A method to resist small subgroup attacks in pairing-based cryptographic protocols

Abstract

The present invention belongs to the field of information security technology, and more specifically, relates to a method for resisting small subgroup attacks in a pairing-based cryptographic protocol. The method can fundamentally eliminate the influence of small subgroup attacks on pairing-based cryptographic protocols and effectively ensure the security of network communications. Compared with traditional detection methods, the method proposed by us has higher detection efficiency. Taking the KSS16-P330 curve as an example, the Magma software implementation shows that in G1, G2 and G T In the three subgroups, the detection method we proposed improved the implementation efficiency by about 90%, 300% and 330% respectively.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and more specifically, relates to a method for resisting small subgroup attacks in a pairing-based cryptographic protocol. Background Art

[0002] In the pairing-based protocol, the input subgroups G1, G2 and the output subgroup G T The order of is r. Specifically, G1 and G2 are elliptic curve rational point groups E(F pk ), G T Yes F p * k The r-order root of unity group on the k -1. Since the security of the protocol depends on the difficulty of computing the discrete logarithm problem in the above three subgroups, r is usually taken as a large prime number. For example, in order to achieve a security level of 128 bits, the bit length of the prime number r is at least 256. In many pairing-friendly curves, subgroups G1, G2 and G T They are located at the order of h1·r, h2·r and h T ·r group, where the parameters h1, h2 and h T It is called cofactor. Since cryptographic protocols usually run in untrusted environments, they are easily attacked by small subgroups. For example, an attacker can tamper with the public parameters in the protocol (elements in G1 or G2) into elements of very small order. Once the implementer uses the key to perform scalar multiplication with undetected points, this is likely to expose the key information. Under certain conditions, the attacker can even completely recover the key information. In order to completely eliminate the hidden dangers brought by this attack, cofactor elimination and subgroup member detection are two feasible methods.

[0003] Cofactor elimination method: This method is mainly used in G1 and G2. Specifically, the protocol implementer multiplies the parameter by the corresponding cofactor to force it into the "correct" subgroup. For G1, since the cofactor h1 is very small, the implementation efficiency of this method is relatively high. For G2, although the cofactor h2 is very large, this method is still feasible. This is because this process is in fact equivalent to hashing to G2. Therefore, we can take the method of fast hashing to G2 to reduce the computational complexity of the cofactor elimination method. However, the cofactor elimination method also has many defects. First, it is often difficult for implementers to determine which specific locations in the protocol to perform the cofactor elimination operation. Secondly, this will also make it more difficult to prove the security of the protocol.

[0004] Subgroup member detection method: Subgroup member detection is another method to resist small subgroup attacks. Compared with the cofactor elimination method, the subgroup detection method does not modify the public parameters and does not bring difficulties to the security proof of the protocol, but the computational cost of this method is higher. T , in most pair-friendly curves, the tester needs to perform r scalar multiplication or exponential operation on the tested elements. For G2, the situation is more complicated. Suppose E has a curve E with a twist of degree d t For any element Q that is claimed to be in G2, we only need to check whether Q is For a pair-friendly curve without twist, the examiner needs to check that π(Q) = [p]Q and [r]Q = O E Is it true, where π is a p-Frobenius endomorphism, O E is a point at infinity on E. However, this detection method is computationally expensive. Summary of the invention

[0005] In order to overcome the defects in the above-mentioned prior art, the present invention provides a method for resisting small subgroup attacks in a pairing-based cryptographic protocol, which effectively reduces the computing cost and improves the computing efficiency.

