An SM2 operation method, system, device and computer-readable storage medium

Abstract

The present application discloses an SM2 operation method, system, device and computer-readable storage medium, which includes: obtaining target data to be operated; obtaining first elliptic curve parameters of the SM2 algorithm at the current moment; obtaining a private key and performing blinding processing on the private key to obtain a blinded private key; determining an elliptic curve point and performing blinding processing on the elliptic curve point to obtain a blinded curve point; performing an operation on the target data based on the blinded private key and the blinded curve point to obtain a target operation result; obtaining second elliptic curve parameters of the SM2 algorithm at the current moment; and determining whether the first elliptic curve parameters are consistent with the second elliptic curve parameters, and if so, determining that the target operation result is correct. The present application performs SM2 operation on target data by applying a blinded private key and a blinded curve point, and performs security verification on the elliptic curve parameters, which can resist side-channel attacks and has good security. The SM2 operation method, system, device and computer-readable storage medium provided by the present application also solve corresponding technical problems.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and more specifically, to an SM2 operation method, system, device, and computer-readable storage medium. Background Art

[0002] SM2 is an elliptic curve public key cryptography algorithm announced by the China National Cryptography Administration in December 2010. It is a commercial cryptography algorithm with independent intellectual property rights in China and is widely used in commercial cryptography chips.

[0003] However, during the operation of SM2, it may be subject to side-channel attacks, which affect the security of SM2 operations. It should be noted that the side-channel attack described here is also known as side-channel cryptanalysis, which was proposed by American cryptographer P.C. Kocher in the late 1990s. It is a physical attack method against cryptographic implementations (including cryptographic chips, cryptographic modules, cryptographic systems, etc.). The essence of this attack method is to use the side information generated during the execution of cryptographic-related operations by the cryptographic implementation to recover the key used in the cryptographic implementation.

[0004] In summary, how to improve the security of SM2 operations is an urgent problem to be solved by those skilled in the art at present. Summary of the Invention

[0005] The purpose of the present application is to provide an SM2 operation method, which can, to a certain extent, solve the technical problem of how to improve the security of SM2 operations. The present application also provides an SM2 operation system, device, and computer-readable storage medium.

[0006] To achieve the above purpose, the present application provides the following technical solutions:

[0007] An SM2 operation method includes:

[0008] Obtaining target data to be operated;

[0009] Obtaining the first elliptic curve parameter of the SM2 algorithm at the current moment;

[0010] Obtaining a private key, performing blinding processing on the private key to obtain a blinded private key;

[0011] Determining an elliptic curve point, performing blinding processing on the elliptic curve point to obtain a blinded curve point;

[0012] Performing an operation on the target data based on the blinded private key and the blinded curve point to obtain a target operation result;

[0013] Obtaining the second elliptic curve parameter of the SM2 algorithm at the current moment;

[0014] Determine whether the first elliptic curve parameter is consistent with the second elliptic curve parameter. If so, determine that the target operation result is correct.

[0015] Preferably, the target data includes the ciphertext encrypted by the SM2 algorithm, and the target operation result includes the plaintext corresponding to the ciphertext.

[0016] The determining of the elliptic curve point includes:

[0017] Extract a first bit string from the first string of the ciphertext, and convert the target bit string into the elliptic curve point.

[0018] The blinding process of the private key to obtain a blinded private key includes:

[0019] Generate a first random number;

[0020] Based on the first private key blinding formula, perform a blinding process on the private key to obtain the blinded private key.

[0021] The first private key blinding formula includes:

[0022] k′1 = r1 × N + k1;

[0023] Where k′1 represents the blinded private key; r1 represents the first random number; N represents the order of the elliptic curve; k1 represents the private key.

[0024] The blinding process of the elliptic curve point to obtain a blinded curve point includes:

[0025] Generate a second random number;

[0026] Based on the curve point blinding formula, perform a blinding process on the elliptic curve point to obtain the blinded curve point.

[0027] The curve point blinding formula includes:

[0028] A′1 = (A1 + rand_point) - rand_point; rand_point = r2 × G;

[0029] Where A′1 represents the blinded curve point; A1 represents the elliptic curve point; r2 represents the second random number; G represents the preset elliptic curve point of the SM2 algorithm.

[0030] Preferably, the operation on the target data based on the blinded private key and the blinded curve point to obtain a target operation result includes:

[0031] Calculating the product of the blinded private key and the blinded curve point;

[0032] Converting the abscissa value and the ordinate value of the product value into a second bit string and a third bit string respectively;

[0033] Obtaining the byte length value of the third character string in the ciphertext;

[0034] performing an operation on the second bit string, the third bit string, and the byte length value based on a key derivation function to obtain a first operation value;

[0035] Calculating an exclusive OR value of the first operation value and the third character string;

[0036] Calculating a hash value of the second bit string, the XOR value, and the third bit string;

[0037] Determining whether the hash value is consistent with the second character string in the ciphertext;

[0038] If the hash value is consistent with the second character string, the XOR value is used as the target operation result.

