A three-party collaborative signature and decryption method and system based on an SM2 algorithm
By employing a three-party collaborative signing and decryption method, secure distributed storage and efficient signature generation of SM2 algorithm private keys are achieved, solving the problems of easy loss of private keys and high computational and communication overhead. This method is suitable for distributed and cloud computing environments.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING WATCH DATA SYSTEM CO LTD
- Filing Date
- 2021-08-27
- Publication Date
- 2026-06-02
AI Technical Summary
The existing SM2 algorithm suffers from problems such as easy loss of private keys, centralized signing rights, high computational and communication overhead, and low signature generation efficiency in distributed environments.
A three-party collaborative signature and decryption method is adopted, in which the three parties generate sub-private keys, calculate a portion of the public key, and generate the complete public key and signature or decryption plaintext through multiple rounds of information transmission, ensuring that the private key is stored in a distributed manner and reducing the amount of computation and communication.
It improves private key security, is suitable for distributed environments, reduces the risk of centralized signature rights, reduces computational and communication overhead, and is suitable for low-latency, high-interaction cloud computing environments.
Smart Images
Figure CN113849832B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of cryptographic application technology, specifically relating to a three-party collaborative signature and decryption method and system based on the SM2 algorithm. Background Technology
[0002] The SM2 algorithm, released by the State Cryptography Administration, is a public-key cryptography algorithm based on elliptic curves. It is a crucial component of my country's commercial cryptographic algorithm standards and plays a vital security role in applications such as e-commerce, e-government, and identity authentication. In public-key cryptography, ensuring the security of the private key is paramount. Typically, a user's private key needs to be securely generated, stored, and used in dedicated hardware. However, with the development of the internet, the application of the SM2 algorithm has become more widespread. Many systems using the SM2 algorithm lack hardware cryptographic modules such as cryptographic chips or secure elements, relying instead on software cryptographic modules. The private key is stored on the user's terminal. Although the private key can be protected through encryption and PIN codes, it remains vulnerable to being stolen by attackers.
[0003] Typically, the SM2 algorithm's signature private key is held solely by the user, which fails to meet the security requirements of current distributed environments. To avoid centralized signing rights and reduce the risk of private key loss, the private key can be divided into multiple sub-private keys, stored on different terminals or servers. When a signature is needed, all parties collaborate to generate it.
[0004] Currently, there are some two-party signature or decryption schemes based on the SM2 algorithm, but there are very few three-party signature or decryption schemes, and they suffer from problems such as high computational and communication overhead and low efficiency in signature or decryption generation. Summary of the Invention
[0005] To address the problems existing in the prior art, the present invention aims to provide a three-party collaborative signature and decryption method and system based on the SM2 algorithm. This method and system can reduce the risk of private key loss, can be used in application scenarios that avoid concentration of signature rights, and can solve or at least partially solve the problems of large computational load, large communication data volume, and low signature generation efficiency in the prior art.
[0006] To achieve the above objectives, in a first aspect, the present invention provides a three-party collaborative signature method based on the SM2 algorithm, comprising a public key generation stage and a collaborative signature stage, wherein the public key generation stage includes the following steps:
[0007] The third communication party generates its own sub-private key, calculates the third part of the public key based on its own sub-private key, and sends the third part of the public key to the second communication party;
[0008] The second communicating party generates its own sub-private key, calculates the second part of the public key based on its own sub-private key and the received third part of the public key, and sends the second part of the public key to the first communicating party;
[0009] The first communicating party generates its own sub-private key, calculates the complete public key based on its own sub-private key and the received second part of the public key, and publishes it.
[0010] The collaborative signature phase includes the following steps:
[0011] The first communicating party calculates the message digest of the message to be signed, generates a first partial signature, and sends the message digest and the first partial signature to the second communicating party;
[0012] The second communicating party calculates the second signature based on its private key and the first signature, and sends the message digest and the second signature to the third communicating party.
[0013] The third communicating party calculates the third signature based on its own sub-private key, the received second signature, and the message digest, and sends the third signature to the second communicating party.
[0014] The second communicating party calculates the fourth signature based on its own sub-private key and the received third signature, and sends the fourth signature to the first communicating party;
[0015] The first communicating party generates and outputs a complete signature based on its own sub-private key and the fourth part of the signature.
