pkcs7: polish, improve maintainability

docs/sm2.md

@@ -24,6 +24,12 @@ SM2既然是椭圆曲线公钥密码算法，它就和NIST P系列椭圆曲线
 **注**：最新的阿里KMS支持ECIES，难道客户有这个需求？
 ECIES_DH_SHA_1_XOR_HMAC：遵循[SEC 1: Elliptic Curve Cryptography, Version 2.0](https://www.secg.org/sec1-v2.pdf)标准，密钥协商算法采用ECDH，密钥派生算法采用 KDF2 with SHA-1，MAC算法采用HMAC-SHA-1，对称加密算法采用XOR。
 
+**业界对RSA非对称加密的安全性担忧与日俱增**：  
+* [The Marvin Attack](https://people.redhat.com/~hkario/marvin/)
+* [CVE-2023-45287 Detail](https://nvd.nist.gov/vuln/detail/CVE-2023-45287)
+* [Vulnerability Report: GO-2023-2375](https://pkg.go.dev/vuln/GO-2023-2375)
+* [Seriously, stop using RSA](https://blog.trailofbits.com/2019/07/08/fuck-rsa/)
+
 ## SM2公私钥对
 SM2公私钥对的话，要么是自己产生，要么是别的系统产生后通过某种方式传输给您的。
 

pkcs/cipher.go

@@ -115,7 +115,7 @@ func (c *cbcBlockCipher) Encrypt(key, plaintext []byte) (*pkix.AlgorithmIdentifi
 	if err != nil {
 		return nil, nil, err
 	}
-	ciphertext, err := cbcEncrypt(block, key, iv, plaintext)
+	ciphertext, err := cbcEncrypt(block, iv, plaintext)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -144,10 +144,10 @@ func (c *cbcBlockCipher) Decrypt(key []byte, parameters *asn1.RawValue, encrypte
 		return nil, errors.New("pkcs: invalid cipher parameters")
 	}
 
-	return cbcDecrypt(block, key, iv, encryptedKey)
+	return cbcDecrypt(block, iv, encryptedKey)
 }
 
-func cbcEncrypt(block cipher.Block, key, iv, plaintext []byte) ([]byte, error) {
+func cbcEncrypt(block cipher.Block, iv, plaintext []byte) ([]byte, error) {
 	mode := cipher.NewCBCEncrypter(block, iv)
 	pkcs7 := padding.NewPKCS7Padding(uint(block.BlockSize()))
 	plainText := pkcs7.Pad(plaintext)
@@ -156,7 +156,7 @@ func cbcEncrypt(block cipher.Block, key, iv, plaintext []byte) ([]byte, error) {
 	return ciphertext, nil
 }
 
-func cbcDecrypt(block cipher.Block, key, iv, ciphertext []byte) ([]byte, error) {
+func cbcDecrypt(block cipher.Block, iv, ciphertext []byte) ([]byte, error) {
 	mode := cipher.NewCBCDecrypter(block, iv)
 	pkcs7 := padding.NewPKCS7Padding(uint(block.BlockSize()))
 	plaintext := make([]byte, len(ciphertext))

pkcs7/encrypt.go

@@ -1,187 +1,35 @@
 package pkcs7
 
 import (
-	"crypto/ecdsa"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509/pkix"
 	"encoding/asn1"
 	"errors"
 
 	"github.com/emmansun/gmsm/pkcs"
-	"github.com/emmansun/gmsm/sm2"
-	"github.com/emmansun/gmsm/smx509"
 )
 
-type envelopedData struct {
-	Version              int
-	RecipientInfos       []recipientInfo `asn1:"set"`
-	EncryptedContentInfo encryptedContentInfo
-}
-
 type encryptedData struct {
 	Version              int
 	EncryptedContentInfo encryptedContentInfo
 }
 
-type recipientInfo struct {
-	Version                int
-	IssuerAndSerialNumber  issuerAndSerial
-	KeyEncryptionAlgorithm pkix.AlgorithmIdentifier
-	EncryptedKey           []byte
-}
-
-type encryptedContentInfo struct {
-	ContentType                asn1.ObjectIdentifier
-	ContentEncryptionAlgorithm pkix.AlgorithmIdentifier
-	EncryptedContent           asn1.RawValue `asn1:"tag:0,optional"`
-}
-
-func (data envelopedData) GetRecipient(cert *smx509.Certificate) *recipientInfo {
-	for _, recp := range data.RecipientInfos {
-		if isCertMatchForIssuerAndSerial(cert, recp.IssuerAndSerialNumber) {
-			return &recp
-		}
-	}
-	return nil
-}
-
-func (data envelopedData) GetEncryptedContentInfo() *encryptedContentInfo {
-	return &data.EncryptedContentInfo
-}
-
-// ErrUnsupportedEncryptionAlgorithm is returned when attempting to encrypt
-// content with an unsupported algorithm.
-var ErrUnsupportedEncryptionAlgorithm = errors.New("pkcs7: cannot encrypt content: only DES-CBC, AES-CBC, AES-GCM, SM4-CBC and SM4-GCM supported")
-
 // ErrPSKNotProvided is returned when attempting to encrypt
 // using a PSK without actually providing the PSK.
 var ErrPSKNotProvided = errors.New("pkcs7: cannot encrypt content: PSK not provided")
 
