SM2 Chinese Cryptographic Algorithm
Elliptic curve cryptography per GM/T 0003-2012. Generate key pairs, encrypt/decrypt, sign/verify — all in-browser.
1. SM2 Key Pair
2. Encryption / Decryption
3. Sign / Verify
SM2 is an elliptic curve cryptographic algorithm standardized by the Chinese State Cryptography Administration (GM/T 0003-2012). It uses the SM2 curve (256-bit prime field) and is paired with SM3 hashing. This tool uses the sm-crypto JavaScript library.
SM2 encryption uses C1C2C3 format (hex output). Signatures use r||s format (raw concatenation). The public key is in compressed format (02/03 prefix + 64 hex chars).
How to Use
Encrypt: Generate a key pair. Enter plaintext, click "Encrypt with Public Key". The output is a hexadecimal C1C2C3 ciphertext string.
Decrypt: Paste a hex C1C2C3 ciphertext, ensure the private key matches, click "Decrypt with Private Key".
Sign: Enter a message, click "Sign with Private Key". The message is first hashed with SM3, then signed. Output is hex r||s (64 bytes = 128 hex chars).
Verify: Enter the original message and the hex signature, click "Verify with Public Key".
When to Use SM2 vs RSA vs ECDSA
- SM2 — Required for Chinese government, finance, and compliance applications
- RSA — Widest compatibility, mature ecosystem, supported everywhere
- ECDSA (P-256) — Better performance than RSA, widely used in TLS 1.3 and WebAuthn
Example Use Cases
- Chinese banking — SM2 is required for Chinese financial IC card applications
- Government systems — Mandated for Chinese government information systems
- IoT security — Lightweight compared to RSA, suitable for embedded devices
- Interoperability testing — Verify SM2 implementations across Java (BouncyCastle), C (GMSSL), and JavaScript
Understanding SM2 Cryptography
SM2 is a public-key cryptographic algorithm based on elliptic curves, published by China's State Cryptography Administration in 2010 and formalized as GM/T 0003-2012. It is part of the Chinese national cryptographic suite (SM2/SM3/SM4) that provides an alternative to the RSA/SHA/AES ecosystem. SM2 is mandated for Chinese government IT systems, financial systems (PBOC standards), and is increasingly used in Chinese commercial products. RFC 8998 defines SM2 and SM3 as valid TLS 1.3 cipher suites.
The SM2 Curve
SM2 uses a specific 256-bit elliptic curve defined over a prime field. The curve equation is y^2 = x^3 + ax + b, where a and b are fixed parameters specified in GM/T 0003. The base point G has order n, a 256-bit prime. The curve was not randomly generated — its parameters are derived from the SHA-256 hash of an elliptic curve seed, following the standard verifiable random generation procedure (ANSI X9.62). This rules out the possibility that the curve parameters were specially crafted to enable secret attacks. The security strength is 128 bits, equivalent to NIST P-256 (secp256r1) and RSA-3072.
SM2 vs ECDSA vs RSA: Performance and Security
SM2 operates on a 256-bit curve, providing 128-bit security. This is equivalent to RSA-3072 but with much smaller keys and faster operations. A 256-bit SM2 public key is 64 bytes (or 33 bytes compressed), compared to 384 bytes for a 3072-bit RSA public key. SM2 signature generation is about 10x faster than RSA-3072 signing, and verification is about 3x faster. Compared to NIST P-256 (ECDSA), SM2 is similar in performance and security, but uses a different curve and hash (SM3 instead of SHA-256). The choice between SM2 and ECDSA is primarily driven by regulatory requirements, not technical superiority.
SM2 Encryption: C1C2C3 Format
SM2 encryption produces a ciphertext with three components: C1 is the ephemeral public key (64 bytes, a random point on the curve), C2 is the encrypted data (XOR of the plaintext with a key derived from the shared secret), and C3 is the SM3 hash of the plaintext and shared secret (32 bytes, providing integrity). The standard format (GM/T 0003) is C1||C2||C3. An older format (C1||C3||C2) was used in some implementations — be aware of the ordering when interoperating. This tool uses the standard C1C2C3 format.
SM2 Signatures: The Z Value
Unlike ECDSA which signs only the hash of the message, SM2 signs a hash that includes the message and a "Z value" — a pre-computed hash of the user's public key and ID information. This binds the signature to the key holder's identity, preventing signature malleability across different users. The signature algorithm produces two integers (r, s), each 32 bytes, concatenated as a 64-byte raw signature. Some implementations use DER-encoded ASN.1 format instead; this tool uses the raw r||s format for simplicity.
When to Use SM2
SM2 is mandatory in Chinese government information systems (classified networks, e-government) and Chinese financial systems (PBOC EMV cards, mobile payment standards). If your product targets the Chinese market and needs cryptographic compliance (e.g., a smart card applet for a Chinese bank), SM2 is non-optional. For international products, ECDSA (P-256) or RSA-2048 is more appropriate. If you need both compliance and international interoperability, consider supporting both SM2 and ECDSA — many modern Chinese cryptographic libraries (GMSSL, BouncyCastle) support both.
Interop with Other Languages
Java: Use BouncyCastle (SM2 signer = new SM2Signer();) with the SM2 curve parameters. C: Use GMSSL or GmSSL library. Python: Use the gmssl package. JavaScript: This tool uses the sm-crypto npm package. When testing interop, remember that different libraries may use different C1/C2/C3 orderings, different signature formats (DER vs raw), and different SM2 curves (there is one standard curve, but some libraries also support test curves). Always verify the exact byte-level output matches between implementations.