An SM9-based ring signcryption method satisfying self-attestation

Abstract

The application discloses a ring signature method based on SM9 and meeting self-proving, and comprises the following steps: generating system parameters according to an SM9 algorithm; generating a user private key according to a user identity based on an SM9 identification algorithm; a real ring signature user combines other user public keys to generate a ring signature corresponding to a plaintext file; a receiver decrypts and verifies whether the received ring signature is valid; and the real ring signature user proves to a receiving user that the real signature user of the ring signature is himself. The application realizes the ring signature method meeting self-proving in the national cryptography system, is beneficial to constructing a data security system which is self-controllable, safe, credible, efficient and usable, and can be used for constructing an anonymous reward reporting scheme in a new smart city, such as a smart public security and a smart discipline inspection and supervision.

Description

Technical Field

[0001] This invention relates to the field of information security, and specifically to a ring signature method based on SM9 that satisfies self-proving properties. Background Technology

[0002] In many scenarios of digital information exchange, protecting the privacy of the information sender's identity is a core requirement. While traditional secure communication technologies can guarantee the confidentiality, authenticity, and non-repudiation of information, they often expose the sender's exact identity. This exposure of identity information is undesirable in certain sensitive scenarios, such as reward-based whistleblowing. As a typical application in areas like smart policing and smart discipline inspection, reward-based whistleblowing still faces two major challenges in its implementation: first, the mechanisms for protecting the whistleblower's identity privacy are insufficient, and whistleblowers may face the risk of being traced or even retaliated against; second, in the process of transmitting the whistleblower's information and disbursing the reward, there is a lack of secure, reliable, and verifiable technical means, making it difficult to simultaneously guarantee the confidentiality and authenticity of the whistleblower's information and the anonymity of the whistleblower's identity.

[0003] To address the aforementioned issues, ring signature cryptography can be employed. Ring signature cryptography is a cryptographic scheme that integrates ring signature and signature cryptography techniques. Its core idea is to achieve secure, authenticated, encrypted transmission while protecting anonymity. This technology relies on a ring signature structure to construct the sender's anonymity, ensuring that any verifier can be certain that the ciphertext originates from a specific user group without being able to trace the individual signer, thus effectively protecting the sender's identity privacy. Simultaneously, this technology combines digital signature and encryption operations into a single, computationally more efficient logical step using the signature cryptography process. This guarantees message confidentiality and unforgeability while significantly improving the overall protocol efficiency. Finally, through a Public Key Infrastructure (PKI) system, it ensures that only the designated target recipient can use their private key to complete the decryption operation and simultaneously verify the message's origin authenticity and integrity, achieving authenticated, targeted secure communication.

[0004] The SM9 cryptographic algorithm is an identity-based cryptographic algorithm independently designed in my country. Users use their uniquely identified identity information as their public key. Due to the inclusion of related algorithms in international standards, it has attracted significant attention from researchers. SM9's security is based on the elliptic curve discrete logarithm problem and related bilinear pairing difficulties. Compared to traditional public-key algorithms, SM9 uses identity information as the public key, eliminating certificate management overhead. It also has a shorter key length for the same security strength, and its dot product and bilinear pairing operations can be optimized through hardware acceleration, maintaining high efficiency even in resource-constrained scenarios.

[0005] However, research on constructing a self-proving ring signature mechanism based on the SM9 algorithm is currently lacking. This paper presents a ring signature method based on the national cryptographic standard SM9 that satisfies self-proving requirements, achieving unconditional anonymity, semantic security, unforgeability, and self-proving properties. This solves the problem of anonymous reward-based whistleblowing in emerging smart city fields such as smart policing and smart discipline inspection, achieving autonomous and controllable data security.

[0006] The technical differences compared to existing technologies are as follows:

[0007] This application is compared with the technology of Chinese patent CN115765986B, "A method, system and device for generating ring signatures based on the SM9 digital signature algorithm";

[0008] 1. CN115765986B proposes a ring signature generation method based on the SM9 digital signature algorithm. This patent's design differs significantly from SM9, dividing the user's private key into a signature private key and a decryption private key, increasing the cost of user key management. This application maintains the same key parameters as the original SM9 algorithm, making it more suitable for functional extensions of the SM9 algorithm. Therefore, the design of the related signature, decryption, and verification algorithms in this application differs from patent CN115765986B, and the two applications have fundamental differences in their technical solutions.