-// Encrypt creates and returns an envelope data PKCS7 structure with encrypted
-// recipient keys for each recipient public key.
-//
-// # The algorithm used to perform encryption is determined by the argument cipher
-//
-// TODO(fullsailor): Add support for encrypting content with other algorithms
-func Encrypt(cipher pkcs.Cipher, content []byte, recipients []*smx509.Certificate) ([]byte, error) {
-	return encrypt(cipher, content, recipients, false, false)
-}
-
-// EncryptSM creates and returns an envelope data PKCS7 structure with encrypted
-// recipient keys for each recipient public key.
-// The OIDs use GM/T 0010 - 2012 set and the encrypted key use ASN.1 format.
-//
-// The algorithm used to perform encryption is determined by the argument cipher
-func EncryptSM(cipher pkcs.Cipher, content []byte, recipients []*smx509.Certificate) ([]byte, error) {
-	return encrypt(cipher, content, recipients, true, false)
-}
-
-// EncryptCFCA creates and returns an envelope data PKCS7 structure with encrypted
-// recipient keys for each recipient public key.
-// The OIDs use GM/T 0010 - 2012 set and the encrypted key use C1C2C3 format and without 0x4 prefix.
-//
-// The algorithm used to perform encryption is determined by the argument cipher
-func EncryptCFCA(cipher pkcs.Cipher, content []byte, recipients []*smx509.Certificate) ([]byte, error) {
-	return encrypt(cipher, content, recipients, true, true)
-}
-
-func encrypt(cipher pkcs.Cipher, content []byte, recipients []*smx509.Certificate, isSM, isCFCA bool) ([]byte, error) {
-	var key []byte
-	var err error
-
-	// Create key
-	key = make([]byte, cipher.KeySize())
-	_, err = rand.Read(key)
-	if err != nil {
-		return nil, err
-	}
-
-	id, ciphertext, err := cipher.Encrypt(key, content)
-	if err != nil {
-		return nil, err
-	}
-
-	envelope := envelopedData{
-		Version: 0,
-		EncryptedContentInfo: encryptedContentInfo{
-			ContentType:                OIDData,
-			ContentEncryptionAlgorithm: *id,
-			EncryptedContent:           marshalEncryptedContent(ciphertext),
-		},
-	}
-
-	if isSM {
-		envelope.Version = 1 // follow GB/T 35275-2017 9.1
-		envelope.EncryptedContentInfo.ContentType = SM2OIDData
-	}
-
-	// Prepare each recipient's encrypted cipher key
-	recipientInfos := make([]recipientInfo, len(recipients))
-	for i, recipient := range recipients {
-		encrypted, err := encryptKey(key, recipient, isCFCA)
-		if err != nil {
-			return nil, err
-		}
-		ias, err := cert2issuerAndSerial(recipient)
-		if err != nil {
-			return nil, err
-		}
-		var keyEncryptionAlgorithm asn1.ObjectIdentifier = OIDEncryptionAlgorithmRSA
-		if recipient.SignatureAlgorithm == smx509.SM2WithSM3 {
-			keyEncryptionAlgorithm = OIDKeyEncryptionAlgorithmSM2
-		} else if isSM {
-			return nil, errors.New("pkcs7: Shangmi does not support RSA")
-		}
-
-		info := recipientInfo{
-			Version:               0,
-			IssuerAndSerialNumber: ias,
-			KeyEncryptionAlgorithm: pkix.AlgorithmIdentifier{
-				Algorithm: keyEncryptionAlgorithm,
-			},
-			EncryptedKey: encrypted,
-		}
-		if isSM {
-			info.Version = 1 // follow GB/T 35275-2017 9.1
-		}
-		recipientInfos[i] = info
-	}
-
-	envelope.RecipientInfos = recipientInfos
-
-	innerContent, err := asn1.Marshal(envelope)
-	if err != nil {
-		return nil, err
-	}
-
-	// Prepare outer payload structure
-	wrapper := contentInfo{
-		ContentType: OIDEnvelopedData,
-		Content:     asn1.RawValue{Class: asn1.ClassContextSpecific, Tag: 0, IsCompound: true, Bytes: innerContent},
-	}
-
-	if isSM {
-		wrapper.ContentType = SM2OIDEnvelopedData
-	}
-
-	return asn1.Marshal(wrapper)
-}
-
 // EncryptUsingPSK creates and returns an encrypted data PKCS7 structure,
 // encrypted using caller provided pre-shared secret.
 func EncryptUsingPSK(cipher pkcs.Cipher, content []byte, key []byte) ([]byte, error) {
-	return encryptUsingPSK(false, cipher, content, key)
+	return encryptUsingPSK(cipher, content, key, []asn1.ObjectIdentifier{OIDData, OIDEncryptedData}, 0)
 }
 
