1. Project Overview & Quickstart (Tencent/Hippy) Copy Chapter

File: README.md Copy Chapter

Hippy Cross Platform Framework

Homepage

💡 Introduction Copy Chapter

Hippy is a cross-platform development framework, that aims to help developers write once, and run on multiple platforms(iOS, Android, Web, and so on). Hippy is quite friendly to Web developers, especially those who are familiar with React or Vue. With Hippy, developers can create the cross-platform app easily.

Hippy is now applied in Tencent major apps such as Mobile QQ, Mobile QQ Browser, Tencent Video App, QQ Music App, and Tencent News, reaching hundreds of millions of ordinary users.

💯 Advantages Copy Chapter

• Designed for Web developers, officially support Web frameworks like React and Vue.
• Same APIs for different platforms.
• Excellent performance with JS engine binding communication.
• Build-in recyclable component with better performance.
• Smoothly and gracefully migrate to Web browser.
• Fully supported Flex Layout engine.

🔨 Getting started Copy Chapter

Preparing environment Copy Section

Make sure you have git and npm installed locally.

Run git clone https://github.com/Tencent/Hippy.git and npm install at project root directory.

The Hippy repository applies git-lfs to manage so,gz,otf files, make sure you have installed git-lfs first.

For macOS developers:

• Xcode with iOS sdk: build the iOS app.
• Android Studio with NDK: build the android app.
• Node.JS: run the build scripts.

homebrew is recommended to install the dependencies.

For Windows developers:

• Android Studio with NDK: build the android app.
• Node.JS: run the build scripts.

Windows can't run the iOS development environment so far.

Build the iOS simulator with js demo Copy Section

For iOS, we recommend to use iOS simulator when first try. However, you can change the Xcode configuration to install the app to iPhone if you are an iOS expert.

1. cd to driver/js/.

2. Run npm run init.

   This command is combined with npm install && npx lerna bootstrap && npm run build.

   npm install: Install the project build scripts dependencies.

   npx lerna bootstrap: Install dependencies of each npm package.（Hippy uses Lerna to manage multi js packages, if lerna command is not found, execute npm install lerna -g first.）

   npm run build: Build each front-end sdk package.

3. Choose a demo to build with npm run buildexample [hippy-react-demo|hippy-vue-demo|hippy-vue-next-demo].

4. Install CocoaPods with brew install cocoapods, install cmake with brew install cmake, then execute pod install command at framework/examples/ios-demo directory, which will create HippyDemo.xcworkspace files and install Cocoapods dependencies.

5. Start the Xcode and build the iOS app with opening framework/examples/ios-demo/HippyDemo.xcworkspace.

If Step 2 throw error, you can cd to driver/js/examples hippy-react-demo or hippy-vue-demo, and run npm install to install demo dependencies first.

More details for iOS SDK integration.

Build the Android app with js demo Copy Section

For Android, we recommend using the real cellphone for better develop experience, because Hippy is using X5 JS engine which can't support x86 simulator, as well as ARM simulator has a low performance.

Before build the android app, please make sure the SDK and NDK is installed, And DO NOT update the build toolchain.

1. cd to driver/js/.

2. Run npm run init.

   This command is combined with npm install && npx lerna bootstrap && npm run build.

   npm install: Install the project build scripts dependencies.

   npx lerna bootstrap: Install dependencies of each npm package.（Hippy uses Lerna to manage multi js packages, if lerna command is not found, execute npm install lerna -g first.）

   npm run build: Build each front-end sdk package.

3. Choose a demo to build with npm run buildexample [hippy-react-demo|hippy-vue-demo|hippy-vue-next-demo].

4. Open the Hippy Project at root directory with Android Studio.

5. Connect Android phone with USB cable and make sure USB debugging mode is enabled(Run adb devices on the computer terminal to check cellphone connection status).

6. Open the project with Android Studio, run and install the apk.

If Step 2 throw error, you can cd to driver/js/examples hippy-react-demo, hippy-vue-demo or hippy-vue-next-demo, and run npm install to install demo dependencies first.

If you encounter the issue of No toolchains found in the NDK toolchains folder for ABI with prefix: mips64el-linux-android, here is the solution.

More details for Android SDK integration.

