Encryption method and related device based on two-party joint generation of encryption scheme parameters

Abstract

The application discloses an encryption method based on two-party joint generation of encryption scheme parameters and related devices, and the method comprises the following steps: confirming the generation number parity rule of two entities, so that the two entities generate corresponding numerical values according to the generation number parity rule; receiving the numerical values sent by the two entities; confirming the value range of the encryption parameter; adding the numerical values generated by the two entities to obtain the encryption parameter, and verifying whether the encryption parameter is within the set value range; if the encryption parameter is within the set value range, performing primality testing on the encryption parameter; if the encryption parameter is a prime number, inputting the encryption parameter into an Elgamal encryption scheme; and encrypting the data to be encrypted by using the Elgamal encryption scheme. Under the premise that the two entities do not trust each other, the application can establish a trusted Elgamal encryption scheme parameter, and realizes encryption in a scene without a certificate authority (CA) and other trusted third parties by using the Elgamal encryption scheme.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cyberspace security, and in particular to an encryption method based on two-party joint generation of encryption scheme parameters and related devices. BACKGROUND

[0002] Generally, the generation of public key cryptography system parameters is done by a trusted third party (for example, a certificate center CA), which should be deployed with the relevant software for generating public key cryptography system parameters. However, in many scenarios, such as some edge computing scenarios involving IoT, there is no ready-made trusted third party that can be used, resulting in the inability to establish a trusted Elgamal encryption scheme for data encryption. SUMMARY

[0003] The present application provides an encryption method based on two-party joint generation of Elgamal encryption scheme parameters and related devices, aiming to solve the problem of how to perform data encryption in the scenario without a certificate center (CA) and other trusted third parties for the Elgamal encryption scheme.

[0004] In a first aspect, an embodiment of the present application provides an encryption method based on two-party joint generation of Elgamal encryption scheme parameters, comprising:

[0005] Confirming the generation number parity rule of two entities, so that the two entities generate corresponding numerical values according to the generation number parity rule respectively;

[0006] Receiving the numerical values sent by the two entities;

[0007] Confirming the value range of the encryption parameter;

[0008] Adding the numerical values generated by the two entities to obtain an encryption parameter, and verifying whether the encryption parameter is within the set value range;

[0009] If the encryption parameter is within the set value range, performing primality testing on the encryption parameter;

[0010] If the encryption parameter is a prime number, inputting the encryption parameter into the Elgamal encryption scheme;

[0011] Encrypting the data to be encrypted using the Elgamal encryption scheme.

[0012] In a second aspect, an embodiment of the present application provides an encryption device based on two-party joint generation of Elgamal encryption scheme parameters, comprising:

[0013] A generation unit configured to confirm the generation number parity rule of two entities, so that the two entities generate corresponding numerical values according to the generation number parity rule respectively;

[0014] A receiving unit is configured to receive the values generated by the two entities;

[0015] A confirming unit is configured to confirm the value range of the encryption parameter;

[0016] A value range checking unit is configured to add the values generated by the two entities to obtain the encryption parameter, and check whether the encryption parameter is within the set value range;

[0017] A primality checking unit is configured to perform primality checking on the encryption parameter if the encryption parameter is within the set value range;

[0018] An input unit is configured to input the encryption parameter into the Elgamal encryption scheme if the encryption parameter is a prime number;

[0019] An encryption unit is configured to encrypt the data to be encrypted by using the Elgamal encryption scheme.

[0020] In a third aspect, an embodiment of the present application further provides a computer device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the encryption method for generating an Elgamal encryption scheme parameter based on two-party joint generation according to the first aspect when executing the computer program.

[0021] In a fourth aspect, an embodiment of the present application further provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program implements the encryption method for generating an Elgamal encryption scheme parameter based on two-party joint generation according to the first aspect when executed by a processor.

