5cjVY4NgnZbniyslJG9hsmcibn8Q/vpqUOV7jE428SuQ9qo/gH9US3oVoEC40xmmJ6yswZhG1GA==";

String publicKey = "MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE5SMhCzQHRkg5cjVY4NgnZbniyslJG9hsmcibn8Q/vpqUOV7jE428SuQ9qo/gH9US3oVoEC40xmmJ6yswZhG1GA==";

SM2 sm2 = SmUtil.sm2(Base64.decode(privateKey), Base64.decode(publicKey));

byte[] sign = sm2.sign(txt.getBytes());

System.out.println("sign");

for(Integer i = 0; i < sign.length; i++){

System.out.print(sign[i] + " ");

}

System.out.println();

boolean verify = sm2.verify(txt.getBytes(), sign);

System.out.print("verify:" + verify);

}

/***

* 分开的：私钥签名，公钥验签

* 密钥使用OpenSSL生成

public static void test7(){

String privateKey = "MHcCAQEEIE8DQeWXexdeDsDh/e/SeZsT3SXFFxYTPvQrp2wO3Zc9oAoGCCqBHM9VAYItoUQDQgAE5SMhCzQHRkg5cjVY4NgnZbniyslJG9hsmcibn8Q/vpqUOV7jE428SuQ9qo/gH9US3oVoEC40xmmJ6yswZhG1GA==";

String publicKey = "MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE5SMhCzQHRkg5cjVY4NgnZbniyslJG9hsmcibn8Q/vpqUOV7jE428SuQ9qo/gH9US3oVoEC40xmmJ6yswZhG1GA==";

SM2 sm2Sign = SmUtil.sm2(Base64.decode(privateKey), null);

sm2Sign.usePlainEncoding();

byte[] sign = sm2Sign.sign(txt.getBytes(), null);

System.out.println("sign");

for(Integer i = 0; i < sign.length; i++){

System.out.print(sign[i] + " ");

}

System.out.println();

SM2 sm2 = SmUtil.sm2(null, Base64.decode(publicKey));

sm2.usePlainEncoding();

boolean verify = sm2.verify(txt.getBytes(), sign);

System.out.print("verify:" + verify);

}

public void test8(){

}

public static void main(String[] args) {

test1();