[0009] 2. The method proposed in CN115765986B achieves basic ring signature authentication, namely, the confidentiality and anonymity authentication of messages. This application implements a ring signature authentication method that satisfies self-proof within the national cryptographic system. Based on the functions provided by patent CN115765986B, it adds the self-proof function of real signature users, making the method applicable to the construction of anonymous reward reporting schemes in new smart cities, such as smart public security and smart discipline inspection and supervision, with a wider range of application scenarios.

[0010] The two differ fundamentally in their applicable systems and usage scenarios.

[0011] Technical comparison with Chinese patent CN104967513B "Identity-based multi-receiver ring signature method with multiple security attributes";

[0012] 1. CN104967513B discloses an identity-based multi-receiver ring signature method with multiple security attributes. The design of this patent is unrelated to the national cryptographic algorithm SM9. The design of this application is based on the national cryptographic algorithm SM9, and one of its purposes is to expand the scope of application of the national cryptographic algorithm. The scheme of this application is fundamentally different from the method proposed in patent CN104967513B in terms of key generation, ring signature algorithm, decryption and verification algorithm design.

[0013] 2. Patent CN104967513B solves the problem of multiple recipients through techniques such as Lagrange interpolation. This application, while implementing the basic ring signature function, adds a self-verification function for the real signature user. The two differ fundamentally in their applicable systems and usage scenarios. Summary of the Invention

[0014] The purpose of this invention is to propose a self-proving ring signature method based on SM9, which achieves unconditional anonymity, semantic security, unforgeability, and self-provingness, and solves the problem of anonymous reward whistleblowing in emerging smart city fields such as smart public security and smart discipline inspection and supervision.

[0015] This invention proposes a self-proving ring signature method based on SM9, comprising the following steps:

[0016] S1. The key generation center generates system parameters based on the SM9 identifier algorithm;

[0017] S2. The key generation center generates the user's private key based on the user's unique identifier and secretly sends it to the user;

[0018] S3. For a plaintext file to be ring-signed, the real ring-signing user, together with the public keys of other users, generates the ring-signed key for the file without the consent of other users;

[0019] S4. The data receiver decrypts the ring signature to obtain the plaintext file and verifies whether the received ring signature is valid;

[0020] S5. The real ring signer proves to the receiving user that they are the real signer of a certain ring signer.

[0021] As a further improvement of the present invention, step S1 specifically includes:

[0022] Let the elliptic curve identifier be... The base domain is Elliptic curve The prime factor of the order is Bilinear pair The identifier is , and for Additive cyclic group for The factorial cyclic group, bilinear pairings are , for Generator, for Generator, KGC from the module group Select random numbers and calculate Choose the private key generation function identifier as KGC's private-public key pair is Set the first password hash function Second cryptographic hash function Third cryptographic hash function and the fourth cryptographic hash function , , , They are all identifiers represented by a single byte. It includes A finite field of elements;

[0023] First cryptographic hash function It maps bit strings of arbitrary length to... ;

[0024] Second cryptographic hash function Using the national cryptographic algorithm SM3, the input length is The bit string is output as a hash value of length 256 bits;

[0025] Third cryptographic hash function It is to put one The elements in the group and a Elements in a group are mapped to a fixed length The bit string;

[0026] Fourth cryptographic hash function It maps a bit string of arbitrary length to a bit string of fixed length. The bit string;

[0027] The four cryptographic hash functions can be represented as:

[0028] ;

[0029] ;

[0030] ;

[0031] ;

[0032] Fixed length The bit length of the plaintext file. .

[0033] As a further improvement of the present invention, step S2 specifically includes:

[0034] The key generation center is based on the user Unique Identifier Generate user's private key And secretly sent to the user;

[0035] KGC obtains the first cryptographic hash function and the generated private-public key pair, calculated as follows:

[0036] ;

[0037] in, Indicates the user's identity; Indicates user The private key.

