A two-party collaborative signature and decryption method and system based on SM2 algorithm

Abstract

The present invention relates to a two-party collaborative signature and decryption method and system based on the SM2 algorithm, which belongs to the field of cryptography application technology. The collaborative signature method includes: the two communicating parties generate their own sub-private keys, one of which calculates a part of the public key according to its own sub-private key and sends it to the other communicating party; the other communicating party calculates the complete public key according to its own sub-private key and the part of the public key and makes it public; the first communicating party calculates the summary of the message to be signed, generates the first part of the signature according to its own sub-private key, and sends it to the second communicating party; the second communicating party calculates the second part of the signature according to the received data and its own sub-private key, and sends it to the first communicating party; the first communicating party generates a complete signature according to its own sub-private key and the second part of the signature and outputs it. At the same time, the present invention relates to a two-party collaborative decryption method. The present invention can fully guarantee the security of the SM2 algorithm private key; the communication and calculation costs are low, the actual operability is strong, and it can meet the cloud computing environment with low latency and less interaction.

Description

Technical Field

[0001] The present invention belongs to the technical field of cryptography application, and in particular relates to a two-party collaborative signature and decryption method and system based on SM2 algorithm. Background Art

[0002] Cryptography is the core technology of information security. Public key cryptography is more suitable for digital signature and other application scenarios due to the asymmetry between public key and private key, and can effectively solve the problem of key distribution. Digital signature and encryption and decryption technology based on public key cryptography has been widely used in e-commerce, identity authentication and other applications. In the public key cryptography system, how to ensure the security of user private key is a very important issue. Usually, the user's private key needs to be securely generated, stored and used in special hardware. However, with the popularization of public key cryptography algorithms and the promotion of SM2 elliptic curve public key cryptography algorithm independently developed by my country, SM2 algorithm has also played an increasingly important role in Internet of Things applications such as Internet of Vehicles, smart medical systems, smart home systems and cloud computing systems. Many systems and terminals using SM2 algorithm, especially mobile smart terminals, are not equipped with hardware cryptographic modules in the form of cryptographic chips and security elements. We call them "weak terminals" and can only rely on software cryptographic modules to complete cryptographic operations. Private keys need to be stored in the local storage medium of the user terminal. Although private keys can be protected by encryption, PIN code protection and other means, they are still easy to be stolen by attackers.

[0003] How to protect the security of private keys in "weak terminals" is a very important issue in the implementation of cryptographic algorithms. A feasible solution to this problem is to adopt a multi-party collaborative signature or decryption method, where the private key is split into multiple copies and stored separately in different terminals. When performing private key calculations, each terminal uses its own sub-private key to perform calculations and exchanges partial calculation results, so that the final private key calculation result is finally obtained by one party. In the process of private key generation and private key calculation, the complete private key can be prevented from appearing, which can effectively improve the security of the private key.

[0004] Currently, there are some solutions for two-party collaborative signing or decryption based on the SM2 algorithm. However, there are problems such as large amount of calculation, large amount of interactive data, large storage space, low signing or decryption efficiency, and relatively large performance overhead, and better technical solutions are needed. Summary of the invention

[0005] In view of the problems existing in the prior art, the purpose of the present invention is to provide a two-party collaborative signature and decryption method and system based on the SM2 algorithm, which can fully ensure the security of the SM2 algorithm private key; the communication and computing costs are low, the basic operation modules of the SM2 algorithm can be reused, the actual operability is strong, and it can meet the low-latency and low-interaction cloud computing environment.

[0006] To achieve the above objectives, in a first aspect, the present invention provides a two-party collaborative signature method based on the SM2 algorithm, involving a first communication party and a second communication party, the method comprising a public key generation phase and a collaborative signature phase, wherein the public key generation phase comprises the following steps:

[0007] The two communicating parties each generate their own sub-private key, one of which calculates a partial public key based on its own sub-private key and sends the partial public key to the other communicating party;

[0008] The other communication party calculates the complete public key based on its own sub-private key and the received partial public key and makes it public;

[0009] The collaborative signing phase includes the following steps:

[0010] The first communication party calculates a message digest of the message to be signed, generates a first partial signature according to its own sub-private key, and sends the message digest and the first partial signature to the second communication party;

[0011] The second communication party calculates the second partial signature according to the received message digest, the first partial signature and its own sub-private key, and sends the second partial signature to the first communication party;

[0012] The first communication party generates a complete signature according to its own sub-private key and the received second partial signature and outputs it.

