diff --git a/docs/features/SM2-No-Za.md b/docs/features/algorithm-practice/SM2-No-Za.md similarity index 98% rename from docs/features/SM2-No-Za.md rename to docs/features/algorithm-practice/SM2-No-Za.md index 3bf41be9..46d54d2b 100644 --- a/docs/features/SM2-No-Za.md +++ b/docs/features/algorithm-practice/SM2-No-Za.md @@ -1,5 +1,6 @@ --- -sidebar_position: 19 +sidebar_position: 2 +slug: /features/SM2-No-Za --- # SM2 无 Za 实战 diff --git a/docs/features/zuc/ZUC-128-EIA3.md b/docs/features/algorithm-practice/ZUC-128-EIA3.md similarity index 97% rename from docs/features/zuc/ZUC-128-EIA3.md rename to docs/features/algorithm-practice/ZUC-128-EIA3.md index 269548f6..d1b2dc0f 100644 --- a/docs/features/zuc/ZUC-128-EIA3.md +++ b/docs/features/algorithm-practice/ZUC-128-EIA3.md @@ -1,3 +1,7 @@ +--- +sidebar_position: 3 +slug: /features/zuc/ZUC-128-EIA3 +--- # ZUC 128-EIA3 例子 ## 构建 构建 Tongsuo 时需要开启 ZUC 算法，例如： diff --git a/docs/features/algorithm-practice/_category_.json b/docs/features/algorithm-practice/_category_.json new file mode 100644 index 00000000..7dc59b0e --- /dev/null +++ b/docs/features/algorithm-practice/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "算法实战", + "position": 5, + "collapsible": true, + "link": null +} diff --git a/docs/features/sm2-sm3-sm4-cli.md b/docs/features/algorithm-practice/sm2-sm3-sm4-cli.md similarity index 91% rename from docs/features/sm2-sm3-sm4-cli.md rename to docs/features/algorithm-practice/sm2-sm3-sm4-cli.md index 4fafd203..4acd88e4 100644 --- a/docs/features/sm2-sm3-sm4-cli.md +++ b/docs/features/algorithm-practice/sm2-sm3-sm4-cli.md @@ -1,5 +1,6 @@ --- -sidebar_position: 6 +sidebar_position: 1 +slug: /features/sm2-sm3-sm4-cli --- # SM2&SM3&SM4 命令行实战 @@ -26,7 +27,7 @@ echo -n "hello tongsuo" | /opt/tongsuo/bin/tongsuo dgst -sm3 ``` 结果如下： -![image.png](img/cli-result.png) +![image.png](../img/cli-result.png) ## 实战 SM2 签名和验签 @@ -44,7 +45,7 @@ dd if=/dev/urandom of=msg.bin bs=1024 count=1 签名正确时，验证成功可以看到： -![image.png](img/cli-result2.png) +![image.png](../img/cli-result2.png) ## 实战 SM2 加密和解密 @@ -61,4 +62,4 @@ echo "hello tongsuo" > msg.bin diff msg.bin msg2.bin ``` -![image.png](img/cli-result3.png) +![image.png](../img/cli-result3.png) diff --git a/docs/features/ecosystem-integrations/_category_.json b/docs/features/ecosystem-integrations/_category_.json new file mode 100644 index 00000000..8c9dbde5 --- /dev/null +++ b/docs/features/ecosystem-integrations/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "生态集成", + "position": 9, + "collapsible": true, + "link": null +} diff --git a/docs/features/angie.md b/docs/features/ecosystem-integrations/angie.md similarity index 98% rename from docs/features/angie.md rename to docs/features/ecosystem-integrations/angie.md index 9a787fd9..ae13ad5e 100644 --- a/docs/features/angie.md +++ b/docs/features/ecosystem-integrations/angie.md @@ -1,5 +1,6 @@ --- sidebar_position: 5 +slug: /features/angie --- # Nginx 衍生版 Angie 支持铜锁和国密功能 @@ -9,7 +10,7 @@ sidebar_position: 5 近日，铜锁社区收到 Angie 核心成员 VBart (真名：Valentin V. Bartenev) 的来信，他很高兴地说，Angie 已经支持了铜锁库和国密功能，希望我们在铜锁项目主页上『互粉』一下。这让我们欣喜万分，因为我们之前尝试去让 Nginx 支持铜锁和国密，但由于 Nginx 被 F5 收购之后就不那么 open 了，此事就没了后续，而今天了解到 Angie 是 Nginx 的几个核心成员 fork Nginx 的衍生版，因为 F5 是美国公司，由于政治原因关闭了俄罗斯的业务，所以 Nginx 的核心成员就出去创业了自己的公司，开始开发 Angie，也算是延续 Nginx 的生命吧。同时，也让我们意识到，解决卡脖子问题刻不容缓。另外，也想不到一个俄罗斯软件会主动来集成铜锁和支持国密，我想这可能是开源社区的魅力吧。 下面是 VBart 来信的原文截图： -![image.png](img/angie.png) +![image.png](../img/angie.png) ## 关于 Angie @@ -26,7 +27,7 @@ http 模块支持国密的commit：[https://github.com/webserver-llc/angie/commi stream 模块支持国密的commit：[https://github.com/webserver-llc/angie/commit/fa83ee606cf7d55910e28772f5914d773e1fb635](https://github.com/webserver-llc/angie/commit/fa83ee606cf7d55910e28772f5914d773e1fb635) 下面是 Angie 的特性截图： -![image.png](img/angie2.png) +![image.png](../img/angie2.png) Angie 更多信息请移步其官网：[https://angie.software/en/](https://angie.software/en/) diff --git a/docs/features/cpython_ntls.md b/docs/features/ecosystem-integrations/cpython_ntls.md similarity index 96% rename from docs/features/cpython_ntls.md rename to docs/features/ecosystem-integrations/cpython_ntls.md index e2aa1c73..517c5ee4 100644 --- a/docs/features/cpython_ntls.md +++ b/docs/features/ecosystem-integrations/cpython_ntls.md @@ -1,6 +1,7 @@ ---- -sidebar_position: 28 ---- +--- +sidebar_position: 8 +slug: /features/cpython_ntls +--- # cpython + tongsuo @@ -296,4 +297,4 @@ if __name__ == "__main__": bash sudo tcpdump -i lo -s 0 -w localhost_8443.pcap 'host 127.0.0.1 and port 8443' -然后在 Windows 系统下用 Wireshark 打开并分析 pcap 文件。 \ No newline at end of file +然后在 Windows 系统下用 Wireshark 打开并分析 pcap 文件。 diff --git a/docs/features/curl.md b/docs/features/ecosystem-integrations/curl.md similarity index 99% rename from docs/features/curl.md rename to docs/features/ecosystem-integrations/curl.md index 1e28e548..cb0bd2a6 100644 --- a/docs/features/curl.md +++ b/docs/features/ecosystem-integrations/curl.md @@ -1,5 +1,6 @@ --- -sidebar_position: 10 +sidebar_position: 1 +slug: /features/curl --- # curl + 铜锁，支持国密HTTPS diff --git a/docs/features/gRPC_NTLS.md b/docs/features/ecosystem-integrations/gRPC_NTLS.md similarity index 96% rename from docs/features/gRPC_NTLS.md rename to docs/features/ecosystem-integrations/gRPC_NTLS.md index 3a97cad2..208eb42d 100644 --- a/docs/features/gRPC_NTLS.md +++ b/docs/features/ecosystem-integrations/gRPC_NTLS.md @@ -1,6 +1,7 @@ ---- -sidebar_position: 27 ---- +--- +sidebar_position: 7 +slug: /features/gRPC_NTLS +--- # gRPC + Tongsuo @@ -475,4 +476,4 @@ int main(int argc, char** argv) { bash tcpdump -i lo -s 0 -w localhost_50051.pcap '(host 127.0.0.1 or host ::1) and port 50051' -然后在 Windows 系统下用 Wireshark 打开并分析 pcap 文件。 \ No newline at end of file +然后在 Windows 系统下用 Wireshark 打开并分析 pcap 文件。 diff --git a/docs/features/php.md b/docs/features/ecosystem-integrations/php.md similarity index 99% rename from docs/features/php.md rename to docs/features/ecosystem-integrations/php.md index eb3e8ab9..3aa04096 100644 --- a/docs/features/php.md +++ b/docs/features/ecosystem-integrations/php.md @@ -1,5 +1,6 @@ --- -sidebar_position: 8 +sidebar_position: 6 +slug: /features/php --- # PHP 使用 Tongsuo + 国密说明文档 diff --git a/docs/features/tengine.md b/docs/features/ecosystem-integrations/tengine.md similarity index 99% rename from docs/features/tengine.md rename to docs/features/ecosystem-integrations/tengine.md index 701a336d..467fec39 100644 --- a/docs/features/tengine.md +++ b/docs/features/ecosystem-integrations/tengine.md @@ -1,5 +1,6 @@ --- -sidebar_position: 13 +sidebar_position: 4 +slug: /features/tengine --- # Tengine + Tongsuo 国密使用教程 ## 版本 @@ -270,7 +271,7 @@ ECDHE-SM2套件需要设置客户端的签名和加密证书。 1. 下载和安装360安全浏览器: [http://jinjiu.oss.aliyuncs.com/360se10.1.1670.0.exe](http://jinjiu.oss.aliyuncs.com/360se10.1.1670.0.exe)  （注意：360安全浏览器其他版本没有测试通过，可能是用法不对，也可能是客户端 bug） 2. 启用国密 -![image.png](./img/tengine.png) +![image.png](../img/tengine.png) 3. 配置信任的根证书 diff --git a/docs/features/tongsuo-java-sdk-engine.md b/docs/features/ecosystem-integrations/tongsuo-java-sdk-engine.md similarity index 98% rename from docs/features/tongsuo-java-sdk-engine.md rename to docs/features/ecosystem-integrations/tongsuo-java-sdk-engine.md index 077b1f57..ea7518a5 100644 --- a/docs/features/tongsuo-java-sdk-engine.md +++ b/docs/features/ecosystem-integrations/tongsuo-java-sdk-engine.md @@ -1,3 +1,7 @@ +--- +sidebar_position: 10 +slug: /features/tongsuo-java-sdk-engine +--- # Tongsuo-Java-SDK + 海光CPU密码协处理器使用教程 ## 概述 diff --git a/docs/features/tongsuo-java-sdk-tls13.md b/docs/features/ecosystem-integrations/tongsuo-java-sdk-tls13.md similarity index 99% rename from docs/features/tongsuo-java-sdk-tls13.md rename to docs/features/ecosystem-integrations/tongsuo-java-sdk-tls13.md index b8e99956..d22355ed 100644 --- a/docs/features/tongsuo-java-sdk-tls13.md +++ b/docs/features/ecosystem-integrations/tongsuo-java-sdk-tls13.md @@ -1,3 +1,7 @@ +--- +sidebar_position: 9 +slug: /features/tongsuo-java-sdk-tls13 +--- # Tongsuo-Java-SDK, TLS 1.3 + 商密套件示例代码 ## 客户端，TLS 1.3 + 商密套件 diff --git a/docs/features/wget.md b/docs/features/ecosystem-integrations/wget.md similarity index 98% rename from docs/features/wget.md rename to docs/features/ecosystem-integrations/wget.md index f9c477fe..7bae21a3 100644 --- a/docs/features/wget.md +++ b/docs/features/ecosystem-integrations/wget.md @@ -1,5 +1,6 @@ --- -sidebar_position: 9 +sidebar_position: 2 +slug: /features/wget --- # wget + 铜锁，支持从国密服务器下载文件 diff --git a/docs/features/wrk.md b/docs/features/ecosystem-integrations/wrk.md similarity index 97% rename from docs/features/wrk.md rename to docs/features/ecosystem-integrations/wrk.md index 29ed5756..229de245 100644 --- a/docs/features/wrk.md +++ b/docs/features/ecosystem-integrations/wrk.md @@ -1,5 +1,6 @@ --- -sidebar_position: 11 +sidebar_position: 3 +slug: /features/wrk --- # wrk + 铜锁，测试国密性能 diff --git a/docs/features/getting-started/_category_.json b/docs/features/getting-started/_category_.json new file mode 100644 index 00000000..7ff2d796 --- /dev/null +++ b/docs/features/getting-started/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "综合使用教程", + "position": 3, + "collapsible": true, + "link": null +} diff --git a/docs/features/handbook.md b/docs/features/getting-started/handbook.md similarity index 99% rename from docs/features/handbook.md rename to docs/features/getting-started/handbook.md index 2697fca1..61ab747f 100644 --- a/docs/features/handbook.md +++ b/docs/features/getting-started/handbook.md @@ -1,5 +1,6 @@ --- -sidebar_position: 3 +sidebar_position: 1 +slug: /features/handbook --- # 铜锁探“密”训练营实验手册 @@ -66,13 +67,13 @@ make install ```bash ls -l /opt/tongsuo ``` -![image.png](img/handbook1.png) +![image.png](../img/handbook1.png) 产看铜锁版本，执行如下命令： ```bash /opt/tongsuo/bin/tongsuo version ``` -![image.png](img/handbook2.png) +![image.png](../img/handbook2.png) ## SM2&SM3&SM4算法实战 @@ -96,7 +97,7 @@ diff msg.bin msg2.bin echo -n "hello tongsuo" | /opt/tongsuo/bin/tongsuo dgst -sm3 ``` 结果如下： -![image.png](img/handbook3.png) +![image.png](../img/handbook3.png) ### 实战SM2签名和验签 @@ -112,7 +113,7 @@ dd if=/dev/urandom of=msg.bin bs=1024 count=1 ``` 签名正确时，验证成功可以看到： -![image.png](img/handbook4.png) +![image.png](../img/handbook4.png) ## SM2&SM3&SM4算法编程入门 @@ -186,7 +187,7 @@ gcc sm4_enc.c -I/opt/tongsuo/include -L/opt/tongsuo/lib64 -lcrypto -Wl,-rpath=/o ./a.out ``` 输出明文消息的密文如下： -![image.png](img/handbook5.png) +![image.png](../img/handbook5.png) SM4解密： ```c @@ -309,7 +310,7 @@ gcc sm3.c -I/opt/tongsuo/include -L/opt/tongsuo/lib64 -lcrypto -Wl,-rpath=/opt/t ./a.out ``` 运行结果如下： -![image.png](img/handbook6.png) +![image.png](../img/handbook6.png) ### SM2签名算法编程入门 @@ -387,7 +388,7 @@ gcc sm2_sign.c -I/opt/tongsuo/include -L/opt/tongsuo/lib64 -lcrypto -Wl,-rpath=/ ./a.out ``` 输出签名结果： -![image.png](img/handbook7.png) +![image.png](../img/handbook7.png) SM2验签： ```c @@ -653,7 +654,7 @@ gcc sm2_dec.c -I/opt/tongsuo/include -L/opt/tongsuo/lib64 -lcrypto -Wl,-rpath=/o ./a.out ``` 解密出来的明文应该是hello tongsuo， -![image.png](img/handbook8.png) +![image.png](../img/handbook8.png) ## 自签发国密证书 @@ -1020,22 +1021,22 @@ mkdir certs/server /opt/tongsuo/bin/tongsuo pkey -in certs/server/sm2_sign.key -text -noout ``` 结果如下： -![image.png](img/handbook9.png) +![image.png](../img/handbook9.png) 命令行查看证书： ```bash /opt/tongsuo/bin/tongsuo x509 -in certs/server/sm2_sign.crt -text -noout ``` 结果如下： -![image.png](img/handbook10.png) +![image.png](../img/handbook10.png) 浏览器查看证书，使用支持360浏览器访问[https://ebssec.boc.cn/boc15/login.html](https://ebssec.boc.cn/boc15/login.html)，或者其他支持国密协议的浏览器也可以，查看国密证书，截图如下： -![image.png](img/handbook11.png) +![image.png](../img/handbook11.png) 点击证书信息，可以查看详细的信息： -![image.png](img/handbook12.png) +![image.png](../img/handbook12.png) ## 实战国密传输协议 @@ -1391,13 +1392,13 @@ SSL-Session: 通过360浏览器访问[https://ebssec.boc.cn/](https://ebssec.boc.cn/)，如图所示： -![image.png](img/handbook13.png) +![image.png](../img/handbook13.png) 可以从截图中看出使用的国密传输协议。 同时使用 Wireshark 进行抓包，可以看到 TLCP 的握手消息的详细内容。 -![image.png](img/handbook14.png) +![image.png](../img/handbook14.png) ## 国密传输协议编程入门 @@ -1588,7 +1589,7 @@ gcc server.c -I/opt/tongsuo/include/ -L/opt/tongsuo/lib64/ -lssl -lcrypto -Wl,- ``` 并在客户端发送消息，服务端截图： -![image.png](img/handbook15.png) +![image.png](../img/handbook15.png) ### 国密客户端 @@ -1724,7 +1725,7 @@ gcc client.c -I/opt/tongsuo/include/ -L/opt/tongsuo/lib64/ -lssl -lcrypto -Wl,- ``` 可以看到连接成功，发送消息，并收到应答： -![image.png](img/handbook16.png) +![image.png](../img/handbook16.png) ## Tengine + 铜锁，搭建国密服务器 @@ -2244,7 +2245,7 @@ cp /usr/local/mysql/support-files/mysql.server /etc/init.d/mysql /usr/local/mysql/bin/mysql -uroot -p --ssl-mode=required ``` 查看status： -![image.png](img/handbook17.png) +![image.png](../img/handbook17.png) ## 结营作业说明 @@ -2267,7 +2268,7 @@ cp /usr/local/mysql/support-files/mysql.server /etc/init.d/mysql - 以组号或者小组名字在t-camp下创建目录，将所有代码放到该目录下，避免和其他小组冲突； fork项目： -![image.png](img/handbook18.png) +![image.png](../img/handbook18.png) 提交变更请求： -![image.png](img/handbook19.png) +![image.png](../img/handbook19.png) diff --git a/docs/features/sm2-sm3-sm4-algorithms.md b/docs/features/getting-started/sm2-sm3-sm4-algorithms.md similarity index 99% rename from docs/features/sm2-sm3-sm4-algorithms.md rename to docs/features/getting-started/sm2-sm3-sm4-algorithms.md index 7d5319dd..94bca48d 100644 --- a/docs/features/sm2-sm3-sm4-algorithms.md +++ b/docs/features/getting-started/sm2-sm3-sm4-algorithms.md @@ -1,5 +1,6 @@ --- -sidebar_position: 12 +sidebar_position: 3 +slug: /features/sm2-sm3-sm4-algorithms --- # 在铜锁中使用 SM2&SM3&SM4 算法的教程 diff --git a/docs/features/performance-optimization/_category_.json