A method for realizing SM2 encryption and decryption based on multiple random scrambling to prevent information tampering

Abstract

The present invention provides a method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling. The method adopts a scalar random masking method in all scalar multiplication processes, specifically: selecting an input scalar d 1 scalar multiplication with any point P on the curve to obtain [d 1 ]P: First verify whether the coordinates of point P conform to the elliptic curve equation of the SM2 algorithm, and then generate a true random number m by the hardware physical true random number generation unit 1 , using the Montgomery Ladder algorithm, calculate and generate random points M 1 =[m 1 ]P; Through the BRIP process, M 1 Calculate Q for a random point 1 =[t 1 ]P,t 1 =d 1 ‑m 1 , calculate the completed Q 1 After the point coordinates, use point Q 1 Subtract random point M 1 , the result is the point [d 1 ]P=Q 1 ‑M 1 The random mask processing method used when calculating s during the signature process makes the entire encryption and decryption process resistant to SPA, DPA, ZPA, and high-order DPA attacks, prevents information tampering, and improves the security of data communications.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption and decryption, and in particular to a method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling. Background Art

[0002] The SM2 algorithm is an asymmetric encryption algorithm designed by the China National Cryptography Administration based on elliptic curves, including key generation, encryption, decryption, signature and signature verification. In the above operation processes, encryption and signature verification only use public keys for calculation, and there is no problem of private key information leakage. However, key generation, decryption and signature require private keys. A If there is no protection during the operation, the private key d can be inferred by external means through SPA, DPA, correlation analysis, etc. A , which may cause the SM2 signature information to be tampered with, or the encrypted data to be decrypted, resulting in information leakage.

[0003] As a type of elliptic curve algorithm, the core of the SM2 algorithm is the implementation of point multiplication. Generally, point multiplication without anti-attack design uses binary expansion method, and the private key d A Directly participate in the operation, according to the private key d A The bits of the ,algorithm flow are different, and it is easy to infer d by using side channel analysis. A Once the private key d A If leaked, it is easy to forge signatures and tamper with encrypted data, posing a fatal security risk.

[0004] The risk points of key generation and decryption are in the process of scalar multiplication of points. The risk points of signatures are in the process of scalar multiplication of points and the subsequent calculation of the signature result. The general anti-attack algorithms for point multiplication algorithms mainly use BRIP and Montgomery Ladder. Among them, BRIP uses random points to achieve averaging and randomization of the elliptic curve scalar multiplication process, and has the ability to resist first-order DPA, ZPA, RPA and other attacks, but cannot resist second-order DPA correlation analysis. MontgomeryLadder: Montgomery Ladder can achieve power consumption balance in the process of elliptic curve scalar multiplication, and has anti-SPA function, but cannot resist DPA.

[0005] Therefore, in response to the above technical problems, the present application proposes a method that can implement SM2 encryption and decryption to prevent information tampering based on multiple random scrambling, which can resist high-order DPA analysis attacks. Summary of the invention

[0006] The object of the present invention is to provide a method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling, thereby solving the above-mentioned problems existing in the prior art.

[0007] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0008] A method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling, in which a point multiplication process with a scalar random mask is used in the process of data encryption and decryption using the SM2 algorithm, and the point multiplication process with a scalar random mask includes the following steps:

[0009] Select the input scalar d1 and any point P on the curve for scalar multiplication to obtain [d1]P: first verify whether the coordinates of point P conform to the elliptic curve equation of the SM2 algorithm, then generate a true random number m1 using the hardware physical true random number generation unit, and use the Montgomery Ladder algorithm to calculate and generate a random point M1=[m1]P; through the BRIP process, use M1 as the random point to calculate Q1=[t1]P, t1=d1-m1, and after calculating the coordinates of point Q1, subtract the random point M1 from point Q1, and the result is point [d1]P=Q1-M1.

[0010] Preferably, the elliptic curve equation used is:

[0011] The modulus value p is used to limit the range of coordinates and parameters of points on the elliptic curve; a and b are the parameters of the elliptic curve.