Debug the js demo Copy Section

1. Follow Build the iOS simulator with js demo or Build the Android app with js demo first to build the App.
2. cd to driver/js/.
3. Run npm run init:example [hippy-react-demo|hippy-vue-demo|hippy-vue-next-demo].
4. Run npm run debugexample [hippy-react-demo|hippy-vue-demo|hippy-vue-next-demo] dev.

Or you can cd to driver/js/examples/hippy-react-demo, driver/js/examples/hippy-vue-demo or driver/js/examples/hippy-vue-next-demo directory to run npm run hippy:dev instead.

On example debug mode, npm packages such as @hippy/react, @hippy/vue, @hippy/vue-next are linked to driver/js/packages > [different package] > dist(not node_modules), so if you have changed js package source code and want to make it take effect in target example, please call npm run build again.

More details for debugging can be read in Hippy Debug Document.

Build the js production demo Copy Section

1. Follow Build the iOS simulator with js demo or Build the Android app with js demo first to build the App.
2. cd to driver/js/examples/hippy-react-demo, driver/js/examples/hippy-vue-demo or driver/js/examples/hippy-vue-next-demo.
3. Run npm install to install demo js dependencies.
4. Run npm run hippy:vendor and npm run hippy:build in sequence to build the production vendor.[android|ios].js and index.[android|ios].js.

Hippy demo uses DllPlugin to split the common chunk and app chunk.

📁 Documentation Copy Chapter

To check out hippy examples and visit framework.tds.qq.com.

📅 Changelog Copy Chapter

Detailed changes for each release version are documented in the project release notes.

🧱 Project structure Copy Chapter

Hippy
├── devtools                                                      # Devtools for Hippy.
├── dom                                                           # DOM Layer for Hippy.
├── driver                                                        # Different UI Driver Layers for Hippy.
│   └── js                                                     # JS Driver Layer for Hippy.
│       ├── examples                                                # Related examples for JS Driver.
│       ├── include
│       ├── packages                                                # Related JS Packages for JS Driver.
│       │   ├── hippy-react
│       │   ├── hippy-react-web
│       │   ├── hippy-vue
│       │   ├── hippy-vue-css-loader
│       │   ├── hippy-vue-loader
│       │   ├── hippy-vue-native-components
│       │   └── hippy-vue-router
│       └── src
├── framework
│   ├── android
│   ├── examples
│   │   ├── android-demo
│   │   └── ios-demo
│   └── ios
├── layout                                                      # Layout engine for Hippy.
├── modules
│   ├── android
│   └── footstone
├── renderer                                                    # Different Renderers for Hippy.
│   ├── flutter
│   └── native
│       ├── android
│       └── ios
└── static

🤝 Contribution Copy Chapter

Developers are welcome to contribute to Tencent's open source, and we will also give them incentives to acknowledge and thank them. Here we provide an official description of Tencent's open source contribution. Specific contribution rules for each project are formulated by the project team. Developers can choose the appropriate project and participate according to the corresponding rules. The Tencent Project Management Committee will report regularly to qualified contributors and awards will be issued by the official contact. Before making a pull request or issue to Hippy, please make sure to read Contributing Guide.

All the people who already contributed to Hippy can be seen in Contributors and Authors File.

❤️ Stargazers over time Copy Chapter

📄 License Copy Chapter

Hippy is Apache-2.0 licensed.

🔗 Links Copy Chapter

Hippy Eco-System

Taitank Layout Engine

File: docs/index.md Copy Chapter

Hippy

</a>
    
        [GitHub](//github.com/Tencent/Hippy)
        [开始接入](#/guide/integration)
    


    <h2>⚡ 高性能</h2>
        提供极致流畅体验的可复用列表，通过 binding 模式实现高效的前端-终端通讯。
    <h2>📱 跨平台</h2>
        不同的平台保持了相同的接口，可平滑迁移到 Web 浏览器。
    <h2>📚 易学习</h2>
        支持 React 和 Vue 两套界面框架，完整支持 Flex 布局。

QQ浏览器

手机QQ

腾讯新闻

全民K歌

QQ音乐

腾讯地图

王者营地

闪现

云视听极光

Start云游戏(TV)

