Notes on SM2

sm2_standards.md

layout	title	description	author	date	last_modified	published
post	SM2 standards	A list of standards relevant for SM2	Nicola Tuveri	2020-03-18 20:00 CEST	2021-09-27 22:33 EEST	false

SM2 standards

CSTC	NISSTC	ISO	Notes	Name
GM/T 0003.1-2012 🇨🇳	GB/T 32918.1-2016 🇨🇳🇬🇧		SM2 Key generation	Public Key Cryptograhpic Algorithm SM2 Based on Elliptic Curves - Part 1: General
GM/T 0003.2-2012 🇨🇳	GB/T 32918.2-2016 🇨🇳🇬🇧	ISO/IEC 14888-3:2018 💸	SM2DSA	Public Key Cryptograhpic Algorithm SM2 Based on Elliptic Curves - Part 2: Digitial Signature Algorithm
GM/T 0003.3-2012 🇨🇳	GB/T 32918.3-2016 🇨🇳🇬🇧			Public Key Cryptograhpic Algorithm SM2 Based on Elliptic Curves - Part 3: Key Exchange Protocol
GM/T 0003.4-2012 🇨🇳	GB/T 32918.4-2016 🇨🇳🇬🇧			Public Key Cryptograhpic Algorithm SM2 Based on Elliptic Curves - Part 4: Public Key Encryption Algorithm
GM/T 0003.5-2012 🇨🇳	GB/T 32918.5-2017 🇨🇳🇬🇧			Public Key Cryptograhpic Algorithm SM2 Based on Elliptic Curves - Part 5: Parameter Definition
GM/T 0009-2012 🇨🇳🇬🇧 (unofficial)	GB/T 35276-2017 🇨🇳		SM2 objects encodings	SM2 Cryptographic Algorithm Application Specification

References

The English translations come from

• https://github.com/alipay/tls13-sm-spec
• https://github.com/metanorma/gmt-0009-2012

The PDFs in Chinese come from:

• https://www.gmssl.cn/gmssl/index.jsp?go=down

More details about different standardization bodies and the relationship between different standards can be found at

• https://github.com/alipay/tls13-sm-spec#chinese-algorithm-standards
• CSTC
• NISSTC

Relevant IETF documents:

• https://tools.ietf.org/html/draft-yang-tls-tls13-sm-suites-03 (ID)
• https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02 (ID)
• https://tools.ietf.org/html/draft-sca-cfrg-sm3-02 (ID)
• https://tools.ietf.org/html/draft-ribose-openpgp-sca-00 (ID)

sm2dsa_vs_ecdsa.md

layout	title	description	author	date	last_modified	published
post	SM2DSA vs ECDSA	Comparison of SM2DSA and ECDSA	Nicola Tuveri	2020-06-23 20:00 CEST	2020-06-23 22:55 CEST	false

SM2DSA vs ECDSA

Keygen

SM2DSA keygen differs in the range for the random secret scalar

Signature generation

The signature generation differs between SM2DSA and ECDSA.

Compare the respective points A3, A5 and A6 in the definitions of the two algorithms below.

SM2DSA

Let

• 𝑑_𝐴 be the (static) secret key of user A
• 𝐼𝐷_𝐴 be the distinguishing identifier of user A
• 𝑍_𝐴 be the hash value of 𝐼𝐷_𝐴 (part of the system parameters of elliptic curves and the public key of user A)
• 𝑀 be the message to be signed
• 𝐻𝑣() be a cryptographic hash function with 𝑣 bits message digest
• 𝑛 be the order of a base point 𝐺, where 𝑛 is a prime factor of #𝐸(𝐹𝑞)
• Q = (𝑥Q, 𝑦Q) = [𝑥]P denote the scalar multiplication between a scalar 𝑥 and a EC point P, resulting in a point Q with affine coordinates (𝑥Q, 𝑦Q)

In order to obtain a signature (𝑟, 𝑠) of the message 𝑀, user A as a signer should do the following:

• SM2::A1: Set 𝑀̅ = 𝑍_𝐴 ∥ 𝑀;
• SM2::A2: Compute 𝑒 = 𝐻𝑣(𝑀̅),
  • and convert the type of data 𝑒 to be integer as specified in Clauses 4.2.4 and 4.2.3 of GM/T 0003.1‒2012;
• SM2::A3: Generate a random number 𝑘 ∈ [1, 𝑛 − 1) using cryptographic RNG
  • (notice upper boundary is excluded);
• SM2::A4: Compute (𝑥1, 𝑦1) = [𝑘]𝐺,
  • and convert the type of data 𝑥1 to be integer as specified in Clause 4.2.8 of GM/T 0003.1‒2012;
• SM2::A5: Compute 𝑟 = (𝑒 + 𝑥1) mod 𝑛.
  • If 𝑟 = 0 or 𝑟 + 𝑘 = 𝑛, then go to SM2::A3;
• SM2::A6: Compute 𝑠 = ((1 + 𝑑_𝐴)^(-1) ⋅ (𝑘 − 𝑟 ⋅ 𝑑_𝐴)) mod 𝑛.
  • If 𝑠 = 0, then go to SM2::A3;
• SM2::A7: Convert the type of data 𝑟, 𝑠 to be bit strings according to the details in Clause 4.2.2 of GM/T 0003.1‒2012.
  • Then the signature of message 𝑀 is (𝑟, 𝑠).

ECDSA

Let

• 𝑑_𝐴 be the (static) secret key of user A
• 𝑀 be the message to be signed
• HASH() be the selected cryptographic hash function
• 𝑛 be the order of a base point 𝐺, where 𝑛 is a prime factor of #𝐸(𝐹𝑞)
• Q = (𝑥Q, 𝑦Q) = [𝑥]P denote the scalar multiplication between a scalar 𝑥 and a EC point P, resulting in a point Q with affine coordinates (𝑥Q, 𝑦Q)

In order to obtain a signature (𝑟, 𝑠) of the message 𝑀, user A as a signer should do the following:

• ECDSA::A1: Compute 𝑒 = HASH(𝑀)
  • and convert the output to an integer
• ECDSA::A2: Let 𝒛 be the 𝓛_𝑛 leftmost bits of 𝑒, where 𝓛_𝑛 is bitlen(𝑛)
• ECDSA::A3: Generate a random number 𝑘 ∈ [1, 𝑛 − 1] using cryptographic RNG
  • (notice the upper boundary is inclusive);
• ECDSA::A4: Compute (𝑥1, 𝑦1) = [𝑘]𝐺
  • convert 𝑥1 to integer
• ECDSA::A5: Compute 𝑟 = 𝑥1 mod 𝑛.
  • If 𝑟 = 0, then go to ECDSA::A3;
• ECDSA::A6: Compute 𝑠 = (𝑘^(-1) ⋅ (𝒛 + 𝑟 ⋅ 𝑑_𝐴)) mod 𝑛.
  • If 𝑠 = 0, then go to ECDSA::A3;
• ECDSA::A7: Then the signature of message 𝑀 is (𝑟, 𝑠).
  • (notice that (𝑟, -𝑠 mod 𝑛) is also a valid signature)

Signature Verification

Without going into too much details, the algorithms to verify an SM2 key and to verify an ECDSA key, differ given that the definitions of 𝑟 and 𝑠 differ.

References

Sources for this post:

• https://github.com/alipay/tls13-sm-spec/raw/master/sm-en-pdfs/sm2/GBT.32918.2-2016.SM2-en.pdf (Sect 6.1)
• https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm

Miscellaneous:

• https://crypto.stackexchange.com/questions/9918/reasons-for-chinese-sm2-digital-signature-algorithm
• SM2 related standards