A method of n-choose-1 oblivious transmission based on SM9

Abstract

The present invention relates to an n-choose-1 oblivious transmission method based on SM9. The method comprises: S1, running the SM9 algorithm to generate public parameters for SM9 identification encryption; S2, the receiver selects a random number corresponding to the message to be obtained, generates a data request for the message according to the public parameters of the system and sends it to the sender; S3, the sender calculates the ciphertexts of n messages according to the received data request and sends it to the receiver; S4, the receiver decrypts the n ciphertexts according to the random number corresponding to the obtained message selected by the receiver to obtain the plaintext message he wants. The present invention does not change the basic architecture of SM9, but uses the oblivious transmission protocol. The receiver generates a data request for the message according to the user public key generation algorithm and the system master public key in the SM9 identification encryption algorithm. The sender encrypts the n messages through the data request, so that the receiver can only decrypt the ciphertext of the message selected by the receiver, but cannot decrypt the ciphertext of other messages.

Description

Technical Field

[0001] The invention belongs to the field of information security technology, and in particular to an SM9-based n-choose-1 oblivious transmission method. Background Art

[0002] Oblivious transmission is one of the most basic primitives in cryptography and secure computing systems. It refers to the protocol participants transmitting information in an obfuscated manner, thereby effectively protecting the privacy of each participant.

[0003] The n-choose-1 oblivious transfer protocol means that the sender has n messages m1, m2, ...m n , the receiver can only choose one of the messages to obtain, and the sender does not know which message the receiver has obtained, and the receiver cannot obtain any information about other messages except the obtained message. Because of its above characteristics, the oblivious transfer protocol is widely used to construct obfuscated circuits, zero-knowledge proof protocols and Beaver triples, etc. It is also widely used in scenarios such as privacy information retrieval (PIR), fair electronic contract signatures, and secure multi-party computing.

[0004] At present, most oblivious transfer protocols are designed based on foreign cryptographic algorithms such as Elgamal. In order to achieve independent control of cryptography and ensure network and information security, my country has independently designed the SM9 identification encryption algorithm and it has become an international standard. Unfortunately, there is currently no oblivious transfer protocol based on SM9. How to build an n-choose-1 oblivious transfer protocol based on the SM9 identification encryption algorithm and apply it to my country's secure multi-party computing system and privacy information retrieval system is a meaningful task.

[0005] In view of this situation, the present invention designs an SM9-based n-choose-1 oblivious transfer protocol. Without changing the basic architecture of the SM9 identification encryption algorithm, the SM9-based n-choose-1 oblivious transfer protocol is constructed. Summary of the invention

[0006] The purpose of the present invention is to solve the problem that SM9 cannot transmit information in a fuzzy manner in a distributed computing system and a privacy information retrieval system, and therefore provides an n-choose-1 oblivious transmission method based on SM9.

[0007] To achieve the above object, the technical solution of the present invention is: an n-choose-1 oblivious transmission method based on SM9, comprising the following steps:

[0008] S1. Run the SM9 algorithm to generate public parameters for SM9 identification encryption;

[0009] S2. The receiver selects a random number that corresponds to the message it wants to obtain, generates a data request for the message based on the public parameters of the system, and sends it to the sender;

[0010] S3. The sender calculates the ciphertext of n messages based on the received data request and sends it to the receiver.

[0011] S4. The receiver decrypts the n ciphertexts according to the random number corresponding to the acquired message selected by him / her to obtain the plaintext message he / she wants.

[0012] Compared with the prior art, the present invention has the following beneficial effects: on the basis of not changing the basic architecture of the SM9 identification encryption algorithm, the present invention utilizes the structural characteristics of the oblivious transfer protocol to construct an n-choose-1 oblivious transfer protocol based on SM9, which has the following advantages:

[0013] 1. The receiver generates a data request for the message based on the user public key generation algorithm and the system master public key in the SM9 identification encryption algorithm. Due to the one-way nature of the hash function and the difficulty of the discrete logarithm problem, the sender cannot know which message the receiver needs to query after receiving the data request, thereby protecting the receiver's privacy.

[0014] 2. The sender encrypts n messages through the data request, so that the receiver can only decrypt the ciphertext of the message he chooses, but cannot decrypt the ciphertext of other messages, thereby protecting the privacy of the sender.

[0015] 3. The oblivious transfer protocol only needs 2 rounds to complete the data query. The communication cost required during the query process is only the elements y and n in G1 and the ciphertext c of the message. i , the computational cost is comparable to that of the SM9 identity encryption algorithm.