[0038] As a further improvement of the present invention, step S3 specifically includes:

[0039] Include One possible user, the actual ring signature password user is... The recipient is The plaintext file sent is , is a length of bit string, user Select other A set of possible ring-signature users is formed, denoted as [a_n]. ,in For the first The identity of the user also indicates the identity of the first user. Each user, the self-proving contract is ,include The published reward notice;

[0040] Obtain the first, second, third, and fourth password hash functions, and select a random number. Calculate the partial value of the ring sign-cryptography , The calculation formula is:

[0041] ,

[0042] ,

[0043] ,

[0044] in It is a group Random numbers in the array.

[0045] A signature is generated using the SM9 digital signature algorithm, and intermediate variables are calculated. And the partial value of the ring signature The calculation formula is:

[0046] ,

[0047] ,

[0048] ,

[0049] in, ( () is the SM9 digital signature algorithm, which uses the ring signature to decrypt the user's private key. Self-proving contracts are verified using the SM9 digital signature algorithm. Perform digital signature.

[0050] Select random number Calculate intermediate variables , The calculation formula is:

[0051] ,

[0052] ,

[0053] ,

[0054] in, It is a group Random numbers in the array.

[0055] make Repeat the following steps to calculate a partial value of the ring signature. The calculation steps are as follows:

[0056] 1) If ,make ;

[0057] 2) Random selection ,calculate ,

[0058] ,

[0059] ,

[0060] ,

[0061] ;

[0062] 3) Order ;

[0063] 4) When If the process terminates, proceed to step 1; otherwise, proceed to step 2.

[0064] calculate ;like Re-execute; otherwise, calculate. .

[0065] Finally, output the plaintext file. The ring signature is .

[0066] As a further improvement of the present invention, step S4 specifically includes:

[0067] Receiver Obtain plaintext file Ring Signature ,Will Decomposition Decryption yields the plaintext file. The calculation formula is:

[0068] )

[0069] calculate ,make Perform the following steps:

[0070] 1) Calculation , ;

[0071] 2) Calculation , ;

[0072] 3) Order ;

[0073] 4) When If the process terminates, proceed to step 1; otherwise, proceed to step 2.

[0074] verify Is it valid? If valid, the ring signature is valid, and the decrypted plaintext is accepted. Otherwise, the circular signature is invalid.

[0075] As a further improvement of the present invention, step S5 specifically includes:

[0076] user Towards submit , After verifying the validity of the ring signature, obtain ;

[0077] verify If true, verify The validity of the signature; if valid, then the ring signature. The real signer is Otherwise, it proves failure.

[0078] Beneficial effects:

[0079] This invention presents a self-proving ring signature method based on SM9, which possesses the unconditional anonymity of ring signatures. The SM9-based user private key generation method solves the certificate management problem. It utilizes SM9 digital signatures to achieve self-proving, unforgeable, and non-transferable characteristics. This not only solves the problem of anonymous reward whistleblowing in emerging smart city fields such as smart policing and smart discipline inspection, but can also be widely applied in areas such as connected vehicles, digital currency, and digital government, achieving autonomous control over data security. Attached Figure Description

[0080] Figure 1 This is a flowchart of the self-proving ring signature method based on SM9 according to the present invention. Detailed Implementation

[0081] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0082] The following is combined Figure 1 This invention describes a self-proving ring signature method based on SM9 provided by the present invention.

[0083] Example: In response to the need for autonomous and controllable cryptographic technology and to address the issue of anonymous reward whistleblowing in emerging smart city fields such as smart public security and smart discipline inspection, this example provides a self-proving ring signature method based on SM9.

[0084] This embodiment involves three entities: a Key Generator Center (KGC), a ring signature user, and a data receiver. The KGC is an honest and trustworthy key generator that generates system parameters and user keys. The ring signature user generates a ring signature and sends it to the data receiver, achieving secure, authenticated, and encrypted transmission while protecting anonymity. The data receiver decrypts the ring signature and verifies the authenticity and integrity of the message's origin.