 // EncryptSMUsingPSK creates and returns an encrypted data PKCS7 structure,
 // encrypted using caller provided pre-shared secret.
 // This method uses China Standard OID
 func EncryptSMUsingPSK(cipher pkcs.Cipher, content []byte, key []byte) ([]byte, error) {
-	return encryptUsingPSK(true, cipher, content, key)
+	return encryptUsingPSK(cipher, content, key, []asn1.ObjectIdentifier{SM2OIDData, SM2OIDEncryptedData}, 1)
 }
 
-func encryptUsingPSK(isSM bool, cipher pkcs.Cipher, content []byte, key []byte) ([]byte, error) {
+func encryptUsingPSK(cipher pkcs.Cipher, content []byte, key []byte, contentTypes []asn1.ObjectIdentifier, version int) ([]byte, error) {
 	var err error
 
 	if key == nil {
@@ -195,16 +43,8 @@ func encryptUsingPSK(isSM bool, cipher pkcs.Cipher, content []byte, key []byte)
 
 	// Prepare encrypted-data content
 	ed := encryptedData{
-		Version: 0,
-		EncryptedContentInfo: encryptedContentInfo{
-			ContentType:                OIDData,
-			ContentEncryptionAlgorithm: *id,
-			EncryptedContent:           marshalEncryptedContent(ciphertext),
-		},
-	}
-	if isSM {
-		ed.Version = 1 // follow GB/T 35275-2017 9.1
-		ed.EncryptedContentInfo.ContentType = SM2OIDData
+		Version:              version,
+		EncryptedContentInfo: newEncryptedContent(contentTypes[0], id, marshalEncryptedContent(ciphertext)),
 	}
 
 	innerContent, err := asn1.Marshal(ed)
@@ -212,38 +52,11 @@ func encryptUsingPSK(isSM bool, cipher pkcs.Cipher, content []byte, key []byte)
 		return nil, err
 	}
 
-	var contentType asn1.ObjectIdentifier = OIDEncryptedData
-	if isSM {
-		contentType = SM2OIDEncryptedData
-	}
 	// Prepare outer payload structure
 	wrapper := contentInfo{
-		ContentType: contentType,
+		ContentType: contentTypes[1],
 		Content:     asn1.RawValue{Class: asn1.ClassContextSpecific, Tag: 0, IsCompound: true, Bytes: innerContent},
 	}
 
 	return asn1.Marshal(wrapper)
 }
-
-func marshalEncryptedContent(content []byte) asn1.RawValue {
-	asn1Content, _ := asn1.Marshal(content)
-	return asn1.RawValue{Tag: 0, Class: asn1.ClassContextSpecific, Bytes: asn1Content, IsCompound: true}
-}
-
-func encryptKey(key []byte, recipient *smx509.Certificate, isCFCA bool) ([]byte, error) {
-	if pub, ok := recipient.PublicKey.(*rsa.PublicKey); ok {
-		return rsa.EncryptPKCS1v15(rand.Reader, pub, key)
-	}
-	if pub, ok := recipient.PublicKey.(*ecdsa.PublicKey); ok && pub.Curve == sm2.P256() {
-		if isCFCA {
-			encryptedKey, err := sm2.Encrypt(rand.Reader, pub, key, sm2.NewPlainEncrypterOpts(sm2.MarshalUncompressed, sm2.C1C2C3))
-			if err != nil {
-				return nil, err
-			}
-			return encryptedKey[1:], nil
-		} else {
-			return sm2.EncryptASN1(rand.Reader, pub, key)
-		}
-	}
-	return nil, errors.New("pkcs7: only supports RSA/SM2 key")
-}

pkcs7/encrypt_test.go

@@ -2,131 +2,11 @@ package pkcs7
 
 import (
 	"bytes"
-	"crypto/x509"
-	"encoding/pem"
-	"os"
 	"testing"
 
 	"github.com/emmansun/gmsm/pkcs"
-	"github.com/emmansun/gmsm/smx509"
 )
 
