//TDES128-CFB_block-ENC
//plain
81709944E0CB2E1DB5B0A477D1A8539B
//key
E07099F1BFAFFD7F
240CD790CA4FE134
//iv
C72B6591A0D7DE8F
//cipher
DE658657CEC1D13A4C416ED7E83CAB85


//step
//C1, key=E07099F1BFAFFD7F,crypto=enc
DD5F07CEFABC934E52D7417C07F8EF30
//C2,key=240CD790CA4FE134,cipher=DD5F07CEFABC934E52D7417C07F8EF30,crypto=dec
56D029BFEE32C886DB98EBFDFC35476D
//C3,key=E07099F1BFAFFD7F,plain=56D029BFEE32C886DB98EBFDFC35476D,crypto=enc
00E7549663AB000094840B2FE6190DCC



//TDES128-CFB-ENC
//plain
81709944E0CB2E1D
//key
E07099F1BFAFFD7F
240CD790CA4FE134
//iv
C72B6591A0D7DE8F
//cipher
B3F76EB9504F5B5D

//step
//C1, key=E07099F1BFAFFD7F,crypto=enc
DD5F07CEFABC934E
//C2,key=240CD790CA4FE134,cipher=DD5F07CEFABC934E,crypto=dec
56D029BFEE32C886
//C3,key=E07099F1BFAFFD7F,plain=56D029BFEE32C886,crypto=enc
00E7549663AB0000




//TDES128-CFB-ENC
//plain
81709944E0CB2E1D
//key
E07099F1BFAFFD7F
240CD790CA4FE134
//cipher
C00727761EC27282

//step
//C1, key=E07099F1BFAFFD7F,crypto=enc
60DFC6E3581378FB
//C2,key=240CD790CA4FE134,cipher=60DFC6E3581378FB,crypto=dec
6380CA29F4F4BAB0
//C3,key=E07099F1BFAFFD7F,plain=6380CA29F4F4BAB0,crypto=enc
C00727761EC27282

//---------------------Input---------------------//
//key-16byte
FEFFE9928665731C6D6A8F9467308308
//plain-64byte
d9313225f88406e5a55909c5aff5269a
86a7a9531534f7da2e4c303d8a318a72
1c3c0c95956809532fcf0e2449a6b525
b16aedf5aa0de657ba637b391aafd255
//iv-12byte
cafebabefacedbaddecaf888
//aad-20bytes
feedfacedeadbeeffeedfacedeadbeef
abaddad2000000000000000000000000

//---------------------Output---------------------//
//cipher-64byte
//iv长度12byte，J0=CAFEBABEFACEDBADDECAF88800000001
//ctr-iv（即J1）：CAFEBABEFACEDBADDECAF88800000002
42831ec2217774244b7221b784d0d49c
e3aa212f2c02a4e035c17e2329aca12e
21d514b25466931c7d8f6a5aac84aa05
1ba30b396a0aac973d58e091473f5985
//mac
DA80CE830CFDA02DA2A218A1744F4C76

//构造IV-16byte
cafebabefacedbaddecaf88800000000

blocks=aad||padding(aad)||payload||padding(payload)
注：如果aad或payload实际长度已经分组整数倍，则不需要padding

在chacha20轮函数中，a += b存在回绕
Qround:
  a += b; d ^= a; d <<<= 16;
  c += d; b ^= c; b <<<= 12;
  a += b; d ^= a; d <<<= 8;
  c += d; b ^= c; b <<<= 7;

the constant prime "P" be 2^130-5=0x3fffffffffffffffffffffffffffffffb

//认证域的字节长度，即认证tag（如下用U表示）的字节长度，有效值是在{4,6,8,10,12,14,16}中选取。M越大，则攻击者篡改后仍有效的可能越小，也即越安全。
M
//长度域的长度，即消息字节长度占用的字节数，有效值在2到8个字节（1个字节是保留值）
L
//一次性的认证信息，字节长度是15-L
Nonce
//额外的认证消息，其字节长度表示为len(a)，要求0≤len(a)<2^64
AAD：

//同时加密和MAC
C = Enc(K,M)
T = Mac(M)
//先加密、再MAC
C = Enc(K,M)
T = Enc(C)
//先MAC、再加密  //选择密文攻击
C = Enc(K,(M||Mac(M))

//SM4 example
//key
ffffffffffffffffffffffffffffffff
//iv
ffffffffffffffffffffffffffffffff
//plain
ffffffffffffffffffffffffffffffff
//ECB(key, iv)
EDB119F8455FD2327AD6FBEDCB5B4F5D
//ECB(key, iv) ^ plain
EDB119F8455FD2327AD6FBEDCB5B4F5D ^ ffffffffffffffffffffffffffffffff
=124EE607BAA02DCD8529041234A4B0A2

//《IEEE_1619_2007_standard_for_cryptographic_protection_of_data_on_block_oriented_storage_devices.pdf》
//Input
Key //is the 256 or 512 bit XTS key
P //is the plaintext, bitlen(p)>=128
i //is the value of the 128-bit tweak
//Output
C

//calc step
P = P0||P1||...||Pm
1.for q <- 0 to m-2 do
    Cq = XTS_blockEnc(key, Pj, i, q)
2.b=bit_len(Pm)
3.if b == 0
    Cm-1 = XTS_blockEnc(key,Pm-1, i, m-1)
    Cm = empty
  else
    CC=XTS_blockEnc(key,pm-1,i,m-1)
    Cm=first b bits of CC
    CP=last (128-b) bits of CC
    PP=Pm || CP
    Cm-1=XTS_blockEnc(key,PP,i,m)
4.return C=C1||...||Cm-1||Cm

//XTS_blockEnc calc step
key=key1||key2
T=Enc(key2, i) ⊗ (alpha^j)
PP = P ⊕ T
CC=Enc(key1, PP)
C=CC ⊕ T

//T ⊗ (alpha)// multiply T by alpha
//input：T
//output：T
Cin = 0;
for (j=0;j<16;j++)
{
    Cout=(T[j]>>7)&1
    T[j]=((T[j]<<1)+Cin) & 0xFF
    Cin=Cout
}
if Cout
    T[0]^=0x87//GF_128_FDBK

//XTS AES128_Enc Demo
//Input
//key-256bit-32byte
27F86757EE3A22CF321E2C04931DD95F//key1
9DAD1FD72D56817C4E3E0A49AA462378//key2
//i
11223344556677881122334455667788//must be a block
//plain-33byte
27C066D4F46C716C9C7F7ED01F4B6812
CAE8E5549F276F703D7AEBFA397A74D3
11

//output
6654931E11319CAECDA1801149E740E2
18713E0EC80926DF795E3613E6570E21
01

//block-1
//T = AES128_ECB(key2,i)
D1184F906DB0B8368CC8639E3F337011
//PP = P ⊕ T
27C066D4F46C716C9C7F7ED01F4B6812^
D1184F906DB0B8368CC8639E3F337011
=F6D8294499DCC95A10B71D4E20781803
//CC=Enc(key1, PP)
=Enc(27F86757EE3A22CF321E2C04931DD95F,F6D8294499DCC95A10B71D4E20781803)
=B74CDC8E7C8124984169E38F76D430F3
//C=CC ⊕ T
B74CDC8E7C8124984169E38F76D430F3^
D1184F906DB0B8368CC8639E3F337011
=6654931E11319CAECDA1801149E740E2

//block-2 and block-3 (last)
// T ⊗ (alpha)// multiply T by alpha
a2319e20db60716d1891c73c7f66e022

//calc CC
//CC = Pm-1 ⊕ T
CAE8E5549F276F703D7AEBFA397A74D3^
a2319e20db60716d1891c73c7f66e022
=68D97B7444471E1D25EB2CC6461C94F1
//CC=Enc(key1, CC)
=Enc(27F86757EE3A22CF321E2C04931DD95F,68D97B7444471E1D25EB2CC6461C94F1)
=A33A4CEE7D5D5BCFB8868304988D182B
//CC=CC ⊕ T
A33A4CEE7D5D5BCFB8868304988D182B^
a2319e20db60716d1891c73c7f66e022
=010BD2CEA63D2AA2A0174438E7EBF809

//Cm=first b bits of CC
Cm=01

//PP = Pm||CP=last(128-b) bits of CC
11||0BD2CEA63D2AA2A0174438E7EBF809

//clac Cm-1
// T ⊗ (alpha)// multiply T by alpha
44633c41b6c1e2da30228f79feccc045
//Cm-1 = PP ⊕ T
110BD2CEA63D2AA2A0174438E7EBF809^
44633c41b6c1e2da30228f79feccc045
=5568EE8F10FCC8789035CB411927384C
//Cm-1=Enc(key1, CC)
=Enc(27F86757EE3A22CF321E2C04931DD95F,5568EE8F10FCC8789035CB411927384C)
=5C12024F7EC8C405497CB96A189BCE64
//Cm-1=Cm-1 ⊕ T
5C12024F7EC8C405497CB96A189BCE64^
44633c41b6c1e2da30228f79feccc045
=18713E0EC80926DF795E3613E6570E21

C=C1||Cm-1||Cm
=6654931E11319CAECDA1801149E740E2||18713E0EC80926DF795E3613E6570E21||01

//原始数据-DES
4E6F77206973207468652074696D6520666F7220616C6C20  //3block=24byte=192bit
//Padding Method 1
4E6F77206973207468652074696D6520666F7220616C6C20
//Padding Method 2
4E6F77206973207468652074696D6520666F7220616C6C208000000000000000
//Padding Method 3
00000000000000C04E6F77206973207468652074696D6520666F7220616C6C20
//Padding Method 4
4E6F77206973207468652074696D6520666F7220616C6C20

IV = 00...00
for i = 1 to n //n分组
{
    temp = M_i XOR IV
    temp = Enc(K,temp)
    IV = temp;
}
最后一个密文block作为MAC

//《NIST-SP800-38B》
//Input，两个子密钥生成
Key
block cipher CIPH with block size b
//Output
subKeys K1、K2

//Step
1）当原文长度不是分组长度的整数倍时(10填充)，最后一组明文与k2异或后进行CBC加密
2）当原文长度为分组长度的整数倍时，最后一组明文(不需padding)与k1异或后进行CBC加密
3）T长度至少64bit

当消息为空，block数量为1，即10填充后，与k2异或后进行CBC加密

Prerequisites:
block cipher CIPH with block size b
key K

Output：
subkeys k1,k2

Suggested Notation：
SUBK(K)

Steps:
1.Let L = CIPH_k(0_b)//使用密钥对全0的分组做ECB加密
2.if MSB_1(L) = 0, then k1 = L<<1;
  else k1 = (L<<1) xor B_b //see follow
3.if MSB_1(k1) = 0, then K2 = k1<<1
  else k2 = (k1<<1) xor R_b
4.return k1,k2

R_128 = 0_120||10000111 = (0_15||87)hex
R_64 = 0_59||11011 = (0_7||1B)hex

//AES128-CMAC
//key
e07099f1bfaffd7f240cd790ca4fe134
//k1
7051501d5233e9d2e1f43857dc30888c
//k2
e0a2a03aa467d3a5c3e870afb8611118

L=DES_ECB(key,00.00)=3828A80EA919F4E970FA1C2BEE184446
MSB_1(L)=0,k1=L<<1=7051501d5233e9d2e1f43857dc30888c
MSB_1(k1)=0,k2=(k1<<1) =7051501d5233e9d2e1f43857dc30888c<<1=e0a2a03aa467d3a5c3e870afb8611118

//DES CMAC
 k1: 9cce53a2d96b4d28
 k2: 399ca745b2d69a4b
 key: e07099f1bfaffd7f
//calc subkey
L=DES_ECB(key,00.00)=4E6729D16CB5A694
MSB_1(L)=0,k1=L<<1=9cce53a2d96b4d28
MSB_1(k1)=1,k2=(k1<<1) xor R_b=399CA745B2D69A50 xor 000000000000001B=399CA745B2D69A4B

//msg
616263
//pad
6162638000000000
//pad(msg) XOR k2
58FEC4C5B2D69A4B
//res=Enc(key, (pad(msg) XOR k2))
EE3F707F2C11D297

