A collaborative signature and decryption method and system for communicating parties based on elliptic curves

Abstract

The technical solution of the present invention provides a collaborative signature method and system for communicating parties based on the ECDSA algorithm, as well as a collaborative decryption method and system for communicating parties based on ECIES with the same inventive concept. The communicating parties generate their own sub-private keys and partial public keys respectively, and one of the parties calculates and publishes the complete public key based on its own sub-private key and the partial public keys of both parties. When the two parties sign or decrypt collaboratively, by exchanging the signature or decryption components generated by each party, the complete signature and message, or plain text, are finally calculated. The technical solution of the present invention solves the security problem of the private key in the ECC algorithm software cryptographic module, and through the security enhancement design of the collaborative signature algorithm, it avoids the risk of attackers inferring the private key components by repeatedly intercepting the information exchanged between the communicating parties during the collaborative signature process, thereby greatly improving the security of the collaborative signature.

Description

Technical Field

[0001] The present invention relates to the field of information security and cryptography application technology, and in particular to a collaborative signature and decryption method and system for communicating parties based on elliptic curves. Background Art

[0002] In the public key cryptography system, ensuring the security of the private key is a very important issue. The user's private key usually needs to be securely stored and used in special cryptographic hardware, and the private key cannot be exported from the cryptographic hardware. However, in Internet of Vehicles, smart home and other IoT applications and cloud computing systems, there are a large number of devices that are not equipped with hardware cryptographic modules. In response to the public key cryptographic application requirements of such devices, a common method is to introduce software cryptographic modules. In the application of software cryptographic modules, special attention should be paid to the standardized use of private keys and security and leakage prevention to ensure the security of information systems.

[0003] Elliptic curve public key cryptography (ECC) algorithm has made great progress and been widely used in recent years. In view of the security problem of private key in ECC algorithm software cryptographic module, a feasible solution is to store the private key in parts. When the private key needs to be used for cryptographic operation, each part of the storage uses its own sub-private key for cryptographic operation and exchanges some operation results with each other. The final cryptographic operation result is equivalent to the result of directly using the private key for cryptographic operation (such as digital signature).

[0004] The Elliptic Curve Digital Signature Algorithm (ECDSA) is a simulation of the Digital Signature Algorithm (DSA) using ECC. In order to solve the problem of the private key security of the ECDSA algorithm software cryptographic module, there are a few collaborative signature schemes. However, due to the characteristics of the ECDSA algorithm, the collaborative signature schemes in the prior art have great security risks. If an attacker intercepts the information exchanged by the communicating parties during the collaborative signature process multiple times, it is easy for the attacker to find unrelated equations about the private key components and calculate some of the private key components by solving the private key component equations, thereby threatening the security of the ECDSA algorithm. Summary of the invention

[0005] The purpose of the present invention is to provide a two-way collaborative signature and a corresponding collaborative decryption method and system with higher security performance in response to the security and confidentiality requirements of the ECC algorithm software cryptographic module, so as to further improve the private key security of the ECC algorithm software cryptographic module.

[0006] In order to achieve the above purpose, the technical solution of the present invention provides a collaborative signature method for communicating parties based on the ECDSA algorithm, and a collaborative signature system for communicating parties based on the ECDSA algorithm. The communicating parties generate their own sub-private keys and partial public keys respectively, and one of them calculates the complete public key based on its own sub-private key and the partial public keys of both parties and publishes it; when the two parties sign collaboratively, they exchange multiple signature components generated by each party and use the random number of the negotiation process to finally calculate the complete signature and message.

[0007] Specifically, the stage where both parties in communication collaborate to generate a public key includes:

[0008] S101, the first communication party generates a random number d1∈[1,n-1], and uses d1 as the sub-private key of the first communication party; calculates the elliptic curve point P1=[d1]G according to d1 and the base point G, which is the first part of the public key P1, and sends P1 to the second communication party;

[0009] S102, the second communication party generates a random number d2∈[1,n-1], and uses d2 as the sub-private key of the second communication party; the elliptic curve point P2=[d2]G is calculated based on d2 and the base point G, which is the second part of the public key P2; the complete public key P = P1+P2+[d2]P1 is calculated based on d2, P2 and the received P1, and P is made public;

[0010] The collaborative signing phase includes:

[0011] S201, the first communication party uses a predetermined hash function on the message M to be signed to obtain a message digest e;

[0012] S202, the first communication party generates a random number k1, b1∈[1,n-1], generates a first partial signature W1= [k1]G according to k1 and base point G, generates a second partial signature W2= [b1]G according to b1 and base point G, and sends e, W1 and W2 to the second communication party;

[0013] S203, the second communication party generates a random number k2,b2∈[1,n-1], calculates the elliptic curve point W = [k2]W1 according to k2 and the received W1, the coordinates of W are (x1,y1), calculates the third partial signature r = x1 mod n according to W, and returns to step S202 when r=0;

