Pure-MoonBit crypto & CTF toolbox (a port of ToolsFx): national crypto SM2/SM3/SM4 (GB/T 32905/32907/32918, byte-for-byte standard vectors), encoding toolkit (Base16/32/58/58Check/62/64/85/91, Punycode, URL, radix, QP, UU/XX), classical ciphers with ciphertext auto-detection, and a single-JSON-dispatch workbench shared by the browser frontend and the moon run demo.

crypto

ctf

encoding

sm2

sm3

sm4

chinese-national-crypto

base16

base32

base58

base62

base64

ascii85

base91

punycode

classical

cipher

vigenere

toolsfx

moon add 2d5rrr333/toolsfx-moonbit@0.3.0

Download zip

Author

2d5rrr333

Version

0.3.0

License

ISC

Repository

github.com/2d5rrr333/toolsfx-moonbit

Last updated

10 hours ago

Downloads

Dependencies

cc06b/mooncry0.20.0

README

#toolsfx-moonbit

Pure-MoonBit cryptography & CTF toolbox — a behavior-aligned port of ToolsFx. 纯 MoonBit 密码学与 CTF 工具箱 —— ToolsFx 的行为对齐移植。

Online workbench 在线工作台: https://2d5rrr333.github.io/toolsfx-moonbit/（纯静态、浏览器本地计算、断网可用） mooncakes: https://mooncakes.io/docs/2d5rrr333/toolsfx-moonbit

2d5rrr333/toolsfx-moonbit is a pure-MoonBit, zero-FFI toolbox covering:

国密 National crypto: SM3 hash (GB/T 32905-2016), SM4 block cipher with ECB/CBC/CTR/GCM (GB/T 32907-2016), SM2 signatures & public-key encryption (GB/T 32918 series, incl. DER per GM/T 0009) — the first pure-MoonBit GM suite on mooncakes.io. 国密三件套：SM3 摘要、SM4 分组密码（ECB/CBC/CTR/GCM）、SM2 签名与公钥加密（含 DER）。
CTF / classical ciphers: Caesar / ROT5/13/18/47 / Atbash, Vigenère / Beaufort / Autokey / Gronsfeld / Affine, Polybius / Bacon / Playfair / ADFGX / ADFGVX, rail fence, Morse, one-time pad, plus oddball encodings (Brainfuck / Ook! / Braille / alphabet numbers / 01248 / Gray code / QWERTY / socialist-core-values / periodic table / Bubble Babble), with ciphertext auto-detection (classical.detect).
Encoding toolkit: Base16/32/58/58Check/62/64/85/91, Punycode (RFC 3492), URL percent-encoding, Unicode/JS hex/octal escapes, radix 2-36 (bigint), Quoted-Printable, UU/XX.
Workbench: one JSON dispatch (module/op/params → ok/result or code/msg_zh/msg_en) shared by the browser frontend, native end-to-end tests, and the moon run demo.
General-purpose crypto is reused from mooncry (MD5/SHA family, AES modes, ChaCha20, HMAC, KDF, …).

#Feature matrix 功能矩阵

Capability 能力	Status 状态
Encoding toolkit 编码工具库	✅ released (v0.2.0)
Classical ciphers + auto-detect 古典密码 + 自动识别	✅ released (v0.2.0)
SM3 (one-shot + streaming)	✅ GB/T 32905 App.A vectors
SM4 (ECB/CBC/PKCS7/CTR/GCM)	✅ GB/T 32907 vector + RFC 8452 GHASH cross-check
SM2 keygen / sign / verify / encrypt / decrypt (raw + DER, C1C3C2/C1C2C3)	✅ GM/T 0003.5 Annex A vectors (byte-for-byte)
JSON dispatch + registry (49 routes)	✅ 10 native e2e tests
Browser workbench + GitHub Pages	✅ auto-deployed from main

#Quick start 快速开始

moon run cmd/demo -- sm3 abc
# 66c7f0f462eeedd9d1f2d46bdc10e4e24167c4875cf2f7a2297da02b8f4ba8e0

moon run cmd/demo -- caesar_encode Hello --shift=3      # Khoor
moon run cmd/demo -- vigenere_encode ATTACKATDAWN --key=LEMON
moon run cmd/demo -- detect "Gur dhvpx oebja sbk whzcf bire gur ynml qbt"
moon run cmd/demo -- sha256 abc
moon run cmd/demo -- sm4_encrypt secret --mode=cbc \
  --key_hex=0123456789abcdeffedcba9876543210 \
  --iv_hex=000102030405060708090a0b0c0d0e0f

No args prints the usage plus the live capability list. The same dispatch protocol drives the online workbench; errors are structured (code + msg_zh/msg_en) in all three front-ends.

#Performance boundary 性能边界

Reference timings, js backend (V8, desktop CPU, debug build; interactive use — not a constant-time or hardened implementation):

Operation	~time
SM3 (short message)	~0.04 ms
SM2 sign / verify	~11 / ~10 ms
SM2 decrypt	~5 ms

SM2 on-wasm/native is slower than C libraries (bigint-based scalar math) but comfortably interactive. Not audited: this is a toolbox/teaching library, not a certified security product. 性能为参考值；本库未审计、非恒定时间实现。

#Upstream & License 上游与许可

Project 项目	License 许可	Relationship 关系
ToolsFx (Leon406)	ISC	Behavior-aligned port source 行为对齐移植来源
mooncry (cc06b)	Apache-2.0	General crypto dependency 通用密码原语依赖
toolsfx-moonbit (this project)	ISC	—

This project reimplements algorithms in MoonBit rather than copying upstream source. See docs/compatibility.md for the ported scope and explicitly not-ported features (desktop GUI, QR/OCR, network scanning, online-service codecs, and non-sm2p256v1 example curves). 本项目按 MoonBit 习惯重新实现算法，不复制上游源码；移植范围与未移植项见 docs/compatibility.md。

#Development 开发

moon check --deny-warn          # native (needs a C toolchain)
moon test --deny-warn --target wasm-gc   # full suite (193 tests)
moon build web --target js      # browser bridge for the workbench

CI (GitHub Actions) runs fmt/info/check/test with --deny-warn, wasm-gc checks, and deploys the workbench to GitHub Pages on every push to main.

#Status 状态

Module scaffold / CI / registration material
Encoding toolkit (Base16/32/58/58Check/62/64/85/91, Punycode, URL, JS escapes, radix, QP, UU/XX)
Classical ciphers + oddball encodings + auto-detection
SM2/SM3/SM4 (GB/T vectors, byte-for-byte)
Workbench (dispatch + web) — deployed to GitHub Pages