openssl 从 1.1.1 开始支持 sm2。gmssl 基于openssl 添加了对国密的支持。

检测 openssl 是否支持 SM2

openssl ecparam -list_curves | grep SM2

生成密钥

openssl ecparam -genkey -name SM2 -out priv.key

gmssl ecparam -genkey -name sm2p256v1 -out priv.key
gmssl sm2 -genkey -out priv.key

查看私钥

openssl ec -in priv.key -text -noout

验证密钥

openssl ecparam -in priv.key -check

生成公钥

openssl ec -in priv.key -pubout -out pub.key
gmssl sm2 -in priv.key -pubout -out pub.key

创建测试文件

echo -n "xxxxxx" > data.txt

签名

gmssl dgst -sm3 -sign priv.key -out sm2.sig data.txt
gmssl sm2utl -sign -in data.txt -inkey priv.key -out sm2.sig -id "1234567812345678"
openssl pkeyutl -sign -in data.txt -inkey priv.key -out sig

验签

gmssl dgst -sm3 -verify pub.key -signature sm2.sig data.txt

gmssl sm2utl -verify -in data.txt -pubin -inkey pub.key -sigfile sm2.sig -id "1234567812345678"
openssl pkeyutl -verify -pubin -in data.txt -inkey pub.key -sigfile sig

加密

gmssl sm2utl -encrypt -in msg.txt -pubin -inkey pub.key -out enced.der

解密

gmssl sm2utl -decrypt -in enced.der -inkey priv.key

格式转换

私钥 openssl ec -in priv.key -out priv.der -outform der
公钥 openssl ec -pubin -in pub.key -outform der -out pub.der
gmssl sm2 -inform der -out priv.key -in priv.der

openssl 3.0 加解密

生成公私钥
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:sm2 -out sm2_private_key.pem
openssl pkey -in sm2_private_key.pem -pubout -out sm2_public_key.pem

加密
echo xxxx> plaintext.txt
openssl pkeyutl -encrypt -pubin -inkey sm2_public_key.pem -in plaintext.txt -out sm2_ciphertext.bin

解密
openssl pkeyutl -decrypt -inkey sm2_private_key.pem -in sm2_ciphertext.bin -out decrypted.txt