[0014] S204, the second communication party generates the fourth partial signature W3 = [b2]G according to b2 and the base point G; calculates the elliptic curve point T = [b2]W2 according to b2 and the received W2, the coordinates of T are (x2, y2), and obtains the process random number k3 = x2mod n according to T; calculates the fifth partial signature s1 = k2 according to r, d2, k3, k2 and the received e -1 (e+d2r) mod n and the sixth part of the signature s2 = k3k2 -1 (1+d2) mod n, and send r, W3, s1, s2 to the first communication party;

[0015] S205. The first communication party calculates the elliptic curve point T'= [b1]W3 according to b1 and the received W3, where the coordinates of T' are (x2', y2'), and calculates the process random number k3'= x2'mod n according to T'; calculates the signature component s = (k1 -1 s1+ k3' -1 k1 -1 d1s2r) mod n; if s=0, return to step S202, otherwise the first communication party outputs the message M and the complete signature (r, s);

[0016] In this case, [k]G is used to represent the k-fold point G on the elliptic curve E, and k is used to represent the k-fold point G on the elliptic curve E. -1 The inverse element k is expressed in the form of - 1 mod n, k is a positive integer; mod n means modulo n operation.

[0017] Correspondingly, the technical solution of the present invention also provides a collaborative decryption method for communicating parties based on ECIES, and a collaborative decryption system for communicating parties based on ECIES. The communicating parties use the same method as the collaborative signature of the communicating parties based on the ECDSA algorithm to generate their own sub-private keys and calculate the complete public key, and when the two parties collaboratively decrypt, they exchange the decryption components generated by each party and finally calculate the plaintext.

[0018] The stage where both parties in communication collaborate to generate a public key includes:

[0019] S101, the first communication party generates a random number d1∈[1,n-1], and uses d1 as the sub-private key of the first communication party; calculates the elliptic curve point P1=[d1]G according to d1 and the base point G, which is the first part of the public key P1, and sends P1 to the second communication party;

[0020] S102, the second communication party generates a random number d2∈[1,n-1], and uses d2 as the sub-private key of the second communication party; the elliptic curve point P2=[d2]G is calculated based on d2 and the base point G, which is the second part of the public key P2; the complete public key P = P1+P2+[d2]P1 is calculated based on d2, P2 and the received P1, and P is made public;

[0021] The collaborative decryption stage includes:

[0022] S201, the first communication party takes out R from the ciphertext structure and confirms its validity. If the confirmation fails, an error is reported and the communication party exits.

[0023] S202, the first communication party sends R to the second communication party;

[0024] S203, the second communication party calculates the elliptic curve point Z2 = [hd2]R according to d2 and R, and sends Z2 to the first communication party; where h is the cofactor obtained by dividing the order of the elliptic curve E by n;

[0025] S204. The first communication party calculates the elliptic curve point Z1=[hd1]R+[d1]Z2 according to d1, R, and Z2, where Z=Z1+Z2. The coordinates of Z are (x Z ,y Z ), if Z is a point at infinity, an error is reported and the program exits;

[0026] S205. The first communication party calculates (k1, k2) = KDF(x Z ,R), then calculate t' = MAC k2 (C); if t'≠ t, report an error and exit;

[0027] S206, the first communication party calculates the plaintext m = DEC k1 (C), and output m;

[0028] Among them, the k-times point G on the elliptic curve E is represented in the form of [k]G, k is a positive integer, k1 and k2 are derived keys, KDF is a key derivation function, MAC is a message authentication code algorithm, and DEC is a symmetric encryption algorithm.

[0029] The present invention has outstanding substantive features and significant progress compared to the prior art, specifically:

[0030] 1. The technical solution of the present invention ensures the security of the private key by splitting and storing the private key and collaboratively generating the public key. It can be used in a software cryptographic module that does not rely on cryptographic hardware to enhance the security and confidentiality of user data.

[0031] 2. The signing and decryption process in the technical solution of the present invention requires the cooperation of both communicating parties to complete, thereby enhancing the security and unforgeability of the collaborative signature and the security of the decryption, and also enhancing the interactivity between the communicating parties.

[0032] 3. The technical solution of the present invention allows the communicating parties to negotiate the process random number during the collaborative signature process, and utilizes the process random number in the calculation of the signature component. In this way, even if a third party intercepts the information exchanged by the communicating parties for multiple times and attempts to calculate part of the private key component by solving the private key component equation group, it will not be able to solve the equation group because it cannot simplify the process random number. This avoids the risk of a third-party attacker calculating the private key component by repeatedly intercepting the information exchanged by the communicating parties during the collaborative signature process, enhances the security of the information exchanged by the communicating parties during the collaborative signature process, and greatly improves the security of the collaborative signature. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a schematic diagram of a collaborative signature method between two communicating parties based on the ECDSA algorithm according to the present invention;

[0034] Figure 2 It is a schematic diagram of the implementation steps of a collaborative signature method between two communicating parties based on the ECDSA algorithm according to the present invention;