[0016] Through the above advantages, the implementation protocol of the method of the present invention can greatly promote the application of the SM9 identification encryption algorithm in secure multi-party computing systems and privacy information retrieval systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flowchart of an n-choose-1 oblivious transfer protocol based on SM9;

[0018] Figure 2 It is a system diagram of an n-choose-1 oblivious transfer protocol based on SM9;

[0019] Figure 3 A schematic diagram of an n-choose-1 oblivious transfer protocol algorithm based on SM9. DETAILED DESCRIPTION

[0020] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings.

[0021] Please refer to Figure 1The present invention designs an n-choose-1 oblivious transmission method based on SM9. The key concept is: the n-choose-1 oblivious transmission protocol based on SM9 includes the following steps:

[0022] S1. Run the SM9 algorithm to generate public parameters for SM9 identification encryption;

[0023] S2. The receiver selects a random number that corresponds to the message it wants to obtain, generates a message data request based on the system's public parameters, and sends it to the sender;

[0024] S3. The sender calculates the ciphertext of n messages based on the received data request and sends it to the receiver.

[0025] S4. The receiver decrypts the n ciphertexts according to the random number corresponding to the acquired message selected by him / her to obtain the plaintext message he / she wants.

[0026] Figure 2 A system diagram of an n-choose-1 oblivious transfer protocol based on SM9. Figure 3 A schematic diagram of an n-choose-1 oblivious transfer protocol algorithm based on SM9.

[0027] Furthermore, in step S1, the SM9 algorithm is run to generate public parameters for SM9 identification encryption, specifically including:

[0028] Choose additive groups G1, G2 of order N and multiplicative group G of order N T e:G1×G2→G T It is a bilinear map, a hash function Next, we select a one-byte encryption generator identifier hid, and randomly select generators P1∈G1, P2∈G2, so that ψ(P2)=P1. The public parameters of the system are defined as params={G1,G2,P1,P2,e}.

[0029] in,

[0030] N: Cyclic group G1, G2, G T The order of, and N>2 191 prime number of ;

[0031] G1: additive cyclic group of order prime number N;

[0032] G2: additive cyclic group of order prime number N;

[0033] G T : A multiplicative cyclic group of order prime number N;

[0034] e: From G1×G2 to G T Bilinear mapping of ;

[0035] P1: Generator of group G1;

[0036] P2: Generator of group G2;

[0037] ψ: Mapping from group G2 to G1.

[0038] Z N : A set of integers greater than or equal to 0 and less than or equal to N-1;

[0039] The set of integers greater than 0 and less than or equal to N-1;

[0040] {0,1} * arrive Cryptographic functions derived from cryptographic hash functions;

[0041] HID: A one-byte identifier of the encryption key generation function, selected and made public by the key generation center.

[0042] In step S2, the receiver selects a random number corresponding to the message to be obtained, generates a data request for the message according to the public parameters of the system, and sends it to the sender, which specifically includes:

[0043] Choose a random number α∈Z n as well as Calculate the element y in group G1 = (H1("α"||hid,N)+a)P1. And send y to the sender. Where:

[0044] α∈Z n : A random number chosen by the receiver that corresponds to the message he wants to receive;

[0045] A random number chosen by the recipient;

[0046] "α"||hid: the concatenation of α and hid, where α and hid are bit strings or byte strings;

[0047] In step S3, the sender calculates the ciphertext of n messages according to the received data request and sends it to the receiver, which specifically includes:

[0048] Select random number Calculate ciphertext And send it to the receiver.

[0049] The random number selected by the data owner when encrypting;

[0050] m i : The message owned by the sender belongs to G T The elements in Zn .

[0051] In step S4, the receiver decrypts n ciphertexts according to the random number corresponding to the acquired message selected by the receiver to obtain the desired plaintext message, which specifically includes:

[0052] When receiving the ciphertext c sent by the sender α =(u,v), the receiver calculates

[0053]

[0054] in:

[0055] c α : The ciphertext of the αth message received by the receiver;

[0056] m α : the αth message;

[0057] (u,v): Part of the ciphertext in the αth message ciphertext.

