A calculation method and system for multiplication or power operation of group elements

Abstract

The method involves a calculation method for multiplication or exponentiation of group elements: the first party has a parameter pool, and the pool contains m integers k1, k2, ..., k in [1, n-1]. m , and the corresponding elements k1G, k2G, …, k in the additive group m G, where G is an element of the additive group or an element g^k1, g^k2, ..., g^k of the corresponding multiplicative group m , where g is an element of the multiplication group, ^ is the power operation, and n is the order of the group; the first party uses the integer parameters in the pool and the corresponding group elements to complete the calculation of G_k=kG or g_k=g^k with the help of the second party without exposing k, where k is the integer secret of the first party in [1,n-1]; after completing the calculation of G_k or g_k once, or after completing the specified number of calculations of G_k or g_k for different k, the first party calculates the integer parameter k used in the parameter pool t And the corresponding group elements are updated.

Description

Technical Field

[0001] The present invention belongs to the field of cryptographic technology, and in particular to a calculation method and system for additive group element multiplication operations (scalar multiplication operations, doubling operations) or multiplication group element power operations for resource-constrained devices. Background Art

[0002] In cryptographic operations (mainly cryptographic operations of public key cryptographic algorithms), it is often necessary to perform multiplication operations (scalar multiplication operations, doubling operations) of group elements in an additive group or power operations of group elements in a multiplicative group, which often involve complex large number operations. For example, in cryptographic algorithms based on elliptic curve point groups, kG multiplication operations are often required, where G is an element (point) in the elliptic curve additive point group, and k is a randomly selected integer whose value may be very large. Calculating kG involves large number calculations and requires a lot of calculations. For another example, in some cryptographic operations (such as cryptographic algorithms based on two-line pairing), gG multiplication operations are often required. k The power operation, where g is an element of a multiplicative group, i.e., it could be a very large integer, and k is a randomly chosen integer whose value could be very large, so computing g k It involves large number operations and requires a lot of calculations.

[0003] With the development of the Internet of Things, more and more tiny devices are becoming intelligent and connected to the Internet. For security protection purposes, these intelligent tiny devices may need to perform cryptographic operations, but these tiny devices are usually resource-constrained devices with weak computing power. It is difficult for them to perform such complex multiplication or exponentiation operations involving large numbers in real time, which limits the application of cryptographic algorithms (especially public key cryptographic algorithms) in these tiny smart devices. Summary of the invention

[0004] The purpose of the present invention is to propose a calculation method and corresponding system for additive group element multiplication operation (scalar multiplication operation, doubling operation) or multiplication group element power operation for resource-constrained devices to meet the requirements of these devices for cryptographic functions.

[0005] In view of the above invention objectives, the technical solution proposed in this patent application includes a calculation method and system for multiplication or exponentiation of group elements.

[0006] The calculation method for group element multiplication or exponentiation proposed in the present invention is as follows:

[0007] The method involves an additive group or a multiplicative group; the order of the additive group or the multiplicative group is a prime number n;

[0008] The method includes a first party and a second party, wherein the first party maintains a parameter pool, wherein the parameter pool has m integers k1, k2, ..., k in the interval [1, n-1].m , and the corresponding group elements k1G, k2G, …, k m G, that is, k1, k2, …, k m The result of performing a number multiplication operation (scalar multiplication operation, point doubling operation) with G, where G is an element of the additive group, or has a corresponding group element g^k1, g^k2, ..., g^k in the multiplicative group m , that is, k1, k2, …, k m The result of performing power operation on g respectively, where g is an element of the multiplication group, and ^ represents power operation (power operation is performed on the element before ^, and the integer after ^ is the number of times of power operation);

[0009] k1,k2,…,k m is called an integer parameter, and the group elements k1G, k2G, …, k m G is called the integer parameter k1, k2, ..., k m The corresponding number of multipliers, group elements g^k1, g^k2, ..., g^k m are called integer parameters k1, k2, …, k m The corresponding power element (the integer parameter and its corresponding relationship with the multiplier or power element need to be kept confidential);

