Security protection method based on SM9 signature algorithm

Abstract

The invention discloses a security protection method based on an SM9 signature algorithm, operation time is determined according to the value of a random number, the operation time is random, in addition, point multiplication operation time is also random, and timing attacks can be resisted; according to the method, secret key masking operation is carried out on a private key of a user, meanwhile, randomization operation is carried out on operands of point multiplication in point multiplication operation, the private key is not leaked in the process of adopting an NAF point multiplication operation algorithm and a signature algorithm, and meanwhile, full-process masking is carried out in the middle process, so that power consumption, electromagnetism and secret key information have no correlation; energy power consumption and electromagnetic attack can be resisted; whether related parameter variables are tampered or whether errors are injected or not can be detected by comparing hash operation before algorithm starting and point multiplication operation; in addition, after signature is completed, verification operation is carried out on the signature value once, whether all parameter variables and intermediate variables are tampered or whether errors are injected in the whole-process operation can be detected, and fault attacks can be resisted.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology, and specifically relates to a security protection method based on an SM9 signature algorithm. Background Art

[0002] The SM9 algorithm is an identity-based public key cryptographic algorithm, also known as an identity cryptographic algorithm. It is a series of industry standards issued by the State Cryptography Administration on March 28, 2016, and officially became a national standard in 2020. The SM9 algorithm is mainly used for user identity authentication. It uses a 256-bit elliptic curve and uses the user's identity as the public key. It does not require a digital certificate, certificate library or key library, and omits the process of exchanging digital certificates and public keys, making the security system easy to deploy and manage.

[0003] The SM9 algorithm has a wide range of application scenarios in the field of information security, including e-government, e-commerce, Internet of Things, mobile payment, etc. It can provide strong protection for user identity authentication and data security, and is particularly suitable for various occasions such as end-to-end offline secure communication, cloud data encryption, attribute-based encryption, and policy-based encryption.

[0004] The deployment and application of cryptographic algorithms from cloud to end cannot be separated from the support of cryptographic chips. There are various security threats in the design and implementation of chips, as well as when they are used in different application scenarios, including chip logical security, physical security, forward security, etc., and the side channel security issue is particularly prominent at present.

[0005] When cryptographic algorithms are running in hardware systems, other side channel information will be generated in addition to input and output information, such as calculation time, circuit power consumption and electromagnetic radiation. The reason for this is that during data processing, changes in register data lead to the charging and discharging of load capacitors in the hardware system, which is reflected in the operands as changes in the Hamming distance of data before and after instruction execution. Common side channel attack methods include timing attacks, energy consumption attacks, electromagnetic attacks and fault attacks.

[0006] Timing attacks mainly analyze the possible leakage of key information by analyzing the inconsistent execution time of different keys or plaintexts. Energy consumption attacks refer to an attack method that uses cryptography, probability, and statistics principles to analyze and decipher key information by collecting energy consumption and leakage information indicators generated by hardware devices such as cryptographic systems and encryption chips during encryption, decryption, or signing operations. The main analysis techniques include SPA (simple power analysis) and DPA (differential power analysis). Electromagnetic analysis attacks refer to an attack method that uses cryptography, probability, and statistics principles to analyze and decipher key information by collecting electromagnetic leakage information indicators generated by hardware devices such as cryptographic systems and encryption chips during encryption, decryption, or signing operations. Fault attacks are attacks that intentionally insert an error in the calculation step, thereby leaking relevant key information during the calculation process.

[0007] These attacks make the side channel security worrying and there is a problem of easy leakage of private keys. The existing SM9 signature algorithm implementation is weak in resisting timing attacks, energy consumption attacks, electromagnetic attacks and fault attacks, and needs to be improved urgently. Summary of the invention

[0008] To solve the above problems, the present invention discloses a security protection method based on the SM9 signature algorithm. Through the complete SM9 signature security protection solution, side channel attacks can be resisted.

