Computational method and system for issuing implicit digital certificates to two-party collaborative user components

Abstract

The present invention discloses a computing method and system for issuing implicit digital certificates to two-party collaborative user components. The user applies for an implicit digital certificate from a certificate issuing component, and the certificate issuing component generates a user private key contribution value while issuing the implicit digital certificate. In the process of issuing the implicit digital certificate and generating the user private key contribution value, the certificate issuing component cooperates with the user to distribute the user private key to two user components. In the above process, the user private key does not appear as a whole, and neither party can calculate and obtain the user private key. After the above process is completed, the two user components jointly master the user private key (the user private key portion mastered by each user component is called a sub-private key), and the relationship between the sub-private keys can be directly used in the existing two-party collaborative computing scheme of the elliptic curve cryptographic algorithm. The present invention enables the implicit digital certificate system to seamlessly combine the existing two-party collaborative computing schemes of the elliptic curve cryptographic algorithms such as SM2 and ECDSA.

Description

Technical Field

[0001] The present invention relates to the field of cryptographic applications, and in particular to a two-party collaborative computing solution of an implicit digital certificate system and an elliptic curve cryptographic algorithm. Background Art

[0002] X.509 standard digital certificates based on public key cryptography are widely used in information security. According to the principle of public key cryptography, CA (Certification Authority, referred to as CA, also referred to as "certificate issuing component" in the present invention) and users generate their own public-private key pairs respectively, and CA uses its own private key to perform digital signature operations on the user's digital certificate. X.509 digital certificates contain user identity identification, public key, other digital certificate auxiliary information, and CA's digital signature. The user of the digital certificate has the CA's public key pre-installed. When the digital certificate user receives the user's X.509 digital certificate, the CA public key is used to verify the validity of the digital signature. After the verification is passed, the user's public key can be obtained, and then various public key cryptographic calculation operations (for example, public key encryption, digital signature verification, etc.) can be performed on this basis to realize information security functions. In the X.509 standard digital certificate, the CA's digital signature ensures that the user's digital certificate originates from a trusted CA and will not be maliciously tampered with during transmission; any minor changes to the digital certificate will cause the CA digital signature verification to fail.

[0003] Implicit digital certificates are digital certificates in another standard format different from the X.509 standard. In an implicit digital certificate, there is no digital signature of the CA, and it only contains the user's identity, public key, and other auxiliary information of the digital certificate. Compared with the digital certificate of the X.509 standard, the implicit digital certificate has a smaller data volume and is more suitable for scenarios with limited communication bandwidth resources. Implicit digital certificates use the following special usage process to ensure that the implicit digital certificate comes from a trusted CA and will not be maliciously tampered with during transmission: the digital certificate user does not directly use the public key contained in the implicit digital certificate, but calculates the public key with the CA public key to obtain the user's public key; that is, the user's public key has a certain intrinsic relationship with the CA public key; accordingly, the user's private key also has a certain intrinsic relationship with the CA private key; therefore, if the user can hold the corresponding private key, it means that the user has obtained the "user private key contribution value" from the CA and passed the CA's verification. The user's private key contribution value is calculated by the CA using its own private key and then sent to the user. The specific implicit digital certificate issuance and usage process is described in detail below. Any minor change to a user's implicit digital certificate will cause the user's public and private key pairs to mismatch.

[0004] Implicit digital certificates are applicable to elliptic curve cryptography, and the user's public-private key pair is a public-private key pair that meets the requirements of the elliptic curve cryptography. The two-party collaborative computing scheme of the elliptic curve cryptography can effectively improve the security of the elliptic curve cryptography in applications: the user's private key is stored in two independent user components in a split form (the part of the private key data held by each user component is called a sub-private key). Each digital signature operation or decryption operation of the user's private key requires the collaboration of two user components and the participation of two sub-private keys in the calculation; moreover, during the collaborative computing process, each user component cannot obtain any information about the sub-private key held by another user component, nor can it obtain any information about the user's private key as a whole.

[0005] According to the international standard SEC 4: Elliptic Curve Qu-Vanstone Implicit Certificate Scheme (ECQV), various operations of implicit digital certificates are described as follows. We first define the labels used in the present invention as follows:

[0006] 1.G, represents the base point of the elliptic curve;

[0007] 2. [k] G, which represents the k-times point operation of the base point G of the elliptic curve;

[0008] 3. [k] P, which represents the k-times point operation of the elliptic curve point P;

[0009] 4.n, represents the order of the elliptic curve;

[0010] 5.mod n, which means modulo n operation;

[0011] 6.d -1 mod n, which means the inverse element of d mod n, has d×d -1 = 1 mod n;

[0012] 7.+, which indicates integer addition or elliptic curve point addition. When in use, the corresponding operation is selected according to the type of operand;

[0013] 8.×, represents integer multiplication operation;

[0014] 9.Hash(), indicating hash function;

[0015] 10. Cert, represents the user's implicit digital certificate. Cert contains the user identity u, the elliptic curve point coordinates P and other digital certificate auxiliary information m. Cert = Encode(u, P, m), where Encode means encoding in a standard format;

[0016] 11.r, represents the user's private key contribution value.