399CA745B2D69A50
000000000000001B

//msg
248F9D
//msg||padding
248F9D8000000000
//res=Enc(key, (pad(msg) XOR k2))
Enc(1D133AC5B2D69A4B)
=B8F9226E6B34BAE4

//DES CMAC
 k1: 9cce53a2d96b4d28
 k2: 399ca745b2d69a4b
 key: e07099f1bfaffd7f
//calc subkey
L=DES_ECB(key,00.00)=4E6729D16CB5A694
MSB_1(L)=0,k1=L<<1=9cce53a2d96b4d28
MSB_1(k1)=1,k2=(k1<<1) xor R_b=399CA745B2D69A50 xor 000000000000001B=399CA745B2D69A4B

//iv
0000000000000000
//msg
0001020304050607
08090a0b0c0d0e0f
//pad
0001020304050607
08090a0b0c0d0e0f

//cbc加密第一个分组
58BD1B8CEBD10955

//第二分组与k1异或
08090a0b0c0d0e0f xor 9cce53a2d96b4d28
=94C759A9D5664327
//msg
0001020304050607
94C759A9D5664327

//整个msg做cbc
58BD1B8CEBD10955
87B39963013D547F

//SM4-CMAC
//key
E07099F1BFAFFD7F240CD790CA4FE134
k1: 1d016f274a3a18888c48f7e5401a17d2
k2: 3a02de4e947431111891efca80342fa4
//p
000102030405060708090a0b0c0d0e0f
101112131415161718191a1b1c1d1e1f
202122232425262728292a2b2c2d2e2f
303132333435363738393a3b3c3d3e3f
40

//cmac
09D7F12496D4E84C39C05F298FD39DC5

1）IV=0..0
Enc(IV XOR 000102030405060708090a0b0c0d0e0f)=20B93A0C8A401D018464875F408136DE

2)IV=20B93A0C8A401D018464875F408136DE
Enc(IV XOR 101112131415161718191a1b1c1d1e1f)
=Enc(30A8281F9E550B169C7D9D445C9C28C1)
=F1295C1E1FFABBDADC0E909E1E2E2DC2

3)IV=F1295C1E1FFABBDADC0E909E1E2E2DC2
Enc(IV XOR 202122232425262728292a2b2c2d2e2f)
=Enc(D1087E3D3BDF9DFDF427BAB5320303ED)
=DA3AEEDBDBAD4F411C2EA7F7D352138B

3)IV=DA3AEEDBDBAD4F411C2EA7F7D352138B
Enc(IV XOR 303132333435363738393a3b3c3d3e3f)
=Enc(EA0BDCE8EF98797624179DCCEF6F2DB4)
=E557ECCBA0181C95D0EDF6D566064081

//最后block非block整数倍，k2 xor 后加密
3) IV=K2=3a02de4e947431111891efca80342fa4
(K2 XOR 40800000000000000000000000000000)
=(7A82DE4E947431111891EFCA80342FA4)

Enc(E557ECCBA0181C95D0EDF6D566064081 XOR 7A82DE4E947431111891EFCA80342FA4)
=Enc(9FD53285346C2D84C87C191FE6326F25)
=09D7F12496D4E84C39C05F298FD39DC5

//SM4-CMAC
//key
e07099f1bfaffd7fe07099f1bfaffd7f
//plain
e07099f1bfaffd7fe07099f1bfaffd7f
e07099f1bfaffd7fe07099f1bfaffd7f
e07099f1bfaffd7fe07099f1bfaffd7f

//mac
458AB613526E09AB50C7A7B8EC6CD753

//流程
 k1: 22b4c22b9e8e8b9c23c9da876039a8dc
 k2: 456984573d1d17384793b50ec07351b8

1）IV=0..0
Enc(IV XOR block1)=1B2273875F25284EA8823A473CD88E5C

2)IV=1B2273875F25284EA8823A473CD88E5C
Enc(IV XOR block2)
=Enc(1B2273875F25284EA8823A473CD88E5C XOR e07099f1bfaffd7fe07099f1bfaffd7f)
=Enc(fb52ea76e08ad53148f2a3b683777323)
=F76BFA239CC75759CB83F8D78E7B30DF

3) IV=K1=22b4c22b9e8e8b9c23c9da876039a8dc
(K1 XOR block3)
=(22b4c22b9e8e8b9c23c9da876039a8dc XOR e07099f1bfaffd7fe07099f1bfaffd7f)
=(c2c45bda212176e3c3b94376df9655a3)

Enc(c2c45bda212176e3c3b94376df9655a3 XOR F76BFA239CC75759CB83F8D78E7B30DF)
=Enc(35afa1f9bde621ba083abba151ed657c)
=458AB613526E09AB50C7A7B8EC6CD753

//TDES128
//key
E07099F1BFAFFD7F240CD790CA4FE134
k1: f72b4ee8a67f18ae
k2: ee569dd14cfe3147
//p
0001020304050607
08090a0b0c0d0e0f

//std_mac
E4C3593AD6F86AA9

1）IV=0..0
Enc(IV XOR block1)=C0D92C81A7AE8D03

2)IV=C0D92C81A7AE8D03
(k1 xor block2)
=f72b4ee8a67f18ae xor 08090a0b0c0d0e0f
=FF2244E3AA7216A1

CBC(IV, (FF2244E3AA7216A1))
=E4C3593AD6F86AA9

//输入
    K：秘密密钥
    message：消息
    w：压缩分组大小（哈希函数分组大小）
    Tlen：要求的MAC标记长度
//输出
    Tag：MAC标记

1. if length(K) > w then
    K = hash(K)
   else
    对K进行0填充至w字长
2. hmac = hash((opad XOR K) || hash(ipad XOR K || message))
3. 通过只保留前Tlen字节作为Tag

注：
1）ipad为00110110(0x36)的循环，直到达到单项散列函数的分组长度。
2）opad为01011100(0x5C)的循环，直到达到单项散列函数的分组长度。

//手动计算与在线计算验证HSHA256（分组512bit，输出256bit）
M：ABC（hex格式：616263）
K：313233343536（hex格式）
alg：SHA256
//在线计算
res：f6ced6f4883ffc0981a6b9945819f680102b43097ad8ef7a0df9bde06fb3d2e4

//手动计算，运算过程均为hex，验证成功
//K = K(pad)
31323334353600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
//ipadKey = ipad XOR K:
36363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636^
31323334353600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
=07040502030036363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636
//opadKey = opad XOR K
5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C^
31323334353600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
=6D6E6F68696A5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C
//SHA256(ipadKey || meassage)
=SHA256(07040502030036363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636363636||616263)
=29B4C2EE6B7392016EEB0E5729790C1F299B551F54902E78AD049BC33D8EF29C
//Tag=SHA256(opadKey||SHA256(ipadKey || meassage))
SHA256(6D6E6F68696A5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C||29B4C2EE6B7392016EEB0E5729790C1F299B551F54902E78AD049BC33D8EF29C)
=F6CED6F4883FFC0981A6B9945819F680102B43097AD8EF7A0DF9BDE06FB3D2E4

//Input
Key //128bit
Plaintext //could be NULL
//preprocess：calc subkey
t1 = 0x010101010101010101010101010101
t2 = 02020202020202020202020202020202
t3 = 03030303030303030303030303030303
K1 = AES128_ECB_ENC(Key, t1)
K2 = AES128_ECB_ENC(Key, t2)
k3 = AES128_ECB_ENC(Key, t3)
//Output
Mac //occupy 12 Bytes

//Step
1）初始iv全0
2）中间block进行CBC运算
1）当原文长度不是分组长度的整数倍时(10填充)，最后一组明文与k3异或后进行CBC加密
2）当原文长度为分组长度的整数倍时，最后一组明文(padding)与k2异或后进行CBC加密
//《NIST-SP800-38B》

//SM9椭圆曲线参数(y^2 = x^3 +ax +b)
//p
B640000002A3A6F1D603AB4FF58EC74521F2934B1A7AEEDBE56F9B27E351457D
//a
0000000000000000000000000000000000000000000000000000000000000000
//b
0000000000000000000000000000000000000000000000000000000000000005
//Gx
93DE051D62BF718FF5ED0704487D01D6E1E4086909DC3280E8C4E4817C66DDDD
//Gy
21FE8DDA4F21E607631065125C395BBC1C1C00CBFA6024350C464CD70A3EA616
//n
B640000002A3A6F1D603AB4FF58EC74449F2934B18EA8BEEE56EE19CD69ECF25
//h
1

由上图可知H<sub>2</sub>和H<sub>1</sub>的区别在于计算H<sub>a</sub>的第一个字节值，对于SM9的椭圆曲线参数，log2 N=256，hlen=8 * 5 * 256 / 32 = 320bit，占用40字节。因此计数器ct只需要[1,2]，第2次计算hash值只截取前8字节。

这里似乎可以使用预计算加速h的计算，待研究。

//g=(P1, Ppub-s)，其中P1为系统参数群1生成元，xy各占32byte，Ppub-s为签名主公钥，是二次扩域上点，xy各有两个分量，各占32bytes
//计算数值Demo
//Ppub-s(128bytes)
9f64080b3084f733e48aff4b41b565011ce0711c5e392cfb0ab1b6791b94c408//x_re
29dba116152d1f786ce843ed24a3b573414d2177386a92dd8f14d65696ea5e32//x_rm
69850938abea0112b57329f447e3a0cbad3e2fdb1a77f335e89e1408d0ef1c25//y_re
41e00a53dda532da1a7ce027b7a46f741006e85f5cdff0730e75c05fb4e3216d//y_rm
//P1(64bytes)
93DE051D62BF718FF5ED0704487D01D6E1E4086909DC3280E8C4E4817C66DDDD
21FE8DDA4F21E607631065125C395BBC1C1C00CBFA6024350C464CD70A3EA616
//t=e(P1,Pupub-s)[32*2*3*2=32*12bytes]
4E378FB5561CD0668F906B731AC58FEE25738EDF09CADC7A29C0ABC0177AEA6D28B3404A61908F5D6198815C99AF1990C8AF38655930058C28C21BB539CE000067E0E0C2EED7A6993DCE28FE9AA2EF56834307860839677F96685F2B44D0911F5A1AE172102EFD95DF7338DBC577C66D8D6C15E0A0158C7507228EFB078F42A6B3129A75D31D17194675A1BC56947920898FBF390A5BF5D931CE6CBB3340F66D4C744E69C4A2E1C8ED72F796D151A17CE2325B943260FC460B9F73CB57C9014B38BFFE40A22D529A0C66124B2C308DAC9229912656F62B4FACFCED408E02380FA01F2C8BEE81769609462C69C96AA923FD863E209D3CE26DD889B55E2E3873DB1604A3FCFA9783E667CE9FCB1062C2A5C6685C316DDA62DE0548BAA6BA30038B93634F44FA13AF76169F3CC8FBEA880ADAFF8475D5FD28A75DEB83C44362B43984B87422330D7936EABA1109FA5A7A7181EE16F2438B0AEB2F38FD5F7554E57AAAB9F06A4EEBA4323A7833DB202E4E35639D93FA3305AF73F0F071D7D284FCFB

//二次扩域下的点乘
//k
2
//Gx
85AEF3D078640C98597B6027B441A01FF1DD2C190F5E93C454806C11D8806141 //Gx_1
3722755292130B08D2AAB97FD34EC120EE265948D19C17ABF9B7213BAF82D65B //Gx_2
//Gy
17509B092E845C1266BA0D262CBEE6ED0736A96FA347C8BD856DC76B84EBEB96 //Gy_1
A7CF28D519BE3DA65F3170153D278FF247EFBA98A71A08116215BBA5C999A7C7 //Gy_2

//[k]G-x
513F149AB53E94BB3A0367C61FF87670E025DB30C57F84594E4BA4D7B3C656CF
2A74F8561B91993205EB512576AD56221EA5963F3DA078240D55594FB051EA86
//[k]G-y
776DE41DB0511B8976D69C982DD4757D641487C68D13CBEE7069396C20CD3459
8E3D9EC4E63D5B9F83081FB97B715430C8BFC6F1A1321A89627B9A4E8961C7BD

