devbox
我家自动化
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

国密算法 SM9 公钥加密 数字签名 密钥交换 基于身份的密码算法（IBC）高效python代码_sm9算法

作者：我家自动化 | 2024-04-26 05:08:48

赞

踩

sm9算法

接上篇：国密算法 SM9 公钥加密 数字签名 密钥交换 基于身份的密码算法（IBC）完整高效的开源python代码-CSDN博客

接触过国密算法Python库——hggm的朋友可能知道，库中SM2、SM3、SM4、ZUC都区分了慢速版和快速版：慢速版纯Python实现，代码逻辑清晰适合教学；快速版用了外挂（如numba），牺牲代码可读性或部分Python特性以追求更高的效率。上篇SM9代码虽然集成了若干关于效率优化的文献研究成果，但毕竟是纯Python实现的，我还是放在了慢速版（/slow目录下），这显然是给自己挖了坑。没发现合适的外挂，故而继续在数学上做文章，在上篇代码的基础上，主要进行了3项优化：

①固定点乘预计算。SM9的两个椭圆曲线群G1、G2的生成元分别是P1、P2，还有用户签名私钥ds，算法中多次出现与这些固定点的点乘运算(k·P)，类似SM2，可提前计算好k的每一个字节位置与P相乘的结果并保存，后续点乘运算则转变为31次点加法。实测有6.~倍的效率提升。

②采用Comb固定基的高次幂运算。算法中多次出现以gs和ge为底的幂运算（gs=e(P1, Ppub_s), ge=e(Ppub_e, P2)），提前计算好gs和ge的预计算表，后续幂运算转变为31次乘法和31次平方计算（见文献：王江涛,樊荣,黄哲. SM9中高次幂运算的快速实现方法[J]. 计算机工程,2023,49(9):118-124,136. DOI:10.19678/j.issn.1000-3428.0065618）。实测有4倍左右的效率提升。

③固定G2点的双线性对预计算。用户加密私钥de（椭圆曲线群G2上的点）经常参与双线性对计算，可预先计算好双线性对Miller循环中由该点衍生出的所有系数，后续计算双线性对时可简化线函数，并省略点加。不过实测只有10%左右的效率提升。

当然上述优化都是针对特定的计算步骤，签名验签、加解密、密钥交换等算法中也包含了许多不符合上述情况的耗时步骤，因此实际提升幅度没有那么大。虽然依旧是纯Python实现，但上述优化也以牺牲可读性为代价，所以放在了快速版这边。