[0017] The CA's public-private key pair is:

[0018] Private key q;

[0019] Public key Q = [q]G, where [q]G represents the q-fold point of the base point G of the elliptic curve.

[0020] The user's public-private key pair is:

[0021] Private key w;

[0022] Public key W = [w]G, where [w]G represents the w-fold point of the elliptic curve base point G. Note: W is not the public key P contained in the implicit digital certificate.

[0023] The application and issuance of implicit digital certificates are as follows:

[0024] 1. The user generates a random number k between (1, n-1) and calculates R = [k]G;

[0025] 2. The user sends an implicit digital certificate application message to the CA. The application message contains the user identity u and the elliptic curve point coordinates R;

[0026] 3. CA verifies that the user's application message is correct, then generates a random number k' between (1, n-1) and calculates P = R+ [k']G;

[0027] 4. CA generates Cert = Encode(P, u, m) and calculates e = Hash(Cert), where Encode means encoding according to the implicit digital certificate standard format, m is other digital certificate auxiliary information, and Hash() is a hash function;

[0028] 5. CA calculates r = e×k' + q mod n, and then sends Cert and r to the user; r is called the user's private key contribution value;

[0029] 6. The user receives Cert and r, and then calculates e = Hash(Cert) and w = e×k + r mod n as his own private key;

[0030] 7. For the user of implicit digital certificate, when receiving the implicit digital certificate Cert = Encode(P, u,m), calculate e = Hash(Cert), and then calculate W = [e]P + Q as the user's public key, where Q is the CA's public key.

[0031] Following the above steps, we can verify that W = [e]P + Q = [e]R + [e×k']G + [q]G = [e×k]G+ [e×k']G + [q]G = [e×k + e×k' + q]G = [e×k + r]G = [w]G, so the user's public-private key pair relationship is established.

[0032] Implicit digital certificates are applicable to public and private key pairs of various elliptic curve cryptographic algorithms, including the US national standard ECDSA algorithm (see US national standard FIPS 186-4 Digital Signature Standard) and the Chinese national standard SM2 algorithm (see GB / T 32918-2016 Information Security Technology SM2 Elliptic Curve Public Key Cryptography Algorithm). The Hash() function used to calculate e can be the US national standard SHA algorithm (see US national standard FIPS 202 SHA-3Standard) and the Chinese national standard SM3 algorithm (see GB / T 32905-2016 Information Security Technology SM3 Cryptographic Hash Algorithm), or other hash functions.

[0033] For more technical information about implicit digital certificates, please refer to the international standard SEC 4: EllipticCurve Qu-Vanstone Implicit Certificate Scheme (ECQV).

[0034] According to the existing two-party collaborative computing scheme of the elliptic curve cryptography algorithm, the user private key is split into two sub-private keys, which are stored separately by two user components. According to the Chinese invention patent "Signature and decryption method and system based on SM2 algorithm for cloud computing" (patent number ZL201410437599.5), the two sub-private keys of the SM2 algorithm can be recorded as w1 and w2 respectively, and the relationship between them and the private key w is: w1×w2 = (1+w) -1 mod n. Alternatively, according to the paper "Fast Secure Two-Party ECDSA Signing" of the CRYPTO 2017 International Conference, the two sub-private keys of the ECDSA algorithm can be recorded as w1 and w2 respectively, and the relationship between them and the private key w satisfies: w1×w2 = w mod n. The detailed process of the two parties using the two sub-private keys to perform collaborative SM2 algorithm cryptographic calculations and ECDSA algorithm cryptographic calculations can be further referenced to the above patents and papers. Summary of the invention

[0035] In view of this, the present invention provides a computing method and system for issuing implicit digital certificates to two-party collaborative user components. In the process of the certificate issuing component issuing an implicit digital certificate to a user and generating a user private key contribution value, the certificate issuing component cooperates with the user to distribute the user private key to two user components; in the above process, the user private key will not appear as a whole, and any party cannot calculate the user private key, and the relationship between the two sub-private keys meets the requirements of the existing two-party collaborative computing scheme of the elliptic curve cryptography algorithm.

