{"repo":"guanzhi/GmSSL","free":true,"listed":false,"github":"https://github.com/guanzhi/GmSSL","clone":"git clone https://github.com/guanzhi/GmSSL.git","description":"支持国密SM2/SM3/SM4/SM9/SSL的密码工具箱","language":"C","stars":6136,"topics":["crypto","encryption","pairing","post-quantum","sm2","sm3","sm4","sm9","ssl","tlcp","tls","zuc"],"license":"Apache-2.0","category":"crypto_library","readme_excerpt":"# GmSSL\n\n[![CMake-Ubuntu/macOS](https://github.com/guanzhi/GmSSL/workflows/CMake/badge.svg)](https://github.com/guanzhi/GmSSL/actions/workflows/cmake.yml)\n[![CMake-Windows](https://github.com/guanzhi/GmSSL/workflows/CMake-windows/badge.svg)](https://github.com/guanzhi/GmSSL/actions/workflows/cmake-windows.yml)\n[![CMake-Android](https://github.com/guanzhi/GmSSL/actions/workflows/android-ci.yml/badge.svg)](https://github.com/guanzhi/GmSSL/actions/workflows/android-ci.yml)\n[![CMake-OpenHarmony](https://github.com/guanzhi/GmSSL/actions/workflows/ohos.yml/badge.svg)](https://github.com/guanzhi/GmSSL/actions/workflows/ohos.yml)\n[![CMake-iOS](https://github.com/guanzhi/GmSSL/actions/workflows/ios.yml/badge.svg)](https://github.com/guanzhi/GmSSL/actions/workflows/ios.yml)\n\nGmSSL是由北京大学自主开发的国产商用密码开源库，实现了对国密算法、标准和安全通信协议的全面功能覆盖，支持包括移动端在内的主流操作系统和处理器，支持密码钥匙、密码卡等典型国产密码硬件，提供功能丰富的命令行工具及多种编译语言编程接口。\n\n\n## 主要特性\n\n* 超轻量：GmSSL 3 大幅度降低了内存需求和二进制代码体积，不依赖动态内存，可以用于无操作系统的低功耗嵌入式环境(MCU、SOC等)，开发者也可以更容易地将国密算法和SSL协议嵌入到现有的项目中。\n* 更合规：GmSSL 3 可以配置为仅包含国密算法和国密协议(TLCP协议)，依赖GmSSL 的密码应用更容易满足密码产品型号检测的要求，避免由于混杂非国密算法、不安全算法等导致的安全问题和合规问题。\n* 更安全：TLS 1.3在安全性和通信延迟上相对之前的TLS协议有巨大的提升，GmSSL 3 支持TLS 1.3协议和RFC 8998的国密套件。GmSSL 3 默认支持密钥的加密保护，提升了密码算法的抗侧信道攻击能力。\n* 跨平台：GmSSL 3 更容易跨平台，构建系统不再依赖Perl，默认的CMake构建系统可以容易地和Visual Studio、Android NDK等默认编译工具配合使用，开发者也可以手工编写Makefile在特殊环境中编译、剪裁。\n\n## 下载\n\n* GmSSL的当前稳定发布版本为 [GmSSL-3.2.0](https://github.com/guanzhi/GmSSL/releases/tag/v3.2.0)，主要增加TLS 1.3、TLCP、后量子密码算法和跨平台构建支持，Windows、Android、iOS、OpenHarmony等平台的开发者需要使用该版本。\n\n## 编译与安装\n\nGmSSL 3 采用了cmake构建系统。下载源代码后将其解压缩，进入源码目录，执行：\n\n```bash\nmkdir build\ncd build\ncmake ..\nmake\nmake test\nsudo make install\n```\n\n在`make install`完成后，GmSSL会在默认安装目录中安装`gmssl`命令行工具，在头文件目录中创建`gmssl`目录，并且在库目录中安装`libgmssl.so`或`libgmssl.dylib`等动态库文件。需要静态库时，可以在配置阶段指定`-DBUILD_SHARED_LIBS=OFF`生成`libgmssl.a`。