SM2 签名编码格式实战：R+S、DER 与 GB/T 35275-2026 新标准深度解析

import binascii
from gmssl import sm2, func
from gmssl.sm3 import sm3_hash

# 生成私钥（32 字节，64 个十六进制字符）
private_key_hex = func.random_hex(64)
print(f"私钥: {private_key_hex}")

# 计算公钥 P = d × G
# gmssl 的 CryptSM2 内部实现了椭圆曲线点乘
ecc_table = sm2.default_ecc_table

# 创建临时对象用于计算公钥
temp = object.__new__(sm2.CryptSM2)
temp.private_key = private_key_hex
temp.para_len = len(ecc_table['n'])
temp.ecc_table = ecc_table
temp.ecc_a3 = (int(ecc_table['a'], 16) + 3) % int(ecc_table['p'], 16)
temp.public_key = ecc_table['g']

d = int(private_key_hex, 16)
public_key_hex = temp._kg(d, ecc_table['g'])
print(f"公钥: {public_key_hex}")
print(f"公钥长度: {len(public_key_hex) // 2} 字节")

# 创建 CryptSM2 对象（默认 asn1=False，即 R+S 格式）
csm2 = sm2.CryptSM2(
    public_key=public_key_hex,
    private_key=private_key_hex,
    asn1=False  # 默认值，可省略
)

# 准备消息
msg = b"这是一条需要签名的消息"

# 计算 SM3 哈希（gmssl 的 sign 方法需要哈希值，不是原始消息）
msg_hash = sm3_hash([i for i in msg])
print(f"SM3 哈希: {msg_hash}")

# 签名（需要随机数 K）
K = func.random_hex(64)
signature_rs = csm2.sign(bytes.fromhex(msg_hash), K)

print(f"签名(R+S): {signature_rs}")
print(f"签名长度: {len(signature_rs) // 2} 字节")  # 64

# 验签
result = csm2.verify(signature_rs, bytes.fromhex(msg_hash))
print(f"验签结果: {result}")  # True

# 创建 CryptSM2 对象（asn1=True，启用 DER 编码）
csm2_der = sm2.CryptSM2(
    public_key=public_key_hex,
    private_key=private_key_hex,
    asn1=True  # 启用 DER 编码
)

# 使用相同的随机数 K，确保签名内容一致（仅编码不同）
signature_der = csm2_der.sign(bytes.fromhex(msg_hash), K)

print(f"签名(DER, hex): {signature_der}")
print(f"签名长度: {len(bytes.fromhex(signature_der))} 字节")  # 70-72

# DER 格式的验签也用同一个对象
result = csm2_der.verify(signature_der, bytes.fromhex(msg_hash))
print(f"验签结果: {result}")  # True

from gmssl.sm2 import DerSequence, DerInteger

def rs_to_der(r_hex: str, s_hex: str) -> str:
    """
    R+S 格式转 DER 编码
    r_hex, s_hex: 64 字符十六进制字符串（32 字节）
    返回: DER 编码的十六进制字符串
    """
    r = int(r_hex, 16)
    s = int(s_hex, 16)
    seq = DerSequence([DerInteger(r), DerInteger(s)])
    return seq.encode().hex()


def der_to_rs(der_hex: str) -> str:
    """
    DER 编码转 R+S 格式
    der_hex: DER 编码的十六进制字符串
    返回: R+S 格式的十六进制字符串（128 字符，64 字节）
    """
    der_bytes = bytes.fromhex(der_hex)
    seq = DerSequence()
    origin = seq.decode(der_bytes)
    r = origin[0]
    s = origin[1]
    return '%064x%064x' % (r, s)


# === 实际使用 ===
# 从 R+S 提取 R 和 S
r_hex = signature_rs[:64]
s_hex = signature_rs[64:]

# 转换为 DER
signature_der_converted = rs_to_der(r_hex, s_hex)
print(f"R+S -> DER: {signature_der_converted}")

# 转换回 R+S
signature_rs_converted = der_to_rs(signature_der)
print(f"DER -> R+S: {signature_rs_converted}")
print(f"与原签名一致: {signature_rs_converted == signature_rs}")  # True

def analyze_der_signature(der_hex: str) -> dict:
    """
    解析 DER 编码的 SM2 签名，返回详细信息
    """
    der_bytes = bytes.fromhex(der_hex)
    result = {
        'total_length': len(der_bytes),
        'sequence_tag': f'0x{der_bytes[0]:02x}',
    }
    
    offset = 1
    # 解析长度（支持长格式，虽然 SM2 签名长度 < 128 字节）
    if der_bytes[offset] & 0x80:
        length_bytes = der_bytes[offset] & 0x7f
        offset += 1 + length_bytes
    else:
        offset += 1
    
