Certificateless signature generation method and system based on SM9

Abstract

The application is suitable for the field of information security technology, and provides a certificateless signature generation method and system based on SM9, which comprises the following steps: step S100, system initialization, selecting a master private key from the system, and calculating a master public key according to the master private key; step S200, extracting a partial private key, extracting the partial private key as a partial private key of a signer through the master private key; step S300, setting a secret value, selecting a signer secret value; and step S400, setting a public key. The application is based on the SM9 signature structure, then the certificateless cryptography, and an improved certificateless signature of SM9 is proposed. Compared with the traditional public key cryptography system, the application effectively guarantees the integrity and authenticity of data in the transmission process, fills the gap of the domestic identity cryptography system, and lays a solid underlying cryptography foundation for the application level security.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a certificateless signature generation method and system based on SM9. Background Technology

[0002] Digital signatures are a crucial means of ensuring network information security. They can replace traditional handwritten signatures in a network environment and possess security features such as tamper-proofing, non-repudiation, and impersonation prevention. With the development of the information age and the diversification of network application scenarios, traditional digital signature algorithms can no longer meet the information security needs of new applications.

[0003] In 2003, Al-Riyami and Paterson proposed certificateless public-key cryptography. Compared to traditional public-key cryptography, certificateless cryptography does not require any certificates to ensure the authenticity of a user's public key. It relies on a semi-trusted third-party key generation center (KGC) that holds the master key. In a certificateless system, the KGC only provides the user with a portion of their private key, which is calculated based on the user's identity. The user also holds a secret value of their choice. The user combines their partial private key with their secret value to generate their actual private key, avoiding the problem of excessive KGC authority in identity-based cryptography. With these advantages, certificateless public-key systems can provide robust security for mobile devices while meeting the efficiency requirements of resource-constrained devices.

[0004] On March 28, 2016, the State Cryptography Administration released the SM9 identifier cryptography algorithm. SM9, as an identifier cryptography standard (standard number: GM / T 0044-2016SM9 identifier cryptography algorithm), mainly consists of three parts: a digital signature algorithm, a public-key encryption algorithm, and a key exchange protocol. The SM9 standard can be applied to electronic authentication services, identity authentication, and email systems, effectively ensuring the integrity and authenticity of data during transmission, filling the gap in domestically developed identifier cryptography systems, and laying a solid underlying cryptographic foundation for application-level security.

[0005] In summary, this patent presents a certificateless signature generation method and system based on SM9. Summary of the Invention

[0006] This invention provides a certificateless signature generation method and system based on SM9, which effectively ensures the integrity and authenticity of data during transmission, laying a solid underlying cryptographic foundation for application-level security. Furthermore, the certificateless signature method does not require any certificate to ensure the authenticity of the user's public key, avoiding the problem of excessive KGC privileges in identity-based cryptography.

[0007] The present invention is implemented as follows: a certificateless signature generation method based on SM9 includes the following steps:

[0008] Step S100: System initialization, select the master private key from the system, and calculate the master public key based on the master private key;

[0009] Step S200: Extract a partial private key. The partial private key is extracted from the master private key and used as the signer's partial private key.

[0010] Step S300: Set secret value, select to set signer secret value;

[0011] Step S400: Set the public key and calculate the public key based on the secret value;

[0012] Step S500: Set the private key, and calculate the signer's private key based on the partial private key calculated in the above steps;

[0013] Step S600: Calculate the signature value. Given the message, private key, and identity information, calculate the signature value.

[0014] Step S700: Verify the key. Given the message, public key, identity, and signature, perform signature authentication calculation.