\n\n### Visual Studio环境编译\n\n在Visual Studio命令提示符下执行：\n\n```bash\nmkdir build\ncd build\ncmake .. -G \"NMake Makefiles\" -DWIN32=ON\nnmake\n```\n\n## 主要功能\n\n### 密码算法\n\n* 分组密码：SM4 (CBC/CTR/GCM/ECB/CFB/OFB/CCM/XTS), AES (CBC/CTR/GCM)\n* 序列密码：ZUC/ZUC-256\n* 哈希函数: SM3, SHA-1, SHA-224/256/384/512\n* 公钥密码：SM2加密/签名, SM9加密/签名\n* 后量子密码：LMS/HSS签名\n* MAC算法：HMAC, GHASH, CBC-MAC\n* 密钥导出函数：PBKDF2、HKDF\n* 随机数生成器：Intel RDRAND, HASH_DRBG (NIST.SP.800-90A)\n\n### 证书和数字信封\n\n* 数字证书：X.509证书, CRL证书注销列表, CSR (PKCS #10) 证书签名请求\n* 私钥加密：基于SM4/SM3口令加密的PEM格式私钥 (PKCS #8)\n* 数字信封：SM2密码消息 (GM/T 0010-2012)\n\n### SSL协议\n\n* TLCP 1.1，支持密码套`TLS_ECC_SM4_CBC_SM3 {0xE0,0x13}` (GB/T 38636-2020、GM/T 0024-2014)\n* TLS 1.2，支持密码套件`TLS_ECDHE_SM4_CBC_SM3 {0xE0,0x11}` (GB/T 38636-2020、GM/T 0024-2014)\n* TLS 1.3，支持密码套件`TLS_SM4_GCM_SM3 {0x00,0xC6}`  (RFC 8998)\n\n### 多语言接口\n\nGmSSL通过子项目提供多种编程语言绑定\n\n * [GmSSL-Java](https://github.com/GmSSL/GmSSL-Java) 以JNI方式实现的Java语言绑定\n * [GmSSL-PHP](https://github.com/GmSSL/GmSSL-PHP) 以PHP扩展方式实现的PHP语言绑定\n * [GmSSL-Go](https://github.com/GmSSL/GmSSL-Go) 以CGO方式实现的Go语言绑定\n * [GmSSL-Python](https://github.com/GmSSL/GmSSL-Python) 以ctypes方式实现的Python语言绑定\n * [gmssl-rs](https://github.com/GmSSL/gmssl-rs) GmSSL密码库的Rust语言封装\n * [GmSSL-Nodejs](https://github.com/GmSSL/GmSSL-Nodejs) GmSSL密码库的Node.js语言绑定\n\n### 支持国密硬件\n\nGmSSL内置支持国密SDF密码硬件（通常为PCI-E接口的密码卡或者服务器密码机）和SKF密码硬件（通常为小型USB密码钥匙）。经过测试的密码产品型号包括：\n\n* to be added.\n\n开发者也可以用GmSSL的子项目SoftSDF(https://github.com/GmSSL/SoftSDF) ，用功能等效（但是不具备密码硬件密钥保护等价的安全性）的软件SDF模块来进行开发和测试，正式部署的时候再替换为硬件SDF。\n\n### OpenSSL兼容性\n\nGmSSL 3.0版本重写了所有的代码并改变了原有API，因此当前GmSSL版本和OpenSSL不兼容，无法直接用GmSSL替换OpenSSL进行编译。GmSSL提供了子项目 OpenSSL-Compatibility-Layer (https://github.com/GmSSL/OpenSSL-Compatibility-Layer) 提供了OpenSSL的兼容层，Nginx等应用可以通过OpenSSL-Compatibility-Layer调用GmSSL功能。经过测试目前兼容层可以兼容Nginx 1.16 ~ 1.25 之间的版本。\n\n## Benchmark\n\n性能测试结果是在单核单线程且未修改处理器默认配置下5次测试中取最好效果。由于未关闭睿频或进行大小核设置，这个成绩通常会略高于多核多线程中每核心的平均成绩。\n\n```\ncmake .. -DENABLE_TEST_SPEED=ON\nmake\n./bin/sm4_cltest; ./bin/sm4test; ./bin/sm3test; ./bin/sm2_signtest; ./bin/sm2_enctest; ./bin/sm9test; ./bin/zuctest\n```\n\nMacBook Air M2 2022. Apple M2. 16 GB. Tahoe 26.1.\n```\nspeed_sm4_cl_ctr32_encrypt_blocks: 15340.364334-MiB per seconds\n```\n\nMacBook Pro 13-inch 2018: 2.7 GHz Quad-Core Intel Core i7, Intel  Iris Plus Graphics 655. 8 GB 2133 HMz LPDDR3. macOS Sonoma 14.3.\n\n```\nspeed_sm4_encrypt: 164.826108 MiB per second\nspeed_sm4_encrypt_blocks: 163.120495 MiB per second\nspeed_sm4_cbc_encrypt_blocks: 156.870435 MiB per second\nspeed_sm4_cbc_decrypt_blocks: 174.701097 MiB per second\nspeed_sm4_ctr_encrypt_blocks: 178.457901 MiB per second\nspeed_sm4_ctr32_encrypt_blocks: 185.007458 MiB per second\nspeed_zuc_generate_keystream: 337.403260-MiB per second\nspeed_zuc_encrypt: 356.315696-MiB per second\ntest_sm3_speed: 273.551034 MiB per second\nsm2_sign_ctx speed (ENABLE_SM2_AMD64): 