无缝互操作：腾讯云KMS在SM2国密算法上与 EasyGmSSL 的兼容实践

from __future__ import annotations
import base64
import os
from easy_gmssl import EasySm2EncryptionKey , SM2CipherMode
from tencentcloud.common import credential
from tencentcloud.common.exception.tencent_cloud_sdk_exception import TencentCloudSDKException
from tencentcloud.kms.v20190118 import kms_client , models
cred = credential.Credential(os.getenv("CLOUD_SECRET_ID") ,
                             os.getenv("CLOUD_SECRET_KEY"))
client = kms_client.KmsClient(cred , "ap-guangzhou")
try:
    # 生成本地 SM2密钥对
    # 去 KMS-API 侧生成 DEK，并使用本地的 SM2公钥加密 DEK 明文得到 DEK 密文
    with open('test_sm2_public.pem' , 'rb') as f:
        sm2_pub_key_bytes = f.read()
    req = models.GenerateDataKeyRequest()
    req.KeyId = '7bab23ea-1a0e-11ee-a405-52540078f78b'
    req.NumberOfBytes = 32
    req.EncryptionAlgorithm = 'SM2_C1C3C2_ASN1'
    req.EncryptionPublicKey = sm2_pub_key_bytes.decode('utf-8')
    resp = client.GenerateDataKey(req)
    print(resp.to_json_string(indent = 4))
    ####################################################
    # 使用本地的 SM2私钥解密 KMS 返回的 DEK 密文数据
    decrypt_sm2 = EasySm2EncryptionKey()
    decrypt_sm2.load_sm2_private_key('./test_sm2_private.pem' , '12345678')
    cipher = base64.b64decode(resp.Plaintext)
    plain_data = decrypt_sm2.Decrypt(cipher_data = cipher ,
                                     cipher_mode = SM2CipherMode.C1C3C2_ASN1)
    print(f'original dek data: {plain_data}, length: {len(plain_data)}')
except TencentCloudSDKException as err:
    print(err)

from __future__ import annotations
import base64
import os
from easy_gmssl import EasySm2EncryptionKey , SM2CipherMode
from tencentcloud.common import credential
from tencentcloud.common.exception.tencent_cloud_sdk_exception import TencentCloudSDKException
from tencentcloud.kms.v20190118 import kms_client , models
cred = credential.Credential(os.getenv("CLOUD_SECRET_ID") ,
                             os.getenv("CLOUD_SECRET_KEY"))
client = kms_client.KmsClient(cred , "ap-guangzhou")
try:
    # KMS公钥加密，然后去 KMS 控制台使用私钥解密
    # 密钥 ID：5f6b0824-bbf1-11ee-968e-5254000a5333
    encrypt_sm2 = EasySm2EncryptionKey()
    encrypt_sm2.load_sm2_pub_key('./sm2_encrypt.pem')
    plain = b'hello,world\n'
    ret = encrypt_sm2.Encrypt(plain)
    print(f'using kms sm2 public key to encrypt plain, got cipher in base64: {ret}')
    req = models.AsymmetricSm2DecryptRequest()
    req.KeyId = '5f6b0824-bbf1-11ee-968e-5254000a5333'
    req.Ciphertext = ret
    resp = client.AsymmetricSm2Decrypt(req)
    print(resp.to_json_string(indent = 4) , base64.b64decode(resp.Plaintext) == plain)
    assert base64.b64decode(resp.Plaintext) == plain , 'kms decrypt failed, decrypted data is invalid'
except TencentCloudSDKException as err:
    print(err)

from __future__ import annotations
import base64
import os
from easy_gmssl import EasySM2VerifyKey , EasySM3Digest , EasySm2Key , SignatureMode
from tencentcloud.common import credential
from tencentcloud.common.exception.tencent_cloud_sdk_exception import TencentCloudSDKException
from tencentcloud.kms.v20190118 import kms_client , models
cred = credential.Credential(os.getenv("CLOUD_SECRET_ID") ,
                             os.getenv("CLOUD_SECRET_KEY"))
client = kms_client.KmsClient(cred , "ap-guangzhou")
try:
    plain = os.urandom(2048)
    req = models.SignByAsymmetricKeyRequest()
    req.KeyId = '6b9a11ff-bbf1-11ee-829f-5254007a9eec'
    req.Algorithm = 'SM2DSA'
    req.Message = base64.b64encode(plain).decode('utf-8')
    req.MessageType = 'RAW'
    resp = client.SignByAsymmetricKey(req)
    print(resp.to_json_string(indent = 4))
    signature = resp.Signature
    signature_bytes = base64.b64decode(signature)
    test_verify = EasySM2VerifyKey(pem_public_key_file = './sm2_verify.pem')
    test_verify.UpdateData(plain)
    ret = test_verify.VerifySignature(signature_data = signature_bytes , signature_mode = SignatureMode.RS_ASN1)
    print(f'verify sm2 signature for plain data: {ret}')
except TencentCloudSDKException as err:
    print(err)

from __future__ import annotations
import base64
import os
from easy_gmssl import EasySM2VerifyKey , EasySM3Digest , EasySm2Key , SignatureMode
from tencentcloud.common import credential
from tencentcloud.common.exception.tencent_cloud_sdk_exception import TencentCloudSDKException
from tencentcloud.kms.v20190118 import kms_client , models
cred = credential.Credential(os.getenv("CLOUD_SECRET_ID") ,
                             os.getenv("CLOUD_SECRET_KEY"))
client = kms_client.KmsClient(cred , "ap-guangzhou")
try:
    plain = os.urandom(2048)
    h = EasySM3Digest()
    h.UpdateData(plain)
    hash_bytes , hash_len , plain_len = h.GetHash()
    print(f'plain sm3 hash:{base64.b64encode(hash_bytes).decode()}, length:{hash_len}, plain_len:{plain_len}')
    req = models.SignByAsymmetricKeyRequest()
    req.KeyId = '6b9a11ff-bbf1-11ee-829f-5254007a9eec'
    req.Algorithm = 'SM2DSA'
    req.Message = base64.b64encode(hash_bytes).decode('utf-8')
    req.MessageType = 'DIGEST'
    resp = client.SignByAsymmetricKey(req)
    print(resp.to_json_string(indent = 4))
    signature = resp.Signature
    signature_bytes = base64.b64decode(signature)
    verify = EasySm2Key()
    verify.load_sm2_pub_key('./sm2_verify.pem')
    ret = verify.verify_digest_signature(hash_bytes , signature_bytes)
    print(f'verify sm2 digest signature for plain sm3 hash: {ret}')
except TencentCloudSDKException as err:
    print(err)

from __future__ import annotations
from easy_gmssl import EasySm2EncryptionKey, SM2CipherFormat, SM2CipherMode
enc = EasySm2EncryptionKey()
plain = 'hello,world'
# 遍历当前支持的所有 SM2 加解密算法模式
# 当前支持的模式包括：
# C1C3C2_ASN1、C1C3C2、C1C2C3_ASN1、C1C2C3
for mode in SM2CipherMode:
    print(mode, '密文 in Hex:', enc.Encrypt('hello,world'.encode('utf-8'), mode, SM2CipherFormat.HexStr))

from __future__ import annotations
from easy_gmssl import EasySm2Key
test = EasySm2Key()
print('公钥数据 In Hex:', test.get_sm2_public_key_in_hex())
print('私钥数据 In Hex:', test.get_sm2_private_key_in_hex())