//以上在OSR_driver里，Gx和Gy，整体U8小端配置到寄存器

//[n-1]G
//sm9-p
B640000002A3A6F1D603AB4FF58EC74521F2934B1A7AEEDBE56F9B27E351457D
//y_1 = sm9-p - Gx_1
9EEF64F6D41F4ADF6F499E29C8CFE0581ABBE9DB7733261E6001D3BC5E6559E7
//y_2 = sm9-p - Gx_2
7F1D8AAD70909BE90358F1D02240062433CC3A0248DED72FEBB879EC33CE6F22

//g = e(P1, P2)，P1群的生成元P1，
//主公钥128byte--二次扩域上的点，有x、y坐标构成，每个坐标有2个分量

//计算g = e(C, deA), C为素数基域上的点，deA为二次扩域上的点，g为12次扩域上的点 
1.r = rand[1, N-1]
2.Q = [r]P2 //Q为二次扩域上的点(Qx0||Qx1, Qy0||Qy1)，128B  //循环群G2的点是二次扩域Fp2的点
3.R = (Qx, (p-Qy0)||(p-Qy1)) = (Qx, -Qy)
4.e(C,deA + R)*e(C, Q)
  =e(C,deA + R + Q) //R和Q互为负点
  =e(C, deA)

//RSA2048
//e
10001
//d
58D83FB05C894A8A7CCD708B9E6DA8515E06009AC2D736A00DD2D40C552A037BECA9D30EBA86A6985D003AED2D1D233D540BBD19A13730317C4FCC18EAF171B4765E3E0809BBCAF2936EB1DD3168160174169935CB4EEBBC77B78FFA79A83467F34C2E6C93ECA3FFE528DA4E91D850BC0333D432E93682EBE7528918F920DFA0CA65B8DAC5E216A297AB4C82A35B040E95E4E95F3DC1FF71FBCE0338F8020C2DD03F0DC423FFDB4F6CD0C116E4D53248E91ED36189921D2D20F996B3D06CCF0634F1A0D68E8CC18B98E348B11EB8BEAF5F49F4DD4FE917EC2682298924B29FC5ABF1E2C751286399F2B3318980C7408AE2E73969248A9953D28F405F946D3F01
//n
F6A32EDA0C98C1D74E984DFFFD26AD5101BA6952B5D995E580AE8FD2A48C1BD310A1B30EFB497D57EAC0ABE92F6406E1485C7CFA84375CA81587294D06191F08AD0263D4B585E80A0BA3687D4D8674DE897FED6575C56EE75049A5CD44D26F63960936D59AC6920CC3CDADD75BF174349D042853408EBFBE8723D518BF7A537ABDD7F82952EAAF6226856F8C28783A2CBE85D6275C6EE089E22EC11F771F0488B04780F5B263454DB13C77188A641D5C2FA8A9248910129EEC71A2E03C05FF5BE3E83D244ABD8B89BB2274BA71D5850471F7285CF743DE7328CC74CCA7918195812153623A587B57A0AE25C5A4B440AE9181ABAA7C5B09901B47F461C09986F3

//p
FEA137FD595620504DE3CCEC7F99CB6542EB70000EF68AEE4A877321CC504B2073BF16E2FC867F95A0772126BE073BB93A08EB36E90973892B51DF96BD8739B179E3CCB1D479BA1A64CD266B5C7940410F978DD9403C122F9505FB2E101989650525F2E70607DCCD6F438476DE4ABEDFC84FAD8F253F8CCB6343620DA5578E91
//q
F7F6F437708C87628AD6DAC60134C16F52CAE67FB5E767B2068538EBEF64EE27203312DABCC2522CEAAF7F5405A90EC4687BF3B59E13E865ABE258DF687431CF800DBEDE09F6F4D33F451103F6CDDA51C36EBD656329066AA1C2A8578FF79E0D7BD0306898DC95253BF1BDB5FB94F461B41792E1272E3FA06A419CAA1C554743
//dp=eInv mod p-1
3B06744C2E6160AC3CE209A6E90D65B0DB8A68341B43DB80D1960482593263B7EA1CE9D944608942CE27CF6F83AD7992BE7942CD3FC809184B0A77A221DD2EEA8D2ED94C7FCC97EF765E78017B364046D4AE751B5F608D76AA3CF0B504D6669B1C4E67B856158C81B2C11BFBD21BD1935E83D9DFCCEAA6609F6A0758D2733181
//dq=eInv mod q-1
968C7B6E05896CD1699655318E9DE72B9DCACEF38F0FB627A249D46B7AE77EA886A63BB64E9074B00CB50CCB88BC41D901CEF002BEBD3B862F3BB7D5BC677FAE8A02CE75A4FB295DF0B61044A5DE09C546B0BF9105096D79E4487948E081E8962B2C15980BE7312E701CAFA003E54612E3F2C41CAB5B2B0A4C3915D33A6C945D
//u=qInv mod p
896EA479B6B4CD371FF8ED70EE18D2986489D31D310E1F0CC3C10139105538C811F5C355B69C2B3D74AF9F21FAD9C999D6F4B80872476D96557429C1A7C2EF31E5471BBD2AFF3E1480A5239CB1815F61719A3CAB4A1057FE4E934E7C72C4DB4129E124F5BE600F22318963BAFA7EF625C1A5E2B491310391F7774670346D8B73


//m=11223344
//m^d mod n
69717BD50F3E04B30A68FAD9439FCB023631511A3AAD9B472D30D480B79ABF89D5498882E0E0EF05F6CAB3ACDF3B0E41FC91A3C23C5BE7109EB58CF26D618BC9657454FF2CEEEC902C84399FECAD66E33A69571A5472964D52494E5F165A87C64E5B82D3DAC36E59008BF3BA6D52FAEB54FDE27B51A03CADC6D197825BF60502F21CD8C2FC35DF134ABE3D44F460F5565D00831AF21DC939C5926A05A8AC03CFB8702673F2B1819BDF44A4B4100FEA9D214D5E29267E9D5DC9775CE876B0DC608057DD1F70D16AF0E7ED1E12A2A7F9537423605CF9043637917B515EE2144CA9AA1D651EA55632F1D470235A237CFB97597E202F2504D7CCA2840B8969D36F87

//m1=m^dp mod p
E726FD1B53A390F6A482292A2C0D82A9672C8D8D175C67F9E910C1379EDACE7F81FFD9EE6CCC13DF6C46C9B85749301A4991FA059A966F89A66ADB460770EE2C9E8CB92AFA4EB4D56C6534BB0EF83DAF959656B7AB5F47734381BDB31B02892DDED0523049485E59C6BCB139448CAD3E3A39A1DFAB9D73FC2FE661661F56F199
//m2=m^dq mod q
7C98F4FFCEB47BE7A484543FD8AFA96FA872F0C7DF06FE24C445F3FDEA932F31E4DA4994F5112C65A4467BAF645A75ACABBFB9718EB9DEB3E785F25829235D3F64BCC98DED351D9FCA1D2C7540ED3CA5508FC1A7EB8E2469D498AF5091FFA66960D0795D0C368459904D6806975EBACD15B834E5CBB861CD57E91DD694D699A5

//(m1-m2) mod p
6A8E081B84EF150EFFFDD4EA535DD939BEB99CC5385569D524CACD39B4479F4D9D25905977BAE779C8004E08F2EEBA6D9DD240940BDC90D5BEE4E8EDDE4D90ED39CFEF9D0D199735A2480845CE0B010A4506950FBFD123096EE90E628902E2C47DFFD8D33D11DA00366F4932AD2DF27124816CF9DFE5122ED7FD438F8A8057F4
//h=qInv * (m1-m2) mod p
6CDC3647F6DC3050558B99A6F9129DC823102832BE44475E0832C09787A52119B855BBB66C4E64EC2DE9D949B5F62875C1436D4B889BF868F51E9EACD10EE4C0D3D2B7D1E1B26D561D66B257989D76E933818A1CB84C2392C12FB697A053F7191D16D56EF2356DB65575EF90247C3A42510F7D24F0C6BC1FD296127224C1BF76

//h*q
69717BD50F3E04B30A68FAD9439FCB023631511A3AAD9B472D30D480B79ABF89D5498882E0E0EF05F6CAB3ACDF3B0E41FC91A3C23C5BE7109EB58CF26D618BC9657454FF2CEEEC902C84399FECAD66E33A69571A5472964D52494E5F165A87C64E5B82D3DAC36E59008BF3BA6D52FAEB54FDE27B51A03CADC6D197825BF605027583E3C32D81632BA639E9051BB14BE6B48D92531316CB15014C7607BE18D49DD395DCDEFDA055363AFE2904ABB574F0758DA4B797C4BEA9E1F16A904D8D7F211B9B1391839C4D511DCFF19D61BABCAE23939EB50D7611CDBCE2A20E5014A640494CEBC1991FAE984422BB538C1E40CA43C5EB49594C75FF4A9AEDB2D4FCD5E2
//C=m2+h*q
69717BD50F3E04B30A68FAD9439FCB023631511A3AAD9B472D30D480B79ABF89D5498882E0E0EF05F6CAB3ACDF3B0E41FC91A3C23C5BE7109EB58CF26D618BC9657454FF2CEEEC902C84399FECAD66E33A69571A5472964D52494E5F165A87C64E5B82D3DAC36E59008BF3BA6D52FAEB54FDE27B51A03CADC6D197825BF60502F21CD8C2FC35DF134ABE3D44F460F5565D00831AF21DC939C5926A05A8AC03CFB8702673F2B1819BDF44A4B4100FEA9D214D5E29267E9D5DC9775CE876B0DC608057DD1F70D16AF0E7ED1E12A2A7F9537423605CF9043637917B515EE2144CA9AA1D651EA55632F1D470235A237CFB97597E202F2504D7CCA2840B8969D36F87

1.挑选两个不同的大素数p、q，令N=p*q
2.利用Euler函数计算Φ(N)=(p-1)(q-1)
3.挑选一个整数e，满足：1<e<Φ(N)，gcd(e,Φ(N))=1
4.计算d，满足：d*e≡1 (mod Φ(N))
5.(e,N)作为公钥，(d,N)作为私钥

1024bit示例：
//x
11223344
//e
10001
//d
23075234F1770E2356480F0D91ED1F51D823B8C1F23547D40F1871FD9A7193EF0EA1D22508078E76753971597BDB016D2E71CC80F565B5D530B412ACE635AE3EF2ADD0B624071F4CEA9F609E0F65B0289DD173C169729CFE36E7EF4B2033358DE63CF6E4CF9AE5078D43C428BFC38F38F4672F71BC1616EE4711A03BE3E767C1
//d1
23075234F1770E2356480F0D91ED1F51D823B8C1F23547D40F1871FD9A7193EF0EA1D22508078E76753971597BDB016D2E71CC80F565B5D530B412ACE635AE3EF2ADD0B624071F4CEA9F609E0F65B0289DD173C169729CFE36E7EF4B2033358DE63CF6E4CF9AE5078D43C428BFC38F38F4672F71BC1616EE4711A03BE3E76700
//d2
C1

//p即n
B0EAA37021B25702ED99D4DD9CC734B1DD1253722B6350AD6F0B11CBD886C1323D922A6EFF4D2627D88A637D93D13A8EFDC53008E03FFC1C89CF747F62DA3571BEA9A16DE4C65612CE49BDF9A7E5A588BA8F9B4517BEA84DE5A45CF27B53008BB66E08BE903FC9DF71E8D76F4E174A50A8B6648E74EFC45FF4612EB35E960631

//k
FF

----------calc----------
//1+e*k
1+FF00FF
=FF0100

//d1*(1+e*k)
22E46DEA0EBA888C41151D469368C41FA59D6D2CE90504C182DD68A40ED4BCCCB3823EF4B5248EEF8D3AAD2193B8A246C2B0892640F1458511588F4E4BFC5EC661FA15933E993C34BD01ABDCD1F459DE255C401F1BCA93D3D5AF3E43C45E228B8DE4A02AE1B019BD6ABE0DA85B2C8B6D4AABBCA979CBBCED6FB8D5AD483F6380670000

//d2*(1+e*k)
C03FC100

//d1*(1+e*k)+d2*(1+e*k)
22E46DEA0EBA888C41151D469368C41FA59D6D2CE90504C182DD68A40ED4BCCCB3823EF4B5248EEF8D3AAD2193B8A246C2B0892640F1458511588F4E4BFC5EC661FA15933E993C34BD01ABDCD1F459DE255C401F1BCA93D3D5AF3E43C45E228B8DE4A02AE1B019BD6ABE0DA85B2C8B6D4AABBCA979CBBCED6FB8D5AD483F6440A6C100