[0016] Furthermore, in the three-party collaborative signature method based on the SM2 algorithm described above, the specific calculation method for the complete public key during the public key generation stage is as follows:
[0017] The third party generates a random number d3 ∈ [1, n-1], which serves as its own sub-private key. Based on the sub-private key d3, it calculates the third part of the public key P3 = d3. -1 [*]G, and send P3 to the second communication party, where G is the base point of the SM2 algorithm elliptic curve E shared by the three communication parties, n is the order of the base point, and [*] represents the dot product operation on the elliptic curve E;
[0018] The second communicating party generates a random number d2 ∈ [1, n-1], which serves as its own sub-private key. Based on the sub-private key d2 and the received third part of the public key P3, it calculates the second part of the public key P2 = d2. -1 [*]P3, and send P2 to the first communicating party;
[0019] The first communicating party generates a random number d1 ∈ [1, n-1], which serves as its own sub-private key. Based on the sub-private key d1 and the received second part of the public key P2, it calculates the complete public key P = d1. -1 [*]P2-G;
[0020] If P = O, the first communicating party regenerates a random number; otherwise, P is published as the complete public key, where O is the point at infinity of the elliptic curve E.
[0021] Furthermore, in the three-party collaborative signature method based on the SM2 algorithm described above, the specific process of generating a complete signature in the collaborative signature stage is as follows:
[0022] For the message M to be signed, the first communicating party concatenates the corresponding Z value in the SM2 algorithm with the message M to be signed into M', that is, M' = Z||M, and then calculates the message digest e = H(M'), where Z represents the common identity identifier of the first communicating party, the second communicating party and the third communicating party, and H() represents the predetermined cryptographic hash function;
[0023] The first communicating party generates a random number k1∈[1,n-1], calculates the first part of the signature Q1=k1[*]G based on k1, and sends the message digest e and the first part of the signature Q1 to the second communicating party;
[0024] The second communicating party generates a random number k2∈[1,n-1], and calculates the second part of the signature Q2=d2 based on k2 and the received first part of the signature Q1. -1 [*]Q1+k2[*]G, and send the message digest e and the second part of the signature Q2 to the third party;
[0025] The third party generates a random number k3 ∈ [1, n-1], and calculates the intermediate signature Q3 = d3 based on k3 and the received second part signature Q2. -1 [*]Q2+k3[*]G=(x1,y1), and calculate the signature component r=x1+emod n. If r=0, the third communication party regenerates a random number, where mod is the modulo operation;
[0026] If r≠0, the third communicating party calculates the third part of the signature s3 = d3(k3+r)mod n, and sends the signature component r and the third part of the signature s3 to the second communicating party;
[0027] The second communicating party calculates the fourth signature s2 = d2(k2+s3)mod n based on the received third signature s3, and sends the signature component r and the fourth signature s2 to the first communicating party;
[0028] The first communicating party calculates the signature component s = d1(k1+s2)-r mod n based on the sub-private key d1, the received signature component r, and the fourth part of the signature s2. If s = 0 or s = nr, the signature process is restarted; otherwise, (r, s) is output as the complete signature.
[0029] Furthermore, in the three-party collaborative signature method based on the SM2 algorithm described above, the identities of the first, second, and third communicating parties can be interchanged.
[0030] Secondly, the present invention provides a three-party collaborative decryption method based on the SM2 algorithm, including a public key generation stage and a collaborative decryption stage, wherein the public key generation stage includes the following steps:
[0031] The third communication party generates its own sub-private key, calculates the third part of the public key based on its own sub-private key, and sends the third part of the public key to the second communication party;
[0032] The second communicating party generates its own sub-private key, calculates the second part of the public key based on its own sub-private key and the received third part of the public key, and sends the second part of the public key to the first communicating party;
[0033] The first communicating party generates its own sub-private key, calculates the complete public key based on its own sub-private key and the received second part of the public key, and publishes it.
[0034] The collaborative decryption phase includes the following steps:
[0035] The first communicating party extracts the first part of the ciphertext from the obtained ciphertext, partially decrypts the first part of the ciphertext using its own sub-private key to obtain the first collaborative ciphertext, and sends the first collaborative ciphertext to the second communicating party.
[0036] The second communicating party partially decrypts the first collaborative ciphertext using its own sub-private key to obtain the second collaborative ciphertext, and then sends the second collaborative ciphertext to the third communicating party;
[0037] The third communicating party partially decrypts the second collaborative ciphertext using its own sub-private key to obtain the third collaborative ciphertext, and then sends the third collaborative ciphertext to the first communicating party;
[0038] The first communicating party decrypts the ciphertext completely using its own sub-private key and the received third collaborative ciphertext to obtain the complete plaintext, which is then output.
