加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
此仓库是为了提升国内下载速度的镜像仓库,每日同步一次。 原始仓库: https://github.com/guanzhi/GmSSL
克隆/下载
贡献代码
同步代码
取消
提示: 由于 Git 不支持空文件夾,创建文件夹后会生成空的 .keep 文件
Loading...
README
Apache-2.0

GmSSL

CMake-Ubuntu/macOS CMake-Windows CMake-Android CMake-iOS

GmSSL是由北京大学自主开发的国产商用密码开源库,实现了对国密算法、标准和安全通信协议的全面功能覆盖,支持包括移动端在内的主流操作系统和处理器,支持密码钥匙、密码卡等典型国产密码硬件,提供功能丰富的命令行工具及多种编译语言编程接口。

主要特性

  • 超轻量:GmSSL 3 大幅度降低了内存需求和二进制代码体积,不依赖动态内存,可以用于无操作系统的低功耗嵌入式环境(MCU、SOC等),开发者也可以更容易地将国密算法和SSL协议嵌入到现有的项目中。
  • 更合规:GmSSL 3 可以配置为仅包含国密算法和国密协议(TLCP协议),依赖GmSSL 的密码应用更容易满足密码产品型号检测的要求,避免由于混杂非国密算法、不安全算法等导致的安全问题和合规问题。
  • 更安全:TLS 1.3在安全性和通信延迟上相对之前的TLS协议有巨大的提升,GmSSL 3 支持TLS 1.3协议和RFC 8998的国密套件。GmSSL 3 默认支持密钥的加密保护,提升了密码算法的抗侧信道攻击能力。
  • 跨平台:GmSSL 3 更容易跨平台,构建系统不再依赖Perl,默认的CMake构建系统可以容易地和Visual Studio、Android NDK等默认编译工具配合使用,开发者也可以手工编写Makefile在特殊环境中编译、剪裁。

下载

  • GmSSL的主分支版本为 GmSSL-3.1.1,主要增加跨平台特性,特别是对Windows/Visual Studio的支持,Windows、Android、iOS平台的开发者需要使用该版本。

编译与安装

GmSSL 3 采用了cmake构建系统。下载源代码后将其解压缩,进入源码目录,执行:

mkdir build
cd build
cmake ..
make
make test
sudo make install

make install完成后,GmSSL会在默认安装目录中安装gmssl命令行工具,在头文件目录中创建gmssl目录,并且在库目录中安装libgmssl.alibgmssl.so等库文件。

Visual Studio环境编译

在Visual Studio命令提示符下执行:

mkdir build
cd build
cmake .. -G "NMake Makefiles" -DWIN32=ON
nmake

主要功能

密码算法

  • 分组密码:SM4 (CBC/CTR/GCM/ECB/CFB/OFB/CCM/XTS), AES (CBC/CTR/GCM)
  • 序列密码:ZUC/ZUC-256, ChaCha20
  • 哈希函数: SM3, SHA-1, SHA-224/256/384/512
  • 公钥密码:SM2加密/签名, SM9加密/签名
  • MAC算法:HMAC, GHASH, CBC-MAC
  • 密钥导出函数:PBKDF2、HKDF
  • 随机数生成器:Intel RDRAND, HASH_DRBG (NIST.SP.800-90A)

证书和数字信封

  • 数字证书:X.509证书, CRL证书注销列表, CSR (PKCS #10) 证书签名请求
  • 私钥加密:基于SM4/SM3口令加密的PEM格式私钥 (PKCS #8)
  • 数字信封:SM2密码消息 (GM/T 0010-2012)

SSL协议

  • TLCP 1.1,支持密码套TLS_ECC_SM4_CBC_SM3 {0xE0,0x13} (GB/T 38636-2020、GM/T 0024-2014)
  • TLS 1.2,支持密码套件TLS_ECDHE_SM4_CBC_SM3 {0xE0,0x11} (GB/T 38636-2020、GM/T 0024-2014)
  • TLS 1.3,支持密码套件TLS_SM4_GCM_SM3 {0x00,0xC6} (RFC 8998)

多语言接口

GmSSL通过子项目提供多种多种编程语言绑定

  • GmSSL-Java 以JNI方式实现的Java语言绑定
  • GmSSL-PHP 以PHP扩展方式实现的PHP语言绑定
  • GmSSL-Go 以CGO方式实现的Go语言绑定
  • GmSSL-Python 以ctypes方式实现的Python语言绑定
  • GmSSL-JS 纯JavaScript实现的国密算法库

支持国密硬件

GmSSL内置支持国密SDF密码硬件(通常为PCI-E接口的密码卡或者服务器密码机)和SKF密码硬件(通常为小型USB密码钥匙)。经过测试的密码产品型号包括:

  • to be added.