[0039] Preferably, the calculating the product value of the blinded private key and the blinded curve point includes:

[0040] Calculate a second operation value based on a random sliding window algorithm, where the second operation value is a result of k'(A1+rand_point);

[0041] Calculating a third operation value based on the random sliding window algorithm, wherein the third operation value is a calculation result of k'×rand_point;

[0042] A difference between the second operation value and the third operation value is calculated to obtain the product value.

[0043] Preferably, the random sliding window algorithm includes:

[0044] For α*β, if the lowest bit of α is 1 and the window is 2, then α t Is 0x3 greater than 2? If so, set naf_w[i] = α t &0x3-4, if not, set naf_w[i]=α t &0x3, and let α t+1 =α t -naf_w[i]; if the lowest bit of α is 0, set naf_w[i] = 0, and set α t+1 =α t >>1, i++; if the window is 3, then judge α tIs &0x7 greater than 4? If so, let naf_w[i] = α t &0x7 - 8. If not, let naf_w[i] = α t &0x7, and let α t+1 = α t -naf_w[i]; if the least significant bit of α is 0, let naf_w[i] = 0, and let α t+1 = α t >> 1, i++. If the window is 4, then determine if α t &0xf is greater than 8. If so, let naf_w[i] = α t &0xf - 16. If not, let naf_w[i] = α t &0xf, and let α t+1 = α t -naf_w[i]; if the least significant bit of α is 0, let naf_w[i] = 0, and let α t+1 = α t >> 1, i++. Loop the above operations until it is 0 to exit the loop;

[0045] For naf_w[i], during the process of i from the highest to 0, under the condition of naf_w[i] == 0, let δ = 2β, and under the condition of naf_w[i]!= 0, let δ = 2β + naf_w[i];

[0046] Among them, α and β represent the data to be operated; naf_w[i] represents the random window encoding result; w represents the window size value; i represents the label of the random window encoding result; α t represents the value of α at the current moment; α t+1 represents the value of α at the next moment of the current moment; >> represents the right shift operation; δ represents the operation result of α and β.

[0047] Preferably, the operation on the second bit string, the third bit string and the byte length value by the key derivation function to obtain the first operation value includes:

[0048] Based on the key derivation function after randomizing the counter, operate on the second bit string, the third bit string and the byte length value to obtain the first operation value.

[0049] Preferably, the target data includes a message, and the target operation result includes the signature result of the message;

[0050] The determination of the elliptic curve point includes:

[0051] Using the preset elliptic curve point of the SM2 algorithm as the elliptic curve point;

[0052] The blinding process of the private key to obtain a blinded private key includes:

[0053] generating a third random number;

[0054] Blinding the private key based on a second private key blinding formula to obtain the blinded private key;

[0055] The second private key blinding formula includes:

[0056] k'2=r3×(1+k2);

[0057] Wherein, k'2 represents the blinded private key; r3 represents the third random number; k2 represents the private key;

[0058] The step of blinding the elliptic curve point to obtain the blinded curve point includes:

[0059] generating a fourth random number;

[0060] Based on a curve point blinding formula, the elliptic curve point is blinded to obtain the blinded curve point;

[0061] The curve point blinding formula includes:

[0062] A'2=(A2+rand_point)-rand_point; rand_point=r4×G;

[0063] Wherein, A'2 represents the blinded curve point; A2 represents the elliptic curve point; r4 represents the fourth random number; and G represents the preset elliptic curve point of the SM2 algorithm.

[0064] Preferably, the performing operation on the target data based on the blinded private key and the blinded curve point to obtain a target operation result includes:

[0065] Calculate Z a =Hash(ental||IDA||a||b||G x ||G y ||pk x ||pk y ), m'=Hash(Z a ||m);

[0066] generating a fifth random number, and performing a blinding process on the fifth random number to obtain a blinded fifth random number;

[0067] Calculate (x1, y1) = r′5 × A'2, R = (m' + x1) mod N. If R == 0 or R + r5 == N, then regenerate the fifth random number, and return to execute the step of blinding the fifth random number to obtain the blinded fifth random number;

[0068] If R ≠ 0 and R + r5 ≠ N, then calculate

[0069] Judge whether S is equal to 0; if S is not equal to 0, then take (R, S) as the signature result;

[0070] Among them, ental represents the signature identifier; IDA represents the unique identifier of the message; a and b represent the preset numerical values in the SM2 algorithm; G x represents the abscissa value of the preset elliptic curve point; G y represents the ordinate value of the preset elliptic curve point; pk x represents the abscissa value of the public key; pk y represents the ordinate value of the public key; Hash represents the hash operation; m represents the message; || represents the concatenation operation; r′5 represents the blinded fifth random number; mod represents the modulo operation; r5 represents the fifth random number; N represents the order of the elliptic curve.

[0071] Preferably, the blinding process of the fifth random number to obtain the blinded fifth random number includes:

[0072] Generate a sixth random number;

[0073] Based on the random number blinding formula, blind the fifth random number to obtain the blinded fifth random number;

[0074] The random number blinding formula includes:

[0075] r′5 = r6 × N + r5;

[0076] Among them, r′5 represents the blinded fifth random number; r6 represents the sixth random number; N represents the order of the elliptic curve; r5 represents the fifth random number.

[0077] Preferably, the calculation of (x1, y1) = r′5 × A'2 includes:

[0078] Calculate (x1, y1) = r′5 × A'2 based on the random sliding window algorithm.