[0006] To solve the above technical problems, the technical solution adopted by the present invention is: a method for resisting small subgroup attacks in a pairing-based cryptographic protocol, comprising the following steps:

[0007] S1. G1 subgroup membership detection: For any element P that claims to belong to subgroup G1, the following steps are used for detection:

[0008] S11. Check whether P belongs to the rational point group E(F p ); where p is a prime number; if so, continue to the next step of detection; if not, stop the detection and output: P is an illegal element;

[0009] S12. Find integers a0 and a1 that satisfy a0+a1·λ≡0modr, where λ is a GLV endomorphism The corresponding scalar multiplication on G1; Apply the LLL algorithm to make the bit lengths of a0 and a1 as small as possible;

[0010] S13. For the curves of CM discriminant D=-3 and -4, check whether the following equations hold:

[0011] (i) If D = -3,

[0012] (ii) If D = -4,

[0013] In the formula, the symbol gcd represents the greatest common factor. If it is true, continue to the next step of detection; if it is not true, return to step S12 and search for new parameters a0 and a1 again;

[0014] S14. Detection Is it true? If it is true, input: P is a legal element; if it is not true, output: P is an illegal element;

[0015] S2. G2 subgroup membership detection: For any element Q that claims to belong to the G2 subgroup, the specific detection steps are as follows:

[0016] S21. Check whether Q belongs to the rational point group If yes, continue to the next step of detection; if no, stop the detection and output: Q is an illegal element

[0017] S22. Order Apply the LLL algorithm to find an integer m such that parameter c i As small as possible;

[0018] S23. Solve to satisfy Integers b0 and b1, where ψ = φoπoφ -1 And φ is a twist mapping; check whether the following equation holds:

[0019]

[0020] If true, proceed to the next step of testing. If not true, return to step S22 to find a new integer m;

[0021] S24. Detection Is it true? If it is true, then output: Q is a legal element; if it is not true, then output: Q is an illegal element;

[0022] S3.G T Subgroup membership detection: For any claim to belong to G T The specific detection steps are as follows:

[0023] S31. Order Apply the LLL algorithm to find an integer m such that parameter c i As small as possible;

[0024] S32. Detect gcd(m,Φ k (p))=r whether it holds that Φ k represents a k-order cyclotomic polynomial. If true, proceed to the next step of detection; if not true, return to step S31 to find a new integer m;

[0025] S33. Detection equation Is it true? If so, continue to the next step of detection; if not, stop the detection and output: α is an illegal element;

[0026] S34. Detection equation Is it true? If it is true, output: α is a legal element; if it is not true, output: α is an illegal element.

[0027] Furthermore, in step S1, Theorem 1 is provided: Let E be defined in F p Elliptic curve with CM discriminant D = -3 or -4; let P be E(F p ) is a rational point on Z; suppose a0,a1∈Z satisfies:

[0028] (1)a0+a1·λ≡0modr,

[0029] (2) If D = -3,

[0030] (3) If D = -4, Then P∈G1 if and only if

[0031] Proof: Here we only prove the case when D = -3; when D = -4, the proof method is similar. First, prove the necessity. Since P∈G1, the order of P is r and According to the assumption a0+a1·λ≡0modr, we can easily get:

[0032]

[0033] Also because Therefore, it is easy to get that the order of P is r. The proof is complete.

[0034] It is worth noting that it is always possible to find parameters a0 and a1 that satisfy the conditions. In the most extreme case, a0 = r, a1 = 0 can be selected. In most pairing-friendly curves, the bit lengths of a0 and a1 are approximately In the traditional G1 subgroup member detection method, a scalar multiplication with a bit length of log2r needs to be performed. In this invention, we provide a new detection method. In most pairing friendly curves, the bit length of the scalar multiplication required by this method is reduced to Therefore, this detection method is about 1 times faster than traditional detection methods.

[0035] Furthermore, in step S2, Theorem 2 is provided: Let E be defined in F p The elliptic curve Q is A reasonable point on make Assume b0,b1∈Z satisfies:

[0036] (1)

[0037] (2)

[0038] Then Q∈G2 if and only if

[0039] Proof: First, we prove the necessity. Since Q∈G2, the order of Q is r, and:

[0040] πoφ -1 (Q)=[p]φ -1 (Q). (1)

[0041] Applying the twist mapping φ to both sides of equation (1) yields:

[0042] ψ(Q)=φoπoφ -1 (Q) = φo([p]φ -1 )Q=[p]Q.