-func TestEncrypt(t *testing.T) {
-	ciphers := []pkcs.Cipher{
-		pkcs.DESCBC,
-		pkcs.TripleDESCBC,
-		pkcs.SM4CBC,
-		pkcs.SM4GCM,
-		pkcs.AES128CBC,
-		pkcs.AES192CBC,
-		pkcs.AES256CBC,
-		pkcs.AES128GCM,
-		pkcs.AES192GCM,
-		pkcs.AES256GCM,
-	}
-	sigalgs := []x509.SignatureAlgorithm{
-		x509.SHA1WithRSA,
-		x509.SHA256WithRSA,
-		x509.SHA512WithRSA,
-		smx509.SM2WithSM3,
-	}
-	for _, cipher := range ciphers {
-		for _, sigalg := range sigalgs {
-			plaintext := []byte("Hello Secret World!")
-			cert, err := createTestCertificate(sigalg)
-			if err != nil {
-				t.Fatal(err)
-			}
-			encrypted, err := Encrypt(cipher, plaintext, []*smx509.Certificate{cert.Certificate})
-			if err != nil {
-				t.Fatal(err)
-			}
-			p7, err := Parse(encrypted)
-			if err != nil {
-				t.Fatalf("cannot Parse encrypted result: %s", err)
-			}
-			result, err := p7.Decrypt(cert.Certificate, *cert.PrivateKey)
-			if err != nil {
-				t.Fatalf("cannot Decrypt encrypted result: %s", err)
-			}
-			if !bytes.Equal(plaintext, result) {
-				t.Errorf("encrypted data does not match plaintext:\n\tExpected: %s\n\tActual: %s", plaintext, result)
-			}
-		}
-	}
-}
-
-func TestEncryptSM(t *testing.T) {
-	ciphers := []pkcs.Cipher{
-		pkcs.SM4CBC,
-		pkcs.SM4GCM,
-	}
-	sigalgs := []x509.SignatureAlgorithm{
-		smx509.SM2WithSM3,
-	}
-	for _, cipher := range ciphers {
-		for _, sigalg := range sigalgs {
-			plaintext := []byte("Hello Secret World!")
-			cert, err := createTestCertificate(sigalg)
-			if err != nil {
-				t.Fatal(err)
-			}
-			encrypted, err := EncryptSM(cipher, plaintext, []*smx509.Certificate{cert.Certificate})
-			if err != nil {
-				t.Fatal(err)
-			}
-			pem.Encode(os.Stdout, &pem.Block{Type: "PKCS7", Bytes: encrypted})
-			p7, err := Parse(encrypted)
-			if err != nil {
-				t.Fatalf("cannot Parse encrypted result: %s", err)
-			}
-			result, err := p7.Decrypt(cert.Certificate, *cert.PrivateKey)
-			if err != nil {
-				t.Fatalf("cannot Decrypt encrypted result: %s", err)
-			}
-			if !bytes.Equal(plaintext, result) {
-				t.Errorf("encrypted data does not match plaintext:\n\tExpected: %s\n\tActual: %s", plaintext, result)
-			}
-		}
-	}
-}
-
-func TestEncryptCFCA(t *testing.T) {
-	ciphers := []pkcs.Cipher{
-		pkcs.SM4,
-		pkcs.SM4CBC,
-		pkcs.SM4GCM,
-	}
-	sigalgs := []x509.SignatureAlgorithm{
-		smx509.SM2WithSM3,
-	}
-	for _, cipher := range ciphers {
-		for _, sigalg := range sigalgs {
-			plaintext := []byte("Hello Secret World!")
-			cert, err := createTestCertificate(sigalg)
-			if err != nil {
-				t.Fatal(err)
-			}
-			encrypted, err := EncryptCFCA(cipher, plaintext, []*smx509.Certificate{cert.Certificate})
-			if err != nil {
-				t.Fatal(err)
-			}
-			pem.Encode(os.Stdout, &pem.Block{Type: "PKCS7", Bytes: encrypted})
-			p7, err := Parse(encrypted)
-			if err != nil {
-				t.Fatalf("cannot Parse encrypted result: %s", err)
-			}
-			result, err := p7.DecryptCFCA(cert.Certificate, *cert.PrivateKey)
-			if err != nil {
-				t.Fatalf("cannot Decrypt encrypted result: %s", err)
-			}
-			if !bytes.Equal(plaintext, result) {
-				t.Errorf("encrypted data does not match plaintext:\n\tExpected: %s\n\tActual: %s", plaintext, result)
-			}
-		}
-	}
-}
-
 func TestEncryptUsingPSK(t *testing.T) {
 	ciphers := []pkcs.Cipher{
 		pkcs.DESCBC,