//t=d1*(1+e*k)+d2*(1+e*k)-k
22E46DEA0EBA888C41151D469368C41FA59D6D2CE90504C182DD68A40ED4BCCCB3823EF4B5248EEF8D3AAD2193B8A246C2B0892640F1458511588F4E4BFC5EC661FA15933E993C34BD01ABDCD1F459DE255C401F1BCA93D3D5AF3E43C45E228B8DE4A02AE1B019BD6ABE0DA85B2C8B6D4AABBCA979CBBCED6FB8D5AD483F6440A6C001

//c=x^t mod n
000FB212D1E54C45D537ADBB5CFAB00E4DA49D791BB3FCF80B6215C7EEE45D8B7B5EAFD126B4F233D2FBF2CD874F5AD275FD8B371A827636E610AF80B3D3A42781CC19B9CF6226CAA904AA379FD88001A3114FC2AFB2161DC27D93CBC8024CAEA9B540B316DDBD8E7A40DD14F17BE0575E1289F1E2101169891D655C69E87BD8

//c=x^d mod n
同上

//判断n是否为素数
1. rand get a, 2<=a<=n-2
2.if gcd(a,n) == 1, goto step3
3.if a^(n-1)=1 mod n, n maybe is prime
4.repeat m times tesp1-step3

n's probability is prime 1-1/2^(m) 

//sign
//e=SM3(Z || M)，私钥d
while(1)
{
    k = rand(1,n-1);
    [k]G = (x1,y1);
    r = (e+x1) mod n;
    if(r == 0 || r+k == n) 
        continue;
    s = (1+d)^-1(k-r*d) mod n;//这里d不能为N-1
    if(s == 0) continue;
    return (r,s);
}

//sm2签名防护方案--数据盲化
//Δ和rg为随机值
s=((dA - Δ + 1)*rg + Δ*rg)^(-1) * (k+r)*rg - r mod N
=((dA - Δ + 1 + Δ)*rg)^(-1) * (k+r)*rg - r mod N
=[(dA+1)*rg]^(-1) * (k+r)*rg - r mod N
=(dA+1)^(-1) * rg^(-1) * (k+r)*rg - r mod N
=(dA+1)^(-1) * (k+r) -r mod N
=(dA+1)^(-1) * (k+r) -r*(dA+1)^(-1) * (dA+1) mod N
=(dA+1)^(-1) * (k+r - r*(dA+1)) mod N
=(dA+1)^(-1) * (k+r - r*dA - r) mod N
=(dA+1)^(-1) * (k- r*dA) mod N

//verify
if(publickey is not on ECC and not be 0(加法群的单位元)) return fail;
if(r and s are not in [1,n-1]) return fail;
t = (r+s) mod n;
if(t == 0) return fail;
X(x1,y1) = [S]G + [t]P; //这里，[s]G + [t*dA]G = [k]G, 即s+t*dA = k
R = (e+x1) mod n;
if(R == r) return succeed;
    else return fail;

//验签安全方案
e mod n //加扰 引入假动作（不管e是否满足小于n）
x mod n //加扰 引入假动作（不管x是否满足小于n）

//Enc
//已知明文M，密文接收者公钥Pa
k = get_rand_from(1,n-1)
C1 = [k]G //64字节
Z = [h]Pa //h=1,该步骤省略
[k]Pa = (x2,y2) //[k]Pa = [k * dA]G
t = KDF(x2 || y2)
C2 = M XOR t
C3 = SM3(x2 || M || y2) //32字节,认证作用
return C1 || C3 || C2  //比原文多97字节

//安全方案
使用硬件版本安全点乘

//dec
//已知密文C1C2C3，解密者私钥da
check_C1_On_ECC(C1)
Z = [h]C1 //h==1
if Z == 无穷远点 return fail //略
[da]C1 = (x2,y2) //[dA]C1 = [dA * k]G
t = KDF(x2 || y2)
m = C2 XOR t
u = SM3(x2 || m || y2)
if (u != C3) return fail
return m

//协商流程，用户A为发起方，用户B为响应方
//A方：公私钥对(dA，PA)、临时公私钥对(rA，RA)，【B方ID、B方公钥Pb,对方临时公钥Rb】,ZA,ZB
//B方：公私钥(dB,PA)、临时公私钥对(rB,RB)，【A方ID、A方公钥Pa，对方临时公钥Rb】，ZA，AB

//用户A
x1' = 2^w+(RA_x & (2^w - 1)) //w=127，取低位127bit，高位1byte异或0x80
tA = (dA + x1' * rA) mod n
if RB not on sm2_curve 
    return fail
else
    x2' = 2^w + (RB_x & (2^w - 1))
U = [h*tA](PB + [x2']RB) = (xU, yU)
if U is 0 
    return fail
else
    KA = KDF(xU||yU||ZA||ZB, klen)
(optional)
{
S1 = Hash(0x02 || yU || Hash(xU||ZA||ZB||RA_x||RA_y||RB_x||RB_y))
if S1 == SB return exchange_key success else fail
SA = Hash(0x03 || yU || Hash(xU||ZA||ZB||RA_x||RA_y||RB_x||RB_y))
}

//用户B
x2' = 2^w + (RB_x & (2^w - 1))
tB = (dB + x2' * rB) mod n
if RA not on sm2_curve 
      return fail
else
      x1' = 2^w + (RA_x & (2^w -1))
V = [h*tB](PA + [x1']RA) = (xV,yV)
if V is 0 
      return fail
else
      KB = KDF(xV||yV||ZA||ZB, klen)
SB = Hash(0x02 || yV || Hash(xV||ZA||ZB||RA_x||RA_y||RB_x||RB_y))
return RB (optional)SB to 用户A
(optional)
{
S2 = Hash(0x03 || yV || Hash(xV||ZA||ZB||RA_x||RA_y||RB_x||RB_y))
if S2 == SA return exchange_key success else return fail
}

//密钥交换
//IDa
31323334353637383132333435363738
//Z=SM3(bitLenofID|| ID|| a || b || Gx || Gy || Xa || Xy)
=SM3(0080||31323334353637383132333435363738||FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC||28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E93||32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7||BC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0||160E12897DF4EDB61DD812FEB96748FBD3CCF4FFE26AA6F6DB9540AF49C94232||4A7DAD08BB9A459531694BEB20AA489D6649975E1BFCF8C4741B78B4B223007F)
=SM3(008031323334353637383132333435363738FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E9332C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7BC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0160E12897DF4EDB61DD812FEB96748FBD3CCF4FFE26AA6F6DB9540AF49C942324A7DAD08BB9A459531694BEB20AA489D6649975E1BFCF8C4741B78B4B223007F)
=3B85A57179E11E7E513AA622991F2CA74D1807A0BD4D4B38F90987A17AC245B1

//Sponsor
//dA
81EB26E941BB5AF16DF116495F90695272AE2CD63D6C4AE1678418BE48230029
//ZA
3B85A57179E11E7E513AA622991F2CA74D1807A0BD4D4B38F90987A17AC245B1
//rA
D4DE15474DB74D06491C440D305E012400990F3E390C7E87153C12DB2EA60BB3
//RA
64CED1BDBC99D590049B434D0FD73428CF608A5DB8FE5CE07F15026940BAE40E//x1
376629C7AB21E7DB260922499DDB118F07CE8EAAE3E7720AFEF6A5CC062070C0//t1
//[S1]
D3A0FE15DEE185CEAE907A6B595CC32A266ED7B3367E9983A896DC32FA20F8EB
//[SA]
18C7894B3816DF16CF07B05C5EC0BEF5D655D58F779CC1B400A4F3884644DB88

//dB
785129917D45A9EA5437A59356B82338EAADDA6CEB199088F14AE10DEFA229B5
//PB
6AE848C57C53C7B1B5FA99EB2286AF078BA64C64591B8B566F7357D576F16DFB
EE489D771621A27B36C5C7992062E9CD09A9264386F3FBEA54DFF69305621C4D
//ZB
79C988D63229D97EF19FE02CA1056E01E6A7411ED24694AA8F834F4A4AB022F7
//rB
7E07124814B309489125EAED101113164EBF0F3458C5BD88335C1F9D596243D6
//RB
ACC27688A6F7B706098BC91FF3AD1BFF7DC2802CDB14CCCCDB0A90471F9BD707
2FEDAC0494B2FFC4D6853876C79B8F301C6573AD0AA50F39FC87181E1A1B46FE
//[S2]
18C7894B3816DF16CF07B05C5EC0BEF5D655D58F779CC1B400A4F3884644DB88
//[SB]
D3A0FE15DEE185CEAE907A6B595CC32A266ED7B3367E9983A896DC32FA20F8EB

//k
6C89347354DE2484C60B4AB1FDE4C6E5

//取x1'=2^127+(x1&(2^127 - 1)) //x1为RA的x坐标，保留低127bit
x1'=2^127 + CF608A5DB8FE5CE07F15026940BAE40E=CF608A5DB8FE5CE07F15026940BAE40E
//tA=(dA+x1'*rA) mod n
tA=(dA+CF608A5DB8FE5CE07F15026940BAE40E*D4DE15474DB74D06491C440D305E012400990F3E390C7E87153C12DB2EA60BB3) mod FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123
=(81EB26E941BB5AF16DF116495F90695272AE2CD63D6C4AE1678418BE48230029+BB7D99D62C08B4264BECE7B73443579195F483A72E7239F2993AD3692DC40DE0) mod n
=3D68C0C06DC40F17B9DDFE0093D3C0E4969ED1124A187FA8AD02F81E3C11CCE6

//取x2'=2^127+(x2&(2^127 - 1)) //x2为RB的x坐标，保留低127bit
x2=2^127 + 7DC2802CDB14CCCCDB0A90471F9BD707=FDC2802CDB14CCCCDB0A90471F9BD707
//U=[h*tA](PB + x2'*RB) //h=1
=tA*PB + [tA*x2' mod n]RB
=tA*PB + [3D68C0C06DC40F17B9DDFE0093D3C0E4969ED1124A187FA8AD02F81E3C11CCE6*FDC2802CDB14CCCCDB0A90471F9BD707 mod n]RB
=tA*PB + [20B34E8F94D2B962B9CC15ADA9F3E7C83601A2C02E4BACF0D6610B668A9AAE3F]RB
=[3D68C0C06DC40F17B9DDFE0093D3C0E4969ED1124A187FA8AD02F81E3C11CCE6]PB +[20B34E8F94D2B962B9CC15ADA9F3E7C83601A2C02E4BACF0D6610B668A9AAE3F]RB
=C558B44BEE5301D9F52B44D939BB59584D75B9034DD6A9FC826872109A65739F||3252B35B191D8AE01CD122C025204334C5EACF68A0CB4854C6A7D367ECAD4DE7

//KA=KDF(Ux||Uy||ZA||ZB, klen)
//KA_16byte_0
=SM3(C558B44BEE5301D9F52B44D939BB59584D75B9034DD6A9FC826872109A65739F||3252B35B191D8AE01CD122C025204334C5EACF68A0CB4854C6A7D367ECAD4DE7||3B85A57179E11E7E513AA622991F2CA74D1807A0BD4D4B38F90987A17AC245B1||79C988D63229D97EF19FE02CA1056E01E6A7411ED24694AA8F834F4A4AB022F7||0x00000001)
=6C89347354DE2484C60B4AB1FDE4C6E579391A21FA6CB72AE8754EC21AD8B703
=6C89347354DE2484C60B4AB1FDE4C6E5//取前面16byte


//下面获取KB
...