[0013] Further, in the two-party collaborative signature method based on the SM2 algorithm as described above, the calculation method of the complete public key is:

[0014] The first communication party generates a random number D 1 ∈[1, n-2], as its own child private key, according to the child private key D 1 Calculate the partial public key P 1 =D 1 [*]G, where G is the base point of the SM2 algorithm elliptic curve E shared by both communicating parties, n is the order of the base point, and [*] represents the point multiplication operation on the elliptic curve E;

[0015] The second communication party generates a random number D 2 ∈[1, n-2], as its own child private key, according to the child private key D 2 and the received partial public key P 1 Calculate the complete public key P = D 2 [*](P 1 +G)+P 1 ;

[0016] If P=O, a random number is regenerated, otherwise P is published as a complete public key, where O is the point at infinity of the elliptic curve E;

[0017] Or the calculation method of the complete public key is:

[0018] The second communication party generates a random number D 2 ∈[1, n-2], as its own child private key, according to the child private key D 2 Calculate the partial public key P 2 =D 2 [*]G, where G is the base point of the SM2 algorithm elliptic curve E shared by both communicating parties, n is the order of the base point, and [*] represents the point multiplication operation on the elliptic curve E;

[0019] The first communication party generates a random number D 1 ∈[1, n-2], as its own child private key, according to the child private key D 1 and the received partial public key P 2 Calculate the complete public key P = D 1 [*](P 2 +G)+P 2 ;

[0020] If P=O, a random number is regenerated; otherwise, P is published as a complete public key, where O is the point at infinity of the elliptic curve E.

[0021] Further, in the above-mentioned two-party collaborative signature method based on the SM2 algorithm, the first communication party calculates the message digest of the message to be signed, and generates the first part of the signature according to its own sub-private key based on the SM2 algorithm. The specific steps are:

[0022] The first communication party concatenates the corresponding Z value in the SM2 algorithm and the message M to be signed into M', that is, M'=Z||M, and then calculates the message digest e=H(M'), where Z represents the common identity of the first communication party and the second communication party, and H() represents a predetermined cryptographic hash function;

[0023] The first communication party generates a random number k 1 ∈[1, n-1], according to k 1 Calculate the first part of the signature Q 1 =k 1 (1+D 1 )[*]G.

[0024] Further, in the above-mentioned two-party collaborative signature method based on the SM2 algorithm, the calculation method of the second part of the signature is:

[0025] The second communication party generates a random number k 2 ∈[1, n-1], according to k2 and the first part of the signature Q received 1 Calculate Q 2 =(1+D 2 )[*]Q 1 +k 2 [*]G=(x 1 ,y 1 ), and calculate r = x 1 +e mod n, if r = 0, the second communication party regenerates a random number, where mod is a modulus operation;

[0026] If r≠0, the second communication party calculates s 2 =(1+D 2 ) -1 (r+k 2 ) mod n, get the second part of the signature r and s 2 .

[0027] Further, in the two-party collaborative signature method based on the SM2 algorithm as described above, the first communication party generates a complete signature based on its own sub-private key and the received second partial signature and outputs the following:

[0028] The first communication party uses the sub-private key D 1 and the second part of the signature received r and s 2 , calculate the signature component s = (1 + D 1 ) -1 s 2 +k 1 -r mod n;

[0029] If s=0 or s=nr, the signing process is restarted, otherwise (r, s) is output as the complete signature.

[0030] In a second aspect, the present invention provides a two-party collaborative decryption method based on the SM2 algorithm, involving a first communication party and a second communication party, the method comprising a public key generation stage and a collaborative decryption stage, wherein the public key generation stage comprises the following steps:

[0031] The two communicating parties each generate their own sub-private key, one of which calculates a partial public key based on its own sub-private key and sends the partial public key to the other communicating party;

[0032] The other communication party calculates the complete public key based on its own sub-private key and the received partial public key and makes it public;

[0033] The collaborative decryption stage includes the following steps:

[0034] The first communication party extracts a first part of the ciphertext from the acquired ciphertext, and sends the first part of the ciphertext to the second communication party;

[0035] The second communication party partially decrypts the first part of the ciphertext according to its own sub-private key to obtain a partial ciphertext, and sends the partial ciphertext to the first communication party;

[0036] The first communication party completely decrypts the ciphertext according to its own sub-private key and the received partial ciphertext, obtains the complete plaintext and outputs it.