[0010] k1G,k2G,…,k m G is represented by G_k1, G_k2, …, G_k m ;

[0011] g^k1, g^k2, …, g^k m Respectively denoted as g_k1, g_k2, …, g_k m ;

[0012] When the first party needs to calculate G_k=kG or g_k=g^k, where k is an integer in [1,n-1] that only the first party knows and needs to be kept confidential (such as a randomly selected integer as a secret, or an integer selected or calculated by an agreed method that needs to be kept confidential), the first party and the second party collaborate to complete the calculation of G_k=kG or g_k=g^k in the following manner:

[0013] The first party selects an integer parameter k from the m integer parameters in the parameter pool according to a predetermined rule. t , t=1,2,…,or m;

[0014] The first party calculates w = (k (k t ) -1 ) mod n or w = (kk t )mod n, then w and G_k t or w and g_k t Sent to the second party, where (kt ) -1 k t The modulo n multiplicative inverse (i.e. (k t (k t ) -1 )mod n=1), G_k t is (taken from the parameter pool) and k t The corresponding number multiplier (i.e. G_k t =k t G), g_k t is (taken from the parameter pool) and k t The corresponding power element (i.e. g_k t =g^k t );

[0015] If the calculation formula of w is w=(k(k t ) -1 ) mod n, then:

[0016] The second party calculates G_k = wG_k t Or g_k=g_k t ^w;

[0017] If the calculation formula of w is w=(kk t ) mod n, then:

[0018] The second party calculates G_k = wG + G_k t Or g_k=g_k t (g^w);

[0019] G_k is kG or g_k is g^k;

[0020] After completing a G_k or g_k calculation, or after completing a specified number of G_k or g_k calculations for different k, the first party calculates the integer parameter k used in the parameter pool. t and the corresponding multiplier G_k t or power element g_k t Update is performed, where t = 1, 2, ... or m.

[0021] For the calculation method for group element multiplication or power operation described above, the first party selects an integer parameter k from the m integer parameters in the parameter pool according to a predetermined rule. t The methods include:

[0022] Each time G_k=kG or g_k=g^k is calculated, an integer parameter k is selected in sequence from the m integer parameters. t , or randomly select an unused integer parameter k from among the m integer parameters t(The integer parameter updated after use belongs to the unused integer parameter);

[0023] Selecting an integer parameter k in sequence from among the m integer parameters t means:

[0024] If it is the first calculation of G_k = kG or g_k = g^k, then select k1;

[0025] If the integer parameter selected in the previous calculation is k i and 1 ≤ i < m, then the integer parameter selected in this calculation is k i+1 ;

[0026] If the integer parameter selected in the previous calculation is k m , then the integer parameter selected in this calculation is k1.

[0027] For the above-mentioned calculation method for group element multiplication or power operation, Party A updates the used integer parameter k t and the corresponding G_k t or g_k t in a way as follows (not meaning all possible ways):

[0028] Select p integer parameters from among the m integer parameters (for example, p parameters randomly selected from the m integer parameters, or one of the p integer parameters is k t , and the other p - 1 are randomly selected from the remaining m - 1 integer parameters), 1 ≤ p < m; the p integer parameters are respectively denoted as r1, r2,..., r p ;

[0029] r1, r2,..., r p The corresponding multiplication elements are respectively denoted as G_r1, G_r2,..., G_r p , or r1, r2,..., r p The corresponding power elements are respectively denoted as g_r1, g_r2,..., g_r p ;

[0030] Randomly select p positive integers c1, c2,..., c p , and make c1 + c2 +... + c p ≤ L, where L is a pre-set integer less than m (usually L is much less than m);

[0031] Calculate u = (c1r1 + c2r2 +... + c p r p ) mod n,

[0032] G_u = c1G_r1 + c2G_r2 +... + c p G_rp ,

[0033] or g_u=(g_r1^c1)(g_r2^c2)…(g_r p ^c p );

[0034] Then use u as the new integer parameter k t (tth integer parameter), using G_u as the new G_k t (k t corresponding number of multipliers), or use g_u as the new g_k t (k t corresponding power element).