[0039] Furthermore, in the three-party collaborative decryption method based on the SM2 algorithm described above, the specific calculation method for the complete public key during the public key generation stage is as follows:
[0040] The third party generates a random number d3 ∈ [1, n-1], which serves as its own sub-private key. Based on the sub-private key d3, it calculates the third part of the public key P3 = d3. -1 [*]G, and send P3 to the second communication party, where G is the base point of the SM2 algorithm elliptic curve E shared by the three communication parties, n is the order of the base point, and [*] represents the dot product operation on the elliptic curve E;
[0041] The second communicating party generates a random number d2 ∈ [1, n-1], which serves as its own sub-private key. Based on the sub-private key d2 and the received third part of the public key P3, it calculates the second part of the public key P2 = d2. -1 [*]P3, and send P2 to the first communicating party;
[0042] The first communicating party generates a random number d1 ∈ [1, n-1], which serves as its own sub-private key. Based on the sub-private key d1 and the received second part of the public key P2, it calculates the complete public key P = d1. -1 [*]P2-G;
[0043] If P = O, the first communicating party regenerates a random number; otherwise, P is published as the complete public key, where O is the point at infinity of the elliptic curve E.
[0044] Furthermore, in the three-party collaborative decryption method based on the SM2 algorithm described above, the specific process of generating complete plaintext during the collaborative decryption phase is as follows:
[0045] The first communicating party extracts the first part of the ciphertext C1 from the ciphertext C = C1||C3||C2, converts the data type of C1 to a point on the elliptic curve E, and determines whether C1 is a non-infinity point. If it is, it calculates the first collaborative ciphertext T1 = d1. -1 [*]C1, and send the first collaborative ciphertext T1 to the second communicating party, wherein C1, C3, and C2 are bit strings;
[0046] The second communicating party decrypts the first collaborative ciphertext T1 using its own sub-private key d2 to obtain the second collaborative ciphertext T2. The decryption formula is: T2 = d2 -1 [*]T1, and send T2 to the third communication party;
[0047] The third party decrypts the second collaborative ciphertext T2 using its own sub-private key d3 to obtain the third collaborative ciphertext T3. The decryption formula is: T3 = d3 -1 [*]T2, and send T3 to the first communicating party;
[0048] The first communicating party calculates T = T3 - C1 = (x2, y2) and converts the coordinates x2, y2 into a bit string;
[0049] The first communicating party calculates t = KDF(x2||y2, klen). If t is a string of all zero bits, an error is reported and the process exits. Here, KDF() represents the predefined key derivation function, and klen represents the length of the key data to be obtained.
[0050] If t≠0, then the first communicator extracts the second part of the ciphertext C2 from the ciphertext C=C1||C3||C2 and calculates M”=C2⊕t;
[0051] The first communicating party calculates u = H(x2||M”||y2), extracts the third part of the ciphertext C3 from the ciphertext C = C1||C3||C2. If u ≠ C3, an error is reported and the process exits; otherwise, the complete plaintext M is output.
[0052] Furthermore, in the three-party collaborative decryption method based on the SM2 algorithm described above, the identities of the first, second, and third communicating parties can be interchanged.
[0053] Thirdly, the present invention provides a three-party collaborative signature system based on the SM2 algorithm, comprising a first communicating party, a second communicating party, and a third communicating party, wherein the first communicating party, the second communicating party, and the third communicating party are interconnected, and the three-party collaborative signature system is configured to execute the three-party collaborative signature method based on the SM2 algorithm described in the first aspect.
[0054] Fourthly, the present invention provides a three-party collaborative decryption system based on the SM2 algorithm, comprising a first communication party, a second communication party, and a third communication party, wherein the first communication party, the second communication party, and the third communication party are interconnected, and the three-party collaborative decryption system is configured to execute the three-party collaborative decryption method based on the SM2 algorithm described in the second aspect.
[0055] The three-party collaborative signature and decryption method and system based on the SM2 algorithm provided by this invention can independently generate and store partial private keys among the three communicating parties, and then perform three-party collaborative signature and decryption. Compared with the prior art, the beneficial effects of this invention are as follows:
[0056] 1. The complete private key of the SM2 algorithm is never seen throughout the entire process, which improves the security of the SM2 algorithm private key;
[0057] 2. The private key is split into three parts, which can be stored in different terminals, meeting the security requirements of distributed environments and suitable for application scenarios involving many mobile smart terminals.
