SPRUJB6B November 2024 – May 2025 AM2612
This command generates an SM2DSA signature. The nonce doesn’t need to be blinded before use.
The SM2DSA_SIGN command takes a private key in the additively DPA-blinded format that is the output of ECC_KEY_BLIND.
SM2DSA_SIGN is the most side-channel-critical command within the PKE. So in addition to the existing countermeasures in SM2DSA_SIGN, PKE also includes a command SM2DSA_SIGN_2 which includes more countermeasures against side-channel analysis. In PKE, SM2DSA_SIGN_2 takes roughly twice as long as SM2DSA_SIGN and uses two slots more memory.
| Slot | Name | Description | In ROM? |
|---|---|---|---|
| 0 | n0 | Less-significant component of the nonce. | No |
| 1 | n1 |
More-significant component of the nonce. The effective nonce is {n1,n0}, so setting n1=0 will use only n0. Alternatively, (n0,n1) can both set to random values or to a pseudorandom function of the message. This prevents biases in |
No |
| nonce selection which, in the case of Brainpool curves, might expose the private key to a Bleichenbacher-style attack. | |||
| 2 | h | The hash of the message | No |
| 3 | s0 | First component of blinded private key. | No |
| 4 | s1 | Second component of blinded private key. | No |
| 10 | b | b-coefficient of the elliptic curve | Yes |
| 11 | gx | x-coordinate of the elliptic curve’s generator | Yes |
| 12 | gy | y-coordinate of the elliptic curve’s generator | Yes |
| 13 | q | Order of the subgroup generated by (gx,gy). Must be odd. | Yes |
| 14 | p | Order of the finite field underlying the elliptic curve if it is not a supported special modulus. | Yes |
| 15 | a | a-coefficient of the elliptic curve | Yes |
The SM2DSA_SIGN and SM2DSA_SIGN_2 commands will raise an error if:
On error, the command clears slots 0 through 12. On success, it clears slots 0,1,2 and 5 through 10.
Additionally, it clears slots 13 and 14 if the parameters are in ROM, and slots 16 and 17 if they are not.
Output memory map:
| Slot | Name | Description |
|---|---|---|
| 3 | s0 | First component of the private key, reblinded |
| 4 | s1 | Second component of the private key, reblinded |
| 11 | r | r-component of the signature |
| 12 | s | s-component of the signature |