[0036] If the technical solution of the present invention is not adopted, the CA generates a user private key contribution value and sends it to the user; the user calculates his own private key, and then splits the private key that has appeared as a whole into two sub-private keys and sends them to two user components, so that the two user components can perform collaborative elliptic curve cryptographic calculations. Since the user private key will appear as a whole in the above process, attackers have the opportunity to steal the user private key in this process, resulting in reduced system security.

[0037] In order to achieve the above object, the technical solution of the present invention is as follows:

[0038] A computational method for issuing an implicit digital certificate to a two-party collaborative user component, comprising:

[0039] The first user component and the second user component cooperate to generate a random number k and cooperate to calculate R = [k]G;

[0040] The first user component sends R and user identity u to the certificate issuing component;

[0041] The certificate issuing component calculates the implicit digital certificate Cert and the user private key contribution value r, and then sends Cert and r to the first user component;

[0042] The first user component calculates r' according to r, and sends r' to the second user component;

[0043] The first user component calculates its own child private key w1;

[0044] The second user component calculates its own child private key w2.

[0045] A system for issuing implicit digital certificates to two-party collaborative user components, comprising:

[0046] The first user component is used to collaborate with the second user component to generate a random number k and collaboratively calculate R = [k]G, send R and the user identity u to the certificate issuing component, calculate r' based on r, send r' to the second user component, and calculate its own sub-private key w1;

[0047] The second user component is used to collaborate with the second user component to generate a random number k and collaboratively calculate R = [k]G, receive r' sent by the first user component, and calculate its own sub-private key w2;

[0048] The certificate issuing component is used to receive R and user identity u sent by the first user component, calculate the implicit digital certificate Cert and the user private key contribution value r according to the implicit digital certificate issuance process, and then send Cert and r to the first user component.

[0049] In the existing implicit digital certificate issuance process, the CA sends the user's private key contribution value to the user, and then the user calculates and obtains the private key in its entirety. In the existing two-party collaborative computing scheme of the elliptic curve cryptography algorithm, the user's private key is generated by two user components working together, and the implicit digital certificate issuance process is not involved.

[0050] Technical effects and advantages of the present invention:

[0051] The technical solution of the present invention enables the implicit digital certificate system to combine the two-party collaborative computing solution of the elliptic curve cryptography algorithm and ensure the security of the user's private key. With the technical solution of the present invention, the CA issues an implicit digital certificate and sends the user's private key contribution value, and the two user components obtain two sub-private keys respectively, and the user's private key will not appear as a whole in the above process. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A flowchart of a computing method embodiment of the present invention for issuing an implicit digital certificate to a two-party collaborative user component;

[0053] Figure 2 A schematic diagram of the process of the certificate issuing component of the present invention cooperating with two components to issue an implicit digital certificate and calculate a user's ECDSA algorithm sub-private key;

[0054] Figure 3 A schematic diagram of the process of the certificate issuing component of the present invention cooperating with two components to issue an implicit digital certificate and calculate the user's SM2 algorithm sub-private key; DETAILED DESCRIPTION

[0055] like Figure 1 As shown, the following steps are included: 11~16

[0056] Step 11: The first user component and the second user component cooperate to generate a random number k and cooperate to calculate R = [k]G.

[0057] For ease of description, the first user component and the second user component are used to represent the two communicating parties who obtain the user sub-private key.

[0058] Step 12: The first user component sends R and user identity u to the certificate issuing component.

[0059] Step 13: The certificate issuing component calculates the implicit digital certificate Cert and the user private key contribution value r, and then sends Cert and r to the first user component.

[0060] Step 14: The first user component calculates r' based on r, and sends r' to the second user component.

[0061] Step 15: The first user component calculates its own child private key w1.

[0062] Step 16: The second user component calculates its own child private key w2.

[0063] It should be noted that the above-mentioned steps 11 to 16 are only for illustration and are not used to limit the execution order of each step. In practical applications, the execution order of each step can be set according to actual needs, as long as the desired result can be obtained in the end. The same is true for each process step involved in the subsequent description, which will not be repeated.

[0064] Figure 2 The schematic diagram of the process of the certificate issuing component of the present invention cooperating with two components to issue an implicit digital certificate and calculate the user's ECDSA algorithm sub-private key is as follows: Figure 2 As shown, the following steps 21 to 27 are included.

[0065] Step 21: The first user component generates a random number k1 between (1, n-1), calculates R' = [k1]G, and then sends R' to the second user component.

[0066] Step 22: The second user component generates a random number k2 between (1, n-1), calculates R'' = [k2]R', and then sends R'' to the first user component.