完整代码如下：

  1. import os
  2. from random import randrange
  3. from math import ceil
  4. from .SM3 import digest as sm3
  5.  
  6. # SM9总则(GB_T 38635.1-2020) A.1 系统参数
  7. q = 0XB640000002A3A6F1D603AB4FF58EC74521F2934B1A7AEEDBE56F9B27E351457D  # 基域特征
  8. N = 0XB640000002A3A6F1D603AB4FF58EC74449F2934B18EA8BEEE56EE19CD69ECF25  # 群的阶
  9. # 群G1的生成元 P1=(x_p1, y_p1)
  10. x_p1 = 0X93DE051D62BF718FF5ED0704487D01D6E1E4086909DC3280E8C4E4817C66DDDD
  11. y_p1 = 0X21FE8DDA4F21E607631065125C395BBC1C1C00CBFA6024350C464CD70A3EA616
  12. # 群G2的生成元 P2=(x_p2, y_p2)
  13. x_p2 = (0X85AEF3D078640C98597B6027B441A01FF1DD2C190F5E93C454806C11D8806141,
  14.         0X3722755292130B08D2AAB97FD34EC120EE265948D19C17ABF9B7213BAF82D65B)
  15. y_p2 = (0X17509B092E845C1266BA0D262CBEE6ED0736A96FA347C8BD856DC76B84EBEB96,
  16.         0XA7CF28D519BE3DA65F3170153D278FF247EFBA98A71A08116215BBA5C999A7C7)
  17. HASH_SIZE = 32  # sm3输出256位（32字节）
  18. N_SIZE = 32  # 阶的字节数
  19. KEY_LEN = 128  # 默认密钥位数
  20. K2_len = 256  # MAC函数中密钥K2的位数
  21.  
  22.  
  23. def to_byte(x, size=None):
  24.     if type(x) is int:
  25.         return x.to_bytes(size if size else ceil(x.bit_length() / 8), byteorder='big')
  26.     elif type(x) in (str, bytes):
  27.         x = x.encode() if type(x) is str else x
  28.         return x[:size] if size and len(x) > size else x  # 超过指定长度，则截取左侧字符
  29.     elif type(x) in (tuple, list):
  30.         return b''.join(to_byte(c, size) for c in x)
  31.     return bytes(x)[:size] if size else bytes(x)
  32.  
  33.  
  34. # 将字节转换为int
  35. def to_int(byte):
  36.     return int.from_bytes(byte, byteorder='big')
  37.  
  38.  
  39. # 广义的欧几里得除法求模逆（耗时约为slow/SM2代码内get_inverse函数的43%）
  40. def mod_inv(a, mod=q):
  41.     if a == 0:
  42.         return 0
  43.     lm, low, hm, high = 1, a % mod, 0, mod
  44.     while low > 1:
  45.         r = high // low
  46.         lm, low, hm, high = hm - lm * r, high - low * r, lm, low
  47.     return lm % mod
  48.  
  49.  
  50. class FQ:
  51.     def __init__(self, n):
  52.         self.n = n
  53.  
  54.     def __add__(self, other):
  55.         return FQ(self.n + other.n)
  56.  
  57.     def __sub__(self, other):
  58.         return FQ(self.n - other.n)
  59.  
  60.     def __mul__(self, other):  # 右操作数可为int
  61.         return FQ(self.n * (other.n if type(other) is FQ else other) % q)
  62.  
  63.     def __truediv__(self, other):  # 右操作数可为int
  64.         return FQ(self.n * mod_inv(other.n if type(other) is FQ else other) % q)
  65.  
  66.     def __pow__(self, other):  # 操作数应为int
  67.         return FQ(pow(self.n, other, q) if other else 1)
  68.  
  69.     def __eq__(self, other):  # 右操作数可为int
  70.         return self.n % q == (other.n if type(other) is FQ else other) % q
  71.  
  72.     def __neg__(self):
  73.         return FQ(-self.n)
  74.  
  75.     def __repr__(self):
  76.         return 'FQ(%064X)' % (self.n % q)
  77.  
  78.     def __bytes__(self):
  79.         return to_byte(self.n % q, N_SIZE)
  80.  
  81.     def is_zero(self):
  82.         return self.n % q == 0
  83.  
  84.     def inv(self):
  85.         return FQ(mod_inv(self.n))
  86.  
  87.     def sqr(self):
  88.         return FQ(self.n * self.n % q)
  89.  
  90.     @classmethod
  91.     def one(cls):
  92.         return cls(1)
  93.  
  94.     @classmethod
  95.     def zero(cls):
  96.         return cls(0)
  97.  
  98.  
  99. class FQ2:
  100.     def __init__(self, *coeffs):  # 国标中的表示是高位在前，而此处coeffs是低位在前
  101.         self.coeffs = coeffs
  102.  
  103.     def __add__(self, other):
  104.         (a0, a1), (b0, b1) = self.coeffs, other.coeffs
  105.         return FQ2(a0 + b0, a1 + b1)
  106.  
  107.     def __sub__(self, other):
  108.         (a0, a1), (b0, b1) = self.coeffs, other.coeffs
  109.         return FQ2(a0 - b0, a1 - b1)
  110.  
  111.     def sqr(self):
  112.         a0, a1 = self.coeffs
  113.         return FQ2((a0 * a0 - (a1 * a1 << 1)) % q, (a0 * a1 << 1) % q)  # (a0^2 - 2 * a1^2, 2 * a0 * a1)
  114.  
  115.     def sqr_u(self):
  116.         a0, a1 = self.coeffs
  117.         return FQ2(-(a0 * a1 << 2) % q, (a0 * a0 - (a1 * a1 << 1)) % q)  # (-4 * a0 * a1, a0^2 - 2 * a1^2)
  118.  
  119.     def mul_b_u(self, b):  # 带参数乘法
  120.         (a0, a1), (b0, b1) = self.coeffs, b.coeffs
  121.         return FQ2(-(a0 * b1 + a1 * b0 << 1) % q, (a0 * b0 - (a1 * b1 << 1)) % q)  # (-2*(a0*b1+a1*b0), a0*b0-2*a1*b1)
  122.  
  123.     def __mul__(self, other):
  124.         if type(other) is int:
  125.             a0, a1 = self.coeffs
  126.             return FQ2(a0 << 1, a1 << 1) if other == 2 else FQ2(a0 * other % q, a1 * other % q)
  127.         (a0, a1), (b0, b1) = self.coeffs, other.coeffs
  128.         a0b0, a1b1 = a0 * b0, a1 * b1  # Karatsuba 思想方法（节约一次乘法），实测此处约有5%提升，用在其他地方未见性能提升
  129.         return FQ2((a0b0 - (a1b1 << 1)) % q, ((a0 + a1) * (b0 + b1) - (a0b0 + a1b1)) % q)  # (a0*b0-2*a1*b1,a0*b1+a1*b0)
  130.  
  131.     def __rmul__(self, other):
  132.         return self.__mul__(other)
  133.  
  134.     def __truediv__(self, other):
  135.         if type(other) is int:
  136.             other_inv = mod_inv(other)
  137.             return FQ2([c * other_inv % q for c in self.coeffs])
  138.         return self * other.inv()
  139.  
  140.     def inv(self):
  141.         a0, a1 = self.coeffs
  142.         if a0 == 0:
  143.             return FQ2(0, -mod_inv(a1 << 1))  # (0, -(2 * a1)^-1)
  144.         if a1 == 0:
  145.             return FQ2(mod_inv(a0), 0)  # (a0^-1, 0)