开发者也可以用GmSSL的子项目SoftSDF(https://github.com/GmSSL/SoftSDF) ,用功能等效(但是不具备密码硬件密钥保护等价的安全性)的软件SDF模块来进行开发和测试,正式部署的时候再替换为硬件SDF。

OpenSSL兼容性

GmSSL 3.0版本重写了所有的代码并改变了原有API,因此当前GmSSL版本和OpenSSL不兼容,无法直接用GmSSL替换OpenSSL进行编译。GmSSL提供了子项目 OpenSSL-Compatibility-Layer (https://github.com/GmSSL/OpenSSL-Compatibility-Layer) 提供了OpenSSL的兼容层,Nginx等应用可以通过OpenSSL-Compatibility-Layer调用GmSSL功能。经过测试目前兼容层可以兼容Nginx 1.16 ~ 1.25 之间的版本。

Benchmark

性能测试结果是在单核单线程且未修改处理器默认配置下5次测试中取最好效果。由于未关闭睿频或进行大小核设置,这个成绩通常会略高于多核多线程中每核心的平均成绩。

cmake .. -DENABLE_TEST_SPEED=ON
make
./bin/sm4test; ./bin/sm3test; ./bin/sm2_signtest; ./bin/sm2_enctest; ./bin/sm9test; ./bin/zuctest

MacBook Pro 13-inch 2018: 2.7 GHz Quad-Core Intel Core i7, Intel Iris Plus Graphics 655. 8 GB 2133 HMz LPDDR3. macOS Sonoma 14.3.

speed_sm4_encrypt: 164.826108 MiB per second
speed_sm4_encrypt_blocks: 163.120495 MiB per second
speed_sm4_cbc_encrypt_blocks: 156.870435 MiB per second
speed_sm4_cbc_decrypt_blocks: 174.701097 MiB per second
speed_sm4_ctr_encrypt_blocks: 178.457901 MiB per second
speed_sm4_ctr32_encrypt_blocks: 185.007458 MiB per second
speed_zuc_generate_keystream: 337.403260-MiB per second
speed_zuc_encrypt: 356.315696-MiB per second
test_sm3_speed: 273.551034 MiB per second
sm2_sign_ctx speed (ENABLE_SM2_AMD64): 4096 signs time 0.036916 seconds, 110954.599632 signs per second
sm2_sign_ctx speed : 4096 signs time 0.236611 seconds, 17311.114023 signs per second
test_sm2_encrypt_ctx_speed (ENABLE_SM2_AMD64): 17879.592122 encryptions per second
test_sm2_encrypt_ctx_speed: 1869.314131 encryptions per second
test_sm9_z256_pairing_speed: 173 pairings per second

MacBook Air M2 2022. Apple M2. 16 GB. Sonoma 14.5.

speed_sm4_encrypt: 143.180578 MiB per second
speed_sm4_encrypt_blocks: 190.928509 MiB per second
speed_sm4_cbc_encrypt_blocks: 148.519447 MiB per second
speed_sm4_cbc_decrypt_blocks: 187.305378 MiB per second
speed_sm4_ctr_encrypt_blocks: 191.195450 MiB per second
speed_sm4_ctr32_encrypt_blocks: 191.522725 MiB per second
speed_zuc_generate_keystream: 344.604781-MiB per second
speed_zuc_encrypt: 344.723575-MiB per second
test_sm3_speed: 327.298762 MiB per second
sm2_sign_ctx speed : 4096 signs time 0.290709 seconds, 14089.691066 signs per second
test_sm2_encrypt_ctx_speed: 1518.575861 encryptions per second
test_sm9_z256_pairing_speed: 141 pairings per seconds

ChangeLog

自从3.1.1版本以来

  • 提升了全部国密算法的性能,并在tests测试程序中增加了国密算法的性能测试
  • 增加了SM4 ECB/CFB/OFB/CCM/XTS加密模式,带SM3-HMAC的SM4 CBC/CTR模式,并且在gmssl命令行工具中增加了所有SM4加密模式的选项
  • gmssl命令行中增加了GHASH计算的选项
  • 增加了sdftest正确性和兼容性测试命令,以独立子项目的形式提供了SDF的软件实现SoftSDF
  • 移除了RC4, MD5等已被攻破的密码算法

开发者们

Stargazers over time

Stargazers over time

Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS

简介

GmSSL (http://gmssl.org) 是支持国密算法和标准的OpenSSL分支,增加了对国密SM2/SM3/SM4算法和ECIES、CPK、ZUC算法的支持,实现了这些 展开 收起
C/C++ 等 4 种语言
Apache-2.0
取消

发行版

暂无发行版

贡献者

全部

近期动态

加载更多
不能加载更多了
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化