A spatial impedance obfuscation protection method for SM2 digital signature algorithm

Abstract

The present invention belongs to the field of identity authentication technology and discloses a spatial impedance obfuscation protection method for an SM2 digital signature algorithm. The method comprises: step 1 key generation, step 2 obfuscation, step 3 signature, and step 4 signature verification. The above steps use four algorithms, including: a key generation algorithm, an obfuscation algorithm, a signature algorithm, and a signature verification algorithm. Based on the spatial impedance obfuscation method, the present invention obfuscates the original signature algorithm using a private key into a signature algorithm using a lookup table, and has the following characteristics: (1) high security: the private key information is hidden in the lookup table, thereby effectively reducing the risk of private key exposure due to side channel attacks, and has provable white box security and reliable black box security; (2) strong compatibility: the signature generated by the obfuscated signature algorithm can be verified by the SM2 standard signature verification algorithm. The embodiment shows that the present method has high performance and economical energy consumption.

Description

Technical Field

[0001] The present invention belongs to the technical field of identity authentication, and in particular relates to a spatial impedance obfuscation protection method for an SM2 digital signature algorithm. Background Art

[0002] SM2 is a suite of public-key cryptographic algorithms based on elliptic curves, published as a Chinese national standard (GBT.32918-2016). This suite includes digital signature algorithms, key exchange protocols, and public-key encryption algorithms. The SM2 digital signature algorithm has been adopted as an international standard (ISO / IEC.14888-2018). OpenSSL, a renowned open-source cryptographic library for secure communications, also supports the SM2 digital signature algorithm.

[0003] Digital signature algorithms must be robustly secure to prevent key leakage. Private keys must be accessible only to the key owner. Otherwise, a malicious user, once they obtain the private key, could impersonate the key owner and generate digital signatures. The SM2 digital signature algorithm offers high security under the black-box attack model. This model assumes that the cryptographic algorithm behaves like a black box to an attacker. In this model, attackers can only intercept or query the algorithm's input and output pairs, but cannot access the algorithm code, intermediate variables, or execution traces. This assumption holds true only when the communication channel is insecure but the computing device is trustworthy.

[0004] However, the actual application scenarios of the SM2 digital signature algorithm are complex, and the assumptions of the black-box attack model do not always hold true. This is because SM2 is typically executed in an untrusted environment, allowing attackers to access the algorithm's internal design or observe its dynamic execution. By controlling the execution environment, attackers can exploit side-channel attacks to extract the SM2 signature private key. Furthermore, some blockchain nodes running digital signatures are deployed in cloud virtual machines, which are vulnerable to shared cache attacks. If an attacker-controlled virtual machine is located on the same host as the blockchain virtual machine, the attacker can illegally access the latter's private data, including the signature private key.

[0005] Given SM2's high susceptibility to side-channel attacks, designing an effective defense method is crucial. Although various countermeasures have been proposed to deal with side-channel attacks, most of them have certain limitations. For example, Das et al. mentioned in the paper "STELLAR: A generic EM side-channel attack protection through ground-uproot-cause analysis" that providing computing devices with specific electromagnetic shielding can effectively reduce the intensity of electromagnetic radiation. Executing cryptographic algorithms within trusted execution environments such as ARM TrustZone and Intel Software Guard Extensions (SGX) can also make signals leaked from side channels difficult to observe. However, these solutions can only target one or several types of side-channel attacks, or have certain security vulnerabilities. Summary of the Invention

[0006] The technical solutions of the present invention are as follows:

[0007] A spatial impedance obfuscation protection method for the SM2 digital signature algorithm, suitable for countering side-channel attacks, including:

[0008] Step 1: key generation;

[0009] Step 2: Obfuscation;

[0010] Step 3 Signature;

[0011] Step 4: Signature verification.

[0012] The present invention aims to address the shortcomings of existing SM2 signature private key protection methods against side-channel attacks, thereby improving the security of SM2 private keys during the signing process. This invention uses spatial impedance obfuscation to hide private key information by converting the original program into an obfuscated program with a larger code size and greater difficulty to understand, without changing the functionality of the cryptographic program. If the code size obtained by an attacker is below a certain threshold, the attacker cannot extract the hidden information.