  146.         k = mod_inv(a0 * a0 + (a1 * a1 << 1))  # k = (a0^2 + 2 * a1^2)^-1
  147.         return FQ2(a0 * k % q, -a1 * k % q)  # (a0 * k, -a1 * k)
  148.  
  149.     def conjugate(self):  # 共轭
  150.         a0, a1 = self.coeffs
  151.         return self.__class__(a0, -a1)
  152.  
  153.     def get_fp_list(self):  # 返回所有基域元素（高位在前）
  154.         if type(self) is FQ2:
  155.             return [i % q for i in self[::-1]]
  156.         return [y for x in self[::-1] for y in x.get_fp_list()] if self.coeffs else [0] * 4  # 注意FQ4对象零值的处理
  157.  
  158.     def __repr__(self):
  159.         return '%s(%s)' % (self.__class__.__name__, ', '.join('%064X' % i for i in self.get_fp_list()))
  160.  
  161.     def __bytes__(self):  # 字节串高位在前
  162.         return to_byte(self.get_fp_list(), N_SIZE)
  163.  
  164.     def __eq__(self, other):
  165.         return self.get_fp_list() == other.get_fp_list()
  166.  
  167.     def __neg__(self):
  168.         return self.__class__(*[-c for c in self.coeffs])
  169.  
  170.     def __getitem__(self, item):
  171.         return self.coeffs[item]
  172.  
  173.     def is_zero(self):
  174.         return all(c % q == 0 for c in self.coeffs) if type(self) is FQ2 else all(c.is_zero() for c in self.coeffs)
  175.  
  176.     @classmethod
  177.     def one(cls):
  178.         return FQ2_one if cls is FQ2 else (FQ12_one if cls is FQ12 else FQ4_one)
  179.  
  180.     @classmethod
  181.     def zero(cls):
  182.         return FQ2_zero if cls is FQ2 else ()
  183.  
  184.  
  185. class FQ4(FQ2):  # 零元的coeffs为空，可优化FQ12稀疏乘法运算
  186.     def __add__(self, other):
  187.         if not self.coeffs:
  188.             return other
  189.         if not other.coeffs:
  190.             return self
  191.         (a0, a1), (b0, b1) = self.coeffs, other.coeffs
  192.         return FQ4(a0 + b0, a1 + b1)
  193.  
  194.     def __sub__(self, other):
  195.         if not self.coeffs:
  196.             return -other
  197.         if not other.coeffs:
  198.             return self
  199.         (a0, a1), (b0, b1) = self.coeffs, other.coeffs
  200.         return FQ4(a0 - b0, a1 - b1)
  201.  
  202.     def sqr(self):
  203.         if not self.coeffs:
  204.             return FQ4_zero
  205.         a0, a1 = self.coeffs
  206.         return FQ4(a0.sqr() + a1.sqr_u(), a0 * a1 * 2)  # (a0^2 + a1^2 * u, 2 * a0 * a1)
  207.  
  208.     def sqr_v(self):
  209.         if not self.coeffs:
  210.             return FQ4_zero
  211.         a0, a1 = self.coeffs
  212.         return FQ4(a0.mul_b_u(a1) * 2, a0.sqr() + a1.sqr_u())  # (2 * a0 * a1 * u, a0^2 + a1^2 * u)
  213.  
  214.     def mul_b_v(self, b):  # 带参数乘法
  215.         if not self.coeffs or not b.coeffs:
  216.             return FQ4_zero
  217.         (a0, a1), (b0, b1) = self.coeffs, b.coeffs
  218.         return FQ4(a0.mul_b_u(b1) + a1.mul_b_u(b0), a0 * b0 + a1.mul_b_u(b1))  # (a0*b1*u+a1*b0*u, a0*b0+a1*b1*u)
  219.  
  220.     def __mul__(self, other):
  221.         if not self.coeffs:
  222.             return FQ4_zero
  223.         if type(other) is int:
  224.             a0, a1 = self.coeffs
  225.             return FQ4(a0 * other, a1 * other)
  226.         if not other.coeffs:
  227.             return FQ4_zero
  228.         (a0, a1), (b0, b1) = self.coeffs, other.coeffs
  229.         return FQ4(a0 * b0 + a1.mul_b_u(b1), a0 * b1 + a1 * b0)  # (a0*b0+a1*b1*u, a0*b1+a1*b0)
  230.  
  231.     def inv(self):
  232.         if not self.coeffs:
  233.             return FQ4_zero
  234.         a0, a1 = self.coeffs
  235.         k = (a1.sqr_u() - a0.sqr()).inv()
  236.         return FQ4((-a0 * k), a1 * k)
  237.  
  238.  
  239. class FQ12(FQ2):
  240.     def __add__(self, other):
  241.         (a0, a1, a2), (b0, b1, b2) = self.coeffs, other.coeffs
  242.         return FQ12(a0 + b0, a1 + b1, a2 + b2)
  243.  
  244.     def __sub__(self, other):
  245.         (a0, a1, a2), (b0, b1, b2) = self.coeffs, other.coeffs
  246.         return FQ12(a0 - b0, a1 - b1, a2 - b2)
  247.  
  248.     def sqr(self):
  249.         a0, a1, a2 = self.coeffs
  250.         return FQ12(a0.sqr() + a1.mul_b_v(a2) * 2, a0 * a1 * 2 + a2.sqr_v(), a0 * a2 * 2 + a1.sqr())
  251.  
  252.     def __mul__(self, other):
  253.         (a0, a1, a2), (b0, b1, b2) = self.coeffs, other.coeffs
  254.         return FQ12(a0 * b0 + a1.mul_b_v(b2) + a2.mul_b_v(b1), a0 * b1 + a1 * b0 + a2.mul_b_v(b2),
  255.                     a0 * b2 + a1 * b1 + a2 * b0)
  256.  
  257.     def sqr2(self):  # 分圆循环子群Gϕ6(Fp2)中的元素平方
  258.         a, b, c = self.coeffs
  259.         a2, b2, c2v = a.sqr(), b.sqr(), c.sqr_v()
  260.         return FQ12(a2 + (a2 - a.conjugate()) * 2, c2v + (c2v + b.conjugate()) * 2, b2 + (b2 - c.conjugate()) * 2)
  261.  
  262.     def __pow__(self, other):  # 实际运行此函数的对象都是分圆循环子群Gϕ6(Fp2)中的元素
  263.         if other > 10:  # 加减法
  264.             h, k = bin(3 * other)[2:], bin(other)[2:]
  265.             k, t, nf = '0' * (len(h) - len(k)) + k, self, self.frobenius6()
  266.             for i in range(1, len(h) - 1):
  267.                 t = t.sqr2()
  268.                 if h[i] == '1' and k[i] == '0':
  269.                     t = t * self
  270.                 elif h[i] == '0' and k[i] == '1':
  271.                     t = t * nf
  272.         else:
  273.             t = self
  274.             for ri in bin(other)[3:]:
  275.                 t = t.sqr2() * self if ri == '1' else t.sqr2()
  276.         return t
  277.  
  278.     def inv(self):