微视

应用宝

理财通

腾讯自选股

NOW直播

心悦俱乐部

WiFi管家

大丰满满

企鹅号

VOOV直播

团队贡献 Copy Chapter

TME 全民K歌团队

TME QQ音乐团队

CDG大丰满满/自选股团队

QGraphics团队

IVWEB团队

游云南WII团队

贡献者 Copy Chapter

Super Zheng

XQ Kuang

siguangli2018

luomy

churchill-zhang

old kidd

Zoom Chan

ilikethese

Box Tsang

jerome han

tsangint

RonkTsang

Elf Sundae

三点

dequanzhu

kassadin

Arylo Yeung

交流链接 Copy Chapter

• 文章专栏
• 企业微信交流群，使用微信或者企业微信扫描加入

总结 Copy Chapter

如果您准备好了，那就 开始接入 Hippy 吧。

File: docs/README.md Copy Chapter

Hippy 简介

版本：3.3.7

更新时间：2025-09-25

SDK介绍：Hippy 是腾讯端框架（Tencent Device-oriented Service Framework）下的开源跨平台应用开发解决方案。Hippy 可以理解为一个精简版的浏览器，从底层做了大量工作，抹平了 iOS、Android、Ohos 三端差异，提供了接近 Web 的开发体验，目前上层支持了 React 和 Vue 两套界面框架，前端开发人员可以通过它，将前端代码转换为终端的原生指令，进行原生终端 App 的开发。同时，Hippy 从底层进行了大量优化，在启动速度、渲染性能、动画速度、内存占用、包体积等方面都提供了业内顶尖的性能表现。

更新日志：Change log

服务提供方：深圳市腾讯计算机系统有限公司

接入指引

Hippy SDK隐私保护指引

和 Web 接近的开发体验 Copy Chapter

• Hippy 对齐浏览器 DOM 的事件、网络、日志、定时器、Performance 等API, 前端开发同学没有太高的学习成本。

• Hippy-Vue、Hippy-React兼容 Vue 和 React 框架, 使用 Vue、React 开发的 Web 项目基本无缝迁移。

• 完全支持 Flex 布局, 和常用的 CSS 属性。

• 兼容 Webpack/Rollup 等打包工具, 支持分包, 代码动态加载, 有完善的 devtools 工具, 对齐前端的开发体验。

一次开发，多端运行 Copy Chapter

使用 Hippy 框架开发后，代码可以同时运行在 Android、iOS、Ohos、Web等多个平台。

出色的性能表现 Copy Chapter

Hippy 有比竞品更出色的性能表现。

渲染性能 Copy Section

ListView 在滑动时的性能对比，Hippy 可以一直保持十分流畅的状态。

内存占用 Copy Section

而在内存占用上，初始化 List 时 Hippy 就略占优势，在滑动了几屏后内存开销的差距越来越大。

包体积 Copy Section

Hippy 的包体积在业内也是非常具有竞争力的。

上图是一个空的APK，在引入后终端包大小对比。

上图是在前端搭建了一个最简单的 ListView 后，前端打出的 JS 的包大小对比。

可扩展的架构设计 Copy Chapter

在Hippy 3.0版本，我们对 Hippy 架构做了一次比较大的重构, 采用 Driver，Dom Manager，Renderer 分层解耦的设计理念，其设计目标就是希望框架在未来具有很好的可扩展性，以复用的 DOM 管理、排版布局为核心连接上层 Driver 和下层 Renderer，同时支持不同 Driver 和 Renderer 的接入和自由切换。

驱动层 Copy Section

驱动层为业务封装了对接DOM层的渲染指令和底层接口, 用户可以使用 Hippy 框架提供的 React/Vue 驱动层来开发业务，也支持扩展其它任意 DSL 语言进行驱动。详见 Hippy-React、Hippy-Vue。

DOM层 Copy Section

DOM Manager 从 Java/OC 抽离到 C++，作为中间枢纽，除了接收处理来自上层的消息，进行 DOM Tree 的创建和维护外，还负责与不同渲染引擎，排版引擎和调试工具的对接通信。

渲染层 Copy Section

• Native Renderer：使用 Android/iOS/Ohos 原生组件进行渲染, 详见 Android、iOS、Ohos。
• Voltron Renderer：使用 Flutter 渲染, 详见 Voltron。
• Web Renderer：使用 WebView 渲染（Web 同构）, 详见 Web。

