近期go项目对接第三方Java服务,第三方要求使用国密sm3/sm2算法进行数据签名验签,特记录go端开发注意事项
1 关于密钥对
密钥生成可以使用openssl库,openssl版本至少是1.1.1,终端运行openssl version检查版本,之前版本不支持sm2/sm3, openssl官网https://www.openssl.org/source/
检查椭圆曲线是否包含sm2,如下所示是支持sm2的。
$ openssl ecparam -list_curves | grep SM2
SM2       : SM2 curve over a 256 bit prime field
密钥生成流程,存在第四步的原因是go使用的库需要读取pkcs#8格式私钥pem文件：
1 生成sm2私钥: openssl ecparam -genkey -name SM2 -out sm2PriKey.pem
2 sm2私钥导出公钥: openssl ec -in sm2PriKey.pem -pubout -out sm2PubKey.pem
3 查看私钥: openssl ec -in sm2PriKey.pem -text
4 私钥pkcs#1转pkcs#8: openssl pkcs8 -topk8 -inform PEM -in sm2PriKey.pem -outform pem -nocrypt -out sm2PriKeyPkcs8.pem
2 go签名验签代码
1 读取公钥pem文件, 将公钥X/Y的bytes拼接base64编码,函数示例:
func DealPubKey() {
// 公钥X/Y的bytes拼接后base64编码
PubKeyPath := "/home/xx/sm2PubKey.pem"
pubKey, e := sm2.ReadPublicKeyFromPem(PubKeyPath, nil)
if e != nil {
log.Println("pubKeyPem read failed, error: ", e)
}
var buf bytes.Buffer
buf.Write(pubKey.X.Bytes())
buf.Write(pubKey.Y.Bytes())
XY := base64.StdEncoding.EncodeToString(buf.Bytes())
log.Println("pubKey XY base64--->", XY)
}
2 sm2签名验签使用的包"github.com/tjfoc/gmsm/sm2", go mod自动安装不会安装最新版本, go.mod不要添加此包,
github最新版本是是V1.2, 切换到项目目录, 终端运行 go get github.com/tjfoc/gmsm@master安装最新版本后会自动添加到go.mod
3 "github.com/tjfoc/gmsm/sm2"使用签名函数为 sm2.Sm2Sign, 此函数会将输入的[]bytes类型数据sm3摘要运算后进行sm2签名, 对应验签函数sm2.Sm2Verify
4 函数sm2.Sign默认是使用sha-512进行摘要运算,与服务端Java签名验签失败.
代码示例:
package main
import (
"bytes"
"encoding/base64"
"fmt"
"github.com/tjfoc/gmsm/sm2"
"log"
"math/big"
"os"
)
var (
default_uid = []byte{0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38}
)
func Sign(body string) (string, error) {
cwd, _ := os.Getwd()
PriKeyPath := cwd + string(os.PathSeparator) + "sm2PriKeyPkcs8.pem"
priKey, e := sm2.ReadPrivateKeyFromPem(PriKeyPath, nil)
if e != nil {
log.Println("priKeyPem read failed, error: ", e)
return "", e
}
r, s, err := sm2.Sm2Sign(priKey, []byte(body), default_uid)
if err != nil {
log.Println("priKey sign error: ", err)
return "", err
}
//Buffer是一个实现了读写方法的可变大小的字节缓冲
var buffer bytes.Buffer
buffer.Write(r.Bytes())
buffer.Write(s.Bytes())
signature := base64.StdEncoding.EncodeToString(buffer.Bytes())