pkcs7/envelope.go

@@ -0,0 +1,237 @@
+package pkcs7
+
+import (
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"errors"
+
+	"github.com/emmansun/gmsm/pkcs"
+	"github.com/emmansun/gmsm/sm2"
+	"github.com/emmansun/gmsm/smx509"
+)
+
+type EnvelopedData struct {
+	ed                   envelopedData
+	key                  []byte
+	contentType          asn1.ObjectIdentifier
+	encryptedContentType asn1.ObjectIdentifier
+}
+
+type envelopedData struct {
+	Version              int
+	RecipientInfos       []recipientInfo `asn1:"set"`
+	EncryptedContentInfo encryptedContentInfo
+}
+
+type recipientInfo struct {
+	Version                int
+	IssuerAndSerialNumber  issuerAndSerial
+	KeyEncryptionAlgorithm pkix.AlgorithmIdentifier
+	EncryptedKey           []byte
+}
+
+type encryptedContentInfo struct {
+	ContentType                asn1.ObjectIdentifier
+	ContentEncryptionAlgorithm pkix.AlgorithmIdentifier
+	EncryptedContent           asn1.RawValue `asn1:"tag:0,optional"`
+}
+
+func (data envelopedData) GetRecipient(cert *smx509.Certificate) *recipientInfo {
+	for _, recp := range data.RecipientInfos {
+		if isCertMatchForIssuerAndSerial(cert, recp.IssuerAndSerialNumber) {
+			return &recp
+		}
+	}
+	return nil
+}
+
+func (data envelopedData) GetEncryptedContentInfo() *encryptedContentInfo {
+	return &data.EncryptedContentInfo
+}
+
+// ErrUnsupportedEncryptionAlgorithm is returned when attempting to encrypt
+// content with an unsupported algorithm.
+var ErrUnsupportedEncryptionAlgorithm = errors.New("pkcs7: cannot encrypt content: only DES-CBC, AES-CBC, AES-GCM, SM4-CBC and SM4-GCM supported")
+
+// Encrypt creates and returns an envelope data PKCS7 structure with encrypted
+// recipient keys for each recipient public key.
+//
+// # The algorithm used to perform encryption is determined by the argument cipher
+//
+// TODO(fullsailor): Add support for encrypting content with other algorithms
+func Encrypt(cipher pkcs.Cipher, content []byte, recipients []*smx509.Certificate) ([]byte, error) {
+	ed, err := NewEnvelopedData(cipher, content)
+	if err != nil {
+		return nil, err
+	}
+	for _, recipient := range recipients {
+		if err := ed.AddRecipient(recipient, 0, func(cert *smx509.Certificate, key []byte) ([]byte, error) {
+			return encryptKey(key, cert, false)
+		}); err != nil {
+			return nil, err
+		}
+	}
+	return ed.Finish()
+}
+
+// EncryptSM creates and returns an envelope data PKCS7 structure with encrypted
+// recipient keys for each recipient public key.
+// The OIDs use GM/T 0010 - 2012 set and the encrypted key use ASN.1 format.
+//
+// The algorithm used to perform encryption is determined by the argument cipher
+func EncryptSM(cipher pkcs.Cipher, content []byte, recipients []*smx509.Certificate) ([]byte, error) {
+	return encryptSM(cipher, content, recipients, false)
+}
+
+// EncryptCFCA creates and returns an envelope data PKCS7 structure with encrypted
+// recipient keys for each recipient public key.
+// The OIDs use GM/T 0010 - 2012 set and the encrypted key use C1C2C3 format and without 0x4 prefix.
+//
+// The algorithm used to perform encryption is determined by the argument cipher
+func EncryptCFCA(cipher pkcs.Cipher, content []byte, recipients []*smx509.Certificate) ([]byte, error) {
+	return encryptSM(cipher, content, recipients, true)
+}
+
+func encryptSM(cipher pkcs.Cipher, content []byte, recipients []*smx509.Certificate, isLegacyCFCA bool) ([]byte, error) {
+	ed, err := NewSM2EnvelopedData(cipher, content)
+	if err != nil {
+		return nil, err
+	}
+	for _, recipient := range recipients {
+		if err := ed.AddRecipient(recipient, 1, func(cert *smx509.Certificate, key []byte) ([]byte, error) {
+			return encryptKey(key, cert, isLegacyCFCA)
+		}); err != nil {
+			return nil, err
+		}
+	}
+	return ed.Finish()
+}
+
+// NewEnvelopedData creates a new EnvelopedData structure with the provided cipher and content.