  279.         a0, a1, a2 = self.coeffs
  280.         a0_2, a1_2 = a0.sqr(), a1.sqr()
  281.         if a2.is_zero():
  282.             k = (a0 * a0_2 + a1.mul_b_v(a1_2)).inv()
  283.             return FQ12(a0_2 * k, (-a0 * a1 * k), a1_2 * k)
  284.         t0, t1, t2 = a1_2 - a0 * a2, a0 * a1 - a2.sqr_v(), a0_2 - a1.mul_b_v(a2)
  285.         t3 = a2 * (t1.sqr() - t0 * t2).inv()
  286.         return FQ12(t2 * t3, (-t1 * t3), t0 * t3)
  287.  
  288.     def frobenius(self):
  289.         (a0, a1), (b0, b1), (c0, c1) = self.coeffs
  290.         a = FQ4(a0.conjugate(), a1.conjugate() * alpha3)
  291.         b = FQ4(b0.conjugate() * alpha1, b1.conjugate() * alpha4)
  292.         c = FQ4(c0.conjugate() * alpha2, c1.conjugate() * alpha5)
  293.         return FQ12(a, b, c)
  294.  
  295.     def frobenius2(self):
  296.         a, b, c = self.coeffs
  297.         return FQ12(a.conjugate(), b.conjugate() * alpha2, c.conjugate() * alpha4)
  298.  
  299.     def frobenius3(self):
  300.         (a0, a1), (b0, b1), (c0, c1) = self.coeffs
  301.         a = FQ4(a0.conjugate(), -a1.conjugate() * alpha3)
  302.         b = FQ4(b0.conjugate() * alpha3, b1.conjugate())
  303.         c = FQ4(-c0.conjugate(), c1.conjugate() * alpha3)
  304.         return FQ12(a, b, c)
  305.  
  306.     def frobenius6(self):
  307.         a, b, c = self.coeffs
  308.         return FQ12(a.conjugate(), -b.conjugate(), c.conjugate())
  309.  
  310.  
  311. class ECC_Point:
  312.     def __init__(self, *pt):  # 采用Jacobian射影坐标计算，输入仿射坐标后会转换为Jacobian射影坐标
  313.         self.pt = pt if len(pt) == 3 else (*pt, pt[0].one())
  314.  
  315.     @classmethod
  316.     def from_byte(cls, byte):  # 输入bytes类型仿射坐标，构建点对象
  317.         fp_num = len(byte) // (N_SIZE << 1)  # 单个坐标包含的域元素个数
  318.         if fp_num in (1, 2) and len(byte) % N_SIZE == 0:
  319.             fp_list = [to_int(byte[i:i + N_SIZE]) for i in range(0, len(byte), N_SIZE)]  # 将bytes转换为域元素列表
  320.             if fp_num == 1:
  321.                 return cls(FQ(fp_list[0]), FQ(fp_list[1]))
  322.             x_list, y_list = fp_list[fp_num - 1::-1], fp_list[:fp_num - 1:-1]  # 从bytes到FQ2对象保存的域元素，需翻转高低位顺序
  323.             return cls(FQ2(*x_list), FQ2(*y_list))
  324.         return False
  325.  
  326.     def is_inf(self):
  327.         return self[2].is_zero()
  328.  
  329.     def is_on_curve(self):  # 检查点是否满足曲线方程 y^2 == x^3 + b
  330.         x, y, z = self.pt
  331.         return y ** 2 == x ** 3 + (_b1 if type(x) is FQ else _b2) * z ** 6
  332.  
  333.     def double(self):
  334.         x, y, z = self.pt
  335.         _3x2, _2y = x.sqr() * 3, y * 2
  336.         _4y2 = _2y.sqr()
  337.         _4xy2 = x * _4y2
  338.         x3 = _3x2.sqr() - _4xy2 * 2
  339.         return ECC_Point(x3, _3x2 * (_4xy2 - x3) - _4y2.sqr() * _2_inv, _2y * z)
  340.  
  341.     def zero(self):
  342.         cls = self[0].__class__
  343.         return ECC_Point(cls.one(), cls.one(), cls.zero())
  344.  
  345.     def __add__(self, p2):
  346.         if self.is_inf():
  347.             return p2
  348.         if p2.is_inf():
  349.             return self
  350.         (x1, y1, z1), (x2, y2, z2) = self.pt, p2.pt
  351.         z1_2, z2_2 = z1.sqr(), z2.sqr()
  352.         T1, T2 = x1 * z2_2, x2 * z1_2
  353.         T3, T4, T5 = T1 - T2, y1 * z2_2 * z2, y2 * z1_2 * z1
  354.         T6, T7, T3_2 = T4 - T5, T1 + T2, T3.sqr()
  355.         T8, T9 = T4 + T5, T7 * T3_2
  356.         x3 = T6.sqr() - T9
  357.         T10 = T9 - x3 * 2
  358.         y3 = (T10 * T6 - T8 * T3_2 * T3) * _2_inv
  359.         z3 = z1 * z2 * T3
  360.         return ECC_Point(x3, y3, z3)
  361.  
  362.     def multiply(self, n):  # 算法一：二进制展开法
  363.         if n in (0, 1):
  364.             return self if n else self.zero()
  365.         Q = self
  366.         for i in bin(n)[3:]:
  367.             Q = Q.double() + self if i == '1' else Q.double()
  368.         return Q
  369.  
  370.     def __mul__(self, n):  # 算法三：滑动窗法
  371.         k = bin(n)[2:]
  372.         l, r = len(k), 5  # 滑动窗口为5效果较好
  373.         if r >= l:  # 如果窗口大于k的二进制位数，则本算法无意义
  374.             return self.multiply(n)
  375.         P_ = {1: self, 2: self.double()}  # 保存P[j]值的字典
  376.         for i in range(1, 1 << (r - 1)):
  377.             P_[(i << 1) + 1] = P_[(i << 1) - 1] + P_[2]
  378.         t = r
  379.         while k[t - 1] != '1':
  380.             t -= 1
  381.         hj = int(k[:t], 2)
  382.         Q, j = P_[hj], t
  383.         while j < l:
  384.             if k[j] == '0':
  385.                 Q = Q.double()
  386.                 j += 1
  387.             else:
  388.                 t = min(r, l - j)
  389.                 while k[j + t - 1] != '1':
  390.                     t -= 1
  391.                 hj = int(k[j:j + t], 2)
  392.                 Q = Q.multiply(1 << t) + P_[hj]
  393.                 j += t
  394.         return Q
  395.  
  396.     def __rmul__(self, n):
  397.         return self.__mul__(n)
  398.  
  399.     def __eq__(self, p2):
  400.         (x1, y1, z1), (x2, y2, z2) = self.pt, p2.pt
  401.         z1_2, z2_2 = z1.sqr(), z2.sqr()
  402.         return x1 * z2_2 == x2 * z1_2 and y1 * z2_2 * z2 == y2 * z1_2 * z1
  403.  
  404.     def __neg__(self):
  405.         x, y, z = self.pt
  406.         return ECC_Point(x, -y, z)
  407.  
  408.     def __getitem__(self, item):
  409.         return self.pt[item]
  410.  
  411.     def __repr__(self):
  412.         return '%s%s' % (self.__class__.__name__, self.normalize())