[0037] Further, in the two-party collaborative decryption method based on the SM2 algorithm as described above, the calculation method of the complete public key is:

[0038] The first communication party generates a random number D 1 ∈[1, n-2], as its own child private key, according to the child private key D 1 Calculate the partial public key P 1 =D 1 [*]G, where G is the base point of the SM2 algorithm elliptic curve E shared by both communicating parties, n is the order of the base point, and [*] represents the point multiplication operation on the elliptic curve E;

[0039] The second communication party generates a random number D 2 ∈[1, n-2], as its own child private key, according to the child private key D 2 and the received partial public key P 1 Calculate the complete public key P = D 2 [*](P 1 +G)+P 1 ;

[0040] If P=O, a random number is regenerated, otherwise P is published as a complete public key, where O is the point at infinity of the elliptic curve E;

[0041] Or the calculation method of the complete public key is:

[0042] The second communication party generates a random number D 2 ∈[1, n-2], as its own child private key, according to the child private key D 2 Calculate the partial public key P 2 =D 2 [*]G, where G is the base point of the SM2 algorithm elliptic curve E shared by both communicating parties, n is the order of the base point, and [*] represents the point multiplication operation on the elliptic curve E;

[0043] The first communication party generates a random number D 1 ∈[1, n-2], as its own child private key, according to the child private key D 1 and the received partial public key P 2 Calculate the complete public key P = D 1 [*](P 2 +G)+P2 ;

[0044] If P=O, a random number is regenerated; otherwise, P is published as a complete public key, where O is the point at infinity of the elliptic curve E.

[0045] Further, in the two-party collaborative decryption method based on the SM2 algorithm as described above, the first communication party extracts the first part of the ciphertext from the acquired ciphertext, and sends the first part of the ciphertext to the second communication party specifically as follows:

[0046] The first communication party obtains the ciphertext C=C 1 ||C 3 ||C 2 Take out the first part of the ciphertext C 1 , and C 1 The data type is converted to a point on the elliptic curve E, and C is judged 1 Is it a non-infinity point? If so, then C 1 Sent to the second communication party, where C 1 , C 3 , C 2 The type of is bit string.

[0047] Further, in the two-party collaborative decryption method based on the SM2 algorithm as described above, the calculation formula for the second communication party to obtain the partial ciphertext is: T = D 2 [*]C 1 .

[0048] Further, in the two-party collaborative decryption method based on the SM2 algorithm as described above, the first communication party completely decrypts the ciphertext according to its own sub-private key and the received partial ciphertext to obtain the complete plaintext and output the specific process as follows:

[0049] The first communication party calculates D 1 [*]C 1 +(1+D 1 )[*]T=(x 2 ,y 2 ), and the coordinate x 2 ,y 2 Convert to bit string;

[0050] The first communication party calculates t=KDF(x 2 ||y 2 , klen), if t is an all-zero bit string, an error is reported and the program exits, where KDF() represents a predetermined key derivation function, and klen represents the length of the key data to be obtained;

[0051] If t≠0, the first communication party will use the ciphertext C=C 1 ||C 3 ||C2 Take out the second part of the ciphertext C 2 , calculate M" = C 2 ⊕t;

[0052] The first communication party calculates u=H(x 2 ||M"||y 2 ), from the ciphertext C = C 1 ||C 3 ||C 2 Take out the third part of the ciphertext C 3 , if u≠C 3 , then report an error and exit, otherwise output the complete plaintext M".

[0053] In a third aspect, the present invention provides a two-party collaborative signature system based on the SM2 algorithm, comprising a first communication party and a second communication party, wherein the first communication party and the second communication party are communicatively connected, and the two-party collaborative signature system is configured to execute the two-party collaborative signature method based on the SM2 algorithm described in the first aspect.