[0022] The embodiment of the present application provides an encryption method based on two-party joint generation of Elgamal encryption scheme parameters, comprising: confirming generation number parity rules of two entities, so that the two entities generate corresponding values according to the generation number parity rules; receiving values sent by the two entities; confirming a value range of an encryption parameter; adding the values generated by the two entities to obtain the encryption parameter, and verifying whether the encryption parameter is in the set value range; if the encryption parameter is in the set value range, performing primality testing on the encryption parameter; if the encryption parameter is a prime number, inputting the encryption parameter into an Elgamal encryption scheme; and encrypting to-be-encrypted data by using the Elgamal encryption scheme. The present application can establish a trusted Elgamal encryption scheme parameter under the premise that two entities do not trust each other, and realizes data encryption in a scenario without a certificate authority (CA) and other trusted third parties by using the Elgamal encryption scheme. The embodiment of the present application also provides an encryption device based on two-party joint generation of Elgamal encryption scheme parameters, a computer readable storage medium and a computer device, which have the above beneficial effects, and details are not repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0024] Figure 1 A flowchart of the encryption method based on two-party joint generation of Elgamal encryption scheme parameters provided by the embodiment of the present application is shown in the figure.

[0025] Figure 2 A schematic block diagram of the encryption device based on two-party joint generation of Elgamal encryption scheme parameters provided by the embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0026] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0027] It should be understood that the terms "comprises" and "comprising," when used in this specification and the following claims, indicate the presence of the described features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0028] It should also be understood that the terms used in the specification of the application herein are used for the purpose of describing particular embodiments only and are not intended to limit the application. As used in the specification and the appended claims of the application, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0029] It should be further understood that the term "and / or" used in the specification of the application and the appended claims means one or more of the associated listed items as well as all possible combinations of the items and includes these combinations.

[0030] Generally, the generation of public key cryptography system parameters is done by a trusted third party, which should be deployed with the relevant software for generating public key cryptography system parameters. However, in many scenarios, such as some edge computing scenarios involving IoT, there is no ready-made trusted third party to use, which requires two or more participating entities to jointly generate a parameter under the premise of mutual distrust, and the Elgamal encryption scheme is a widely used public key encryption scheme, so the application realizes data encryption of the Elgamal encryption scheme in the case of no trusted third party by two entities jointly generating Elgamal encryption parameters.

[0031] Among them, the Elgamal encryption scheme consists of four stages of parameter setting, key generation, encryption and decryption, the parameter setting includes: selecting a random prime number n, selecting an element , satisfying is the primitive element of the multiplicative group , (n, ) as the public parameter of the system;

[0032] The key generation includes: randomly selecting s∈{1, 2, …, n-1}, calculating , then taking s as the private key and β as the public key;

[0033] The encryption includes: assuming that the plaintext message to be encrypted is m, selecting a random value k∈{1, 2, …, n-1}, calculating the following two values:

[0034]

[0035] Taking (y1, y2) as the ciphertext obtained by encryption;

[0036] Decryption includes: after receiving the ciphertext (y1, y2), calculating the plaintext as:

[0037]

[0038] It should be noted that two entities jointly generate the Elgamal encryption parameter, which is the prime number n in the Elgamal encryption scheme, and the embodiment of the application realizes data encryption of the Elgamal encryption scheme in the case of no trusted third party by jointly generating the prime number n in the Elgamal encryption scheme.

[0039] Please refer to Figure 1 The embodiment provides an encryption method based on two-party joint generation of Elgamal encryption scheme parameters, which comprises the following steps:

[0040] S101: confirming the generation number parity rule of two entities, so that the two entities generate corresponding number values according to the generation number parity rule;

[0041] S102: receiving the number values sent by the two entities;

[0042] S103: confirming the value range of the encryption parameter;

[0043] S104: adding the number values generated by the two entities to obtain the encryption parameter, and verifying whether the encryption parameter is within the set value range;

[0044] S105: if the encryption parameter is within the set value range, performing primality test on the encryption parameter;

[0045] S106: if the encryption parameter is a prime number, inputting the encryption parameter into the Elgamal encryption scheme;

[0046] S107: encrypting the data to be encrypted by using the Elgamal encryption scheme.

[0047] The step S101 will be described in detail as follows:

[0048] The encryption parameter jointly generated by the two entities in the embodiment of the application is a prime number, and since all prime numbers except 2 are odd numbers, the generation number parity rule adopted is to set one of the entities to generate only odd numbers and the other entity to generate only even numbers, and to replace them alternately, wherein the alternate replacement can be set to one replacement at a time, or several replacements at a time.