[0035] In the above mentioned integer parameter k t and the corresponding G_k t or g_k t In the update operation, p is a fixed integer or a non-fixed integer; if p is a non-fixed integer, then p is an integer randomly selected within a specified range, or an integer that changes or is selected according to a predetermined rule.

[0036] In the above mentioned integer parameter k t and the corresponding G_k t or g_k t In the update operation, the selection principle of L is to make the integer parameter k t and the corresponding G_k t or g_k t The update operation performed can be completed within the expected or specified time (that is, when the computation amount is the largest, the update operation can be completed within the expected or specified time).

[0037] In the above mentioned integer parameter k t and the corresponding G_k t or g_k t In the update operation, if L = pq (p times q), where p and q are integers, the first party randomly selects p positive integers c1, c2, ..., c p , and such that c1+c2+…+c p One way to ≤ L is as follows (not all possible ways):

[0038] Randomly select p integers c1, c2, ..., c in [1, q] p .

[0039] Based on the above-mentioned calculation method for group element multiplication or power operation, a corresponding calculation system for group element multiplication or power operation can be constructed, the system includes two devices, one of which is the first party and the other is the second party;

[0040] When the device as the first party needs to calculate G_k=kG or g_k=g^k, where k is an integer in [1,n-1] that is known only to the first party and needs to be kept confidential (such as a randomly selected integer as a secret, or an integer that needs to be kept confidential selected or calculated by an agreed method), the two devices calculate G_k=kG or g_k=g^k according to the calculation method for multiplication or exponentiation of group elements.

[0041] In the above calculation method and system for multiplication or exponentiation of group elements, the first party is usually a device with limited resources and weak computing power, while the second party is usually a device with abundant resources and strong computing power; based on the method and system of the present invention, the first party, as a resource-limited device, can use the resource-rich second party to complete multiplication operations in addition groups with large computational complexity (such as multiplication or doubling operations in elliptic curve point groups) or exponentiation operations in multiplication groups (such as exponentiation operations in multiplication groups of two-line pairings); at the same time, in order to prevent the cracking of integer parameters in the parameter pool, the first party updates the integer parameters according to a predetermined strategy, and the operations involved in the update operation are operations that the first party (resource-limited device) can undertake and have a small computational complexity. DETAILED DESCRIPTION

[0042] The present invention is further described below in conjunction with the embodiments. The following embodiments are only several possible embodiments of the present invention, and do not represent all possible embodiments, and are not intended to limit the present invention.

[0043] Embodiment 1,

[0044] This embodiment relates to an additive group, the order of which is a prime number n; this embodiment includes a first party and a second party, wherein the first party maintains a parameter pool, and the parameter pool has m integers k1, k2, ..., k in the interval [1, n-1]. m , and the corresponding group elements k1G, k2G, …, k m G is k1, k2, ..., k m The results of multiplication operations (scalar multiplication, doubling of points) with G, where G is an element of the additive group;

[0045] k1,k2,…,k m is called an integer parameter, and the group elements k1G, k2G, …, k m G is called the integer parameter k1, k2, ..., k m The corresponding multiplier (the integer parameter and its corresponding relationship with the multiplier need to be kept confidential);

[0046] k1G,k2G,…,k m G is represented by G_k1, G_k2, …, G_km ;

[0047] When the first party needs to calculate G_k=kG, where k is an integer in [1,n-1] that only the first party knows and needs to be kept confidential (such as a randomly selected integer as a secret, or an integer selected or calculated by an agreed method that needs to be kept confidential), the first party and the second party collaborate to complete the calculation of G_k=kG in the following manner:

[0048] The first party selects an integer parameter k from the m integer parameters in the parameter pool according to a predetermined rule. t ;

[0049] The first party calculates w = (k (k t ) -1 )mod n, then w and G_k t Sent to the second party, where (k t ) -1 k t The modulo n multiplicative inverse (i.e. (k t (k t ) -1 )mod n=1), G_k t is (taken from the parameter pool) and k t The corresponding number multiplier (i.e. G_k t =k t G);

[0050] The second party calculates G_k = wG_k t ;

[0051] G_k is kG;

[0052] After completing a G_k calculation, or after completing a specified number of G_k calculations for different k, the first party calculates the integer parameter k used in the parameter pool. t and the corresponding multiplier G_k t Update is performed, where t = 1, 2, ... or m.