交流链接 Copy Chapter

• 文章专栏
• 企业微信交流群，使用微信或者企业微信扫描加入

总结 Copy Chapter

如果您准备好了，那就 开始接入 Hippy 吧。

2. Official Technical Reference & Guides (Tencent/Tencent.github.io) Copy Chapter

File: konajdk/sm/README.md Copy Chapter

Tencent Kona JDK ShangMi Reference Guide

Overview of ShangMi Copy Chapter

ShangMi is a set of cryptographic techniques and tools in commercial or business applications, including the encryption of sensitive business data, secure communication channels, digital signatures for document verification, and even more.

Generally, the below ShangMi cryptographic algorithms and secure communication protocols are widely applied.

ShangMi cryptographic algorithms Copy Section

• SM2, which is a public key algorithm based on Elliptic Curve Cryptography (ECC). It complies with China's specifications:
  • GB/T 32918.1-2016 Part 1：General
  • GB/T 32918.2-2016 Part 2：Digital signature algorithm
  • GB/T 32918.3-2016 Part 3：Key exchange protocol
  • GB/T 32918.4-2016 Part 4：Public key encryption algorithm
  • GB/T 32918.5-2017 Part 5：Parameter definition
• SM3, which is a cryptographic hash algorithm. It complies with China's specification:
  • GB/T 32905-2016 SM3 cryptographic hash algorithm
• SM4, which is a block encryption algorithm. It complies with China's specification:
  • GB/T 32907-2016 SM4 block cipher algorithm

ShangMi secure communication protocols Copy Section

• Transport Layer Cryptography Protocol (TLCP), which is a TLS liked protocol. This protocol requires an endpoint must have two certificates, one for signature and the other for encryption. It complies China's specification:
  • GB/T 38636-2020 Information security technology-Transport layer cryptography protocol (TLCP)
• ShangMi (SM) Cipher Suites for TLS 1.3, which defines elements for applying ShangMi algorithms over TLS 1.3. It complies IETF's Informational specification:
  • RFC 8998 ShangMi (SM) Cipher Suites for TLS 1.3

Providers and implementations Copy Chapter

Tencent Kona JDK extends Java Cryptography Architecture (JCA) and Java Cryptography Extension (JCE) providers, exactly SUN, SunEC and SunJCE, to support ShangMi cryptographic algorithms, and extends Java Secure Socket Extension (JSSE) provider, exactly SunJSSE, to support ShangMi secure communication protocols.

The algorithms are implemented by the different security providers in the JDK. The followings list the security providers and the corresponding supported ShangMi algorithms and protocols.

• SUN
  • MessageDigest
    • SM3
• SunEC
  • KeyAgreement
    • SM2
  • KeyFactory
    • SM2
  • Signature
    • SM3withSM2
• SunJCE
  • Cipher
    • SM4
  • KeyGenerator
    • HmacSM3
    • SM4
  • Mac
    • HmacSM3
• SunJSSE
  • SSLContext
    • TLCP 1.1
      • ECC_SM4_GCM_SM3
      • ECC_SM4_CBC_SM3
      • ECDHE_SM4_GCM_SM3
      • ECDHE_SM4_CBC_SM3
    • TLS 1.3/RFC 8998
      • TLS_SM4_GCM_SM3

Since Tencent Kona JDK just uses the existing OpenJDK security providers to accommodate the ShangMi stuff, and these providers are already installed with the highest priorities, so the application developers can use these out-of-the-box features as those JDK built-in algorithms (e.g. EC and AES) and protocols (e.g. TLS 1.3).

The following sections will unveil the details on using the above algorithms and protocols.

SM2 Copy Chapter

Key pair Copy Section

Generating SM2 key pair is the same as generating the key pairs on other EC curves. It just needs to invoke the standard JDK APIs. The JDK builtin ECKeyPairGenerator. In the key pair generated by this implementation, the format of private key is PKCS#8 and the format of public key is X.509.

Create KeyPairGenerator implementation for EC algorithm.

KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC);
keyPairGenerator.initialize(spec);

spec can be SM2ParameterSpec (use SM2ParameterSpec.instance() to create the instance) or ECGenParameterSpec (use new ECGenParameterSpec("curveSM2") to create the instance).

Generate key pair.

KeyPair keyPair = keyPairGenerator.generateKeyPair();
ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic();
ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate();

SM2 key pair is also EC key pair, so the public key and private key are also ECPublicKey and ECPrivateKey respectively.

For more information on key pair generation, please refer to the official KeyPairGenerator docs.

Generally, in the signing and encrypting operations, the key pairs are already generated. They are not generated on the runtime. It just reads the existing public key and private key to create PublicKey and PrivateKey instances respectively.

byte[] encodedPublicKey = ;
byte[] encodedPrivateKey = ;

KeyFactory keyFactory = KeyFactory.getInstance("SM2");

SM2PublicKeySpec publicKeySpec = new SM2PublicKeySpec(encodedPublicKey);
PublicKey publicKey = keyFactory.generatePublic(publicKeySpec);

SM2PrivateKeySpec privateKeySpec = new SM2PrivateKeySpec(encodedPrivateKey);
PrivateKey privateKey = keyFactory.generatePrivate(privateKeySpec);

Signature Copy Section

Using SM2 signature is the same as using other existing signatures, like ECDSA, though the parameters are different.

Create Signature instance.

Signature signature = Signature.getInstance("SM3withSM2);

Initialize the Signature instance with the private key for signing.

signature.initSign(privateKey);

Behind the above initialization, it uses the default SM2 ID, exactly 1234567812345678. It also derives the public key from the private key. According to the associated specification, public key must be used for generating SM2 signature data. This is a significant difference between the international algorithms, like ECDSA, and SM2 signature algorithm. Note that calculating the public key leads to some overhead. That is harmful for the performance.

If not using the default ID or expect to eliminate the cost on calculating public key, it would provide an AlgorithmParameterSpec, exactly SM2SignatureParameterSpec, instance.

byte[] altID = <custom ID>;
ECPublicKey publicKey = ;
SM2SignatureParameterSpec paramSpec = new SM2SignatureParameterSpec(altID, publicKey);
signature.setParameter(paramSpec);
signature.initSign(privateKey);

After parameter setup and initialization, it is time to pass the message data in.

byte[] message = ;
signature.update(message);

Generate signature data.

byte[] sign = signature.sign();

Initialize the Signature instance with public key for verifying.

signature.initVerify(publicKey);

Pass the message in.

byte[] message = ;
signature.update(message);

Pass the signature data in.

boolean verified = signature.verify(sign);

If the verification is successful, the result is true, otherwise false.

It has to know that the private key is used for signing, however the public key is used for verifying. For detailed information about Signature APIs, please refer to the official Signature docs.

Encryption Copy Section

Because of the performance concern, public key encryption is only used for encrypting short but critical data. The same to SM2 encryption.

Create Cipher instance.

Cipher cipher = Cipher.getInstance("SM2");

Initialize the Cipher instance with public key and set the mode to encryption.

cipher.init(Cipher.ENCRYPT_MODE, publicKey);

Pass the message in and generate the ciphertext.

byte[] message = ;
byte[] ciphertext = cipher.doFinal(message);

Initialize the Cipher instance with private key and set the mode to decryption.

cipher.init(Cipher.DECRYPT_MODE, privateKey);

Pass the ciphertext in and generate the plaintext.

byte[] cleartext = cipher.doFinal(ciphertext);

It has to know that public key is used for encryption, however the private key is used for decryption. For detailed information on Cipher APIs, please refer to the official Cipher docs.

SM3 Copy Chapter

Using SM3 hash algorithm is the same as using other existing hash algorithm, like SHA-256. It only invokes JDK APIs to generate the message digest (hash).

Create MessageDigest instance.

MessageDigest md = MessageDigest.getInstance("SM3");

It can pass all the message in and generate the digest.

byte[] message = ;
byte[] digest = md.digest(message);

It also can pass the message segments, and finally generate the digest.

byte[] messageSegment1 = ;
byte[] messageSegment2 = ;

// Pass the message segments in
md.update(messageSegment1);
md.update(messageSegment2);

// Finally generate the digest
byte[] digest = md.digest();

For detailed information about MessageDigest APIs, please refer to the official MessageDigest docs.