    # 解析 R
    r_tag = der_bytes[offset]
    r_len = der_bytes[offset + 1]
    r_bytes = der_bytes[offset + 2: offset + 2 + r_len]
    r_val = int.from_bytes(r_bytes, 'big')
    result['r_length'] = r_len
    result['r_hex'] = r_bytes.hex()
    result['r_padded'] = r_len == 33  # 是否补了 0x00
    offset += 2 + r_len
    
    # 解析 S
    s_tag = der_bytes[offset]
    s_len = der_bytes[offset + 1]
    s_bytes = der_bytes[offset + 2: offset + 2 + s_len]
    s_val = int.from_bytes(s_bytes, 'big')
    result['s_length'] = s_len
    result['s_hex'] = s_bytes.hex()
    result['s_padded'] = s_len == 33  # 是否补了 0x00
    
    return result


# 使用示例
info = analyze_der_signature(signature_der)
print(f"Total length: {info['total_length']} bytes")
print(f"R: {info['r_hex'][:20]}... (padded: {info['r_padded']})")
print(f"S: {info['s_hex'][:20]}... (padded: {info['s_padded']})")

# mode=0: C1 || C2 || C3（默认，GM/T 0003.4 标准格式）
csm2_mode0 = sm2.CryptSM2(
    public_key=public_key_hex,
    private_key=private_key_hex,
    mode=0
)

csm2_mode1 = sm2.CryptSM2(
    public_key=public_key_hex,
    private_key=private_key_hex,
    mode=1  # C1 || C3 || C2
)

plaintext = b"机密数据：项目代号 Alpha-7"

ct0 = csm2_mode0.encrypt(plaintext)
ct1 = csm2_mode1.encrypt(plaintext)

print(f"mode=0 密文长度: {len(ct0)} 字节")  # C1(65) + C2(N) + C3(32)
print(f"mode=1 密文长度: {len(ct1)} 字节")  # 相同长度，但 C2/C3 顺序不同

# 各自解密
pt0 = csm2_mode0.decrypt(ct0)
pt1 = csm2_mode1.decrypt(ct1)
print(f"mode=0 解密正确: {pt0 == plaintext}")  # True
print(f"mode=1 解密正确: {pt1 == plaintext}")  # True

# ⚠️ mode 必须匹配，否则解密失败
pt_cross = csm2_mode0.decrypt(ct1)
print(f"跨 mode 解密: {pt_cross}")  # 乱码或错误

# ❌ cryptography 不支持 SM2 密钥
from cryptography.hazmat.primitives.asymmetric import ec
# ec.SM2() → 不存在

# ✅ 用 cryptography 做 SM3 哈希
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.hashes import SM3
digest = hashes.Hash(SM3())
digest.update(b"message")
hash_bytes = digest.finalize()

# ✅ 用 gmssl 做 SM2 签名
csm2 = sm2.CryptSM2(public_key=public_key_hex, private_key=private_key_hex)
sig = csm2.sign(hash_bytes, func.random_hex(64))

# Python 端：将 R+S 转为 DER 发给 Java
def sign_for_java(csm2, msg):
    """生成 DER 编码签名，供 Java BouncyCastle 验签"""
    csm2_der = sm2.CryptSM2(
        public_key=csm2.public_key,
        private_key=csm2.private_key,
        asn1=True
    )
    msg_hash = sm3_hash([i for i in msg])
    return csm2_der.sign(bytes.fromhex(msg_hash), func.random_hex(64))


# Python 端：验签 Java 的 DER 编码签名
def verify_from_java(csm2, msg, der_sig_hex):
    """验签 Java BouncyCastle 的 DER 编码签名"""
    msg_hash_bytes = bytes.fromhex(sm3_hash([i for i in msg]))
    csm2_der = sm2.CryptSM2(
        public_key=csm2.public_key,
        private_key=csm2.private_key,
        asn1=True
    )
    return csm2_der.verify(der_sig_hex, msg_hash_bytes)