[0054] In a fourth aspect, the present invention provides a two-party collaborative decryption system based on the SM2 algorithm, comprising a first communication party and a second communication party, wherein the first communication party and the second communication party are communicatively connected, and the two-party collaborative decryption system is configured to execute the two-party collaborative decryption method based on the SM2 algorithm described in the second aspect.

[0055] The two-party collaborative signing and decryption method and system based on the SM2 algorithm provided by the present invention can independently generate and store partial private keys at both communicating parties, and then perform two-party collaborative signing and decryption. Compared with the prior art, the beneficial effects of the present invention are:

[0056] 1. The complete private key of the SM2 algorithm never appears in the entire process, which improves the security of the SM2 algorithm private key;

[0057] 2. The private key is split into two parts, which can be stored in different terminals respectively, which is more suitable for application scenarios currently participated by many mobile smart terminals;

[0058] 3. During the signing or decryption operation, both parties need to perform less calculations, and less data is transmitted during the communication process, which is more suitable for cloud computing environments that require low latency and high interactivity;

[0059] 4. The basic operation modules of the SM2 algorithm can be reused without adding new operation modules, which is simple to implement and has low deployment cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a flow chart of a two-party collaborative signature method based on the SM2 algorithm provided in a specific implementation manner of the present invention;

[0061] Figure 2 The implementation mechanism of the public key generation phase provided in the specific implementation mode of the present invention;

[0062] Figure 3 An implementation mechanism of the collaborative signature phase provided in a specific implementation manner of the present invention;

[0063] Figure 4 It is a flow chart of a two-party collaborative decryption method based on the SM2 algorithm provided in a specific implementation manner of the present invention;

[0064] Figure 5 This is an implementation mechanism of the collaborative decryption phase provided in a specific implementation manner of the present invention. DETAILED DESCRIPTION

[0065] In order to make the technical problems solved by the present invention, the technical solutions adopted and the technical effects achieved clearer, the technical solutions of the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] To facilitate understanding, basic concepts and terms involved in the embodiments of the present invention are first briefly described.

[0067] The two communicating parties share the elliptic curve parameters E(F) of the SM2 algorithm. q ), the elliptic curve E is defined in the finite field F q An elliptic curve on E, wherein G is the base point of the elliptic curve, the order of the base point is n, and O is the point at infinity of the elliptic curve. The present invention uses [*] to represent the point multiplication operation on E, k[*]G represents the k-times point of G; mod n represents the modulo n operation; the plus sign + is used to represent the elliptic curve point addition operation and the numerical addition operation: if it is the elliptic curve point addition, then + represents the point addition operation; if it is the numerical addition, then + represents the numerical addition operation; H() represents a predetermined cryptographic hash function, KDF() represents a predetermined key derivation function, klen represents the length of the key data to be obtained, and || represents splicing.

[0068] For ease of expression, the first communication party and the second communication party are used to represent the two communicating parties respectively, wherein the first communication party can be a client or a server. Accordingly, when the first communication party is a client, the second communication party is a server; when the first communication party is a server, the second communication party is a client.

[0069] Figure 1The flowchart of the two-party collaborative signature method based on the SM2 algorithm provided by the present invention is shown. The method mainly includes a public key generation stage and a collaborative signature stage;

[0070] The public key generation phase mainly includes the following steps:

[0071] Step S11: Each communicating party generates its own sub-private key, one of which calculates a partial public key based on its own sub-private key, and sends the partial public key to the other communicating party.

[0072] Step S12: The other communication party calculates the complete public key based on its own sub-private key and the received partial public key and makes it public.

[0073] In an optional implementation, the specific steps of generating a complete public key are:

[0074] like Figure 2 As shown, the first communication party generates a random number D 1 As its own child private key, D 1 Any integer in the range [1, n-2], then according to the child private key D 1 Calculate the partial public key P 1 , and send it to the second communication party. Partial public key P 1 The calculation formula is: 1 =D 1 [*]G

[0075] Where G is the base point of the SM2 algorithm elliptic curve E shared by both communicating parties, n is the order of the base point, and [*] represents the point multiplication operation on the elliptic curve E;

[0076] The second communication party generates a random number D 2 As its own child private key, D 2 Any integer in the range [1, n-2], and according to the child private key D 2 and P 1 Calculate the complete public key P. The calculation formula of P is:

[0077] P=D 2 [*](P 1 +G)+P 1

[0078] If P=O, a random number needs to be regenerated, otherwise P is published as a complete public key, where O is the point at infinity of the elliptic curve E.