总结:
1.己方：已方临时公钥x坐标低127bit，高bit异或上1，结合己方私钥和乙方临时私钥，计算t
2.己方：对方临时公钥x坐标低127bit，高bit异或上1，结合对方公钥和对方临时公钥，计算U
3.通过U和双方Z值计算KDF

//以spec160k1为例，SHA1("abc")=023097D223405D8228642A477BDA255B32AADBCE4BDA0B3F7E36C9DA7
//曲线nbit=161位
//若hash长度比nbit小，实际运算大数就是hash值
//若hash长度比nbit大，实际运算大数：从左边开始截取nbit，注意2是0010开始，非10开始
//Z
0x4612fa44680bb0450c8548ef7b44ab66555b79c9 //数值从右往左4bit转换   《FIPS 186-5》


/* 以下忽略 历史描述
//(0x023097D223405D8228642A477BDA255B32AADBCE4BDA0B3F7E36C9DA7)转2进制，注意实际大数(4bit一个块)
000000100011000010010111110100100010001101000000010111011000001000101000011001000010101001000111011110111101101000100101010110110011001010101010110110111100111001001011110110100000101100111111011111100011011011001001110110100111
//从左往右截取161bit
00100011000010010111110100100010001101000000010111011000001000101000011001000010101001000111011110111101101000100101010110110011001010101010110110111100111001001
//转成U8，161比特需要高位补3bit0
00000100011000010010111110100100010001101000000010111011000001000101000011001000010101001000111011110111101101000100101010110110011001010101010110110111100111001001
//转U8
0x04612fa44680bb0450c8548ef7b44ab66555b79c9
0x04612fa44680bb0450c8548ef7b44ab66555b79c
  以上忽略 历史描述 */

//(0x023097D223405D8228642A477BDA255B32AADBCE4BDA0B3F7E36C9DA7)转2进制，注意实际大数(8bit一个块,字节对齐)
000000100011000010010111110100100010001101000000010111011000001000101000011001000010101001000111011110111101101000100101010110110011001010101010110110111100111001001011110110100000101100111111011111100011011011001001110110100111
//从左往右截取161bit
00000010001100001001011111010010001000110100000001011101100000100010100001100100001010100100011101111011110110100010010101011011001100101010101011011011110011100
//转成U8，161比特需要高位补7bit0（相当于右移7bit）
0000000||00000010001100001001011111010010001000110100000001011101100000100010100001100100001010100100011101111011110110100010010101011011001100101010101011011011110011100
//转U8
0x00||04612fa44680bb0450c8548ef7b44ab66555b79c（161bit取21Byte）

//e=Hash(m)
//z=e从左边截断的Ln个bit构成大数，Ln是曲线阶n的bit长度
while(1)
{
    k = rand(1,n-1);
    [k]G = (x1,y1);  //[k-r]G + [r]G   //[k+1]G
    r = x1 mod n;
    if(r == 0) 
        continue;
    s = k^(-1)*(z+r*dA) mod n; //r=0，r*dA无意义
    if(s == 0) continue;
    return (r,s);//(rf,sf)
}

1.calc e=hash(m)
2.let z be the left most of e
3.get the k randomly chosen from [1,n-1]
4.calc the curve point(x,y)=[k]G，r=x, if r=0 return back to step 3
5.calc s=(z+r*dA)/k(mod n) if s=0 return back to step 3
6.return (r,s)

//硬件算子
Input：消息hash值e, 私钥dA, 曲线参数
Output：签名值rs 
while(1)
{
    e = pre_process(e) //参考SEC1-V2—2009
    k = rand(1,n-1);
    [k]G = (x1,y1);  //1次点乘
    r = x1 mod n; //1次模运算
    if(r == 0) 
        continue;
    s = k^(-1)*(e+r*dA) mod n; //1次模逆，2次模乘，1次模加
    if(s == 0) continue;
    return (r,s);
}

//使用公钥和消息m，对签名进行验证
//verify
if(publickey is not on ECC and not be 0(无穷远点，加法群的单位元)) return fail;
if(r and s are not in [1,n-1]) return fail;
e = Hash(m);
z = get(z) //e从左边截断的Ln个bit构成大数，Ln是曲线阶n的bit长度
u1 = z * s^(-1) mod n
u2 = r * s^(-1) mod n
[u1]G + [u2]Pa = (x1, y1)
if(X == 无穷远点) return fail;
v = x1 mod n
if(v == r) return succeed;
    else return fail;

z * s^(-1) * G + r * s^(-1) * Q
=z * s^(-1) + r * s^(-1) * dA * G
=[z * s^(-1) + r * s^(-1) * dA]G
=[s^(-1)](z + r * dA) * G
即要[s^(-1)](z + r * dA)等价于[k]

由s = k^(-1)*(z+r*dA) mod n，两边同乘k，除s，得到k=[s^(-1)](z + r * dA) mod n

Input
1.an EC private key d owned by A
2.an EC private key Q owned by B

Actions
1.Compute the point P=dQ
2.Check P，if P==0 stop
3.Set z=Px， Px is the x-coordinate of P

Output
z∈Fq as the shared secret value

//同上，唯一不同是
1.Compute the point P=hdQ

Input
1.a bit string EncData
2.An EC public key Q owned by receiver
3.(optional)sharedData1, sharedData2, which are shared by the sender and the receiver

Action
1.Generate an ephemeral key pair(de,Qe), corresponding to the EC domain parameters D
2.conver Qe to a bit string QE
3.use DH to derive a shared secret value z∈Fq from de and Q， if error，stop
4.conver z∈Fq to a bit string Z
5.use KDF generate keydata of bit length encdatalen+mackeylen from Z and SharedData1
6.parse keyData： KeyData = EncKey||MacKey//k1||k2
7.compute MaskedEncData=EncData xor EncKey
8.compute the tag MacTag on the bit string: MacData=MaskedEncData||[SharedData2]

Output
QE||MaskedEncData||MacTag

Input
1.QE||MaskedEncData||MacTag
2.An EC private key d own by the recipient
3.(optional)SharedData1,SharedData2

Action
1.conver QE to an elliptic Qe'
2.Check public key Qe'
3.use DH z=get_x_coordinate([d]Qe)
4.convert z to a bit string Z
5.use KDF generate keydata of bit length encdatalen+mackeylen from Z and SharedData1
6.parse keyData： KeyData = EncKey||MacKey//k1(encdatalen)||k2(mackeylen)
7.Compute EncData=MaskedEncData xor EncKey
8.hmac(MacKey, MaskedEncData||SharedData2)

Output
if verify pass
    return EncData
else
    return error

//Demo
ECIES

========secp256k1==========
//receiver_pri_key
23CDCED066095AA72DE0192509A1E540DE341C1D4DC3B1DEB8A258A6BA26199C

//receiver_pub_key=[receiver_pri_key]G
E3B2EBEC783BB230F20F336E30FBA3BADD0A3453B4F6DCB77C0462B5166F795A
171C91D560427708ED15DCFF24E858233881AD2478CBA05EC9145836B9C787D9

//sender_tmp_pri_key
998943C47E19596D126BB33AC7C656F764D509F2F39AA9C0A872117B9CBA3D8C

//plain (43byte)
33333320717569636B2062726F776E20666F78206A756D7073206F76657220746865206C617A7944444444


//shared_info for KDF
//shared_info1_2  (51bytes)
A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F

//shared_info for MAC
//shared_info2_1 (5bytes)
6162636465

//hmac_key_byte
0x20

Output=Q||EncData||Hmac

//Q=[sender_tmp_pri_key]G
382A1AABFBD5B501917145D25035027DE977F65E432F0C89B7AD58A25FFF9103EB73E26421182E2F508C5C0A0D65BBDCBB0CD07D62DC628A93F7EE2F0F2B9E8D


==========without s1 s2==========
//KDF

//[sender_tmp_pri_key]receiver_pub_key
=[998943C47E19596D126BB33AC7C656F764D509F2F39AA9C0A872117B9CBA3D8C]*E3B2EBEC783BB230F20F336E30FBA3BADD0A3453B4F6DCB77C0462B5166F795A171C91D560427708ED15DCFF24E858233881AD2478CBA05EC9145836B9C787D9
=DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||D37BA38C5D1D390CC5238DBDD404C7ED56BFE24FA1CA242BCDBD2C91EA6B151B

//get Z=coordiate x
DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598


//Compute Hash_i = H(Z||counter||Shareinfo), counter=00000001, Hash_alg=sha512
//KDF
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000001)
AFC610393EDC3CE518BF8B13565B87B6D06A6787781C29F57DBC3EB8EFCFC5E963438D303F3D379BA04DA263E29F9828243D23EB65D652A5C44BB6D82D469574
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000002)
AEF21C42354B0C638DCCF5CA1B5E18627EA9674103B65DA1932D78163B6339C75429A245BA82006173E92F25BEC8764404A864623363CF4BD142DC29FE117EBE

//Enc_key = MBS(KDF,sizeof(plain)=43)
AFC610393EDC3CE518BF8B13565B87B6D06A6787781C29F57DBC3EB8EFCFC5E963438D303F3D379BA04DA2

//Cipher = Plain XOR (MBS(KDF,sizeof(plain)=43))
AFC610393EDC3CE518BF8B13565B87B6D06A6787781C29F57DBC3EB8EFCFC5E963438D303F3D379BA04DA2
33333320717569636B2062726F776E20666F78206A756D7073206F76657220746865206C617A7944444444
=9CF523194FA95586739FE961392CE996B6051FA7126944850E9C51CE8ABDE59D0B26AD5C5E474EDFE409E6


//mac_key = MBS(KDF+sizeof(plain)=43, sizepf(mac_key_byte)=32)
63E29F9828243D23EB65D652A5C44BB6D82D469574AEF21C42354B0C638DCCF5
//Mac=Hmac(mac_key,Cipher||ShareInfo2=NULL),hash_alg=sha1
=(63E29F9828243D23EB65D652A5C44BB6D82D469574AEF21C42354B0C638DCCF5, 9CF523194FA95586739FE961392CE996B6051FA7126944850E9C51CE8ABDE59D0B26AD5C5E474EDFE409E6)
=E48FC0BBFAAF26897CE60A541BAFC536640CED52





================================secp256k1 SHA256==================================
//receiver_pri_key
23CDCED066095AA72DE0192509A1E540DE341C1D4DC3B1DEB8A258A6BA26199C

//receiver_pub_key=[receiver_pri_key]G
E3B2EBEC783BB230F20F336E30FBA3BADD0A3453B4F6DCB77C0462B5166F795A
171C91D560427708ED15DCFF24E858233881AD2478CBA05EC9145836B9C787D9

//sender_tmp_pri_key
998943C47E19596D126BB33AC7C656F764D509F2F39AA9C0A872117B9CBA3D8C

//plain (43byte)
33333320717569636B2062726F776E20666F78206A756D7073206F76657220746865206C617A7944444444


//shared_info for KDF
//shared_info1_2  (51bytes)
A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F

//shared_info for MAC
//shared_info2_1 (5bytes)
6162636465

//hmac_key_byte
0x20

Output=Q||EncData||Hmac

//Q=[sender_tmp_pri_key]G
382A1AABFBD5B501917145D25035027DE977F65E432F0C89B7AD58A25FFF9103EB73E26421182E2F508C5C0A0D65BBDCBB0CD07D62DC628A93F7EE2F0F2B9E8D


==========without s1 s2==========
//KDF

//[sender_tmp_pri_key]receiver_pub_key
=[998943C47E19596D126BB33AC7C656F764D509F2F39AA9C0A872117B9CBA3D8C]*E3B2EBEC783BB230F20F336E30FBA3BADD0A3453B4F6DCB77C0462B5166F795A171C91D560427708ED15DCFF24E858233881AD2478CBA05EC9145836B9C787D9
=DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||D37BA38C5D1D390CC5238DBDD404C7ED56BFE24FA1CA242BCDBD2C91EA6B151B

//get Z=coordiate x
DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598


//Compute Hash_i = H(Z||counter||Shareinfo), counter=00000001, Hash_alg=sha256
//KDF
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000001)
88ED4CCAF84134FC66360397B35B2CA9081CADE5071B8AC95A767441C8B5CA24
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000002)
B8B34FFFF293CAF036AE901E590B4CD39ACCA91C7563247450185F1264FDC2F0
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000003)
6B2762EB34DCA0DEA26BA6D29BEE0E1803084CAFD51B21B1C35843B2FA9FFF62

//Enc_key = MBS(KDF,sizeof(plain)=43)
88ED4CCAF84134FC66360397B35B2CA9081CADE5071B8AC95A767441C8B5CA24B8B34FFFF293CAF036AE90