4096 signs time 0.036916 seconds, 110954.599632 signs per second\nsm2_sign_ctx speed : 4096 signs time 0.236611 seconds, 17311.114023 signs per second\ntest_sm2_encrypt_ctx_speed (ENABLE_SM2_AMD64): 17879.592122 encryptions per second\ntest_sm2_encrypt_ctx_speed: 1869.314131 encryptions per second\ntest_sm9_z256_pairing_speed: 173 pairings per second\n```\n\nMacBook Air M2 2022. Apple M2. 16 GB. Sonoma 14.5.\n\n```\nspeed_sm4_encrypt: 143.180578 MiB per second\nspeed_sm4_encrypt_blocks: 190.928509 MiB per second\nspeed_sm4_cbc_encrypt_blocks: 148.519447 MiB per second\nspeed_sm4_cbc_decrypt_blocks: 187.305378 MiB per second\nspeed_sm4_ctr_encrypt_blocks: 191.195450 MiB per second\nspeed_sm4_ctr32_encrypt_blocks: 191.522725 MiB per second\nspeed_zuc_generate_keystream: 344.604781-MiB per second\nspeed_zuc_encrypt: 344.723575-MiB per second\ntest_sm3_speed: 327.298762 MiB per second\nsm2_sign_ctx speed : 4096 signs time 0.290709 seconds, 14089.691066 signs per second\ntest_sm2_encrypt_ctx_speed: 1518.575861 encryptions per second\ntest_sm9_z256_pairing_speed: 141 pairings per seconds\n```\n\n## ChangeLog\n\n自从3.1.1版本以来\n\n* 增加了TLS 1.3的PSK-DHE和PSK-only握手模式，支持0-RTT\n* 增加了TLS 1.3 HelloRetryRequest协商机制\n* 增加了TLS 1.3的SNI扩展\n* 增加了TLS 1.3的CT、OCSP Stapling扩展\n* 增加了P-256 + AES128 + SHA256密码套件\n* 以状态机方式实现TLS协议栈，支持非阻塞模式\n* 增加了CRYSTALS-Kyber后量子密钥封装算法及命令行选项\n* 增加了基于SM3的SPHINCS+后量子哈希签名算法(无状态)及命令行选项\n* 增加了基于SM3的XMSS后量子哈希签名算法(有状态)及命令行选项\n* 增加了基于SM3的LMS/HSS后量子哈希签名算法(有状态)及命令行选项\n* 提升了全部国密算法的性能，并在`tests`测试程序中增加了国密算法的性能测试\n* 增加了SM4 ECB/CFB/OFB/CCM/XTS加密模式，带SM3-HMAC的SM4 CBC/CTR模式，并且在`gmssl`命令行工具中增加了所有SM4加密模式的选项\n* 在`gmssl`命令行中增加了GHASH计算的选项\n* 增加了`sdftest`正确性和兼容性测试命令，以独立子项目的形式提供了SDF的软件实现SoftSDF\n* 移除了RC4, MD5等已被攻破的密码算法\n\n## 开发者们\n<a href=\"https://github.com/guanzhi/GmSSL/graphs/contributors\">\n  <img src=\"https://contrib.rocks/image?repo=guanzhi/GmSSL\" />\n</a>\n\n## Stargazers over time\n\n[![Stargazers over time](https://starchart.cc/guanzhi/GmSSL.svg)](https://starchart.cc/guanzhi/GmSSL)\n","default_branch":"master","files":416,"tree":[".githooks/pre-commit",".github/workflows/android-ci.yml",".github/workflows/cmake-windows.yml",".github/workflows/cmake.yml",".github/workflows/ios.yml",".github/workflows/msvc.yml",".github/workflows/ohos.yml",".github/workflows/release.yml",".gitignore","CMakeLists.txt","INSTALL.md","LICENSE","README.md","cmake/openssl_interop_commands.cmake","cmake/tlcp_commands.cmake","cmake/tls12_commands.cmake","cmake/tls13_commands.cmake","cmake/tls_command_test.cmake","cmake/tool_cert.cmake","cmake/tool_cms.cmake