[0085] This embodiment of the SM9-based ring signature method for satisfying self-proof includes system parameter generation for the system, user key generation for the user, and ring signature generation, ring signature decryption verification, and real ring signature user self-proof for the file.

[0086] S1 and KGC generate system parameters based on the SM9 identifier algorithm.

[0087] This step, namely the system parameter generation part, is executed by KGC. Specifically:

[0088] S11. Input security parameters. Security parameters generally represent the security strength that the system needs to meet, and are typically required to be 128 bits. In this embodiment, the security parameters... Let the elliptic curve identifier be... The base domain is Elliptic curve The prime factor of the order is , Bilinear pair The identifier is , and for Additive cyclic group for Factorial cyclic group. Bilinear pairs are This embodiment is based on the BN256 curve: Tate pairing. for Generator, for Generators. KGC from the module group Select random numbers and calculate Choose the private key generation function identifier as... KGC's private-public key pair is .

[0089] in , , They are all identifiers represented by a single byte. It includes A finite field of n elements.

[0090] S12. Set the first password hash function It maps bit strings of arbitrary length to... Second cryptographic hash function Using the national cryptographic algorithm SM3, the input length is The bit string is output as a hash value of length 256 bits; the third cryptographic hash function It is to put one The elements in the group and a Elements in the map are mapped to a fixed length The bit string; the fourth cryptographic hash function It maps a bit string of arbitrary length to a bit string of fixed length. The bit string; represented as:

[0091] ;

[0092] ;

[0093] ;

[0094] ;

[0095] in The bit length of the plaintext file. .

[0096] In this embodiment, the hash function is a collision-resistant hash function. Specifically, SM3 or SHA-256 can be used as the base hash function. SHA stands for Secure Hash Algorithm. Taking SHA-256 as the base hash function as an example, it can generate a unique 256-bit (32-byte) hash value, ensuring data integrity and security. To ensure that each hash function is independent after instantiation, each hash function must have a globally unique field separation label, which is an ASCII-encoded string that is pre-set in the input of the hash function before any other input. Before any input is passed to the hash function, all inputs must be unambiguously encoded and concatenated into a single bit string. The encoding rules are: a) For bit strings... or a) Use its value directly; b) For group elements , The serialization format defined in IETF RFC 9380 is used, and all points must be verified to be on the correct curve before serialization; c) For tuple input: the encoded results of multiple inputs are concatenated in the order defined in the formula. Then, the SHA-256 algorithm is called to calculate the encoded input, generating a 256-bit intermediate hash value. For different output requirements, specific domain mapping methods are needed: a) When the output target is a multiplicative group... At that time, a technique combining modular reduction and rejection sampling is used. Specifically, the hash value pairs are... Add 1 after taking the modulus to ensure the result falls within the range of 1 / 2. Within range and with coprime; b) when the output target is When using an extension mechanism (such as a counter-based hash extension or an MGF1 mask generation function), the generated length should be no less than [amount missing]. A bit string of bits, and extract the first bit. Bits are used as output. This hierarchical processing method not only ensures the cryptographic security of the hash process, but also meets the special requirements of different algebraic structures for the output format.

[0097] S2 and KGC generate the user's private key based on the user's unique identifier and secretly send it to the user.

[0098] Step S2 is the user key generation part, executed by KGC, and is consistent with the SM9 algorithm. Specifically:

[0099] Obtain the first cryptographic hash function and the generated private-public key pair, calculated as follows:

[0100] ;

[0101] in, Indicates the user's identity; Indicates user The private key.

[0102] S3. For a plaintext file to be ring-signed, the real ring-signing user, together with the public keys of other users (without requiring the consent of other users), generates the ring-signed key for the file.

[0103] Step S3 is the ring signature generation part, which is executed by the actual ring signature user. Specifically:

[0104] This invention includes One possible user, the actual ring signature password user is... The recipient is The plaintext file sent is , is a length of The bit string. User Select other A set of possible ring-signature users is formed, denoted as [a_n]. ,in For the first The identity of the user also indicates the identity of the first user. Individual users. The self-proving contract is... ,for example The reward notice for information leading to the arrest of the informant has been published.