[0079] In the public key generation stage, the identities of the first communication party and the second communication party can be interchangeable, that is, the method for generating a complete public key can also be:

[0080] The second communication party generates a random number D2 As its own child private key, D 2 Any integer in the range [1, n-2], then according to the child private key D 2 Calculate the partial public key P 2 , and send it to the second communication party. Partial public key P 2 The calculation formula is: 2 =D 2 [*]G

[0081] Where G is the base point of the SM2 algorithm elliptic curve E shared by both communicating parties, n is the order of the base point, and [*] represents the point multiplication operation on the elliptic curve E;

[0082] The first communication party generates a random number D 1 As its own child private key, D 1 Any integer in the range [1, n-2], and according to the child private key D 1 and P 2 Calculate the complete public key P. The calculation formula of P is:

[0083] P=D 1 [*](P 2 +G)+P 2

[0084] If P=O, a random number needs to be regenerated, otherwise P is published as a complete public key, where O is the point at infinity of the elliptic curve E.

[0085] refer to Figure 3 ,The collaborative signature phase mainly includes the following steps:

[0086] Step S13: The first communication party calculates the message digest of the message to be signed, generates a first partial signature according to its own sub-private key, and sends the message digest and the first partial signature to the second communication party.

[0087] In an optional implementation, the steps of calculating the message digest of the message to be signed and generating the first part of the signature in step S13 are as follows:

[0088] The first communication party concatenates the corresponding Z value in the SM2 algorithm and the message M to be signed into M', that is, M'=Z||M, and then calculates the message digest e=H(M'), where Z represents the common identity of the first communication party and the second communication party, and H() represents a predetermined cryptographic hash function;

[0089] The first communication party generates a random number k 1 ∈[1, n-1], according to k 1 Calculate the first part of the signature Q 1 =k 1 (1+D1 )[*]G.

[0090] Step S14: The second communication party calculates a second partial signature based on the received message digest, the first partial signature and its own sub-private key, and sends the second partial signature to the first communication party.

[0091] In an optional implementation, the specific steps of calculating the second partial signature in step S14 include:

[0092] The second communication party generates a random number k 2 ∈[1, n-1], according to k 2 and the first part of the signature Q received 1 Calculate Q 2 =(1+D 2 )[*]Q 1 +k 2 [*]G=(x 1 ,y 1 ), and calculate r = x 1 +e mod n, if r = 0, the second communication party regenerates a random number, where mod is a modulus operation;

[0093] If r≠0, the second communication party calculates s 2 =(1+D 2 ) -1 (r+k 2 ) mod n, get the second part of the signature r and s 2 .

[0094] Step S15: The first communication party generates a complete signature based on the sub-private key and the received second partial signature and outputs it.

[0095] In an optional implementation, the step of generating a complete signature in step S15 is specifically as follows:

[0096] The first communication party uses the sub-private key D 1 and the second part of the signature received r and s 2 , calculate the signature component s = (1 + D 1 ) -1 s 2 +k 1 -r mod n;

[0097] If s=0 or s=nr, the signing process is restarted, otherwise (r, s) is output as the complete signature.

[0098] The subsequent signature verification process is the same as that in the SM2 algorithm.

[0099] In this embodiment, during the public key generation phase, the communicating parties each independently generate their own sub-private keys, and through one round of information transmission, one of the parties can calculate and publish the public key. The SM2 complete private key never appears in the entire process, thereby improving the security of the SM2 private key. During the collaborative signing phase, the communicating parties use their own sub-private keys, and through two rounds of information transmission, one of them generates a complete signature. Any third party that obtains the signature can verify the signature through the public public key information and the SM2 algorithm.

[0100] Only one data needs to be transmitted in the public key generation phase, and only two data are transmitted in each round in the collaborative signature phase, so the amount of communication data is small. The public key generation phase does not use expensive point subtraction operations or modular inverse budgets, and only two point multiplication operations are required. The collaborative signature phase only uses three point multiplication operations, which greatly reduces the computational overhead.