  413.  
  414.     def __bytes__(self):
  415.         return to_byte(self.normalize(), N_SIZE if type(self[0]) is FQ else None)
  416.  
  417.     def normalize(self):
  418.         x, y, z = self.pt
  419.         if not hasattr(self, 'normalize_tuple'):
  420.             if z != z.one():
  421.                 z_inv = z.inv()
  422.                 z_inv_2 = z_inv.sqr()
  423.                 x, y = x * z_inv_2, y * z_inv_2 * z_inv
  424.             self.normalize_tuple = (x.n, y.n) if type(x) is FQ else (x, y)
  425.         return self.normalize_tuple
  426.  
  427.     def frobenius(self):
  428.         x, y, z = self.pt
  429.         return ECC_Point(x.conjugate(), y.conjugate(), z.conjugate() * alpha1)
  430.  
  431.     def frobenius2_neg(self):
  432.         x, y, z = self.pt
  433.         return ECC_Point(x, -y, z * alpha2)
  434.  
  435.  
  436. FQ2_one, FQ2_zero = FQ2(1, 0), FQ2(0, 0)  # FQ2单位元、零元
  437. FQ4_one, FQ4_zero = FQ4(FQ2_one, FQ2_zero), FQ4()  # FQ4单位元、零元
  438. FQ12_one = FQ12(FQ4_one, FQ4_zero, FQ4_zero)  # FQ12单位元
  439. P1 = ECC_Point(FQ(x_p1), FQ(y_p1))  # 群G1的生成元
  440. P2 = ECC_Point(FQ2(*x_p2[::-1]), FQ2(*y_p2[::-1]))  # 群G2的生成元
  441. _b1, _b2 = FQ(5), FQ2(0, 5)  # b2=βb=(1,0)*5
  442. alpha1 = 0X3F23EA58E5720BDB843C6CFA9C08674947C5C86E0DDD04EDA91D8354377B698B  # -2^((q - 1)/12)
  443. alpha2 = 0XF300000002A3A6F2780272354F8B78F4D5FC11967BE65334  # -2^((q - 1)/6)
  444. alpha3 = 0X6C648DE5DC0A3F2CF55ACC93EE0BAF159F9D411806DC5177F5B21FD3DA24D011  # -2^((q - 1)/4)
  445. alpha4 = 0XF300000002A3A6F2780272354F8B78F4D5FC11967BE65333  # -2^((q - 1)/3)
  446. alpha5 = 0X2D40A38CF6983351711E5F99520347CC57D778A9F8FF4C8A4C949C7FA2A96686
  447. _2_inv = 0X5B2000000151D378EB01D5A7FAC763A290F949A58D3D776DF2B7CD93F1A8A2BF  # 1/2
  448. _3div2 = 0X5B2000000151D378EB01D5A7FAC763A290F949A58D3D776DF2B7CD93F1A8A2C0  # 3/2
  449. R_ate_a_NAF = '0100000000000000000000000000000000000010001020200020200101000020'  # a=6t+2的二进制非相邻表示(2-NAF)（去首10）
  450. hlen = 320  # 8 * ceil(5 * log(N, 2) / 32)
  451. _t, _6t, _6t_3 = 0x600000000058F98A, 0X2400000000215D93C, 0X2400000000215D93F
  452.  
  453.  
  454. # 输入系数值和点P，求线函数值
  455. def g_value(a_tuple, P):
  456.     (a0, a1, a4), (xP, yP) = a_tuple, P
  457.     return FQ12(FQ4(a0, a1 * yP), FQ4_zero, FQ4(a4 * xP, FQ2_zero))
  458.  
  459.  
  460. # 获取线函数g T,Q(P)的系数值（分母在最终模幂时值为1，可消去）
  461. def get_g_a_tuple(T, Q):
  462.     (xT, yT, zT), (xQ, yQ, zQ) = T, Q
  463.     zT_2, zQ_2 = zT.sqr(), zQ.sqr()
  464.     zQ_3, t1 = zQ * zQ_2, (xT * zQ_2 - xQ * zT_2) * zT * zQ
  465.     a1, t2 = t1 * zQ_3, (yT * zQ_3 - yQ * zT * zT_2) * zQ
  466.     a0, a4 = t1 * yQ - t2 * xQ, t2 * zQ_2
  467.     return a0, a1, a4
  468.  
  469.  
  470. # 线函数g T,Q(P)，求过点T和Q的直线在P上的值
  471. def g(T, Q, nP):
  472.     return g_value(get_g_a_tuple(T, Q), nP)
  473.  
  474.  
  475. # 获取线函数g T,T(P)的系数值（分母在最终模幂时值为1，可消去），利用中间值完成倍点计算
  476. def get_g2_a_tuple(T):
  477.     x, y, z = T
  478.     _z2, _3x2, _2y = z.sqr(), x.sqr() * 3, y * 2
  479.     _4y2, _2yz = _2y.sqr(), _2y * z
  480.     a1, a0, a4, _4xy2 = _z2 * _2yz, _4y2 * _2_inv - _3x2 * x, _3x2 * _z2, x * _4y2
  481.     x3 = _3x2.sqr() - _4xy2 * 2
  482.     y3 = _3x2 * (_4xy2 - x3) - _4y2.sqr() * _2_inv
  483.     return (a0, a1, a4), ECC_Point(x3, y3, _2yz)
  484.  
  485.  
  486. # 线函数g T,T(P)，求过点T的切线在P上的值，利用中间值完成倍点计算
  487. def g2(T, nP):
  488.     a_tuple, double_T = get_g2_a_tuple(T)
  489.     return g_value(a_tuple, nP), double_T
  490.  
  491.  
  492. # BN曲线上R_ate对的计算
  493. def e(P, Q):
  494.     nQ, nP_xy = -Q, (-P).normalize()
  495.     f, T = g2(Q, nP_xy)
  496.     for ai in R_ate_a_NAF:
  497.         new_g, T = g2(T, nP_xy)
  498.         f = f.sqr() * new_g
  499.         if ai == '1':
  500.             f, T = f * g(T, Q, nP_xy), T + Q
  501.         elif ai == '2':  # 用2代替-1
  502.             f, T = f * g(T, nQ, nP_xy), T + nQ
  503.     Q1, nQ2 = Q.frobenius(), Q.frobenius2_neg()
  504.     return final_exp(f * g(T, Q1, nP_xy) * g(T + Q1, nQ2, nP_xy))
  505.  
  506.  
  507. # 最终模幂
  508. def final_exp(f):
  509.     m = f.frobenius6() * f.inv()  # f^(p^6 - 1)
  510.     s = m.frobenius2() * m  # m^(p^2 + 1)
  511.     # 困难部分 s^(p^3 + (6t^2+1)p^2 + (-36t^3-18t^2-12t+1)p + (-36t^3-30t^2-18t-2))
  512.     s_6t = s ** _6t
  513.     s_6t2 = s_6t ** _t
  514.     s_36t3_18t2_12t, a2 = s_6t2 ** _6t_3 * s_6t.sqr2(), s_6t2 * s
  515.     a1, a0 = s_36t3_18t2_12t.frobenius6() * s, (s_36t3_18t2_12t * s_6t * a2.sqr2()).frobenius6()
  516.     return s.frobenius3() * a2.frobenius2() * a1.frobenius() * a0
  517.  
  518.  
  519. # 获取线函数的系数值序列
  520. def get_a_list(Q):
  521.     a_tuple, T = get_g2_a_tuple(Q)
  522.     a_list, nQ = [a_tuple], -Q
  523.     for ai in R_ate_a_NAF:
  524.         a_tuple, T = get_g2_a_tuple(T)
  525.         a_list.append(a_tuple)
  526.         if ai != '0':
  527.             a_list.append(get_g_a_tuple(T, nQ if ai == '2' else Q))
  528.             T = T + (nQ if ai == '2' else Q)
  529.     Q1, nQ2 = Q.frobenius(), Q.frobenius2_neg()
  530.     return a_list + [get_g_a_tuple(T, Q1), get_g_a_tuple(T + Q1, nQ2)]
  531.  
  532.  
  533. def e_fast(P, a_list):
  534.     nP_xy = (-P).normalize()
  535.     f, i = g_value(a_list[0], nP_xy), 1
  536.     for ai in R_ate_a_NAF:
  537.         f, i = f.sqr() * g_value(a_list[i], nP_xy), i + 1
  538.         if ai != '0':
  539.             f, i = f * g_value(a_list[i], nP_xy), i + 1
  540.     return final_exp(f * g_value(a_list[i], nP_xy) * g_value(a_list[-1], nP_xy))