[0053] Embodiment 2,

[0054] This embodiment relates to an additive group, the order of which is a prime number n; this embodiment includes a first party and a second party, wherein the first party maintains a parameter pool, and the parameter pool has m integers k1, k2, ..., k in the interval [1, n-1]. m , and the corresponding group elements k1G, k2G, …, k m G is k1, k2, ..., k m The results of multiplication operations (scalar multiplication, doubling of points) with G, where G is an element of the additive group;

[0055] k1,k2,…,k m is called an integer parameter, and the group elements k1G, k2G, …, k m G is called the integer parameter k1, k2, ..., k m The corresponding multiplier (the integer parameter and its corresponding relationship with the multiplier need to be kept confidential);

[0056] k1G,k2G,…,k m G is represented by G_k1, G_k2, …, G_k m ;

[0057] When the first party needs to calculate G_k=kG, where k is an integer in [1,n-1] that only the first party knows and needs to be kept confidential (such as a randomly selected integer as a secret, or an integer selected or calculated by an agreed method that needs to be kept confidential), the first party and the second party collaborate to complete the calculation of G_k=kG in the following manner:

[0058] The first party selects an integer parameter k from the m integer parameters in the parameter pool according to a predetermined rule. t ;

[0059] The first party calculates w = (kk t )mod n, then w and G_k t Sent to the second party, where G_k t is (taken from the parameter pool) and k t The corresponding number multiplier (i.e. G_k t =k t G);

[0060] The second party calculates G_k = wG + G_k t ;

[0061] G_k is kG;

[0062] After completing a G_k calculation, or after completing a specified number of G_k calculations for different k, the first party calculates the integer parameter k used in the parameter pool. t and the corresponding multiplier G_k t Update is performed, where t = 1, 2, ... or m.

[0063] Embodiment 3,

[0064] This embodiment relates to a multiplication group, the order of which is a prime number n; this embodiment includes a first party and a second party, wherein the first party maintains a parameter pool, and the parameter pool has m integers k1, k2, ..., k in the interval [1, n-1]. m , and the corresponding group elements g^k1, g^k2, …, g^k in the multiplication group m, that is, k1, k2, …, k m The result of performing power operation on g respectively, where g is an element of the multiplication group, and ^ represents power operation (power operation is performed on the element before ^, and the integer after ^ is the number of times of power operation);

[0065] k1,k2,…,k m are called integer parameters, and the group elements g^k1, g^k2, …, g^k m are called integer parameters k1, k2, …, k m The corresponding power element (the integer parameter and its corresponding relationship with the power element need to be kept confidential);

[0066] g^k1, g^k2, …, g^k m Respectively denoted as g_k1, g_k2, …, g_k m ;

[0067] When the first party needs to calculate g_k=g^k, where k is an integer in [1,n-1] that only the first party knows and needs to be kept confidential (such as a randomly selected integer as a secret, or an integer selected or calculated by an agreed method that needs to be kept confidential), the first party and the second party collaborate to complete the calculation of g_k=g^k in the following manner:

[0068] The first party selects an integer parameter k from the m integer parameters in the parameter pool according to a predetermined rule. t ;

[0069] The first party calculates w = (k (k t ) -1 )mod n, then w and g_k t Sent to the second party, where (k t ) -1 k t The modulo n multiplicative inverse (i.e. (k t (k t ) -1 )mod n=1), g_k t is (taken from the parameter pool) and k t The corresponding power element (i.e. g_k t =g^k t );

[0070] The second party calculates g_k = g_k t ^w;

[0071] g_k is g^k;

[0072] After completing a g_k calculation, or after completing a specified number of g_k calculations for different k, the first party calculates the integer parameter k used in the parameter pool. t And the corresponding power element g_kt Update is performed, where t = 1, 2, ... or m.