[0101] Figure 4 The flowchart of the two-party collaborative decryption method based on the SM2 algorithm provided by the present invention is shown, and the method mainly includes a public key generation stage and a collaborative decryption stage;

[0102] Among them, the public key generation stage is the same as steps S11 and S12 of the public key generation stage in the above-mentioned two-party collaborative signature method based on the SM2 algorithm, and will not be described in detail here.

[0103] refer to Figure 5 ,The collaborative decryption phase mainly includes the following steps:

[0104] Step S23: The first communication party extracts a first part of the ciphertext from the acquired ciphertext, and sends the first part of the ciphertext to the second communication party.

[0105] In an optional implementation, the first communication party obtains the ciphertext C=C 1 ||C 3 ||C 2 Take out the first part of the ciphertext C 1 , and C 1 The data type is converted to a point on the elliptic curve E, and C is judged 1 Is it a non-infinity point? If so, then C 1 Sent to the second communication party, where C 1 , C 3 , C 2 The data type is bit string.

[0106] Step S24: The second communication party partially decrypts the first part of the ciphertext according to its own sub-private key to obtain a partial ciphertext, and sends the partial ciphertext to the first communication party.

[0107] In an optional implementation, the calculation formula for the partial ciphertext is: T = D 2 [*]C1 .

[0108] Step S25: The first communication party completely decrypts the ciphertext according to its own sub-private key and the received partial ciphertext to obtain the complete plaintext and output it.

[0109] In an optional implementation, the specific decryption process in step S25 is:

[0110] The first communication party calculates D 1 [*]C 1 +(1+D 1 )[*]T=(x 2 ,y 2 ), and the coordinate x 2 ,y 2 Convert to bit string;

[0111] The first communication party calculates t=KDF(x 2 ||y 2 , klen), if t is an all-zero bit string, an error is reported and the program exits, where KDF() represents a predetermined key derivation function, and klen represents the length of the key data to be obtained;

[0112] If t≠0, the first communication party will use the ciphertext C=C 1 ||C 3 ||C 2 Take out the second part of the ciphertext C 2 , calculate M" = C 2 ⊕t;

[0113] The first communication party calculates u=H(x 2 ||M"||y 2 ), from the ciphertext C = C 1 ||C 3 ||C 2 Take out the third part of the ciphertext C 3 , if u≠C 3 , then report an error and exit, otherwise output the complete plaintext M".

[0114] In this embodiment, the communicating parties use their own sub-private keys and, through two rounds of information transmission, can decrypt any legal ciphertext encrypted by a third party using public public key information and the SM2 algorithm. The entire decryption process (including the key generation phase and the collaborative decryption phase) does not require modular inverse operations, and only one data needs to be transmitted in each round, which requires less calculations and is more suitable for cloud computing environments that require low latency and high interactivity.

[0115] According to the above-mentioned two-party collaborative signature method based on the SM2 algorithm, the present invention provides a two-party collaborative signature system based on the SM2 algorithm, the system comprising a first communication party and a second communication party, the first communication party and the second communication party being communicatively connected, and the two-party collaborative signature system is configured to execute the above-mentioned two-party collaborative signature method based on the SM2 algorithm.

[0116] According to the above-mentioned two-party collaborative decryption method based on the SM2 algorithm, the present invention provides a two-party collaborative decryption system based on the SM2 algorithm, the system comprising a first communication party and a second communication party, the first communication party and the second communication party being communicatively connected, and the two-party collaborative decryption system being configured to execute the above-mentioned two-party collaborative decryption method based on the SM2 algorithm.