[0043] therefore,

[0044]

[0045] Now we prove the sufficiency. According to the characteristic equation of ψ, we know that:

[0046]

[0047] According to assumption (1), we can know that:

[0048]

[0049] Multiply both sides of equation (2) by We can get:

[0050]

[0051] Combining equations (3) and (4), we can deduce:

[0052]

[0053] Also because Therefore, the order of Q is r. The proof is complete.

[0054] The above method describes an efficient G2 subgroup membership detection method for pair-friendliness curves with twists. Let the vector Similar to G1 subgroup membership detection, we can always find a vector C that satisfies the conditions. Experimental results show that for many pairing-friendly curves, the value of vector C is the same as the Miller iteration parameter in the optimal pair. Therefore, the bit length of the required scalar multiplication is reduced to about For G2 subgroup membership detection, in most pair-friendly curves, the bit length of the scalar multiplication required by the new detection scheme is reduced to approximately in Represents the Euler function. Compared with the traditional detection method, the detection efficiency is significantly improved.

[0055] Furthermore, in step S3, Theorem 3 is provided: Let Let α be elements in; assuming that gcd(m,Φ k (p))=r; then α∈G T If and only if and

[0056] Proof: The necessity is obvious. We only need to prove the sufficiency. and It can be seen that the order of α divides gcd(Φ k (p),η). By assuming gcd(m,Φ k (p))=r, we can get that the order of α is r. The proof is complete.

[0057] For the G T Subgroup membership detection, the bit length of the exponentiation operation is reduced to

[0058] The present invention also provides a system for resisting small subgroup attacks in a pairing-based cryptographic protocol, comprising:

[0059] G1 subgroup member detection module: for any element P that claims to belong to subgroup G1, the following steps are used to detect:

[0060] S11. Check whether P belongs to the rational point group E(F p ); If yes, continue to the next step of detection; if no, stop the detection and output: P is an illegal element;

[0061] S12. Find integers a0 and a1 that satisfy a0+a1·λ≡0modr, where λ is a GLV endomorphism The corresponding scalar multiplication on G1; Apply the LLL algorithm to make the bit lengths of a0 and a1 as small as possible;

[0062] S13. For the curves with D=-3 and -4, check whether the following equations hold:

[0063] (i) If D = -3,

[0064] (ii) If D = -4, In the formula, the symbol gcd represents the greatest common factor. If it is true, continue to the next step of detection; if it is not true, return to step S12 and search for new parameters a0 and a1 again;

[0065] S14. Detection Is it true? If it is true, input: P is a legal element; if it is not true, output: P is an illegal element;

[0066] G2 subgroup member detection module: for any element Q that claims to belong to the G2 subgroup, the specific detection steps are as follows:

[0067] S21. Check whether Q belongs to If yes, continue to the next step of detection; if no, stop the detection and output: Q is an illegal element;

[0068] S22. Order Apply the LLL algorithm to find an integer m such that parameter c i As small as possible;

[0069] S23. Solve to satisfy Integers b0 and b1, where ψ = φoπoφ -1 And φ is a twist mapping; check whether the following equation holds:

[0070]

[0071] If true, proceed to the next step of testing. If not true, return to step S22 to find a new integer m;

[0072] S24. Detection Is it true? If it is true, then output: Q is a legal element; if it is not true, then output: Q is an illegal element;

[0073] G T Subgroup member detection module: used to detect any group member that claims to belong to G T The specific detection steps are as follows:

[0074] S31. Order Apply the LLL algorithm to find an integer m such that parameter c i As small as possible;

[0075] S32. Detect gcd(m,Φ k (p))=r, where Φ krepresents a k-order cyclotomic polynomial. If true, proceed to the next step of detection; if not true, return to step S31 to find a new integer m;

[0076] S33. Detection equation Is it true? If so, continue to the next step of detection; if not, stop the detection and output: α is an illegal element;

[0077] S34. Detection equation Is it true? If it is true, output: α is a legal element; if it is not true, output: α is an illegal element.