[0079] An SM2 operation system includes:

[0080] The first acquisition module is used to acquire the target data to be operated;

[0081] A second acquisition module, configured to acquire first elliptic curve parameters of the SM2 algorithm at the current moment;

[0082] A third acquisition module, configured to acquire a private key, perform blinding processing on the private key to obtain a blinded private key;

[0083] A first determination module, configured to determine an elliptic curve point, perform blinding processing on the elliptic curve point to obtain a blinded curve point;

[0084] A first operation module, configured to perform an operation on the target data based on the blinded private key and the blinded curve point to obtain a target operation result;

[0085] A fourth acquisition module, configured to acquire second elliptic curve parameters of the SM2 algorithm at the current moment;

[0086] A first judgment module, configured to judge whether the first elliptic curve parameters are consistent with the second elliptic curve parameters, and if so, determine that the target operation result is correct.

[0087] An SM2 operation device, comprising:

[0088] A memory, configured to store a computer program;

[0089] A processor, configured to implement the steps of any of the above-mentioned SM2 operation methods when executing the computer program.

[0090] A computer-readable storage medium, in which a computer program is stored, and when the computer program is executed by a processor, the steps of any of the above-mentioned SM2 operation methods are implemented.

[0091] An SM2 operation method provided by the present application includes: acquiring target data to be operated; acquiring first elliptic curve parameters of the SM2 algorithm at the current moment; acquiring a private key, performing blinding processing on the private key to obtain a blinded private key; determining an elliptic curve point, performing blinding processing on the elliptic curve point to obtain a blinded curve point; performing an operation on the target data based on the blinded private key and the blinded curve point to obtain a target operation result; acquiring second elliptic curve parameters of the SM2 algorithm at the current moment; judging whether the first elliptic curve parameters are consistent with the second elliptic curve parameters, and if so, determining that the target operation result is correct. In the present application, the blinded private key and the blinded curve point are applied to perform SM2 operation on the target data, and the elliptic curve parameters are safely verified, so that side-channel attacks can be resisted and the security is good. An SM2 operation method system, device and computer-readable storage medium provided by the present application also solve corresponding technical problems. Description of the Drawings

[0092] To more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the accompanying drawings required in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only the embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can also be obtained based on the provided accompanying drawings.

[0093] Figure 1 It is a flowchart of a SM2 operation method provided by an embodiment of the present application;

[0094] Figure 2 It is a flowchart of decrypting using the SM2 algorithm in the present application;

[0095] Figure 3 It is a flowchart of signing using the SM2 algorithm in the present application;

[0096] Figure 4 It is a schematic structural diagram of a SM2 operation system provided by an embodiment of the present application;

[0097] Figure 5 It is a schematic structural diagram of a SM2 operation device provided by an embodiment of the present application;

[0098] Figure 6 It is another schematic structural diagram of a SM2 operation device provided by an embodiment of the present application. Detailed implementation manners

[0099] The following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present application.

[0100] Please refer to Figure 1 , Figure 1 It is a flowchart of a SM2 operation method provided by an embodiment of the present application.

[0101] A SM2 operation method provided by an embodiment of the present application may include the following steps:

[0102] Step S101: Obtain the target data to be operated.

[0103] In practical applications, the target data to be subjected to SM2 operation can be obtained first. The type of the target data can be determined according to actual needs, and the present application does not make specific limitations here.

[0104] Step S102: Obtain the first elliptic curve parameters of the SM2 algorithm at the current moment.

[0105] In practical applications, after obtaining the target data to be computed, the first elliptic curve parameter of the SM2 algorithm at the current moment can be obtained. The first elliptic curve parameter is also the elliptic curve parameter of the SM2 algorithm at the current moment, so as to verify whether there is a side-channel attack based on the elliptic curve parameter subsequently.

[0106] Step S103: Obtain the private key, perform blinding processing on the private key to obtain the blinded private key.

[0107] In practical applications, the private key needs to be applied during the running process of the SM2 algorithm. To avoid the private key being attacked, after obtaining the private key, blinding processing can be performed on the private key to obtain the blinded private key, so as to perform SM2 operations using the blinded private key subsequently. The method for blinding the private key can be determined according to actual needs, and the present application does not make specific limitations here.

[0108] Step S104: Determine the elliptic curve point, perform blinding processing on the elliptic curve point to obtain the blinded curve point.

[0109] In practical applications, the elliptic curve point needs to be applied during the running process of the SM2 algorithm. To avoid the elliptic curve point being attacked, after determining the elliptic curve point, blinding processing can be performed on the elliptic curve point to obtain the blinded curve point, so as to perform SM2 operations using the blinded curve point subsequently. The method for blinding the elliptic curve point can be determined according to actual needs, and the present application does not make specific limitations here.

[0110] Step S105: Perform an operation on the target data based on the blinded private key and the blinded curve point to obtain the target operation result.

[0111] In practical applications, after obtaining the blinded private key and the blinded curve point, an operation can be performed on the target data based on the blinded private key and the blinded curve point to obtain the target operation result, so as to defend against side-channel attacks by means of the blinded private key and the blinded curve point.