","cmake/tool_crl.cmake","cmake/tool_ghash.cmake","cmake/tool_helpers.cmake","cmake/tool_ocsp.cmake","cmake/tool_pqc.cmake","cmake/tool_rand.cmake","cmake/tool_sm2.cmake","cmake/tool_sm3.cmake","cmake/tool_sm4.cmake","cmake/tool_sm9.cmake","cmake/tool_zuc.cmake","include/gmssl/aes.h","include/gmssl/asm.h","include/gmssl/asn1.h","include/gmssl/base64.h","include/gmssl/block_cipher.h","include/gmssl/bn.h","include/gmssl/cms.h","include/gmssl/digest.h","include/gmssl/dylib.h","include/gmssl/ec.h","include/gmssl/endian.h","include/gmssl/error.h","include/gmssl/file.h","include/gmssl/gf128.h","include/gmssl/ghash.h","include/gmssl/hash256.h","include/gmssl/hex.h","include/gmssl/hkdf.h","include/gmssl/hmac.h","include/gmssl/http.h","include/gmssl/kyber.h","include/gmssl/lms.h","include/gmssl/lms_cl.h","include/gmssl/mem.h","include/gmssl/ocsp.h","include/gmssl/oid.h","include/gmssl/passwd.h","include/gmssl/pbkdf2.h","include/gmssl/pem.h","include/gmssl/pkcs8.h","include/gmssl/quic.h","include/gmssl/rand.h","include/gmssl/rdrand.h","include/gmssl/rsa.h","include/gmssl/sct.h","include/gmssl/sdf.h","include/gmssl/secp256r1.h","include/gmssl/secp384r1.h","include/gmssl/sha1.h","include/gmssl/sha2.h","include/gmssl/sha3.h","include/gmssl/skf.h","include/gmssl/sm2.h","include/gmssl/sm2_z256.h","include/gmssl/sm3.h","include/gmssl/sm3_x8_avx2.h","include/gmssl/sm4.h","include/gmssl/sm4_cbc_mac.h","include/gmssl/sm4_cl.h","include/gmssl/sm9.h","include/gmssl/sm9_z256.h","include/gmssl/socket.h","include/gmssl/sphincs.h","include/gmssl/tls.h","include/gmssl/version.h","include/gmssl/x509.h","include/gmssl/x509_alg.h","include/gmssl/x509_cer.h","include/gmssl/x509_crl.h","include/gmssl/x509_ext.h","include/gmssl/x509_key.h","include/gmssl/x509_req.h","include/gmssl/xmss.h","include/gmssl/xmss_cl.h","include/gmssl/zuc.h","src/aes.c","src/asn1.c","src/base64.c","src/block_cipher.c","src/bn.c","src/cl.c","src/cl.h","src/cms.c","src/debug.c","src/digest.c","src/ec.c","src/file.c","src/gf128.c","src/gf128_arm64.S","src/gf128_arm64.c","src/gf128_avx.c","src/ghash.c","src/hex.c","src/hkdf.c","src/hmac.c","src/http.c","src/http_win.c","src/kyber.c","src/lms.c","src/lms_cl.c","src/ocsp.c","src/passwd.c","src/pbkdf2.c","src/pem.c","src/pkcs8.c","src/quic.c","src/rand.c","src/rand_apple.c","src/rand_unix.c","src/rand_win.c","src/rdrand.c","src/rsa.c","src/sct.c","src/sdf/sdf.c","src/sdf/sdf.h","src/sdf/sdf_ext.c","src/sdf/sdf_ext.h","src/sdf/sdf_int.h","src/sdf/sdf_lib.c","src/sdf/sdf_meth.c","src/sdf/sdf_sansec.c","src/sdf/sdf_sansec.h","src/secp