HmacSM3 Copy Chapter

Using HmacSM3 algorithm is the same as using other existing MAC algorithm, like HmacSHA256. It only invokes JDK APIs to generate the message authentication code.

Prepare a 16-bytes key.

byte[] key = ;
SecretKey secretKey = new SecretKeySpec(key, "SM4");

Create Mac instance.

Mac hmac = Mac.getInstance("HmacSM3");

Initialize the Mac instance with the key.

hmac.init(secretKey);

Pass all the message in and generate message authentication code. The code is 32-bytes length.

byte[] message = ;
byte[] mac = hmac.doFinal(message);

It also can pass the message segments, and finally generate the message authentication code.

byte[] messageSegment1 = ;
byte[] messageSegment2 = ;

// Pass the message segments in
hmac.update(messageSegment1);
hmac.update(messageSegment2);

// Finally generate the message authentication code
byte[] mac = hmac.doFinal();

For the detailed information about Mac APIs, please refer to the official Mac docs.

SM4 Copy Chapter

Using SM4 cipher algorithm is the same as using other existing block cipher algorithm, like AES. It only invokes JDK APIs to do encryption and decryption. Tencent Kona JDK supports four operation modes, including CBC, CTR, ECB and GCM. It also supports PKCS#7 padding specification.

Prepare a 16-bytes key.

byte[] key = ;
SecretKey secretKey = new SecretKeySpec(key, "SM4");

Create Cipher instance.

Cipher cipher = Cipher.getInstance(transformation);

The transformation consists of algorithm name, operation mode and padding type. A symbol / is used as separator between the parts.

The following transformations are supported:

• SM4/CBC/NoPadding: The operation mode is CBC. No padding is needed. It requires the input must be 16x bytes.
• SM4/CBC/PKCS7Padding: The operation mode is CBC. PKCS#7 padding is used. It doesn't require that the input must be 16x bytes.
• SM4/CTR/NoPadding: The operation mode is CBC. No padding is needed. It doesn't require that the input must be 16x bytes.
• SM4/ECB/NoPadding: The operation mode is ECB. No padding is needed. It requires the input must be 16x bytes.
• SM4/ECB/PKCS7Padding: The operation mode is ECB. PKCS#7 padding is used. It doesn't require that the input must be 16x bytes.
• SM4/GCM/NoPadding: The operation mode is GCM. No padding is needed. It doesn't require that the input must be 16x bytes.

Create the algorithm parameters.

AlgorithmParameterSpec paramSpec = ;

Different operation modes may need different AlgorithmParameterSpec types,

• CBC and CTR modes use IvParameterSpec. This parameter type needs a 16-bytes as Initialization Vector (IV).
• GCM mode uses GCMParameterSpec. This parameter type needs a 12-bytes as Initialization Vector (IV) and specifies the tag length to 12-bytes.

Initialize the Cipher instance with the key and parameter type and set the mode to encryption.

cipher.init(Cipher.ENCRYPT_MODE, secretKey, paramSpec);

Pass all the message in and generate the ciphertext.

byte[] ciphertext = cipher.doFinal(message);

Initialize the Cipher instance with the key and parameter type and set the mode to decryption.

cipher.init(Cipher.DECRYPT_MODE, secretKey);

Pass all the ciphertext in and generate the plaintext.

byte[] cleartext = cipher.doFinal(ciphertext);

It also can receive the plaintext/ciphertext segments in, and then generate the ciphertext/plaintext segments.

byte[] input1 = <segment1>;
byte[] input2 = <segment2>;

// Pass the plaintext/ciphertext segments in
byte[] output1 = cipher.update(input1);
byte[] output2 = cipher.update(input2);

// Generate the ciphertext/plaintext segments
byte[] outputFinal = cipher.doFinal();

For the detailed information about Cipher APIs, please refer to the official [Cipher] docs.

Certificate Copy Chapter

The so-called ShangMi certificate also complies to X.509 specification, though the public key algorithm is EC with SM2 curve and the signature algorithm is SM3withSM2.