[0058] 3. The signing or decryption process requires less computation from both parties and less data is transmitted during communication, making it more suitable for cloud computing environments that require low latency and high interactivity;
[0059] 4. It can reuse the basic operation modules of the SM2 algorithm without adding new operation modules, which is simple to implement and has low deployment cost;
[0060] 5. It can be used in scenarios where three parties collaborate to generate transaction signatures, reducing the potential risks of concentrated signature rights. Attached Figure Description
[0061] Figure 1 The flowchart below shows the three-party collaborative signature method based on the SM2 algorithm provided in a specific embodiment of the present invention.
[0062] Figure 2 This is the implementation mechanism for the public key generation stage provided in a specific embodiment of the present invention;
[0063] Figure 3 This is the implementation mechanism for the collaborative signature stage provided in a specific embodiment of the present invention;
[0064] Figure 4 The flowchart below shows the three-party collaborative decryption method based on the SM2 algorithm provided in a specific embodiment of the present invention.
[0065] Figure 5 This is the implementation mechanism for the collaborative decryption stage provided in a specific embodiment of the present invention. Detailed Implementation
[0066] To make the technical problems solved by the present invention, the technical solutions adopted, and the technical effects achieved clearer, the technical solutions of the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0067] To facilitate understanding, the basic concepts and terms involved in the embodiments of this invention will be briefly explained first.
[0068] The three parties involved in the communication share the elliptic curve parameters E(F) of the SM2 algorithm. q The elliptic curve E is defined in the finite field F. qThe elliptic curve E is defined as follows: G is the base point of the elliptic curve, the order of the base point is n, and O is the point at infinity of the elliptic curve. In this invention, [*] represents a dot product operation on E, k[*]G represents a point k times G; mod n represents a modulo n operation; for dot addition operations on elliptic curves and numerical addition operations, the plus sign + is used: if it is the addition of elliptic curve points, + represents dot addition; if it is the addition of numerical values, + represents numerical addition; H() represents a predetermined cryptographic hash function, KDF() represents a predetermined key derivation function, klen represents the length of the key data to be obtained, and || represents concatenation.
[0069] For ease of description, the communication participants are referred to as the first communication party, the second communication party, and the third communication party, respectively. The communication participants are generally certain terminals or servers, and the identities of the communication participants can be interchanged.
[0070] Figure 1 The flowchart of the three-party collaborative signature method based on the SM2 algorithm provided by the present invention is shown. The method mainly includes a public key generation stage and a collaborative signature stage.
[0071] Among them, reference Figure 2 The public key generation phase mainly includes the following steps:
[0072] Step S11: The third communication party generates its own sub-private key, calculates the third part of the public key based on its own sub-private key, and sends the third part of the public key to the second communication party.
[0073] In one optional implementation, step S11 specifically involves:
[0074] The third communicating party generates a random number d3 as its own sub-private key, where d3 is any integer in the range [1, n-1]. Then, it calculates the third part of the public key P3 based on the sub-private key d3 and sends it to the second communicating party. The formula for calculating the partial public key P3 is as follows:
[0075] P3=d3 -1 [*]G
[0076] Where G is the base point of the elliptic curve E shared by the three parties in the communication SM2 algorithm, n is the order of the base point, and [*] represents the dot product operation on the elliptic curve E.
[0077] Step S12: The second communicating party generates its own sub-private key, calculates the second part of the public key based on its own sub-private key and the received third part of the public key, and sends the second part of the public key to the first communicating party.
[0078] In one optional implementation, step S12 specifically involves:
[0079] The second communicating party generates a random number d2 as its own sub-private key, where d2 is any integer in the range [1, n-1]. Then, based on the sub-private key d2 and the received third part of the public key P3, it calculates the second part of the public key P2 and sends it to the first communicating party. The formula for calculating the second part of the public key P2 is:
[0080] P2=d2 -1 [*]P3.
[0081] Step S13: The first communicating party generates its own sub-private key, calculates the complete public key based on its own sub-private key and the received second part of the public key, and publishes it.
[0082] In one optional implementation, step S13 specifically involves:
[0083] The first communicating party generates a random number d1 as its own sub-private key, where d1 is any integer in the range [1, n-1]. Based on the sub-private key d1 and the received second part of the public key P2, the first party calculates the complete public key P. The formula for calculating P is:
[0084] P = d1 -1 [*]P2-G
[0085] If P = O, the first communicating party needs to regenerate a random number; otherwise, P will be published as the complete public key, where O is the point at infinity of the elliptic curve E.
[0086] refer to Figure 3 The collaborative signature phase mainly includes the following steps:
[0087] Step S14: The first communicating party calculates the message digest of the message to be signed, generates a first partial signature, and sends the message digest and the first partial signature to the second communicating party.
