feat(归并文件): 归并根包文件

ofdgo_crypto.go

@@ -17,8 +17,18 @@ package ofdgo
 import (
 	"bytes"
 	"crypto"
+	"crypto/cipher"
+	"crypto/ecdsa"
+	"crypto/rand"
 	"errors"
+	"fmt"
 	"io"
+
+	"github.com/emmansun/gmsm/padding"
+	"github.com/emmansun/gmsm/sm2"
+	"github.com/emmansun/gmsm/sm3"
+	"github.com/emmansun/gmsm/sm4"
+	"github.com/emmansun/gmsm/smx509"
 )
 
 // Credentials 解密凭据，UserName用于筛选接收者，留空自动匹配，不参与口令派生；证书采用DER编码
@@ -84,6 +94,9 @@ type encryptionState struct {
 	options *EncryptionOptions
 }
 
+// GMCryptoProvider 使用纯Go国密实现，可在原生环境和WASM使用
+type GMCryptoProvider struct{}
+
 // 加密错误可通过errors.Is识别，不包含口令或私钥
 var (
 	ErrCredentialsRequired      = errors.New("document credentials required")
@@ -212,3 +225,91 @@ func (e *Editor) writeEncrypted(writer io.Writer) (int64, error) {
 	}
 	return io.Copy(writer, bytes.NewReader(data))
 }
+
+// EncryptSM4 使用SM4-CBC及PKCS#7填充加密
+// 入参: key 密钥, iv 初始向量, plaintext 明文
+// 返回: []byte 密文, error 错误信息
+func (GMCryptoProvider) EncryptSM4(key, iv, plaintext []byte) ([]byte, error) {
+	block, err := sm4.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	if len(iv) != block.BlockSize() {
+		return nil, fmt.Errorf("invalid SM4 IV length")
+	}
+	out := padding.NewPKCS7Padding(sm4.BlockSize).Pad(bytes.Clone(plaintext))
+	cipher.NewCBCEncrypter(block, iv).CryptBlocks(out, out)
+	return out, nil
+}
+
+// DecryptSM4 解密SM4-CBC并校验PKCS#7填充
+// 入参: key 密钥, iv 初始向量, ciphertext 密文
+// 返回: []byte 明文, error 错误信息
+func (GMCryptoProvider) DecryptSM4(key, iv, ciphertext []byte) ([]byte, error) {
+	block, err := sm4.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	if len(iv) != block.BlockSize() || len(ciphertext) == 0 || len(ciphertext)%block.BlockSize() != 0 {
+		return nil, ErrInvalidCredentials
+	}
+	out := make([]byte, len(ciphertext))
+	cipher.NewCBCDecrypter(block, iv).CryptBlocks(out, ciphertext)
+	plain, err := padding.NewPKCS7Padding(sm4.BlockSize).ConstantTimeUnpad(out)
+	if err != nil {
+		clear(out)
+		return nil, ErrInvalidCredentials
+	}
+	return plain, nil
+}
+
+// PasswordKey 按GB/T32918派生16字节口令密钥
+// 入参: password UTF-8口令
+// 返回: []byte 密钥, error 错误信息
+func (GMCryptoProvider) PasswordKey(password []byte) ([]byte, error) {
+	if len(password) == 0 {
+		return nil, ErrCredentialsRequired
+	}
+	return sm3.Kdf(password, sm4.BlockSize), nil
+}
+
+// EncryptKey 使用SM2公钥证书封装文件密钥
+// 入参: certificate DER证书, key 文件密钥
+// 返回: []byte ASN.1密文, error 错误信息
+func (GMCryptoProvider) EncryptKey(certificate, key []byte) ([]byte, error) {
+	cert, err := parseEncryptionCertificate(certificate)
+	if err != nil {
+		return nil, err
+	}
+	return sm2.EncryptASN1(rand.Reader, cert.PublicKey.(*ecdsa.PublicKey), key)
+}
+
+// ParseEncryptionCertificate 解析单张SM2加密证书并返回DER副本
+// 仅检查格式、算法和密钥用途，接收者身份及信任应由调用方确认
+// 入参: certificate PEM或DER证书
+// 返回: []byte DER证书, error 错误信息
+func ParseEncryptionCertificate(certificate []byte) ([]byte, error) {
+	cert, err := parseEncryptionCertificate(certificate)
+	if err != nil {
+		return nil, err
+	}
+	return bytes.Clone(cert.Raw), nil
+}
+
+// parseEncryptionCertificate 解析并检查加密证书
+// 入参: certificate PEM或DER证书
+// 返回: *smx509.Certificate 证书, error 错误信息
+func parseEncryptionCertificate(certificate []byte) (*smx509.Certificate, error) {
+	cert, err := parseSignatureCertificate(certificate)
+	if err != nil {
+		return nil, err
+	}
+	public, ok := cert.PublicKey.(*ecdsa.PublicKey)
+	if !ok || !sm2.IsSM2PublicKey(public) {
+		return nil, fmt.Errorf("SM2 encryption certificate required")
+	}
+	if cert.KeyUsage != 0 && cert.KeyUsage&(smx509.KeyUsageKeyEncipherment|smx509.KeyUsageDataEncipherment|smx509.KeyUsageKeyAgreement) == 0 {
+		return nil, fmt.Errorf("certificate does not permit encryption")
+	}
+	return cert, nil
+}