gmssl
Pure-Python SM2/SM3/SM4 implementation
Decision gist · record as of 2026-08-14
Yes, if you need SM2/SM3/SM4 cryptography and accept dormant maintenance. The package has no dependencies, installs easily, and carries no known vulnerabilities. However, do not use it for new projects requiring active security support or Python version compatibility guarantees—consider it suitable for legacy systems, Chinese regulatory compliance scenarios, or interoperability with existing gmssl deployments where the risk of unpatched issues is acceptable.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Low install friction with no runtime dependencies.
- Dormant maintenance status—last release June 2022—means security updates and compatibility fixes are unlikely to arrive quickly.
License · maintenance · safety
BSD (permissive) — BSD permissive license allows use in both open-source and closed-source commercial applications without requiring source disclosure.
last release 2022-06-21 (1515 days) · last repo commit 2024-12-08 · 559 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 153,541 downloads/mo, #10,877 on PyPI
Alternatives
Verify before relying
pip install gmssl
from gmssl import sm2
private_key = '00B9AB0B828FF68872F21A837FC303668428DEA11DCD1B24429D0C99E24EED83D5'
public_key = 'B9C9A6E04E9C91F7BA880429273747D7EF5DDEB0BB2FF6317EB00BEF331A83081A6994B8993F3F5D6EADDDB81872266C87C018FB4162F5AF347B483E24620207'
sm2_crypt = sm2.CryptSM2(public_key=public_key, private_key=private_key)
enc_data = sm2_crypt.encrypt(b'111')
dec_data = sm2_crypt.decrypt(enc_data)- Whether the SM2, SM3, and SM4 implementations have undergone formal cryptographic audit or validation against official Chinese standards.
- Current compatibility with modern Python versions, given the dormant maintenance status and lack of specified Python support.
- Whether the package is suitable for production use in regulated environments requiring certified implementations.
What it is and what it does
gmssl is a pure-Python cryptographic library implementing China's national standard algorithms: SM2 (elliptic curve public-key cryptography), SM3 (cryptographic hash), and SM4 (block cipher). It provides functions for encryption, decryption, digital signing, and verification without external compiled dependencies. The package is designed for applications needing to interoperate with Chinese cryptographic standards or systems, particularly where SM2 key exchange, SM4 block encryption in ECB or CBC modes, and SM3-based signatures are required.
The library has no runtime dependencies and installs as a pure wheel. However, maintenance is dormant—the last release was June 2022—so security patches, bug fixes, and compatibility updates with newer Python versions are not actively maintained. It remains available and functional for existing deployments, but adopters should be aware that issues discovered after the last release are unlikely to receive fixes from the upstream project.
Use it for
- Encrypt and decrypt data using SM2 elliptic curve cryptography for systems requiring Chinese national standard compliance.
- Sign and verify messages with SM2 or SM3 hash integration for authentication in Chinese regulatory or enterprise environments.
- Perform symmetric block encryption with SM4 in ECB or CBC modes for data protection in applications mandated to use national standards.
- Interoperate with systems already using gmssl or compatible SM2/SM3/SM4 implementations, including ASN.1 mode for Java compatibility.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need SM2/SM3/SM4 cryptography and accept dormant maintenance.
The package has no dependencies, installs easily, and carries no known vulnerabilities. However, do not use it for new projects requiring active security support or Python version compatibility guarantees—consider it suitable for legacy systems, Chinese regulatory compliance scenarios, or interoperability with existing gmssl deployments where the risk of unpatched issues is acceptable.
Install
gmssl on PyPI
Before you install
Low install friction with no runtime dependencies. Dormant maintenance status—last release June 2022—means security updates and compatibility fixes are unlikely to arrive quickly.
License in practice
BSD permissive license allows use in both open-source and closed-source commercial applications without requiring source disclosure.
Quickstart
pip install gmssl
from gmssl import sm2
private_key = '00B9AB0B828FF68872F21A837FC303668428DEA11DCD1B24429D0C99E24EED83D5'
public_key = 'B9C9A6E04E9C91F7BA880429273747D7EF5DDEB0BB2FF6317EB00BEF331A83081A6994B8993F3F5D6EADDDB81872266C87C018FB4162F5AF347B483E24620207'
sm2_crypt = sm2.CryptSM2(public_key=public_key, private_key=private_key)
enc_data = sm2_crypt.encrypt(b'111')
dec_data = sm2_crypt.decrypt(enc_data)Verify before relying
- Whether the SM2, SM3, and SM4 implementations have undergone formal cryptographic audit or validation against official Chinese standards.
- Current compatibility with modern Python versions, given the dormant maintenance status and lack of specified Python support.
- Whether the package is suitable for production use in regulated environments requiring certified implementations.
Package facts
| License | BSD permissive |
| Python support | Not specified |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | None |
| Maintenance | Dormant 1,515 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 153,541 / month, #10,877 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
Evidence: gmssl-3.2.2-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “SM2 SM3 SM4 cryptography”
- gmsslPure-Python implementation of SM2, SM3, and SM4 Chinese national…
- types-cryptographyProvides PEP 561 type stubs for the cryptography package, enabling…
- libnaclPython bindings to libsodium's NaCl cryptography library, providing…
Give your agent the search over MCP, or paste the wish link into any chat.
More Cryptography packages
Certifi provides Mozilla's curated collection of root SSL certificates for Python applications to validate TLS hosts and verify certificate trustworthiness.
cryptography provides cryptographic recipes and low-level primitives for symmetric encryption, message digests, key derivation, and other common cryptographic algorithms in Python.
Pure-Python RSA encryption, decryption, signing, and key generation following PKCS#1 v1.5, with command-line and library interfaces.
pyOpenSSL wraps OpenSSL's SSL/TLS functionality for Python, providing high-level connection objects and certificate handling through a Python-friendly interface around OpenSSL's cryptographic operations.
Provides Microsoft Entra ID token-based authentication for Azure SDK clients through a set of TokenCredential implementations that handle OAuth flows and managed identity support.
PyNaCl provides Python bindings to libsodium for digital signatures, secret-key and public-key encryption, hashing, message authentication, and password-based key derivation.
See also sslcrypto · py-ecc · eciespy · lightphe · PGPy · pyDes · fastecdsa · aws-encryption-sdk · pywidevine