[0105] S31, Obtain the first, second, third, and fourth password hash functions, and select a random number. Calculate the partial value of the ring sign-cryptography , The calculation formula is:

[0106] ,

[0107] ,

[0108] ,

[0109] in It is a group Random numbers in the data;

[0110] S32. Generate a signature using the SM9 digital signature algorithm and calculate intermediate variables. And the partial value of the ring signature The calculation formula is:

[0111] ,

[0112] ,

[0113] ,

[0114] in, ( () is the SM9 digital signature algorithm, which uses the ring signature to decrypt the user's private key. Self-proving contracts are verified using the SM9 digital signature algorithm. Perform digital signature;

[0115] S33. Select random number Calculate intermediate variables , The calculation formula is:

[0116] ,

[0117] ,

[0118] ,

[0119] in, It is a group Random numbers in the data;

[0120] S34, Order Repeat the following steps to calculate a partial value of the ring signature. The calculation steps are as follows:

[0121] 1) If ,make .

[0122] 2) Random selection ,calculate ,

[0123] ,

[0124] ,

[0125] ,

[0126] .

[0127] 3) Order .

[0128] 4) When If the process terminates, proceed to step 1; otherwise, proceed to step 2.

[0129] S35, Calculation ;like Re-execute. Otherwise, calculate. .

[0130] Finally, output the plaintext file. The ring signature is .

[0131] S4. The data receiver decrypts the ring signature to obtain the plaintext file and verifies whether the received ring signature is valid.

[0132] Step S4 is the ring signature encryption / decryption verification part, which is performed by the data receiver. Specifically:

[0133] S41, Receiver Obtain plaintext file Ring Signature ,Will Decomposition Decryption yields the plaintext file. The calculation formula is:

[0134] )

[0135] To better illustrate this, the correctness of the decryption algorithm is verified, namely... :

[0136]

[0137]

[0138]

[0139] )

[0140]

[0141]

[0142] S42, Calculation ,make Perform the following steps:

[0143] 1) Calculation , .

[0144] 2) Calculation , .

[0145] 3) Order .

[0146] 4) When If the process terminates, proceed to step 1; otherwise, proceed to step 2.

[0147] S43, Verification Is it valid? If valid, the ring signature is valid, and the decrypted plaintext is accepted. Otherwise, the circular signature is invalid.

[0148] To better illustrate this, the correctness of the ring signature algorithm is verified, namely... :

[0149] Due to All other values ​​are It was calculated using the same method, therefore it only requires proof. That's fine. Since... , ,and , , , and , , , Consistent.

[0150] Therefore, as long as it is proven That's all.

[0151]

[0152]

[0153]

[0154]

[0155]

[0156] so, ,as well as Established.

[0157] S5. The real ring signer proves to the receiving user that they are the real signer of a certain ring signer.

[0158] Step S5 is the self-verification part by the real ring signature user, which is executed by the real ring signature user. That is, the real ring signature user proves to the receiving user that they are the real signature user for a certain ring signature. Specifically:

[0159] S51, User Towards submit , After verifying the validity of the ring signature, obtain ;

[0160] S52, Verification If true, verify The validity of the signature; if valid, then the ring signature. The real signer is Otherwise, it proves failure.

[0161] To better illustrate this, we will prove the self-proving property. Based on the one-way nature of hash functions, only genuine ring-signature users can provide [the proof / proof]. Foreword To prevent the recipient from obtaining the previous image The subsequent impersonation of the genuine ring-signed user relies on the digital signature of the contract in the preceding image. Based on the unforgeability of digital signatures, our designed scheme satisfies self-proving properties and is non-transferable. Even if the recipient obtains the preceding image, they cannot impersonate the genuine ring-signed user.

