代码拉取完成，页面将自动刷新
这是基于fabric-v2.2.0修改的支持国密算法的fabric，已通过命令行完成网络部署以及链码操作测试。
版权所有 上海旺链信息科技有限公司(http://www.vonechain.com)。
SM2为基于椭圆曲线密码的公钥密码算法标准，包含数字签名、密钥交换和公钥加密 SM3为密码哈希算法，用于替代MD5 / SHA-1 / SHA-256等国际算法。 SM4为分组密码，用于替代DES / AES等国际算法。 SM2，SM3，SM4现在是公开标准，直接使用苏州同济区块链研究院实现的代码
通过国密SM2加解密、SM3withSM2签名验签，SM3哈希完成国密的改造
对国密算法的支持首先就要通过这个模块进行入手，创建bccsp的gm国密模块，实现思路是，参照sw模块来实现gm模块
(1)新增gmfactory.go，定义GMFactory结构体，增加gm文件夹，与sw类似
bccsp/factory/gmfactory.go
bccsp/gm/certhelper.go
bccsp/gm/conf.go
bccsp/gm/dummyks.go
bccsp/gm/ecdsakey.go
bccsp/gm/fileks.go
bccsp/gm/hash.go
bccsp/gm/impl.go
bccsp/gm/internals.go
bccsp/gm/keyderiv.go
bccsp/gm/keygen.go
bccsp/gm/keyimport.go
bccsp/gm/sm2.go
bccsp/gm/sm2key.go
bccsp/gm/sm4.go
bccsp/gm/sm4key.go
(2)sw是bccsp中的软件实现方案，加入对sm2，sm4的处理，定义相关的结构体，修改清单如下
bccsp/sw/sm2.go //新增
bccsp/sw/sm2key.go //新增
bccsp/sw/sm4.go //新增
bccsp/sw/sm4key.go //新增
bccsp/sw/conf.go
bccsp/sw/ecdsa.go
bccsp/sw/fileks.go
bccsp/sw/impl_test.go
bccsp/sw/keyderiv.go
bccsp/sw/keygen.go
bccsp/sw/keyimport.go
bccsp/sw/new.go
(3)factory是bccsp中的工厂服务，提供密码选项的配置，指定加解密方式，生成特定的服务工厂
bccsp/factory/factory.go
bccsp/factory/factory_test.go
bccsp/factory/nopkcs11.go
bccsp/factory/nopkcs11_test.go
bccsp/factory/opts.go
bccsp/factory/opts_test.go
bccsp/factory/pkcs11.go
(4)utils是bccsp中的工具函数服务，提供一些支持服务，修改清单: 参考文章
bccsp/utils/errs.go
bccsp/utils/io.go
bccsp/utils/keys.go
bccsp/utils/slice.go
(5)新增国密选项
bccsp/hashopts.go
bccsp/opts.go
(6)修改signer包中证书的解析函数
bccsp/signer/signer.go
idemix包中的修改需要把所有ecdsa算法改为sm2算法，修改的文件清单如下：
bccsp/idemix/bridge/bridge_test.go
bccsp/idemix/bridge/revocation.go
bccsp/idemix/bridge/signaturescheme.go
bccsp/idemix/handlers/idemix.go
bccsp/idemix/handlers/mock/revocation.go
bccsp/idemix/handlers/mock/signature_scheme.go
bccsp/idemix/handlers/revocation.go
bccsp/idemix/handlers/revocation_test.go
主要修改crypto包里面的ca.go和key.go，tools包作相应调整和适配
(1)core包：大部分核心实现代码都在本包下，其他包的代码封装上层接口，最终调用本包内代码
core/chaincode/accesscontrol/mapper.go
core/chaincode/lifecycle/serializer.go
core/deliverservice/config.go
core/deliverservice/deliveryclient.go
core/endorser/msgvalidation.go
core/operations/system.go
core/operations/tls.go
core/peer/config.go
(2)gossip包：实现gossip协议
gossip/api/crypto.go
gossip/comm/comm_impl.go
gossip/comm/crypto.go
gossip/comm/crypto_test.go
gossip/util/grpc.go
idemix/revocation_authority.go
idemix/signature.go
(3)msp包：Member Service Provider包
msp/cert.go
msp/cert_test.go
msp/configbuilder.go
msp/identities.go
msp/mgmt/mgmt.go //主要文件，localMsp和mspMap都在这个文件，还有多个管理函数
msp/mgmt/testtools/config_test.go
msp/mspimpl.go //实现MSP接口，结构为bccspmsp
msp/mspimplsetup.go
msp/mspimplsetup_test.go
msp/mspimplvalidate.go
(4)order包：order服务相关的入口和框架代码
orderer/common/cluster/comm.go
orderer/common/cluster/comm_test.go
orderer/common/cluster/connections.go
orderer/common/cluster/deliver.go
orderer/common/cluster/rpc_test.go
orderer/common/cluster/util.go
orderer/common/cluster/util_test.go
orderer/consensus/etcdraft/membership.go
orderer/consensus/etcdraft/util.go
orderer/consensus/kafka/config.go
protoutil/txutils.go
(1)证书相关的结构体的修改，增加sm2证书和sm2私钥
type CA struct {
Name string
Country string
Province string
Locality string
OrganizationalUnit string