//Cipher = (MBS(KDF,sizeof(plain)=43)) XOR Plain
88ED4CCAF84134FC66360397B35B2CA9081CADE5071B8AC95A767441C8B5CA24B8B34FFFF293CAF036AE90 ^
33333320717569636B2062726F776E20666F78206A756D7073206F76657220746865206C617A7944444444
=BBDE7FEA89345D9F0D1661E5DC2C42896E73D5C56D6EE7B929561B37ADC7EA50D0D66F9393E9B3B472EAD4


//mac_key = MBS(KDF+sizeof(plain)=43, sizepf(mac_key_byte)=32)
1E590B4CD39ACCA91C7563247450185F1264FDC2F06B2762EB34DCA0DEA26BA6
//Mac=Hmac(mac_key,Cipher||ShareInfo2=NULL),hash_alg=sha256
=(1E590B4CD39ACCA91C7563247450185F1264FDC2F06B2762EB34DCA0DEA26BA6, BBDE7FEA89345D9F0D1661E5DC2C42896E73D5C56D6EE7B929561B37ADC7EA50D0D66F9393E9B3B472EAD4)
=BAC23020CBB5A5DA57A9C6B98E739794C8D8023BB0DB2B9C65BBD205C93DA173



==========only with s1==========
//Compute Hash_i = H(Z||counter||Shareinfo1), counter=00000001, Hash_alg=sha256
//KDF
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000001||A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F)
AD5ECFBEF03BE969B84FB07A9E0337C93D9493B07C6533BCF82A910D9F97D61F
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000002||A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F)
82869BDA29490DAF6A0650F581CD6592D3EA5D5AE14B160B275F420AAF277B5F
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000003||A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F)
0651C3D52DED2E9B8FFDC5D0AFF2178AF462BB46C70A63651934B3D4FFBCAAC6

AD5ECFBEF03BE969B84FB07A9E0337C93D9493B07C6533BCF82A910D9F97D61F82869BDA29490DAF6A0650 

//Enc_key = MBS(KDF,sizeof(plain)=43)
AD5ECFBEF03BE969B84FB07A9E0337C93D9493B07C6533BCF82A910D9F97D61F82869BDA29490DAF6A0650

//Cipher = (MBS(KDF,sizeof(plain)=43)) XOR Plain
AD5ECFBEF03BE969B84FB07A9E0337C93D9493B07C6533BCF82A910D9F97D61F82869BDA29490DAF6A0650
33333320717569636B2062726F776E20666F78206A756D7073206F76657220746865206C617A7944444444
=9E6DFC9E814E800AD36FD208F17459E95BFBEB9016105ECC8B0AFE7BFAE5F66BEAE3BBB6483374EB2E4214


//mac_key = MBS(KDF+sizeof(plain)=43, sizepf(mac_key_byte)=32)
F581CD6592D3EA5D5AE14B160B275F420AAF277B5F0651C3D52DED2E9B8FFDC5
//Mac=Hmac(mac_key,Cipher||ShareInfo2=NULL),hash_alg=sha256
=(F581CD6592D3EA5D5AE14B160B275F420AAF277B5F0651C3D52DED2E9B8FFDC5, 9E6DFC9E814E800AD36FD208F17459E95BFBEB9016105ECC8B0AFE7BFAE5F66BEAE3BBB6483374EB2E4214)
=8BB6E853122377B14F9E3F91A8F325ABF1D8D077A757BDB9630DCA97AAE17AF3


==========only with s2==========
//KDF

//[sender_tmp_pri_key]receiver_pub_key
=[998943C47E19596D126BB33AC7C656F764D509F2F39AA9C0A872117B9CBA3D8C]*E3B2EBEC783BB230F20F336E30FBA3BADD0A3453B4F6DCB77C0462B5166F795A171C91D560427708ED15DCFF24E858233881AD2478CBA05EC9145836B9C787D9
=DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||D37BA38C5D1D390CC5238DBDD404C7ED56BFE24FA1CA242BCDBD2C91EA6B151B

//get Z=coordiate x
DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598


//Compute Hash_i = H(Z||counter||Shareinfo), counter=00000001, Hash_alg=sha256
//KDF
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000001)
88ED4CCAF84134FC66360397B35B2CA9081CADE5071B8AC95A767441C8B5CA24
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000002)
B8B34FFFF293CAF036AE901E590B4CD39ACCA91C7563247450185F1264FDC2F0
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000003)
6B2762EB34DCA0DEA26BA6D29BEE0E1803084CAFD51B21B1C35843B2FA9FFF62

//Enc_key = MBS(KDF,sizeof(plain)=43)
88ED4CCAF84134FC66360397B35B2CA9081CADE5071B8AC95A767441C8B5CA24B8B34FFFF293CAF036AE90

//Cipher = (MBS(KDF,sizeof(plain)=43)) XOR Plain
88ED4CCAF84134FC66360397B35B2CA9081CADE5071B8AC95A767441C8B5CA24B8B34FFFF293CAF036AE90 ^
33333320717569636B2062726F776E20666F78206A756D7073206F76657220746865206C617A7944444444
=BBDE7FEA89345D9F0D1661E5DC2C42896E73D5C56D6EE7B929561B37ADC7EA50D0D66F9393E9B3B472EAD4


//mac_key = MBS(KDF+sizeof(plain)=43, sizepf(mac_key_byte)=32)
1E590B4CD39ACCA91C7563247450185F1264FDC2F06B2762EB34DCA0DEA26BA6
//Mac=Hmac(mac_key,Cipher||ShareInfo2=NULL),hash_alg=sha256
=(1E590B4CD39ACCA91C7563247450185F1264FDC2F06B2762EB34DCA0DEA26BA6, BBDE7FEA89345D9F0D1661E5DC2C42896E73D5C56D6EE7B929561B37ADC7EA50D0D66F9393E9B3B472EAD4||6162636465)
=490B384E5C4FF3300DDE70A3663BBE3EBBA306A523402ED595F4F10B4B63B261




==========only with s1 and s2==========
//Compute Hash_i = H(Z||counter||Shareinfo1), counter=00000001, Hash_alg=sha256
//KDF
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000001||A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F)
AD5ECFBEF03BE969B84FB07A9E0337C93D9493B07C6533BCF82A910D9F97D61F
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000002||A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F)
82869BDA29490DAF6A0650F581CD6592D3EA5D5AE14B160B275F420AAF277B5F
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000003||A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F)
0651C3D52DED2E9B8FFDC5D0AFF2178AF462BB46C70A63651934B3D4FFBCAAC6

AD5ECFBEF03BE969B84FB07A9E0337C93D9493B07C6533BCF82A910D9F97D61F82869BDA29490DAF6A0650 

//Enc_key = MBS(KDF,sizeof(plain)=43)
AD5ECFBEF03BE969B84FB07A9E0337C93D9493B07C6533BCF82A910D9F97D61F82869BDA29490DAF6A0650

//Cipher = (MBS(KDF,sizeof(plain)=43)) XOR Plain
AD5ECFBEF03BE969B84FB07A9E0337C93D9493B07C6533BCF82A910D9F97D61F82869BDA29490DAF6A0650
33333320717569636B2062726F776E20666F78206A756D7073206F76657220746865206C617A7944444444
=9E6DFC9E814E800AD36FD208F17459E95BFBEB9016105ECC8B0AFE7BFAE5F66BEAE3BBB6483374EB2E4214


//mac_key = MBS(KDF+sizeof(plain)=43, sizepf(mac_key_byte)=32)
F581CD6592D3EA5D5AE14B160B275F420AAF277B5F0651C3D52DED2E9B8FFDC5
//Mac=Hmac(mac_key,Cipher||ShareInfo2=NULL),hash_alg=sha256
=(F581CD6592D3EA5D5AE14B160B275F420AAF277B5F0651C3D52DED2E9B8FFDC5, 9E6DFC9E814E800AD36FD208F17459E95BFBEB9016105ECC8B0AFE7BFAE5F66BEAE3BBB6483374EB2E4214||6162636465)
=686C508582CD785519A76A59E9379083F3CA4DFB6A0BF1D2E4CB8EC7427ACCBB




================================secp256k1 SM3==================================
//receiver_pri_key
23CDCED066095AA72DE0192509A1E540DE341C1D4DC3B1DEB8A258A6BA26199C

//receiver_pub_key=[receiver_pri_key]G
E3B2EBEC783BB230F20F336E30FBA3BADD0A3453B4F6DCB77C0462B5166F795A
171C91D560427708ED15DCFF24E858233881AD2478CBA05EC9145836B9C787D9

//sender_tmp_pri_key
998943C47E19596D126BB33AC7C656F764D509F2F39AA9C0A872117B9CBA3D8C

//plain (43byte)
33333320717569636B2062726F776E20666F78206A756D7073206F76657220746865206C617A7944444444


//shared_info for KDF
//shared_info1_2  (51bytes)
A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F

//shared_info for MAC
//shared_info2_1 (5bytes)
6162636465

//hmac_key_byte
0x20

Output=Q||EncData||Hmac

//Q=[sender_tmp_pri_key]G
382A1AABFBD5B501917145D25035027DE977F65E432F0C89B7AD58A25FFF9103EB73E26421182E2F508C5C0A0D65BBDCBB0CD07D62DC628A93F7EE2F0F2B9E8D


==========without s1 s2==========
//KDF

//[sender_tmp_pri_key]receiver_pub_key
=[998943C47E19596D126BB33AC7C656F764D509F2F39AA9C0A872117B9CBA3D8C]*E3B2EBEC783BB230F20F336E30FBA3BADD0A3453B4F6DCB77C0462B5166F795A171C91D560427708ED15DCFF24E858233881AD2478CBA05EC9145836B9C787D9
=DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||D37BA38C5D1D390CC5238DBDD404C7ED56BFE24FA1CA242BCDBD2C91EA6B151B

//get Z=coordiate x
DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598


//Compute Hash_i = H(Z||counter||Shareinfo), counter=00000001, Hash_alg=SM3
//KDF
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000001)
443DC3B378B234CB4FA82731B21313513FC663B2F8FAD076D2CA6551EA97CF3C
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000002)
76A7FC64D6351048F8CCEB32790BB50A65404560C0DA6131D1DAFCB572BE8B33
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000003)
3AEB1DD3739DCA104822DB08E9BAF59560ED71D10B2FFF1609C973DDBF8A9E9A

443DC3B378B234CB4FA82731B21313513FC663B2F8FAD076D2CA6551EA97CF3C76A7FC64D6351048F8CCEB 32790BB50A65404560C0DA6131D1DAFCB572BE8B333AEB1DD3739DCA104822DB08E9BAF59560ED71D10B2FFF1609C973DDBF8A9E9A

//Enc_key = MBS(KDF,sizeof(plain)=43)
443DC3B378B234CB4FA82731B21313513FC663B2F8FAD076D2CA6551EA97CF3C76A7FC64D6351048F8CCEB

//Cipher = (MBS(KDF,sizeof(plain)=43)) XOR Plain
443DC3B378B234CB4FA82731B21313513FC663B2F8FAD076D2CA6551EA97CF3C76A7FC64D6351048F8CCEB ^
33333320717569636B2062726F776E20666F78206A756D7073206F76657220746865206C617A7944444444
=770EF09309C75DA824884543DD647D7159A91B92928FBD06A1EA0A278FE5EF481EC2DC08B74F690CBC88AF


//mac_key = MBS(KDF+sizeof(plain)=43, sizepf(mac_key_byte)=32)
32790BB50A65404560C0DA6131D1DAFCB572BE8B333AEB1DD3739DCA104822DB
//Mac=Hmac(mac_key,Cipher||ShareInfo2=NULL),hash_alg=SM3
=(32790BB50A65404560C0DA6131D1DAFCB572BE8B333AEB1DD3739DCA104822DB, 770EF09309C75DA824884543DD647D7159A91B92928FBD06A1EA0A278FE5EF481EC2DC08B74F690CBC88AF)
=C17A7AECCA3FFA80B5DBC1E2B755022988592D642D68B9CDC18A1FFE7805F835



==========only with s1==========

//Compute Hash_i = H(Z||counter||Shareinfo), counter=00000001, Hash_alg=SM3
//KDF
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000001||A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F)
B56AD8D7ECA977DA795245B84FC00ACB17914160DFDD0D2E75A2FDB6835458F4
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000002||A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F)
BBA6C4C6CF1611C8717A59ABE5002646647C2356CD1D7F0814204BC646CFA882
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000003||A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F)
85D971DFDFEE9A627E34AF27BE75B947B7C1C0EABB024CB2AD2F5A4F8050776D

