Elliptic curve digital signature calculation method and device for resisting memory information leakage attack

Abstract

The present invention discloses an elliptic curve digital signature calculation method and device for resisting memory information leakage attack, belonging to the field of cryptographic technology. The method comprises: in an initialized trusted environment, placing a symmetric cryptographic algorithm key in a privileged register, and using the symmetric cryptographic algorithm key to generate a ciphertext of a random number k1 and a ciphertext of a private key, and calculating a value of a scalar multiplication k1×G; each time a signature is made, based on the selected signature algorithm and the value of the scalar multiplication k1×G, calculating plaintext data for generating parameter s, wherein the plaintext data for generating parameter s includes: parameter r or data calculated based on parameter r; the register calculates parameter s according to the plaintext data, the ciphertext of the random number k1 and the ciphertext of the private key; and outputs (r, s) as a digital signature of a message. The present invention ensures that the calculation in the memory will not leak the information of the random number and the private key, the calculation of sensitive data is completed in the register, and the performance overhead is reduced, the scope of application is improved, and the specific compatibility and scalability are good.

Description

Technical Field

[0001] The present invention belongs to the field of cryptographic technology, and proposes an elliptic curve digital signature calculation method and device that are resistant to memory information leakage attacks, which provide protection for keys and effectively ensure the practicability of cryptographic algorithms. Background Art

[0002] Cryptographic software systems are widely used in various computer and network applications to provide protection for data security. However, cryptographic software does not provide a proprietary protection solution for keys. Keys are the prerequisite for cryptographic technology to work, and key leakage will seriously threaten the security of cryptographic systems. When cryptographic software is implemented, keys usually appear in plain text in memory and can be easily obtained by adversaries through memory information leakage attacks. Memory information leakage attacks can be implemented through various means. Attackers can launch software-level memory information leakage attacks through various vulnerabilities; they can also physically approach the target machine to launch cold boot attacks and DMA (Direct Memory Access) attacks. Therefore, it is urgent to provide an effective protection solution for keys.

[0003] Public key cryptography is an important part of modern cryptography, which can effectively solve the distribution and management of keys as well as the problems of signature and authentication. Elliptic curve cryptography (ECC) is a type of public key cryptography algorithm that has attracted much attention. It has the advantages of short key length, fast calculation speed, and saving computing resources. One of the main uses of elliptic curve cryptography is to construct digital signature algorithms. Specific ECC digital signature algorithms include SM2 signature algorithm, ECDSA signature algorithm, or EC-Schnorr signature algorithm. The signature algorithm relies on the private key to sign the message. Once the attacker obtains the private key information through a memory information leakage attack, the signature can be forged. Therefore, how to securely implement an ECC-based signature scheme so that it has the ability to resist memory information leakage is very critical.

[0004] In order to resist memory information leakage attacks, some solutions have been proposed. The hardware-based solution uses Intel SGX (Software Guard eXtensions) and MPK (Memory Protection Keys) to protect keys. However, these key protection solutions require proprietary hardware support. In addition, SGX introduces additional side-channel attacks, and MPK can only resist software-level memory information leakage attacks, but cannot resist cold start attacks. The software-based solution uses the registers inside the processor to complete all cryptographic calculations, and attackers cannot obtain the data in the registers. However, due to the scarcity of register resources, implementing cryptographic operations entirely inside the registers will cause defects in performance, scalability, and compatibility. In addition, the design of implementing cryptographic operations entirely inside the registers requires a lot of code refactoring, which makes development difficult. Summary of the invention

[0005] In view of the above problems, the present invention proposes an elliptic curve digital signature calculation method and device that is resistant to memory information leakage attacks to ensure key security. The present invention does not rely on any hardware characteristics, and does not implement all cryptographic operations inside the register. Instead, the ECC signature algorithm is split into two parts, and only simple operations are implemented in the register, and complex operations are implemented in the memory. However, even if the attacker obtains all the data in the memory, the key of the ECC signature algorithm cannot be recovered. While resisting memory information leakage, the development difficulty is greatly reduced, the performance overhead is reduced, and the compatibility and scalability of the solution are improved.