[0117] The present invention provides a two-party collaborative signature and decryption method and system based on the SM2 algorithm, and also provides a technical solution for collaborative signature and collaborative decryption. In the public key generation stage, the two communicating parties independently generate their own sub-private keys, and one of them can calculate and publish the public key through one round of information transmission; in the collaborative signature stage, the two communicating parties use their own sub-private keys, and one of them generates a complete signature through two rounds of information transmission. Any third party that obtains the signature can verify the signature through the public public key information and the SM2 algorithm, and the signature verification process is consistent with the signature verification in the SM2 algorithm; in the collaborative decryption stage, the two communicating parties use their own sub-private keys, and through two rounds of information transmission, one of them can decrypt the legal ciphertext encrypted by any third party through the public public key information and the SM2 algorithm. Through the above means, the beneficial effects achieved are:

[0118] The complete private key of the SM2 algorithm never appears in the entire process, which improves the security of the SM2 algorithm private key; the private key is split into two parts, which can be stored in different terminals respectively, which is more suitable for application scenarios currently participated by many mobile smart terminals; the two parties need to perform fewer calculations during the signing or decryption operation, and less data is transmitted during the communication process, which is more suitable for cloud computing environments that require low latency and high interactivity; the basic operation modules of the SM2 algorithm can be reused without adding new operation modules, which is simple to implement and has low deployment costs.

[0119] Those skilled in the art should understand that the present invention is not limited to the embodiments described in the specific implementation manner, and the above specific description is only for the purpose of explaining the present invention, and is not used to limit the present invention. Those skilled in the art derive other implementation methods based on the technical solution of the present invention, which also belong to the technical innovation scope of the present invention, and the protection scope of the present invention is defined by the claims and their equivalents.

Claims

1. A two-party collaborative signature method based on the SM2 algorithm, involving a first communication party and a second communication party, the method comprising a public key generation phase and a collaborative signature phase, wherein the public key generation phase comprises the following steps: The two communicating parties each generate their own sub-private key, one of which calculates a partial public key based on its own sub-private key and sends the partial public key to the other communicating party; The other communication party calculates the complete public key based on its own sub-private key and the received partial public key and makes it public; The specific calculation method of the complete public key is: The first communication party generates a random number D1∈[1, n-2] as its own sub-private key, and calculates a partial public key P1=D1[*]G based on the sub-private key D1, where G is the base point of the SM2 algorithm elliptic curve E shared by both communication parties, n is the order of the base point, and [*] represents the point multiplication operation on the elliptic curve E; The second communication party generates a random number D2∈[1, n-2] as its own sub-private key, and calculates the complete public key P=D2[*](P1+G)+P1 based on the sub-private key D2 and the received partial public key P1; If P=O, a random number is regenerated, otherwise P is published as a complete public key, where O is the point at infinity of the elliptic curve E; Or the calculation method of the complete public key is: The second communication party generates a random number D2∈[1, n-2] as its own sub-private key, and calculates the partial public key P2=D2[*]G based on the sub-private key D2, where G is the base point of the elliptic curve E of the SM2 algorithm shared by both communication parties, n is the order of the base point, and [*] represents the point multiplication operation on the elliptic curve E; The first communication party generates a random number D1∈[1, n-2] as its own sub-private key, and calculates the complete public key P=D1[*](P2+G)+P2 based on the sub-private key D1 and the received partial public key P2; If P=O, a random number is regenerated, otherwise P is published as a complete public key, where O is the infinite point of the elliptic curve E; the collaborative signature phase includes the following steps: The first communication party calculates the message digest of the message to be signed, and generates the first part of the signature according to its own sub-private key, specifically: the first communication party splices the corresponding Z value in the SM2 algorithm and the message M to be signed into M', that is, M'=Z||M, and then calculates the message digest e=H(M'), where Z represents the common identity of the first communication party and the second communication party, and H() represents a predetermined cryptographic hash function; the first communication party generates a random number k1∈[1, n-1], calculates the first part of the signature Q1=k1(1+D1)[*]G according to k1, and sends the message digest e and the first part of the signature Q1 to the second communication party; The second communication party calculates the second partial signature according to the received message digest, the first partial signature and its own sub-private key, specifically: the second communication party generates a random number k2∈[1, n-1], calculates Q2=(1+D2)[*]Q1+k2[*]G=(x1, y1) according to k2 and the received first partial signature Q1, and calculates r=x1+e mod n. If r=0, the second communication party regenerates a random number, where mod is a modulus operation; if r≠0, the second communication party calculates s2=(1+D2) -1 (r+k2)modn, obtain the second partial signature r and s2, and send the second partial signature to the first communication party; The first communication party generates a complete signature based on its own sub-private key and the received second part of the signature and outputs the complete signature as follows: The first communication party calculates the signature component s=(1+D1) based on the sub-private key D1 and the received second partial signature r and s2 -1 s2+k1-r mod n; If s=0 or s=nr, the signing process is restarted, otherwise (r, s) is output as the complete signature.

