English | 简体中文
ShangMi (SM) cipher suites for Golang, referred to as GMSM, is a secure, high-performance, easy-to-use Golang ShangMi (SM) cipher suites library, covering public algorithms SM2/SM3/SM4/SM9/ZUC.
-
SM2 - This is a SM2 sm2p256v1 implementation whose performance is similar like golang native NIST P256 under amd64, arm64, s390x and ppc64le, for implementation detail, please refer SM2实现细节. It supports ShangMi sm2 digital signature, public key encryption algorithm and also key exchange.
-
SM3 - This is also a SM3 implementation whose performance is similar like golang native SHA 256 with SIMD under amd64, arm64, s390x, ppc64x, for implementation detail, please refer SM3性能优化. It also provides A64 cryptographic instructions SM3 tested with QEMU.
-
SM4 - For SM4 implementation, SIMD & AES-NI are used under amd64, arm64 and ppc64x, for detail please refer SM4性能优化. It is optimized for ECB/CBC/GCM/XTS operation modes. It also provides A64 cryptographic instructions SM4 tested with QEMU.
-
SM9 - For SM9 implementation, please reference SM9实现及优化
-
ZUC - For ZUC implementation, SIMD, AES-NI and CLMUL are used under amd64, arm64 and ppc64x, for detail please refer Efficient Software Implementations of ZUC
-
CFCA - some cfca specific implementations.
-
CIPHER - ECB/CCM/XTS/HCTR/BC/OFBNLF operation modes, XTS mode also supports GB/T 17964-2021. Current XTS mode implementation is NOT concurrent safe! BC and OFBNLF are legacy operation modes, HCTR is new operation mode in GB/T 17964-2021. BC operation mode is similar like CBC, there is no room for performance optimization in OFBNLF operation mode.
-
SMX509 - a fork of golang X509 that supports ShangMi.
-
PKCS7 - a fork of mozilla-services/pkcs7 that supports ShangMi.
-
PKCS8 - a fork of youmark/pkcs8 that supports ShangMi.
-
ECDH - a similar implementation of golang ECDH that supports SM2 ECDH & SM2MQV without usage of big.Int, a replacement of SM2 key exchange. For detail, pleaes refer is my code constant time?
-
DRBG - Random Number Generation Using Deterministic Random Bit Generators, for detail, please reference NIST Special Publication 800-90A and GM/T 0105-2021: CTR-DRBG using derivation function and HASH-DRBG. NIST related implementations are tested with part of NIST provided test vectors. It's NOT concurrent safe! You can also use randomness tool to check the generated random bits.
- TLCP - An implementation of GB/T 38636-2020 Information security technology Transport Layer Cryptography Protocol (TLCP).
- Trisia/Randomness - An implementation of GM/T 0005-2021 Randomness test specification.
- PKCS12 - pkcs12 supports ShangMi, a fork of SSLMate/go-pkcs12.
- MKSMCERT - A simple tool for making locally-trusted development ShangMi certificates, a fork of FiloSottile/mkcert.
This work is licensed under a MIT License. See the LICENSE file for details.
The basic architecture, design and some codes are from golang crypto.
The SM4 amd64 SIMD AES-NI implementation is inspired by code from mjosaarinen/sm4ni.
The original SM9/BN256 version is based on code from cloudflare/bn256.
The ZUC amd64 SIMD AES-NI, CLMUL implementation is inspired by code from Intel(R) Multi-Buffer Crypto for IPsec Library.
The pkcs7 is based on code from mozilla-services/pkcs7, which has been archived by the owner on Feb 10, 2024.
The pkcs8 is based on code from youmark/pkcs8.
This library is not fully audited and is offered as-is, and without a guarantee. Therefore, it is expected that changes in the code, repository, and API occur in the future. We recommend to take caution before using this library in a production application.