[0006] The technical contents of the present invention include:

[0007] A method for calculating an elliptic curve digital signature that resists memory information leakage attacks, the steps of which include:

[0008] In the initialized trusted environment, the key of the symmetric cryptographic algorithm is placed in the privileged register, and the symmetric cryptographic algorithm key is used to generate the ciphertext of the random number k1 and the ciphertext of the private key, and calculate the value of the scalar multiplication k1×G, where k1∈[1,n-1], n is the order of the elliptic curve, and G is the base point of the elliptic curve;

[0009] Each time a signature is made, based on the selected signature algorithm and the value of the scalar multiplied by k1×G, plaintext data for generating parameter s is calculated, wherein the plaintext data for generating parameter s includes: parameter r or data calculated based on parameter r;

[0010] The register calculates the parameter s according to the plaintext data, the ciphertext of the random number k1 and the ciphertext of the private key;

[0011] Use (r,s) to sign the message.

[0012] Furthermore, the digital signature algorithm includes: SM2 signature algorithm, ECDSA signature algorithm or EC-Schnorr signature algorithm, and the symmetric encryption algorithm includes: AES algorithm or SM4 algorithm.

[0013] Furthermore, when the SM2 signature algorithm is selected, the plaintext data used to generate the parameter s is calculated by the following steps:

[0014] 1) Based on the known parameters of the SM2 signature algorithm Calculate parameter e;

[0015] 2) Select a random number k2, where k2∈[1,n-1];

[0016] 3) Calculate the value of the scalar multiplied by k2×G;

[0017] 4) Add the value of the scalar multiplication k1×G and the value of the scalar multiplication k2×G to obtain a value of k×G, where k is a random number;

[0018] 5) Calculate the parameter r according to the value of k×G;

[0019] 6) The parameter r and the random number k2 are used as plaintext data to generate the parameter s.

[0020] Furthermore, when the SM2 signature algorithm is selected, the parameter s is calculated in the register by the following steps:

[0021] 1) Use the symmetric encryption algorithm key inside the register to decrypt the ciphertext of the random number k1 and the ciphertext of the private key to obtain the random number k1 and the private key;

[0022] 2) Recover the random number k in the register based on the random number k1, the random number k2 and the order n of the elliptic curve;

[0023] 3) Based on the random number k, parameter r, private key and order n of the elliptic curve, calculate parameter s in the register.

[0024] Furthermore, when the ECDSA signature algorithm is selected, the plaintext data used to generate the parameter s is calculated through the following steps:

[0025] 1) Perform hash calculation on message m to obtain parameter z;

[0026] 2) Select a random number k2, where k2∈[1,n-1];

[0027] 3) Calculate the value of the scalar multiplied by k2×G;

[0028] 4) Add the value of the scalar multiplication k1×G and the value of the scalar multiplication k2×G to obtain a value of k×G, where k is a random number;

[0029] 5) Calculate the parameter r according to the value of k×G;

[0030] 6) Use parameter z, parameter r and random number k2 as plaintext data for generating parameter s.

[0031] Furthermore, when the ECDSA signature algorithm is selected, the parameter s is calculated in the register by the following steps:

[0032] 1) Use the symmetric encryption algorithm key inside the register to decrypt the ciphertext of the random number k1 and the ciphertext of the private key to obtain the random number k1 and the private key;

[0033] 2) Recover the random number k in the register based on the random number k1, the random number k2 and the order n of the elliptic curve;

[0034] 3) Based on parameter z, random number k, parameter r, private key and order n of the elliptic curve, parameter s is calculated in the register.

[0035] Furthermore, when the EC-Schnorr signature algorithm is selected, the plaintext data used to generate the parameter s is calculated through the following steps:

[0036] 1) Perform hash calculation on message m to obtain message digest H(m);

[0037] 2) Select a random number k2, where k2∈[1,n-1];

[0038] 3) Calculate the value of the scalar multiplied by k2×G;

[0039] 4) Add the value of the scalar multiplication k1×G and the value of the scalar multiplication k2×G to obtain a value of k×G, where k is a random number;

[0040] 5) According to the value of k×G, obtain the parameter r;

[0041] 6) Calculate the value of H(Q||r||H(m)) using the message digest H(m), parameter r and public key Q;

[0042] 7) The value of H(Q||r||H(m)) and the random number k2 are used as plain text data for generating parameter s.