b/docs/features/performance-optimization/_category_.json new file mode 100644 index 00000000..cbc99ff9 --- /dev/null +++ b/docs/features/performance-optimization/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "国密性能优化", + "position": 7, + "collapsible": true, + "link": null +} diff --git a/docs/features/sm2/Implement-2.md b/docs/features/performance-optimization/sm2/Implement-2.md similarity index 99% rename from docs/features/sm2/Implement-2.md rename to docs/features/performance-optimization/sm2/Implement-2.md index f9b2a90f..6c6b6216 100644 --- a/docs/features/sm2/Implement-2.md +++ b/docs/features/performance-optimization/sm2/Implement-2.md @@ -1,5 +1,6 @@ --- sidebar_position: 3 +slug: /features/sm2/Implement-2 --- # 铜锁SM2算法性能优化实践：（三）快速模逆元算法实现 @@ -18,7 +19,7 @@ sidebar_position: 3 用于求解最大公约数的欧几里得算法最早在欧几里得的《几何原本》中被提出，拓展欧几里得算法是对这一古老算法的扩展。在求解最大公约数的基础上，拓展欧几里得算法通过收集辗转相除过程中的余式，求得线性方程$ax + by = gcd(a, b)$的整数解。由于阶数$n$是一个质数，因此$gcd(a, n) = 1$，那 么该线性方程即转化为$ax + ny = 1$，恰巧是同余线性方程 $ax \equiv 1 \pmod{n}$ 的一般表示形式，所求的$x$即为$a$的模$n$逆元。 对于现代计算机而言，拓展欧几里得算法的一个缺点是在计算过程中存在大量除法运算，而CPU在处理除法运算时的效率通常比其他基本运算（如加、减、乘）要低得多。针对这一缺陷，约瑟夫 · 斯提芬于1967年提出了[二进制拓展欧几里得算法](https://www.sciencedirect.com/science/article/abs/pii/0021999167900472?via%3Dihub), 该算法用简单的移位操作和减法代替了复杂的除法运算。 下面是利用二进制拓展欧几里得算法求模$n$逆元的伪代码： -![image.png](../img/pseudocode.png) +![image.png](../../img/pseudocode.png) 拓展欧几里得算法求解模逆元的优点是：**可以求解任意模数下的逆元**，不受模数是否为素数的限制；算法效率高，相较于费马小定理求模逆元有一定的**性能优势**。但是，拓展欧几里得算法相应的也存在一些缺点：**实现代码较为复杂**，容易出错；代码中有大量的分支和判断语句，**难以实现恒定时间（Constant time）算法**，对于侧信道攻击的抵抗较弱，在密码学算法中可能会导致关于私钥或明文的信息发生泄漏。 @@ -50,7 +51,7 @@ $a^{2^{256} − 2^{224} - 2^{96} + 2^{64} - 3} \pmod{p}$ 该数的幂次非常大，如果采用常规方式构造，效率极低，这里我们采用加法链的思想以实现快速求幂。加法链求幂是一种快速求幂的方法，它的基本思想是将指数按二进制分解，并将幂运算分解为多个小幂数相乘的形式，从而减少幂运算的次数。前文提到，费马小定理求解模逆元的运算过程可以分解为模乘法和模平方运算，这里我们记模乘法次数为$xM$，模平方次数为$yS$，那么加法链求幂的时间复杂度可以用$xM + yS$来衡量。 尽管使加法链求幂时间复杂度最优的问题是一个NP-hard问题，且证明某求解链路是否为最优解也非常困难，但密码学界针对常见的椭圆曲线参数已经提出了许多较优的加法链。我们通过比较同一曲线的不同加法链路和相近曲线的较优链路，再进一步比较不同方案所需的中间值数量，可以比选出一个当前最优解。目前，在针对SM2曲线参数$p$的模逆元加法链研究中，一个较优解是朱辉等人提出的[算法](https://jeit.ac.cn/cn/article/doi/10.11999/JEIT211049)，**此算法的时间复杂度为**$255M + 14S$**，需要4个变量作为中间值**，具体如下： -![image.png](../img/sca-256.png) +![image.png](../../img/sca-256.png) 在计算$a^{p-2}$时，另一个需要仔细考虑的是中间值溢出问题。在本系列（二）中提到，快速模约减的输入必须小于$p^2$，由于$0 < a < p$，因此在每一次乘法或平方运算后，都需要立刻调用快速模约减函数将中间值约化到$[0,p)$范围内，以避免中间值溢出导致结果出错的情况。最终铜锁实现的快速模逆元算法如下所示： ```c static void felem_inv(felem out, const felem in) diff --git a/docs/features/sm2/_category_.json b/docs/features/performance-optimization/sm2/_category_.json similarity index 81% rename from docs/features/sm2/_category_.json rename to docs/features/performance-optimization/sm2/_category_.json index b02f8c9e..ef9d5d73 100644 --- a/docs/features/sm2/_category_.json +++ b/docs/features/performance-optimization/sm2/_category_.json @@ -1,6 +1,6 @@ { "label": "SM2 性能优化", - "position": 1, + "position": 2, "collapsible": true, "link": null } diff --git a/docs/features/sm2/implement.md b/docs/features/performance-optimization/sm2/implement.md similarity index 99% rename from docs/features/sm2/implement.md rename to docs/features/performance-optimization/sm2/implement.md index 1d902eed..9e7a3e4d 100644 --- a/docs/features/sm2/implement.md +++ b/docs/features/performance-optimization/sm2/implement.md @@ -1,5 +1,6 @@ --- sidebar_position: 2 +slug: /features/sm2/implement --- # 铜锁SM2算法性能优化实践：（二）快速模约减算法实现 @@ -49,7 +50,7 @@ $(v[0]*2^0 + v[1]*2^{32} + v[2]*2^{64} + ... + v[15]*2^{480}) \mod p$, 其中 $ | | a | -a | 0 | 0 | 0 | -a | a | 0 | -a | 上下相减，高位参数$v[8]$被成功消除，低位约化的结果为：$a * 2^{224} + a * 2^{96} - a * 2^{64} + a$。依次对$v[8] - v[15]$做低位约化即可消除所有高位参数。将所有的低位约化结果合并同类项，可得到如下的sm2快速模约减算法。该算法由[白国强等人](https://ieeexplore.ieee.org/document/7011249)于2014年首次提出，实际运用中也有多种不同的参数组合形式： -![image.png](../img/256.png) +![image.png](../../img/256.png) 图1：基于参数 $p_{sm2p256}$ 的快速模约减算法 最后对约化后的低位参数$v[0] - v[7]$再做一次约减，旨在将模约减结果规约到$[0,p)$范围内。此处最多需要减去$13p$即可得到最终结果，无需使用成本昂贵的模除法。从图1中不难看出，基于广义梅森素数的SM2快速模约减算法仅需要少量的有限域加法和减法即可实现，性能表现明显优于使用模逆元的模约减算法。 diff --git a/docs/features/sm2/overview.md b/docs/features/performance-optimization/sm2/overview.md similarity index 99% rename from docs/features/sm2/overview.md rename to docs/features/performance-optimization/sm2/overview.md index 75bd3544..a1b75e3d 100644 --- a/docs/features/sm2/overview.md +++ b/docs/features/performance-optimization/sm2/overview.md @@ -1,5 +1,6 @@ --- sidebar_position: 1 +slug: /features/sm2/overview --- # 铜锁SM2算法性能优化实践：（一）综述 @@ -12,7 +13,7 @@ sidebar_position: 1 作为椭圆曲线非对称加密算法的一类，SM2算法在计算数字签名时所执行的操作与其他椭圆曲线类似，主要涉及有限域运算、椭圆曲线运算和数字签名运算三大类计算操作，三类操作之间自底向上形成层级调用关系。