[0035] Figure 3 It is a schematic diagram of a collaborative decryption method between communicating parties based on ECIES according to the present invention. DETAILED DESCRIPTION

[0036] In the present invention, the point multiplication operation on the elliptic curve E is represented by the form of [k]G, where [k]G represents the k-times point G, and k is a positive integer; mod n represents the modulo n operation; and k is the -1 The inverse element k is expressed in the form of -1 mod n; the multiplication sign is omitted when indicating the multiplication of numerical values; for the elliptic curve point addition operation and the numerical addition operation, the symbol used is the plus sign "+". If it is the elliptic curve point addition, "+" indicates the point addition operation, and if it is the numerical addition, "+" indicates the numerical addition operation.

[0037] In addition, KDF is a key derivation function, MAC is a message authentication code algorithm, and DEC is a symmetric encryption algorithm.

[0038] Example 1

[0039] This embodiment provides a collaborative signature method between two communicating parties based on the ECDSA algorithm. Figure 1-2As shown, the communicating parties include a first communicating party and a second communicating party, the first communicating party and the second communicating party share an ECDSA algorithm elliptic curve E and a base point G with an order of n on E, and the method includes the following steps: including a collaborative public key generation stage and a collaborative signature stage,

[0040] The collaborative public key generation phase includes:

[0041] S101, the first communication party generates a random number d1∈[1,n-1], and uses d1 as the sub-private key of the first communication party; calculates the elliptic curve point P1=[d1]G according to d1 and the base point G, which is the first part of the public key P1, and sends P1 to the second communication party;

[0042] S102, the second communication party generates a random number d2∈[1,n-1], and uses d2 as the sub-private key of the second communication party; the elliptic curve point P2=[d2]G is calculated based on d2 and the base point G, which is the second part of the public key P2; the complete public key P = P1+P2+[d2]P1 is calculated based on d2, P2 and the received P1, and P is made public;

[0043] It can be understood that d1 and d2 are respectively obtained by one or more random number operations between [1, n-1], and the operations include linear operations, multiplication and inversion.

[0044] According to P = P1+P2+[d2]P1, we can get P= [d1]G+[d2]G+[d1d2]G, and thus the relationship between the private key d and the sub-private keys d1 and d2 in the ECDSA algorithm is d = (d1+d2+d1d2) mod n.

[0045] Obviously, the first communication party and the second communication party can only generate and store part of the private key, and cannot calculate the private key d from the parameters generated and obtained by themselves, thereby ensuring the security of the private key d.

[0046] The collaborative signing phase includes:

[0047] S201, the first communication party uses a predetermined hash function on the message M to be signed to obtain a message digest e;

[0048] S202, the first communication party generates a random number k1, b1∈[1,n-1], generates a first partial signature W1= [k1]G according to k1 and base point G, generates a second partial signature W2= [b1]G according to b1 and base point G, and sends e, W1 and W2 to the second communication party;

[0049] S203, the second communication party generates a random number k2,b2∈[1,n-1], calculates the elliptic curve point W = [k2]W1 according to k2 and the received W1, the coordinates of W are (x1,y1), calculates the third partial signature r = x1 mod n according to W, and returns to step S202 when r=0;

[0050] S204, the second communication party generates the fourth partial signature W3 = [b2]G according to b2 and the base point G; calculates the elliptic curve point T = [b2]W2 according to b2 and the received W2, the coordinates of T are (x2, y2), and obtains the process random number k3 = x2mod n according to T; calculates the fifth partial signature s1 = k2 according to r, d2, k3, k2 and the received e -1 (e+d2r) mod n and the sixth part of the signature s2 = k3k2 -1 (1+d2) mod n, and send r, W3, s1, s2 to the first communication party;

[0051] S205. The first communication party calculates the elliptic curve point T'= [b1]W3 according to b1 and the received W3, where the coordinates of T' are (x2', y2'), and calculates the process random number k3'= x2'mod n according to T'; calculates the signature component s = (k1 -1 s1+ k3' -1 k1 -1 d1s2r) mod n; if s=0, return to step S202, otherwise the first communication party outputs the message M and the complete signature (r, s);

[0052] In this case, [k]G is used to represent the k-fold point G on the elliptic curve E, and k is used to represent the k-fold point G on the elliptic curve E. -1 The inverse element k is expressed in the form of - 1 mod n, k is a positive integer; mod n means modulo n operation.

[0053] Among them, k1, b1, k2, and b2 can also be obtained by one or more random number operations between [1, n-1], and the operations include linear operations, multiplication, and inversion.

[0054] It can be understood that, in this embodiment, the first communication party and the second communication party are mutually trusted communication parties, that is, neither party will become an attacker, and can avoid being hacked and controlled by a third party to become an attacker, which can ensure that the system is more secure.