[0049] In one embodiment, A is set to generate odd numbers, and B is set to generate even numbers, and the subsequent steps are performed, when the number values need to be generated again, A and B are replaced, A is set to generate even numbers, and B is set to generate odd numbers, and the cycle is alternated.

[0050] In another embodiment, set A generates odd numbers, set B generates even numbers, and the subsequent steps are performed, and when the number is regenerated for 3 times, A and B are exchanged, set A generates even numbers, and set B generates odd numbers, and thus the alternation is performed for 3 times.

[0051] Next, in order to avoid that any party controls the value of the final encryption parameter n, for example, one party has determined n = 1001, and then n2 = 1001 - nl is generated after receiving nl from the other party, so that nl and n2 are exchanged between the two parties, which seems fair, but the value of n = 1001 has been determined by one party in advance. Since the hash function has the property of "binding", the corresponding operation value cannot be changed after the hash operation results are exchanged between the two parties. Therefore, in this embodiment, the method for avoiding fraud is that the two entities generate hash operation results of the generated numbers respectively, and exchange the hash operation results and the corresponding numbers generated by the two entities in sequence, so that the two entities perform hash operation on the number sent by the other party through the hash function, and match the current hash operation result with the hash operation result sent by the other party. If they do not match, it is determined that there is fraud, and the corresponding numbers of the two parties are generated again according to the generation rule of the number parity; if they match, step S102 is performed.

[0052] The step S103 is described below:

[0053] The size of the encryption parameter n determines the security of the system and the calculation amount of encryption and decryption. If the encryption parameter n is set too small, the security is insufficient and it is easy to be attacked by the exhaustive algorithm. If the encryption parameter n is set too large, the calculation amount of encryption and decryption is too large, and the efficiency is too low.

[0054] In one embodiment, all participating entities have low requirements for system security, and the encryption parameter n can be set to represent how many bits. The value range of the encryption parameter n is set to be less than 256 bits, and the integer representation is n < 2 256 .

[0055] In another embodiment, all participating entities have general requirements for system security, and the encryption parameter n can be set to represent how many bits. The value range of the encryption parameter n is set to be between 256 bits and 1024 bits, and the integer representation is 2 256 ≤ n ≤ 2 1024 .

[0056] In yet another embodiment, all participating entities have high requirements for system security, and the encryption parameter n can be set to represent how many bits. The value range of the encryption parameter n is set to be greater than 1024 bits, and the integer representation is n > 2 1024 .

[0057] Then the two entities generated values are added to get the encryption parameter, and check whether the encryption parameter is in the set value range, if the encryption parameter is in the set value range, the encryption parameter is prime, if the encryption parameter is not in the set value range, the corresponding number of both parties is generated according to the generation of the number parity rule.

[0058] When the encryption parameter is in the set value range, the encryption parameter is prime, if the encryption parameter is prime, the encryption parameter is input into the Elgamal encryption scheme, and the Elgamal encryption scheme is used to encrypt the data to be encrypted, if the encryption parameter is not prime, the corresponding number of both parties is generated according to the generation of the number parity rule.

[0059] Among them, the prime test algorithm is used for prime test algorithm, which is a mathematical algorithm for testing whether an integer is prime, because the encryption parameter n generated in the previous step is an odd number obtained by adding two random numbers, which cannot guarantee that it is prime, so it must be tested by using the prime test algorithm. At present, there is a very mature prime test algorithm in mathematics, so this embodiment can be directly applied.

[0060] The step S107 is described below:

[0061] This step uses the Elgamal encryption scheme to encrypt the data to be encrypted, which can be used in the field of data encryption and digital signature.

[0062] In one embodiment, one entity (A entity) needs to send a file (i.e. data to be encrypted) to another entity (B entity), first, according to steps S101~S106, the two entities jointly generate the encryption parameter n and input it into the Elgamal encryption scheme, A entity selects an element , satisfies is the primitive element of the multiplicative group , (n, ) as the public parameter of the system, then through the generation of the key and the encryption of the file to be sent (i.e. data to be encrypted), the encrypted file is obtained, and then the generated encrypted file is transmitted to B entity through the network, B entity gets the encrypted file and gets the original file content through decryption.