[0067] Step 23: The first user component generates a random number k3 between (1, n-1), calculates R = [k3]G +R'', and then sends R and the user identity u to the certificate issuing component. This is equivalent to the random number k generated by the user in the implicit digital certificate issuance process being k1×k2 + k3 mod n.

[0068] Step 24: The certificate issuing component calculates the implicit digital certificate Cert and the user private key contribution value r according to the implicit digital certificate issuing process, and then sends Cert and r to the first user component.

[0069] Step 25: The first user component calculates e = Hash(Cert) and r' = k1 -1×(e×k3 + r) mod n, and then send r' to the second user component.

[0070] Step 26: The first user component uses k1 as its own child private key w1.

[0071] Step 27: The second user component calculates e×k2 + r' mod n, and uses the calculation result as its own child private key w2.

[0072] According to the issuance process of implicit digital certificates, the user private key w = e×k + r mod n, combined with step 23, that is, w = e×(k1×k2 + k3) + r mod n.

[0073] According to the above steps, w1×w2 = k1×(e×k2 + r') = k1×(e×k2 + k1 -1 ×(e×k3 +r)) = e×(k1×k2 + k3) + r mod n, so w1 and w2 meet the requirements of the two-party collaborative computing scheme of the ECDSA algorithm, that is, w1×w2= w mod n, w1 and w2 can be directly used in the existing two-party collaborative computing scheme of the ECDSA algorithm.

[0074] According to steps 21, 22 and 23, k = k1×k2 + k3 mod n, and neither the first user component nor the second user component can obtain any information about k, because for the first user component or the second user component, k is related to its unknown variable. According to the elliptic curve discrete logarithm problem, the first user component cannot obtain any information about k2 from R'' = [k2]R', and the second user component cannot obtain any information about k1 and k3 from R' = [k1]G and R = [k3]G + R''.

[0075] According to the implicit digital certificate issuance process in step 24, no one can obtain any information about k from r.

[0076] According to step 25, for the certificate issuing component and the second user component, since k1 and k3 are two unknowns, k1 and k3 cannot be obtained from the relationship between r' and r; that is, one equation cannot be used to solve two unknowns.

[0077] Figure 3 The schematic diagram of the process of the certificate issuing component of the present invention cooperating with two components to issue an implicit digital certificate and calculate the user SM2 algorithm sub-private key is as follows: Figure 3 As shown, the following steps 31 to 37 are included.

[0078] Step 31: The first user component generates a random number k1 between (1, n-1), calculates R' = [k1]G, and then sends R' to the second user component.

[0079] Step 32: The second user component generates a random number k2 between (1, n-1), calculates R'' = [k2]R', and then sends R'' to the first user component.

[0080] Step 33: The first user component generates a random number k3 between (1, n-1), calculates R = [k3]G +R'', and then sends R and the user identity u to the certificate issuing component. This is equivalent to the random number k generated by the user in the implicit digital certificate issuance process being k1×k2 + k3 mod n.

[0081] Step 34: The certificate issuing component calculates the implicit digital certificate Cert and the user private key contribution value r according to the implicit digital certificate issuing process, and then sends Cert and r to the first user component.

[0082] Step 35: The first user component calculates e = Hash(Cert) and r' = k1 -1 ×(e×k3 + r + 1) modn, and then send r' to the second user component.

[0083] Step 36: The first user component calculates k1 -1 mod n, and use the calculation result as your own child private key w1.

[0084] Step 37: The second user component calculates (e×k2 + r') -1 mod n, and use the calculation result as your own child private key w2.

[0085] According to the issuance process of implicit digital certificates, the user private key w = e×k + r mod n, combined with step 33, that is, w = e×(k1×k2 + k3) + r mod n.

[0086] According to the above steps, we have (w1×w2) -1 = k1×(e×k2 + r') = k1×(e×k2 + k1 -1 ×(e×k3 + r + 1)) = e×(k1×k2 + k3) + r + 1 = w + 1 mod n, so w1 and w2 meet the requirements of the two-party collaborative computing scheme of the SM2 algorithm, that is, w1×w2 = (1+w) -1 Mod n, w1 and w2 can be directly used in the existing two-party collaborative computing scheme of the SM2 algorithm.

[0087] According to steps 31, 32 and 33, k = k1×k2 + k3 mod n, neither the first user component nor the second user component can obtain any information about k, because for the first user component or the second user component, k is related to its unknown variable. At the same time, according to the elliptic curve discrete logarithm problem, the first user component cannot obtain any information about k2 from R'' = [k2]R', and the second user component cannot obtain any information about k1 and k3 from R' = [k1]G and R = [k3]G + R''.