[0078] Furthermore, in the G1 subgroup member detection module, Theorem 1 is provided: Let E be defined in F p Elliptic curve with CM discriminant D = -3 or -4; let P be E(F p ) is a rational point on Z; suppose a0,a1∈Z satisfies:

[0079] (1)a0+a1·λ≡0modr,

[0080] (2) If D = -3,

[0081] (3) If D = -4,

[0082] Then P∈G1 if and only if

[0083] Furthermore, in the G2 subgroup member detection module, there is Theorem 2: Let E be defined in F p The elliptic curve Q is A reasonable point on make Assume b0,b1∈Z satisfies:

[0084] (1)

[0085] (2) Then Q∈G2 if and only if

[0086] Furthermore, in the G T In the subgroup member detection module, there is Theorem 3: Let Let α be elements in; assuming that gcd(m,Φ k (p))=r; then α∈G T If and only if and

[0087] The present invention also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-mentioned method for resisting small subgroup attacks in a pairing-based cryptographic protocol.

[0088] The present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for resisting small subgroup attacks in a pairing-based cryptographic protocol described above is implemented.

[0089] Compared with the prior art, the beneficial effects are as follows: the method proposed by the present invention for resisting small subgroup attacks in pairing-based cryptographic protocols can fundamentally eliminate the influence of small subgroup attacks on pairing-based cryptographic protocols and effectively ensure the security of network communications. Compared with traditional detection methods, the method proposed by our invention has higher detection efficiency. Taking the KSS16-P330 curve as an example, in G1, G2 and G T In the three subgroups, the detection method we proposed improved the implementation efficiency by about 90%, 300% and 330% respectively. DETAILED DESCRIPTION

[0090] Embodiment 1:

[0091] A method for resisting small subgroup attacks in a pairing-based cryptographic protocol comprises the following steps:

[0092] Step 1. G1 subgroup membership detection

[0093] In the traditional G1 subgroup member detection method, a scalar multiplication with a bit length of log2 r needs to be performed. In this invention, we provide a new detection method. In most pairing friendly curves, the bit length of the scalar multiplication required by this method is reduced to Therefore, this detection method is about 1 times faster than the traditional detection method. For any element P that claims to belong to subgroup G1, we use the following steps to detect; For any element P that claims to belong to subgroup G1, we use the following steps to detect:

[0094] S11. Check whether P belongs to the rational point group E(F p ); If yes, continue to the next step of detection; if no, stop the detection and output: P is an illegal element;

[0095] S12. Find integers a0 and a1 that satisfy a0+a1·λ≡0modr, where λ is a GLV endomorphism The corresponding scalar multiplication on G1; Apply the LLL algorithm to make the bit lengths of a0 and a1 as small as possible;

[0096] S13. For the curves with D=-3 and -4, check whether the following equations hold:

[0097] (i) If D = -3,

[0098] (ii) If D = -4, In the formula, the symbol gcd represents the greatest common factor. If it is true, continue to the next step of detection; if it is not true, return to step S12 to find new parameters a0 and a1;

[0099] S14. Detection Is it true? If it is true, input: P is a legal element; if it is not true, output: P is an illegal element.

[0100] Theorem 1: Let E be defined in F p Elliptic curve with CM discriminant D = -3 or -4; let P be E(F p ) is a rational point on Z; suppose a0,a1∈Z satisfies:

[0101] (1)a0+a1·λ≡0modr,

[0102] (2) If D = -3,

[0103] (3) If D = -4, Then P∈G1 if and only if

[0104] Proof: Here we only prove the case when D = -3; when D = -4, the proof method is similar. First, prove the necessity. Since P∈G1, the order of P is r and According to the assumption a0+a1·λ≡0modr, we can easily get:

[0105]

[0106] Also because Therefore, it is easy to get that the order of P is r. The proof is complete.

[0107] It is worth noting that it is always possible to find parameters a0 and a1 that satisfy the conditions. In the most extreme case, a0 = r, a1 = 0 can be selected. In most pairing-friendly curves, the bit lengths of a0 and a1 are approximately In the traditional G1 subgroup member detection method, a scalar multiplication with a bit length of log2r needs to be performed. In this invention, we provide a new detection method. In most pairing friendly curves, the bit length of the scalar multiplication required by this method is reduced to Therefore, this detection method is about 1 times faster than traditional detection methods.