[0063] In another embodiment, when one entity (entity A) needs to prove its identity to another entity (entity B), first, the two entities jointly generate the encryption parameter n and input it into the Elgamal encryption scheme according to steps S101-S106, then the B entity sends a random number to the A entity, the A entity signs the random number by using the Elgamal encryption scheme, and sends the signature result to the B entity, and the B entity verifies the signature to determine whether the identity of the other party is true.

[0064] Please refer to Figure 2 The embodiment of the present application provides an encryption device 200 based on two-party joint generation of Elgamal encryption scheme parameters, comprising:

[0065] The generating unit 201 is configured to confirm the generation number parity rule of the two entities, and make the two entities generate corresponding values according to the generation number parity rule respectively.

[0066] The receiving unit 202 is configured to receive the values sent by the two entities.

[0067] The confirming unit 203 is configured to confirm the value range of the encryption parameter.

[0068] The value range checking unit 204 is configured to add the values generated by the two entities to obtain the encryption parameter, and check whether the encryption parameter is within the set value range.

[0069] The primality checking unit 205 is configured to perform primality checking on the encryption parameter if the encryption parameter is within the set value range.

[0070] The input unit 206 is configured to input the encryption parameter into the Elgamal encryption scheme if the encryption parameter is a prime number.

[0071] The encryption unit 207 is configured to encrypt the data to be encrypted by using the Elgamal encryption scheme.

[0072] Further, the generating unit 201 comprises:

[0073] The rule setting subunit is configured to set that one of the entities only generates odd numbers, and the other entity only generates even numbers, and the two entities take turns to replace each other.

[0074] Further, the generating unit 201 further comprises:

[0075] The judgment subunit is used for confirming the generation number parity rule of two entities, making the two entities generate corresponding values according to the generation number parity rule respectively, and performing hash operation on the corresponding values respectively to obtain hash operation results, and making the two entities exchange the hash operation results and the corresponding values generated by both sides in sequence, judging whether the other party exists fraud according to the values and the hash operation results, and feeding back according to the judgment result.

[0076] Further, the judgment subunit comprises:

[0077] The matching subunit is used for performing hash operation on the values sent by the other party through a hash function, matching the hash operation results calculated at present with the hash operation results sent by the other party, if not matching, determining that fraud exists, and generating corresponding values of both sides according to the generation number parity rule again, if matching, continuing the next step.

[0078] Further, the confirmation unit 203 comprises:

[0079] The setting subunit is used for setting the value range of the encryption parameter between 256 bits and 1024 bits.

[0080] Further, the value range inspection unit 204 comprises:

[0081] The regeneration subunit is used for if the encryption parameter is not in the set value range, generating corresponding values of both sides according to the generation number parity rule again.

[0082] Further, the input unit 206 further comprises:

[0083] The value regeneration subunit is used for if the encryption parameter is not a prime number, generating corresponding values of both sides according to the generation number parity rule again.

[0084] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-mentioned device and unit can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0085] The application further provides a computer readable storage medium, which has a computer program stored thereon, the computer program can implement the method provided by the foregoing embodiments when executed. The storage medium can include: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various storage medium capable of storing program codes.

[0086] The application further provides a computer device, which can include a memory and a processor, the memory has a computer program stored therein, and the processor can realize the method provided by the above-mentioned embodiments when calling the computer program in the memory. Of course, the computer device can also include various network interfaces, power supplies and other components.

[0087] The various embodiments are described in the specification by way of progressive progression, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be mutually referred to. For the device disclosed by the embodiments, since it corresponds to the method disclosed by the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part. It should be pointed out that, for those skilled in the art, without departing from the principle of the application, the application can be improved and modified in several ways, and these improvements and modifications also fall within the protection scope of the claims of the application.