[0055] The proof of the correctness of the collaborative signature is as follows:

[0056] Let k = k1k2 mod n,

[0057] Then W = [k2]W1= [k1k2]G= [k]G, its coordinates are (x1,y1), r = x1 mod n;

[0058] From T = [b2]W2 = [b1b2]G, T' = [b1]W3 = [b1b2]G, we can know that T = T',

[0059] The coordinates of T are (x2, y2), the coordinates of T' are (x2', y2'), and k3 = x2 mod n, k3' = x2' mod n, then k3' = k3, so

[0060] s = (k1 -1 s1+ k3' -1 k1 -1 d1s2r) mod n

[0061] = (k1 -1 k2 -1 (e+d2r) + k3 -1 k1 -1 d1s2r) mod n

[0062] = ((k1k2) -1 (e+d2r) + k3 -1 k1 -1 d1k3k2 -1 (1+d2)r) mod n

[0063] = (k -1 (e+d2r) + k1 -1 k2 -1 d1(1+d2)r) mod n

[0064] = (k -1 (e+d2r) + k -1 d1(1+d2)r) mod n

[0065] = k -1 ((e+d2r) + (d1+d1d2)r) mod n

[0066] = k -1 (e + (d2+d1+d1d2)r) mod n

[0067] = k -1 (e + dr) mod n

[0068] It can be seen that the above collaborative signature algorithm can sign correctly.

[0069] In the collaborative signature process, the two communicating parties negotiated the process random number k3, and each party calculated the process random number k3 based on a random number generated by itself and the parameters sent by the other party. k3 is used in the calculation of the sixth part of the signature s2. In this way, even if a third party intercepts the information exchanged by the two communicating parties many times and tries to find unrelated equations about the private key components and calculate some private key components by solving the private key component equation group, it will not be able to solve the equation group because it cannot simplify the process random number k3. Therefore, during the communication process between the two communicating parties, the sensitive information of the sub-private keys of the two communicating parties is protected. This ensures that the private key is safe, thereby ensuring the security of the signature algorithm.

[0070] This technical solution avoids the risk of a third-party attacker inferring the private key component by repeatedly intercepting the information exchanged between the communicating parties during the collaborative signature process, enhances the security of the information exchanged between the communicating parties during the collaborative signature process, and greatly improves the security of the collaborative signature.

[0071] Example 2

[0072] Based on the same inventive concept as the above method, this embodiment provides a collaborative decryption method between communicating parties based on ECIES, in which the communicating parties use the same method as the collaborative signing method between communicating parties based on the ECDSA algorithm to generate their own sub-private keys and calculate a complete public key.

[0073] like Figure 3 As shown, the method involves a first communication party and a second communication party, the first communication party and the second communication party share an elliptic curve E and a base point G with an order of n on E; the ciphertext is obtained by encrypting the plaintext using a public key P by an encryption terminal using an ECIES-based encryption algorithm, wherein the ECIES encryption algorithm is: using a random number and a public key of a receiver to generate an encryption key ek and a MAC key mk, encrypting the plaintext M with ek to obtain a ciphertext C, using mk to generate a label t of the ciphertext C, and sending the random elliptic curve point R, the ciphertext C and the label t to the receiver together in a ciphertext structure of R||C||t, wherein || represents concatenation; the collaborative decryption method includes a collaborative public key generation stage and a collaborative decryption stage,

[0074] The collaborative public key generation phase includes:

[0075] S101, the first communication party generates a random number d1∈[1,n-1], and uses d1 as the sub-private key of the first communication party; calculates the elliptic curve point P1=[d1]G according to d1 and the base point G, which is the first part of the public key P1, and sends P1 to the second communication party;

[0076] S102, the second communication party generates a random number d2∈[1,n-1], and uses d2 as the sub-private key of the second communication party; the elliptic curve point P2=[d2]G is calculated based on d2 and the base point G, which is the second part of the public key P2; the complete public key P = P1+P2+[d2]P1 is calculated based on d2, P2 and the received P1, and P is made public;

[0077] The collaborative decryption stage includes:

[0078] S201, the first communication party takes out R from the ciphertext structure and confirms its validity. If the confirmation fails, an error is reported and the communication party exits.

[0079] S202, the first communication party sends R to the second communication party;

[0080] S203, the second communication party calculates the elliptic curve point Z2 = [hd2]R according to d2 and R, and sends Z2 to the first communication party; where h is the cofactor obtained by dividing the order of the elliptic curve E by n;

[0081] S204. The first communication party calculates the elliptic curve point Z1=[hd1]R+[d1]Z2 according to d1, R, and Z2. Z=Z1+Z2, and the coordinates of Z are (x Z ,y Z ), if Z is a point at infinity, an error is reported and the program exits;

[0082] S205. The first communication party calculates (k1, k2) = KDF(x Z ,R), then calculate t' = MAC k2 (C); if t'≠ t, report an error and exit;

[0083] S206, the first communication party calculates the plaintext m = DEC k1 (C), and output m;

[0084] Among them, the k-times point G on the elliptic curve E is represented in the form of [k]G, k is a positive integer, k1 and k2 are derived keys, KDF is a key derivation function, MAC is a message authentication code algorithm, and DEC is a symmetric encryption algorithm.