[0088] In one optional implementation, step S14 specifically involves:
[0089] For the message M to be signed, the first communicating party concatenates the corresponding Z value in the SM2 algorithm with the message M to be signed into M', that is, M' = Z||M, and then calculates the message digest e = H(M'), where Z represents the common identity identifier of the first communicating party, the second communicating party and the third communicating party, and H() represents the predetermined cryptographic hash function;
[0090] The first communicating party generates a random number k1∈[1,n-1], calculates the first part of the signature Q1=k1[*]G based on k1, and sends the message digest e and the first part of the signature Q1 to the second communicating party.
[0091] Step S15: The second communicating party calculates the second part of the signature based on its private key and the first part of the signature, and sends the message digest and the second part of the signature to the third communicating party.
[0092] In one optional implementation, step S15 specifically involves:
[0093] The second communicating party generates a random number k2∈[1,n-1], and calculates the second part of the signature Q2=d2 based on k2 and the received first part of the signature Q1. -1 [*]Q1+k2[*]G, and send the message digest e and the second part of the signature Q2 to the third communicating party.
[0094] Step S16: The third communicating party calculates the third signature based on its own sub-private key, the received second signature, and the message digest, and sends the third signature to the second communicating party.
[0095] In one optional implementation, step S16 specifically involves:
[0096] The third party generates a random number k3 ∈ [1, n-1], and calculates the intermediate signature Q3 = d3 based on k3 and the received second part signature Q2. -1 [*]Q2+k3[*]G=(x1,y1), and calculate the signature component r=x1+e mod n. If r=0, the third communication party regenerates a random number, where mod is the modulo operation;
[0097] If r≠0, the third communicating party calculates the third part of the signature s3 = d3(k3+r)mod n, and sends the signature component r and the third part of the signature s3 to the second communicating party.
[0098] Step S17: The second communicating party calculates the fourth signature based on its own sub-private key and the received third signature, and sends the fourth signature to the first communicating party.
[0099] In one optional implementation, step S17 specifically involves:
[0100] The second communicating party calculates the fourth signature s2 = d2(k2+s3)mod n based on the received third signature s3, and sends the signature component r and the fourth signature s2 to the first communicating party.
[0101] Step S18: The first communicating party generates and outputs a complete signature based on its own sub-private key and the fourth part of the signature.
[0102] In one optional implementation, step S18 specifically involves:
[0103] The first communicating party calculates the signature component s = d1(k1+s2)-r mod n based on the sub-private key d1, the received signature component r, and the fourth part of the signature s2. If s = 0 or s = nr, the signature process is restarted; otherwise, (r, s) is output as the complete signature.
[0104] The subsequent signature verification process is consistent with the signature verification process in the SM2 algorithm.
[0105] In this embodiment, during the public key generation phase, each of the three communicating parties independently generates its own sub-private key. Through two rounds of information transmission, one party is able to calculate and publish the public key. The complete SM2 private key never appears throughout the entire process, thus improving the security of the SM2 private key. During the collaborative signature phase, the three communicating parties use their respective sub-private keys to generate a complete signature through four rounds of information transmission. Any third party that obtains the signature can verify the signature using the published public key information and the SM2 algorithm.
[0106] In the public key generation phase, only one piece of data needs to be transmitted in each round, and in the collaborative signature phase, only two pieces of data need to be transmitted in each round. The amount of communication data is small and the calculation method is simple, which greatly reduces the computational overhead.
[0107] Figure 4 The flowchart of the three-party collaborative decryption method based on the SM2 algorithm provided by the present invention is shown. The method mainly includes a public key generation stage and a collaborative decryption stage.
[0108] The public key generation stage is the same as steps S11-S13 in the public key generation stage of the three-party collaborative signature method based on the SM2 algorithm, and will not be described in detail here.
[0109] refer to Figure 5 The collaborative decryption phase mainly includes the following steps:
[0110] Step S24: The first communicating party extracts the first part of the ciphertext from the obtained ciphertext, partially decrypts the first part of the ciphertext according to its own sub-private key to obtain the first collaborative ciphertext, and sends the first collaborative ciphertext to the second communicating party.
[0111] In one optional implementation, step S24 specifically involves:
[0112] The first communicating party extracts the first part of the ciphertext C1 from the ciphertext C = C1||C3||C2, converts the data type of C1 to a point on the elliptic curve E, and determines whether C1 is a non-infinity point. If it is, it calculates the first collaborative ciphertext T1 = d1. -1 [*]C1, and send the first collaborative ciphertext T1 to the second communicating party, wherein C1, C3, and C2 are bit strings.