经过抽象算法结构和筛选主要运算后，我们绘制出如图1所示的核心运算层次图： -![image.png](../img/core.png) +![image.png](../../img/core.png) 图1：SM2数字签名算法核心运算层次图 若要着手实现SM2性能优化，其关键在于如何提升图1所示的核心运算的计算效率。由于数字签名的具体步骤由国密标准定义，可优化的潜力不大，因此我们首先分析了铜锁中与SM2相关的椭圆曲线和有限域运算源码。在铜锁中，与上述运算相关的各类函数以函数指针的形式封装在`EC_method`结构体中，根据曲线和优化方式不同，函数指针指向的具体函数也有差异。SM2与大多数曲线类似，采用通用的基于**蒙哥马利模乘法**优化素数域运算的方式，相关函数封装在结构体`mont_method`中。 @@ -146,7 +147,7 @@ const EC_METHOD *EC_GFp_sm2p256_method(void) 在有限域运算中，对于运算结果大于 $p$ 的中间值，需要将其约减到 $p$ 以内，此过程也被称为模约减。由于 $p$ 是一个非常大的256位素数，且运算中间值最大可达 $p^2-1$ ，采用除法来计算模约减的效率将极其低下（在具体实践中，有限域除法一般借助乘法逆元实现，其耗时大约是模乘的200-300倍）。 目前，铜锁中的SM2算法调用的是通用的模约减优化函数，暂时没有针对曲线特化的快速模约减算法实现。第2章中已有提及，SM2曲线的推荐参数 $p$ 属于广义梅森素数， 而广义梅森素数在公钥密码学广泛运用的一个重要原因就是，基于此类素数可以实现快速模约减算法。具体来说，该算法能够将对 $p$ 的有限域除法转化为少量的加减法运算和位移操作，从而提升模约减的速度。我们参照如图2所示的算法实现了基于SM2曲线参数的快速模约减算法： -![image.png](../img/arithmetic.png) +![image.png](../../img/arithmetic.png) 图2：基于SM2曲线参数的快速模约减算法 ### 快速模逆元算法实现 @@ -158,7 +159,7 @@ $a^{p-2} = a^{2^{256} − 2^{224} - 2^{96} + 2^{64} - 3} \pmod{p}$ 优化后的模逆元虽可以分解为模乘法和模平方运算，但由于指数 $p-2$ 非常大，常规方式求解的效率依然很低。这里我们借用加法链的思想，将幂计算分解为多个小幂相乘的形式，从而减少幂运算的时间复杂度。目前，针对sm2曲线参数 $p$ 的模逆元加法链研究中，一个较优解是朱辉等人提出的[方案](https://jeit.ac.cn/cn/article/doi/10.11999/JEIT211049)，此方案复杂度为255次模平方+14次模乘法，需要4个变量作为中间值，具体如下： -![image.png](../img/arithmetic2.png) +![image.png](../../img/arithmetic2.png) 图3：基于SM2曲线参数的快速模逆元算法 ## 优化功能启用及系统要求 @@ -206,7 +207,7 @@ SM2算法64位平台性能优化功能的实现全面兼容铜锁现有架构， | SM2 verify | 12246/s | 6212/s | 6088/s | 2061/s | **+97.1%** | | SM2 keygen | 20485/s | 5543/s | 5457/s | 16028/s | **+269.5%** | -![image.png](../img/result.png) +![image.png](../../img/result.png) 性能测试结果表明，铜锁中针对SM2算法实现的64-bit 平台优化取得了较大的性能提升效果，符合优化工作的预期目标。从优化结果来看，签名算法和密钥对生成过程的优化提升明显高于验签算法，这主要是因为签名算法和密钥对生成过程所涉及的的椭圆曲线多倍点运算是基点乘运算，可以使用预置的预计算表加速计算，而验签算法的椭圆曲线多倍点运算是普通点乘运算，曲线点是不固定的，因而无法利用预计算表实现性能的进一步突破。 ## 参考文献 diff --git a/docs/features/sm4-ni.md b/docs/features/performance-optimization/sm4-ni.md similarity index 95% rename from docs/features/sm4-ni.md rename to docs/features/performance-optimization/sm4-ni.md index 871d24c6..6f09207a 100644 --- a/docs/features/sm4-ni.md +++ b/docs/features/performance-optimization/sm4-ni.md @@ -1,5 +1,6 @@ --- -sidebar_position: 7 +sidebar_position: 1 +slug: /features/sm4-ni --- # SM4-NI 性能优化 diff --git a/docs/features/platforms/_category_.json b/docs/features/platforms/_category_.json new file mode 100644 index 00000000..0892e6db --- /dev/null +++ b/docs/features/platforms/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "平台适配与系统安装", + "position": 10, + "collapsible": true, + "link": null +} diff --git a/docs/features/openeuler.md b/docs/features/platforms/openeuler.md similarity index 94% rename from docs/features/openeuler.md rename to docs/features/platforms/openeuler.md index 0556f74f..6e29ba03 100644 --- a/docs/features/openeuler.md +++ b/docs/features/platforms/openeuler.md @@ -1,3 +1,7 @@ +--- +sidebar_position: 2 +slug: /features/openeuler +--- # 欧拉操作系统上安装铜锁 RPM 包 ## 前言 @@ -9,7 +13,7 @@ ## 实战华为云服务器+欧拉+铜锁 购买弹性云服务器时，镜像选择公共镜像里面的openEuler，版本为openEuler 20.03，如下图所示。 -![image.png](img/image.png) +![image.png](../img/image.png) 登录云服务器后，安装铜锁，步骤如下。 1. 添加源 @@ -30,4 +34,3 @@ ```bash /opt/tongsuo/bin/openssl version ``` - diff --git a/docs/features/openharmony.md b/docs/features/platforms/openharmony.md similarity index 98% rename from docs/features/openharmony.md rename to docs/features/platforms/openharmony.md index 43ee223a..203601b1 100644 --- a/docs/features/openharmony.md +++ b/docs/features/platforms/openharmony.md @@ -1,5 +1,6 @@ --- -sidebar_position: 4 +sidebar_position: 1 +slug: /features/openharmony --- # 铜锁适配 OpenHarmony diff --git a/docs/features/post-quantum/_category_.json b/docs/features/post-quantum/_category_.json new file mode 100644 index 00000000..fc47822d --- /dev/null +++ b/docs/features/post-quantum/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "后量子密码", + "position": 6, + "collapsible": true, + "link": null +} diff --git a/docs/features/ml_dsa.md b/docs/features/post-quantum/ml_dsa.md similarity index 99% rename from docs/features/ml_dsa.md rename to docs/features/post-quantum/ml_dsa.md index e53c4aae..80a2a42c 100644 --- a/docs/features/ml_dsa.md +++ b/docs/features/post-quantum/ml_dsa.md @@ -1,5 +1,6 @@ --- -sidebar_position: 999 +sidebar_position: 2 +slug: /features/ml_dsa --- # 在Tongsuo中使用ML-DSA后量子签名算法 diff --git a/docs/features/pqc.md b/docs/features/post-quantum/pqc.md similarity index 96% rename from docs/features/pqc.md rename to docs/features/post-quantum/pqc.md index ed0db8c1..2ca40e3c 100644 --- a/docs/features/pqc.md +++ b/docs/features/post-quantum/pqc.md @@ -1,3 +1,7 @@ +--- +sidebar_position: 1 +slug: /features/pqc +--- # 在铜锁中使用 PQC 建立 TLS 1.3 连接 目前铜锁提供了 SM2DH-MLKEM768-hybrid（curveSM2MLKEM768） 混合抗量子密码密钥交换算法。