[0085] In this embodiment, it can be seen from P = P1+P2+[d2]P1 = [d1]G+[d2]G+[d1d2]G that the relationship between the private key d and the sub-private keys d1 and d2 in the ECIES decryption algorithm is d = d1+d2+d1d2mod n.

[0086] The proof of the correctness of collaborative decryption is as follows:

[0087] Z = Z1+Z2

[0088] = [hd1]R+[d1]Z2+[hd2]R

[0089] = [hd1]R+[hd1d2]R+[hd2]R

[0090] = [hd1+hd2+hd1d2]R

[0091] = [h(d1+d2+d1d2)]R

[0092] = [hd]R

[0093] The process after calculating Z is the same as the general process of ECIES decryption.

[0094] It can be seen that the above collaborative decryption algorithm can decrypt correctly.

[0095] Only through collaborative operations between the communicating parties can the message be decrypted. An attacker cannot obtain the private key by intercepting the communication between the two parties or invading either party, nor can he correctly decrypt the secret information, thereby enhancing the security of the cryptographic algorithm.

[0096] Example 3

[0097] Based on the same inventive concept as that of Example 1, this embodiment provides a collaborative signature system for communicating parties based on the ECDSA algorithm, including a first communicating party and a second communicating party, wherein the first communicating party includes a first cryptographic operation module and a first communication module, and the second communicating party includes a second cryptographic operation module and a second communication module, and the first communicating party and the second communicating party are connected in communication via the first communication module and the second communication module; the first communicating party and the second communicating party share an ECDSA algorithm elliptic curve E and a base point G with an order of n on E; the first communicating party and the second communicating party collaboratively generate a public key, and perform collaborative signing when a signature is required; wherein the process of the first communicating party and the second communicating party collaboratively generating a public key includes:

[0098] The first communication party generates a random number d1∈[1,n-1] through the first cryptographic operation module, and uses d1 as the sub-private key of the first communication party; calculates the elliptic curve point P1=[d1]G according to d1 and the base point G, which is the first partial public key P1, and then sends P1 to the second communication party through the first communication module;

[0099] The second communication party receives P1 through the second communication module, generates a random number d2∈[1,n-1] through the second cryptographic operation module, and uses d2 as the sub-private key of the second communication party; calculates the elliptic curve point P2=[d2]G according to d2 and the base point G, which is the second part of the public key P2; then calculates the complete public key P = P1+P2+[d2]P1 according to d2, P2 and the received P1, and publishes P through the second communication module;

[0100] The process of the first communication party and the second communication party co-signing includes:

[0101] The first communication party uses a predetermined hash function on the signed message M through the first cryptographic operation module to obtain a message digest e;

[0102] The first communication party generates a random number k1, b1∈[1, n-1], generates a first partial signature W1 according to k1, generates a second partial signature W2 according to b1, and sends e, W1 and W2 to the second communication party through the first communication module;

[0103] The second communication party receives e, W1 and W2 through the second communication module, generates a random number k2,b2∈[1,n-1] through the second cryptographic operation module, calculates the elliptic curve point W = [k2]W1 according to k2 and the received W1, the coordinates of W are (x1,y1), and calculates the third partial signature r = x1 mod n according to W; if r=0, restarts the collaborative signature process;

[0104] The second communication party generates the fourth partial signature W3 = [b2]G according to b2; calculates the elliptic curve point T = [b2]W2 according to b2 and the received W2, the coordinates of T are (x2, y2), and calculates the process random number k3 = x2mod n according to T; calculates the fifth partial signature s1 = k2 according to r, d2, k3, k2 and the received e -1 (e+d2r) mod n and the sixth part signature s2 = k3k2 -1 (1+d2) mod n, and send r, W3, s1, s2 to the first communication party through the second communication module;

[0105] The first communication party receives r, W3, s1, and s2 through the first communication module, and calculates the elliptic curve point T'= [b1]W3 according to b1 and the received W3 through the first cryptographic operation module, where the coordinates of T' are (x2', y2'), and calculates the process random number k3'= x2'mod n according to T'; and calculates the signature component s = (k1 -1s1+ k3' -1 k1 -1 d1s2r) mod n; if s = 0, restart the collaborative signing process, otherwise the first communication party outputs the message M and the complete signature (r, s);

[0106] In this case, [k]G is used to represent the k-fold point G on the elliptic curve E, and k is used to represent the k-fold point G on the elliptic curve E. -1 The inverse element k is expressed in the form of - 1 mod n, k is a positive integer; mod n means modulo n operation.