[0013] Specifically, the present invention, based on Lagrange interpolation, first splits the private key of the SM2 digital signature scheme into secret fragments that are integrated into a lookup table. This lookup table also contains other built-in parameters of the SM2 signature algorithm. Subsequently, the present invention employs a novel signature algorithm that uses the lookup table instead of the private key to generate the signature. The signature generated by this novel signature algorithm is fully compatible with the verification algorithm of the standard SM2 signature. The present invention has provable security, and the probability of calculating the original private key information is negligible given the limited code size obtained by the attacker. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a structural diagram of the lookup table T = (T1, T2, T3);

[0015] Figure 2 Flowchart for practical application of the present invention;

[0016] Figure 3 Obfuscation algorithm SHObf for different exposed volumes sign Performance test results;

[0017] Figure 4 Obfuscating signature algorithms for different exposed volumes Performance test results;

[0018] Figure 5 SHObf under different exposed volumes sign and Algorithm energy consumption test results; DETAILED DESCRIPTION

[0019] The present invention belongs to the field of identity authentication technology and discloses a spatial impedance obfuscation protection method for an SM2 digital signature algorithm. The method comprises: step 1 key generation, step 2 obfuscation, step 3 signature, and step 4 signature verification. The above steps use four algorithms, including: a key generation algorithm, an obfuscation algorithm, a signature algorithm, and a signature verification algorithm. Based on the spatial impedance obfuscation method, the present invention obfuscates the original signature algorithm using a private key into a signature algorithm using a lookup table, and has the following characteristics: (1) high security: the private key information is hidden in the lookup table, thereby effectively reducing the risk of private key exposure due to side channel attacks, and has provable white box security and reliable black box security; (2) strong compatibility: the signature generated by the obfuscated signature algorithm can be verified by the SM2 standard signature verification algorithm. The embodiment shows that the present method has high performance and economical energy consumption. The technical solution provided by the present invention will be further described below in conjunction with specific embodiments and their accompanying drawings.

[0020] The symbols used in the present invention are shown in Table 1.

[0021] Table 1 Symbols used in the present invention

[0022]

[0023]

[0024] A spatial impedance obfuscation protection method for an SM2 digital signature algorithm, characterized by comprising the following steps:

[0025] Step 1: key generation;

[0026] Step 2: Obfuscation;

[0027] Step 3 Signature;

[0028] Step 4: Signature verification;

[0029] The above steps 1 and 4 reuse the SM2 national standard key generation algorithm and are therefore not original to the present invention.

[0030] Furthermore, the step 1 includes:

[0031] Step 1.1 The signer generates a key pair based on the security parameters. The key generation algorithm is as described in Algorithm 1:

[0032] Algorithm 1: Key generation algorithm KeyGen(1 λ ), where the input λ∈N (N is a set of natural numbers) is a specified security parameter and the output is a key pair (d, P). The process includes:

[0033] S1.1.1 From the finite field Z q Uniformly randomly select elements from ;

[0034] S1.1.2 Calculate P = dG, where G is the base point of the elliptic curve group;

[0035] S1.1.3 Output the key pair (d, P), where the private key is d and the public key is P;

[0036] Step 1.2 After Algorithm 1 is executed, the signer needs to disclose the public key P, and the private key d needs to be kept secret for use in the obfuscation step (step 2).