[0009] To achieve the above object, the technical solution of the present invention is as follows:

[0010] A security protection method based on SM9 signature algorithm includes the following steps:

[0011] Step 1: Calculate group G T The element g=e(P1,P pub-s ), hash = SM3(M,P pub-s ,ds A ), where e is the distance from G1xG2 to G T The bilinear pairing of G T , G1, G2 are additive cyclic groups of order prime number N, N is greater than 2 191 The prime number, P pub-s is the signature master public key, ds A is the signature private key of user A, and SM3 is the SM3 hash operation;

[0012] Step 2, generate a random number r∈[1, N-1];

[0013] Step 3: Calculate group G T The element w=g r ; g r is the operation g raised to the power of r in the multiplication group;

[0014] Step 4, calculate the integer h=H2(M||w,N); H2() is a cryptographic function derived from a cryptographic hash function, and the bit string M is the message to be signed;

[0015] Step 5, calculate the integer l = (rh) modN, if l = 0, return to step 2; modN is a modulo N operation;

[0016] Step 6, generate a 256-bit random number R1, and calculate R2=1-R1;

[0017] Step 7: Generate a point R on the G1 domain and calculate R'=R+ds A ;

[0018] Step 8, calculate hash'=SM3(M,P pub-s ,ds A ), if hash'≠hash, exit and report an error;

[0019] Step 9, using a dot multiplication operation to calculate S1=[R1]R', the dot multiplication operation uses a random window NAF dot multiplication algorithm;

[0020] Step 10, using a dot multiplication operation to calculate S2=[R2]R', the dot multiplication operation uses a random window NAF dot multiplication algorithm;

[0021] Step 11, using a dot multiplication operation to calculate S3=[R1]R, the dot multiplication operation uses a random window NAF dot multiplication algorithm;

[0022] Step 12, using a dot multiplication operation to calculate S4=[R2]R, the dot multiplication operation uses a random window NAF dot multiplication algorithm;

[0023] Step 13, calculate S5=S1-S3;

[0024] Step 14, calculate S6=S2-S4;

[0025] Step 15, calculate S=S5+S6;

[0026] Step 16, the signature of the message M is obtained as (h, S);

[0027] Step 17, perform a signature verification operation on the signature value (h, S). If the signature verification passes, the signature value (h, S) is valid, otherwise exit and report an error.

[0028] Furthermore, before each dot multiplication operation, the SM3 hash operation is performed on all parameters again. If the hash value of the parameter at this time is inconsistent with the first operation, an error message is printed. If they are consistent, the dot multiplication operation is performed.

[0029] Furthermore, the signature verification operation step includes the following operation steps:

[0030] B1: Check whether h'∈[1,N-1] holds. If not, the verification fails.

[0031] B2: Check whether S'∈G1 holds. If not, the verification fails.

[0032] B3: Calculation group G T The element g=e(P1,P pub-s ); P1 is the generator of group G1;

[0033] B4: Calculation group G T The element t=g h '; (h', S') is a digital signature;

[0034] B5: Calculate the integer h1=H1(ID A ||hid,N); H1() is a cryptographic function derived from a cryptographic hash function, ID A is the identifier of user A, which can uniquely determine the public key of user A. hid is the signature private key generation function identifier represented by one byte, and || is the concatenation symbol;

[0035] B6: Calculate the element P in group G2 = [h1]P2+P pub-s ; P2 is the generator of group G2;

[0036] B7: Calculation group G T The element u in is equal to e(S',P);

[0037] B8: Calculation group G T The element w'=ut in, convert the data type of w' into a bit string;

[0038] B9: Calculate the integer h2=H2(M||w',N), and check whether h2=h holds. If so, the verification passes; otherwise, the verification fails.

[0039] Furthermore, the method further comprises the following steps:

[0040] Step 18: Output the message M and its digital signature (h, S).

[0041] The beneficial effects of the present invention are:

[0042] 1. The present invention determines the operation time according to the value of the random number, so that the operation time is random. In addition, the point multiplication operation time of the random window is also random, so it can resist timing attacks.

[0043] 2. The present invention performs a key mask operation on the user's private key and converts the private key into ds AAdd a random point R on the G1 domain and calculate S' = [l] R. When calculating the signature value S, calculate S" = [l] (R + ds A ), then calculate S = S" - S' = [l]ds A The final signature S result is obtained, thereby avoiding the correlation between the key and the power consumption.