[0012] Preferably, the Montgomery Ladder algorithm is used to calculate and generate a random point M1=[m1]P, which specifically includes:

[0013] Input: coordinate P, u-bit integer And m 1(u-1) =1,

[0014] Output: Point coordinates M1 = [m1]P.

[0015] Preferably, through the BRIP process, Q1=[t1]P is calculated with M1 as a random point, which specifically includes:

[0016] Input: u-bit integer Point coordinates P;

[0017] Output: Point coordinates Q1 = [t1]P;

[0018] Calculation process:

[0019] 1) Use the Montgomery Ladder algorithm to generate random coordinate points R;

[0020] 2) Calculate T0 = R, T1 = -R, T2 = PR;

[0021] 3), j decreases from u-1 to 0 and executes:

[0022] T0=[2]T0

[0023] If t1 jth bit = 0 then

[0024] T0=T0+T1

[0025] otherwise

[0026] T0=T0+T2

[0027] 4), output Q1 = T0 + T1.

[0028] Preferably, it is characterized in that the key generation process includes the following steps:

[0029] Generate a true random number k1, and use the point multiplication process with the scalar random mask to calculate the coordinates of point P1, P1 = [k1]G, determine whether the calculated coordinates of point P1 are valid, if valid, obtain the key pair (k1, P1) and store the key pair; otherwise, return to regenerate the true random number k1 and repeat the calculation of the coordinates of point P1.

[0030] Preferably, the signature process in the SM2 encryption and decryption process specifically includes the following process:

[0031] Calculate e according to the SM2 standard process, then generate true random numbers k2 and k3, use the point multiplication process with scalar random mask to calculate (x1, y1) = [k2] G, where G is the base point of the elliptic curve; determine whether the coordinates of the point (x1, y1) are valid, if so, calculate r = (e + x1) mod n again; determine r = 0 or r + k1 = n, if yes, exit the signing process with an error; if not yes, further calculate f = k2*d A (mod n), s = ((k3+f)*(k3*k2-r*f))(mod n), and again determine whether s is greater than or equal to 1 and less than n; if so, determine that the digital signature is (r, s), otherwise the signing process is wrong and exit the signing process.

[0032] The beneficial effects of the present invention are:

[0033] The present invention provides a method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling. The method adopts a scalar randomization mask method in all scalar multiplication processes and a random mask processing method when calculating s in the signature process, so that the entire encryption and decryption process can resist SPA, DPA, ZPA, and high-order DPA attacks to prevent information tampering. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 is a flowchart of the dot multiplication with scalar random mask used in Example 1;

[0035] Figure 2 is a schematic diagram of the key generation process used in Example 1;

[0036] Figure 3 This is a schematic diagram of the signature process provided in Example 1; DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation methods described herein are only used to explain the present invention and are not used to limit the present invention.

[0038] Example

[0039] This embodiment provides a method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling, including key generation, signature, signature verification, encryption, and final decryption process, wherein a point multiplication process with a scalar random mask is adopted, and the process specifically includes:

[0040] Select the input scalar d1 and any point P on the curve for scalar multiplication to obtain [d1]P: first verify whether the coordinates of point P conform to the elliptic curve equation of the SM2 algorithm, then generate a true random number m1 using the hardware random number generation unit, and use the MontgomeryLadder algorithm to calculate and generate a random point M1=[m1]P; through the BRIP process, use M1 as the random point to calculate Q1=[t1]P, t1=d1-m1, and after calculating the coordinates of point Q1, subtract the random point M1 from point Q1, and the result is point [d1]P.

[0041] Based on the above special point multiplication method, this embodiment provides a complete encryption and decryption process, and the specific process of each step is as follows:

[0042] Key generation process:

[0043] Input: First enter a valid Fq (q = p and p is a prime number greater than 3, or q = 2 m ) is a set of elliptic curve system parameters on . It is expressed in the form of elliptic curve parameters (a, b, c, d, p).