[0113] Step S25: The second communicating party partially decrypts the first collaborative ciphertext using its own sub-private key to obtain the second collaborative ciphertext, and sends the second collaborative ciphertext to the third communicating party.
[0114] In one optional implementation, step S25 specifically involves:
[0115] The second communicating party decrypts the first collaborative ciphertext T1 using its own sub-private key d2 to obtain the second collaborative ciphertext T2. The decryption formula is: T2 = d2 -1 [*]T1, and send T2 to the third communication party.
[0116] Step S26: The third communication party partially decrypts the second collaborative ciphertext using its own sub-private key to obtain the third collaborative ciphertext, and sends the third collaborative ciphertext to the first communication party.
[0117] In one optional implementation, step S26 specifically involves:
[0118] The third party decrypts the second collaborative ciphertext T2 using its own sub-private key d3 to obtain the third collaborative ciphertext T3. The decryption formula is: T3 = d3 -1 [*]T2, and send T3 to the first communicating party.
[0119] Step S27: The first communicating party decrypts the ciphertext completely using its own sub-private key and the received third collaborative ciphertext to obtain the complete plaintext and output it.
[0120] In one optional implementation, step S27 specifically involves:
[0121] The first communicating party calculates T = T3 - C1 = (x2, y2) and converts the coordinates x2, y2 into a bit string;
[0122] The first communicating party calculates t = KDF(x2||y2, klen). If t is a string of all zero bits, an error is reported and the process exits. Here, KDF() represents the predefined key derivation function, and klen represents the length of the key data to be obtained.
[0123] If t≠0, then the first communicator extracts the second part of the ciphertext C2 from the ciphertext C=C1||C3||C2 and calculates M”=C2⊕t;
[0124] The first communicating party calculates u = H(x2||M”||y2), extracts the third part of the ciphertext C3 from the ciphertext C = C1||C3||C2. If u ≠ C3, an error is reported and the process exits; otherwise, the complete plaintext M is output.
[0125] In this embodiment, the three parties to the communication use their respective sub-private keys and, through three rounds of information transmission, are able to decrypt any legitimate ciphertext encrypted by a third party using publicly available public key information and the SM2 algorithm. Moreover, each round only requires the transmission of one piece of data, resulting in less computation and making it suitable for cloud computing environments that require low latency and high interactivity.
[0126] Based on the above-described three-party collaborative signature method based on the SM2 algorithm, this invention provides a three-party collaborative signature system based on the SM2 algorithm. The system includes a first communication party, a second communication party, and a third communication party, which are interconnected. The three-party collaborative signature system is configured to execute the three-party collaborative signature method based on the SM2 algorithm as described above.
[0127] Based on the above-mentioned three-party collaborative decryption method based on the SM2 algorithm, the present invention provides a three-party collaborative decryption system based on the SM2 algorithm. The system includes a first communication party, a second communication party, and a third communication party. The first communication party, the second communication party, and the third communication party are interconnected. The three-party collaborative decryption system is configured to execute the three-party collaborative decryption method based on the SM2 algorithm as described above.
[0128] This invention provides a three-party collaborative signature and decryption method and system based on the SM2 algorithm. It also presents technical solutions for collaborative signature and decryption. In the public key generation phase, each of the three communicating parties independently generates its own sub-private key. Through two rounds of information transmission, one party can calculate and publish the public key. In the collaborative signature phase, the three parties use their respective sub-private keys and, through four rounds of information transmission, one party generates a complete signature. Any third party that obtains the signature can verify it using the published public key information and the SM2 algorithm. The verification process is consistent with the signature verification process in the SM2 algorithm. In the collaborative decryption phase, the three parties use their respective sub-private keys and, through three rounds of information transmission, can decrypt any legitimate ciphertext encrypted by any third party using the published public key information and the SM2 algorithm. The beneficial effects achieved through these methods are:
[0129] The complete private key of the SM2 algorithm never appears throughout the entire process, which improves the security of the SM2 algorithm private key; the private key is split into three parts, which can be stored in different terminals, meeting the security requirements of distributed environments and suitable for application scenarios involving many mobile smart terminals; the three parties need to perform fewer calculations during the signing or decryption operation, and less data is transmitted during communication, making it suitable for cloud computing environments that require low latency and high interactivity; the basic operation module of the SM2 algorithm can be reused, without the need to add new operation modules, making it simple to implement and low in deployment cost.
[0130] Those skilled in the art should understand that this invention is not limited to the embodiments described in the specific implementation details. The above detailed description is merely for illustrative purposes and is not intended to limit the invention. Other implementation methods derived by those skilled in the art based on the technical solutions of this invention also fall within the scope of this invention's technical innovation. The scope of protection of this invention is defined by the claims and their equivalents.