本文描述如何在编译选项中引入该算法参数以及如何在建立 TLS 1.3 连接时使用该参数。 diff --git a/docs/features/products-and-compliance/_category_.json b/docs/features/products-and-compliance/_category_.json new file mode 100644 index 00000000..a51901bc --- /dev/null +++ b/docs/features/products-and-compliance/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "产品与合规", + "position": 11, + "collapsible": true, + "link": null +} diff --git a/docs/features/crypto-module-L1.md b/docs/features/products-and-compliance/crypto-module-L1.md similarity index 89% rename from docs/features/crypto-module-L1.md rename to docs/features/products-and-compliance/crypto-module-L1.md index 16bcd97c..fa349c59 100644 --- a/docs/features/crypto-module-L1.md +++ b/docs/features/products-and-compliance/crypto-module-L1.md @@ -1,3 +1,7 @@ +--- +sidebar_position: 1 +slug: /features/crypto-module-L1 +--- # 1级密码模块使用说明 ## 密码模块基本信息 @@ -6,9 +10,9 @@ |平台|产品名称|版本号|代码分支|证书|检测报告| |---|---|---|---|---|---| -|Android|BabaSSL移动端软件密码模块|8.2.1|8.2.1-gm|[证书](../../static/pdf/BabaSSL移动端软件密码模块证书.pdf)|待补充| -|iOS|BabaSSL IOS端软件密码模块|8.3.0|8.3.0-gm|[证书](../../static/pdf/BabaSSL-IOS端软件密码模块证书.pdf)|待补充| -|Linux|应用安全软件密码模块（Linux版）|8.3.1|8.3.1-gm|[证书](../../static/pdf/应用安全软件密码模块（Linux版）证书.pdf)|[检测报告](../../static/pdf/应用安全软件密码模块（Linux版）-检测报告.pdf)| +|Android|BabaSSL移动端软件密码模块|8.2.1|8.2.1-gm|[证书](../../../static/pdf/BabaSSL移动端软件密码模块证书.pdf)|待补充| +|iOS|BabaSSL IOS端软件密码模块|8.3.0|8.3.0-gm|[证书](../../../static/pdf/BabaSSL-IOS端软件密码模块证书.pdf)|待补充| +|Linux|应用安全软件密码模块（Linux版）|8.3.1|8.3.1-gm|[证书](../../../static/pdf/应用安全软件密码模块（Linux版）证书.pdf)|[检测报告](../../../static/pdf/应用安全软件密码模块（Linux版）-检测报告.pdf)| ## 构建和安装 diff --git a/docs/features/TLCP.md b/docs/features/protocols-and-certs/TLCP.md similarity index 99% rename from docs/features/TLCP.md rename to docs/features/protocols-and-certs/TLCP.md index b166dc8c..58149253 100644 --- a/docs/features/TLCP.md +++ b/docs/features/protocols-and-certs/TLCP.md @@ -1,5 +1,6 @@ --- -sidebar_position: 15 +sidebar_position: 1 +slug: /features/TLCP --- # 国密TLCP使用手册 ## 编译 NTLS 功能 diff --git a/docs/features/TLS-1-3.md b/docs/features/protocols-and-certs/TLS-1-3.md similarity index 98% rename from docs/features/TLS-1-3.md rename to docs/features/protocols-and-certs/TLS-1-3.md index 32fb722b..f7276804 100644 --- a/docs/features/TLS-1-3.md +++ b/docs/features/protocols-and-certs/TLS-1-3.md @@ -1,5 +1,6 @@ --- -sidebar_position: 16 +sidebar_position: 2 +slug: /features/TLS-1-3 --- # 在 TLS1.3 中使用商用密码算法 ## 背景文档 diff --git a/docs/features/Tongsuo-SM2-2.md b/docs/features/protocols-and-certs/Tongsuo-SM2-2.md similarity index 99% rename from docs/features/Tongsuo-SM2-2.md rename to docs/features/protocols-and-certs/Tongsuo-SM2-2.md index 33f433a9..07cc3207 100644 --- a/docs/features/Tongsuo-SM2-2.md +++ b/docs/features/protocols-and-certs/Tongsuo-SM2-2.md @@ -1,5 +1,6 @@ --- -sidebar_position: 18 +sidebar_position: 4 +slug: /features/Tongsuo-SM2-2 --- # 使用 Tongsuo 签发 SM2 双证书 ## SM2测试双证书 diff --git a/docs/features/Tongsuo-SM2.md b/docs/features/protocols-and-certs/Tongsuo-SM2.md similarity index 98% rename from docs/features/Tongsuo-SM2.md rename to docs/features/protocols-and-certs/Tongsuo-SM2.md index 999c3766..cf4709de 100644 --- a/docs/features/Tongsuo-SM2.md +++ b/docs/features/protocols-and-certs/Tongsuo-SM2.md @@ -1,5 +1,6 @@ --- -sidebar_position: 17 +sidebar_position: 3 +slug: /features/Tongsuo-SM2 --- # 使用 Tongsuo 签发 SM2 证书 ### SM2 测试证书 diff --git a/docs/features/protocols-and-certs/_category_.json b/docs/features/protocols-and-certs/_category_.json new file mode 100644 index 00000000..f75b2eeb --- /dev/null +++ b/docs/features/protocols-and-certs/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "协议与证书", + "position": 4, + "collapsible": true, + "link": null +} diff --git a/docs/features/zuc/_category_.json b/docs/features/whitebox-sm4/_category_.json similarity index 50% rename from docs/features/zuc/_category_.json rename to docs/features/whitebox-sm4/_category_.json index c6bdc312..d49e5532 100644 --- a/docs/features/zuc/_category_.json +++ b/docs/features/whitebox-sm4/_category_.json @@ -1,6 +1,6 @@ { - "label": "祖冲之", - "position": 14, + "label": "SM4 白盒", + "position": 8, "collapsible": true, "link": null } diff --git