[0073] Embodiment 4,

[0074] This embodiment relates to a multiplication group, the order of which is a prime number n; this embodiment includes a first party and a second party, wherein the first party maintains a parameter pool, and the parameter pool has m integers k1, k2, ..., k in the interval [1, n-1]. m , and the corresponding group elements g^k1, g^k2, …, g^k in the multiplication group m , that is, k1, k2, …, k m The result of performing power operation on g respectively, where g is an element of the multiplication group, and ^ represents power operation (power operation is performed on the element before ^, and the integer after ^ is the number of times of power operation);

[0075] k1,k2,…,k m are called integer parameters, and the group elements g^k1, g^k2, …, g^k m are called integer parameters k1, k2, …, k m The corresponding power element (the integer parameter and its corresponding relationship with the power element need to be kept confidential);

[0076] g^k1, g^k2, …, g^k m Respectively denoted as g_k1, g_k2, …, g_k m ;

[0077] When the first party needs to calculate g_k=g^k, where k is an integer in [1,n-1] that only the first party knows and needs to be kept confidential (such as a randomly selected integer as a secret, or an integer selected or calculated by an agreed method that needs to be kept confidential), the first party and the second party collaborate to complete the calculation of g_k=g^k in the following manner:

[0078] The first party selects an integer parameter k from the m integer parameters in the parameter pool according to a predetermined rule. t ;

[0079] The first party calculates w = (kk t )mod n, then w and g_k t Sent to the second party, where g_k t is (taken from the parameter pool) and k t The corresponding power element (i.e. g_k t =g^k t );

[0080] The second party calculates g_k = g_k t (g^w);

[0081] g_k is g^k;

[0082] After completing one calculation of g_k, or after completing a specified number of calculations of g_k for different k, the first party updates the integer parameter k t and the corresponding power element g_k t in the parameter pool, where t = 1, 2, … or m.

[0083] In the above Embodiments 1-4, the way for the first party to select an integer parameter k t from the m integer parameters in the parameter pool according to a predetermined rule includes:[[]]

[0084] When calculating G_k = kG or g_k = g^k each time, select an integer parameter k t in sequence from the m integer parameters, or randomly select an unused integer parameter k t (the integer parameter that has been updated after use belongs to the unused integer parameters);

[0085] The selection of an integer parameter k t in sequence from the m integer parameters

[0086] means that:

[0087] If it is the first time to calculate G_k = kG or g_k = g^k, then select k1; i If the integer parameter selected in the previous calculation is k i+1 and 1 ≤ i < m, then the integer parameter selected in this calculation is k

[0088] If the integer parameter selected in the previous calculation is k m , then the integer parameter selected in this calculation is k1.

[0089] In the above Embodiments 1-2, one way for the first party to update the integer parameter k t and the corresponding G_k t in the parameter pool is as follows (not meaning all possible ways):

[0090] Select p integer parameters from the m integer parameters, 1 ≤ p < m, one of which is k t , and the other p - 1 are randomly selected from the remaining m - 1 integer parameters; the p integer parameters are respectively denoted as r1, r2, …, r p ;

[0091] r1, r2, …, r p The corresponding scalar multiplication elements are respectively denoted as G_r1, G_r2, …, G_r p ;

[0092] Randomly select p positive integers c1, c2, …, c p , and make c1 + c2 + … + c p ≤ L, where L is a pre-set integer less than m (usually L is much less than m);

[0093] Calculate u = (c1r1 + c2r2 + … + c p r p ) mod n,

[0094] Gu = c1Gr1 + c2Gr2 + … + c p Gr p ;

[0095] Then use u as the value of the new integer parameter k t (the t-th integer parameter), and use Gu as the new Gk t (the scalar multiplication element corresponding to k t ).