2. A two-party collaborative decryption method based on the SM2 algorithm, involving a first communication party and a second communication party, the method comprising a public key generation phase and a collaborative decryption phase, wherein the public key generation phase comprises the following steps: The two communicating parties each generate their own sub-private key, one of which calculates a partial public key based on its own sub-private key and sends the partial public key to the other communicating party; The other communication party calculates the complete public key based on its own sub-private key and the received partial public key and makes it public; The calculation method of the complete public key is: The first communication party generates a random number D1∈[1, n-2] as its own sub-private key, and calculates a partial public key P1=D1[*]G based on the sub-private key D1, where G is the base point of the SM2 algorithm elliptic curve E shared by both communication parties, n is the order of the base point, and [*] represents the point multiplication operation on the elliptic curve E; The second communication party generates a random number D2∈[1, n-2] as its own sub-private key, and calculates the complete public key P=D2[*](P1+G)+P1 based on the sub-private key D2 and the received partial public key P1; If P=O, a random number is regenerated, otherwise P is published as a complete public key, where O is the point at infinity of the elliptic curve E; Or the calculation method of the complete public key is: The second communication party generates a random number D2∈[1, n-2] as its own sub-private key, and calculates the partial public key P2=D2[*]G based on the sub-private key D2, where G is the base point of the elliptic curve E of the SM2 algorithm shared by both communication parties, n is the order of the base point, and [*] represents the point multiplication operation on the elliptic curve E; The first communication party generates a random number D1∈[1, n-2] as its own sub-private key, and calculates the complete public key P=D1[*](P2+G)+P2 based on the sub-private key D1 and the received partial public key P2; If P=O, a random number is regenerated, otherwise P is published as a complete public key, where O is the point at infinity of the elliptic curve E; The collaborative decryption stage includes the following steps: The first communication party extracts the first part of the ciphertext from the obtained ciphertext, and sends the first part of the ciphertext to the second communication party, specifically: the first communication party extracts the first part of the ciphertext C1 from the ciphertext C=C1||C3||C2, and converts the data type of C1 into a point on the elliptic curve E, and determines whether C1 is a non-infinity point. If so, C1 is sent to the second communication party, wherein the types of C1, C3, and C2 are bit strings; The second communication party partially decrypts the first part of the ciphertext according to its own sub-private key to obtain a partial ciphertext, and sends the partial ciphertext to the first communication party. The calculation formula for the partial ciphertext obtained by the second communication party is: T=D2[*]C1; The first communication party completely decrypts the ciphertext according to its own sub-private key and the received partial ciphertext, obtains the complete plaintext and outputs it. The specific process is as follows: The first communication party calculates D1[*]C1+(1+D1)[*]T=(x2, y2), and converts the coordinates x2, y2 into a bit string; The first communication party calculates t=KDF(x2||y2, klen), and if t is an all-zero bit string, an error is reported and the process exits, wherein KDF() represents a predetermined key derivation function, and klen represents the length of the key data to be obtained; If t≠0, the first communication party takes out the second part of the ciphertext C2 from the ciphertext C=C1||C3||C2 and calculates the complete plaintext M”=C2⊕t; The first communicating party calculates u=H(x2||M”||y2), extracts the third part of the ciphertext C3 from the ciphertext C=C1||C3||C2, and if u≠C3, reports an error and exits, otherwise outputs the complete plaintext M”.

3. A two-party collaborative signature system based on the SM2 algorithm, comprising a first communication party and a second communication party, wherein the first communication party and the second communication party are in communication connection, and the two-party collaborative signature system is configured to execute the two-party collaborative signature method based on the SM2 algorithm as described in claim 1.

4. A two-party collaborative decryption system based on the SM2 algorithm, comprising a first communication party and a second communication party, wherein the first communication party and the second communication party are in communication connection, and the two-party collaborative decryption system is configured to execute the two-party collaborative decryption method based on the SM2 algorithm as described in claim 2.

Images