[0015] In a preferred embodiment of the present invention, the parameters selected in this method are consistent with the standard parameters of the SM9 signature algorithm, and the specific symbols are described below:

[0016] q: a large prime number;

[0017] The set of integers consisting of 1, 2, ..., q-1;

[0018] G1, G2: Additive cyclic groups of order q;

[0019] G T : A multiplicative cyclic group of order q;

[0020] P1, P2: generators of groups G1 and G2, respectively;

[0021] g r Multiplication group G T The r-th power of the element g;

[0022] [k]P: A point on the elliptic curve that is k times the value of point P, where k is a positive integer;

[0023] e: From G1×G2 to G T Bilinear pair mapping;

[0024] H1(·), H2(·): Cryptographic functions derived from the cryptographic hash function, both of which are

[0025] msk: The system master private key secretly held by KGC;

[0026] mpk: The system master public key published by KGC, calculated as mpk = [msk]P2;

[0027] ID: A user's identifiable identifier;

[0028] usk0: Part of the private key of signer S;

[0029] s: The secret value of the signer S;

[0030] upk: The public key of the signer S;

[0031] usk: The private key of the signer S;

[0032] m: The message to be signed;

[0033] σ = (σ1, σ2): The signature value corresponding to message m;

[0034] mod q: Modulo q operation; for example, 23 mod 7 ≡ 2;

[0035] x||y: The concatenation of x and y, where x and y can be bit strings or byte strings.

[0036] As a preferred embodiment of the present invention, the detailed steps of step S100 are as follows:

[0037] Key generation center KGC is randomly selected As the master private key;

[0038] Calculate the master public key mpk = [msk]P2.

[0039] As a preferred embodiment of the present invention, the detailed steps of step S200 are as follows:

[0040] KGC calculates t1 = H1(ID) + msk;

[0041] Part of the private key of the signer S is

[0042] As a preferred embodiment of the present invention, the detailed steps of step S300 are as follows:

[0043] Random selection

[0044] Use s as your secret value.

[0045] In a preferred embodiment of the present invention, the calculation steps for setting the public key in step S400 and calculating the public key based on the secret value are as follows:

[0046] upk = [s]P1.

[0047] As a preferred embodiment of the present invention, the calculation formula for step S500 is as follows:

[0048] usk = [s]usk0.

[0049] As a preferred embodiment of the present invention, the detailed calculation steps of step S600 are as follows:

[0050] a) Given a message m, a private key usk, and an identity ID;

[0051] b) Random selection

[0052] c) Calculate G T The element g = e(upk,mpk) in the array;

[0053] d) Calculate Q = g r ;

[0054] e) Calculate σ1=H2(m||Q);

[0055] f) Calculate h = r - σ1;

[0056] g) Calculate σ² = [h]usk;

[0057] h) Output the signature value σ = (σ1, σ2).

[0058] As a preferred embodiment of the present invention, the detailed calculation steps of step S7 are as follows:

[0059] a) Given a message m, a public key upk, an identity ID, and a signature σ.

[0060] b) Calculate G T The element g = e(upk, mpk) in the equation

[0061] c) Calculate t2 = H1(ID)

[0062] d) Calculate R = [t²]P² + mpk,

[0063] e) Calculate u = e(σ²,R)

[0064] f) Calculate

[0065] g) Determine whether σ1=H2(m||w) is true. If true, then σ is a valid signature; otherwise, the signature is invalid.

[0066] Correctness:

[0067]

[0068]

[0069] A certificateless signature generation system based on SM9, comprising:

[0070] An initialization unit, which is used to perform system initialization calculations;

[0071] A partial private key extraction unit, wherein the partial private key extraction unit is used for partial private key extraction calculation;

[0072] A secret value setting unit, wherein the secret value setting unit is used to set a secret value;

[0073] A public key setting unit, which is used to set a public key;

[0074] A private key setting unit, wherein the private key setting unit is used to set a private key;

[0075] The signature unit is used to perform the calculation of the output signature value;

[0076] The verification unit is used to verify the signature information of the system.

[0077] The beneficial effects of this invention are as follows: Based on the SM9 signature structure and certificateless cryptography, this scheme proposes an improved version of SM9 certificateless signature. Compared with traditional public-key cryptography systems, it does not require any certificates to ensure the authenticity of the user's public key. Certificateless cryptography relies on a semi-trusted third-party key generation center (KGC) that possesses the master key. In the certificateless system, the KGC only provides the user with a portion of the private key, which is calculated based on the user's identity. The user also holds a secret value of their choice. The user combines their partial private key with their secret value to generate their actual private key, avoiding the problem of excessive KGC authority in identity-based cryptography. This effectively ensures the integrity and authenticity of data during transmission, fills the gap in domestically developed identity-based cryptography, and lays a solid underlying cryptographic foundation for application-level security. Attached Figure Description

[0078] Fig. 1 This is a flowchart illustrating the steps of a certificateless signature generation method based on SM9 according to the present invention.