[0058] The receiver's decryption process is as follows:

[0059]

[0060] Here are some things to note about the calculation formula:

[0061] Assume that G1 and G2 are additive cyclic groups of order N, G T is a multiplicative cyclic group of order large prime number N, P1 and P2 are generators of G1 and G2 respectively, and the mapping e:G1×G2→G T It is a bilinear map that satisfies the following three conditions:

[0062] (1) Bilinearity: For any generator P1∈G1, P2∈G2 and e(aP1,bP2)=e(P1,P2) ab ;

[0063] (2) Non-degeneracy: There exists at least one element P∈G1,Q∈G2 such that e(P,Q)≠1;

[0064] (3) Computability: For any P∈G1,Q∈G2, there exists a polynomial time algorithm to efficiently compute e(P,Q).

[0065] From the above description, it can be seen that the present invention, without changing the basic architecture of the SM9 identification encryption algorithm, utilizes the structural characteristics of the oblivious transfer protocol to construct an n-choose-1 oblivious transfer protocol based on SM9, which has the following advantages:

[0066] 1. The receiver generates a data request for the message based on the user public key generation algorithm and the system master public key in the SM9 identification encryption algorithm. Due to the one-way nature of the hash function and the difficulty of the discrete logarithm problem, the sender cannot know which message the receiver needs to query after receiving the data request, thereby protecting the receiver's privacy.

[0067] 2. The sender encrypts n messages through the data request, so that the receiver can only decrypt the ciphertext of the message he chooses, but cannot decrypt the ciphertext of other messages, thereby protecting the privacy of the sender.

[0068] 3. The oblivious transfer protocol only needs 2 rounds to complete the data query. The communication cost required during the query process is only the elements y and n in G1 and the ciphertext c of the message. i , the computational cost is comparable to that of the SM9 identity encryption algorithm.

[0069] Through the above advantages, the protocol of the present invention can greatly promote the application of the SM9 identification encryption algorithm in secure multi-party computing systems and privacy information retrieval systems.

[0070] The above are preferred embodiments of the present invention. Any changes made according to the technical solution of the present invention, as long as the resulting functions do not exceed the scope of the technical solution of the present invention, belong to the protection scope of the present invention.

Claims

1. A method for oblivious transmission of n-choose-1 based on SM9, characterized in that: The steps include: S1. Run the SM9 algorithm to generate public parameters for SM9 identification encryption; S2. The receiver selects a random number that corresponds to the message it wants to obtain, generates a data request for the message based on the public parameters of the system, and sends it to the sender; S3, the sender calculates the ciphertext of n messages based on the received data request and sends it to the receiver; S4. The receiver decrypts the n ciphertexts according to the random number corresponding to the acquired message selected by the receiver to obtain the desired plaintext message. The step S1 specifically includes: Choose additive groups G1, G2 of order N and multiplicative group G of order N T ; e:G1×G2→G T It is a bilinear map, a hash function Next, select the encryption generator function identifier hid represented by one byte, randomly select generators P1∈G1, P2∈G2, so that ψ(P2)=P1; define the public parameters of the system as params={G1,G2,P1,P2,e}; in: N: Cyclic group G1, G2, G T The order of, and N>2 191 prime number of ; G1: additive cyclic group of order prime number N; G2: additive cyclic group of order prime number N; G T : A multiplicative cyclic group of order prime number N; e: From G1×G2 to G T Bilinear mapping of ; P1: Generator of group G1; P2: Generator of group G2; ψ: mapping from group G2 to G1; Z N : A set of integers greater than or equal to 0 and less than or equal to N-1; The set of integers greater than 0 and less than or equal to N-1; {0,1} * arrive Cryptographic functions derived from cryptographic hash functions; hid: The encryption key generation function identifier represented by one byte, selected and made public by the key generation center; The step S2 specifically includes: Choose a random number α∈Z n as well as Calculate the element y=(H1("α"||hid,N)+a)P1 in group G1; and send y to the sender; where: α∈Z n : A random number chosen by the receiver that corresponds to the message he wants to receive; A random number chosen by the recipient; "α"||hid: the concatenation of α and hid, where α and hid are bit strings or byte strings; The step S3 specifically includes: Select random number Calculate ciphertext and sends it to the receiver; where, The random number selected by the data owner when encrypting; m i : The message owned by the sender belongs to G T The elements in Z n ; The step S4 specifically includes: When receiving the ciphertext c sent by the sender α =(u,v), the receiver calculates in: c α : The ciphertext of the αth message received by the receiver; m α : the αth message; (u,v): Part of the ciphertext in the αth message ciphertext.

Images