--- /dev/null
+/*
+Copyright Suzhou Tongji Fintech Research Institute 2017 All Rights Reserved.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package sm2
+
+import (
+ "crypto/rand"
+ "crypto/x509/pkix"
+ "encoding/asn1"
+ "fmt"
+ "io/ioutil"
+ "log"
+ "math/big"
+ "net"
+ "os"
+ "testing"
+ "time"
+)
+
+func TestSm2(t *testing.T) {
+ priv, err := GenerateKey() // 生成密钥对
+ if err != nil {
+ log.Fatal(err)
+ }
+ fmt.Printf("%v\n", priv.Curve.IsOnCurve(priv.X, priv.Y)) // 验证是否为sm2的曲线
+ pub := &priv.PublicKey
+ msg := []byte("123456")
+ d0, err := pub.Encrypt(msg)
+ if err != nil {
+ fmt.Printf("Error: failed to encrypt %s: %v\n", msg, err)
+ return
+ }
+ fmt.Printf("Cipher text = %v\n", d0)
+ d1, err := priv.Decrypt(d0)
+ if err != nil {
+ fmt.Printf("Error: failed to decrypt: %v\n", err)
+ }
+ fmt.Printf("clear text = %s\n", d1)
+ ok, err := WritePrivateKeytoPem("priv.pem", priv, nil) // 生成密钥文件
+ if ok != true {
+ log.Fatal(err)
+ }
+ pubKey, _ := priv.Public().(*PublicKey)
+ ok, err = WritePublicKeytoPem("pub.pem", pubKey, nil) // 生成公钥文件
+ if ok != true {
+ log.Fatal(err)
+ }
+ msg = []byte("test")
+ err = ioutil.WriteFile("ifile", msg, os.FileMode(0644)) // 生成测试文件
+ if err != nil {
+ log.Fatal(err)
+ }
+ privKey, err := ReadPrivateKeyFromPem("priv.pem", nil) // 读取密钥
+ if err != nil {
+ log.Fatal(err)
+ }
+ pubKey, err = ReadPublicKeyFromPem("pub.pem", nil) // 读取公钥
+ if err != nil {
+ log.Fatal(err)
+ }
+ msg, _ = ioutil.ReadFile("ifile") // 从文件读取数据
+ sign, err := privKey.Sign(rand.Reader, msg, nil) // 签名
+ if err != nil {
+ log.Fatal(err)
+ }
+ err = ioutil.WriteFile("ofile", sign, os.FileMode(0644))
+ if err != nil {
+ log.Fatal(err)
+ }
+ signdata, _ := ioutil.ReadFile("ofile")
+ ok = privKey.Verify(msg, signdata) // 密钥验证
+ if ok != true {
+ fmt.Printf("Verify error\n")
+ } else {
+ fmt.Printf("Verify ok\n")
+ }
+ ok = pubKey.Verify(msg, signdata) // 公钥验证
+ if ok != true {
+ fmt.Printf("Verify error\n")
+ } else {
+ fmt.Printf("Verify ok\n")
+ }
+ templateReq := CertificateRequest{
+ Subject: pkix.Name{
+ CommonName: "test.example.com",
+ Organization: []string{"Test"},
+ },
+ // SignatureAlgorithm: ECDSAWithSHA256,
+ SignatureAlgorithm: SM2WithSM3,
+ }
+ _, err = CreateCertificateRequestToPem("req.pem", &templateReq, privKey)
+ if err != nil {
+ log.Fatal(err)
+ }
+ req, err := ReadCertificateRequestFromPem("req.pem")
+ if err != nil {
+ log.Fatal(err)
+ }
+ err = req.CheckSignature()
+ if err != nil {
+ log.Fatal(err)
+ } else {
+ fmt.Printf("CheckSignature ok\n")
+ }
+ testExtKeyUsage := []ExtKeyUsage{ExtKeyUsageClientAuth, ExtKeyUsageServerAuth}
+ testUnknownExtKeyUsage := []asn1.ObjectIdentifier{[]int{1, 2, 3}, []int{2, 59, 1}}
+ extraExtensionData := []byte("extra extension")
+ commonName := "test.example.com"
+ template := Certificate{
+ // SerialNumber is negative to ensure that negative
+ // values are parsed. This is due to the prevalence of
+ // buggy code that produces certificates with negative
+ // serial numbers.