Claims
1. A three-party collaborative signature method based on the SM2 algorithm, comprising a public key generation stage and a collaborative signature stage, wherein the public key generation stage includes the following steps: The third communication party generates its own sub-private key, calculates the third part of the public key based on its own sub-private key, and sends the third part of the public key to the second communication party; The second communicating party generates its own sub-private key, calculates the second part of the public key based on its own sub-private key and the received third part of the public key, and sends the second part of the public key to the first communicating party; The first communicating party generates its own sub-private key, calculates the complete public key based on its own sub-private key and the received second part of the public key, and publishes it. The collaborative signature phase includes the following steps: The first communicating party calculates the message digest of the message to be signed, generates a first partial signature, and sends the message digest and the first partial signature to the second communicating party; The second communicating party calculates the second part of the signature based on its own sub-private key and the first part of the signature, and sends the message digest and the second part of the signature to the third communicating party; The third communicating party calculates the third signature based on its own sub-private key, the received second signature, and the message digest, and sends the third signature to the second communicating party. The second communicating party calculates the fourth signature based on its own sub-private key and the received third signature, and sends the fourth signature to the first communicating party; The first communicating party generates and outputs a complete signature based on its own sub-private key and the fourth part of the signature; The specific method for calculating the complete public key during the public key generation phase is as follows: The third party generates a random number d3 ∈ [1, n-1], which serves as its own sub-private key. Based on the sub-private key d3, it calculates the third part of the public key P3 = d3. -1 [*]G, and send P3 to the second communication party, where G is the base point of the SM2 algorithm elliptic curve E shared by the three communication parties, n is the order of the base point, and [*] represents the dot product operation on the elliptic curve E; The second communicating party generates a random number d2 ∈ [1, n-1], which serves as its own sub-private key. Based on the sub-private key d2 and the received third part of the public key P3, it calculates the second part of the public key P2 = d2. -1 [*]P3, and send P2 to the first communicating party; The first communicating party generates a random number d1 ∈ [1, n-1], which serves as its own sub-private key. Based on the sub-private key d1 and the received second part of the public key P2, it calculates the complete public key P = d1. -1 [*]P2-G; If P=O, the first communicating party regenerates a random number; otherwise, P is published as the complete public key, where O is the point at infinity of the elliptic curve E. The specific process for generating a complete signature in the collaborative signature phase is as follows: For the message M to be signed, the first communicating party concatenates the corresponding Z value in the SM2 algorithm with the message M to be signed into M', that is, M'=Z||M, and then calculates the message digest e=H(M'), where Z represents the common identity identifier of the first communicating party, the second communicating party and the third communicating party, and H() represents the predetermined cryptographic hash function; The first communicating party generates a random number k1∈[1,n-1], calculates the first part of the signature Q1=k1[*]G based on k1, and sends the message digest e and the first part of the signature Q1 to the second communicating party; The second communicating party generates a random number k2∈[1,n-1], and calculates the second part of the signature Q2=d2 based on k2 and the received first part of the signature Q1. -1 [*]Q1+k2[*]G, and send the message digest e and the second part of the signature Q2 to the third party; The third party generates a random number k3 ∈ [1, n-1], and calculates the intermediate signature Q3 = d3 based on k3 and the received second part signature Q2. -1 [*]Q2+k3[*]G=(x1, y1), and calculate the signature component r=x1+e mod n. If r=0, the third communication party regenerates a random number, where mod is the modulo operation. If r≠0, the third communicating party calculates the third part of the signature s3=d3(k3+r) mod n, and sends the signature component r and the third part of the signature s3 to the second communicating party; The second communicating party calculates the fourth signature s2 = d2(k2+s3) mod n based on the received third signature s3, and sends the signature component r and the fourth signature s2 to the first communicating party; The first communicating party calculates the signature component s = d1(k1+s2)-r mod n based on the sub-private key d1, the received signature component r, and the fourth part of the signature s2. If s=0 or s=nr, the signature process is restarted; otherwise, (r, s) is output as the complete signature.
2. The three-party collaborative signature method based on the SM2 algorithm according to claim 1, characterized in that, The identities of the first, second, and third communicating parties can be interchanged.