[0088] According to the implicit digital certificate issuance process in step 34, no one can obtain any information about k from r.

[0089] According to step 35, for the certificate issuing component and the second user component, since k1 and k3 are two unknowns, k1 and k3 cannot be solved from the relationship between r' and r; that is, one equation cannot be used to solve two unknowns.

Claims

1. A computing method for issuing an implicit digital certificate to a two-party collaborative user component, characterized in that: include: The first user component and the second user component cooperate to generate a random number k and cooperate to calculate R = [k]G; G represents a base point of the elliptic curve; [k]G represents a k-times point operation of the base point G of the elliptic curve; The first user component sends R and user identity u to the certificate issuing component; The certificate issuing component calculates the implicit digital certificate Cert and the user private key contribution value r, and sends Cert and r to the first user component; The first user component calculates r' according to r, and sends r' to the second user component; The first user component calculates its own child private key w1; The second user component calculates its own child private key w2; The first user component calculates r' according to r, comprising: The first user component calculates e = Hash(Cert) and r' = k1 -1 ×(e×k3 + r + 1) mod n; The first user component calculates its own child private key w1, including: The first user component calculates k1 -1 mod n, and use the calculation result as your own child private key w1; The second user component calculates its own child private key w2, including: The second user component calculates (e×k2 + r') -1 mod n, and use the calculation result as your own child private key w2; Wherein, k1 is a random number between (1, n-1) generated by the first user component; k1 is a random number between (1, n-1) generated by the second user component; k3 is a random number between (1, n-1) generated by the first user component; n represents the order of the elliptic curve; e is the hash value calculated for the certificate file.

2. The method according to claim 1, characterized in that The first user component and the second user component cooperate to generate a random number k and cooperate to calculate R = [k] G, including: The first user component generates a random number k1 between (1, n-1), calculates R' = [k1]G, and sends R' to the second user component; The second user component generates a random number k2 between (1, n-1), calculates R'' = [k2]R', and sends R'' to the first user component; The first user component generates a random number k3 between (1, n-1) and calculates R = [k3]G + R''; n, represents the order of the elliptic curve.

3. The method according to claim 1, characterized in that: The certificate issuing component calculates the implicit digital certificate Cert and the user private key contribution value r, including: The certificate issuing component generates a random number k' between (1, n-1) and calculates P = R + [k']G; The certificate issuing component generates Cert = Encode(P, u, m) and calculates e = Hash(Cert), where Encode is encoded according to the implicit digital certificate standard format, m is other digital certificate auxiliary information, and Hash() is a hash function; The certificate issuing component calculates r = e×k' + q mod n, where q is the private key of the certificate issuing component.

4. A system for issuing implicit digital certificates to two cooperative user components, characterized in that: include: The first user component is used to collaborate with the second user component to generate a random number k and collaboratively calculate R = [k]G, send R and the user identity u to the certificate issuing component, calculate r' based on r, send r' to the second user component, and calculate its own sub-private key w1; The second user component is used to collaborate with the second user component to generate a random number k and collaboratively calculate R = [k]G, receive r' sent by the first user component, and calculate its own sub-private key w2; The certificate issuing component is used to receive R and user identity u sent by the first user component, calculate the implicit digital certificate Cert and the user private key contribution value r according to the implicit digital certificate issuance process, and then send Cert and r to the first user component; The first user component is further used to calculate e = Hash(Cert) and r' = k1 -1 ×(e×k3 + r +1) mod n; calculate k1 -1 mod n, and use the calculation result as your own child private key w1; The second user component is further used to calculate (e×k2 + r') -1 mod n, and use the calculation result as your own child private key w2; Wherein, k1 is a random number between (1, n-1) generated by the first user component; k1 is a random number between (1, n-1) generated by the second user component; k3 is a random number between (1, n-1) generated by the first user component; n represents the order of the elliptic curve; e is the hash value calculated for the certificate file.

5. The system according to claim 4, characterized in that The first user component is further used to: generate a random number k1 between (1, n-1), calculate R' = [k1]G, and send R' to the second user component; generate a random number k3 between (1, n-1), and calculate R = [k3]G + R''; The second user component is further used to: generate a random number k2 between (1, n-1), calculate R''=[k2]R', and send R'' to the first user component.

6. The system according to claim 5, characterized in that The certificate issuing component is further used to: generate a random number k' between (1, n-1), calculate P = R + [k']G; generate Cert = Encode(P, u, m) and calculate e = Hash(Cert), where Encode is encoded according to the implicit digital certificate standard format, m is other digital certificate auxiliary information, and Hash() is a hash function; calculate r = e×k' + q mod n, where q is the private key of the certificate issuing component.

Images