Skip to content
Branch: master
Clone or download
Latest commit f32f3f8 May 7, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github/ISSUE_TEMPLATE Update Nov 27, 2018
Configurations Fix Windows build error Mar 12, 2019
VMS Revert "quantum init" Jan 4, 2018
apps Fix sm2utl bugs Feb 2, 2019
certs Revert "quantum init" Jan 4, 2018
crypto fix bug LNK2001 Mar 14, 2019
demos update demos Nov 28, 2018
doc add-docs Mar 13, 2019
engines Update sdf and skf commands Jan 10, 2019
external/perl Merge remote-tracking branch 'origin/master' Feb 14, 2017
fuzz update build system Dec 26, 2017
go Delete mac.go Dec 19, 2018
include Update byteorder.h Mar 7, 2019
java fixed memory leak issue Apr 26, 2019
ms Revert "quantum init" Jan 4, 2018
npapi Add JavaScript API binding with NPAPI Plugin Feb 28, 2019
os-dep Merge remote-tracking branch 'origin/master' Feb 14, 2017
php Bug fix Mar 12, 2018
ssl Remove chinese comments Jan 14, 2019
test Add ECRS module Feb 17, 2019
tools Revert "quantum init" Jan 4, 2018
util Fix Windows build error Mar 12, 2019
.gitignore Update sm2 and zuc Jan 12, 2019
.travis.yml translate Jul 10, 2017 Create Nov 27, 2018
Configure Add some docs Mar 8, 2019
LICENSE Update LICENSE Nov 27, 2018
Makefile.shared Revert "quantum init" Jan 4, 2018 Update sm2 and zuc Jan 12, 2019
appveyor.yml Update appveyor.yml Dec 18, 2018 Merge remote-tracking branch 'origin/master' Feb 14, 2017
config Revert "quantum init" Jan 4, 2018 Merge remote-tracking branch 'origin/master' Feb 14, 2017
e_os.h Revert "quantum init" Jan 4, 2018

About GmSSL

Build Status Build status

GmSSL is an open source cryptographic toolkit that provide first level support of Chinese national cryptographic algorithms and protocols which are specified in the GM/T serial standards. As a branch of the OpenSSL project, GmSSL provides API level compatibility with OpenSSL and maintains all the functionalities. Existing projects such as Apache web server can be easily ported to GmSSL with minor modification and a simple rebuild. Since the first release in late 2014, GmSSL has been selected as one of the six recommended cryptographic projects by Open Source China and the winner of the 2015 Chinese Linux Software Award.


Supported Algorithms

GmSSL will support all the following GM/T cryptographic algorithms:

  • SM3 (GM/T 0004-2012): cryptographic hash function with 256-bit digest length.
  • SM4 (GM/T 0002-2012): block cipher with 128-bit key length and 128-bit block size, also named SMS4.
  • SM2 (GM/T 0003-2012): elliptic curve cryptographic schemes including digital signature scheme, public key encryption, (authenticated) key exchange protocol and one recommended 256-bit prime field curve sm2p256v1.
  • SM9 (GM/T 0044-2016): pairing-based cryptographic schemes including identity-based digital signature, encryption, (authenticated) key exchange protocol and one 256-bit recommended BN curve.
  • ZUC (GM/T 0001-2012): stream cipher, with 128-EEA3 encryption algorithm and 128-EIA3 integrity algorithm.
  • SM1 and SSF33: block ciphers with 128-bit key length and 128-bit block size without public specification, only provided with chip.

GmSSL supports many useful cryptographic algorithms and schemes:

  • Public-key schemes: Paillier, ECIES (Elliptic Curve Integrated Encryption Scheme)
  • Pairing-based cryptography: BF-IBE, BB1-IBE
  • Block ciphers and modes: Serpent, Speck
  • Block cipher modes: FPE (Format-Preserver Encryption)
  • OTP (One-Time Password) based on SM3/SM4 (GM/T 0021-2012)
  • Encoding: Base58

OpenSSL algorithms such as ECDSA, RSA, AES, SHA-1 are all still available in GmSSL.

GM/T Protocols

The GM/T standards cover 2 protocols:

  • SSL VPN Protocol (GM/T 0024-2014)
  • IPSec VPN Protocol (GM/T 0022-2014)

The GM/T 0024-2014 SSL VPN protocol is different from IETF TLS in the follows aspects:

  • Current version of TLS is 1.3 (0x0304) while GM/T SSL version is 1.1 (0x0102).
  • The handshake protocol of GM/T SSL is different from TLS handshake.
  • There is an optional different record protocol in GM/T SSL designed for VPN applications.
  • GM/T SSL has 12 ciphersuites, some of these ciphers do not provide forward secrecy.