[0112] Step S106: Obtain the second elliptic curve parameter of the SM2 algorithm at the current moment.

[0113] Step S107: Determine whether the first elliptic curve parameter is consistent with the second elliptic curve parameter. If so, execute Step S108: Determine that the target operation result is correct.

[0114] In practical applications, to prevent an attacker from maliciously modifying the elliptic curve parameters during the SM2 operation, it is also necessary to obtain the second elliptic curve parameters of the SM2 algorithm at the current moment, and determine whether the first elliptic curve parameters are consistent with the second elliptic curve parameters. If so, it is determined that the target operation result is correct, and at this time, the target operation result can be applied. If the first elliptic curve parameters are inconsistent with the second elliptic curve parameters, it can be considered that the SM2 operation process has been attacked and the target operation result is incorrect. At this time, the operation can be directly terminated, or the SM2 operation can be restarted, etc. The present application does not make specific limitations here.

[0115] It should be noted that when determining whether the first elliptic curve parameters are consistent with the second elliptic curve parameters, the hash values of the first elliptic curve parameters and the second elliptic curve parameters can be calculated respectively, and then it is determined whether the two hash values are consistent. If they are consistent, it is considered that the first elliptic curve parameters are consistent with the second elliptic curve parameters. If the two hash values are inconsistent, it is considered that the first elliptic curve parameters are inconsistent with the second elliptic curve parameters. Of course, there can be other methods to determine whether the first elliptic curve parameters are consistent with the second elliptic curve parameters. The present application does not make specific limitations here.

[0116] A SM2 operation method provided by the present application includes: obtaining target data to be operated; obtaining the first elliptic curve parameters of the SM2 algorithm at the current moment; obtaining a private key, and performing blinding processing on the private key to obtain a blinded private key; determining an elliptic curve point, and performing blinding processing on the elliptic curve point to obtain a blinded curve point; performing an operation on the target data based on the blinded private key and the blinded curve point to obtain a target operation result; obtaining the second elliptic curve parameters of the SM2 algorithm at the current moment; determining whether the first elliptic curve and the second elliptic curve parameters are consistent. If so, it is determined that the target operation result is correct. In the present application, the blinded private key and the blinded curve point are used to perform the SM2 operation on the target data, and the security verification of the elliptic curve parameters is performed, which can resist side-channel attacks and has good security.

[0117] Please refer to Figure 2 , Figure 2 which is the flowchart of decrypting using the SM2 algorithm in the present application.

[0118] In a SM2 operation method provided by an embodiment of the present application, since the SM2 algorithm can be used to encrypt data, and the encryption process can refer to the prior art, the SM2 algorithm can be used for decryption, that is, the target data includes the ciphertext encrypted by the SM2 algorithm, and the target operation result includes the plaintext corresponding to the ciphertext; the existing decryption process is as shown in the left figure of Figure 2 and includes the following steps:

[0119] Step 1: Input the ciphertext cipher0||cipher1||cipher2, where len is the byte length of cipher2, the private key is k, and the elliptic curve parameters are sm2Prams;

[0120] Step 2: Extract the bit string from cipher0, convert the data type to the point A on the elliptic curve, verify whether A satisfies the elliptic curve equation. If not, exit; if so, calculate the point multiplication kA, convert the x and y coordinates after point multiplication to the bit strings x1 and x2, and calculate t = KDF(x1||y2, len), where KDF is the key derivation function, that is, for the input bit string m, perform block division with blocklen=(len % 32!= 0). That is, if blocklen!= 0, then let blocklen >> 5 + 1; if blocklen = 0, then let blocklen >> 5. For i from 1 to blocklen, execute H 256 (m i ||ct), where ct is a counter composed of 32 - bit bits with an initial value of 0x00000001. Then:

[0121] t = H 256 (m1||0x00000001)||H 256 (m2||0x00000002)||…H 256 (m blocklen ||blocklen);

[0122] Step 3: Extract the bit string cipher2 from the ciphertext, calculate Calculate u = Hash(x2||M'||y2), extract the bit string cipher1 from the ciphertext. If u!= cipher1, then report an error and exit; otherwise, the decryption is completed, and the decryption result is output as M'.

[0123] And to resist side - channel attacks, the decryption process of this application can be as Figure 2 shown on the right. During the process of performing operations on the target data based on the blinded private key and the blinded curve point to obtain the target operation result, it is necessary to calculate the product value of the blinded private key and the blinded curve point; convert the abscissa value and the ordinate value of the product value to the second bit string and the third bit string respectively; obtain the byte length value of the third string in the ciphertext; based on the key derivation function, perform operations on the second bit string, the third bit string, and the byte length value to obtain the first operation value; calculate the exclusive - or value of the first operation value and the third string; calculate the hash value of the second bit string, the exclusive - or value, and the third bit string; determine whether the hash value is consistent with the second string in the ciphertext; if the hash value is consistent with the second string, then use the exclusive - or value as the target operation result.