  541.  
  542.  
  543. # 获取Comb固定基的预计算表（256个FQ12的列表）
  544. def get_comb_list(n):
  545.     comb_list = [FQ12_one, n]
  546.     for i in range(7):
  547.         tmp = comb_list[2**i]
  548.         for _ in range(32):
  549.             tmp = tmp.sqr2()
  550.         comb_list += [tmp * c for c in comb_list]
  551.     return comb_list
  552.  
  553.  
  554. # Comb固定基的幂运算
  555. def comb_pow(r, comb_list):
  556.     r_bin, res = '0' * (256 - r.bit_length()) + bin(r)[2:], FQ12_one
  557.     for i in range(32):
  558.         a = int(''.join(r_bin[j] for j in range(i, 256, 32)), 2)
  559.         res = comb_list[a] if res is FQ12_one else res.sqr2() * comb_list[a]
  560.     return res
  561.  
  562.  
  563. # 获取固定点乘的预计算表（32行256列的椭圆曲线点矩阵）
  564. def get_kP_list(P):
  565.     one, kP_list = P, []
  566.     for i in range(32):
  567.         line_list = [0, one]  # O, P
  568.         for j in range(1, 128):
  569.             line_list.append(line_list[j].double())  # 2j·P
  570.             line_list.append(line_list[-1] + one)  # (2j+1)·P
  571.         kP_list.append(line_list)
  572.         one = line_list[128].double() if i < 31 else 0
  573.     return kP_list
  574.  
  575.  
  576. # 使用预计算表的快速点乘
  577. def fast_kG(k, kP_list):
  578.     P_list = [kP_list[i][byte] for i, byte in enumerate(k.to_bytes(32, byteorder='little')) if byte]
  579.     return sum(P_list[1:], P_list[0])
  580.  
  581.  
  582. # SM9算法(GB_T 38635.2-2020) 5.3.6定义的密钥派生函数
  583. # Z为bytes类型，klen表示输出密钥比特长度（8的倍数）；输出为bytes类型
  584. def KDF(Z, klen=KEY_LEN):
  585.     ksize, K = klen >> 3, bytearray()
  586.     for ct in range(1, ceil(ksize / HASH_SIZE) + 1):
  587.         K.extend(sm3(Z + to_byte(ct, 4)))
  588.     return K[:ksize]
  589.  
  590.  
  591. # SM9算法(GB_T 38635.2-2020) 5.3.2.2和5.3.2.3定义的密码函数
  592. def H(i, Z):
  593.     Ha = to_int(KDF(to_byte(i, 1) + Z, hlen))
  594.     return Ha % (N - 1) + 1
  595.  
  596.  
  597. # SM9算法(GB_T 38635.2-2020) 5.3.5定义的消息认证码函数
  598. def MAC(K2, Z):
  599.     return sm3(Z + K2)
  600.  
  601.  
  602. class SM9:  # SM9算法(GB_T 38635.2-2020)
  603.     def __init__(self, ID='', ds=None, Ppub_s=None, de=None, Ppub_e=None, hid_s=1, hid_e=3, ks=None, ke=None):
  604.         self.ID, self.ID_byte, self.hid_s_byte, self.hid_e_byte = ID, to_byte(ID), to_byte(hid_s, 1), to_byte(hid_e, 1)
  605.         if ks:  # 作为密钥生成中心，给定签名主私钥（若要随机生成，可指定ks=-1）
  606.             self.ks = ks if 0 < ks < N else randrange(1, N)
  607.             self.Ppub_s = fast_kG(self.ks, _kP2)
  608.         if ke:  # 作为密钥生成中心，给定加密主私钥（若要随机生成，可指定ke=-1）
  609.             self.ke = ke if 0 < ke < N else randrange(1, N)
  610.             self.Ppub_e = fast_kG(self.ke, _kP1)
  611.         if ds and Ppub_s:  # 作为用户，给定用户签名私钥和签名主公钥
  612.             self.k_ds_list, self.Ppub_s, self.gs = get_kP_list(ds), Ppub_s, e(P1, Ppub_s)
  613.             self.gs_comb_list = get_comb_list(self.gs)
  614.         if de and Ppub_e:  # 作为用户，给定用户加密私钥和加密主公钥
  615.             self.de_a_list, self.Ppub_e, self.ge = get_a_list(de), Ppub_e, e(Ppub_e, P2)
  616.             self.ge_comb_list = get_comb_list(self.ge)
  617.  
  618.     def KGC_gen_user(self, ID):
  619.         ID_byte, ds, Ppub_s, de, Ppub_e = to_byte(ID), None, None, None, None
  620.         if hasattr(self, 'ks'):
  621.             t1 = (H(1, ID_byte + self.hid_s_byte) + self.ks) % N
  622.             if t1 == 0:  # 需重新产生签名主密钥，并更新所有用户的签名密钥
  623.                 return False
  624.             t2 = self.ks * mod_inv(t1, N) % N
  625.             ds, Ppub_s = fast_kG(t2, _kP1), self.Ppub_s  # 用户签名私钥和签名主公钥
  626.         if hasattr(self, 'ke'):
  627.             t1 = (H(1, ID_byte + self.hid_e_byte) + self.ke) % N
  628.             if t1 == 0:  # 需重新产生加密主密钥，并更新所有用户的加密密钥
  629.                 return False
  630.             t2 = self.ke * mod_inv(t1, N) % N
  631.             de, Ppub_e = fast_kG(t2, _kP2), self.Ppub_e  # 用户加密私钥和加密主公钥
  632.         return SM9(ID, ds, Ppub_s, de, Ppub_e, self.hid_s_byte, self.hid_e_byte)
  633.  
  634.     # 6.2 数字签名生成算法
  635.     def sign(self, M, r=None, outbytes=True):
  636.         l = 0
  637.         while l == 0:
  638.             r = r if r else randrange(1, N)  # A2
  639.             w = bytes(self.gs_pow(r))  # A3
  640.             h = H(2, to_byte(M) + w)  # A4
  641.             l = (r - h) % N  # A5
  642.         S = fast_kG(l, self.k_ds_list)  # A6
  643.         return to_byte([h, S]) if outbytes else (h, S)
  644.  
  645.     # 6.4 数字签名验证算法
  646.     def verify(self, ID, M_, sig):
  647.         h_, S_ = (to_int(sig[:N_SIZE]), ECC_Point.from_byte(sig[N_SIZE:])) if type(sig) is bytes else sig
  648.         if not 0 < h_ < N or not S_ or not S_.is_on_curve():  # B1、B2
  649.             return False
  650.         t = self.gs_pow(h_)  # B4
  651.         h1 = H(1, to_byte(ID) + self.hid_s_byte)  # B5
  652.         P = fast_kG(h1, _kP2) + self.Ppub_s  # B6
  653.         u = e(S_, P)  # B7
  654.         w_ = bytes(u * t)  # B8
  655.         h2 = H(2, to_byte(M_) + w_)  # B9
  656.         return h_ == h2
  657.  
  658.     # A 发起协商（也可用作B生成rB、RB；outbytes=True时输出bytes）
  659.     # 7.2 密钥交换协议 A1-A3
  660.     def agreement_initiate(self, IDB, r=None, outbytes=True):
  661.         QB = fast_kG(H(1, to_byte(IDB) + self.hid_e_byte), _kP1) + self.Ppub_e  # A1
  662.         rA = r if r else randrange(1, N)  # A2
  663.         RA = QB * rA  # A3
  664.         return rA, bytes(RA) if outbytes else RA
  665.  
  666.     # B 响应协商（option=True时计算选项部分）