[0162] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the prior art, can be embodied in the form of software products. These computer software products can be stored in computer-readable storage media, such as ROM / RAM, magnetic disks, optical disks, etc., and include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0163] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A self-proving ring signature method based on SM9, characterized in that: Includes the following steps: S1. The key generation center generates system parameters based on the SM9 identifier algorithm; Step S1 specifically involves: Let the elliptic curve identifier be... The base domain is Elliptic curve The prime factor of the order is Bilinear pair The identifier is , and for Additive cyclic group for The factorial cyclic group, bilinear pairings are , for Generator, for Generator, KGC from the module group Select random numbers and calculate Choose the private key generation function identifier as KGC's private-public key pair is Set the first password hash function Second cryptographic hash function Third cryptographic hash function and the fourth cryptographic hash function , , , They are all identifiers represented by a single byte. It includes A finite field of elements; S2. The key generation center generates the user's private key based on the user's unique identifier and secretly sends it to the user; Step S2 specifically involves: The key generation center is based on the user Unique Identifier Generate user's private key And secretly sent to the user; KGC obtains the first cryptographic hash function and the generated private-public key pair, calculated as follows: ； in, Indicates the user's identity; Indicates user The private key; S3. For a plaintext file to be ring-signed, the real ring-signing user, together with the public keys of other users, generates the ring-signed key for the file without the consent of other users; Step S3 specifically involves: Include One possible user, the actual ring signature password user is... The recipient is The plaintext file sent is , is a length of bit string, user Select other A set of possible ring-signature users is formed, denoted as [a_n]. ,in For the first The identity of the user also indicates the identity of the first user. Each user, the self-proving contract is ,include The published reward notice; user Obtain the first, second, third, and fourth password hash functions, and select a random number. Calculate the partial value of the ring sign-cryptography , The calculation formula is: , , ， in It is a group Random numbers in the data; A signature is generated using the SM9 digital signature algorithm, and intermediate variables are calculated. And the partial value of the ring signature The calculation formula is: ， ， ， in, ( () is the SM9 digital signature algorithm, which uses the ring signature to decrypt the user's private key. Self-proving contracts are verified using the SM9 digital signature algorithm. Perform digital signature; Select random number Calculate intermediate variables , The calculation formula is: , , ， in, It is a group Random numbers in the data; make Repeat the following steps to calculate a partial value of the ring signature. The calculation steps are as follows: 1) If ,make ; 2) Random selection ,calculate , , , ， ； 3) Order ; 4) When If the process terminates, proceed to step 1; otherwise, proceed to step 2. calculate ;like Re-execute; otherwise, calculate. ; Finally, output the plaintext file. The ring signature is ; S4. The data receiver decrypts the ring signature to obtain the plaintext file and verifies whether the received ring signature is valid; S5. The real ring signer proves to the receiving user that they are the real signer of a certain ring signer.

2. The self-proving ring signature method based on SM9 according to claim 1, characterized in that: First cryptographic hash function It maps bit strings of arbitrary length to... ; Second cryptographic hash function Using the national cryptographic algorithm SM3, the input length is The bit string is output as a hash value of length 256 bits; Third cryptographic hash function It is to put one The elements in the group and a Elements in a group are mapped to a fixed length The bit string; Fourth cryptographic hash function It maps a bit string of arbitrary length to a bit string of fixed length. The bit string; The four cryptographic hash functions are represented as follows: ； ； ； ； Fixed length The bit length of the plaintext file. .

3. A self-proving ring signature method based on SM9 according to claim 2, characterized in that: Step S4 specifically involves: Receiver Obtain plaintext file Ring Signature ,Will Decomposition Decryption yields the plaintext file. The calculation formula is: ) calculate ,make Perform the following steps: 1) Calculation , ; 2) Calculation , ; 3) Order ; 4) When If the process terminates, proceed to step 1; otherwise, proceed to step 2. verify Is it valid? If valid, the ring signature is valid, and the decrypted plaintext is accepted. Otherwise, the circular signature is invalid.

4. A self-proving ring signature method based on SM9 according to claim 3, characterized in that: Step S5 specifically involves: user Towards submit , After verifying the validity of the ring signature, obtain ; verify If true, verify The validity of the signature; if valid, then the ring signature. The real signer is Otherwise, it proves failure.

Images