B56AD8D7ECA977DA795245B84FC00ACB17914160DFDD0D2E75A2FDB6835458F4BBA6C4C6CF1611C8717A59 ABE5002646647C2356CD1D7F0814204BC646CFA88285D971DFDFEE9A627E34AF27BE75B947B7C1C0EABB024CB2AD2F5A4F8050776D

//Enc_key = MBS(KDF,sizeof(plain)=43)
B56AD8D7ECA977DA795245B84FC00ACB17914160DFDD0D2E75A2FDB6835458F4BBA6C4C6CF1611C8717A59

//Cipher = (MBS(KDF,sizeof(plain)=43)) XOR Plain
B56AD8D7ECA977DA795245B84FC00ACB17914160DFDD0D2E75A2FDB6835458F4BBA6C4C6CF1611C8717A59
33333320717569636B2062726F776E20666F78206A756D7073206F76657220746865206C617A7944444444
=8659EBF79DDC1EB9127227CA20B764EB71FE3940B5A8605E068292C0E6267880D3C3E4AAAE6C688C353E1D


//mac_key = MBS(KDF+sizeof(plain)=43, sizepf(mac_key_byte)=32)
ABE5002646647C2356CD1D7F0814204BC646CFA88285D971DFDFEE9A627E34AF
//Mac=Hmac(mac_key,Cipher||ShareInfo2=NULL),hash_alg=SM3
=(ABE5002646647C2356CD1D7F0814204BC646CFA88285D971DFDFEE9A627E34AF, 8659EBF79DDC1EB9127227CA20B764EB71FE3940B5A8605E068292C0E6267880D3C3E4AAAE6C688C353E1D)
=CDF90807DCB66D2E881EB76321239DC2DA45A031988EFCCD188E2EB440D44E4E



==========only with s2==========
//Compute Hash_i = H(Z||counter||Shareinfo1), counter=00000001, Hash_alg=SM3
//KDF
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000001)
443DC3B378B234CB4FA82731B21313513FC663B2F8FAD076D2CA6551EA97CF3C
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000002)
76A7FC64D6351048F8CCEB32790BB50A65404560C0DA6131D1DAFCB572BE8B33
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000003)
3AEB1DD3739DCA104822DB08E9BAF59560ED71D10B2FFF1609C973DDBF8A9E9A

443DC3B378B234CB4FA82731B21313513FC663B2F8FAD076D2CA6551EA97CF3C76A7FC64D6351048F8CCEB 32790BB50A65404560C0DA6131D1DAFCB572BE8B333AEB1DD3739DCA104822DB08E9BAF59560ED71D10B2FFF1609C973DDBF8A9E9A

//Enc_key = MBS(KDF,sizeof(plain)=43)
443DC3B378B234CB4FA82731B21313513FC663B2F8FAD076D2CA6551EA97CF3C76A7FC64D6351048F8CCEB

//Cipher = (MBS(KDF,sizeof(plain)=43)) XOR Plain
443DC3B378B234CB4FA82731B21313513FC663B2F8FAD076D2CA6551EA97CF3C76A7FC64D6351048F8CCEB ^
33333320717569636B2062726F776E20666F78206A756D7073206F76657220746865206C617A7944444444
=770EF09309C75DA824884543DD647D7159A91B92928FBD06A1EA0A278FE5EF481EC2DC08B74F690CBC88AF


//mac_key = MBS(KDF+sizeof(plain)=43, sizepf(mac_key_byte)=32)
32790BB50A65404560C0DA6131D1DAFCB572BE8B333AEB1DD3739DCA104822DB
//Mac=Hmac(mac_key,Cipher||ShareInfo2),hash_alg=SM3
=(32790BB50A65404560C0DA6131D1DAFCB572BE8B333AEB1DD3739DCA104822DB, 770EF09309C75DA824884543DD647D7159A91B92928FBD06A1EA0A278FE5EF481EC2DC08B74F690CBC88AF||6162636465)
=65A9D394BC99BBF6FCDFA0A95EBA059497967EB653A7549625A039714CFD7BED


==========with s1 and s2==========

//Compute Hash_i = H(Z||counter||Shareinfo), counter=00000001, Hash_alg=SM3
//KDF
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000001||A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F)
B56AD8D7ECA977DA795245B84FC00ACB17914160DFDD0D2E75A2FDB6835458F4
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000002||A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F)
BBA6C4C6CF1611C8717A59ABE5002646647C2356CD1D7F0814204BC646CFA882
//H(DAC75A25D3FCA8F8905FB5079C08FE8B470BD32BE22D50424660DE311DE83598||00000003||A7F359B46855C48A1B672F1C65FB57A8F5581AD4A96AA0637C4D36F44BCDFBA5D0101E5ECBAF6F4FEA3CD2706B459650D9089F)
85D971DFDFEE9A627E34AF27BE75B947B7C1C0EABB024CB2AD2F5A4F8050776D

B56AD8D7ECA977DA795245B84FC00ACB17914160DFDD0D2E75A2FDB6835458F4BBA6C4C6CF1611C8717A59 ABE5002646647C2356CD1D7F0814204BC646CFA88285D971DFDFEE9A627E34AF27BE75B947B7C1C0EABB024CB2AD2F5A4F8050776D

//Enc_key = MBS(KDF,sizeof(plain)=43)
B56AD8D7ECA977DA795245B84FC00ACB17914160DFDD0D2E75A2FDB6835458F4BBA6C4C6CF1611C8717A59

//Cipher = (MBS(KDF,sizeof(plain)=43)) XOR Plain
B56AD8D7ECA977DA795245B84FC00ACB17914160DFDD0D2E75A2FDB6835458F4BBA6C4C6CF1611C8717A59
33333320717569636B2062726F776E20666F78206A756D7073206F76657220746865206C617A7944444444
=8659EBF79DDC1EB9127227CA20B764EB71FE3940B5A8605E068292C0E6267880D3C3E4AAAE6C688C353E1D


//mac_key = MBS(KDF+sizeof(plain)=43, sizepf(mac_key_byte)=32)
ABE5002646647C2356CD1D7F0814204BC646CFA88285D971DFDFEE9A627E34AF
//Mac=Hmac(mac_key,Cipher||ShareInfo2=NULL),hash_alg=SM3
=(ABE5002646647C2356CD1D7F0814204BC646CFA88285D971DFDFEE9A627E34AF, 8659EBF79DDC1EB9127227CA20B764EB71FE3940B5A8605E068292C0E6267880D3C3E4AAAE6C688C353E1D||6162636465)
=909E14F4170F8E6BAF56590EF25E9435A926A7C6FEC6C414B3CBB59174C6B243

这里Ed25519使用的曲线各参数如下：

p=0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFED  //p=2^255-19
a=-1
d=0x52036CEE2B6FFE738CC740797779E89800700A4D4141D8AB75EB4DCA135978A3
Gx=0x216936D3CD6E53FEC0A4E231FDD6DC5C692CC7609525A7B2C9562D608F25D51A
Gy=0x6666666666666666666666666666666666666666666666666666666666666658
n=0x1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED
点(Gx, Gy)是曲线的基点，其阶是素数n。

《RFC 8032》
Ed25519签名系统有11个参数
1）一个奇素数p，椭圆曲线建立在有限域GF(p)上，如Ed25519，p=2^255-19  //得p是256bit
2）一个正整数b，满足2^(b-1) > p  //公钥是b比特，对于Ed25519，b=256
3）有限域GF(p)中的元素用(b-1)比特表示，对Ed25519，元素用255个比特表示
4）一个密码学hash函数H，具有2b比特输出，对Ed25519，H=sha512
5）一个整数c，取值2或3，秘密的EdDSA标量应该是2c倍数，c是余因子的底数为2的对数，对Ed25519，c是3
6）一个整数n，满足c<=n<=b，秘密的EdDSA应该有n+1个bit，且其最高比特总是1，最低c比特总是0，如Ed25519，n即254
7）有限域GF(p)中的一个非平方元素d，通常建议取离0最近的，且能确定一个可接受的曲线的值，如对Ed25519，d=-121665/12666
8）有限域GF(p)中的一个非0元素a，考虑到性能要求，通常建议a=-1 if p mod 4=1，and a=1 if p mod 4 = 3，如Ed25519，a=-1
9）曲线上一点B != (0,1)
10）点B的阶L，是个奇素数，且曲线的阶#E = L * 2^c
11）一个预计算hash函数PH

编码
1.一个整数0<S<L-1，被编码作一个小端的b比特的串ENC(S)，从左到右，s0s1...sn，s0是低位，sn是高位，用字节串表示时，和x25519中一致
2.一个群元素，即曲线上一个点(x,y)，被编码作一个b比特的串ENC(x,y)，其中b-1比特是y的编码，之后的1比特表示x，具体的，该bit为1，则表示x是负的，若为0，则表示x是非负的
3.GF(p)中的负元素定义如下：x和-x都用这里的编码表示时，按从左到右比较大小，若x>-x mod p，则x是负的。等价说，若x数值是奇数，则为负数，反之为非负

b=256
encoding of GF(p) 255-bit little endian encoding of {0,1,...,p-1}
H(x)=SHA512(dom2(phflag, context) || x)

驱动优化的地方：
1.启动R = [r mod n]G计算后，直接计算sha512(dom2(flag, ctx)
2. 