  667.     # 7.2 密钥交换协议 B1-B6
  668.     def agreement_response(self, RA, IDA, option=False, rB=None, klen=KEY_LEN, outbytes=True):
  669.         RA = ECC_Point.from_byte(RA) if type(RA) is bytes else RA
  670.         if not RA or not RA.is_on_curve():  # B4
  671.             return False, 'RA不属于椭圆曲线群G1'
  672.         rB, RB = self.agreement_initiate(IDA, rB, outbytes)  # B1-B3
  673.         g1, g2 = self.e_de(RA), bytes(self.ge_pow(rB))  # B4
  674.         g1, g3 = bytes(g1), bytes(g1 ** rB)  # B4
  675.         tmp_byte = to_byte([IDA, self.ID_byte, RA, RB])
  676.         SKB = KDF(tmp_byte + g1 + g2 + g3, klen)  # B5
  677.         if not option:
  678.             return True, (RB, SKB)
  679.         self.tmp_byte2 = g1 + sm3(g2 + g3 + tmp_byte)
  680.         SB = sm3(to_byte(0x82, 1) + self.tmp_byte2)  # B6（可选部分）
  681.         return True, (RB, SKB, SB)
  682.  
  683.     # A 协商确认
  684.     # 7.2 密钥交换协议 A5-A8
  685.     def agreement_confirm(self, rA, RA, RB, IDB, SB=None, option=False, klen=KEY_LEN):
  686.         RB = ECC_Point.from_byte(RB) if type(RB) is bytes else RB
  687.         if not RB or not RB.is_on_curve():  # A5
  688.             return False, 'RB不属于椭圆曲线群G1'
  689.         g1_, g2_ = bytes(self.ge_pow(rA)), self.e_de(RB)  # A5
  690.         g2_, g3_ = bytes(g2_), bytes(g2_ ** rA)  # A5
  691.         tmp_byte = to_byte([self.ID_byte, IDB, RA, RB])
  692.         if option and SB:  # A6（可选部分）
  693.             tmp_byte2 = g1_ + sm3(g2_ + g3_ + tmp_byte)
  694.             S1 = sm3(to_byte(0x82, 1) + tmp_byte2)
  695.             if S1 != SB:
  696.                 return False, 'S1 != SB'
  697.         SKA = KDF(tmp_byte + g1_ + g2_ + g3_, klen)  # A7
  698.         if not option or not SB:
  699.             return True, SKA
  700.         SA = sm3(to_byte(0x83, 1) + tmp_byte2)  # A8
  701.         return True, (SKA, SA)
  702.  
  703.     # B 协商确认（可选部分）
  704.     # 7.2 密钥交换协议 B8
  705.     def agreement_confirm2(self, SA):
  706.         if not hasattr(self, 'tmp_byte2'):
  707.             return False, 'step error'
  708.         S2 = sm3(to_byte(0x83, 1) + self.tmp_byte2)
  709.         if S2 == SA:
  710.             del self.tmp_byte2
  711.             return True, ''
  712.         return False, 'S2 != SA'
  713.  
  714.     # 8.2 密钥封装算法
  715.     def encaps(self, IDB, klen, r=None, outbytes=True):
  716.         K = bytes()
  717.         while K == bytes(len(K)):
  718.             r, C = self.agreement_initiate(IDB, r, outbytes)  # A1-A3
  719.             w = bytes(self.ge_pow(r))  # A5
  720.             K = KDF(to_byte([C, w, IDB]), klen)
  721.         return K, C
  722.  
  723.     # 8.4 密钥封装算法
  724.     def decaps(self, C, klen):
  725.         C = ECC_Point.from_byte(C) if type(C) is bytes else C
  726.         if not C or not C.is_on_curve():  # B1
  727.             return False, 'C不属于椭圆曲线群G1'
  728.         w_ = bytes(self.e_de(C))  # B2
  729.         K_ = KDF(to_byte([C, w_, self.ID_byte]), klen)  # B3
  730.         return (True, K_) if K_ != bytes(len(K_)) else (False, 'K为全0比特串')
  731.  
  732.     # 9.2 加密算法
  733.     def encrypt(self, IDB, M, r=None, outbytes=True):
  734.         M = to_byte(M)
  735.         K, C1 = self.encaps(IDB, (len(M) << 3) + K2_len, r, outbytes)  # A1-A6.a.1
  736.         K1, K2 = K[:len(M)], K[len(M):]  # A6.a.1
  737.         C2 = bytes(M[i] ^ K1[i] for i in range(len(M)))  # A6.a.2
  738.         C3 = MAC(K2, C2)  # A7
  739.         return to_byte([C1, C3, C2]) if outbytes else (C1, C3, C2)
  740.  
  741.     # 9.4 解密算法
  742.     def decrypt(self, C):
  743.         C3_start, C3_end = N_SIZE << 1, (N_SIZE << 1) + HASH_SIZE
  744.         C1, C3, C2 = (C[:C3_start], C[C3_start:C3_end], C[C3_end:]) if type(C) is bytes else C
  745.         res, K_ = self.decaps(C1, (len(C2) << 3) + K2_len)  # B1-B3.a.1
  746.         if not res:
  747.             return False, K_.replace('C', 'C1')
  748.         K1_, K2_ = K_[:len(C2)], K_[len(C2):]  # B3.a.1
  749.         if K1_ == bytes(len(K_)):
  750.             return False, 'K1\'为全0比特串'
  751.         u = MAC(K2_, C2)  # B4
  752.         if u != C3:
  753.             return False, 'u != C3'
  754.         return True, bytes(C2[i] ^ K1_[i] for i in range(len(C2)))  # B3.a.2
  755.  
  756.     def e_de(self, P):
  757.         return e_fast(P, self.de_a_list)
  758.  
  759.     def gs_pow(self, r):
  760.         return comb_pow(r, self.gs_comb_list)
  761.  
  762.     def ge_pow(self, r):
  763.         return comb_pow(r, self.ge_comb_list)
  764.  
  765.  
  766. _SM9kG_file = 'hggm/SM9_kG.bin'  # 预计算数据文件的位置
  767. _kP1, _kP2 = [], []  # P1、P2点的预计算表
  768. if os.path.exists(_SM9kG_file):
  769.     with open(_SM9kG_file, 'rb') as f:  # 读取预计算数据文件
  770.         data = f.read()
  771.         G1_size, G2_size = N_SIZE << 1, N_SIZE << 2  # G1点坐标字节数、G2点坐标字节数
  772.         P1_line, line = 255 * G1_size, 255 * (G1_size + G2_size)  # 一行G1点坐标字节数、一行总字节数
  773.         for i in range(0, N_SIZE * line, line):
  774.             _kP1.append([0] + [ECC_Point.from_byte(data[j:j + G1_size]) for j in range(i, i + P1_line, G1_size)])
  775.             _kP2.append([0] + [ECC_Point.from_byte(data[j:j + G2_size]) for j in range(i + P1_line, i + line, G2_size)])
  776. else:  # 预计算数据文件不存在
  777.     _kP1, _kP2 = get_kP_list(P1), get_kP_list(P2)  # 生成P1、P2点的预计算表
  778.     with open(_SM9kG_file, 'wb') as f:  # 将预计算表写入二进制文件
  779.         f.write(b''.join(map(bytes, [P for x, y in zip(_kP1, _kP2) for P in x[1:] + y[1:]])))

