tongsuo-project / tongsuo Goto Github PK
View Code? Open in Web Editor NEW铜锁/Tongsuo is a Modern Cryptographic Primitives and Protocols Library
Home Page: https://www.tongsuo.net
License: Apache License 2.0
铜锁/Tongsuo is a Modern Cryptographic Primitives and Protocols Library
Home Page: https://www.tongsuo.net
License: Apache License 2.0
目前,在include/crypto文件夹下面的evp.h中定义的结构:sm2_pkey_meth都没有在导出列表中:
00000000004e20e0 d sm2_pkey_meth
导致在上层app引用sm2_pkey_meth的时候,发生错误。
请问如何把上述结构和相关的成员函数加入到导出列表?
感谢
Per https://datatracker.ietf.org/doc/rfc8879/, now this became an RFC already...
标准中的用户A应该就NTLS的服务端,那么计算KDF的时候,ZA也就是服务端Z值应该要放在前面,但是我们是放在后面的,是否存在bug呢?
BabaSSL实现TLCP协议时,提供了单独的双证书加载API,而不是在原生的SSL_CTX_use_certificate函数做适配。这样做有什么特殊的考虑吗?
如下是BabaSSL新增的API,
SSL_CTX_use_sign_certificate
SSL_CTX_use_enc_certificate
SSL_CTX_use_sign_PrivateKey
SSL_CTX_use_enc_PrivateKey
新增API使得上层应用(例如Nginx)也要适配双证书加载的API。之前GMSSL库是在SSL_CTX_use_certificate函数调用里面做了证书X509v3 Key Usage的判断,这样Nginx可以不用改动代码集成TLCP功能。
可以集成Android库吗?封装一个jar包 可以走https的国密SSL的通道
根据RFC8998
3.3.1.1 clientHello中的描述“For the key_share extension, a KeyShareEntry for the "curveSM2" group MUST be included.”
在实际使用https://github.com/BabaSSL/BabaSSL/wiki/TLS1.3---%E5%9B%BD%E5%AF%86%E5%8D%95%E8%AF%81%E4%B9%A6的s_server/s_client命令行进行验证时,仅包含了x25519曲线的信息。
这是因为SM2曲线参数实际上在RFC8998中是无法使用的,所以才这样实现么?
ZUC, a.k.a. 祖冲之……
now sure yet when we will do this...
Collaboration way with Quantropy?
请问,SSLv23_method是不是默认对应着TLS算法套件?如果用国密SSL的话,只能是NTLS_method,不能用SSLv23_method?
./Configure --prefix=/tmp/openssl --cross-compile-prefix= linux-armv4 no-asm no-shared -fPIC
配置后,NTLS是默认开启的吗?NTLS_server_method怎么没有定义。
请教一下这款 SSL 和 天安的 SSL 区别是啥?
https://github.com/jntass/TASSL-1.1.1b
支持SM2 SM3 SM4国密算法和国密openssl协议的TASSL 基于openssl-1.1.1b版本
@InfoHunter 是否有什么特殊考虑?
Any use cases for SM9??
有相关样例吗?
使用如下流程生成的key,总是NULL:
if(!(kctx = EVP_PKEY_CTX_new_id(EVP_PKEY_SM2, NULL))) goto err;
if(!EVP_PKEY_keygen_init(kctx)) goto err;
if (!EVP_PKEY_keygen(kctx, &key)) goto err;
查看咱们代码,当前咱们应该是没有对国密加密证书进行校验,这似乎是个很严重的bug:加密证书有效时间,以及来源都没校验。请问咱们会进行这块的支持吗?或者是有规范写明无需校验国密加密证书(只需校验国密签名证书)?
ntls_process_cert_verify_ntls:unknown cipher type:ssl/statem_ntls/statem_ntls_srvr.c:976:
修改源码使SSL_kSM2DHE和SSL_kSM2共用ntls_process_cv_sm2dhe连接通过
这两套件证书认证不知有无差别
openssl 没有sm4-ccm与sm4-gcm,PR一下?