a/docs/features/sm4_whitebox/BitSliced-DummyShuffling/figures/MSS.jpg b/docs/features/whitebox-sm4/sm4_whitebox/BitSliced-DummyShuffling/figures/MSS.jpg similarity index 100% rename from docs/features/sm4_whitebox/BitSliced-DummyShuffling/figures/MSS.jpg rename to docs/features/whitebox-sm4/sm4_whitebox/BitSliced-DummyShuffling/figures/MSS.jpg diff --git a/docs/features/sm4_whitebox/BitSliced-DummyShuffling/figures/OurDS.jpg b/docs/features/whitebox-sm4/sm4_whitebox/BitSliced-DummyShuffling/figures/OurDS.jpg similarity index 100% rename from docs/features/sm4_whitebox/BitSliced-DummyShuffling/figures/OurDS.jpg rename to docs/features/whitebox-sm4/sm4_whitebox/BitSliced-DummyShuffling/figures/OurDS.jpg diff --git a/docs/features/sm4_whitebox/BitSliced-DummyShuffling/readme.md b/docs/features/whitebox-sm4/sm4_whitebox/BitSliced-DummyShuffling/readme.md similarity index 100% rename from docs/features/sm4_whitebox/BitSliced-DummyShuffling/readme.md rename to docs/features/whitebox-sm4/sm4_whitebox/BitSliced-DummyShuffling/readme.md diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/WBSM4-ResistDCA.md b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/WBSM4-ResistDCA.md similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/WBSM4-ResistDCA.md rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/WBSM4-ResistDCA.md diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-1.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-1.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-1.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-1.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-10.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-10.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-10.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-10.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-11.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-11.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-11.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-11.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-12.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-12.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-12.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-12.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-13.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-13.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-13.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-13.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-14.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-14.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-14.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-14.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-15.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-15.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-15.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-15.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-16.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-16.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-16.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-16.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-17.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-17.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-17.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-17.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-18.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-18.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-18.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-18.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-19.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-19.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-19.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-19.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-2.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-2.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-2.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-2.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-3.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-3.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-3.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-3.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-4.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-4.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-4.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-4.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-5.