GM/T 0131-2023 电子签章应用接口规范：国密改造的最后一公里

def create_electronic_seal(
    document: bytes,
    private_key_handle: int,  # 密码机返回的句柄
    cert_chain: list[bytes],  # 证书链 DER 编码
    seal_position: dict,      # {page: int, x: float, y: float}
    timestamp_request: bool = False
) -> dict:
    """
    创建电子签章
    返回: {
        'signed_document': bytes,
        'signature_info': SES_Signature ASN.1,
        'timestamp': bytes | None
    }
    """
    # 1. 调用密码机进行 SM2 签名
    signature = call_crypto_device(
        op='SM2_SIGN',
        key_handle=private_key_handle,
        data=sm3_hash(document),
        algorithm='SM2WithSM3'  # OID: 1.2.156.10197.1.501
    )
    
    # 2. 构造签章数据结构（遵循 GM/T 0031）
    seal_info = {
        'header': 'ES',
        'version': '1.0',
        'vendor_id': 'XXX',
        'seal_id': generate_seal_id(),
        'cert_chain': cert_chain,
        'signature': signature
    }
    
    # 3. 可选：获取时间戳
    timestamp = None
    if timestamp_request:
        timestamp = call_timestamp_service(
            data=sm3_hash(document),
            algorithm='SM3'
        )
    
    # 4. 将签章嵌入文档
    signed_doc = embed_seal_to_pdf(
        document=document,
        seal_info=seal_info,
        position=seal_position,
        timestamp=timestamp
    )
    
    return {
        'signed_document': signed_doc,
        'signature_info': encode_asn1(seal_info),
        'timestamp': timestamp
    }

def verify_electronic_seal(
    document: bytes,
    signature_info: bytes,
    check_revocation: bool = True
) -> dict:
    """
    验证电子签章
    返回: {
        'valid': bool,
        'reason': str,
        'cert_info': dict
    }
    """
    # 1. 解析 ASN.1 数据结构
    seal_data = parse_asn1(signature_info)
    
    # 2. 验证签名算法
    if seal_data['algorithm'] != 'SM2WithSM3':
        return {'valid': False, 'reason': '非国密算法'}
    
    # 3. 验证证书链
    cert_chain = seal_data['cert_chain']
    if not verify_cert_chain(cert_chain):
        return {'valid': False, 'reason': '证书链验证失败'}
    
    # 4. 检查吊销状态
    if check_revocation:
        if not check_crl_or_ocsp(cert_chain):
            return {'valid': False, 'reason': '证书已吊销'}
    
    # 5. 验证签名值
    signature = seal_data['signature']
    public_key = cert_chain[0].public_key
    if not verify_sm2_signature(public_key, sm3_hash(document), signature):
        return {'valid': False, 'reason': '签名验证失败'}
    
    # 6. 验证时间戳（如有）
    if seal_data.get('timestamp'):
        if not verify_timestamp(seal_data['timestamp'], sm3_hash(document)):
            return {'valid': False, 'reason': '时间戳验证失败'}
    
    return {
        'valid': True,
        'reason': '验证通过',
        'cert_info': {
            'subject': cert_chain[0].subject,
            'issuer': cert_chain[0].issuer,
            'valid_from': cert_chain[0].not_before,
            'valid_to': cert_chain[0].not_after
        }
    }

# ✅ 正确：使用 ASN.1 DER 编码
from pyasn1.codec.der import encoder
from pyasn1.type import univ

class SES_Signature(univ.Sequence):
    componentType = univ.OrderedDict([
        ('algorithm', univ.ObjectIdentifier()),
        ('signatureValue', univ.OctetString()),
        ('timestamp', univ.OctetString().optional())
    ])

seal_data = SES_Signature()
seal_data['algorithm'] = '1.2.156.10197.1.501'  # SM2WithSM3
seal_data['signatureValue'] = signature_bytes
encoded = encoder.encode(seal_data)

def check_cert_revocation(cert_chain: list) -> bool:
    """
    检查证书吊销状态
    优先使用 OCSP，降级使用 CRL
    """
    # 1. 尝试 OCSP 查询
    try:
        ocsp_url = cert_chain[0].extensions.get_ocsp_url()
        if ocsp_url:
            response = query_ocsp(ocsp_url, cert_chain[0])
            if response.is_good:
                return True
    except Exception:
        pass
    
    # 2. 降级到 CRL 检查
    crl_url = cert_chain[0].extensions.get_crl_url()
    if crl_url:
        crl = fetch_crl(crl_url)
        return not crl.is_revoked(cert_chain[0].serial_number)
    
    # 3. 都无法获取时，记录警告但不拒绝
    log_warning("无法获取证书吊销状态，建议检查网络连接")
    return True

def add_timestamp(seal_info: dict, timestamp_service_url: str) -> dict:
    """
    添加可信时间戳
    符合 GM/T 0033-2023 时间戳接口规范
    """
    # 1. 构造时间戳请求
    request = {
        'version': 1,
        'message_imprint': {
            'hashAlgorithm': '1.2.156.10197.1.401',  # SM3
            'hashedMessage': sm3_hash(seal_info['document'])
        },
        'reqPolicy': '1.2.156.10197.2.1'  # 政务时间戳策略
    }
    
    # 2. 调用时间戳服务
    response = call_timestamp_service(
        url=timestamp_service_url,
        request=request
    )
    
    # 3. 验证时间戳响应
    if not verify_timestamp_response(response):
        raise ValueError("时间戳验证失败")
    
    seal_info['timestamp'] = response
    return seal_info

阶段1：基础对接（1-2周）
├── 选择国密 PDF/OFD SDK
├── 对接密码机接口
└── 实现基本签章/验签功能

阶段2：合规完善（1周）
├── 集成时间戳服务
├── 实现证书吊销检查
└── 完善日志审计

阶段3：优化提升（1周）
├── 批量签章优化
├── 性能调优
└── 异常处理完善