SM2 vs RSA: How to Choose Between Chinese and International Public-Key Crypto

The one-line answer

If you have Chinese compliance requirements (等保 classified protection, government, finance, SOEs) — SM2, no discussion. For pure technical choices both are secure: SM2 has shorter keys, RSA has a deeper ecosystem. In practice this is rarely an algorithm-quality question; it's a compliance question.

What they are

• RSA (1977): security rests on the hardness of integer factorization. The most widely deployed public-key algorithm — HTTPS certificates, SSH, JWT signing.
• SM2 (2010, national standard GB/T 32918-2016): a 256-bit elliptic-curve scheme from the Chinese Cryptocurrency Administration, security resting on the elliptic-curve discrete logarithm problem (ECDLP).

Head-to-head

| Dimension | SM2 | RSA | |---|---|---| | Math basis | ECDLP | integer factorization | | Recommended key size | 256-bit | 2048-bit (3072 to be safe) | | Strength equivalence | 256-bit SM2 ≈ 3072-bit RSA | 3072-bit ≈ 128-bit security | | Signing speed | fast (scalar mult) | slow (modular exponentiation) | | Verification speed | slow | fast | | Signature size | short (~70 bytes DER) | long (256 bytes at 2048-bit) | | Ecosystem | mature in China (crypto cards, UKeys, GM TLS) | universal globally | | Compliance | required for Chinese classified protection | does not satisfy GM requirements |

Performance nuance: SM2 signs fast and verifies slowly; RSA is the reverse (verification benefits from the small exponent e=65537). Certificate-heavy flows (TLS handshakes) favor RSA verification; signing-heavy flows (IoT telemetry) favor SM2.

Three questions that decide it

1. Is there a compliance mandate?

等保 2.0 level 3+, government systems, regulated finance, SOE informatization — SM2 is mandatory (usually as the SM2/SM3/SM4 suite). Without a hard mandate, choose freely.

2. What does the other end speak?

The counterparty often decides: government platform integration requires SM2 certificates; international payment rails expect RSA. Transition periods commonly run dual certificates — one SM2, one RSA — negotiating per peer. Nginx with a GM fork (Tongsuo/BabaSSL) supports dual-certificate deployment.

3. Is key size sensitive?

In IoT/embedded, a 256-bit SM2 private key saves an order of magnitude in storage and bandwidth versus 3072-bit RSA, and signatures are ~70 bytes instead of 384 — meaningful on narrow-band networks.

The most common interop pitfall: C1C3C2 vs C1C2C3

An SM2 ciphertext has three parts: C1 (an EC point), C2 (the encrypted data), C3 (an SM3 digest). The old standard (GM/T 0003) orders them C1C2C3; the newer GB/T 32918.4-2016 recommends C1C3C2 — the two are incompatible, and this mismatch explains most interop failures:

• Java BouncyCastle defaults to C1C2C3 (switchable via parameter)
• The sm-crypto JS library takes a cipherMode flag (1 = C1C3C2)
• When the peer can't decrypt, confirm the ciphertext structure first

Use the online SM2 tool as a verified counterparty: generate a keypair, encrypt a known plaintext, and send the ciphertext to the peer — if it decrypts, your formats match.

Key format cheat sheet

SM2 public key:  130 hex chars (04 prefix + X 32B + Y 32B, uncompressed)
SM2 private key: 64 hex chars (32-byte scalar)

A compressed form (66 hex chars) exists too; some HSMs/UKeys emit it — convert during integration.

Migration notes (RSA → SM2)

1. Rebuild the certificate chain: SM2 certificates from a GM CA (CFCA, Shanghai CA, ...)
2. TLS stack: standard OpenSSL lacks GM TLS — use Tongsuo (formerly BabaSSL) or GmSSL
3. Data: existing RSA-encrypted data must be decrypted and re-encrypted — no in-place swap
4. Transition: run dual certificates for 3-6 months with gradual traffic shifting

Checklist

1. Compliance mandate → SM2, done
2. Match the peer — and confirm C1C3C2 vs C1C2C3 first when debugging
3. Verification-heavy (TLS) favors RSA; signing-heavy (IoT) favors SM2
4. Migrate via dual certificates, never a hard cutover
5. Debug with the online SM2 tool to isolate the algorithm layer

Provided by ToolVault. Related tools: SM2 Encrypt/Sign, SM3 Hash, SM4 Encrypt/Decrypt, JWT Decoder. Related reading: Chinese cryptography guide, SM3 vs SHA-256. See the homepage for more developer tools.