[0096] In the above Examples 3 - 4, a way for the first party to update the used integer parameter k t and the corresponding gk t in the parameter pool is as follows (not meaning all possible ways):

[0097] Select p integer parameters from m integer parameters (for example, randomly select p parameters from m integer parameters, or one of the p integer parameters is k t , and the other p - 1 are randomly selected from the remaining m - 1 integer parameters), 1 ≤ p < m; the p integer parameters are respectively denoted as r1, r2, …, r p ;

[0098] r1, r2, …, r p The corresponding power elements are respectively denoted as gr1, gr2, …, gr p ;

[0099] Randomly select p positive integers c1, c2, …, c p , and make c1 + c2 + … + c p ≤ L, where L is a pre-set integer less than m (usually L is much less than m);

[0100] Calculate u = (c1r1 + c2r2 + … + c p r p ) mod n,

[0101] gu = (gr1^c1)(gr2^c2)…(gr p ^c p );

[0102] Then use u as the new integer parameter k t (tth integer parameter), using g_u as the new g_k t (k t corresponding power element).

[0103] In the above embodiment, the integer parameter k is updated t and the corresponding G_k t or g_k t In the method, the number p of selected parameters is a fixed integer or a non-fixed integer; if p is a non-fixed integer, then p is an integer randomly selected within a specified range, or an integer changed or selected according to a predetermined rule.

[0104] In the above embodiment, the integer parameter k is updated t and the corresponding G_k t or g_k t In the above example, the principle of selecting L is to make the integer parameter k t and the corresponding G_k t or g_k t The update operation performed can be completed within the expected or specified time (that is, when the computational workload is the largest, the update operation can be completed within the expected or specified time).

[0105] In the above embodiment, the integer parameter k is updated t and the corresponding G_k t or g_k t If L = pq (p times q), where p and q are integers, then the first party randomly selects p positive integers c1, c2, ..., c p , and such that c1+c2+…+c p One way to ≤ L is as follows (not all possible ways):

[0106] Randomly select p integers c1, c2, ..., c in [1, q] p .

[0107] Based on the calculation method for group element multiplication or exponentiation, a calculation system for group element multiplication or exponentiation can be implemented, the system comprising two devices, one of which is the first party, and the other is the second party; the device as the first party is a device with limited resources and weak computing power, and the device as the second party is a device with abundant resources and strong computing power;

[0108] When the device as the first party needs to calculate G_k=kG or g_k=g^k, where k is an integer in [1,n-1] that is known only to the first party and needs to be kept confidential (such as a randomly selected integer as a secret, or an integer that needs to be kept confidential selected or calculated by an agreed method), the two devices calculate G_k=kG or g_k=g^k according to the calculation method for multiplication or exponentiation of group elements.

[0109] Other specific technical implementations not described are well known and self-evident to technicians in the relevant fields.

Claims

1. A method for calculating multiplication or exponentiation of group elements, characterized by: The method involves an additive group or a multiplicative group; the order of the additive group or the multiplicative group is a prime number n; The method includes a first party and a second party, wherein the first party maintains a parameter pool, wherein the parameter pool contains m confidential integers k1, k2, ..., k in the interval [1, n-1]. m , and the corresponding group elements k1G, k2G, …, k m G, that is, k1, k2, …, k m The result of multiplication with G, where G is an element of the additive group or has a corresponding element g^k1, g^k2, ..., g^k in the multiplicative group m , that is, k1, k2, …, k m The results of the power operation on g, where g is an element of the multiplication group and ^ represents the power operation; k1,k2,…,k m is called an integer parameter, and the group elements k1G, k2G, …, k m G is called the integer parameter k1, k2, ..., k m The corresponding number of multipliers, group elements g^k1, g^k2, ..., g^k m are called integer parameters k1, k2, …, k m The corresponding power element; k1G,k2G,…,k m G is represented by G_k1, G_k2, …, G_k m ; g^k1, g^k2, …, g^k m Respectively denoted as g_k1, g_k2, …, g_k m ; When the first party needs to calculate G_k=kG or g_k=g^k, where k is an integer in [1,n-1] that only the first party knows and needs to be kept secret, the first party and the second party collaborate to complete the calculation of G_k=kG or g_k=g^k as follows: The first party selects an integer parameter k from the m integer parameters in the parameter pool according to a predetermined rule. t , t=1,2,…,or m; The first party calculates w = (k (k t ) -1 ) mod n or w = (kk t )mod n, then w and G_k t or w and g_k t Sent to the second party, where (k t ) -1 k t The modular n multiplicative inverse of G_k t is with k t The corresponding number of multipliers, g_k t is with k t The corresponding power element; If the calculation formula of w is w=(k(k t ) -1 ) mod n, then: The second party calculates G_k = wG_k t Or g_k=g_k t ^w; If the calculation formula of w is w=(kk t ) mod n, then: The second party calculates G_k = wG + G_k t Or g_k=g_k t (g^w); G_k is kG or g_k is g^k; After completing a G_k or g_k calculation, or after completing a specified number of G_k or g_k calculations for different k, the first party calculates the integer parameter k used in the parameter pool. t and the corresponding multiplier G_k t or power element g_k t Update, where t = 1, 2, ... or m; The first party and the second party are computing devices.