[0037] Furthermore, the step 2 includes:

[0038] Step 2.1 The signer generates a standard signature circuit based on the key pair (d, P) and the public parameter pub

[0039] Step 2.2 The signer executes Algorithm 2 to confuse the standard signature circuit; Algorithm 2 is designed as follows:

[0040] Algorithm 2: Obfuscation Algorithm Its input M is the size of the exposed code, and its output is To confuse the signature circuit, the process of Algorithm 2 includes:

[0041] S2.2.1 Calculation of two integers

[0042] S2.2.2 Randomly generate logq t-order polynomials, labeled f i (x)(i=1,…,logq);

[0043] S2.2.3 Generate nlogq secret shares ki,j =f i (j), where i = 1, ..., logq and j = 1, ..., n, create Figure 1 The lookup table T1 shown in FIG;

[0044] S2.2.4 Randomly generate logq polynomials of order t with constant terms of 0, labeled g i (x)(i=1,…,logq);

[0045] S2.2.5 Generate nlogq shares of secret b i,j =g i (j), where i = 1, ..., logq and j = 1, ..., n;

[0046] S2.2.6 Calculation of u i,j =(1+d) -1 k i,j +b i,j (i=1,…,logq and j=1,…,n), create Figure 1 The lookup table T2 shown in FIG;

[0047] S2.2.7 Randomly generate logq polynomials of order t with a constant term of 1, labeled h i (x)(i=1,…,logq);

[0048] S2.2.8 Generate nlogq shares of secret c i,j =h i (j), where i = 1, ..., logq and j = 1, ..., n;

[0049] S2.2.9 Calculation of v i,j =d(1+d) -1 c i,j (i=1,…,logq and j=1,…,n), create Figure 1 Lookup table T3 shown in ;

[0050] S2.2.10 Create a lookup table T = (T1, T2, T3), such as Figure 1 As shown;

[0051] S2.2.11 Output

[0052] Step 2.3 The signatory party will Deploy to devices that need to run the signature algorithm.

[0053] Furthermore, the step 3 includes:

[0054] Step 3.1 The signer runs the signing device To generate a signature, the process is shown in Algorithm 3:

[0055] Algorithm 3: Obfuscated Signature Circuit (i.e., signature algorithm), whose input m is the message to be signed and output σ is the signature; the process of Algorithm 3 includes:

[0056] S3.1.1 Parse the lookup table T into (T1, T2, T3);

[0057] S3.1.2 Calculate e = H(m) and e′ = H′(m), and denote the l-th bit of e′ by γ(l) (l = 1, …, 256);

[0058] S3.1.3 For each i that satisfies γ(i) = 1, use the lookup table T1 to calculate k j G=∑k i,j G(j=1,…,n);

[0059] S3.1.4 Calculation and r=(e+r x )modq;

[0060] The Lagrange interpolation is defined as follows: take any k+1 points (x0, y0)…(x k ,y k ), assuming that any two different x j are all different from each other, and the formula for the interpolation to obtain the unique k-degree polynomial L(x) is

[0061]

[0062] It is worth noting that calculating L(x) in the definition does not mean obtaining the coefficients of the polynomial, but rather means that any horizontal coordinate can be substituted to obtain its vertical coordinate value on the polynomial. For example, L(0) can be calculated by definition. Represents the zero value of the polynomial obtained by interpolating multiple points (the horizontal coordinates of these points default to increasing from 1 to n with a step size of 1).

[0063] S3.1.5 For each i satisfying γ(i) = 1, use the lookup table T2 to calculate u j =∑u i,j (j=1,…,n);

[0064] S3.1.6 Calculation

[0065] S3.1.7 For each i satisfying γ(i) = 1, use the lookup table T3 to calculate v j =∑v i,j (j=1,…,n);

[0066] S3.1.8 Calculation

[0067] S3.1.9 Calculate s = (s1 - s2) mod q;

[0068] S3.1.10 Output σ = (r, s).

[0069] Step 3.2: Broadcast the message m and signature σ = (r, s) to the message verifier;

[0070] Furthermore, the step 4 includes:

[0071] Step 4.1 The verification node receives the message m and signature σ = (r, s) broadcast by the signer;

[0072] Step 4.2: The verification node executes Algorithm 4 to verify whether the signature is legitimate. Algorithm 4 is designed as follows:

[0073] Algorithm 4: Verification algorithm Ver(m,σ,P), whose input m is the message, σ is the signature, and P is the public key of the signer. The process of Algorithm 4 includes:

[0074] S4.1 Verify r∈Z q , s∈Z q Is r+s≠q true? If not, output 0;

[0075] S4.2 Calculate (x′1, y′1) = sG + (r + s)P, r′ = (H(m) + r′ x )mod q;

[0076] S4.3 If r′=r, output 1, otherwise output 0.

