QianHeng乾珩 PQC Docs Hub量子文档 ✦ Ask AI✦ 问问文档 ⚐ Scan⚐ 扫一扫
/

SM2 · Elliptic-Curve PKC

SM2 is China's national elliptic-curve public-key algorithm, standardized in GM/T 0003-2012 and GB/T 32918. It is the ShangMi (商密) counterpart to ECDSA/ECIES/ECDH, bundling a digital-signature scheme, a public-key encryption scheme, and an authenticated key-exchange scheme over a 256-bit prime-field curve. Because its security rests on the elliptic-curve discrete-log problem (ECDLP), SM2 is fully broken by Shor's algorithm — adopting it gains nothing in post-quantum terms.

What SM2 is

SM2 is a set of elliptic-curve public-key mechanisms defined by China's State Cryptography Administration (SCA / 国家密码管理局). The core specification is GM/T 0003-2012, published in five parts (general framework, digital signature, key exchange, public-key encryption, and parameter definitions); the same algorithm is also issued as the national standard GB/T 32918. SM2 operates over an elliptic curve defined on a 256-bit prime field; the SCA-recommended curve is named sm2p256v1.

In deployment SM2 is the public-key workhorse of Chinese commercial cryptography: TLS/TLCP handshakes, PKI certificates (X.509 with SM2 keys), electronic-signature law compliance, smart cards, and government and banking systems all rely on it.

The three schemes

  • Digital signature — the SM2 signature scheme, broadly the SM-suite analogue of ECDSA. It signs a message digest and is the most widely used SM2 mode.
  • Public-key encryption — an integrated encryption scheme comparable to ECIES, producing ciphertext from a recipient's public key without a shared secret established in advance.
  • Key exchange — an authenticated two-party key-agreement protocol, the rough counterpart to ECDH, establishing a shared session key with mutual authentication.

SM3 pairing

SM2 does not work alone: the hash function used alongside it is SM3 (GM/T 0004-2012, 256-bit digest). SM3 supplies the message hashing inside the signature scheme and the key-derivation steps inside encryption and key exchange — the same structural role SHA-256 plays for ECDSA/ECIES. Unlike SM2, SM3 is symmetric-flavoured and only weakened by Grover, not broken by Shor.

Relation to ECDSA / ECDH

SM2 is best understood as a nationally specified ECC family. It uses its own curve parameters (sm2p256v1) and its own signature equation and encoding, but the underlying mathematics — point arithmetic on a prime-field elliptic curve — is the same kind used by NIST P-256 with ECDSA and ECDH. The practical consequence is that SM2 inherits ECC's quantum weakness exactly: it is no more and no less quantum-resistant than ECDSA/ECDH.

International standardization

The SM2 digital-signature algorithm has been adopted into ISO/IEC 14888-3:2018 (digital signatures with appendix), giving it formal status outside China. The domestic standardization of SM2 encryption and key exchange is found mainly in the GB/T 32918 / GM/T 0003 series; the scope of international adoption should be distinguished by the specific ISO standard entry, and should not be stated loosely as "all SM2 mechanisms have been adopted by ISO."

Quantum status — ECDLP means Shor-vulnerable

The security of every SM2 scheme reduces to the elliptic-curve discrete-log problem (ECDLP). A cryptographically relevant quantum computer (CRQC) running Shor's algorithm solves ECDLP in polynomial time, recovering the private key from the public key. SM2 is therefore broken in the quantum era in precisely the same way as ECDSA and ECDH. Replacing RSA with SM2 — or ECC with SM2 — provides no post-quantum benefit. See quantum-threat.html for the threat model and sm-pqc.html for how the SM suite is migrating toward post-quantum primitives.

Tooling example

Open-source implementations include GmSSL and Tongsuo (铜锁). A minimal GmSSL signing flow:

# Generate an SM2 key pair on the sm2p256v1 curve
gmssl sm2keygen -pass 1234 -out sm2.pem -pubout sm2pub.pem

# Sign a file using SM3 as the digest
gmssl sm2sign -key sm2.pem -pass 1234 -in message.txt -out message.sig

# Verify the signature with the public key
gmssl sm2verify -pubkey sm2pub.pem -in message.txt -sig message.sig

Standards & references

Warning
SM2 is a classical elliptic-curve algorithm. It is Shor-vulnerable and must not be treated as a post-quantum solution. Any Harvest Now, Decrypt Later (HNDL) exposure that applies to ECC applies equally to SM2; plan a migration to PQC or hybrid schemes for long-lived data.