[0044] Output: A key pair (d2;P) associated with the elliptic curve system parameters.

[0045] 1) Generate an integer d2∈[1;n-2] using a random number generator;

[0046] 2) G is the base point, and the point multiplication process with a scalar random mask is used to calculate the point P = (x P ;y P ) = [d2] G;

[0047] 3) The key pair is (d2; P), where d2 is the private key and P is the public key.

[0048] Signature Process:

[0049] Suppose the message to be signed is M. In order to obtain the digital signature (r, s) of message M, user A as the signer should implement the following operation steps:

[0050] A1: Set M=Z A ||M;

[0051] A2: Calculate e=Hv(M) and convert the data type of e to an integer;

[0052] A3: Use a random number generator to generate a random number k∈[1,n-1];

[0053] A4: Use the point multiplication process with a scalar random mask to calculate the elliptic curve point (x1, y1) = [k]G, and convert the data types of x1 and y1 to integers;

[0054] A5: Calculate r = (e + x1) mod n. If r = 0 or r + k = n, return to A3.

[0055] A6: Calculate f=k3*d A (mod n), s=((k3+f)*(k3*k2-r*f))(mod n), if s=0, return to step A3, otherwise go to step A7;

[0056] A7: Convert the data types of r and s into byte strings according to the byte conversion technology described in the SM2 algorithm specification, and obtain the signature of the message M as (r, s).

[0057] Visa verification process:

[0058] In order to verify the received message M′ and its digital signature (r', s'), user B as the verifier should implement the following operation steps:

[0059] B1: Check whether r'∈[1,n-1] holds. If not, the verification fails.

[0060] B2: Check whether s'∈[1,n-1] holds. If not, the verification fails.

[0061] B3: Set M' = Z A ||M';

[0062] B4: Calculate e'=Hv(M'), and convert the data type of e' to an integer;

[0063] B5: Convert the data types of r' and s' to integers and calculate t = (r' + s') mod n. If t = 0, the verification fails.

[0064] B6: Use the point multiplication process with a scalar random mask to calculate the elliptic curve point (x1'; y1') = [s']G + [t]P A ;

[0065] B7: Convert the data type of x1' to an integer, calculate R = (e' + x1') mod n, and check whether R = r' holds. If so, the verification passes; otherwise, the verification fails.

[0066] Encryption process:

[0067] Suppose the message to be sent is a bit string M, k len is the bit length of M.

[0068] In order to encrypt plaintext M, user A, as the encryptor, should implement the following operation steps:

[0069] A1: Use a random number generator to generate a random number k∈[1,n-1];

[0070] A2: Calculate the elliptic curve point C1 = [k]G = (x1, y1), and convert the data type of C1 into a bit string;

[0071] A3: Calculate the elliptic curve point S = [h] P B , if S is a point at infinity, report an error and exit;

[0072] A4: Calculate elliptic curve point [k]P B =(x2,y2), convert the data type of coordinates x2 and y2 into a bit string;

[0073] A5: Calculate t = KDF(x2||y2,klen). If t is a string of all 0 bits, return to A1.

[0074] A6: Calculation

[0075] A7: Calculate C3 = Hash(x2||M||y2);

[0076] A8: Output ciphertext C=C1||C3||C2.

[0077] Decryption process:

[0078] Let k len is the bit length of C2 in the ciphertext.

[0079] In order to decrypt the ciphertext C=C1||C3||C2, user B as the decryptor should implement the following operation steps:

[0080] B1: Extract the bit string C1 from C, convert the data type of C1 to a point on the elliptic curve, and verify whether C1 satisfies the elliptic curve equation. If not, an error is reported and the program exits.

[0081] B2: Calculate the elliptic curve point S = [h] C1. If S is a point at infinity, report an error and exit.