256r1.c","src/secp384r1.c","src/sgd.h","src/sha1.c","src/sha2.c","src/sha3.c","src/skf/skf.c","src/skf/skf.h","src/skf/skf_dummy.c","src/skf/skf_ext.c","src/skf/skf_ext.h","src/skf/skf_int.h","src/skf/skf_lib.c","src/skf/skf_meth.c","src/skf/skf_prn.c","src/skf/skf_wisec.c","src/skf/skf_wisec.h","src/sm2_enc.c","src/sm2_exch.c","src/sm2_key.c","src/sm2_sign.c","src/sm2_z256.c","src/sm2_z256_amd64.S","src/sm2_z256_arm64.S","src/sm2_z256_table.c","src/sm3.c","src/sm3_arm64.c","src/sm3_avx2.c","src/sm3_cl.c","src/sm3_hmac.c","src/sm3_kdf.c","src/sm3_pbkdf2.c","src/sm3_sse.c","src/sm4.c","src/sm4_aesni.c","src/sm4_arm64.c","src/sm4_avx2.c","src/sm4_cbc.c","src/sm4_cbc_mac.c","src/sm4_ccm.c","src/sm4_ce.c","src/sm4_cfb.c","src/sm4_cl.c","src/sm4_ctr.c","src/sm4_ecb.c","src/sm4_ff1.c","src/sm4_gcm.c","src/sm4_ofb.c","src/sm4_xts.c","src/sm9_cms.c","src/sm9_enc.c","src/sm9_exch.c","src/sm9_key.c","src/sm9_lib.c","src/sm9_sign.c","src/sm9_z256.c","src/sm9_z256_arm64.S","src/sm9_z256_table.c","src/socket.c","src/sphincs.c","src/tlcp.c","src/tls.c","src/tls12.c","src/tls13.c","src/tls_alpn.c","src/tls_cert.c","src/tls_cookie.c","src/tls_ext.c","src/tls_ocsp.c","src/tls_psk.c","src/tls_sct.c","src/tls_sni.c","src/tls_trace.c","src/tls_vrf.c","src/version.c","src/x509_alg.c","src/x509_cer.c","src/x509_crl.c","src/x509_ext.c","src/x509_key.c","src/x509_new.c","src/x509_req.c","src/x509_vrf.c","src/xmss.c","src/xmss_cl.c","src/zuc.c","src/zuc_modes.c","tests/aes_cbc_pkcs5test.h","tests/aestest.c","tests/asn1test.c","tests/base64test.c","tests/block_ciphertest.c","tests/bntest.c","tests/cmstest.c","tests/digesttest.c","tests/ecdsatest.c","tests/ectest.c","tests/gf128test.c","tests/ghashtest.c","tests/hextest.c","tests/hkdftest.c","tests/hmactest.c","tests/http_crltest.c","tests/httptest.c","tests/kybertest.c","tests/kybertest_mlkem768.h","tests/lms_cltest.c","tests/lmstest.c","tests/ocsptest.c","tests/pbkdf2test.c","tests/pbkdf2test_sha1.h","tests/pbkdf2test_sha224.h","tests/pbkdf2test_sha256.h","tests/pbkdf2test_sha384.h","tests/pbkdf2test_sha512.h","tests/pbkdf2test_sm3.h","tests/pemtest.c","tests/pkcs8test.c","tests/quictest.c","tests/rdrandtest.c","tests/secp256r1_keytest.c","tests/secp256r1test.c","tests/secp384r1_ecdsatest.c","tests/secp384r1_keytest.c","tests/secp384r1test.c","tests/sha1test.c","tests/sha224test.c","tests/sha256test.c","tests/sha384test.c","tests/sha512test.c","tests/sm2_enctest.c","tests/sm2_exchtest.c","tests/sm2_keytest.c","tests/sm2_signtest.c","tests/sm2_z256test.c","tests/sm3_hkdftest.c","tests/sm3_hkdftest.