看了NTLS使用手册,想要在iOS工程中使用NTLS_client_method,SSL_CTX_enable_ntls方法,找不到方法实现。请教在iOS平台下,需要如何才能支持到NTLS的使用
https://github.com/BabaSSL/BabaSSL/blob/45bde95ccb9c4f35ab7c4777e5f265b7e9811807/apps/s_client.c#L885
最后一个写错了(o == OPT_DTLS),应该是 o == OPT_NTLS
A more friendly API style: https://github.com/google/tink
We need to investigate on some testing stuffs, like Travics for instance...
国密标准协议是基于TLS1.1协议,应该也是需要支持扩展。比如sni、重协商等。
支持engine吗?
老师,您好,我将babassl和Nginx一起编译,完成后部署上SM2双证书(签名证书含证书链+加密证书)。然后通过babassl编译生成的客户端程序,能获取到SM2证书信息,但是获取不到证书链信息。请问这个怎么解决呀?
建议看官方openssl。
由于SSL VPN规范没有很具体,当前有:
1.证书链构造的顺序
2.sm2 id的来源
3.某些字段的编解码等
...
都无法从协议中获取明确的做法。
阅读了BabaSSL,有自己独特的理解和实现,我想问下怎么去和其他厂家实现的SSL对接呢?比如TASSL。
根据wiki页面的“NTLS使用手册”进行NTLS连接测试时,并没有-enc_cert等相关选项。在编译最新版源码后,openssl s_server -hlep中也找不到NTLS相关的选项设置,请问现在的最新版本是否可以测试NTLS了?
增加编译说明和修正标题错误
https://github.com/BabaSSL/BabaSSL/blob/1ac490549dff8261a17c8278fa8a6afd6834d4f4/ssl/t1_lib.c #L2368
此处应该是处理TLS1.3逻辑(入口处已有条件限制 (TLS1_get_version(s) >= TLS1_2_VERSION && strict_mode)),使用 OPENSSL_NO_NTLS 这个宏开关是否合适?相应的赋值是否也有问题(SSL_PKEY_SM2)?
https://github.com/BabaSSL/BabaSSL/blob/1ac490549dff8261a17c8278fa8a6afd6834d4f4/ssl/ssl_ciph.c #L454
最外层条件是如果定义了宏 OPENSSL_NO_SM2,内层宏条件与上 (!defined OPENSSL_NO_SM2) ,导致这个条件分支无效。
https://github.com/BabaSSL/BabaSSL/blob/1ac490549dff8261a17c8278fa8a6afd6834d4f4/ssl/s3_lib.c #L4391
选择套件时,tls1_set_cert_validity 和 ssl_set_masks 两个函数已做了相应的判断,此处应该不需要再特殊处理。
关于公共部分的判断NTLS_VERSION 条件应该增加附加开关条件判断,这样会更严谨。
if (version == NTLS_VERSION) => if ( s->enable_ntls == 1 && version == NTLS_VERSION )
开启编译选项 OPENSSL_NO_NTLS 且 使能enable_ntls开关,才会走国密状态机。开关没有开启,走的是标准状态机。
相关位置如下:
https://github.com/BabaSSL/BabaSSL/blob/1ac490549dff8261a17c8278fa8a6afd6834d4f4/ssl/record/ssl3_record.c #L325
https://github.com/BabaSSL/BabaSSL/blob/1ac490549dff8261a17c8278fa8a6afd6834d4f4/ssl/ssl_asn1.c #L301
https://github.com/BabaSSL/BabaSSL/blob/1ac490549dff8261a17c8278fa8a6afd6834d4f4/ssl/ssl_cert.c #L976
诸如此类
Delete all temporarily generated files in DC test cases.
ECDHE密钥交换算法相关套件
0xE0,0x51 - ECDHE-SM2-SM4-GCM-SM3 NTLSv1.1 Kx=SM2DHE Au=SM2 Enc=SM4-GCM(128) Mac=AEAD
0xE0,0x11 - ECDHE-SM2-SM4-CBC-SM3 NTLSv1.1 Kx=SM2DHE Au=SM2 Enc=SM4(128) Mac=SM3
0xE0,0x11 - ECDHE-SM2-WITH-SM4-SM3 NTLSv1.1 Kx=SM2DHE Au=SM2 Enc=SM4(128) Mac=SM3
tls_post_process_client_hello_ntls
...
if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSM2DHE)
s->verify_mode = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT
| SSL_VERIFY_CLIENT_ONCE;
...
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.