[0107] Example 4

[0108] Based on the same inventive concept as that of Example 2, this embodiment provides a collaborative decryption system for communicating parties based on ECIES, including a first communicating party and a second communicating party, the first communicating party including a first cryptographic operation module and a first communication module, the second communicating party including a second cryptographic operation module and a second communication module, the first communicating party and the second communicating party are connected in communication via the first communication module and the second communication module; the first communicating party and the second communicating party share an elliptic curve E and a base point G with an order of n on E; the first communicating party and the second communicating party collaboratively generate a public key, and perform collaborative decryption when decryption is required; wherein the process of the first communicating party and the second communicating party collaboratively generating a public key includes:

[0109] The first communication party generates a random number d1∈[1,n-1] through the first cryptographic operation module, and uses d1 as the sub-private key of the first communication party; calculates the elliptic curve point P1=[d1]G according to d1 and the base point G, which is the first partial public key P1, and then sends P1 to the second communication party through the first communication module;

[0110] The second communication party receives P1 through the second communication module, generates a random number d2∈[1,n-1] through the second cryptographic operation module, and uses d2 as the sub-private key of the second communication party; calculates the elliptic curve point P2=[d2]G according to d2 and the base point G, which is the second part of the public key P2; then calculates the complete public key P = P1+P2+[d2]P1 according to d2, P2 and the received P1, and publishes P through the second communication module;

[0111] The process of collaborative decryption between the first communication party and the second communication party includes:

[0112] Assume that the ciphertext structure is R||C||t, where || represents concatenation; the first communication party takes out R from the ciphertext structure through the first cryptographic operation module and confirms its validity. If the confirmation fails, an error is reported and the program exits; if the confirmation succeeds, R is sent to the second communication party;

[0113] The second communication party receives R through the second communication module, calculates the elliptic curve point Z2 = [hd2]R according to d2 and R through the second cryptographic operation module, and sends Z2 to the first communication party through the second communication module;

[0114] The first communication party receives Z2 through the first communication module, and calculates the elliptic curve point Z1=[hd1]R+[d1]Z2, Z = Z1+Z2, according to d1, R, and Z2 through the first cryptographic operation module. If Z is a point at infinity, an error is reported and the system exits. Otherwise, according to the coordinates of Z (x Z ,y Z ) and R calculates (k1,k2) = KDF(x Z ,R), then calculate t' = MAC k2 (C); If t'≠ t, report an error and exit, otherwise calculate the plaintext m = DEC k1 (C), and output m;

[0115] Among them, the k-times point G on the elliptic curve E is represented in the form of [k]G, k is a positive integer, k1 and k2 are derived keys, KDF is a key derivation function, MAC is a message authentication code algorithm, and DEC is a symmetric encryption algorithm.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or some technical features can be replaced by equivalents without departing from the spirit of the technical solution of the present invention, which should be included in the scope of the technical solution for protection of the present invention.

Claims

1. A collaborative signature method between two communicating parties based on the ECDSA algorithm, wherein the two communicating parties include a first communicating party and a second communicating party, and the first communicating party and the second communicating party share an ECDSA algorithm elliptic curve E and a base point G of order n on E, characterized in that: The method comprises the following steps: a collaborative public key generation phase and a collaborative signature phase, The collaborative public key generation phase includes: S101, the first communication party generates a random number d1∈[1,n-1], and uses d1 as the sub-private key of the first communication party; calculates the elliptic curve point P1=[d1]G according to d1 and the base point G, which is the first part of the public key P1, and sends P1 to the second communication party; S102, the second communication party generates a random number d2∈[1,n-1], and uses d2 as the sub-private key of the second communication party; the elliptic curve point P2=[d2]G is calculated based on d2 and the base point G, which is the second part of the public key P2; the complete public key P = P1+P2+[d2]P1 is calculated based on d2, P2 and the received P1, and P is made public; The collaborative signing phase includes: S201, the first communication party uses a predetermined hash function on the message M to be signed to obtain a message digest e; S202, the first communication party generates a random number k1, b1∈[1,n-1], generates a first partial signature W1= [k1]G according to k1 and base point G, generates a second partial signature W2= [b1]G according to b1 and base point G, and sends e, W1 and W2 to the second communication party; S203, the second communication party generates a random number k2,b2∈[1,n-1], calculates the elliptic curve point W = [k2]W1 according to k2 and the received W1, the coordinates of W are (x1,y1), calculates the third partial signature r = x1 mod n according to W, and returns to step S202 when r=0; S204, the second communication party generates the fourth partial signature W3 = [b2]G according to b2 and the base point G; calculates the elliptic curve point T = [b2]W2 according to b2 and the received W2, the coordinates of T are (x2, y2), and obtains the process random number k3 = x2modn according to T; calculates the fifth partial signature s1 = k2 according to r, d2, k3, k2 and the received e -1 (e+d2r) mod n and the sixth part of the signature s2 = k3k2 -1 (1+d2) mod n, and send r, W3, s1, s2 to the first communication party; S205. The first communication party calculates the elliptic curve point T'= [b1]W3 according to b1 and the received W3, where the coordinates of T' are (x2', y2'), and calculates the process random number k3'= x2'mod n according to T'; calculates the signature component s = (k1 -1 s1+ k3' -1 k1 -1 d1s2r) mod n; if s=0, return to step S202, otherwise the first communication party outputs the message M and the complete signature (r, s); In this case, [k]G is used to represent the k-fold point G on the elliptic curve E, and k is used to represent the k-fold point G on the elliptic curve E. -1 The inverse element k is expressed in the form of -1 mod n, k is a positive integer; mod n means modulo n operation.