[0124] In a specific application scenario, during the process of determining an elliptic curve point, a first bit string can be extracted from the first string of the ciphertext, and the target bit string can be converted into an elliptic curve point;

[0125] Correspondingly, during the process of blinding the private key to obtain a blinded private key, a first random number can be generated; based on a first private key blinding formula, the private key can be blinded to obtain a blinded private key;

[0126] The first private key blinding formula includes:

[0127] k′1 = r1 × N + k1;

[0128] where k′1 represents the blinded private key; r1 represents the first random number; N represents the order of the elliptic curve; k1 represents the private key;

[0129] Correspondingly, during the process of blinding the elliptic curve point to obtain a blinded curve point, a second random number can be generated; based on a curve point blinding formula, the elliptic curve point can be blinded to obtain a blinded curve point;

[0130] The curve point blinding formula includes:

[0131] A′1 = (A1 + rand_point) - rand_point; rand_point = r2 × G;

[0132] where A′1 represents the blinded curve point; A1 represents the elliptic curve point; r2 represents the second random number; G represents a preset elliptic curve point of the SM2 algorithm.

[0133] In a specific application scenario, during the process of calculating the product value of the blinded private key and the blinded curve point, in order to resist timing attacks, power analysis, electromagnetic analysis, and fault attacks, a second operation value can be calculated based on a random sliding window algorithm, and the second operation value is the operation result of k'(A1 + rand_point); a third operation value can be calculated based on a random sliding window algorithm, and the third operation value is the operation result of k' × rand_point; the difference between the second operation value and the third operation value is calculated to obtain the product value.

[0134] Specifically, the random sliding window algorithm can include:

[0135] For α * β, if the least significant bit of α is 1 and the window is 2, then it is judged whether α t & 0x3 is greater than 2. If so, then let naf_w[i] = α t & 0x3 - 4. If not, then let naf_w[i] = α t & 0x3, and let α t+1 = α t-naf_w[i]; If the least significant bit of α is 0, then set naf_w[i] = 0, and set α t+1 = α t >> 1, i++; If the window is 3, then determine whether α t & 0x7 is greater than 4. If so, then set naf_w[i] = α t & 0x7 - 8. If not, then set naf_w[i] = α t & 0x7, and set α t+1 = α t - naf_w[i]; If the least significant bit of α is 0, then set naf_w[i] = 0, and set α t+1 = α t >> 1, i++; If the window is 4, then determine whether α t & 0xf is greater than 8. If so, then set naf_w[i] = α t & 0xf - 16. If not, then set naf_w[i] = α t & 0xf, and set α t+1 = α t - naf_w[i]; If the least significant bit of α is 0, then set naf_w[i] = 0, and set α t+1 = α t >> 1, i++; Loop the above operations until is 0 to exit the loop;

[0136] For naf_w[i], during the process of i from the highest to 0, under the condition of naf_w[i] == 0, set δ = 2β, and under the condition of naf_w[i]!= 0, set δ = 2β + naf_w[i];

[0137] Wherein, α and β represent the data to be operated; naf_w[i] represents the result of random window encoding; w represents the window size value; i represents the label of the random window encoding result; α t represents the value of α at the current moment; α t+1 represents the value of α at the next moment of the current moment; >> represents the right shift operation; δ represents the operation result of α and β.

[0138] And in this application, during the process of operating on the second bit string, the third bit string and the byte length value based on the key derivation function to obtain the first operation value, it is possible to operate on the second bit string, the third bit string and the byte length value based on the key derivation function after randomizing the counter to obtain the first operation value.

[0139] Please refer to Figure 3 , Figure 3 which is the flow chart of signing using the SM2 algorithm in this application.

[0140] In a SM2 operation method provided by an embodiment of the present application, since the SM2 algorithm can be used to sign data and the signing process can refer to the prior art, the target data may include a message, and the target operation result may include the signature result of the message. The existing signing process is as shown in the left figure of Figure 3 and includes the following steps:

[0141] Step 1: Input message m, unique identifier IDA, signature identifier entla, message length len, private key k, public key pk, and elliptic curve parameter sm2Prams;

[0142] Step 2. Calculate Z a = Hash(ental||IDA||a||b||G x ||G y ||pk x ||pk y ), and then calculate m' = Hash(Z a ||m). Generate a random number r, calculate the elliptic curve point (x1, y1) = r×G, calculate R = (m'+x1) mod N. If R == 0 or R+r == N, then regenerate the random number r. Otherwise, calculate S = ((1+k) -1 ×(k-R×k)) mod n. If s == 0, then regenerate the random number r. Otherwise, output the signature (R, S) and the message m.

[0143] In order to resist side-channel attacks, the process of applying the SM2 algorithm for signing in the present application can be as shown in the right figure of Figure 3 . During the process of performing operations on the target data based on the blinded private key and the blinded curve point to obtain the target operation result, it is possible to:

[0144] Calculate Z a = Hash(ental||IDA||a||b||G x ||G y ||pk x ||pk y ), m' = Hash(Z a ||m);

[0145] Generate a fifth random number, perform a blinding process on the fifth random number to obtain the blinded fifth random number;

[0146] Calculate (x1, y1) = r′5×A′2, R = (m'+x1) mod N. If R == 0 or R+r5 == N, then regenerate the fifth random number and return to execute the step of performing a blinding process on the fifth random number to obtain the blinded fifth random number;

[0147] If R≠0 and R + r5≠N, then calculate

[0148] Determine whether S is equal to 0; if S is not equal to 0, then take (R, S) as the signature result;

[0149] Among them, ental represents the signature identifier; IDA represents the unique identifier of the message; a, b represent the preset values in the SM2 algorithm; G x represents the abscissa value of the preset elliptic curve point; G y represents the ordinate value of the preset elliptic curve point; pk x represents the abscissa value of the public key; pk y represents the ordinate value of the public key; Hash represents the hash operation; m represents the message; || represents the concatenation operation; r′5 represents the fifth blinding random number; mod represents the modulo operation; r5 represents the fifth random number; N represents the order of the elliptic curve.