[0108] Step 2. G2 subgroup membership detection

[0109] For G2 subgroup membership detection, we also propose a corresponding optimization scheme. In most pairing-friendly curves, the bit length of the scalar multiplication required by the new detection scheme is reduced to about in Represents the Euler function. Compared with the traditional detection method, the detection efficiency has been significantly improved. For any element Q that is claimed to belong to the G2 subgroup, the specific detection steps are as follows:

[0110] S21. Check whether Q belongs to If yes, continue to the next step of detection; if no, stop the detection and output: Q is an illegal element;

[0111] S22. Order Apply the LLL algorithm to find an integer m such that parameter c i As small as possible;

[0112] S23. Solve to satisfy Integers b0 and b1, where ψ = φoπoφ -1 And φ is a twist mapping; check whether the following equation holds:

[0113]

[0114] If true, proceed to the next step of testing. If not true, return to step S22 to find a new integer m;

[0115] S24. Detection Is it true? If it is true, then output: Q is a legal element; if it is not true, then output: Q is an illegal element.

[0116] Theorem 2: Let E be defined in F p The elliptic curve Q is A reasonable point on make Assume b0,b1∈Z satisfies:

[0117] (1)

[0118] (2) Then Q∈G2 if and only if

[0119] Proof: First, we prove the necessity. Since Q∈G2, the order of Q is r, and:

[0120] πoφ -1 (Q)=[p]φ -1 (Q). (1)

[0121] Applying the twist mapping φ to both sides of equation (1) yields:

[0122] ψ(Q)=φoπoφ -1 (Q) = φo([p]φ -1 )Q=[p]Q.

[0123] therefore,

[0124]

[0125] Now we prove the sufficiency. According to the characteristic equation of ψ, we know that:

[0126]

[0127] According to assumption (1), we can know that:

[0128]

[0129] Multiply both sides of equation (2) by We can get:

[0130]

[0131] Combining equations (3) and (4), we can deduce:

[0132]

[0133] Also because Therefore, the order of Q is r. The proof is complete.

[0134] The above method describes an efficient G2 subgroup membership detection method for pair-friendliness curves with twists. Let the vector Similar to G1 subgroup membership detection, we can always find a vector C that satisfies the conditions. Experimental results show that for many pairing-friendly curves, the value of vector C is the same as the Miller iteration parameter in the optimal pair. Therefore, the bit length of the required scalar multiplication is reduced to about For G2 subgroup membership detection, in most pair-friendly curves, the bit length of the scalar multiplication required by the new detection scheme is reduced to approximately in Represents the Euler function. Compared with the traditional detection method, the detection efficiency is significantly improved.

[0135] Step 3.G T Subgroup Membership Detection

[0136] The method used in G2 subgroup member detection can actually also be applied to G TSimilar to G2 subgroup member detection, in the new detection method, the bit length for performing the exponentiation operation is reduced to For any claim that G T The specific detection steps are as follows: For any element α claimed to belong to G T The specific detection steps are as follows:

[0137] S31. Order Apply the LLL algorithm to find an integer m such that parameter c i As small as possible;

[0138] S32. Detect gcd(m,Φ k (p))=r, where Φ k represents a k-order cyclotomic polynomial. If true, proceed to the next step of testing; if not, return to step S1 and find a new integer m;

[0139] S33. Detection equation Is it true? If so, continue to the next step of detection; if not, stop the detection and output: α is an illegal element;

[0140] S34. Detection equation Is it true? If it is true, output: α is a legal element; if it is not true, output: α is an illegal element.

[0141] Theorem 3: Let Let α be elements in; assuming that gcd(m,Φ k (p))=r, then α∈G T If and only if and

[0142] Proof: The necessity is obvious. We only need to prove the sufficiency. and It can be seen that the order of α divides gcd(Φ k (p),η). By assuming gcd(m,Φ k (p))=r, we can get that the order of α is r. The proof is complete.