3. A three-party collaborative decryption method based on the SM2 algorithm, comprising a public key generation stage and a collaborative decryption stage, wherein the public key generation stage includes the following steps: The third communication party generates its own sub-private key, calculates the third part of the public key based on its own sub-private key, and sends the third part of the public key to the second communication party; The second communicating party generates its own sub-private key, calculates the second part of the public key based on its own sub-private key and the received third part of the public key, and sends the second part of the public key to the first communicating party; The first communicating party generates its own sub-private key, calculates the complete public key based on its own sub-private key and the received second part of the public key, and publishes it. The collaborative decryption phase includes the following steps: The first communicating party extracts the first part of the ciphertext from the obtained ciphertext, partially decrypts the first part of the ciphertext using its own sub-private key to obtain the first collaborative ciphertext, and sends the first collaborative ciphertext to the second communicating party. The second communicating party partially decrypts the first collaborative ciphertext using its own sub-private key to obtain the second collaborative ciphertext, and then sends the second collaborative ciphertext to the third communicating party; The third communicating party partially decrypts the second collaborative ciphertext using its own sub-private key to obtain the third collaborative ciphertext, and then sends the third collaborative ciphertext to the first communicating party; The first communicating party decrypts the ciphertext completely using its own sub-private key and the received third collaborative ciphertext to obtain the complete plaintext and output it. The specific method for calculating the complete public key during the public key generation phase is as follows: The third party generates a random number d3 ∈ [1, n-1], which serves as its own sub-private key. Based on the sub-private key d3, it calculates the third part of the public key P3 = d3. -1 [*]G, and send P3 to the second communication party, where G is the base point of the SM2 algorithm elliptic curve E shared by the three communication parties, n is the order of the base point, and [*] represents the dot product operation on the elliptic curve E; The second communicating party generates a random number d2 ∈ [1, n-1], which serves as its own sub-private key. Based on the sub-private key d2 and the received third part of the public key P3, it calculates the second part of the public key P2 = d2. -1 [*]P3, and send P2 to the first communicating party; The first communicating party generates a random number d1 ∈ [1, n-1], which serves as its own sub-private key. Based on the sub-private key d1 and the received second part of the public key P2, it calculates the complete public key P = d1. -1 [*]P2-G; If P=O, the first communicating party regenerates a random number; otherwise, P is published as the complete public key, where O is the point at infinity of the elliptic curve E. The specific process for generating complete plaintext during the collaborative decryption phase is as follows: The first communicating party extracts the first part of the ciphertext C1 from the ciphertext C=C1||C3||C2, converts the data type of C1 to a point on the elliptic curve E, and determines whether C1 is a non-infinity point. If it is, it calculates the first collaborative ciphertext T1=d1. -1 [*]C1, and send the first collaborative ciphertext T1 to the second communicating party, wherein C1, C3, and C2 are bit strings; The second communicating party decrypts the first collaborative ciphertext T1 using its own sub-private key d2 to obtain the second collaborative ciphertext T2. The decryption formula is: T2 = d2 -1 [*]T1, and send T2 to the third communication party; The third party decrypts the second collaborative ciphertext T2 using its own sub-private key d3 to obtain the third collaborative ciphertext T3. The decryption formula is: T3 = d3 -1 [*]T2, and send T3 to the first communicating party; The first communicating party calculates T=T3-C1=(x2, y2) and converts the coordinates x2, y2 into a bit string; The first communicating party calculates t=KDF(x2||y2,klen). If t is a string of all zero bits, an error is reported and the process exits. Here, KDF() represents the predefined key derivation function, and klen represents the length of the key data to be obtained. If t≠0, then the first communicator extracts the second part of the ciphertext C2 from the ciphertext C=C1||C3||C2 and calculates M''=C2⊕t; The first communicating party calculates u=H(x2||M''||y2), extracts the third part of the ciphertext C3 from the ciphertext C=C1||C3||C2. If u≠C3, an error is reported and the process exits; otherwise, the complete plaintext M'' is output.
4. The three-party collaborative decryption method based on the SM2 algorithm according to claim 3, characterized in that, The identities of the first, second, and third communicating parties can be interchanged.
5. A three-party collaborative signature system based on the SM2 algorithm, comprising a first communication party, a second communication party, and a third communication party, wherein the first communication party, the second communication party, and the third communication party are interconnected, and the three-party collaborative signature system is configured to execute the three-party collaborative signature method based on the SM2 algorithm as described in claim 1 or 2.
6. A three-party collaborative decryption system based on the SM2 algorithm, comprising a first communication party, a second communication party, and a third communication party, wherein the first communication party, the second communication party, and the third communication party are interconnected, and the three-party collaborative decryption system is configured to execute the three-party collaborative decryption method based on the SM2 algorithm as described in claim 3 or 4.