[0044] 3. The present invention is due to the private key ds A Masking is performed, and the operands of the point multiplication are randomized in the point multiplication operation. The NAF point multiplication algorithm is used. Therefore, the private key is not leaked during the entire signature algorithm. At the same time, the entire intermediate process is masked, so that there is no correlation between power consumption, electromagnetic and key information in the entire process operation, so it can resist energy consumption and electromagnetic attacks.

[0045] 4. The present invention performs SM3 hash operations on all parameter variables at the beginning of the algorithm, and performs SM3 hash operation comparison again before the point multiplication operation, so as to detect whether the relevant parameter variables have been tampered with or whether there are errors injected before the point multiplication operation; in addition, after the signature is completed, a verification operation is performed on the signature value, so as to detect whether all parameter variables and intermediate variables including the private key in the whole process operation have been tampered with or whether there are errors injected, so as to resist fault attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flowchart of the improved SM9 signature algorithm in the present invention.

[0047] Figure 2 This is a flow chart of the signature verification algorithm. DETAILED DESCRIPTION

[0048] The technical solution provided by the present invention will be described in detail below in conjunction with specific embodiments. It should be understood that the following specific implementation methods are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0049] Assume that the message to be signed is a bit string M. In order to obtain the digital signature (h, S) of the message M, user A, as the signer, adopts a security protection method based on the SM9 signature algorithm. The process is as follows: Figure 1 As shown, the following operation steps should be implemented:

[0050] A1: Calculate group G T The element g=e(P1,P pub-s ), hash = SM3(M,P pub-s ,ds A ); e is from G1xG2 to G T The bilinear pairing of G T, G1, G2 are additive cyclic groups of order prime number N, N is greater than 2 191 The prime number, P pub-s is the signature master public key, ds A is the signature private key of user A, and SM3 is the SM3 hash operation;

[0051] A2: Generate a random number r∈[1, N-1];

[0052] A3: Calculate group G T The element w=g r ; g r is the operation g raised to the power of r in the multiplication group;

[0053] A4: Calculate the integer h = H2(M||w,N); H2() is a cryptographic function derived from the cryptographic hash function;

[0054] A5: Calculate the integer l = (rh) mod N. If l = 0, return to A2. mod N is a modulo N operation.

[0055] A6: Generate a 256-bit random number R1 and calculate R2=1-R1;

[0056] A7: Generate a point R on the G1 domain and calculate R'=R+ds A ;

[0057] A8: Calculate hash'=SM3(M,P pub-s ,ds A ), if hash'≠hash, exit and report an error;

[0058] A9: Calculate S1 = [R1] R'. Here, the point multiplication operation uses the point multiplication algorithm of the random window NAF. Before each point multiplication operation, all parameters are hashed again with SM3. If the hash value of the parameter is inconsistent with the first operation (in A1), it means that the elliptic curve parameter has been tampered with or an error has been injected. At the same time, the error message is printed. If it is consistent, the point multiplication operation is performed again.

[0059] The point multiplication algorithm of the random window NAF method aims to increase the NAF w The number of 0s in (k) makes NAF w(k) When performing bit-by-bit scanning, the number of point additions is reduced, which can improve the efficiency of point multiplication. After the random window NAF algorithm, the order of the keys is rearranged, and the arrangement of the keys is very regular. The "non-0" numbers in each window are in the last bit of this window, and the other bits in the window are all "0". When performing point multiplication with such a sequence, the power consumption of its operation can only expose the number of point additions and doublings, but does not leak the arrangement information of the key. Suppose the attacker uses SPA to obtain the arrangement of the regular window NAF, but the specific value of each "non-0" bit is unknown. Because the arrangement is regular and unchanged, it is impossible to exhaustively enumerate and determine the "non-0" value in each window separately. It is only possible to exhaustively enumerate the entire sequence. In this case, the amount of calculation will be very large, and no results can be obtained within the life cycle of the key, and the attacker cannot obtain the key.