[0143] Example 2

[0144] In order to more clearly illustrate the advantages of the above detection scheme, we will use the KSS16-P330 curve as an example to explain the present invention in more detail.

[0145] The KSS16 curve family is parameterized by the following polynomial:

[0146] r=(z 8 +48z 4+625) / 61250,

[0147] t=(2z 5 +41z+35) / 35,

[0148] p=(z 10 +2z 9 +5z 8 +48z 6 +152z 5 +240z 4 +526z 2 +2398z+3125) / 980.

[0149] In order to achieve a security level of 128 bits, the parameter z can be taken as z = -2 34 +2 27 -2 23 +2 20 -2 11 +1. The corresponding curve equation is:

[0150] E:y 2 =x 3 +x,E t :y 2 =x 3 +(1 / u)·x,

[0151] in

[0152] 1. G1 subgroup member detection

[0153] Using Magma software, we found the best parameters a0 and a1 to be:

[0154] a0=299609893663766701347795728932946474488,

[0155] a1=-164302199751097868481049270705164195687.

[0156] Since -17a0-31a1=1. So we can use and to replace a0 and a1. Now it is easy to check Therefore, for any point Q that is claimed to belong to G1, we only need to do the following checks:

[0157] Q∈E(F p ),

[0158]

[0159] Ignore the detection Q∈E(F p ), in the KSS16-P330 curve, the cost of G1 subgroup membership detection is 1 a1 scalar multiplication, 5 doublings, 3 points plus an automorphism The amount of calculation.

[0160] 2. G2 subgroup member detection

[0161] We first consider selecting the vector C as C = [-z / 5, -1, 0, 0, -2z / 5, 0]. Then according to our proposed G2 subgroup detection scheme, the parameters b0 and b1 are:

[0162] b0=2t 2 ·p·z-2p 2 ·zz,

[0163] b1=-2t 3 +4t·p·z-1.

[0164] However, at this time This does not meet the requirements. Here, we recommend that the vector C be:

[0165] C=[7n,9n+1,-13n+11,-29n+24,-31n+23,-27n+18,-41n+25,-23n+13] Where n=(5-z) / 10. Coefficient c i There are the following relationships:

[0166]

[0167] Let point Q be any element in the G2 subgroup that is claimed to belong to the KSS16-P330 curve. Next, we analyze how to efficiently compute [c i ]Q. Let S i =[c i ]Q, we first calculate S1, S2, [7]Q and [14n]Q according to the following sequence:

[0168] Q→[6]Q→[n]Q→S0=[7n]Q→S1=[9n+1]Q

[0169] ]P0=[7]Q]P1=[14n]Q

[0170] Since [6]Q can be obtained in the process of calculating [n]Q, the above calculation requires 1 n-point multiplication, 4 point additions, and 4 doubling operations. According to (5), in order to calculate S2-S7, the following intermediate variables can be calculated first:

[0171] R1=P0-S1, R2=[2]R1, R3=R1+R2,

[0172] R4=[2]R2,R5=P0-P1.

[0173] therefore,

[0174] S2=R2-S1+P1, S3=R4+S0, S4=S2+R2,

[0175] S5=R3, S6=S5+R5, S7=R1+R5.

[0176] According to the G2 subgroup member detection method, we only need to check whether the following two conditions are met:

[0177]

[0178]

[0179] In summary, in the KSS16-P330 curve, the cost of G2 subgroup membership detection is about the computational cost of 1 n-scalar multiplication, 19 point additions, 6 doublings, and 7 ψ endomorphisms.