//Demo ed25519-pure-sign
//privkey
F5E5767CF153319517630F226876B86C8160CC583BC013744C6BF255F5CC0EE5
//message
08B8B2B733424243760FE426A4B54908632110A66C2F6591EABD3345E3E4EB98FA6E264BF09EFE12EE50F8F54E9F77B1E355F6C50544E23FB1433DDF73BE84D879DE7C0046DC4996D9E773F4BC9EFE5738829ADB26C81B37C93A1B270B20329D658675FC6EA534E0810A4432826BF58C941EFB65D57A338BBD2E26640F89FFBC1A858EFCB8550EE3A5E1998BD177E93A7363C344FE6B199EE5D02E82D522C4FEBA15452F80288A821A579116EC6DAD2B3B310DA903401AA62100AB5D1A36553E06203B33890CC9B832F79EF80560CCB9A39CE767967ED628C6AD573CB116DBEFEFD75499DA96BD68A8A97B928A8BBC103B6621FCDE2BECA1231D206BE6CD9EC7AFF6F6C94FCD7204ED3455C68C83F4A41DA4AF2B74EF5C53F1D8AC70BDCB7ED185CE81BD84359D44254D95629E9855A94A7C1958D1F8ADA5D0532ED8A5AA3FB2D17BA70EB6248E594E1A2297ACBBB39D502F1A8C6EB6F1CE22B3DE1A1F40CC24554119A831A9AAD6079CAD88425DE6BDE1A9187EBB6092CF67BF2B13FD65F27088D78B7E883C8759D2C4F5C65ADB7553878AD575F9FAD878E80A0C9BA63BCBCC2732E69485BBC9C90BFBD62481D9089BECCF80CFE2DF16A2CF65BD92DD597B0707E0917AF48BBB75FED413D238F5555A7A569D80C3414A8D0859DC65A46128BAB27AF87A71314F318C782B23EBFE808B82B0CE26401D2E22F04D83D1255DC51ADDD3B75A2B1AE0784504DF543AF8969BE3EA7082FF7FC9888C144DA2AF58429EC96031DBCAD3DAD9AF0DCBAAAF268CB8FCFFEAD94F3C7CA495E056A9B47ACDB751FB73E666C6C655ADE8297297D07AD1BA5E43F1BCA32301651339E22904CC8C42F58C30C04AAFDB038DDA0847DD988DCDA6F3BFD15C4B4C4525004AA06EEFF8CA61783AACEC57FB3D1F92B0FE2FD1A85F6724517B65E614AD6808D6F6EE34DFF7310FDC82AEBFD904B01E1DC54B2927094B2DB68D6F903B68401ADEBF5A7E08D78FF4EF5D63653A65040CF9BFD4ACA7984A74D37145986780FC0B16AC451649DE6188A7DBDF191F64B5FC5E2AB47B57F7F7276CD419C17A3CA8E1B939AE49E488ACBA6B965610B5480109C8B17B80E1B7B750DFC7598D5D5011FD2DCC5600A32EF5B52A1ECC820E308AA342721AAC0943BF6686B64B2579376504CCC493D97E6AED3FB0F9CD71A43DD497F01F17C0E2CB3797AA2A2F256656168E6C496AFC5FB93246F6B1116398A346F1A641F3B041E989F7914F90CC2C7FFF357876E506B50D334BA77C225BC307BA537152F3F1610E4EAFE595F6D9D90D11FAA933A15EF1369546868A7F3A45A96768D40FD9D03412C091C6315CF4FDE7CB68606937380DB2EAAA707B4C4185C32EDDCDD306705E4DC1FFC872EEEE475A64DFAC86ABA41C0618983F8741C5EF68D3A101E8A3B8CAC60C905C15FC910840B94C00A0B9D0
//h
h=sha512(F5E5767CF153319517630F226876B86C8160CC583BC013744C6BF255F5CC0EE5)
=609C888D0EF886D34B6EDEF27FB244AA04B3A49C82260E6AB86E784FF488CCC8||
6990F0F6BEFEB2651705E7F5F6CF2F13C42005C7CA8419B1FD050616F902D258
//对h前面32B进行解码,注意s被更新
out[0] &= 0xF8;            //clear lowest 3 bits
out[bytes - 1] &= 0x7F;    //clear highest 1 bit
out[bytes - 1] |= 0x40;    //set second highest bit as 1
h=sha512(F5E5767CF153319517630F226876B86C8160CC583BC013744C6BF255F5CC0EE5)
=609C888D0EF886D34B6EDEF27FB244AA04B3A49C82260E6AB86E784FF488CC48||
6990F0F6BEFEB2651705E7F5F6CF2F13C42005C7CA8419B1FD050616F902D258
//prefix取低32Byte
prefix =6990F0F6BEFEB2651705E7F5F6CF2F13C42005C7CA8419B1FD050616F902D258
//r =sha512(dom2(flag, ctx) || prefix || PH(M))
r=sha512(NULL||NULL||6990F0F6BEFEB2651705E7F5F6CF2F13C42005C7CA8419B1FD050616F902D258||08B8B2B733424243760FE426A4B54908632110A66C2F6591EABD3345E3E4EB98FA6E264BF09EFE12EE50F8F54E9F77B1E355F6C50544E23FB1433DDF73BE84D879DE7C0046DC4996D9E773F4BC9EFE5738829ADB26C81B37C93A1B270B20329D658675FC6EA534E0810A4432826BF58C941EFB65D57A338BBD2E26640F89FFBC1A858EFCB8550EE3A5E1998BD177E93A7363C344FE6B199EE5D02E82D522C4FEBA15452F80288A821A579116EC6DAD2B3B310DA903401AA62100AB5D1A36553E06203B33890CC9B832F79EF80560CCB9A39CE767967ED628C6AD573CB116DBEFEFD75499DA96BD68A8A97B928A8BBC103B6621FCDE2BECA1231D206BE6CD9EC7AFF6F6C94FCD7204ED3455C68C83F4A41DA4AF2B74EF5C53F1D8AC70BDCB7ED185CE81BD84359D44254D95629E9855A94A7C1958D1F8ADA5D0532ED8A5AA3FB2D17BA70EB6248E594E1A2297ACBBB39D502F1A8C6EB6F1CE22B3DE1A1F40CC24554119A831A9AAD6079CAD88425DE6BDE1A9187EBB6092CF67BF2B13FD65F27088D78B7E883C8759D2C4F5C65ADB7553878AD575F9FAD878E80A0C9BA63BCBCC2732E69485BBC9C90BFBD62481D9089BECCF80CFE2DF16A2CF65BD92DD597B0707E0917AF48BBB75FED413D238F5555A7A569D80C3414A8D0859DC65A46128BAB27AF87A71314F318C782B23EBFE808B82B0CE26401D2E22F04D83D1255DC51ADDD3B75A2B1AE0784504DF543AF8969BE3EA7082FF7FC9888C144DA2AF58429EC96031DBCAD3DAD9AF0DCBAAAF268CB8FCFFEAD94F3C7CA495E056A9B47ACDB751FB73E666C6C655ADE8297297D07AD1BA5E43F1BCA32301651339E22904CC8C42F58C30C04AAFDB038DDA0847DD988DCDA6F3BFD15C4B4C4525004AA06EEFF8CA61783AACEC57FB3D1F92B0FE2FD1A85F6724517B65E614AD6808D6F6EE34DFF7310FDC82AEBFD904B01E1DC54B2927094B2DB68D6F903B68401ADEBF5A7E08D78FF4EF5D63653A65040CF9BFD4ACA7984A74D37145986780FC0B16AC451649DE6188A7DBDF191F64B5FC5E2AB47B57F7F7276CD419C17A3CA8E1B939AE49E488ACBA6B965610B5480109C8B17B80E1B7B750DFC7598D5D5011FD2DCC5600A32EF5B52A1ECC820E308AA342721AAC0943BF6686B64B2579376504CCC493D97E6AED3FB0F9CD71A43DD497F01F17C0E2CB3797AA2A2F256656168E6C496AFC5FB93246F6B1116398A346F1A641F3B041E989F7914F90CC2C7FFF357876E506B50D334BA77C225BC307BA537152F3F1610E4EAFE595F6D9D90D11FAA933A15EF1369546868A7F3A45A96768D40FD9D03412C091C6315CF4FDE7CB68606937380DB2EAAA707B4C4185C32EDDCDD306705E4DC1FFC872EEEE475A64DFAC86ABA41C0618983F8741C5EF68D3A101E8A3B8CAC60C905C15FC910840B94C00A0B9D0)
=C191ED996744E0E280359D6BF0C762179F17EBD84EC4D4DFD287A33AAA58FB2D||
9F16171155E4C109E70579E15790E6EFCDEFB8BA66E21D659140D09356E0D609
//R = [r mod n]G 注意此处模运算hash已认为是小端
r mod n
=9D6E05693D04091651DE266BAB8EFCDEFE69057E17905E709C1E4551117169F2DFB58AA3AA387D2DFD4C44ED8EB179F1762C7F06B9D3580E2E0446799ED91C1 mod 1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED
=D5B57538A9A43A6CDC255B8C040ABB4E174635A018C973D7B9DF09B1F613F57 //注意此处r值默认小端输出
R = [r mod n]G
=[39B6CFFBFC21B42CABAA8A646D56465B3C2C7360E7E266FF080D151055D7EA5]G
=0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350//目前小工具没有点乘计算，公钥非直接点乘，最终输出的r
//k = sha512(dom2(flag, ctx) || R || A ||PH(M)), A是公钥
k=sha512(NULL||0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350||278117FC144C72340F67D0F2316E8386CEFFBF2B2428C9C51FEF7C597F1D426E||08B8B2B733424243760FE426A4B54908632110A66C2F6591EABD3345E3E4EB98FA6E264BF09EFE12EE50F8F54E9F77B1E355F6C50544E23FB1433DDF73BE84D879DE7C0046DC4996D9E773F4BC9EFE5738829ADB26C81B37C93A1B270B20329D658675FC6EA534E0810A4432826BF58C941EFB65D57A338BBD2E26640F89FFBC1A858EFCB8550EE3A5E1998BD177E93A7363C344FE6B199EE5D02E82D522C4FEBA15452F80288A821A579116EC6DAD2B3B310DA903401AA62100AB5D1A36553E06203B33890CC9B832F79EF80560CCB9A39CE767967ED628C6AD573CB116DBEFEFD75499DA96BD68A8A97B928A8BBC103B6621FCDE2BECA1231D206BE6CD9EC7AFF6F6C94FCD7204ED3455C68C83F4A41DA4AF2B74EF5C53F1D8AC70BDCB7ED185CE81BD84359D44254D95629E9855A94A7C1958D1F8ADA5D0532ED8A5AA3FB2D17BA70EB6248E594E1A2297ACBBB39D502F1A8C6EB6F1CE22B3DE1A1F40CC24554119A831A9AAD6079CAD88425DE6BDE1A9187EBB6092CF67BF2B13FD65F27088D78B7E883C8759D2C4F5C65ADB7553878AD575F9FAD878E80A0C9BA63BCBCC2732E69485BBC9C90BFBD62481D9089BECCF80CFE2DF16A2CF65BD92DD597B0707E0917AF48BBB75FED413D238F5555A7A569D80C3414A8D0859DC65A46128BAB27AF87A71314F318C782B23EBFE808B82B0CE26401D2E22F04D83D1255DC51ADDD3B75A2B1AE0784504DF543AF8969BE3EA7082FF7FC9888C144DA2AF58429EC96031DBCAD3DAD9AF0DCBAAAF268CB8FCFFEAD94F3C7CA495E056A9B47ACDB751FB73E666C6C655ADE8297297D07AD1BA5E43F1BCA32301651339E22904CC8C42F58C30C04AAFDB038DDA0847DD988DCDA6F3BFD15C4B4C4525004AA06EEFF8CA61783AACEC57FB3D1F92B0FE2FD1A85F6724517B65E614AD6808D6F6EE34DFF7310FDC82AEBFD904B01E1DC54B2927094B2DB68D6F903B68401ADEBF5A7E08D78FF4EF5D63653A65040CF9BFD4ACA7984A74D37145986780FC0B16AC451649DE6188A7DBDF191F64B5FC5E2AB47B57F7F7276CD419C17A3CA8E1B939AE49E488ACBA6B965610B5480109C8B17B80E1B7B750DFC7598D5D5011FD2DCC5600A32EF5B52A1ECC820E308AA342721AAC0943BF6686B64B2579376504CCC493D97E6AED3FB0F9CD71A43DD497F01F17C0E2CB3797AA2A2F256656168E6C496AFC5FB93246F6B1116398A346F1A641F3B041E989F7914F90CC2C7FFF357876E506B50D334BA77C225BC307BA537152F3F1610E4EAFE595F6D9D90D11FAA933A15EF1369546868A7F3A45A96768D40FD9D03412C091C6315CF4FDE7CB68606937380DB2EAAA707B4C4185C32EDDCDD306705E4DC1FFC872EEEE475A64DFAC86ABA41C0618983F8741C5EF68D3A101E8A3B8CAC60C905C15FC910840B94C00A0B9D0)
=60F83D247242CB144548DDA50BC649CAB8CD2AD24CF46D7D25F13118E4A96F5C49AF3FD726BA59B012B2D2410214FD60B3924F84AC85312514F08F43EC3BD3D1
//k mod n
=D1D33BEC438FF014253185AC844F92B360FD140241D2B212B059BA26D73FAF495C6FA9E41831F1257D6DF44CD22ACDB8CA49C60BA5DD484514CB4272243DF860 mod 1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED
=3A96A76606CEE099A04A61B43317A9FE8A3F37EBA34209DD4C647D06E08A069
//s mod n
=48CC88F44F786EB86A0E26829CA4B304AA44B27FF2DE6E4BD386F80E8D889C60 mod 1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED
=8CC88F44F786EB86A0E26829CA4B30456C8CB0566FFFAF2733D6BA519B14CAC
//k*s mod n
=3A96A76606CEE099A04A61B43317A9FE8A3F37EBA34209DD4C647D06E08A069 *8CC88F44F786EB86A0E26829CA4B30456C8CB0566FFFAF2733D6BA519B14CAC mod n
=62EC0F6E60EBD05D86DC8AF8F8CE3A97F43CD48C555F1C1221401CFEF05E840
//r+k*s mod n
=D5B57538A9A43A6CDC255B8C040ABB4E174635A018C973D7B9DF09B1F613F57 + 62EC0F6E60EBD05D86DC8AF8F8CE3A97F43CD48C555F1C1221401CFEF05E840 mod n
=38A184A70A900ACA6301E684FCD8F5E4BD936C423EAEC28459F8F50B17153AA，最终输出s值，注意直接小端输出
//RS
=0AAB4C900501B3E24D7CDF4663326A3A87DF5E4843B2CBDB67CBF6E460FEC350||
AA5371B1508F9F4528ECEA23C436D94B5E8FCD4F681E30A6AC00A9704A188A03