GB/T 36968-2018 in English

Analysis of the Standard Core Framework

Cryptographic algorithm configuration specification

Chapter 5 of the standard clearly stipulates:

• Asymmetric algorithm: The SM2 elliptic curve algorithm is mandatory for entity authentication and digital signature (in accordance with GB/T 32918)
• Symmetric algorithm: The SM4 block cipher (CBC mode) with a key length of 128 bits must be supported (in accordance with GB/T 32907)
• Hash algorithm: The SM3 algorithm is used for integrity verification (in accordance with GB/T 32905)

Phase 1: SM2 signature + SM4 encryption working key second stage: SM4 session key (1428-byte frame encryption and decryption throughput ≥ 1Gbps) 

Security Association Establishment Process

Special note: NAT traversal must comply with RFC 3947 specifications and is implemented in UDP 4500 port implements ESP encapsulation

Key indicators for product testing

• Functional testing: Random number generation must pass the 16 tests of GB/T 32915
• Performance parameters:
  • Encryption and decryption delay: 1428-byte frame ≤200μs
  • Key update cycle: working key ≤24h, session key ≤1h
• Security management: Device keys must be stored in hardware cryptographic modules

Implementation suggestions

1. Preferably adopt tunnel mode deployment to ensure internal IP header encryption
2. Gateway devices should be configured with an anti-replay window (64 bits by default)
3. Log records must include SA lifecycle events and abnormal decryption records