+func NewEnvelopedData(cipher pkcs.Cipher, content []byte) (*EnvelopedData, error) {
+	var key []byte
+	var err error
+
+	// Create key
+	key = make([]byte, cipher.KeySize())
+	if _, err = rand.Read(key); err != nil {
+		return nil, err
+	}
+
+	id, ciphertext, err := cipher.Encrypt(key, content)
+	if err != nil {
+		return nil, err
+	}
+	ed := &EnvelopedData{}
+	ed.contentType = OIDEnvelopedData
+	ed.encryptedContentType = OIDData
+	ed.key = key
+	ed.ed = envelopedData{
+		Version:              0,
+		EncryptedContentInfo: newEncryptedContent(ed.encryptedContentType, id, marshalEncryptedContent(ciphertext)),
+	}
+	return ed, nil
+}
+
+// NewSM2EnvelopedData creates a new EnvelopedData structure with the provided cipher and content.
+// The OIDs use GM/T 0010 - 2012 set.
+func NewSM2EnvelopedData(cipher pkcs.Cipher, content []byte) (*EnvelopedData, error) {
+	var key []byte
+	var err error
+
+	// Create key
+	key = make([]byte, cipher.KeySize())
+	if _, err = rand.Read(key); err != nil {
+		return nil, err
+	}
+
+	id, ciphertext, err := cipher.Encrypt(key, content)
+	if err != nil {
+		return nil, err
+	}
+	ed := &EnvelopedData{}
+	ed.contentType = SM2OIDEnvelopedData
+	ed.encryptedContentType = SM2OIDData
+	ed.key = key
+	ed.ed = envelopedData{
+		Version:              1,
+		EncryptedContentInfo: newEncryptedContent(ed.encryptedContentType, id, marshalEncryptedContent(ciphertext)),
+	}
+	return ed, nil
+}
+
+// AddRecipient adds a recipient to the EnvelopedData structure.
+func (ed *EnvelopedData) AddRecipient(cert *smx509.Certificate, version int, encryptKeyFunc func(cert *smx509.Certificate, key []byte) ([]byte, error)) error {
+	encrypted, err := encryptKeyFunc(cert, ed.key)
+	if err != nil {
+		return err
+	}
+	ias, err := cert2issuerAndSerial(cert)
+	if err != nil {
+		return err
+	}
+	var keyEncryptionAlgorithm asn1.ObjectIdentifier = OIDEncryptionAlgorithmRSA
+	if cert.SignatureAlgorithm == smx509.SM2WithSM3 {
+		keyEncryptionAlgorithm = OIDKeyEncryptionAlgorithmSM2
+	}
+
+	info := recipientInfo{
+		Version:               version,
+		IssuerAndSerialNumber: ias,
+		KeyEncryptionAlgorithm: pkix.AlgorithmIdentifier{
+			Algorithm: keyEncryptionAlgorithm,
+		},
+		EncryptedKey: encrypted,
+	}
+	ed.ed.RecipientInfos = append(ed.ed.RecipientInfos, info)
+	return nil
+}
+
+// Finish creates the final PKCS7 structure.
+func (ed *EnvelopedData) Finish() ([]byte, error) {
+	innerContent, err := asn1.Marshal(ed.ed)
+	if err != nil {
+		return nil, err
+	}
+
+	// Prepare outer payload structure
+	wrapper := contentInfo{
+		ContentType: ed.contentType,
+		Content:     asn1.RawValue{Class: asn1.ClassContextSpecific, Tag: 0, IsCompound: true, Bytes: innerContent},
+	}
+	return asn1.Marshal(wrapper)
+}
+
+func newEncryptedContent(contentType asn1.ObjectIdentifier, alg *pkix.AlgorithmIdentifier, ciphertext asn1.RawValue) encryptedContentInfo {
+	return encryptedContentInfo{
+		ContentType:                contentType,
+		ContentEncryptionAlgorithm: *alg,
+		EncryptedContent:           ciphertext,
+	}
+}
+
+func marshalEncryptedContent(content []byte) asn1.RawValue {
+	asn1Content, _ := asn1.Marshal(content)
+	return asn1.RawValue{Tag: 0, Class: asn1.ClassContextSpecific, Bytes: asn1Content, IsCompound: true}
+}
+
+func encryptKey(key []byte, recipient *smx509.Certificate, isCFCA bool) ([]byte, error) {
+	if pub, ok := recipient.PublicKey.(*rsa.PublicKey); ok {
+		return rsa.EncryptPKCS1v15(rand.Reader, pub, key)
+	}
+	if pub, ok := recipient.PublicKey.(*ecdsa.PublicKey); ok && pub.Curve == sm2.P256() {
+		if isCFCA {
+			encryptedKey, err := sm2.Encrypt(rand.Reader, pub, key, sm2.NewPlainEncrypterOpts(sm2.MarshalUncompressed, sm2.C1C2C3))
+			if err != nil {
+				return nil, err
+			}
+			return encryptedKey[1:], nil
+		} else {
+			return sm2.EncryptASN1(rand.Reader, pub, key)
+		}
+	}
+	return nil, errors.New("pkcs7: only supports RSA/SM2 key")
+}