[0043] Furthermore, when the EC-Schnorr signature algorithm is selected, the parameter s is calculated in the register by the following steps:

[0044] 1) Use the symmetric encryption algorithm key inside the register to decrypt the ciphertext of the random number k1 and the ciphertext of the private key to obtain the random number k1 and the private key;

[0045] 2) Recover the random number k in the register based on the random number k1, the random number k2 and the order n of the elliptic curve;

[0046] 3) Based on the random number k, the private key and the value of H(Q||r||H(m)), the parameter s is calculated in the register.

[0047] Furthermore, the calculation is used to generate the plaintext data of the parameter s, and is performed in the memory.

[0048] A storage medium stores a computer program, wherein the computer program is configured to execute any of the above methods when running.

[0049] An electronic device, characterized in that it comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute any of the above methods.

[0050] The beneficial effects and advantages of the present invention are:

[0051] 1) For ECC-based signature algorithms, using registers to protect random numbers and private keys can effectively resist memory information leakage attacks and ensure the security of keys.

[0052] 2) In order to improve the practicality of the solution, the present invention does not perform all signature operations in the register, but for the first time proposes the idea of ​​splitting the signature algorithm into two parts. Complex calculations are implemented in the memory, and simple calculations are implemented in the register, which greatly saves register space, provides better compatibility and scalability, and reduces development difficulty. Through algorithm modification and system design, the invention ensures that even if the attacker obtains all memory data through a memory information leakage attack, the private key cannot be recovered. In addition, the invention only introduces a small amount of performance overhead while ensuring security.

[0053] 3) The invention has a wide range of applications and is universal for ECC-based signature algorithms, and is perfectly compatible with mainstream ECC signature algorithms such as SM2, ECDSA, and EC-Schnorr. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 Schematic diagram of the process for securely generating digital signatures. DETAILED DESCRIPTION

[0055] In order to make the purpose, features and advantages of the present invention more clearly understood, the following further describes the technical solutions in conjunction with the accompanying drawings and the content of the invention.

[0056] The elliptic curve digital signature method of the present invention is universal for ECC-based signature algorithms, such as SM2, ECDSA, EC-Schnorr, etc. The present invention can effectively ensure the key security in the signature process through algorithm modification and system design.

[0057] In the ECC-based signature operation, the most complex and time-consuming operation is the scalar multiplication operation k×G, where k is a scalar and G is a point on the elliptic curve. The scalar multiplication operation will call point addition and point doubling operations multiple times, and point addition and point doubling operations are implemented by calling domain operations. Domain operations include modular addition, modular multiplication, modular square, reduction and inversion operations. The signature consists of two parts, r and s. Among them, only in the process of calculating r, it is necessary to calculate a complex scalar multiplication. The process of calculating s from r only requires the calculation of simple modular addition and modular multiplication, and sometimes an inversion operation may be required. Therefore, the present invention implements the calculation of r completely in the memory, can directly call the existing cryptographic library interface, and only put the calculation process of s in the register for implementation. Since the calculation of s is a simple operation, it will only occupy a small amount of register resources and can be implemented by a small amount of code modification.

[0058] For ECC-based signature operations, there are currently two ways for attackers to obtain private keys. One is to recover the private key d by obtaining the random number k used in the signature process, and the other is to directly obtain the private key d. The present invention can ensure that the calculation in the memory will not leak any information related to the private key and the random number by modifying the calculation process of the signature algorithm. The core idea is to split the random number k into k1 and k2. k1 and k2 are two independent and unrelated random numbers. Only k2 will be exposed in the memory, and k1 in plain text will only appear in the register. Since the attacker cannot obtain k1, the attacker cannot obtain the random number k. Therefore, the attacker cannot use the random number k to recover the private key d. At the same time, the calculations related to the private key d are all completed in the register, so the attacker cannot directly obtain the private key d from the memory.

[0059] Specifically, the technical solution of the present invention is as follows, which is universal for the ECC-based signature algorithm:

[0060] Initialization phase:

[0061] 1) Generate an AES key and place the AES key in a register with Ring 0 privileges, such as a debug register.

[0062] Since the attacker cannot access the privileged registers, they cannot obtain the AES key.

[0063] 2) Select k1∈[1,n-1], where n is the order of the elliptic curve. Use the AES key to encrypt k1 and the private key d, and store them in ciphertext form, such as in a USB or local disk. Since the attacker cannot obtain the AES key, the attacker cannot obtain the plaintext of k1 and the private key d. The ciphertext k1 and d are used as input for the signature operation.

