sm2

func CheckOnCurve ¶

func CheckOnCurve(x, y []byte) bool

CheckOnCurve checks if the point given in x and y coordinates, lies on the curve.

func DerivePublic ¶

func DerivePublic(priv []byte) (x, y []byte, err error)

DerivePublic takes private key and return the X and Y coordinates of the corresponding public key.

func GenerateKey ¶

func GenerateKey(rand io.Reader) (priv, x, y []byte, err error)

GenerateKey generate private key with provided random source note that private key will lie in range [1, n-2] as we need to calculate 1/(d + 1) for signature rand: must NOT be nil. Must be a cryptographically secure random number generator, usually caller can simply use rand.Reader from crypto/rand, but alternatives could be used especially a hardware backed one, as long as it is cryptographically secure x, y: the X and Y coordination of the public key in 32 bytes. Leading bytes could be zero so be cautious converting between byte array and big integer.

Security notes: private key is used as stack variable and then copied out so that this function can securely destroy the key material instead of leaving it in heap after generation

func Sign ¶

func Sign(id, pubx, puby []byte, rand io.Reader, priv, msg []byte) (r, s []byte, err error)

Sign takes user id, user public key coordinates, then calls ZA to derive the za value, and then calls SignZa, returns signature data. For random data generator, private key or return value, see SignHashed

func SignHashed ¶

func SignHashed(rand io.Reader, priv, e []byte) (r, s []byte, err error)

SignHashed signs the data which have been hashed from message and public parameters.

rand: caller must supply a cryptographically secure random number generator
e: the value from hashing the message and public parameters according to the spec
priv: the private key has 32 big endian bytes and its encoded value shall not be n - 1
r, s: has 32 bytes each

Standard demands that priv should lie in [1, n-2], SignHashed only accepts private key in that range.

func SignZa ¶

func SignZa(rand io.Reader, priv, za, msg []byte) (r, s []byte, err error)

SignZa takes the message data and za as calculated user hash which have been derived from user ID, curve public parameters, and user public key (see ZA), hash them together, calls SignHashed and returns signature data. For random data generator, private key or return value, see SignHashed

func TestPrivateKey ¶

func TestPrivateKey(priv []byte) int

TestPrivateKey tests if the priv has at most 32 bytes, and if it is in range [1, n-2] Returns the length difference if longer than 32, or -1 if not in the range, or 0 if everything checks out

TestPrivateKey runs in constant time.

func Verify ¶

func Verify(id, pubx, puby, msg, r, s []byte) (bool, error)

Verify takes user id, user public key coordinates, then calls ZA to derive the za value, and then calls VerifyZa, returns verification result.

func VerifyHashed ¶

func VerifyHashed(pubx, puby, e, r, s []byte) (bool, error)

VerifyHashed verifies if a signature is valid or not. All parameters should be given in byte arrays big endian and in 32 bytes

func VerifyZa ¶

func VerifyZa(pubx, puby, za, msg, r, s []byte) (bool, error)

VerifyZa takes the message data and za as calculated user hash which have been derived from user ID, curve public parameters, and user public key (see ZA), hash them together, calls VerifyHashed and returns verification result.

func ZA ¶

func ZA(id, pubx, puby []byte) (za []byte, err error)

ZA calculates the ZA data according to the GMT 0003.2-2012 spec The spec does not tell what to do about empty user ID. So it is accepted as well.