[0077] Taking the Internet of Things (IoT) system as an example, the following introduces the various participants in this application scenario. Figure 2 :

[0078] The signing party in the Internet of Things (IoT) system is the user of each IoT device.

[0079] The devices deployed in an untrusted environment are embedded devices (such as surveillance cameras and sensors). The signer is the user of these IoT devices, and the verifier can be the IoT gateway used to verify the identity of the embedded device to be connected.

[0080] First, execute step 1 and run algorithm 1 to generate their respective key pairs. Then, the user executes step 2 and runs algorithm 2 to convert their respective private keys (d1,…,d n )Hidden in the obfuscation program In this example, these programs are deployed on embedded devices (device 1, …, device n) in an untrusted environment. The embedded devices then execute step 3 and run algorithm 3 to generate a series of signatures. Finally, the signature verifier executes step 4 and runs algorithm 4 to verify the validity of the signatures generated in step 3.

[0081] Figure 2 An intuitive description of the application scenario of the proposed method is given. In order to prevent key leakage, Algorithm 1KeyGen and Algorithm 2SHObf sign It should be executed in a trusted environment, otherwise the private keys used in these algorithms may be obtained by side channel attacks. ) securely generated, it can be deployed in an untrusted environment, and different devices can run their own To generate a digital signature. Even if The execution process of the algorithm is exposed to side-channel attacks. The characteristics of the lookup table T will also effectively protect the private key from being stolen. Since Algorithm 4Ver does not use private keys and is not related to key leakage, it does not require its execution environment.

[0082] Test effect verification

[0083] The spatial impedance obfuscation protection method for the SM2 digital signature algorithm proposed in this paper was tested on cloud virtual machines, embedded devices, personal computers, and smart phones. The experimental equipment is shown in Table 2.

[0084] Table 2 Experimental equipment list

[0085]

[0086] The cloud virtual machines were Alibaba Elastic Compute Service c6 (Cloud VM-1) and Alibaba Elastic Compute Service hfc6 (Cloud VM-2). The embedded devices were two devices with different architectures: the Raspberry Pi 4 Model B (Embedded device-1), which uses the ARM Cortex architecture, and the UP2 Grove (Embedded device-2), which uses the Intel x86 architecture. The smartphones were two Android smartphones: the Honor Magic 4 Pro (Smartphone-1) and the Honor 60 (Smartphone-2). The personal computers were a thin and light Surface Laptop 4 (PC-1) and an HP OMEN 16 gaming laptop (PC-2).

[0087] Figure 3 For SHObf sign The change of execution time with M, where Figure 3(a) is the evaluation result on high-performance equipment, Figure 3 (b) is the evaluation result on resource-constrained devices. The results show that SHObf sign They can be completed in 27s, 32s, 50s, and 250s respectively. Such short execution time can be ignored in practical applications because SHObf sign This only needs to be done once, and the resulting lookup table can be reused for any number of signatures, unless the private key d needs to be updated.

[0088] Figure 4 It shows that when the exposed volume M increases The changes in execution time, where Figure 4 (a) is the result on high-performance equipment, Figure 4 (b) is the result on resource-constrained devices. The highest efficiency is on personal computers, with execution times ranging from 0.3s to 1.6s, and the lowest efficiency is on embedded devices, with execution times ranging from 1.1s to 7.4s. The efficiency of the signature algorithm is lower than that of the standard SM2 signature scheme, but it is still suitable for scenarios where signatures do not need to be generated frequently, such as the authentication process between IoT devices and IoT gateways.