[0064] 3) Calculate the value of the scalar multiplication k1×G, where G is the base point of the curve. The value of k1×G is used as input in plain text and participates in the signature operation. Due to the elliptic curve discrete logarithm problem, even if the attacker obtains the value of k1×G, he cannot obtain k1.

[0065] The initialization phase is performed before any signing begins. It can be done in a dedicated offline device and is considered safe. The initialization phase only needs to be performed once and can be reused for a large number of signatures.

[0066] Signature phase:

[0067] Each signature is divided into two parts: unsafe calculation in memory and safe calculation in register.

[0068] First, perform unsafe calculations in memory. The process of obtaining r can be divided into three steps:

[0069] 1) Select a cryptographically secure random number k2∈[1,n-1] in memory.

[0070] 2) Calculate k×G=(k1+k2)×G=k1×G+k2×G in memory. At this point, the actual random number k of the ECC signature algorithm is the result of the modular addition operation of k1 and k2, that is, k=(k1+k2)mod n. Since the attacker cannot obtain the value of k1, even if the attacker successfully obtains k2 through a memory information leakage attack, there is no way to recover the random number k. In the second step, the operations required are a scalar multiplication operation k2×G and a point addition operation. The point addition operation requires adding the value of k2×G to the value of k1×G. Since the value of k1×G is known, no additional calculation is required. Therefore, compared with the original signature scheme, the performance overhead introduced is only one point addition operation, and the performance is about one percent of a scalar multiplication calculation, and the performance overhead is almost negligible.

[0071] 3) Get r from the value of k×G in memory.

[0072] At this point, the unsafe operation in memory is completed, and r is calculated in the memory.

[0073] Then the security operation in the register is performed, and the recovery of the random number k and the operation of the private key d are all completed in the register.

[0074] 4) Transfer the plaintext k2, r in the memory to the register.

[0075] 5) The ciphertext private keys d and k1 are passed to the register. The AES key is used inside the register to decrypt and restore the plaintext state.

[0076] 6) Restore the actual random number k = (k1 + k2) mod n in the register.

[0077] 7) Restore s from k, r and d in the register.

[0078] At this point, the security operation in the register is completed and s is obtained in the register.

[0079] As can be seen from the technical solution, the plaintext random number k and private key d will not appear in the memory. Therefore, a successful memory information leakage attack cannot recover the private key.

[0080] For some ECC-based signature schemes, if part of the calculation in the process of obtaining s from r does not involve sensitive data, it can also be completed in memory. For example, in EC-Schnorr signature, after r is calculated in memory, since the public key Q and message m are both public parameters, z=H(Q||r||H(m)) can be further calculated in memory. Only s=k+z×d needs to be calculated in the register.

[0081] Taking the SM2 signature algorithm as an example, the invention demonstrates in detail how to apply the technical solution to the SM2 signature.

[0082] Initialization phase:

[0083] 1) Generate an SM4 key and place the SM4 key in a register with Ring 0 privileges, such as a debug register.

[0084] Since the attacker cannot access the privileged registers, they cannot obtain the SM4 keys.

[0085] 2) Select k1∈[1,n-1], where n is the order of the elliptic curve. Use the SM4 key to encrypt k1 and the private key d and store them in ciphertext form, such as in a USB or local disk. Since the attacker cannot obtain the SM4 key, the attacker cannot obtain the plaintext of k1 and the private key d. The ciphertext k1 and d are used as input for the signature operation.

[0086] 3) Calculate the value of the scalar multiplication k1×G, where G is the base point of the curve. The message m and the value of k1×G are used as plain text inputs for signature calculation. Due to the elliptic curve discrete logarithm problem, even if the attacker obtains k1

[0087] The value of ×G cannot obtain k1 either.

[0088] The initialization phase is performed before any signing begins. It can be done in a dedicated offline device and is considered safe. The initialization phase only needs to be performed once and can be reused for a large number of signatures.

[0089] Signature phase:

[0090] Each SM2 signature is divided into two parts: unsafe calculation in memory and safe calculation in register.

[0091] First, do an unsafe computation in memory:

[0092] 1) In-memory computing are known parameters.

[0093] 2) Generate a random number k2∈[1,n-1] in memory, where n is the order of the curve.

