GmSSL是由北京大学自主开发的国产商用密码开源库,实现了对国密算法、标准和安全通信协议的全面功能覆盖,支持包括移动端在内的主流操作系统和处理器,支持密码钥匙、密码卡等典型国产密码硬件,提供功能丰富的命令行工具及多种编译语言编程接口。
GmSSL 3 采用了cmake构建系统。下载源代码后将其解压缩,进入源码目录,执行:
mkdir build
cd build
cmake ..
make
make test
sudo make install
在make install
完成后,GmSSL会在默认安装目录中安装gmssl
命令行工具,在头文件目录中创建gmssl
目录,并且在库目录中安装libgmssl.a
、libgmssl.so
等库文件。
在Visual Studio命令提示符下执行:
mkdir build
cd build
cmake .. -G "NMake Makefiles" -DWIN32=ON
nmake
TLS_ECC_SM4_CBC_SM3 {0xE0,0x13}
(GB/T 38636-2020、GM/T 0024-2014)TLS_ECDHE_SM4_CBC_SM3 {0xE0,0x11}
(GB/T 38636-2020、GM/T 0024-2014)TLS_SM4_GCM_SM3 {0x00,0xC6}
(RFC 8998)GmSSL通过子项目提供多种多种编程语言绑定
GmSSL内置支持国密SDF密码硬件(通常为PCI-E接口的密码卡或者服务器密码机)和SKF密码硬件(通常为小型USB密码钥匙)。经过测试的密码产品型号包括:
开发者也可以用GmSSL的子项目SoftSDF(https://github.com/GmSSL/SoftSDF) ,用功能等效(但是不具备密码硬件密钥保护等价的安全性)的软件SDF模块来进行开发和测试,正式部署的时候再替换为硬件SDF。
GmSSL 3.0版本重写了所有的代码并改变了原有API,因此当前GmSSL版本和OpenSSL不兼容,无法直接用GmSSL替换OpenSSL进行编译。GmSSL提供了子项目 OpenSSL-Compatibility-Layer (https://github.com/GmSSL/OpenSSL-Compatibility-Layer) 提供了OpenSSL的兼容层,Nginx等应用可以通过OpenSSL-Compatibility-Layer调用GmSSL功能。经过测试目前兼容层可以兼容Nginx 1.16 ~ 1.25 之间的版本。
性能测试结果是在单核单线程且未修改处理器默认配置下5次测试中取最好效果。由于未关闭睿频或进行大小核设置,这个成绩通常会略高于多核多线程中每核心的平均成绩。
cmake .. -DENABLE_TEST_SPEED=ON
make
./bin/sm4test; ./bin/sm3test; ./bin/sm2_signtest; ./bin/sm2_enctest; ./bin/sm9test; ./bin/zuctest
MacBook Pro 13-inch 2018: 2.7 GHz Quad-Core Intel Core i7, Intel Iris Plus Graphics 655. 8 GB 2133 HMz LPDDR3. macOS Sonoma 14.3.
speed_sm4_encrypt: 164.826108 MiB per second
speed_sm4_encrypt_blocks: 163.120495 MiB per second
speed_sm4_cbc_encrypt_blocks: 156.870435 MiB per second
speed_sm4_cbc_decrypt_blocks: 174.701097 MiB per second
speed_sm4_ctr_encrypt_blocks: 178.457901 MiB per second
speed_sm4_ctr32_encrypt_blocks: 185.007458 MiB per second
speed_zuc_generate_keystream: 337.403260-MiB per second
speed_zuc_encrypt: 356.315696-MiB per second
test_sm3_speed: 273.551034 MiB per second
sm2_sign_ctx speed (ENABLE_SM2_AMD64): 4096 signs time 0.036916 seconds, 110954.599632 signs per second
sm2_sign_ctx speed : 4096 signs time 0.236611 seconds, 17311.114023 signs per second
test_sm2_encrypt_ctx_speed (ENABLE_SM2_AMD64): 17879.592122 encryptions per second
test_sm2_encrypt_ctx_speed: 1869.314131 encryptions per second
test_sm9_z256_pairing_speed: 173 pairings per second
MacBook Air M2 2022. Apple M2. 16 GB. Sonoma 14.5.
speed_sm4_encrypt: 143.180578 MiB per second
speed_sm4_encrypt_blocks: 190.928509 MiB per second
speed_sm4_cbc_encrypt_blocks: 148.519447 MiB per second
speed_sm4_cbc_decrypt_blocks: 187.305378 MiB per second
speed_sm4_ctr_encrypt_blocks: 191.195450 MiB per second
speed_sm4_ctr32_encrypt_blocks: 191.522725 MiB per second
speed_zuc_generate_keystream: 344.604781-MiB per second
speed_zuc_encrypt: 344.723575-MiB per second
test_sm3_speed: 327.298762 MiB per second
sm2_sign_ctx speed : 4096 signs time 0.290709 seconds, 14089.691066 signs per second
test_sm2_encrypt_ctx_speed: 1518.575861 encryptions per second
test_sm9_z256_pairing_speed: 141 pairings per seconds
自从3.1.1版本以来
tests
测试程序中增加了国密算法的性能测试gmssl
命令行工具中增加了所有SM4加密模式的选项gmssl
命令行中增加了GHASH计算的选项sdftest
正确性和兼容性测试命令,以独立子项目的形式提供了SDF的软件实现SoftSDF