2. The method for collaborative signature between two communicating parties based on the ECDSA algorithm according to claim 1 is characterized in that: The random numbers d1, d2, b1, b2, k1, and k2 are respectively obtained by one or more random number operations between [1, n-1]; the operations include linear operations, multiplication, and inversion.

3. The collaborative signature method between two communicating parties based on the ECDSA algorithm according to claim 1 is characterized in that: The first communication party and the second communication party are trusted communication parties.

4. A collaborative decryption method between two communicating parties based on ECIES, wherein the two communicating parties include a first communicating party and a second communicating party, and the first communicating party and the second communicating party share an ECIES algorithm elliptic curve E and a base point G of order n on E; assuming that the ciphertext structure is R||C||t, where || represents concatenation, R represents a random elliptic curve point, C represents ciphertext, and t represents a tag, characterized in that: The collaborative decryption method includes a collaborative public key generation phase and a collaborative decryption phase. The collaborative public key generation phase includes: S101, the first communication party generates a random number d1∈[1,n-1], and uses d1 as the sub-private key of the first communication party; calculates the elliptic curve point P1=[d1]G according to d1 and the base point G, which is the first part of the public key P1, and sends P1 to the second communication party; S102, the second communication party generates a random number d2∈[1,n-1], and uses d2 as the sub-private key of the second communication party; the elliptic curve point P2=[d2]G is calculated based on d2 and the base point G, which is the second part of the public key P2; the complete public key P = P1+P2+[d2]P1 is calculated based on d2, P2 and the received P1, and P is made public; The collaborative decryption stage includes: S201, the first communication party takes out R from the ciphertext structure and confirms its validity. If the confirmation fails, an error is reported and the communication party exits. S202, the first communication party sends R to the second communication party; S203, the second communication party calculates the elliptic curve point Z2 = [hd2]R according to d2 and R, and sends Z2 to the first communication party; where h is the cofactor obtained by dividing the order of the elliptic curve E by n; S204. The first communication party calculates the elliptic curve point Z1=[hd1]R+[d1]Z2 according to d1, R, and Z2, where Z=Z1+Z2. The coordinates of Z are (x Z ,y Z ), if Z is a point at infinity, an error is reported and the program exits; S205. The first communication party calculates (k1, k2) = KDF(x Z ,R), then calculate t' = MAC k2 (C); if t'≠ t, report an error and exit; S206, the first communication party calculates the plaintext m = DEC k1 (C), and output m; In which, the k-times point G on the elliptic curve E is represented in the form of [k]G, k is a positive integer, k1 and k2 are derived keys, KDF is a key derivation function, MAC is a message authentication code algorithm, and DEC is a symmetric encryption algorithm.

5. The method for collaborative decryption between two communicating parties based on ECIES according to claim 4, characterized in that: The random numbers d1 and d2 are obtained by performing one or more random number operations between [1, n-1] respectively; the operations include linear operations, multiplication, and inversion.

6. The method for collaborative decryption between two communicating parties based on ECIES according to claim 4, characterized in that: The ciphertext is obtained by encrypting the plaintext using the public key P by the encryption terminal using the ECIES-based encryption algorithm.