[0180] 3. G T Subgroup Membership Detection

[0181] We can easily find that gcd(c0+c1p+L+c7p 7 ,Φ 16 (p)) = r. Therefore, according to G T Subgroup member detection method, for any group claiming to belong to G T The element α in needs to be detected first:

[0182]

[0183] Is it true? If the above formula is not true, α is an illegal element and the detection stops. If the above formula is true, continue the detection:

[0184] Is it true? We first calculate h0,h1,α 7 and α 14n :

[0185]

[0186] Due to α 6 In the calculation of α n Therefore, the above calculation requires 1 n exponentiation, 5 multiplications and 3 square operations. Next, we calculate h2-h7. According to formulas (5) and (6), we first calculate the following intermediate variables:

[0187]

[0188] therefore,

[0189]

[0190] Finally, we just need to check:

[0191]

[0192] According to (6)-(10), the G of KSS16-P330 curve T Subgroup membership detection requires a total of 1 n exponential, 16 multiplications, 5 squarings, and 10 Frobeniu mapping operations.

[0193] Example 3

[0194] This embodiment provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method for resisting small subgroup attacks in a pairing-based cryptographic protocol described in Embodiment 1.

[0195] Example 4

[0196] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for resisting small subgroup attacks in a pairing-based cryptographic protocol described in Embodiment 1 is implemented.

[0197] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A method for resisting small subgroup attacks in pairing-based cryptographic protocols, It is characterized in that The following steps are involved: S1.G 1 Subgroup membership detection: For any claim to belong to subgroup G 1 The element P is detected by the following steps: S11. Check whether P belongs to the rational point group E(F p ), where p is a prime number; if so, continue to the next step of detection; if not, stop the detection and output: P is an illegal element; S12. Find a satisfying 0 +a 1 An integer a with λ≡0 mod r 0 and a 1 , where λ is the GLV endomorphism In G 1 The corresponding scalar multiplication; Apply the LLL algorithm so that a 0 and a 1 The bit length is as small as possible; S13. For the curves of CM discriminant D=-3 and -4, check whether the following equations hold: (i) If D = -3, (ii) If D = -4, In the formula, the symbol gcd represents the greatest common factor; if it is true, continue to the next step of detection; if it is not true, return to step S12 to find a new parameter a 0 and a 1 ; S14. Detection Is it true? If it is true, input: P is a legal element; if it is not true, output: P is an illegal element; S2.G 2 Subgroup membership detection: For any group claiming to belong to G 2 The specific detection steps for the element Q of the subgroup are as follows: S21. Check whether Q belongs to the rational point group If yes, continue to the next step of detection; if no, stop the detection and output: Q is an illegal element; S22. Order Apply the LLL algorithm to find an integer m such that parameter c i As small as possible; S23. Solve to satisfy Integer b 0 and b 1 , where ψ=φoπoφ -1 And φ is a twist mapping; check whether the following equation holds: If true, proceed to the next step of detection; if not true, return to step S22 to find a new integer m; S24. Detection Is it true? If it is true, then output: Q is a legal element; if it is not true, then output: Q is an illegal element; S3.G T Subgroup membership detection: For any claim to belong to G T The specific detection steps are as follows: S31. Order Apply the LLL algorithm to find an integer m such that parameter c i As small as possible; S32. Detect gcd(m,Φ k (p))=r, where Φ k represents a k-order cyclotomic polynomial; if true, proceed to the next step of detection; if not true, return to step S31 to find a new integer m; S33. Detection equation Is it true? If so, continue to the next step of detection; if not, stop the detection and output: α is an illegal element; S34. Detection equation Is it true? If it is true, output: α is a legal element; if it is not true, output: α is an illegal element.