[0060] In addition, the Montgomery modular multiplication algorithm is used in the point multiplication algorithm of the random window NAF. The algorithm itself also has basic resistance to power consumption attacks, because no matter whether each window bit of K is equal to 0, the operation is consistent, and the selection of the window bandwidth w is also random. Each point multiplication operation uses a different w, where w randomly selects a value from 2, 3, and 4, so that the collected power consumption cannot distinguish the bit information of K. The random window NAF point multiplication algorithm includes the following steps:

[0061] Input: point P, integer K = (k t-1 ...k1k0)2, window bandwidth w

[0062] Output: Q = [K] P

[0063] 1) Calculate NAF w (k) = k0*2 0 +k1*2 1 +…+k t-1 2 t-1

[0064] 2) For i = 1, 3, 5, ..., 2 w-1 -1, calculate P i =[i]P

[0065] 3) Q = 0

[0066] 4)for(i=t-1,i>=0;i--)

[0067] {

[0068] Q = [2] Q;

[0069] if(k i ≠0)

[0070] {

[0071] if(k i >0) then Q=Q+P ki

[0072] else Q=QP ki

[0073] }

[0074] }

[0075] 5) Return to Q

[0076] A10: Calculate S2=[R2]R'. The dot product operation here uses the random window NAF dot product algorithm.

[0077] A11: Calculate S3=[R1]R. The dot product operation here uses the random window NAF dot product algorithm.

[0078] A12: Calculate S4=[R2]R. The dot product operation here uses the random window NAF dot product algorithm.

[0079] A13: calculate S5=S1-S3;

[0080] A14: Calculate S6=S2-S4;

[0081] A15: Calculate S=S5+S6; Combining A9-A15, it can be seen that this example uses two random point multiplications and one point addition to calculate the signature value. The random window NAF point multiplication algorithm is used in the calculation process, which further increases the security of R1 and R2.

[0082] A16: The signature of the message M is obtained as (h, S);

[0083] A17: Perform a signature verification operation on the signature value (h, S). If the verification passes, the signature value (h, S) is valid, otherwise exit and report an error. After executing an SM9 signature operation, this step uses the public key to perform an SM9 signature verification operation to verify whether the result is correct. If it is not correct, it means that the operation is wrong or an error is injected. At the same time, print the error information. If it is consistent, it means that the private key has not been tampered with or no error has been injected.

[0084] The verification process is as follows Figure 2 As shown, the following steps are included:

[0085] Assume that the message to be signed is a bit string M', and the digital signature is (h', S'). In this example, M' is the message M in step A16, and the digital signature is the signature (h, S) obtained in step A16. User B, as the verifier, should implement the following operation steps:

[0086] B1: Check whether h'∈[1,N-1] holds. If not, the verification fails.

[0087] B2: Check whether S'∈G1 holds. If not, the verification fails.

[0088] B3: Calculation group G T The element g=e(P1,P pub-s ); P1 is the generator of group G1;

[0089] B4: Calculation group G T The element t=g h ';

[0090] B5: Calculate the integer h1=H1(ID A ||hid,N); H1() is a cryptographic function derived from a cryptographic hash function, ID A is the identifier of user A, which can uniquely determine the public key of user A. hid is the signature private key generation function identifier represented by one byte, and || is the concatenation symbol;

[0091] B6: Calculate the element P in group G2 = [h1]P2+P pub-s ; P2 is the generator of group G2;

[0092] B7: Calculation group G T The element u in is equal to e(S',P);

[0093] B8: Calculation group G T The element w'=ut in, convert the data type of w' into a bit string;

[0094] B9: Calculate the integer h2=H2(M||w',N), and check whether h2=h holds. If so, the verification passes; otherwise, the verification fails.

[0095] A18: Output message M and its digital signature (h, S).

[0096] Since a random number r is generated in step A2, the operation time of step A3 is determined according to the value of r, so the operation time is random. In addition, in steps A9 to A12, NAF dot multiplication operation is used, and the dot multiplication operation time of the random window is also random. Therefore, this scheme can resist timing attacks.

[0097] Since the private key ds is AMasking was performed, and in the point multiplication operations from A9 to A12, the point multiplication operands were randomized, and the NAF point multiplication algorithm was used. Therefore, the private key was not leaked during the entire signature algorithm. At the same time, the entire intermediate process was masked, so that there was no correlation between power consumption, electromagnetic and key information in the entire process. Therefore, this solution can resist energy consumption and electromagnetic attacks.