[0079] Fig. 2 This is a schematic diagram of a certificateless signature generation method based on SM9 according to the present invention;

[0080] Fig. 3 This is a structural block diagram of a certificateless signature generation system based on SM9 according to the present invention. Detailed Implementation

[0081] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0082] This invention is based on the SM9 identifier cryptography algorithm and leverages the advantages of certificateless systems to propose an improved version of SM9 certificateless signature with lower computational overhead.

[0083] The present invention is implemented as follows: a certificateless signature generation method based on SM9 includes the following steps:

[0084] Step S100: System initialization, select the master private key from the system, and calculate the master public key based on the master private key;

[0085] Step S200: Extract a partial private key. The partial private key is extracted from the master private key and used as the signer's partial private key.

[0086] Step S300: Set secret value, select to set signer secret value;

[0087] Step S400: Set the public key and calculate the public key based on the secret value;

[0088] Step S500: Set the private key, and calculate the signer's private key based on the partial private key calculated in the above steps;

[0089] Step S600: Calculate the signature value. Given the message, private key, and identity information, calculate the signature value.

[0090] Step S700: Verify the key. Given the message, public key, identity, and signature, perform signature authentication calculation.

[0091] Furthermore, the parameter selection in this method is consistent with the standard parameters of the SM9 signature algorithm, and the specific symbol descriptions are as follows:

[0092] q: a large prime number;

[0093] The set of integers consisting of 1, 2, ..., q-1;

[0094] G1, G2: Additive cyclic groups of order q;

[0095] G T : A multiplicative cyclic group of order q;

[0096] P1, P2: generators of groups G1 and G2, respectively;

[0097] g r Multiplication group G T The r-th power of the element g;

[0098] [k]P: A point on the elliptic curve that is k times the value of point P, where k is a positive integer;

[0099] e: From G1×G2 to G T Bilinear pair mapping;

[0100] H1(·), H2(·): Cryptographic functions derived from the cryptographic hash function, both of which are

[0101] msk: The system master private key secretly held by KGC;

[0102] mpk: The system master public key published by KGC, calculated as mpk = [msk]P2;

[0103] ID: A user's identifiable identifier;

[0104] usk0: Part of the private key of signer S;

[0105] s: The secret value of the signer S;

[0106] upk: The public key of the signer S;

[0107] usk: The private key of the signer S;

[0108] m: The message to be signed;

[0109] σ = (σ1, σ2): The signature value corresponding to message m;

[0110] mod q: Modulo q operation; for example, 23 mod 7 ≡ 2;

[0111] x||y: The concatenation of x and y, where x and y can be bit strings or byte strings.

[0112] Furthermore, the detailed steps of step S100 are as follows:

[0113] Key generation center KGC is randomly selected As the master private key;

[0114] Calculate the master public key mpk = [msk]P2.

[0115] Furthermore, the detailed steps of step S200 are as follows:

[0116] KGC calculates t1 = H1(ID) + msk;

[0117] Part of the private key of the signer S is

[0118] Furthermore, the detailed steps of step S300 are as follows:

[0119] Random selection

[0120] Use s as your secret value.

[0121] Furthermore, the calculation steps for setting the public key in step S400, based on the secret value, are as follows:

[0122] upk = [s]P1.

[0123] Furthermore, the calculation formula for step S500 is as follows:

[0124] usk = [s]usk0.

[0125] Furthermore, the detailed calculation steps of step S600 are as follows:

[0126] a) Given a message m, a private key usk, and an identity ID;

[0127] b) Random selection

[0128] c) Calculate G T The element g = e(upk,mpk) in the array;

[0129] d) Calculate Q = g r ;

[0130] e) Calculate σ1=H2(m||Q);

[0131] f) Calculate h = r - σ1;

[0132] g) Calculate σ² = [h]usk;

[0133] h) Output the signature value σ = (σ1, σ2).