[0150] In a specific application scenario, during the process of determining the elliptic curve point, the preset elliptic curve point of the SM2 algorithm can be used as the elliptic curve point;

[0151] Correspondingly, during the process of blinding the private key to obtain the blinded private key, a third random number can be generated; based on the second private key blinding formula, the private key is blinded to obtain the blinded private key;

[0152] The second private key blinding formula includes:

[0153] k′2 = r3×(1 + k2);

[0154] Among them, k'2 represents the blinded private key; r3 represents the third random number; k2 represents the private key;

[0155] Correspondingly, during the process of blinding the elliptic curve point to obtain the blinded curve point, a fourth random number can be generated; based on the curve point blinding formula, the elliptic curve point is blinded to obtain the blinded curve point;

[0156] The curve point blinding formula includes:

[0157] A'2 = (A2 + rand_point) - rand_point; rand_point = r4×G;

[0158] Among them, A'2 represents the blinded curve point; A2 represents the elliptic curve point; r4 represents the fourth random number; G represents the preset elliptic curve point of the SM2 algorithm.

[0159] In a specific application scenario, when blinding the fifth random number to obtain the blinded fifth random number, a sixth random number can be generated; based on the random number blinding formula, the fifth random number is blinded to obtain the blinded fifth random number.

[0160] The random number blinding formula includes:

[0161] r′5 = r6 × N + r5;

[0162] Where r′5 represents the blinded fifth random number; r6 represents the sixth random number; N represents the order of the elliptic curve; r5 represents the fifth random number.

[0163] In a specific application scenario, when calculating (x1, y1) = r′5 × A'2, in order to resist timing attacks, power analysis, electromagnetic analysis, and fault attacks, (x1, y1) = r′5 × A'2 can be calculated based on the random sliding window algorithm. The relevant description of the random sliding window algorithm can refer to the above embodiments and will not be elaborated here.

[0164] Please refer to Figure 4 , Figure 4 , which is a schematic structural diagram of an SM2 operation system provided by an embodiment of the present application.

[0165] An SM2 operation system provided by an embodiment of the present application may include the following steps:

[0166] The first acquisition module 101 is used to acquire target data to be operated.

[0167] The second acquisition module 102 is used to acquire the first elliptic curve parameter of the SM2 algorithm at the current moment.

[0168] The third acquisition module 103 is used to acquire a private key, blind the private key, and obtain a blinded private key.

[0169] The first determination module 104 is used to determine an elliptic curve point, blind the elliptic curve point, and obtain a blinded curve point.

[0170] The first operation module 105 is used to operate on the target data based on the blinded private key and the blinded curve point to obtain a target operation result.

[0171] The fourth acquisition module 106 is used to acquire the second elliptic curve parameter of the SM2 algorithm at the current moment.

[0172] The first judgment module 107 is used to judge whether the first elliptic curve and the second elliptic curve parameters are consistent. If so, it is determined that the target operation result is correct.

[0173] This application also provides an SM2 operation device and a computer-readable storage medium, both of which have the corresponding effects of an SM2 operation method provided by the embodiments of this application. Please refer to Figure 5 , Figure 5 which is a schematic structural diagram of an SM2 operation device provided by an embodiment of this application.

[0174] An SM2 operation device provided by an embodiment of this application includes a memory 201 and a processor 202. A computer program is stored in the memory 201, and when the processor 202 executes the computer program, the steps of the SM2 operation method described in any of the above embodiments are implemented.

[0175] Please refer to Figure 6 , in another SM2 operation device provided by an embodiment of this application, it may further include: an input port 203 connected to the processor 202, which is used to transmit commands input from the outside to the processor 202; a display unit 204 connected to the processor 202, which is used to display the processing result of the processor 202 to the outside; a communication module 205 connected to the processor 202, which is used to implement the communication between the SM2 operation device and the outside. The display unit 204 may be a display panel, a laser scanning display, etc.; the communication methods adopted by the communication module 205 include but are not limited to Mobile High-Definition Link technology (HML), Universal Serial Bus (USB), High-Definition Multimedia Interface (HDMI), wireless connections: Wireless Fidelity technology (WiFi), Bluetooth communication technology, Low Energy Bluetooth communication technology, communication technology based on IEEE802.11s.

[0176] A computer-readable storage medium provided by an embodiment of this application stores a computer program, and when the computer program is executed by a processor, the steps of the SM2 operation method described in any of the above embodiments are implemented.

[0177] The computer-readable storage medium involved in this application includes Random Access Memory (RAM), memory, Read-Only Memory (ROM), Electrically Programmable ROM, Electrically Erasable Programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium well-known in the technical field.