StreetAddress string
PostalCode string
Signer crypto.Signer
SignCert *x509.Certificate
SignSm2Cert *sm2.Certificate //sm2证书
Sm2Key *sm2.PrivateKey //sm2私钥
}
(2)证书生成的函数修改，指定证书的签名方式和计算私钥的SKI
func NewCA(
baseDir,
org,
name,
country,
province,
locality,
orgUnit,
streetAddress,
postalCode string,
) (*CA, error) {
var ca *CA
err := os.MkdirAll(baseDir, 0755)
if err != nil {
return nil, err
}
priv, err := csp.GeneratePrivateKey(baseDir)
if err != nil {
return nil, err
}
template := x509Template()
//this is a CA
template.IsCA = true
template.KeyUsage |= x509.KeyUsageDigitalSignature |
x509.KeyUsageKeyEncipherment | x509.KeyUsageCertSign |
x509.KeyUsageCRLSign
template.ExtKeyUsage = []x509.ExtKeyUsage{
x509.ExtKeyUsageClientAuth,
x509.ExtKeyUsageServerAuth,
}
//set the organization for the subject
subject := subjectTemplateAdditional(country, province, locality, orgUnit, streetAddress, postalCode)
subject.Organization = []string{org}
subject.CommonName = name
template.Subject = subject
templateSm2 := gm.ParseX509Certificate2Sm2(&template)
//TODO important
templateSm2.SubjectKeyId = computeSKI(priv) //指定证书的SKI
sm2PubKey := priv.PublicKey
if err != nil {
errors.Errorf("error,%v", err)
}
templateSm2.SignatureAlgorithm = sm2.SM2WithSM3 //指定证书的签名算法
sm2Cert, err := genCertificateGMSM2(
baseDir,
name,
templateSm2,
templateSm2,
&sm2PubKey,
priv,
)
if err != nil {
return nil, err
}
ca = &CA{
Name: name,
Signer: priv,
Country: country,
Province: province,
Locality: locality,
OrganizationalUnit: orgUnit,
StreetAddress: streetAddress,
PostalCode: postalCode,
SignSm2Cert: sm2Cert,
Sm2Key: priv,
}
return ca, err
}
//定义sm2私钥的ski计算函数
func computeSKI(privKey *sm2.PrivateKey) []byte {
// Marshall the public key
raw := elliptic.Marshal(privKey.Curve, privKey.PublicKey.X, privKey.PublicKey.Y)
// Hash it
hash := sha256.New()
hash.Write(raw)
return hash.Sum(nil)
}
(3)sm2私钥生成
//TODO SM2
func GeneratePrivateKey(keystorePath string) (*sm2.PrivateKey, error) {
priv, err := sm2.GenerateKey()
if err != nil {
return nil, errors.WithMessage(err, "failed to generate private key")
}
pkcs8Encoded, err := sm2.MarshalSm2PrivateKey(priv,nil) //解析sm2证书方式
if err != nil {
return nil, errors.WithMessage(err, "failed to marshal private key")
}
pemEncoded := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: pkcs8Encoded})
keyFile := filepath.Join(keystorePath, "priv_sk")
err = ioutil.WriteFile(keyFile, pemEncoded, 0600)
if err != nil {
return nil, errors.WithMessagef(err, "failed to save private key to file %s", keyFile)
}
return priv, err
}
进入你克隆到本地的fabric仓库的根目录
go mod vendor
cd vendor/github.com/tjfoc/gmtls //暂时如此操作,防止后面的问题
go mod vendor
make docker //回到克隆到本地的fabric仓库的根目录
1.出现的问题
remote error: tls: unexpected message
解决办法
cd vendor/github.com/tjfoc/gmtls
go mod vendor
2.出现的问题：找不到rootca的证书链
解决办法
templateSm2.SubjectKeyId = computeSKI(priv) //指定证书的SKI
3.出现的问题：验证签名失败
解决办法
templateSm2.SignatureAlgorithm = sm2.SM2WithSM3 //指定证书的签名算法
docker-compose -f docker-compose-cli.yaml -f docker-compose-etcdraft2.yaml -f docker-compose-ca.yaml up -d
此处可能存在不合适展示的内容，页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容，可点击提交进行申诉，我们将尽快为您处理。
马建仓 AI 助手