完善了测试代码，创建KGC的代码比上版稍有变动：

  1. IDA, IDB, message = 'Alice', 'Bob', 'Chinese IBS standard'
  2.     kgc = SM9(ks=0x130E78459D78545CB54C587E02CF480CE0B66340F319F348A1D5B1F2DC5F4,
  3.                  ke=0x2E65B0762D042F51F0D23542B13ED8CFA2E9A0E7206361E013A283905E31F)
  4.     sm9_A, sm9_B = kgc.KGC_gen_user(IDA), kgc.KGC_gen_user(IDB)
  5.     assert bytes(sm9_A.gs).hex().swapcase().endswith('F0F071D7D284FCFB')
  6.     print("-----------------test sign and verify---------------")
  7.     r = 0x033C8616B06704813203DFD00965022ED15975C662337AED648835DC4B1CBE
  8.     signature = sm9_A.sign(message, r)
  9.     assert signature.hex().swapcase().endswith('827CC2ACED9BAA05')
  10.     assert sm9_B.verify(IDA, message, signature)
  11.     print("success")
  12.  
  13.     print("-----------------test key agreement---------------")
  14.     rA = 0x5879DD1D51E175946F23B1B41E93BA31C584AE59A426EC1046A4D03B06C8
  15.     rA, RA = sm9_A.agreement_initiate(IDB, rA)  # A发起协商
  16.     # A将RA发送给B
  17.     rB = 0x018B98C44BEF9F8537FB7D071B2C928B3BC65BD3D69E1EEE213564905634FE
  18.     res, content = sm9_B.agreement_response(RA, IDA, True, rB)  # B响应协商
  19.     if not res:
  20.         print('B报告协商错误：', content)
  21.         return
  22.     RB, SKB, SB = content
  23.     # B将RB、SB发送给A
  24.     res, content = sm9_A.agreement_confirm(rA, RA, RB, IDB, SB, True)  # A协商确认
  25.     if not res:
  26.         print('A报告协商错误：', content)
  27.         return
  28.     SKA, SA = content
  29.     assert SKA.hex().swapcase() == '68B20D3077EA6E2B825315836FDBC633'
  30.     # A将SA发送给B
  31.     res, content = sm9_B.agreement_confirm2(SA)  # B协商确认
  32.     if not res:
  33.         print('B报告协商错误：', content)
  34.         return
  35.     assert SKA == SKB
  36.     print("success")
  37.  
  38.     print("-----------------test encrypt and decrypt---------------")
  39.     message = 'Chinese IBE standard'
  40.     kgc = SM9(ke=0x01EDEE3778F441F8DEA3D9FA0ACC4E07EE36C93F9A08618AF4AD85CEDE1C22)
  41.     sm9_A, sm9_B = kgc.KGC_gen_user(IDA), kgc.KGC_gen_user(IDB)
  42.     C = sm9_A.encrypt(IDB, message, 0xAAC0541779C8FC45E3E2CB25C12B5D2576B2129AE8BB5EE2CBE5EC9E785C)
  43.     assert C.hex().swapcase().endswith('378CDD5DA9513B1C')
  44.     res, content = sm9_B.decrypt(C)
  45.     if not res:
  46.         print('解密错误：', content)
  47.         return
  48.     assert message == content.decode()
  49.     print("success")

运行结果如下，可见实际算法比上版有20%~4倍提升不等：

以上全部代码在：hggm - 国密算法 SM2 SM3 SM4 SM9 ZUC Python实现完整代码: 国密算法 SM2公钥密码 SM3杂凑算法 SM4分组密码 SM9标识密码 ZUC序列密码 Python代码完整实现 效率高于所有公开的Python国密算法库 (gitee.com)

hggm国密算法Python库自2022年3月开始开发，2022年4月首次公开，目前已经包含SM2、SM3、SM4、SM9、ZUC的慢速版和快速版，基本完善了。出于个人研究学习的兴趣，纰漏在所难免，可继续改进提升的地方还很多，望各位不吝赐教，我会持续更新优化。从一开始就坚持完全开源，希望能帮到大家，也希望能以个人之所学为网安事业尽绵薄之力。

但愿这不止是完结，而是全新的开始。

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/我家自动化/article/detail/489169
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号