2. The method for calculating multiplication or exponentiation of group elements according to claim 1, characterized in that: The first party selects an integer parameter k from the m integer parameters in the parameter pool according to a predetermined rule. t The methods include: Each time G_k=kG or g_k=g^k is calculated, an integer parameter k is selected in sequence from the m integer parameters. t , or randomly select an unused integer parameter k from among the m integer parameters t ; The method selects an integer parameter k from the m integer parameters in sequence. t means: If it is the first time to calculate G_k=kG or g_k=g^k, then select k1; If the integer parameter selected for the previous calculation is k i and 1 ≤ i < m, then the one selected for this calculation is k i+1 ; If the integer parameter selected in the last calculation is k m , then k1 is selected for this calculation.

3. The calculation method for group element multiplication or exponentiation according to claim 1, characterized in that: The first party uses the integer parameter k in the parameter pool t and the corresponding G_k t or g_k t One way to do the update is as follows: Select p integer parameters from m integer parameters, where 1 ≤ p < m; the p integer parameters are respectively represented as r1, r2, …, r p ; r1,r2,…,r p The corresponding multipliers are represented as G_r1, G_r2,…, G_r p , or r1,r2,…,r p The corresponding power elements are represented as g_r1, g_r2, …, g_r p ; Randomly select p positive integers c1, c2, ..., c p , and such that c1+c2+…+c p ≤L, where L is a preset integer less than m; Calculate u = (c1r1 + c2r2 + ... + c p r p )mod n, G_u=c1G_r1+c2G_r2+…+c p G_r p , or g_u=(g_r1^c1)(g_r2^c2)…(g_r p ^c p ); Then use u as the new integer parameter k t value, use G_u as the new G_k t , or use g_u as the new g_k t .

4. The method for calculating group element multiplication or exponentiation according to claim 3, characterized in that: The p is a fixed integer or a non-fixed integer; if p is a non-fixed integer, then p is an integer randomly selected within a specified range, or an integer that changes or is selected according to a pre-set rule.

5. The method for calculating group element multiplication or exponentiation according to claim 3, characterized in that: The principle of selecting L is to make the integer parameter k t and the corresponding G_k t or g_k t The update operations performed can be completed within the expected or specified time.

6. The method for calculating group element multiplication or exponentiation according to claim 5, characterized in that: If L = pq, where p and q are integers, the first party randomly selects p positive integers c1, c2, ..., c p , and such that c1+c2+…+c p One way to ≤L is as follows: Randomly select p integers c1, c2, ..., c in [1, q] p .

7. A computing system for group element multiplication or exponentiation based on the computing method for group element multiplication or exponentiation as claimed in any one of claims 1 to 6, characterized in that: The system includes two devices, one of which is the first party and the other is the second party; When the device as the first party needs to calculate G_k=kG or g_k=g^k, where k is an integer in [1,n-1] that is only known to the first party and needs to be kept confidential, the two devices calculate G_k=kG or g_k=g^k according to the calculation method for multiplication or exponentiation of the number of group elements.