"""
SM2 签名格式工具类
支持 R+S 和 DER 编码的相互转换、解析和验证
"""
from gmssl import sm2, func
from gmssl.sm2 import DerSequence, DerInteger
from gmssl.sm3 import sm3_hash


class SM2SignatureUtil:
    """SM2 签名格式工具类"""
    
    def __init__(self, public_key_hex: str, private_key_hex: str = None):
        """
        public_key_hex: 公钥（不含 04 前缀）
        private_key_hex: 私钥（可选，有私钥才能签名）
        """
        self.public_key = public_key_hex
        self.private_key = private_key_hex
        self.para_len = 64  # SM2 参数长度（十六进制字符数）
    
    def sign_rs(self, msg: bytes) -> str:
        """R+S 格式签名"""
        csm2 = self._get_csm2(asn1=False)
        msg_hash = sm3_hash([i for i in msg])
        K = func.random_hex(64)
        return csm2.sign(bytes.fromhex(msg_hash), K)
    
    def sign_der(self, msg: bytes) -> str:
        """DER 编码签名"""
        csm2 = self._get_csm2(asn1=True)
        msg_hash = sm3_hash([i for i in msg])
        K = func.random_hex(64)
        return csm2.sign(bytes.fromhex(msg_hash), K)
    
    def verify_rs(self, msg: bytes, sig_hex: str) -> bool:
        """验签 R+S 格式"""
        csm2 = self._get_csm2(asn1=False)
        msg_hash_bytes = bytes.fromhex(sm3_hash([i for i in msg]))
        return csm2.verify(sig_hex, msg_hash_bytes)
    
    def verify_der(self, msg: bytes, sig_hex: str) -> bool:
        """验签 DER 编码"""
        csm2 = self._get_csm2(asn1=True)
        msg_hash_bytes = bytes.fromhex(sm3_hash([i for i in msg]))
        return csm2.verify(sig_hex, msg_hash_bytes)
    
    def rs_to_der(self, sig_rs_hex: str) -> str:
        """R+S 转 DER"""
        r = int(sig_rs_hex[:64], 16)
        s = int(sig_rs_hex[64:], 16)
        seq = DerSequence([DerInteger(r), DerInteger(s)])
        return seq.encode().hex()
    
    def der_to_rs(self, sig_der_hex: str) -> str:
        """DER 转 R+S"""
        der_bytes = bytes.fromhex(sig_der_hex)
        seq = DerSequence()
        origin = seq.decode(der_bytes)
        return '%064x%064x' % (origin[0], origin[1])
    
    def parse_der(self, sig_der_hex: str) -> dict:
        """解析 DER 编码签名"""
        der_bytes = bytes.fromhex(sig_der_hex)
        result = {'total_length': len(der_bytes)}
        
        assert der_bytes[0] == 0x30, "不是有效的 DER SEQUENCE"
        offset = 2  # 跳过 SEQUENCE tag + length（假设长度 < 128）
        
        # 解析 R
        assert der_bytes[offset] == 0x02, "R 不是 INTEGER 类型"
        r_len = der_bytes[offset + 1]
        r_bytes = der_bytes[offset + 2: offset + 2 + r_len]
        result['r'] = r_bytes.hex()
        result['r_padded'] = r_len == 33
        offset += 2 + r_len
        
        # 解析 S
        assert der_bytes[offset] == 0x02, "S 不是 INTEGER 类型"
        s_len = der_bytes[offset + 1]
        s_bytes = der_bytes[offset + 2: offset + 2 + s_len]
        result['s'] = s_bytes.hex()
        result['s_padded'] = s_len == 33
        
        return result
    
    def _get_csm2(self, asn1: bool) -> sm2.CryptSM2:
        kwargs = {
            'public_key': self.public_key,
            'asn1': asn1
        }
        if self.private_key:
            kwargs['private_key'] = self.private_key
        return sm2.CryptSM2(**kwargs)


# === 使用示例 ===
util = SM2SignatureUtil(public_key_hex, private_key_hex)
msg = b"这是一条测试消息"

# R+S 签名
sig_rs = util.sign_rs(msg)
print(f"R+S: {sig_rs[:40]}...")

# DER 签名
sig_der = util.sign_der(msg)
print(f"DER: {sig_der[:40]}...")

# 格式转换：R+S → DER → R+S 往返验证
sig_der_from_rs = util.rs_to_der(sig_rs)
sig_rs_roundtrip = util.der_to_rs(sig_der_from_rs)
assert sig_rs_roundtrip == sig_rs, "R+S → DER → R+S 往返不一致"
print("格式转换往返验证通过: R+S → DER → R+S ✓")

# 格式转换：DER → R+S → DER 往返验证
sig_rs_from_der = util.der_to_rs(sig_der)
sig_der_roundtrip = util.rs_to_der(sig_rs_from_der)
assert sig_der_roundtrip == sig_der, "DER → R+S → DER 往返不一致"
print("格式转换往返验证通过: DER → R+S → DER ✓")

# 解析 DER
info = util.parse_der(sig_der)
print(f"R padded: {info['r_padded']}, S padded: {info['s_padded']}")