[0178] For the description of the relevant parts in the SM2 operation system, device and computer-readable storage medium provided by the embodiments of this application, please refer to the detailed description of the corresponding parts in the SM2 operation method provided by the embodiments of this application, which will not be elaborated here. In addition, for the parts of the above technical solutions provided by the embodiments of this application that are consistent with the corresponding technical solutions in the prior art in terms of implementation principles, no detailed description is given to avoid excessive elaboration.

[0179] It should also be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the said element.

[0180] The foregoing description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for SM2 operation, characterized in that, Including: Obtain target data to be calculated; Obtain the first elliptic curve parameter of the SM2 algorithm at the current moment; Obtain the private key, perform blinding processing on the private key to obtain a blinded private key; Determine an elliptic curve point, perform blinding processing on the elliptic curve point to obtain a blinded curve point; Perform an operation on the target data based on the blinded private key and the blinded curve point to obtain a target operation result; Obtain the second elliptic curve parameter of the SM2 algorithm at the current moment; Determine whether the first elliptic curve parameter is the same as the second elliptic curve parameter. If so, determine that the target operation result is correct; Wherein, the target data includes a message, and the target operation result includes a signature result of the message; the performing an operation on the target data based on the blinded private key and the blinded curve point to obtain a target operation result includes: Calculate Z a = Hash(ental || IDA || a || b || G x || G y || pk x || pk y ), m' = Hash(Z a || m); Generate a fifth random number, perform blinding processing on the fifth random number to obtain a blinded fifth random number; Calculate (x1, y1) = r5' × A'2 based on the random sliding window algorithm, R = (m' + x1) mod N. If R == 0 or R + r5 = N, regenerate the fifth random number, and return to execute the step of performing blinding processing on the fifth random number to obtain a blinded fifth random number; If R≠0 and R + r5≠N, then calculate S = (R + r5) × r3 × k'2 -1 -R; Determine whether S is equal to 0; if S is not equal to 0, then use (R, S) as the signature result; Among them, ental represents the signature identifier; IDA represents the unique identifier of the message; a and b represent preset numerical values in the SM2 algorithm; G x represents the abscissa value of the preset elliptic curve point; G y represents the ordinate value of the preset elliptic curve point; pk x represents the abscissa value of the public key; pk y represents the ordinate value of the public key; Hash represents the hashing operation; m represents the message; || represents the concatenation operation; r5' represents the blinded fifth random number; mod represents the modulo operation; r5 represents the fifth random number; N represents the order of the elliptic curve; A'2 represents the blinded curve point; r3 represents the third random number; k'2 represents the blinded private key.

2. The method according to claim 1, wherein The target data includes a ciphertext encrypted by the SM2 algorithm, and the target operation result includes a plaintext corresponding to the ciphertext; The determining an elliptic curve point includes: Extract a first bit string from the first string of the ciphertext, and convert the target bit string into the elliptic curve point; The performing blinding processing on the private key to obtain a blinded private key includes: Generate a first random number; Perform blinding processing on the private key based on the first private key blinding formula to obtain the blinded private key; The first private key blinding formula includes: k1' = r1 × N + k1; Wherein, k1' represents the blinded private key; r1 represents the first random number; N represents the order of the elliptic curve; k1 represents the private key; The performing blinding processing on the elliptic curve point to obtain a blinded curve point includes: Generate a second random number; Perform blinding processing on the elliptic curve point based on the curve point blinding formula to obtain the blinded curve point; The curve point blinding formula includes: A1' = (A1 + rand_point) - rand_point; rand_point = r2 × G; Wherein, A1' represents the blinded curve point; A1 represents the elliptic curve point; r2 represents the second random number; G represents the preset elliptic curve point of the SM2 algorithm.

3. The method according to claim 2, wherein The performing an operation on the target data based on the blinded private key and the blinded curve point to obtain a target operation result includes: Calculate the product value of the blinded private key and the blinded curve point; Convert the abscissa value and the ordinate value of the product value into a second bit string and a third bit string respectively; Obtain the byte length value of the third string in the ciphertext; Based on the key derivation function after randomizing the counter, perform operations on the second bit string, the third bit string, and the byte length value to obtain a first operation value; Calculate the exclusive OR value of the first operation value and the third string; Calculate the hash value of the second bit string, the exclusive OR value, and the third bit string; Determine whether the hash value is consistent with the second string in the ciphertext; If the hash value is consistent with the second string, use the exclusive OR value as the target operation result.