String certPEM = <certificate in PEM format>;
CertificateFactory cf = CertificateFactory.getInstance("X.509");
X509Certificate certificate = (X509Certificate) cf.generateCertificate(
        new ByteArrayInputStream(certPEM.getBytes(StandardCharsets.UTF_8));

For more information on certificate parsing, please read the official reference on CertificateFactory.

It can parse public key from the ShangMi certificate.

PublicKey publicKey = certificate.getPublicKey();

publicKey can be cast to ECPublicKey.

It can parse private key from PKCS#8 format.

String peyPEM = ;
PKCS8EncodedKeySpec privateKeySpec = new PKCS8EncodedKeySpec(
        Base64.getMimeDecoder().decode(keyPem));
KeyFactory keyFactory = KeyFactory.getInstance("EC");
PrivateKey privateKey = keyFactory.generatePrivate(privateKeySpec);

privateKey can be cast to ECPrivateKey.

It can sign data with PKCS#8 private key and verify the signature with X.509 certificate.

Create Signature instance and use SM3withSM2 signature algorithm.

Signature signature = Signature.getInstance("SM3withSM2");

Sign the message with the private key and generate the signature data.

signature.initSign(privateKey);
signature.update(message);
byte[] sign = signature.sign();

Verify the signature data with the certificate and determine whether the verification passes or fails.

signature.initVerify(certificate);
signature.update(message);
boolean verified = signature.verify(sign);

The certificate has to contain digitalSignature key usage for verifying signature data. But it also can verify the signature with the public key directly.

signature.initVerify(publicKey);
signature.update(message);
boolean verified = signature.verify(sign);

TLCP 1.1 and TLS 1.3/RFC 8998 Copy Chapter

In order to take advantage of the implementations on TLCP 1.1 and TLS 1.3/RFC 8998, the most important point is taking SSLSocket or SSLEngine to apply the SSLContext implementation that supports the protocols.

KeyStore trustStore = <a trust store carring the CAs>;
TrustManagerFactory tmf = TrustManagerFactory.getInstance("PKIX");
tmf.init(trustStore);

KeyStore keyStore = <a key store carring the end entity certificates>;
KeyManagerFactory kmf = KeyManagerFactory.getInstance("NewSunX509");
kmf.init(keyStore, keyStorePassword);

SSLContext context = SSLContext.getInstance("TLCPv1.1");
context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom());

When create SSLContext instances, it allows to specify the following context protocols:

• TLCPv1.1, which indicates only TLCP 1.1 is supported.
• TLSv1.3, which indicates only TLS 1.3 is supported.
• TLCP, which indicates TLCP 1.1, TLS 1.3 and TLS 1.2 are supported.

Please read the official JSSE reference for understanding it deeply.

File: konajdk/README.md Copy Chapter

Tencent Kona Copy Chapter

Tencent Kona is a no-cost, production-ready distribution of the Open Java Development Kit (OpenJDK), Long-Term Support (LTS) with quarterly updates.

Kona serves as the default JDK at Tencent internally, optimized for extreme-scale of Big Data, Machine Learning and Cloud Computing workloads. It is also used to build and maintain a Tencent supported version of OpenJDK for Tencent customers and partners who wish to use OpenJDK to run their applications.

Kona also implements China's cryptographic algorithms, including SM2, SM3 and SM4, and secure communication protocol TLCP (or SMSSL). For more details on these features, please refer to the reference guide.

Supported JDK Releases Copy Chapter

Tencent Kona currently supports the JDK Long-Term Support (LTS) releases 8, 11, 17, 21 and 25.
For more details, please go through the individual repository for each of these releases:

• Tencent Kona 8: https://github.com/Tencent/TencentKona-8
• Tencent Kona 11: https://github.com/Tencent/TencentKona-11
• Tencent Kona 17: https://github.com/Tencent/TencentKona-17
• Tencent Kona 21: https://github.com/Tencent/TencentKona-21
• Tencent Kona 25: https://github.com/Tencent/TencentKona-25

Supported System Platforms Copy Chapter

Tencent Kona currently supports Linux/x86_64, Linux/aarch64, Windows/x86_64, macOS/x86_64 and macOS/aarch64.

License Copy Chapter

Tencent Kona is under the same licensing terms as the upstream OpenJDK project. It is clearly a "friendly fork". Please find the license text for more details.