GB/T 36322-2018Information security technology—Cryptographic device application interface specifications (English PDF)

3.1 Algorithm identification

A symbol used to uniquely identify a cryptographic algorithm.

3.2 Asymmetric cryptographic algorithm; public key

Encryption and decryption using a different key cryptographic algorithm.

3.3 Decryption

The inverse process corresponding to the encryption process.

3.4 Device key

An asymmetric key pair for device management stored inside the device, including a signature key pair and an encryption key pair.

3.5 Encryption

The process of cryptographically transforming data to produce ciphertext.

3.6 Key encryption key

The key that encrypts the key.

3.7 Public key infrastructure

A universally applicable infrastructure built using public key cryptography provides users with security services such as certificate management and key management.

3.8 Private key access control code

A password used to verify the private key usage rights.

3.9 Symmetric cryptography technology; symmetric

A cryptographic technique (institution) in which both the originator and the receiver use the same secret key for conversion.

Note: The encryption key is the same as the decryption key, or a cryptosystem in which one key can be derived from another key.

3.10 Session key

The lowest layer in the hierarchical key structure, the key used only in one session.

3.11 User key

An asymmetric key stored in the device for applying cryptographic operations, including a signature key pair and an encryption key pair.

5.1 Algorithm Identification Definition

The algorithm identification of the algorithm used in this standard can be found in GB/T 33560. The algorithm identifier of the symmetric encryption algorithm contains its working mode.

5.2 Basic data type definition

The byte arrays in this standard are all stored and exchanged in the high-order byte (Big-Endian) mode. Basic data type definitions are shown in Table 1.

5.3 Device Information Definition

The device information is described in Table 2.

5.4 Key classification and storage definition

5.4.1 Device Key and User Key

The device key can only be generated or installed when the device is initialized, and the user key is generated or installed by the password device management tool.

The device key and the user key are stored in the key storage area, and the index number is searched from 0, and each index number corresponds to a signature key pair and An encryption key pair. The index number is 0, indicating the device key. Index number 1 begins to represent the user key. Device key and user secret The key storage description is shown in Table 3.

5.4.2 Key Encryption Key

The key encryption key is generated or installed by the password device management tool. The key length is 128 bits and is stored in the key storage area. Quotation marks start at 1. The key encryption key storage description is shown in Table 4.

5.4.3 Session Key

The session key is generated or imported using the device interface function, and the session key is retrieved using the handle.

5.5 RSA key data structure definition

The order of the RSA key structure is stored from high to low, that is, the key is stored from the highest bit of the key structure array, and the highest byte is filled. In the highest bit, the insufficient bits fill the data 0. The RSA key data structure is shown in Table 5.

5.6 ECC key data structure definition

The ECC key data structure is shown in Table 6.

5.8 ECC signature data structure definition

The ECC signature data structure is shown in Table 8.

6.1 Location of the cryptographic device application interface in the framework of the public key cryptographic infrastructure application technology architecture

In the framework of the public key cryptosystem application technology system, the cryptographic device service layer is set by a cipher machine, a cipher card, a smart cipher terminal, etc. The backup component provides the basic password service to the universal password service layer through the password device application interface specified in this standard. As shown in Figure 1.

The basic cryptographic services include services such as key generation, single cryptographic operations, file management, and the like.

This standard uses C language to describe interface functions. Unless otherwise stated, the length unit of the parameter in the function is the number of bytes.

6.2 Device Management Class Functions

6.2.1 Overview

The device management class function provides device opening and closing, session creation and shutdown, device information acquisition, random number generation, and private key permission acquisition. Functions such as release and release, as shown in Table 9, the return codes of each function are shown in Appendix A.

6.2.2 Opening the device

Prototype. LONGSDF_OpenDevice(HANDLE*phDeviceHandle);

Description. Turn on the password device.

Parameters. device handle returned by phDeviceHandle[out]

Return value. 0 Success Non-zero failure, return error code

Note: phDeviceHandle is initialized by the function and fills in the content.

6.2.3 Turning off the device

Prototype. LONGSDF_CloseDevice(HANDLEhDeviceHandle); Description. Turn off the password device and release related resources.