log.Println("priKey signature base64: ", signature)
return signature, nil
}
func Verify(body, signature string) {
cwd, _ := os.Getwd()
PubKeyPath := cwd + string(os.PathSeparator) + "sm2PubKey.pem"
pubKey, e := sm2.ReadPublicKeyFromPem(PubKeyPath, nil)
if e != nil {
log.Println("pubKeyPem read failed, error: ", e)
}
d64, err := base64.StdEncoding.DecodeString(signature)
if err != nil {
log.Println("base64 decode error: ", err)
}
l := len(d64)
br := d64[:l/2]
bs := d64[l/2:]
var ri, si big.Int
r := ri.SetBytes(br)
s := si.SetBytes(bs)
v := sm2.Sm2Verify(pubKey, []byte(body), default_uid, r, s)
log.Printf("pubKey verified: %v\n", v)
}
func main() {
body := `{"name":"mike","gender":"male"}`
signature, _ := Sign(body)
Verify(body, signature)
}

近期go项目对接第三方Java服务,第三方要求使用国密sm3/sm2算法进行数据签名验签,特记录go端开发注意事项
1 关于密钥对
密钥生成可以使用openssl库,openssl版本至少是1.1.1,终端运行     openssl version
检查版本,之前版本不支持sm2/sm3, openssl官网      https://www.openssl.org/source/
检查椭圆曲线是否包含sm2,如下所示是支持sm2的。
$ openssl ecparam -list_curves | grep SM2
SM2       : SM2 curve over a 256 bit prime field
密钥生成流程,存在第四步的原因是go使用的库需要读取pkcs#8格式私钥pem文件：
1 生成sm2私钥:      openssl ecparam -genkey -name SM2 -out sm2PriKey.pem
2 sm2私钥导出公钥:        openssl ec -in sm2PriKey.pem -pubout -out sm2PubKey.pem
3 查看私钥:     openssl ec -in sm2PriKey.pem -text
4 私钥pkcs#1转pkcs#8:      openssl pkcs8 -topk8 -inform PEM -in sm2PriKey.pem -outform pem -nocrypt -out sm2PriKeyPkcs8.pem
2 go签名验签代码
1 读取公钥pem文件, 将公钥X/Y的bytes拼接base64编码,函数示例:
func DealPubKey() {
// 公钥X/Y的bytes拼接后base64编码
PubKeyPath := "/home/xx/sm2PubKey.pem"
pubKey, e := sm2.ReadPublicKeyFromPem(PubKeyPath, nil)
if e != nil {
log.Println("pubKeyPem read failed, error: ", e)
}
var buf bytes.Buffer
buf.Write(pubKey.X.Bytes())
buf.Write(pubKey.Y.Bytes())
XY := base64.StdEncoding.EncodeToString(buf.Bytes())
log.Println("pubKey XY base64--->", XY)
}
2 sm2签名验签使用的包”github.com/tjfoc/gmsm/sm2″, go mod自动安装不会安装最新版本, go.mod不要添加此包,
github最新版本是是V1.2, 切换到项目目录, 终端运行     go get github.com/tjfoc/gmsm@master
安装最新版本后会自动添加到go.mod
3 “github.com/tjfoc/gmsm/sm2″使用签名函数为 sm2.Sm2Sign, 此函数会将输入的[]bytes类型数据sm3摘要运算后进行sm2签名, 对应验签函数sm2.Sm2Verify
4 函数sm2.Sign默认是使用sha-512进行摘要运算,与服务端Java签名验签失败.