[0134] Furthermore, the detailed calculation steps for step S7 are as follows:

[0135] a) Given a message m, a public key upk, an identity ID, and a signature σ.

[0136] b) Calculate G T The element g = e(upk, mpk) in the equation

[0137] c) Calculate t2 = H1(ID)

[0138] d) Calculate R = [t²]P² + mpk,

[0139] e) Calculate u = e(σ²,R)

[0140] f) Calculate

[0141] g) Determine whether σ1=H2(m||w) is true. If true, then σ is a valid signature; otherwise, the signature is invalid.

[0142] Correctness:

[0143]

[0144] A certificateless signature generation system based on SM9, comprising:

[0145] An initialization unit, which is used to perform system initialization calculations;

[0146] A partial private key extraction unit, wherein the partial private key extraction unit is used for partial private key extraction calculation;

[0147] A secret value setting unit, wherein the secret value setting unit is used to set a secret value;

[0148] A public key setting unit, wherein the public key setting unit is used to set the public key;

[0149] A private key setting unit, wherein the private key setting unit is used to set a private key;

[0150] A signature unit, which is used to perform the calculation of the output signature value;

[0151] The verification unit is used to verify the signature information of the system.

[0152] Example 1

[0153] See Figs. 1-3 This invention proposes a certificateless signature generation method based on SM9, described in detail below. The State Cryptography Administration has released the SM9 identifier cryptography algorithm. SM9, as an identifier cryptography standard (standard number: GM / T 0044-2016 SM9 identifier cryptography algorithm), mainly consists of three parts: a digital signature algorithm, a public-key encryption algorithm, and a key exchange protocol. The SM9 standard can be applied to electronic authentication services, identity authentication, and email systems, effectively ensuring the integrity and authenticity of data during transmission, filling the gap in domestic identifier cryptography systems, and laying a solid underlying cryptographic foundation for application-level security.

[0154] The parameter selection in this scheme is consistent with the standard parameters of the SM9 signature algorithm. Specific symbol descriptions are as follows:

[0155] q: a large prime number.

[0156] The set of integers consisting of 1, 2, ..., q-1.

[0157] G1, G2: Additive cyclic groups of order q.

[0158] G T : A multiplicative cyclic group of order q.

[0159] P1, P2: generators of groups G1 and G2, respectively.

[0160] g r Multiplication group G T The element g raised to the power of r.

[0161] [k]P: A point on the elliptic curve that is k times the value of point P, where k is a positive integer.

[0162] e: From G1×G2 to G T The bilinear pairing mapping.

[0163] H1(·), H2(·): Cryptographic functions derived from the cryptographic hash function, both of which are

[0164] msk: The system master private key secretly held by KGC.

[0165] mpk: The system master public key published by KGC, calculated as mpk = [msk]P2.

[0166] ID: A user's identifiable identifier.

[0167] usk0: Part of the private key of signer S.

[0168] s: The secret value of the signer S.

[0169] upk: The public key of the signer S.

[0170] udk: The private key of the signer S.

[0171] m: Message to be signed.

[0172] σ = (σ1, σ2): The signature value corresponding to message m.

[0173] mod q: Modulo q operation. For example, 23 mod 7 ≡ 2.

[0174] x||y: The concatenation of x and y, where x and y can be bit strings or byte strings.

[0175] The specific process is as follows:

[0176] 2) Setup (Initialization)

[0177] a) Key Generation Center (KGC) is randomly selected Use this as the master private key and calculate the master public key mpk = [msk]P2.

[0178] 3) Partial-Private-Key-Extract

[0179] a) KGC calculates t1 = H1(ID) + msk

[0180] b) Generating part of the private key for signer S is

[0181] 4) Set-Secret-Value

[0182] a) Signer S is randomly selected Use s as your secret value.

[0183] 5) Set-Public-Key (Public Key Setting)

[0184] a) Set the public key of the signer S to upk = [s]P1.