pkcs7/envelope_test.go

@@ -0,0 +1,128 @@
+package pkcs7
+
+import (
+	"bytes"
+	"crypto/x509"
+	"encoding/pem"
+	"os"
+	"testing"
+
+	"github.com/emmansun/gmsm/pkcs"
+	"github.com/emmansun/gmsm/smx509"
+)
+
+func TestEncrypt(t *testing.T) {
+	ciphers := []pkcs.Cipher{
+		pkcs.DESCBC,
+		pkcs.TripleDESCBC,
+		pkcs.SM4CBC,
+		pkcs.SM4GCM,
+		pkcs.AES128CBC,
+		pkcs.AES192CBC,
+		pkcs.AES256CBC,
+		pkcs.AES128GCM,
+		pkcs.AES192GCM,
+		pkcs.AES256GCM,
+	}
+	sigalgs := []x509.SignatureAlgorithm{
+		x509.SHA1WithRSA,
+		x509.SHA256WithRSA,
+		x509.SHA512WithRSA,
+		smx509.SM2WithSM3,
+	}
+	for _, cipher := range ciphers {
+		for _, sigalg := range sigalgs {
+			plaintext := []byte("Hello Secret World!")
+			cert, err := createTestCertificate(sigalg)
+			if err != nil {
+				t.Fatal(err)
+			}
+			encrypted, err := Encrypt(cipher, plaintext, []*smx509.Certificate{cert.Certificate})
+			if err != nil {
+				t.Fatal(err)
+			}
+			p7, err := Parse(encrypted)
+			if err != nil {
+				t.Fatalf("cannot Parse encrypted result: %s", err)
+			}
+			result, err := p7.Decrypt(cert.Certificate, *cert.PrivateKey)
+			if err != nil {
+				t.Fatalf("cannot Decrypt encrypted result: %s", err)
+			}
+			if !bytes.Equal(plaintext, result) {
+				t.Errorf("encrypted data does not match plaintext:\n\tExpected: %s\n\tActual: %s", plaintext, result)
+			}
+		}
+	}
+}
+
+func TestEncryptSM(t *testing.T) {
+	ciphers := []pkcs.Cipher{
+		pkcs.SM4CBC,
+		pkcs.SM4GCM,
+	}
+	sigalgs := []x509.SignatureAlgorithm{
+		smx509.SM2WithSM3,
+	}
+	for _, cipher := range ciphers {
+		for _, sigalg := range sigalgs {
+			plaintext := []byte("Hello Secret World!")
+			cert, err := createTestCertificate(sigalg)
+			if err != nil {
+				t.Fatal(err)
+			}
+			encrypted, err := EncryptSM(cipher, plaintext, []*smx509.Certificate{cert.Certificate})
+			if err != nil {
+				t.Fatal(err)
+			}
+			pem.Encode(os.Stdout, &pem.Block{Type: "PKCS7", Bytes: encrypted})
+			p7, err := Parse(encrypted)
+			if err != nil {
+				t.Fatalf("cannot Parse encrypted result: %s", err)
+			}
+			result, err := p7.Decrypt(cert.Certificate, *cert.PrivateKey)
+			if err != nil {
+				t.Fatalf("cannot Decrypt encrypted result: %s", err)
+			}
+			if !bytes.Equal(plaintext, result) {
+				t.Errorf("encrypted data does not match plaintext:\n\tExpected: %s\n\tActual: %s", plaintext, result)
+			}
+		}
+	}
+}
+
+func TestEncryptCFCA(t *testing.T) {
+	ciphers := []pkcs.Cipher{
+		pkcs.SM4,
+		pkcs.SM4CBC,
+		pkcs.SM4GCM,
+	}
+	sigalgs := []x509.SignatureAlgorithm{
+		smx509.SM2WithSM3,
+	}
+	for _, cipher := range ciphers {
+		for _, sigalg := range sigalgs {
+			plaintext := []byte("Hello Secret World!")
+			cert, err := createTestCertificate(sigalg)
+			if err != nil {
+				t.Fatal(err)
+			}
+			encrypted, err := EncryptCFCA(cipher, plaintext, []*smx509.Certificate{cert.Certificate})
+			if err != nil {
+				t.Fatal(err)
+			}
+			pem.Encode(os.Stdout, &pem.Block{Type: "PKCS7", Bytes: encrypted})
+			p7, err := Parse(encrypted)
+			if err != nil {
+				t.Fatalf("cannot Parse encrypted result: %s", err)
+			}
+			result, err := p7.DecryptCFCA(cert.Certificate, *cert.PrivateKey)
+			if err != nil {
+				t.Fatalf("cannot Decrypt encrypted result: %s", err)
+			}
+			if !bytes.Equal(plaintext, result) {
+				t.Errorf("encrypted data does not match plaintext:\n\tExpected: %s\n\tActual: %s", plaintext, result)
+			}
+		}
+	}
+}

pkcs7/sign.go

@@ -22,9 +22,9 @@ type SignedData struct {
 	sd                  signedData
 	certs               []*smx509.Certificate
 	data, messageDigest []byte
+	contentTypeOid      asn1.ObjectIdentifier
 	digestOid           asn1.ObjectIdentifier
 	encryptionOid       asn1.ObjectIdentifier
-	isSM                bool
 }
 
 // NewSignedData takes data and initializes a PKCS7 SignedData struct that is
@@ -43,7 +43,7 @@ func NewSignedData(data []byte) (*SignedData, error) {
 		ContentInfo: ci,
 		Version:     1,
 	}
-	return &SignedData{sd: sd, data: data, digestOid: OIDDigestAlgorithmSHA1, isSM: false}, nil
+	return &SignedData{sd: sd, data: data, digestOid: OIDDigestAlgorithmSHA1, contentTypeOid: OIDSignedData}, nil
 }
 
 // NewSMSignedData takes data and initializes a PKCS7 SignedData struct that is
@@ -56,7 +56,7 @@ func NewSMSignedData(data []byte) (*SignedData, error) {
 	}
 	sd.sd.ContentInfo.ContentType = SM2OIDData
 	sd.digestOid = OIDDigestAlgorithmSM3
-	sd.isSM = true
+	sd.contentTypeOid = SM2OIDSignedData
 	return sd, nil
 }
 
@@ -300,10 +300,7 @@ func (sd *SignedData) AddCertificate(cert *smx509.Certificate) {
 // Detach removes content from the signed data struct to make it a detached signature.
 // This must be called right before Finish()
 func (sd *SignedData) Detach() {
-	sd.sd.ContentInfo = contentInfo{ContentType: OIDData}
-	if sd.isSM {
-		sd.sd.ContentInfo.ContentType = SM2OIDData
-	}
+	sd.sd.ContentInfo.Content = asn1.RawValue{}
 }
 