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-5.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-5.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-5.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-6.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-6.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-6.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-6.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-7.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-7.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-7.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-7.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-8.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-8.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-8.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-8.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image-9.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-9.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image-9.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image-9.png diff --git a/docs/features/sm4_whitebox/WBSM4-ResistDCA/image.png b/docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image.png similarity index 100% rename from docs/features/sm4_whitebox/WBSM4-ResistDCA/image.png rename to docs/features/whitebox-sm4/sm4_whitebox/WBSM4-ResistDCA/image.png diff --git a/docs/features/sm4_whitebox/_category_.json b/docs/features/whitebox-sm4/sm4_whitebox/_category_.json similarity index 100% rename from docs/features/sm4_whitebox/_category_.json rename to docs/features/whitebox-sm4/sm4_whitebox/_category_.json diff --git a/docs/features/sm4_whitebox/nonlinearwbsm4/img/nonlinearwbsm4-1-1.png b/docs/features/whitebox-sm4/sm4_whitebox/nonlinearwbsm4/img/nonlinearwbsm4-1-1.png similarity index 100% rename from docs/features/sm4_whitebox/nonlinearwbsm4/img/nonlinearwbsm4-1-1.png rename to docs/features/whitebox-sm4/sm4_whitebox/nonlinearwbsm4/img/nonlinearwbsm4-1-1.png diff --git a/docs/features/sm4_whitebox/nonlinearwbsm4/img/nonlinearwbsm4-2-1.png b/docs/features/whitebox-sm4/sm4_whitebox/nonlinearwbsm4/img/nonlinearwbsm4-2-1.png similarity index 100% rename from docs/features/sm4_whitebox/nonlinearwbsm4/img/nonlinearwbsm4-2-1.png rename to docs/features/whitebox-sm4/sm4_whitebox/nonlinearwbsm4/img/nonlinearwbsm4-2-1.png diff --git a/docs/features/sm4_whitebox/nonlinearwbsm4/nonlinearwbsm4.md b/docs/features/whitebox-sm4/sm4_whitebox/nonlinearwbsm4/nonlinearwbsm4.md similarity index 100% rename from docs/features/sm4_whitebox/nonlinearwbsm4/nonlinearwbsm4.md rename to docs/features/whitebox-sm4/sm4_whitebox/nonlinearwbsm4/nonlinearwbsm4.md diff --git a/docs/features/sm4_whitebox/wbsm4_xiao_dykey.md b/docs/features/whitebox-sm4/sm4_whitebox/wbsm4_xiao_dykey.md similarity index 99% rename from docs/features/sm4_whitebox/wbsm4_xiao_dykey.md rename to docs/features/whitebox-sm4/sm4_whitebox/wbsm4_xiao_dykey.md index 73ee5e7d..b826208e 100644 --- a/docs/features/sm4_whitebox/wbsm4_xiao_dykey.md +++ b/docs/features/whitebox-sm4/sm4_whitebox/wbsm4_xiao_dykey.md @@ -1,6 +1,7 @@ --- 查找表种的输入输出置乱编码都是随机选择的,白盒多样性的值越大,攻击者就 越难分析出隐藏在查找表中的密钥信息以及输入输出置乱编码。sidebar_label: '国密SM4算法的白盒方案实现' sidebar_position: 99 +slug: /features/sm4_whitebox/wbsm4_xiao_dykey --- # 一种基于Xiao-Lai方案的动态SM4白盒算法 diff --git a/docs/features/wbsm4.md b/docs/features/whitebox-sm4/wbsm4.md similarity index 98% rename from docs/features/wbsm4.md rename to docs/features/whitebox-sm4/wbsm4.md index 83e23857..ff458434 100644 --- a/docs/features/wbsm4.md +++ b/docs/features/whitebox-sm4/wbsm4.md @@ -1,5 +1,6 @@ --- -sidebar_position: 20 +sidebar_position: 1 +slug: /features/wbsm4 --- # SM4白盒密码算法使用说明 @@ -9,7 +10,7 @@ SM4算法加密速度快、安全级别高，在数据安全领域应用广泛 SM4白盒密码算法的算法设计、密码分析国内有丰富的研究成果，铜锁参考这些研究成果确定了实现方案。2009年，肖雅莹等设计了首个SM4白盒方案(肖-来方案)[1], 2013年，林婷婷、来学嘉对该算法进行攻击分析[4], 证明了攻击过程的时间复杂度上界为247；2016 年, 白琨鹏等构造了另外一个白盒实 现 SM4 的方案(白-武方案)[2], 该方案与肖-来方案类似, 增大了分析的难度, 使用了更多的随机数来提高算法的混淆程度；2020年，姚思等人结合混淆密钥与查找表技术提出了一种内部状态扩充的白盒SM4实现方案 (White-box implementation of SM4 algorithm with Internal State Expansion, WSISE方案)[3]，该方案显著提高了攻击者提取密钥的复杂度。2018年，潘文伦等进行了白盒方案分析[4]，计算了肖-来方案、白-武方案的密钥搜索空间；2022年张跃宇进行了白盒SM4的分析与改进[5]， 总结了白盒实现方案的安全性对比，参见下表[5]。 -![image.png](img/wbsm4-compare.jpg) +![image.png](../img/wbsm4-compare.jpg) 铜锁在SM4白盒算法实现选择了肖-来、白-武、WSISE三个方案，代码实现移植自Nexus-TYF的开源实现[6]，对代码进行重构完成在Tongsuo内集成。原代码包含了底层的矩阵运算库，实现了三个白盒算法的block块加密接口，铜锁通过KDF接口进行加密白盒密钥产生，并通过EVP接口支持白盒密钥的加密应用，支持ECB、CBC、CFB、OFB、CTR、CTR、GCM模式。ECB、CBC、CFB、OFB模式解密数据时，仍需使用原始的SM4密钥。