[0088] It should also be noted that in the specification, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. An encryption method based on two-party joint generation of Elgamal encryption scheme parameters, characterized by, The method comprises the following steps: Confirming the generation number parity rule of two entities, so that the two entities generate corresponding values according to the generation number parity rule; Receiving the values sent by the two entities; Confirming the value range of the encryption parameter; Adding the values generated by the two entities to obtain the encryption parameter, and checking whether the encryption parameter is within the set value range; If the encryption parameter is within the set value range, performing primality test on the encryption parameter; If the encryption parameter is a prime number, inputting the encryption parameter into the Elgamal encryption scheme; Encrypting the data to be encrypted by using the Elgamal encryption scheme; The step of confirming the generation number parity rule of the two entities, so that the two entities generate corresponding values according to the generation number parity rule, comprises the following steps: Confirming the generation number parity rule of the two entities, so that the two entities generate corresponding values according to the generation number parity rule, and performing hash operation on the corresponding values to obtain hash operation results, and making the two entities exchange the hash operation results and the corresponding values generated by each other in turn, judging whether the other party exists fraud according to the values and the hash operation results, and feeding back according to the judgment result; The step of judging whether the other party exists fraud according to the values and the hash operation results, and feeding back according to the judgment result comprises the following steps: Performing hash operation on the values sent by the other party by using a hash function, matching the hash operation result currently calculated with the hash operation result sent by the other party, if the two do not match, it is determined that fraud exists, and the corresponding values of the two parties are generated again according to the generation number parity rule; If the two match, the next step is continued.

2. The encryption method based on two-party joint generation of Elgamal encryption scheme parameters according to claim 1, characterized in that, The generation number parity rule comprises the following steps: It is set that one of the entities only generates odd numbers, and the other entity only generates even numbers, and the two entities take turns to replace each other.

3. The encryption method based on two-party joint generation of Elgamal encryption scheme parameters according to claim 1, characterized in that, The value range of the encryption parameter is set to be between 256 bits and 1024 bits.

4. The encryption method based on two-party joint generation of Elgamal encryption scheme parameters according to claim 1, characterized in that, The step of adding the values generated by the two entities to obtain the encryption parameter, and checking whether the encryption parameter is within the set value range comprises the following steps: If the encryption parameter is not within the set value range, the corresponding values of the two parties are generated again according to the generation number parity rule.

5. The encryption method based on two-party joint generation of Elgamal encryption scheme parameters according to claim 1, characterized in that, The method further comprises the following steps: If the encryption parameter is not a prime number, the corresponding values of the two parties are generated again according to the generation number parity rule.

6. An encryption device for generating parameters of an Elgamal encryption scheme based on a two-party joint generation, characterized by The method comprises the following steps: A generation unit is configured to confirm the generation number parity rule of two entities, so that the two entities generate corresponding values according to the generation number parity rule; A receiving unit is configured to receive the values sent by the two entities; A confirming unit is configured to confirm the value range of the encryption parameter; A value range checking unit is configured to add the values generated by the two entities to obtain the encryption parameter, and check whether the encryption parameter is within the set value range; A primality testing unit is configured to perform primality test on the encryption parameter if the encryption parameter is within the set value range; An input unit is configured to input the encryption parameter into the Elgamal encryption scheme if the encryption parameter is a prime number; An encryption unit is configured to encrypt the data to be encrypted by using the Elgamal encryption scheme; The generation unit comprises the following steps: A judging subunit is configured to confirm a generation number parity rule of two entities, make the two entities generate corresponding values according to the generation number parity rule respectively, perform a hash operation on the corresponding values respectively to obtain hash operation results, and make the two entities exchange the hash operation results and the corresponding values generated by both sides in sequence, judge whether the other party exists fraud according to the values and the hash operation results, and feed back according to a judgment result. The judging subunit comprises: A matching subunit is configured to perform a hash operation on the values sent by the other party through a hash function, match the hash operation results calculated currently with the hash operation results sent by the other party, if the match fails, determine that fraud exists, and generate corresponding values of both sides according to the generation number parity rule again; if the match succeeds, continue with the next step.

7. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the encryption method based on two-party joint generation of Elgamal encryption scheme parameters according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program makes the processor execute the encryption method based on two-party joint generation of Elgamal encryption scheme parameters according to any one of claims 1 to 5 when the processor executes the computer program.

Images