+ SerialNumber: big.NewInt(-1),
+ Subject: pkix.Name{
+ CommonName: commonName,
+ Organization: []string{"TEST"},
+ Country: []string{"China"},
+ ExtraNames: []pkix.AttributeTypeAndValue{
+ {
+ Type: []int{2, 5, 4, 42},
+ Value: "Gopher",
+ },
+ // This should override the Country, above.
+ {
+ Type: []int{2, 5, 4, 6},
+ Value: "NL",
+ },
+ },
+ },
+ NotBefore: time.Unix(1000, 0),
+ NotAfter: time.Unix(100000, 0),
+
+ // SignatureAlgorithm: ECDSAWithSHA256,
+ SignatureAlgorithm: SM2WithSM3,
+
+ SubjectKeyId: []byte{1, 2, 3, 4},
+ KeyUsage: KeyUsageCertSign,
+
+ ExtKeyUsage: testExtKeyUsage,
+ UnknownExtKeyUsage: testUnknownExtKeyUsage,
+
+ BasicConstraintsValid: true,
+ IsCA: true,
+
+ OCSPServer: []string{"http://ocsp.example.com"},
+ IssuingCertificateURL: []string{"http://crt.example.com/ca1.crt"},
+
+ DNSNames: []string{"test.example.com"},
+ EmailAddresses: []string{"gopher@golang.org"},
+ IPAddresses: []net.IP{net.IPv4(127, 0, 0, 1).To4(), net.ParseIP("2001:4860:0:2001::68")},
+
+ PolicyIdentifiers: []asn1.ObjectIdentifier{[]int{1, 2, 3}},
+ PermittedDNSDomains: []string{".example.com", "example.com"},
+
+ CRLDistributionPoints: []string{"http://crl1.example.com/ca1.crl", "http://crl2.example.com/ca1.crl"},
+
+ ExtraExtensions: []pkix.Extension{
+ {
+ Id: []int{1, 2, 3, 4},
+ Value: extraExtensionData,
+ },
+ // This extension should override the SubjectKeyId, above.
+ {
+ Id: oidExtensionSubjectKeyId,
+ Critical: false,
+ Value: []byte{0x04, 0x04, 4, 3, 2, 1},
+ },
+ },
+ }
+ pubKey, _ = priv.Public().(*PublicKey)
+ ok, _ = CreateCertificateToPem("cert.pem", &template, &template, pubKey, privKey)
+ if ok != true {
+ fmt.Printf("failed to create cert file\n")
+ }
+ cert, err := ReadCertificateFromPem("cert.pem")
+ if err != nil {
+ fmt.Printf("failed to read cert file")
+ }
+ err = cert.CheckSignature(cert.SignatureAlgorithm, cert.RawTBSCertificate, cert.Signature)
+ if err != nil {
+ log.Fatal(err)
+ } else {
+ fmt.Printf("CheckSignature ok\n")
+ }
+}
+
+func BenchmarkSM2(t *testing.B) {
+ t.ReportAllocs()
+ for i := 0; i < t.N; i++ {
+ priv, err := GenerateKey() // 生成密钥对
+ if err != nil {
+ log.Fatal(err)
+ }
+ msg := []byte("test")
+ sign, err := priv.Sign(rand.Reader, msg, nil) // 签名
+ if err != nil {
+ log.Fatal(err)
+ }
+ ok := priv.Verify(msg, sign) // 密钥验证
+ if ok != true {
+ fmt.Printf("Verify error\n")
+ } else {
+ fmt.Printf("Verify ok\n")
+ }
+ }
+}
OSDN Git Service