[0098] Since the SM3 hash operation of all parameter variables is performed in step A1, and the SM3 hash operation is compared again in step A8, it is possible to detect whether the relevant parameter variables have been tampered with or whether there is an error injection before the point multiplication operation. In addition, the signature value is verified once in step A17, so that it is also possible to detect whether all parameter variables and intermediate variables including the private key in the whole process operation have been tampered with or whether there is an error injection. Therefore, this solution can resist fault attacks.

[0099] It should be noted that the above content only illustrates the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications all fall within the protection scope of the claims of the present invention.

Claims

1. A security protection method based on SM9 signature algorithm, characterized in that: The steps include: Step 1: Calculate group G T The element g=e(P1,P pub-s ), hash = SM3(M,P pub-s ,ds A ), where e is the distance from G1xG2 to G T The bilinear pairing of G T , G1, G2 are additive cyclic groups of order prime number N, N is greater than 2 191 The prime number, P pub-s is the signature master public key, ds A is the signature private key of user A, and SM3 is the SM3 hash operation; Step 2, generate a random number r∈[1, N-1]; Step 3: Calculate group G T The element w=g r ; g r is the operation g raised to the power of r in the multiplication group; Step 4, calculate the integer h=H2(M||w,N); H2() is a cryptographic function derived from a cryptographic hash function, and the bit string M is the message to be signed; Step 5, calculate the integer l = (rh) modN, if l = 0, return to step 2; modN is a modulo N operation; Step 6, generate a 256-bit random number R1, and calculate R2=1-R1; Step 7: Generate a point R on the G1 domain and calculate R'=R+ds A ; Step 8, calculate hash'=SM3(M,P pub-s ,ds A ), if hash'≠hash, exit and report an error; Step 9, using a dot multiplication operation to calculate S1=[R1]R', the dot multiplication operation uses a random window NAF dot multiplication algorithm; Step 10, using a dot multiplication operation to calculate S2=[R2]R', the dot multiplication operation uses a random window NAF dot multiplication algorithm; Step 11, using a dot multiplication operation to calculate S3=[R1]R, the dot multiplication operation uses a random window NAF dot multiplication algorithm; Step 12, using a dot multiplication operation to calculate S4=[R2]R, the dot multiplication operation uses a random window NAF dot multiplication algorithm; Step 13, calculate S5=S1-S3; Step 14, calculate S6=S2-S4; Step 15, calculate S=S5+S6; Step 16, the signature of the message M is obtained as (h, S); Step 17, perform a signature verification operation on the signature value (h, S). If the signature verification passes, the signature value (h, S) is valid, otherwise exit and report an error.

2. The security protection method based on the SM9 signature algorithm according to claim 1 is characterized in that: Before each dot multiplication operation, all parameters are hashed again. If the hash value of the parameter is inconsistent with the first operation, an error message is printed. If they are consistent, the dot multiplication operation is performed.

3. The security protection method based on the SM9 signature algorithm according to claim 1 is characterized in that: The signature verification operation step includes the following operation steps: B1: Check whether h'∈[1,N-1] holds. If not, the verification fails. B2: Check whether S'∈G1 holds. If not, the verification fails. B3: Calculation group G T The element g=e(P1,P pub-s ); P1 is the generator of group G1; B4: Calculation group G T The element t=g h '; (h', S') is a digital signature; B5: Calculate the integer h1=H1(ID A ||hid,N); H1() is a cryptographic function derived from a cryptographic hash function, ID A is the identifier of user A, which can uniquely determine the public key of user A. hid is the signature private key generation function identifier represented by one byte, and || is the concatenation symbol; B6: Calculate the element P in group G2 = [h1]P2+P pub-s ; P2 is the generator of group G2; B7: Calculation group G T The element u in is equal to e(S',P); B8: Calculation group G T The element w'=ut in, convert the data type of w' into a bit string; B9: Calculate the integer h2=H2(M||w',N), and check whether h2=h holds. If so, the verification passes; otherwise, the verification fails.

4. The security protection method based on the SM9 signature algorithm according to claim 1 is characterized in that: The following steps are also included: Step 18: Output the message M and its digital signature (h, S).

Images