[0185] 6) Set-Private-Key (Private Key Setting)

[0186] a) Signer S calculates their private key usk = [s]usk0

[0187] 7) Sign

[0188] a) Given a message m, a private key usk, and an identity ID.

[0189] b) Random selection

[0190] c) Calculate G T The element in the array is g = e(upk, mpk).

[0191] d) Calculate Q = g r .

[0192] e) Calculate σ1=H2(m||Q).

[0193] f) Calculate h = r - σ1.

[0194] g) Calculate σ2=[h]usk.

[0195] a) Output the signature value σ = (σ1, σ2).

[0196] 8) Verify

[0197] a) Given a message m, a public key upk, an identity ID, and a signature σ.

[0198] b) Calculate G T The element g = e(upk, mpk) in the equation

[0199] c) Calculate t2 = H1(ID)

[0200] d) Calculate R = [t²]P² + mpk,

[0201] e) Calculate u = e(σ²,R)

[0202] f) Calculate

[0203] g) Determine whether σ1=H2(m||w) is true. If true, then σ is a valid signature; otherwise, the signature is invalid.

[0204] Correctness:

[0205]

[0206]

[0207] Example 2

[0208] Please see Fig. 3 The present invention also provides a certificateless signature generation system based on SM9. In use, the system first performs system initialization calculation through the initialization unit; then performs partial private key extraction calculation through the partial private key extraction unit; sets the secret value through the secret value setting unit; sets the public key through the public key setting unit; sets the private key through the private key setting unit; performs output signature value calculation through the signature unit; and verifies the signature information through the verification unit.

[0209] In summary, this invention provides certificateless signatures based on SM9, which have lower computational overhead and fill the gap in SM9's presence in certificateless cryptography.

[0210] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0211] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0212] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

[0213] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A certificateless signature generation method based on SM9, characterized in that, Includes the following steps: Step S100: System initialization, key generation center KGC randomly selected. Used as the master private key, and the master public key is calculated based on the master private key. ,in, It is a large prime number. For the combination of 1, 2, ..., The set of integers formed The system master private key is secretly held by KGC. The system master public key published by KGC, For the group generator, For the order of The addition cyclic group; Step S200: Extract a portion of the private key, KGC calculates... Using the master private key, a portion of the private key is extracted as the signer's partial private key, generating the signer S's partial private key. ,in, For a cryptographic function derived from a cryptographic hash function, satisfying , This is a portion of the private key of the signer S. For the group generator, For the order of The addition cyclic group; Step S300: Set a secret value and select it randomly. ,Will Set as the signer's secret value; Step S400: Set the public key and calculate the signer's public key based on the secret value. ; Step S500: Set the private key. Calculate the signer's private key based on the partial private key calculated in step S200 above. ,in, This is a portion of the private key of the signer S; Step S600: Calculate the signature value, given the message to be signed. Private key and identity information as a user's identifiable identifier Random selection ,calculate elements in ,calculate ,calculate ,calculate ,calculate Output message Corresponding signature value ,in, For the order of Multiplication cyclic group, For multiplication group medium elements of Power of 1 For a cryptographic function derived from a cryptographic hash function, satisfying , for and splicing, Is it a bit string or a byte string? From arrive bilinear pair mapping, Points on the elliptic curve of Double point, is a positive integer; Step S700, verify the key, given message Public key ,identity and signature ,calculate elements in ,calculate ,calculate ,calculate ,calculate ,judge Is it true? If it is true, then... A valid signature is one that is not valid; otherwise, the signature is invalid.

2. A certificateless signature generation system based on SM9, characterized in that, The system is used to perform the method of claim 1, comprising: An initialization unit, which performs system initialization calculations; A partial private key extraction unit, wherein the partial private key extraction unit is used for partial private key extraction calculation; A secret value setting unit, wherein the secret value setting unit is used to set a secret value; A public key setting unit, wherein the public key setting unit is used to set the public key; A private key setting unit, wherein the private key setting unit is used to set a private key; A signature unit, which is used to perform the calculation of the output signature value; The verification unit is used to verify the signature information of the system.

Images