[0094] 3) Calculate in memory (x1, y1) = k × G = (k1 + k2) × G = k1 × G + k2 × G. In the third step, the actual random number k is the result of the modular addition operation of k1 and k2, that is, k = (k1 + k2) mod n. Since the attacker cannot obtain the value of k1, even if the attacker successfully obtains k2 through a memory information leakage attack, there is no way to recover the random number k. In the third step, the operations required are a scalar multiplication operation k2 × G and a point addition operation. The point addition operation requires adding the value of k2 × G to the value of k1 × G. Since the value of k1 × G is known, no additional calculation is required. Therefore, compared with the original signature scheme, the performance overhead introduced is only one point addition operation, and the performance is about one percent of a scalar multiplication calculation, and the performance overhead is almost negligible.

[0095] 4) Calculate r=(e+x1)mod n in the memory. When r=0, return to step 2 and reselect k2.

[0096] At this point, all unsafe operations in memory are completed, and r is calculated in memory.

[0097] Then perform the safe operation in the register.

[0098] 5) Transfer the plaintext k2, r in the memory to the register.

[0099] 6) The ciphertext private keys d and k1 are passed to the register. The SM4 key is used inside the register to decrypt and restore the plaintext state.

[0100] 7) Calculate k = (k1 + k2) mod n in the register.

[0101] 8) Calculate s=(1+d) in the register -1 ×(kr×d)mod n.

[0102] At this point, all security operations in the register are completed, and s is obtained in the register.

[0103] As can be seen from the technical solution, the plaintext random number k and private key d will not appear in the memory. Therefore, a successful memory information leakage attack cannot recover the private key.

[0104] The present invention can be used for SM2 signatures as well as other ECC-based signature algorithms such as ECDSA and EC-Schnorr signatures. For these ECC-based signature algorithms, the scheme keeps the initialization phase unchanged, calculates r in the memory, and calculates s in the register, and can still resist memory information leakage attacks while having lower performance overhead.

[0105] In ECDSA signature, the initialization phase remains unchanged. The calculation in memory for each signature includes three steps. The first step is to calculate z=Hash(m) in memory, that is, after hashing the message m, take the first n bits, where n is the order of the curve. The second step is to select a cryptographically secure random number k2∈[1,n-1] in the memory and calculate (x,y)=k×G=(k1+k2)×G=k1×G+k2×G, where the value of k1×G is known and only k2×G needs to be calculated. The third step is to calculate r=xmod n in memory. After the calculation in memory is completed, z, k2, and r are passed to the register. The ciphertext k1 and d are decrypted into plaintext inside the register. The operation in the register includes two steps. The first step is to restore the random number k=(k1+k2)mod n in the register. The second step is to calculate s=k in the register. -1 (z+r×d)mod n.

[0106] In EC-Schnorr signature, the initialization phase remains unchanged. The calculation in memory for each signature includes two steps. In the first step, k2 is selected in the memory and r = k × G = (k1 + k2) × G = k1 × G + k2 × G is calculated, where the value of k1 × G is known, and only k2 × G needs to be calculated. In the second step, the value of H(Q||r||H(m)) is calculated in the memory, where Q is the public key and H(m) is the summary of the message, both of which are public parameters. After the calculation in the memory is completed, k2 and H(Q||r||H(m)) are passed to the register. The ciphertext k1 and d are decrypted into plaintext inside the register. The operation in the register includes two steps. In the first step, the random number k = (k1 + k2) mod n is restored in the register. In the second step, s = k + H(Q||r||H(m)) × d is calculated in the register.

[0107] In summary, by using the elliptic curve digital signature calculation method of the present invention, the message m can be signed, such as Figure 1 As shown, the signing steps include:

[0108] 1) In the initialization phase, the signer generates plaintext parameters and ciphertext parameters for signing. (The initialization phase only needs to be performed once and can be reused for a large number of signatures)

[0109] 2) When signing, first calculate r in memory based on the plaintext parameters.

[0110] 3) After the memory calculation is completed, s is calculated inside the register based on the plaintext parameters and ciphertext parameters.

[0111] 4) Send the signature result (m, (r, s)) to the verifier.

[0112] 5) The verifier uses the signature verification algorithm to verify the signature, and the signature verification algorithm does not need to be changed.

