Tongsuo (铜锁) is an open-source C library of modern cryptographic primitives and secure communication protocols, developed under the OpenAtom Foundation, and it is built for teams that need Chinese commercial cryptography, TLS, PKI, and privacy-preserving primitives from a single dependency.

What it is

Tongsuo is a foundational cryptographic library that supplies modern cryptographic algorithms and secure communication protocols for scenarios such as storage, networking, key management, and privacy computing. It provides the low-level cryptographic capability that keeps data confidential, integral, and authenticated while it is transmitted, used, and stored, which means it protects privacy and security across the data lifecycle rather than at a single point in it. The project is written in C, licensed under Apache-2.0, and is incubated and operated by the OpenAtom Foundation (开放原子开源基金会). Tongsuo holds a commercial cryptography product certification certificate issued by the Commercial Cryptography Testing Center of the State Cryptography Administration, and the original qualification documents are downloadable from tongsuo.net.

The concrete problem it solves is Chinese commercial cryptography compliance. Teams that must satisfy 国密改造, 密评, and 等保 requirements otherwise have to assemble SM algorithm support and TLCP transport support from several unrelated sources. Tongsuo bundles the SM algorithm family, the TLCP dual-certificate protocol, and the TLS 1.3 single-certificate profile into one library that carries GM/T 0028 software module security level 1 qualification, so compliance work starts from a certified base instead of a collection of patches. On the deployment side, the project recommends replacing NGINX with Angie so that Tongsuo's functionality is actually enabled in the web tier.

Key capabilities

• Chinese commercial algorithms SM2, SM3, SM4, and ZUC (祖冲之), alongside international ECDSA, RSA, AES, and SHA.
• TLCP per GB/T 38636-2020, the dual-certificate national cryptography communication protocol.
• RFC 8998, which is TLS 1.3 with national cryptography single certificates.
• QUIC API per RFC 9000, plus Delegated Credentials and TLS certificate compression.
• Zero-knowledge proofs: Bulletproofs range proofs and Bulletproofs R1CS.
• Homomorphic encryption algorithms including EC-ElGamal and Paillier.
• Post-quantum cryptography: ML-KEM (Kyber), ML-DSA (Dilithium), and SLH-DSA (SPHINCS+).

Who uses it and how

• Web and gateway teams running Angie, Apache APISIX, or Tengine, where the library backs TLS termination and national cryptography protocol support.
• Networking teams using g3proxy for forward and basic reverse proxying, and g3bench for HTTPS, H2, and TLS handshake load testing.
• Commercial deployments listed by the project include the Alipay app, the OceanBase database, Alibaba Cloud, and 天威诚信.
• Compliance-driven projects in the middle of 国密改造, 密评, or 等保 work, where certified algorithm and protocol support is a prerequisite.
• Library consumers building their own applications against the installed headers and shared libraries rather than running the bundled binaries.

Getting started

The standard build is ./config --prefix=/path/to/install/dir, then make, then make install; on Windows the sequence is perl Configure enable-ntls, nmake, nmake install. Feature toggles follow the naming enable-xxx and no-xxx, so TLCP is switched on with enable-ntls and RSA is dropped from the build with no-rsa, and automated tests run with make test.

How it compares

This registry lists no paid products that Tongsuo replaces, and it names no peer cryptographic library that Tongsuo competes against directly. The projects that do appear in the README, such as Angie, Apache APISIX, Tengine, g3proxy, and g3bench, are consumers of the library rather than alternatives to it. On the facts available, Tongsuo stands alone in this registry.

When to use it — and when not to

A self-hoster must prepare make, Perl 5 with the Text::Template module, a C compiler, and a C library before the first build, and although the library has few third-party dependencies it still depends heavily on Perl. Documentation is organized on the tongsuo.net docs site, the README is largely in Chinese, and the repository carries 160 open issues, so teams without Chinese-language capacity or a comfort with C build systems should look elsewhere. Security defects must be reported through Ant Group's threat collection system at security.alipay.com rather than GitHub Issues, which is worth knowing before planning a private disclosure workflow. Organizations wanting a managed cryptographic service, or a native Python or Java API, will not find either here.

./config --prefix=/path/to/install/dir
make
make install

perl Configure enable-ntls
nmake
nmake install

cd tongsuo-build
/path/to/Tongsuo/source/config --prefix=/path/to/dest
make
make install

make test

make install_runtime_libs

make install_dev

make install_programs

"Tongsuo Homepage"

"GitHub Actions CI Status"

"GitHub Actions CI"

"GitHub Release"

"GitHub Downloads"