4. The method according to claim 3, wherein The calculating the product value of the blinded private key and the blinded curve point includes: Calculate a second operation value based on the random sliding window algorithm, where the second operation value is the result of k'(A1 + rand_point); Calculate a third operation value based on the random sliding window algorithm, where the third operation value is the result of k'×rand_point; Calculate the difference between the second operation value and the third operation value to obtain the product value; Wherein, the random sliding window algorithm includes: For α * β, if the least significant bit of α is 1 and the window is 2, then determine α t & 0x3 is greater than 2. If so, then set naf_w[i] = α t & 0x3 - 4. If not, then set naf_w[i] = α t & 0x3, and set α t+1 = α t - naf_w[i]; if the least significant bit of α is 0, then set naf_w[i] = 0, and set α t+1 = α t >> 1, i++; if the window is 3, then determine α t & 0x7 is greater than 4. If so, then set naf_w[i] = α t & 0x7 - 8. If not, then set naf_w[i] = α t & 0x7, and set α t+1 = α t - naf_w[i]; if the least significant bit of α is 0, then set naf_w[i] = 0, and set α t+1 = α t >> 1, i++; if the window is 4, then determine α t & 0xf is greater than 8. If so, then set naf_w[i] = α t & 0xf - 16. If not, then set naf_w[i] = α t & 0xf, and set α t+1 = α t - naf_w[i]; if the least significant bit of α is 0, then set naf_w[i] = 0, and set α t+1 = α t >> 1, i++; loop the above operations until it is 0 to exit the loop; For naf_w[i], during the process of i from the highest to 0, when naf_w[i] == 0, let δ = 2β, and when naf_w[i]!= 0, let δ = 2β + naf_w[i]; Among them, α and β represent the data to be operated; naf_w[i] represents the random window encoding result; w represents the window size value; i represents the label of the random window encoding result; α t represents the value of α at the current moment; α t+1 represents the value of α at the next moment of the current moment; >> represents the right shift operation; δ represents the operation result of α and β.

5. The method according to claim 1, wherein The target data includes a message, and the target operation result includes the signature result of the message; The determining the elliptic curve point includes: Use the preset elliptic curve point of the SM2 algorithm as the elliptic curve point; The blinding the private key to obtain a blinded private key includes: Generate a third random number; Based on the second private key blinding formula, blind the private key to obtain the blinded private key; The second private key blinding formula includes: k'2 = r3×(1 + k2); Wherein, k'2 represents the blinded private key; r3 represents the third random number; k2 represents the private key; The blinding the elliptic curve point to obtain a blinded curve point includes: Generate a fourth random number; Based on the curve point blinding formula, blind the elliptic curve point to obtain the blinded curve point; The curve point blinding formula includes: A'2 = (A2 + rand_point) - rand_point; rand_point = r4×G; Wherein, A'2 represents the blinded curve point; A2 represents the elliptic curve point; r4 represents the fourth random number; G represents the preset elliptic curve point of the SM2 algorithm.

6. The method according to claim 5, wherein The blinding the fifth random number to obtain a blinded fifth random number includes: Generate a sixth random number; Based on the random number blinding formula, blind the fifth random number to obtain the blinded fifth random number; The random number blinding formula includes: r5'＝r6×N+r5； Wherein, r5' represents the blinded fifth random number; r6 represents the sixth random number; N represents the order of the elliptic curve; r5 represents the fifth random number.

7. A SM2 operation system, characterized in that, Includes: A first acquisition module, configured to acquire target data to be operated; A second acquisition module, configured to acquire the first elliptic curve parameter of the SM2 algorithm at the current moment; A third acquisition module, configured to acquire a private key, perform blinding processing on the private key to obtain a blinded private key; A first determination module, configured to determine an elliptic curve point, perform blinding processing on the elliptic curve point to obtain a blinded curve point; A first operation module, configured to perform an operation on the target data based on the blinded private key and the blinded curve point to obtain a target operation result; A fourth acquisition module, configured to acquire a second elliptic curve parameter of the SM2 algorithm at the current moment; A first judgment module, configured to judge whether the first elliptic curve parameter is consistent with the second elliptic curve parameter, and if so, determine that the target operation result is correct; Wherein, the target data includes a message, and the target operation result includes a signature result of the message; the first operation module is used for: Calculate Z a = Hash(ental||IDA||a||b||G x ||G y ||pk x ||pk y ), m' = Hash(Z a ||m); Generate a fifth random number, perform blinding processing on the fifth random number to obtain a blinded fifth random number; Calculate (x1, y1) = r5'×A'2 based on the random sliding window algorithm, R = (m'+x1) mod N, if R == 0 or R+r5 = N, then regenerate the fifth random number, and return to execute the step of performing blinding processing on the fifth random number to obtain a blinded fifth random number; If R≠0 and R + r5≠N, then calculate S = (R + r5)×r3×k'2 -1 -R; Judge whether S is equal to 0; if S is not equal to 0, then use (R, S) as the signature result; Among them, ental represents the signature identifier; IDA represents the unique identifier of the message; a and b represent preset numerical values in the SM2 algorithm; G x represents the abscissa value of the preset elliptic curve point; G y represents the ordinate value of the preset elliptic curve point; pk x represents the abscissa value of the public key; pk y represents the ordinate value of the public key; Hash represents the hashing operation; m represents the message; || represents the concatenation operation; r5' represents the blinded fifth random number; mod represents the modulo operation; r5 represents the fifth random number; N represents the order of the elliptic curve; A'2 represents the blinded curve point; r3 represents the third random number; k'2 represents the blinded private key.

8. A SM2 operation device, characterized in that, Including: A memory, configured to store a computer program; A processor, configured to implement the steps of the SM2 operation method according to any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that, The computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the steps of the SM2 operation method according to any one of claims 1 to 6 are implemented.

Images