代码示例:
package main
import (
"bytes"
"encoding/base64"
"fmt"
"github.com/tjfoc/gmsm/sm2"
"github.com/tjfoc/gmsm/sm3"
"log"
"math/big"
"os"
)
var (
default_uid = []byte{0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38}
)
func Sign(body string) (string, error) {
cwd, _ := os.Getwd()
PriKeyPath := cwd + string(os.PathSeparator) + "sm2PriKeyPkcs8.pem"
priKey, e := sm2.ReadPrivateKeyFromPem(PriKeyPath, nil)
if e != nil {
log.Println("priKeyPem read failed, error: ", e)
return "", e
}
r, s, err := sm2.Sm2Sign(priKey, []byte(body), default_uid)
if err != nil {
log.Println("priKey sign error: ", err)
return "", err
}
//Buffer是一个实现了读写方法的可变大小的字节缓冲
var buffer bytes.Buffer
buffer.Write(r.Bytes())
buffer.Write(s.Bytes())
signature := base64.StdEncoding.EncodeToString(buffer.Bytes())
log.Println("priKey signature base64: ", signature)
return signature, nil
}
func Verify(body, signature string) {
cwd, _ := os.Getwd()
PubKeyPath := cwd + string(os.PathSeparator) + "sm2PubKey.pem"
pubKey, e := sm2.ReadPublicKeyFromPem(PubKeyPath, nil)
if e != nil {
log.Println("pubKeyPem read failed, error: ", e)
}
d64, err := base64.StdEncoding.DecodeString(signature)
if err != nil {
log.Println("base64 decode error: ", err)
}
l := len(d64)
br := d64[:l/2]
bs := d64[l/2:]
var ri, si big.Int
r := ri.SetBytes(br)
s := si.SetBytes(bs)
v := sm2.Sm2Verify(pubKey, []byte(body), default_uid, r, s)
log.Printf("pubKey verified: %v\n", v)
}
func main() {
body := `{"name":"mike","gender":"male"}`
signature, _ := Sign(body)
Verify(body, signature)
}

1. 使用BC库1.59版本已经可以支持国密算法SM2/SM3/SM4，某大神写的详细测试例子：https://github.com/ZZMarquis/gmhelper
2. 制作证书参考网上资料简单例子;
``` java
public static void genSM2CertBySelf() throws OperatorCreationException, IOException, CertificateException {
String dn = "CN=dfg, OU=aert, O=45y, L=sdfg, ST=fg, C=CN";
long year = 360 * 24 * 60 * 60 * 1000;
Date notBefore = new Date();
Date notAfter = new Date(notBefore.getTime() + year);
//证书的名称
String fileName = "self"+new Date().getTime()/1000;
String path  = "/test/gmhelper/";
String rootCertPath = path+fileName+".der";
AsymmetricCipherKeyPair kp = Sm2Util.generateKeyPair();
ECPrivateKeyParameters bcecPrivateKey = (ECPrivateKeyParameters)kp.getPrivate();
ECPublicKeyParameters bcecPublicKey = (ECPublicKeyParameters)kp.getPublic();
BcX509v3CertificateBuilder build = new BcX509v3CertificateBuilder(
new X500Name(dn),
BigInteger.probablePrime(64, new Random()),
notBefore,
notAfter,
new X500Name(dn),
bcecPublicKey);
AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find("SM3withSM2");//即"1.2.156.10197.1.501"
AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find("SHA256");
ContentSigner sigGen = new BcECContentSignerBuilder(sigAlgId, digAlgId).build(bcecPrivateKey);
X509CertificateHolder x509certHolder = build.build(sigGen);
FileOutputStream outputStream = new FileOutputStream(rootCertPath);
outputStream.write(x509certHolder.getEncoded());
outputStream.close();
}
```
3. 使用上面介绍的制作证书方法如果跟GMSSL生成的证书比对缺少“公钥参数”对象，因为BC库公钥是采用X9.62格式，见rfc5349 https://tools.ietf.org/html/rfc5349 ; 如果一定要带公钥参数对象，代码去处理下ASN.1，把BcX509v3CertificateBuilder修改为X509v3CertificateBuilder，公钥通过createSubjectECPublicKeyInfo做下转换
``` java
public static SubjectPublicKeyInfo createSubjectECPublicKeyInfo(ECPublicKeyParameters pub)
{
ASN1OctetString p = (ASN1OctetString)new X9ECPoint(pub.getQ()).toASN1Primitive();
return new SubjectPublicKeyInfo(new AlgorithmIdentifier(X9ObjectIdentifiers.id_ecPublicKey, GMObjectIdentifiers.sm2p256v1), p.getOctets());
}
```
4. 自己如何构造公钥参数ECPublicKeyParameters参考：http://linuxgao.iteye.com/blog/2389904  如果要构造私钥参数类似如此操作，更简单，因为私钥参数ECPrivateKeyParameters只有一个大数BigInteger
5. 证书解析参考：https://blog.csdn.net/qq_32221419/article/details/59111828
6、证书请求及其它：参考 http://www.sitcoder.com/?post=54 和
https://blog.csdn.net/jinhill/article/details/17612273

https://www.cnblogs.com/alsodzy/p/9854521.html