[0082] B3: Using the dot product process with a scalar random mask, calculate [d B ]C1=(x2,y2), convert the data type of coordinates x2 and y2 into a bit string;

[0083] B4: Calculate t = KDF(x2||y2,k len ), if t is a string of all 0 bits, an error is reported and the program exits;

[0084] B5: Take the bit string C2 from C and calculate

[0085] B6: Calculate u = Hash(x2||M'||y2), extract the bit string C3 from C, and if u≠C3, report an error and exit;

[0086] B7: Output plaintext M'.

[0087] By adopting the above technical solution disclosed in the present invention, the following beneficial effects are obtained:

[0088] The present invention provides a method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling. The method adopts a scalar randomization mask method in all scalar multiplication processes and a random mask processing method when calculating s in the signature process, so that the entire encryption and decryption process can resist SPA, DPA, ZPA, and high-order DPA attacks to prevent information tampering.

[0089] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be considered as the scope of protection of the present invention.

Claims

1. A method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling, characterized in that: In the process of data encryption and decryption using the SM2 algorithm, a point multiplication process with a scalar random mask is used, and the point multiplication process with a scalar random mask includes the following steps: Select the input scalar d1 and any point P on the curve for scalar multiplication to obtain [d1]P: first verify whether the coordinates of point P conform to the elliptic curve equation of the SM2 algorithm, then generate a true random number m1 using the hardware physical true random number generation unit, and use the Montgomery Ladder algorithm to calculate and generate a random point M1=[m1]P; through the BRIP process, use M1 as the random point to calculate Q1=[t1]P, t1=d1-m1, and after calculating the coordinates of point Q1, subtract the random point M1 from point Q1, and the result is point [d1]P=Q1-M1.

2. The method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling according to claim 1 is characterized in that: The elliptic curve equation used is: 2 =x 3 +ax+b(mod p) The modulus value p limits the range of coordinates and parameters of points on the elliptic curve; a and b are the parameters of the elliptic curve.

3. The method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling according to claim 1 is characterized in that: Use the Montgomery Ladder algorithm to calculate and generate a random point M1=[m1]P, specifically including: Input: coordinate P, u-bit integer m 1(j) ∈{0,1}, and m 1(u-1) =1, Output: Point coordinates M1 = [m1]P.

4. The method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling according to claim 1 is characterized in that: Through the BRIP process, Q1=[t1]P is calculated with M1 as the random point, which includes: Input: u-bit integer t 1(j) ∈{0,1}, point coordinates P; Output: Point coordinates Q1 = [t1]P; Calculation process: 1) Use the Montgomery Ladder algorithm to generate random coordinate points R; 2) Calculate T0 = R, T1 = -R, T2 = PR; 3), j decreases from u-1 to 0 and executes: T0=[2]T0 If t1 jth bit = 0 then T0=T0+T1 otherwise T0=T0+T2 4), output Q1 = T0 + T1.

5. The method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling according to claim 1 is characterized in that: The key generation process includes the following steps: Generate a true random number k1, and use the point multiplication process with the scalar random mask to calculate the coordinates of point P1, P1 = [k1]G, determine whether the calculated coordinates of point P1 are valid, if valid, obtain the key pair (k1, P1) and store the key pair; otherwise, return to regenerate the true random number k1 and repeat the calculation of the coordinates of point P1.

6. The method for implementing SM2 encryption and decryption to prevent information tampering based on multiple random scrambling according to claim 1 is characterized in that: The signature process in the SM2 encryption and decryption process specifically includes the following processes: Calculate e according to the SM2 standard process, then generate true random numbers k2 and k3, use the point multiplication process with scalar random mask to calculate (x1, y1) = [k2] G, where G is the base point of the elliptic curve; determine whether the coordinates of the point (x1, y1) are valid, if so, calculate r = (e + x1) mod n again; determine r = 0 or r + k1 = n, if yes, exit the signing process with an error; if not yes, further calculate f = k2*d A (mod n), s = ((k3 + f) * (k3 * k2 - r * f)) (mod n), again determine whether s is greater than or equal to 1 and less than n; if so, determine that the digital signature is (r, s), otherwise the signing process is wrong and exit the signing process.

Images