int SM2_decrypt(const EC_KEY *key,
                const EVP_MD *digest,
                const uint8_t *ciphertext,
                size_t ciphertext_len, uint8_t *ptext_buf, size_t *ptext_len)
{
    int rc = 0;
    int i;

    BN_CTX *ctx = NULL;
    const EC_GROUP *group = EC_KEY_get0_group(key);
    EC_POINT *C1 = NULL;
    struct SM2_Ciphertext_st *sm2_ctext = NULL;
    BIGNUM *x2 = NULL;
    BIGNUM *y2 = NULL;

    uint8_t *x2y2 = NULL;
    uint8_t *computed_C3 = NULL;

    const size_t field_size = EC_field_size(group);
    const int hash_size = EVP_MD_size(digest);

    uint8_t *msg_mask = NULL;
    const uint8_t *C2 = NULL;
    const uint8_t *C3 = NULL;
    int msg_len = 0;
    EVP_MD_CTX *hash = NULL;

    if (field_size == 0 || hash_size == 0)
       goto done;

    memset(ptext_buf, 0xFF, *ptext_len);

    sm2_ctext = d2i_SM2_Ciphertext(NULL, &ciphertext, ciphertext_len);

    if (sm2_ctext == NULL)
        goto done;

    if (sm2_ctext->C3->length != hash_size)
        goto done;

    C2 = sm2_ctext->C2->data;
    C3 = sm2_ctext->C3->data;
    msg_len = sm2_ctext->C2->length;

    ctx = BN_CTX_new();
    if (ctx == NULL)
       goto done;

    BN_CTX_start(ctx);
    x2 = BN_CTX_get(ctx);
    y2 = BN_CTX_get(ctx);

    if(y2 == NULL)
       goto done;

    msg_mask = OPENSSL_zalloc(msg_len);
    x2y2 = OPENSSL_zalloc(2 * field_size);
    computed_C3 = OPENSSL_zalloc(hash_size);

    if(msg_mask == NULL || x2y2 == NULL || computed_C3 == NULL)
       goto done;

    C1 = EC_POINT_new(group);
    if (C1 == NULL)
        goto done;

    if (EC_POINT_set_affine_coordinates_GFp
        (group, C1, sm2_ctext->C1x, sm2_ctext->C1y, ctx) == 0)
        goto done;

    if (EC_POINT_mul(group, C1, NULL, C1, EC_KEY_get0_private_key(key), ctx) ==
        0)
        goto done;

    if (EC_POINT_get_affine_coordinates_GFp(group, C1, x2, y2, ctx) == 0)
        goto done;

    BN_bn2binpad(x2, x2y2, field_size);
    BN_bn2binpad(y2, x2y2 + field_size, field_size);

    if (ECDH_KDF_X9_62(msg_mask, msg_len, x2y2, 2 * field_size, NULL, 0, digest)
        == 0)
        goto done;

    for (i = 0; i != msg_len; ++i)
        ptext_buf[i] = C2[i] ^ msg_mask[i];

    hash = EVP_MD_CTX_new();

    if (hash == NULL)
       goto done;

    if (EVP_DigestInit(hash, digest) == 0)
        goto done;

    if (EVP_DigestUpdate(hash, x2y2, field_size) == 0)
        goto done;

    if (EVP_DigestUpdate(hash, ptext_buf, msg_len) == 0)
        goto done;

    if (EVP_DigestUpdate(hash, x2y2 + field_size, field_size) == 0)
        goto done;

    if (EVP_DigestFinal(hash, computed_C3, NULL) == 0)
        goto done;

    if (memcmp(computed_C3, C3, hash_size) != 0)
        goto done;

    rc = 1;
    *ptext_len = msg_len;

 done:

    if (rc == 0)
        memset(ptext_buf, 0, *ptext_len);

    OPENSSL_free(msg_mask);
    OPENSSL_free(x2y2);
    OPENSSL_free(computed_C3);
    EC_POINT_free(C1);
    BN_CTX_free(ctx);
    SM2_Ciphertext_free(sm2_ctext);
    EVP_MD_CTX_free(hash);

    return rc;
}