 // GetSignedData returns the private Signed Data
@@ -321,12 +318,9 @@ func (sd *SignedData) Finish() ([]byte, error) {
 		return nil, err
 	}
 	outer := contentInfo{
-		ContentType: OIDSignedData,
+		ContentType: sd.contentTypeOid,
 		Content:     asn1.RawValue{Class: asn1.ClassContextSpecific, Tag: 0, Bytes: inner, IsCompound: true},
 	}
-	if sd.isSM {
-		outer.ContentType = SM2OIDSignedData
-	}
 	return asn1.Marshal(outer)
 }
 

pkcs7/sign_enveloped.go

@@ -126,11 +126,11 @@ func (p7 *PKCS7) decryptSED(sed *signedEnvelopedData, recipient *recipientInfo,
 
 // SignedAndEnvelopedData is an opaque data structure for creating signed and enveloped data payloads
 type SignedAndEnvelopedData struct {
-	sed       signedEnvelopedData
-	certs     []*smx509.Certificate
-	data, cek []byte
-	digestOid asn1.ObjectIdentifier
-	isSM      bool
+	sed            signedEnvelopedData
+	certs          []*smx509.Certificate
+	data, cek      []byte
+	contentTypeOid asn1.ObjectIdentifier
+	digestOid      asn1.ObjectIdentifier
 }
 
 // NewSignedAndEnvelopedData takes data and cipher and initializes a new PKCS7 SignedAndEnvelopedData structure
@@ -160,7 +160,7 @@ func NewSignedAndEnvelopedData(data []byte, cipher pkcs.Cipher) (*SignedAndEnvel
 			EncryptedContent:           marshalEncryptedContent(ciphertext),
 		},
 	}
-	return &SignedAndEnvelopedData{sed: sed, data: data, cek: key, digestOid: OIDDigestAlgorithmSHA1, isSM: false}, nil
+	return &SignedAndEnvelopedData{sed: sed, data: data, cek: key, digestOid: OIDDigestAlgorithmSHA1, contentTypeOid: OIDSignedEnvelopedData}, nil
 }
 
 // NewSMSignedAndEnvelopedData takes data and cipher and initializes a new PKCS7(SM) SignedAndEnvelopedData structure
@@ -170,8 +170,8 @@ func NewSMSignedAndEnvelopedData(data []byte, cipher pkcs.Cipher) (*SignedAndEnv
 	if err != nil {
 		return nil, err
 	}
+	sd.contentTypeOid = SM2OIDSignedEnvelopedData
 	sd.digestOid = OIDDigestAlgorithmSM3
-	sd.isSM = true
 	sd.sed.EncryptedContentInfo.ContentType = SM2OIDData
 	return sd, nil
 }
@@ -223,10 +223,11 @@ func (saed *SignedAndEnvelopedData) AddSignerChain(ee *smx509.Certificate, pkey
 	if !ok {
 		return errors.New("pkcs7: private key does not implement crypto.Signer")
 	}
+
 	var signOpt crypto.SignerOpts
 	var tobeSigned []byte
 
-	if saed.isSM {
+	if _, isSM2 := pkey.(sm2.Signer); isSM2 {
 		signOpt = sm2.DefaultSM2SignerOpts
 		tobeSigned = saed.data
 	} else {
@@ -261,7 +262,7 @@ func (saed *SignedAndEnvelopedData) AddCertificate(cert *smx509.Certificate) {
 
 // AddRecipient adds a recipient to the payload
 func (saed *SignedAndEnvelopedData) AddRecipient(recipient *smx509.Certificate) error {
-	encryptedKey, err := encryptKey(saed.cek, recipient, false) //TODO: check if CFCA has such function 
+	encryptedKey, err := encryptKey(saed.cek, recipient, false) //TODO: check if CFCA has such function
 	if err != nil {
 		return err
 	}
@@ -272,8 +273,6 @@ func (saed *SignedAndEnvelopedData) AddRecipient(recipient *smx509.Certificate)
 	var keyEncryptionAlgorithm asn1.ObjectIdentifier = OIDEncryptionAlgorithmRSA
 	if recipient.SignatureAlgorithm == smx509.SM2WithSM3 {
 		keyEncryptionAlgorithm = OIDKeyEncryptionAlgorithmSM2
-	} else if saed.isSM {
-		return errors.New("pkcs7: Shangmi does not support RSA")
 	}
 	info := recipientInfo{
 		Version:               1,
@@ -295,11 +294,8 @@ func (saed *SignedAndEnvelopedData) Finish() ([]byte, error) {
 		return nil, err
 	}
 	outer := contentInfo{
-		ContentType: OIDSignedEnvelopedData,
+		ContentType: saed.contentTypeOid,
 		Content:     asn1.RawValue{Class: asn1.ClassContextSpecific, Tag: 0, Bytes: inner, IsCompound: true},
 	}
-	if saed.isSM {
-		outer.ContentType = SM2OIDSignedEnvelopedData
-	}
 	return asn1.Marshal(outer)
 }