[0089] Devices with limited resources and power supply, such as embedded devices and smart phones, are also potential application scenarios of the present invention. The energy consumption of the cryptographic algorithms used on these devices should not be too high. sign and The results of energy consumption in one execution on embedded devices and smartphones are as follows Figure 5 The experimental results show that under different exposure M, SHObf sign The energy consumption range is about 16.1J~292.0J. The energy consumption range is about 1.0J to 7.9J.

[0090] The above description is only a description of the preferred embodiments of the present application and does not limit the scope of the present application. Any changes or modifications made by any person skilled in the art based on the above disclosed technical content should be regarded as equivalent valid embodiments and fall within the scope of protection of the technical solution of the present application.

Claims

1. A spatial impedance obfuscation protection method for an SM2 digital signature algorithm, characterized in that: Applicable to defending against side-channel attacks, including: Step 1: key generation; Step 2: Obfuscation; Step 3 Signature; Step 4: Signature verification; The step 2 includes: Step 2.1 The signer generates a standard signature circuit based on the key pair (d, P) and the public parameter pub Step 2.2 The signer executes Algorithm 2 to confuse the standard signature circuit; Algorithm 2 is designed as follows: Algorithm 2: Obfuscation Algorithm Its input M is the size of the exposed code, and its output is To obfuscate the signature circuit; Step 2.3 The signatory party will Deploy to the device that needs to run the signature algorithm; In step 2.2, the process of Algorithm 2 includes: S2.2.1 Calculation of two integers S2.2.2 Randomly generate logq t-order polynomials, labeled f i (x)(i=1,…,logq); S2.2.3 Generate nlogq secret shares k i,j =f i (j), where i = 1, ..., logq and j = 1, ..., n, create a lookup table T1; S2.2.4 Randomly generate logq t-order polynomials with constant terms of 0, labeled g i (x)(i=1,…,logq); S2.2.5 Generate nlogq shares of secret b i,j =g i (j), where i = 1,…,logq and j=1,…,n; S2.2.6 Calculation of u i,j =(1+d) -1 k i,j +b i,j (i=1,…,logq and j=1,…,n), create Create lookup table T2; S2.2.7 Randomly generate logq polynomials of order t with a constant term of 1, labeled h i (x)(i=1,…,logq); S2.2.8 Generate nlogq shares of secret c i,j =h i (j), where i = 1,…,logq and j=1,…,n; S2.2.9 Calculation of v i,j =d(1+d) -1 c i,j (i=1,…,logq and j=1,…,n), create a lookup table T3; S2.2.10 Create a lookup table T = (T1, T2, T3); S2.2.11 Output The lookup table is characterized as follows:

2. The SM2 digital signature algorithm spatial impedance obfuscation protection method according to claim 1, characterized in that: The step 3 comprises: Step 3.1 The signer runs the signing device To generate a signature, the process is shown in Algorithm 3: Algorithm 3: Obfuscated Signature Circuit (i.e., signature algorithm), whose input m is the message to be signed and output σ is the signature; Step 3.2: Broadcast the message m and signature σ = (r, s) to the message verifier.

3. The spatial impedance obfuscation protection method for the SM2 digital signature algorithm according to claim 2, wherein: In step 3.1, the process of Algorithm 2 includes: S3.1.1 Parse the lookup table T into (T1, T2, T3); S3.1.2 Calculate e = H(m) and e′ = H′(m), and denote the l-th bit of e′ by γ(l) (l = 1, …, 256); S3.1.3 For each i that satisfies γ(i) = 1, use the lookup table T1 to calculate k j G=∑k i,j G(j=1,…,n); S3.1.4 Calculation and r=(e+r x )mod q; S3.1.5 For each i satisfying γ(i) = 1, use the lookup table T2 to calculate u j =∑u i,j (j=1,…,n); S3.1.6 Calculation S3.1.7 For each i satisfying γ(i) = 1, use the lookup table T3 to calculate v j =∑v i,j (j=1,…,n); S3.1.8 Calculation S3.1.9 Calculate s = (s1 - s2) mod q; S3.1.10 Output σ = (r, s).

Images