GM/T 0024-2014 Ciphersuites:

 1. {0xe0,0x01} GMTLS_SM2DHE_SM2SIGN_WITH_SM1_SM3
 2. {0xe0,0x03} GMTLS_SM2ENC_WITH_SM1_SM3
 3. {0xe0,0x05} GMTLS_SM9DHE_SM9SIGN_WITH_SM1_SM3
 4. {0xe0,0x07} GMTLS_SM9ENC_WITH_SM1_SM3
 5. {0xe0,0x09} GMTLS_RSA_WITH_SM1_SM3
 6. {0xe0,0x0a} GMTLS_RSA_WITH_SM1_SHA1
 7. {0xe0,0x11} GMTLS_SM2DHE_SM2SIGN_WITH_SMS4_SM3
 8. {0xe0,0x13} GMTLS_SM2ENC_WITH_SMS4_SM3
 9. {0xe0,0x15} GMTLS_SM9DHE_SM9SIGN_WITH_SMS4_SM3
10. {0xe0,0x17} GMTLS_SM9ENC_WITH_SMS4_SM3
11. {0xe0,0x19} GMTLS_RSA_WITH_SMS4_SM3
12. {0xe0,0x1a} GMTLS_RSA_WITH_SMS4_SM3

GmSSL supports the standard TLS 1.2 protocol with SM2/SM3/SM4 ciphersuites and the GM/T SSL VPN protocol and ciphersuites. Currently the following ciphersuites are supported:



Except for the native C interface and the gmssl command line, GmSSL also provide the following interfaces:

  • Java: crypto, X.509 and SSL API through JNI (Java Native Interface).
  • Go: crypto, X.509 and SSL API through CGO.
  • SKF C API: GM/T 0016-2012 Smart token cryptography application interface specification.
  • SDF C API: GM/T 0018-2012 Interface specifications of cryptography device application.
  • SAF C API: GM/T 0019-2012 Universal cryptography service interface specification.
  • SOF C/Java API: GM/T 0020-2012 Certificate application integrated service interface specification.

Supported Cryptographic Hardwares

  • USB-Key through the SKF ENGINE and the SKF API.
  • PCI-E card through the SDF ENGINE and the SDF API.
  • GM Instruction sets (SM3/SM4) through the GMI ENGINE.

Quick Start

This short guide describes the build, install and typical usage of the gmssl command line tool. Visit for more documents.

Download (, uncompress it and go to the source code folder. On Linux and OS X, run the following commands:

$ ./config
$ make
$ sudo make install

After installation you can run gmssl version -a to print detailed information.

The gmssl command line tool supports SM2 key generation through ecparam or genpkey option, supports SM2 signing and encryption through pkeyutl option, supports SM3 through sm3 or dgst option, and supports SM4 through sms4 or enc option.

The following are some examples.

SM3 digest generation:

$ echo -n "abc" | gmssl sm3
(stdin)= 66c7f0f462eeedd9d1f2d46bdc10e4e24167c4875cf2f7a2297da02b8f4ba8e0

SM4 encryption and decryption:

$ gmssl sms4 -in -out README.sms4
$ gmssl sms4 -d -in README.sms4

ZUC encryption and decryption:

$ gmssl zuc -in -out README.zuc
$ gmssl zuc -d -in README.zuc

SM2 private key generation:

$ gmssl sm2 -genkey -out skey.pem

Derive the public key from the generated SM2 private key:

$ gmssl sm2 -pubout -in skey.pem -out vkey.pem

SM2 signature generation and verification:

$ gmssl sm2utl -sign -in -inkey skey.pem -out
$ gmssl sm2utl -verify -in -pubin -inkey vkey.pem -sigfile

Generate SM2 encryption key pair and do SM2 public key encyption/decryption. It should be noted pkeyutl -encrypt should only be used to encrypt short messages such as session key and passphrase.

$ gmssl sm2 -genkey -out dkey.pem
$ gmssl sm2 -pubout -in dkey.pem -out ekey.pem
$ echo "Top Secret" | gmssl sm2utl -encrypt -pubin -inkey ekey.pem -out ciphertext.sm2
$ gmssl sm2utl -decrypt -inkey dkey.pem -in ciphertext.sm2

Identity-based encryption with SM9

$ echo "Message" | gmssl pkeyutl -encrypt -pubin -inkey params.pem -pkeyopt id:Alice -out ciphertext.der
$ gmssl pkeyutl -decrypt -inkey sm9key.pem -in ciphertext.der

Self-signed SM2 certificate generation:

$ gmssl req -new -x509 -key skey.pem -out cert.pem
You can’t perform that action at this time.