Parameters. hDeviceHandle[in] Opened device handle Return value. 0 Success Non-zero failure, return error code

6.2.4 Creating a Session

Prototype. LONGSDF_OpenSession(HANDLEhDeviceHandle,HANDLE*phSessionHandle); Description. Create a session with a password device.

Parameters. hDeviceHandle[in] Opened device handle phSessionHandle[out] returns a new session handle established with the cryptographic device Return value. 0 Success Non-zero failure, return error code

6.2.5 Closing a session

Prototype. LONGSDF_CloseSession(HANDLEhSessionHandle);

Description. Closes the established session with the password device and releases the related resources.

Parameters. hSessionHandle[in] The session handle that has been established with the cryptographic device Return value. 0 Success Non-zero failure, return error code

6.2.6 Obtaining Device Information

Prototype. LONGSDF_GetDeviceInfo( HANDLEhSessionHandle, DEVICEINFO*pstDeviceInfo); Description. Get a description of the cryptographic device capability.

Parameters. hSessionHandle[in] Session handle established with the device pstDeviceInfo[out] device capability description information, content and format, see device information definition Return value. 0 Success Non-zero failure, return error code

6.2.7 Generating random numbers

Prototype. LONGSDF_GenerateRandom( HANDLEhSessionHandle, ULONGuiLength, BYTE*pucRandom); Description. Gets a random number of the specified length.

Parameters. hSessionHandle[in] Session handle established with the device uiLength[in] Get the length of the random number pucRandom[out] buffer pointer for storing the obtained random number Return value. 0 Success Non-zero failure, return error code

6.2.8 Obtaining Private Key Usage Rights

Prototype. LONGSDF_GetPrivateKeyAccessRight( HANDLEhSessionHandle, ULONGuiKeyIndex, LPSTRpucPassword, ULONGuiPwdLength);

Description. Gets the right to use the specified index private key stored inside the cryptographic device.

Parameters. hSessionHandle[in] Session handle established with the device uiKeyIndex[in] The password device stores the index value of the private key. pucPassword[in] private key access control code uiPwdLength[in] private key access control code length, not less than 8 bytes Return value. 0 Success Non-zero failure, return error code

Note: This standard involves the initial index value of the key pair index value stored by the cryptographic device, which is 1 and the maximum is n. The actual storage capacity of the cryptographic device determines the value of n.

6.2.9 Release the private key usage rights

Prototype. LONGSDF_ReleasePrivateKeyAccessRight( HANDLEhSessionHandle, ULONGuiKeyIndex);

Description. Releases the license for the specified index private key stored by the cryptographic device.

Parameters. hSessionHandle[in] Session handle established with the device uiKeyIndex[in] cryptographic device stores private key index value Return value. 0 Success Non-zero failure, return error code

6.3 Key Management Class Functions

6.3.1 Overview

The key management class function provides functions such as key generation and import and export, including the export of the signed public key and the encrypted public key, and the asymmetric key. Generation and output of pairs, generation and output of session keys, import of session keys, digital envelope conversion, generation of key agreement parameters and transmission Output, calculation of session key, calculation of IKE work key, calculation of IPSEC session key, calculation of SSL work key, and session secret The functions such as the destruction of the key are shown in Table 10. The return codes of each function are shown in Appendix A.

6.3.2 Exporting an RSA Signature Public Key

Prototype. LONGSDF_ExportSignPublicKey_RSA( HANDLEhSessionHandle, ULONGuiKeyIndex, RSArefPublicKey*pucPublicKey);

Description. Exports the signed public key of the specified index location stored inside the cryptographic device.

Parameters. hSessionHandle[in] Session handle established with the device uiKeyIndex[in] RSA key pair index value stored by the cryptographic device pucPublicKey[out] RSA public key structure Return value. 0 Success Non-zero failure, return error code

6.3.3 Exporting RSA Encrypted Public Keys

Prototype. LONGSDF_ExportEncPublicKey_RSA( HANDLEhSessionHandle, ULONGuiKeyIndex, RSArefPublicKey*pucPublicKey);

Description. Exports the encrypted public key at the specified index location stored inside the cryptographic device.

Parameters. hSessionHandle[in] Session handle established with the device uiKeyIndex[in] RSA key pair index value stored by the cryptographic device pucPublicKey[out] RSA public key structure Return value. 0 Success Non-zero failure, return error code […]