7. A collaborative signature system for communicating parties based on the ECDSA algorithm, comprising a first communicating party and a second communicating party, wherein the first communicating party comprises a first cryptographic operation module and a first communication module, and the second communicating party comprises a second cryptographic operation module and a second communication module, wherein the first communicating party and the second communicating party are connected in communication via the first communication module and the second communication module; the first communicating party and the second communicating party share an ECDSA algorithm elliptic curve E and a base point G with an order of n on E; the first communicating party and the second communicating party collaboratively generate a public key and perform collaborative signing when a signature is required; characterized in that: The process of the first communication party and the second communication party collaboratively generating a public key includes: The first communication party generates a random number d1∈[1,n-1] through the first cryptographic operation module, and uses d1 as the sub-private key of the first communication party; calculates the elliptic curve point P1=[d1]G according to d1 and the base point G, which is the first partial public key P1, and then sends P1 to the second communication party through the first communication module; The second communication party receives P1 through the second communication module, generates a random number d2∈[1,n-1] through the second cryptographic operation module, and uses d2 as the sub-private key of the second communication party; calculates the elliptic curve point P2=[d2]G according to d2 and the base point G, which is the second part of the public key P2; then calculates the complete public key P = P1+P2+[d2]P1 according to d2, P2 and the received P1, and publishes P through the second communication module; The process of the first communication party and the second communication party co-signing includes: The first communication party uses a predetermined hash function on the signed message M through the first cryptographic operation module to obtain a message digest e; The first communication party generates a random number k1, b1∈[1, n-1], generates a first partial signature W1 according to k1, generates a second partial signature W2 according to b1, and sends e, W1 and W2 to the second communication party through the first communication module; The second communication party receives e, W1 and W2 through the second communication module, generates a random number k2,b2∈[1,n-1] through the second cryptographic operation module, calculates the elliptic curve point W = [k2]W1 according to k2 and the received W1, the coordinates of W are (x1,y1), and calculates the third partial signature r = x1 mod n according to W; if r=0, restarts the collaborative signature process; The second communication party generates the fourth partial signature W3 = [b2]G according to b2; calculates the elliptic curve point T = [b2]W2 according to b2 and the received W2, the coordinates of T are (x2, y2), and calculates the process random number k3 = x2mod n according to T; calculates the fifth partial signature s1 = k2 according to r, d2, k3, k2 and the received e -1 (e+d2r) mod n and the sixth part signature s2 = k3k2 -1 (1+d2) mod n, and send r, W3, s1, s2 to the first communication party through the second communication module; The first communication party receives r, W3, s1, and s2 through the first communication module, and calculates the elliptic curve point T'= [b1]W3 according to b1 and the received W3 through the first cryptographic operation module, where the coordinates of T' are (x2', y2'), and calculates the process random number k3'= x2'mod n according to T'; and calculates the signature component s = (k1 -1 s1+ k3' -1 k1 - 1 d1s2r) mod n; if s = 0, restart the collaborative signing process, otherwise the first communication party outputs the message M and the complete signature (r, s); In this case, [k]G is used to represent the k-fold point G on the elliptic curve E, and k is used to represent the k-fold point G on the elliptic curve E. -1 The inverse element k is expressed in the form of -1 mod n, k is a positive integer; mod n means modulo n operation.

8. A collaborative decryption system for communicating parties based on ECIES, characterized in that: The invention comprises a first communication party and a second communication party, wherein the first communication party comprises a first cryptographic operation module and a first communication module, and the second communication party comprises a second cryptographic operation module and a second communication module, and the first communication party and the second communication party are connected in communication via the first communication module and the second communication module; the first communication party and the second communication party share an ECIES algorithm elliptic curve E and a base point G with an order of n on E; the first communication party and the second communication party jointly generate a public key, and perform joint decryption when decryption is required; the invention is characterized in that: The process of the first communication party and the second communication party collaboratively generating a public key includes: The first communication party generates a random number d1∈[1,n-1] through the first cryptographic operation module, and uses d1 as the sub-private key of the first communication party; calculates the elliptic curve point P1=[d1]G according to d1 and the base point G, which is the first partial public key P1, and then sends P1 to the second communication party through the first communication module; The second communication party receives P1 through the second communication module, generates a random number d2∈[1,n-1] through the second cryptographic operation module, and uses d2 as the sub-private key of the second communication party; calculates the elliptic curve point P2=[d2]G according to d2 and the base point G, which is the second part of the public key P2; then calculates the complete public key P = P1+P2+[d2]P1 according to d2, P2 and the received P1, and publishes P through the second communication module; The process of collaborative decryption between the first communication party and the second communication party includes: Assume that the ciphertext structure is R||C||t, where || represents concatenation, R represents a random elliptic curve point, C represents ciphertext, and t represents a tag; the first communication party takes out R from the ciphertext structure through the first cryptographic operation module and confirms its validity. If the confirmation fails, an error is reported and the communication party exits; if the confirmation succeeds, R is sent to the second communication party through the first communication module; The second communication party receives R through the second communication module, calculates the elliptic curve point Z2 = [hd2]R according to d2 and R through the second cryptographic operation module, and sends Z2 to the first communication party through the second communication module; where h is the cofactor obtained by dividing the order of the elliptic curve E by n; The first communication party receives Z2 through the first communication module, and calculates the elliptic curve point Z1=[hd1]R+[d1]Z2, Z = Z1+Z2, according to d1, R, and Z2 through the first cryptographic operation module. If Z is a point at infinity, an error is reported and the system exits. Otherwise, according to the coordinates of Z (x Z ,y Z ) and R calculates (k1,k2) = KDF(x Z ,R), then calculate t' = MAC k2 (C); If t'≠ t, report an error and exit, otherwise calculate the plaintext m = DEC k1 (C), and output m; Among them, the k-times point G on the elliptic curve E is represented in the form of [k]G, k is a positive integer, k1 and k2 are derived keys, KDF is a key derivation function, MAC is a message authentication code algorithm, and DEC is a symmetric encryption algorithm.

Images