h","tests/sm3_hmactest.c","tests/sm3_hmactest.h","tests/sm3test.c","tests/sm4_aesni_avxtest.c","tests/sm4_cbc_mactest.c","tests/sm4_cbc_paddingtest.h","tests/sm4_cbctest.c","tests/sm4_ccmtest.c","tests/sm4_ccmtest.h","tests/sm4_cfbtest.c","tests/sm4_cltest.c","tests/sm4_ctrtest.c","tests/sm4_ecbtest.c","tests/sm4_ff1test.c","tests/sm4_gcmtest.c","tests/sm4_gcmtest.h","tests/sm4_ofbtest.c","tests/sm4_xtstest.c","tests/sm4test.c","tests/sm9test.c","tests/sphincstest.c","tests/tls13test.c","tests/tls_ocsptest.c","tests/tlstest.c","tests/x509_algtest.c","tests/x509_crltest.c","tests/x509_exttest.c","tests/x509_keytest.c","tests/x509_oidtest.c","tests/x509_reqtest.c","tests/x509_strtest.c","tests/x509_vrftest.c","tests/x509test.c","tests/xmss_cltest.c","tests/xmsstest.c","tests/zuctest.c","tools/certgen.c","tools/certparse.c","tools/certrevoke.c","tools/certverify.c","tools/cmsdecrypt.c","tools/cmsencrypt.c","tools/cmsparse.c","tools/cmssign.c","tools/cmsverify.c","tools/crlgen.c","tools/crlget.c","tools/crlparse.c","tools/crlverify.c","tools/eckeygen.c","tools/ghash.c","tools/gmssl.c","tools/hsskeygen.c","tools/hsssign.c","tools/hssverify.c","tools/kyberdecap.c","tools/kyberencap.c","tools/kyberkeygen.c","tools/lmskeygen.c","tools/lmssign.c","tools/lmsverify.c","tools/ocspget.c","tools/ocspreq.c","tools/ocspsign.c","tools/ocspverify.c","tools/passwd.c","tools/passwd.h","tools/quic_client.c","tools/quic_help.h","tools/quic_server.c","tools/rand.c","tools/reqgen.c","tools/reqparse.c","tools/reqsign.c","tools/sctverify.c","tools/sdfdecrypt.c","tools/sdfdigest.c","tools/sdfencrypt.c","tools/sdfexport.c","tools/sdfinfo.c","tools/sdfsign.c","tools/sdftest.c","tools/sdfutil.c","tools/skfutil.c","tools/sm2decrypt.c","tools/sm2encrypt.c","tools/sm2exch.c","tools/sm2keygen.c","tools/sm2sign.c","tools/sm2speed.c","tools/sm2verify.c","tools/sm3.c","tools/sm3_hmac.c","tools/sm3_pbkdf2.c","tools/sm4.c","tools/sm4_cbc.c","tools/sm4_cbc_mac.c","tools/sm4_ccm.c","tools/sm4_cfb.c","tools/sm4_ctr.c","tools/sm4_ecb.c","tools/sm4_ff1.c","tools/sm4_gcm.c","tools/sm4_ofb.c","tools/sm4_xts.c","tools/sm9decrypt.c","tools/sm9encrypt.c","tools/sm9exch.c","tools/sm9keygen.c","tools/sm9setup.c","tools/sm9sign.c","tools/sm9verify.c","tools/sphincskeygen.c","tools/sphincssign.c","tools/sphincsverify.c","tools/tlcp_client.c","tools/tlcp_help.h","tools/tlcp_server.c","tools/tls12_client.c","tools/tls12_help.h"],"storefront":"/r/guanzhi","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/guanzhi/GmSSL/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}