2. The method for resisting small subgroup attacks in a pairing-based cryptographic protocol according to claim 1, It is characterized in that In the step S1, theorem 1 is provided: Let E be defined in F p Elliptic curve with CM discriminant D = -3 or -4; let P be E(F p ) is a rational point on 0 ,a 1 ∈Z satisfies: (1)a 0 +a 1 ·λ≡0 mod r (2) If D = -3, (3) If D = -4, Then P∈G 1 If and only if 3. The method for resisting small subgroup attacks in a pairing-based cryptographic protocol according to claim 1, It is characterized in that In the step S2, there is Theorem 2: Let E be defined in F p The elliptic curve Q is A reasonable point on make Assumption b 0 ,b 1 ∈Z satisfies: (1) (2) Then Q∈G 2 If and only if 4. The method for resisting small subgroup attacks in a pairing-based cryptographic protocol according to claim 1, It is characterized in that In step S3, there is Theorem 3: Let Let α be elements in; assuming that gcd(m,Φ k (p))=r; then α∈G T If and only if and 5. A system for resisting small subgroup attacks in pairing-based cryptographic protocols, It is characterized in that include: G 1 Subgroup member detection module: used to detect any member who claims to belong to subgroup G 1 The element P is detected by the following steps: S11. Check whether P belongs to the rational point group E(F p ); If yes, continue to the next step of detection; if no, stop the detection and output: P is an illegal element; S12. Find a satisfying 0 +a 1 An integer a with λ≡0 mod r 0 and a 1 , where λ is the GLV endomorphism In G 1 The corresponding scalar multiplication; Apply the LLL algorithm so that a 0 and a 1 The bit length is as small as possible; S13. For the curves with D=-3 and -4, check whether the following equations hold: (i) If D = -3, (ii) If D = -4, In the formula, the symbol gcd represents the greatest common factor; if it is true, continue to the next step of detection; if it is not true, return to step S12 and find a new parameter a again 0 and a 1 ; S14. Detection Is it true? If it is true, input: P is a legal element; if it is not true, output: P is an illegal element; G 2 Subgroup member detection module: used to detect any group member that claims to belong to G 2 The specific detection steps for the element Q of the subgroup are as follows: S21. Check whether Q belongs to If yes, continue to the next step of detection; if no, stop the detection and output: Q is an illegal element; S22. Order Apply the LLL algorithm to find an integer m such that parameter c i As small as possible; S23. Solve to satisfy Integer b 0 and b 1 , where ψ=φoπoφ -1 And φ is a twist mapping; check whether the following equation holds: If true, proceed to the next step of detection; if not true, return to step S22 to find a new integer m; S24. Detection Is it true? If it is true, then output: Q is a legal element; if it is not true, then output: Q is an illegal element; G T Subgroup member detection module: used to detect any group member that claims to belong to G T The specific detection steps are as follows: S31. Order Apply the LLL algorithm to find an integer m such that parameter c i As small as possible; S32. Detect gcd(m,Φ k (p))=r, where Φ k represents a k-order cyclotomic polynomial; if true, proceed to the next step of detection; if not true, return to step S1 and find a new integer m; S33. Detection equation Is it true? If so, continue to the next step of detection; if not, stop the detection and output: α is an illegal element; S34. Detection equation Is it true? If it is true, output: α is a legal element; if it is not true, output: α is an illegal element.

6. The system for resisting small subgroup attacks in a pairing-based cryptographic protocol according to claim 5, It is characterized in that In the G 1 In the subgroup member detection module, there is Theorem 1: Let E be defined in F p Elliptic curve with CM discriminant D = -3 or -4; let P be E(F p ) is a rational point on 0 ,a 1 ∈Z satisfies: (1)a 0 +a 1 ·λ≡0 mod r (2) If D = -3, (3) If D = -4, Then P∈G 1 If and only if 7. The system for resisting small subgroup attacks in a pairing-based cryptographic protocol according to claim 5, It is characterized in that In the G 2 In the subgroup member detection module, there is Theorem 2: Let E be defined in F p The elliptic curve Q is A reasonable point on make Assumption b 0 ,b 1 ∈Z satisfies: (1) (2) Then Q∈G 2 If and only if 8. The system for resisting small subgroup attacks in a pairing-based cryptographic protocol according to claim 5, It is characterized in that In the G T In the subgroup member detection module, there is Theorem 3: Let Let α be elements in; assuming that gcd(m,Φ k (p))=r; then α∈G T If and only if and 9. An electronic device, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method for resisting small subgroup attacks in a pairing-based cryptographic protocol as described in any one of claims 1 to 4.

10. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, the method for resisting small subgroup attacks in a pairing-based cryptographic protocol as described in any one of claims 1 to 4 is implemented.

Images