[0113] The above examples are only used to illustrate the technical solutions of the present invention rather than to limit the same. A person skilled in the art may modify or make equivalent substitutions for the technical solutions of the present invention without departing from the spirit and scope of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. A method for calculating an elliptic curve digital signature that resists memory information leakage attacks, the steps comprising: In the initial trusted environment, the symmetric cryptographic algorithm key is placed in the privileged register, and the symmetric cryptographic algorithm key is used to generate the ciphertext of the random number k1 and the ciphertext of the private key, and calculate the value of the scalar multiplication k1×G, where k1∈[1,n-1], n is the order of the elliptic curve, and G is the base point of the elliptic curve; Each time a signature is made, based on the selected digital signature algorithm and the value of the scalar multiplied by k1×G, plaintext data for generating parameter s is calculated in the memory; wherein the plaintext data for generating parameter s includes: parameter r or data calculated based on parameter r, and the digital signature algorithm includes: SM2 signature algorithm, ECDSA signature algorithm or EC-Schnorr signature algorithm; The register calculates the parameter s according to the plaintext data, the ciphertext of the random number k1 and the ciphertext of the private key; Output (r, s) as the digital signature of the message; Wherein, when the digital signature algorithm is the SM2 signature algorithm, the calculation is used to generate the plaintext data of the parameter s, including: Calculate known parameters The hash value e; Select a random number k2, where k2∈[1,n-1]; Calculate the value of the scalar multiplication k2×G; Add the value of scalar multiplication k1×G to the value of scalar multiplication k2×G to obtain the value of k×G, where k is a random number; Calculate the parameter r based on the value of k×G; The parameter r and the random number k2 are used as plaintext data for generating the parameter s; In the case where the digital signature algorithm is the SM2 signature algorithm, the register calculates the parameter s according to the plaintext data, the ciphertext of the random number k1, and the ciphertext of the private key, including: The symmetric encryption algorithm key is used inside the register to decrypt the ciphertext of the random number k1 and the ciphertext of the private key to obtain the random number k1 and the private key; Recover the random number k in the register based on the random number k1, the random number k2 and the order n of the elliptic curve; Based on the random number k, the parameter r, the private key and the order n of the elliptic curve, the parameter s is calculated in the register; In the case where the digital signature algorithm is the ECDSA signature algorithm, the calculation is used to generate plaintext data of the parameter s, including: Perform hash calculation on message m to obtain parameter z; Select a random number k2, where k2∈[1,n-1]; Calculate the value of the scalar multiplication k2×G; Add the value of scalar multiplication k1×G to the value of scalar multiplication k2×G to obtain the value of k×G, where k is a random number; Calculate the parameter r based on the value of k×G; Parameter z, parameter r and random number k2 are used as plaintext data for generating parameter s; In the case where the digital signature algorithm is the ECDSA signature algorithm, the register calculates the parameter s according to the plaintext data, the ciphertext of the random number k1, and the ciphertext of the private key, including: The symmetric encryption algorithm key is used inside the register to decrypt the ciphertext of the random number k1 and the ciphertext of the private key to obtain the random number k1 and the private key; Recover the random number k in the register based on the random number k1, the random number k2 and the order n of the elliptic curve; Calculate parameter s in a register based on parameter z, random number k, parameter r, private key, and order n of the elliptic curve; In the case where the digital signature algorithm is the EC-Schnorr signature algorithm, the calculation is used to generate plaintext data of the parameter s, including: Perform hash calculation on message m to obtain message digest H(m); Select a random number k2, where k2∈[1,n-1]; Calculate the value of the scalar multiplication k2×G; Add the value of scalar multiplication k1×G to the value of scalar multiplication k2×G to obtain the value of k×G, where k is a random number; According to the value of k×G, the parameter r is obtained; Calculate the value of H(Q||r||H(m)) using the message digest H(m), parameter r and public key Q; The value of H(Q||r||H(m)) and the random number k2 are used as plaintext data for generating parameter s; In the case where the digital signature algorithm is the EC-Schnorr signature algorithm, the register calculates the parameter s according to the plaintext data, the ciphertext of the random number k1 and the ciphertext of the private key, including: The symmetric encryption algorithm key is used inside the register to decrypt the ciphertext of the random number k1 and the ciphertext of the private key to obtain the random number k1 and the private key; Recover the random number k in the register based on the random number k1, the random number k2 and the order n of the elliptic curve; Based on the random number k, the private key and the value of H(Q||r||H(m)), the parameter s is calculated in the register.

2. The method according to claim 1, characterized in that The symmetric encryption algorithm includes: SM4 algorithm or AES algorithm.

3. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the method according to any one of claims 1 to 2.

Images