密钥管理类

本章节主要介绍了密钥管理类接口及其扩展接口的功能和相关规格限制。

密钥管理类接口支持如下，接口定义符合GM/T 0018-2023标准，接口参数与返回值可参考标准文档，算法标识描述可参考GM/T 0006-2023。

int SDF_ExportSignPublicKey_ECC(void *hSessionHandle, unsigned int uiKeyIndex, ECCrefPublicKey *pucPublicKey);
int SDF_ExportEncPublicKey_ECC(void *hSessionHandle, unsigned int uiKeyIndex, ECCrefPublicKey *pucPublicKey);
int SDF_GenerateKeyPair_ECC(void *hSessionHandle, unsigned int uiAlgID, unsigned int uiKeyBits, ECCrefPublicKey *pucPublicKey, ECCrefPrivateKey *pucPrivateKey);
int SDF_GenerateKeyWithIPK_ECC(void *hSessionHandle, unsigned int uiIPKIndex, unsigned int uiKeyBits, ECCCipher *pucKey, void **phKeyHandle);
int SDF_GenerateKeyWithEPK_ECC(void *hSessionHandle, unsigned int uiKeyBits, unsigned int uiAlgID, ECCrefPublicKey *pucPublicKey, ECCCipher *pucKey, void **phKeyHandle);
int SDF_ImportKeyWithISK_ECC(void *hSessionHandle, unsigned int uiISKIndex, ECCCipher *pucKey, void **phKeyHandle);
int SDF_ExchangeDigitEnvelopeBaseOnECC(void *hSessionHandle, unsigned int uiKeyIndex, unsigned int uiAlgID, ECCrefPublicKey *pucPublicKey, ECCCipher *pucEncDataIn, ECCCipher *pucEncDataOut);
int SDF_GenerateAgreementDataWithECC(void *hSessionHandle, unsigned int uiISKIndex, unsigned int uiKeyBits, unsigned char *pucSponsorID, unsigned int uiSponsorIDLength, ECCrefPublicKey *pucSponsorPublicKey, ECCrefPublicKey *pucSponsorTmpPublicKey, void **phAgreementHandle);
int SDF_GenerateKeyWithECC(void *hSessionHandle, unsigned char *pucResponseID, unsigned int uiResponseIDLength, ECCrefPublicKey *pucResponsePublicKey, ECCrefPublicKey *pucResponseTmpPublicKey, void *hAgreementHandle, void **phKeyHandle);
int SDF_GenerateAgreementDataAndKeyWithECC(void *hSessionHandle, unsigned int uiISKIndex, unsigned int uiKeyBits, unsigned char *pucResponseID, unsigned int uiResponseIDLength, unsigned char *pucSponsorID, unsigned int uiSponsorIDLength, ECCrefPublicKey *pucSponsorPublicKey, ECCrefPublicKey *pucSponsorTmpPublicKey, ECCrefPublicKey *pucResponsePublicKey, ECCrefPublicKey *pucResponseTmpPublicKey, void **phKeyHandle);
int SDF_GenerateKeyWithKEK(void *hSessionHandle, unsigned int uiKeyBits, unsigned int uiAlgID, unsigned int uiKEKIndex, unsigned char *pucKey, unsigned int *puiKeyLength, void **phKeyHandle);
int SDF_ImportKeyWithKEK(void *hSessionHandle, unsigned int uiAlgID, unsigned int uiKEKIndex, unsigned char *pucKey, unsigned int puiKeyLength, void **phKeyHandle);
int SDF_DestroyKey(void *hSessionHandle, void *hKeyHandle);

规格限制

• SDF_GenerateKeyPair_ECC算法标识目前仅支持：SGD_SM2_3、SGD_SM2_1、SGD_SM2。
• ECC密钥仅支持SM2，因此公钥长度仅支持256bit，即公钥和私钥结构体中的bits值只能为256。
• 生成的会话密钥长度当前仅支持128bit。
• SDF_GenerateKeyWithEPK_ECC算法标识目前仅支持：SGD_SM2_3、SGD_SM2_1。
• ECCCipher结构体密文长度不大于20K。
• 协商密钥长度范围限制为8~128bit，用户ID标识长度限制不大于64字节。
• SDF_ExchangeDigitEnvelopeBaseOnECC算法标识仅支持：SGD_SM2_3。
• 密钥加密密钥索引支持范围：1~2048。密钥加密密钥接口的算法标识仅支持SGD_SM4_CBC、SGD_SM4_ECB。输入密文长度不大于256字节。
• 会话密钥句柄最大个数为300000。
• SDF_DestroyKey会自动释放hKeyHandle，不需要再次释放。

ECB模式为不安全的密码运算，建议使用CBC模式，CBC可以结合MAC保证TLCP协议的完整性以及机密性。