SM2 椭圆曲线公钥密码

SM2 是中国的国产椭圆曲线公钥算法，标准为 GM/T 0003-2012，并发布为国家标准 GB/T 32918。它是商密体系中对应 ECDSA/ECIES/ECDH 的算法，在 256 位素域曲线上同时提供数字签名、公钥加密与认证密钥交换三种机制。由于其安全性依赖椭圆曲线离散对数问题 ECDLP，SM2 会被 Shor 算法完全攻破——采用它在后量子意义上毫无收益。

SM2 是什么

SM2 是由国家密码管理局 SCA 定义的一组椭圆曲线公钥机制。核心规范为 GM/T 0003-2012，分五个部分发布（总则、数字签名、密钥交换、公钥加密、参数定义）；同一算法亦发布为国家标准 GB/T 32918。SM2 工作在 256 位素域上的椭圆曲线，SCA 推荐曲线名为 sm2p256v1。

在落地部署中 SM2 是中国商用密码的公钥主力：TLS/TLCP 握手、PKI 证书（采用 SM2 密钥的 X.509）、电子签名法合规、智能卡，以及政务与银行系统都依赖它。

三种机制

  • 数字签名——SM2 签名方案，大致对应商密体系中的 ECDSA，对消息摘要进行签名，是使用最广的 SM2 模式。
  • 公钥加密——一种集成加密方案，可类比 ECIES，无需事先建立共享密钥即可用收方公钥生成密文。
  • 密钥交换——双方认证密钥协商协议，大致对应 ECDH，在相互认证下建立共享会话密钥。

与 SM3 的配合

SM2 并非单独工作：与之配套的杂凑函数是 SM3（GM/T 0004-2012，256 位摘要）。SM3 在签名方案中负责消息杂凑，在加密与密钥交换中负责密钥派生——这与 SHA-256 在 ECDSA/ECIES 中的结构性角色完全相同。与 SM2 不同，SM3 属对称类原语，仅被 Grover 削弱而非被 Shor 攻破。

与 ECDSA ECDH 的关系

SM2 最好被理解为一族国产规定的 ECC。它采用自有曲线参数 sm2p256v1、自有签名方程与编码，但底层数学——素域椭圆曲线上的点运算——与 NIST P-256 配合 ECDSA、ECDH 所用的是同一类。其实际后果是 SM2 完全继承了 ECC 的量子弱点：它对量子攻击的抵抗力既不强于也不弱于 ECDSA/ECDH。

国际标准化

SM2 数字签名算法已被纳入 ISO/IEC 14888-3:2018（带附录的数字签名），从而获得了在中国之外的正式地位。SM2 加密和密钥交换的国内标准化主要见 GB/T 32918 / GM/T 0003 系列；国际采纳范围应按具体 ISO 标准条目区分，不宜笼统写成"SM2 全机制均已被 ISO 采纳"。

量子态势 ECDLP 意味着易受 Shor 攻击

每一种 SM2 机制的安全性都归约到椭圆曲线离散对数问题 ECDLP。具备密码学意义的量子计算机 CRQC 运行 Shor 算法 可在多项式时间内求解 ECDLP，从公钥还原私钥。因此 SM2 在量子时代被攻破的方式与 ECDSA、ECDH 完全一致。用 SM2 替换 RSA、或用 SM2 替换 ECC，都不会带来任何后量子收益。威胁模型参见 quantum-threat.html，商密套件如何向后量子原语迁移参见 sm-pqc.html。

工具示例

开源实现包括 GmSSL 与 Tongsuo 铜锁。一段最小的 GmSSL 签名流程：

# 在 sm2p256v1 曲线上生成 SM2 密钥对
gmssl sm2keygen -pass 1234 -out sm2.pem -pubout sm2pub.pem

# 以 SM3 为摘要对文件进行签名
gmssl sm2sign -key sm2.pem -pass 1234 -in message.txt -out message.sig

# 用公钥验证签名
gmssl sm2verify -pubkey sm2pub.pem -in message.txt -sig message.sig

标准与参考

警告
SM2 是经典椭圆曲线算法，易受 Shor 攻击，绝不可当作后量子方案。一切适用于 ECC 的先收集后解密风险同样适用于 SM2；对长生命周期数据应规划向 PQC 或混合方案迁移。
⚑ Report an error⚑ 纠错与校正