Certificate signing scheme based on SM9 signature algorithm

Abstract

The application is suitable for the field of information security technology, and provides a certificate signature scheme based on an SM9 signature algorithm, which comprises the following steps: S100, system initialization calculation, a certificate authority generates a random number as a private key and calculates a public key, then randomly selects a signer private key and performs public key calculation to produce a signer private key pair; S200, certificate authorization, a signer provides identity information to the certificate authority, the certificate authority verifies the information according to the information and the key information, and calculates and generates a certificate after the information passes, and feeds back the certificate to the signer; and S300, signature calculation and the like. The application is based on the signature structure of the SM9 national secret algorithm, combines the advantages of traditional public key cryptography and identity-based encryption technology, and solves the problems of complex certificate management and key escrow. The scheme can resist attacks of Type 1 and Type 2 enemies at the same time.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a certificate signing scheme based on the SM9 signature algorithm. Background Technology

[0002] As information network technology continues to deepen its application in finance, government affairs, and communications, digital signatures, as a crucial tool for digital authentication, increasingly need to meet the evolving application scenarios and requirements. Digital signatures possess characteristics such as identity verification, non-repudiation, and anti-forgery, and are therefore widely used in current network communications, e-commerce, and e-government scenarios. Traditional digital signature technology requires a public key infrastructure and cumbersome certificate management. While identity-based cryptography overcomes these drawbacks, it still presents security challenges due to key escrow.

[0003] Certificate-based signing requires the signer's private key and certificate, while verification only requires the signer's public key. Traditional public key infrastructures must send both the certificate and the signature to the verifier, rather than just the signature, requiring more bandwidth for signature transmission. Certificate-based signing, however, uses the certificate to generate the signature, eliminating the need to send both simultaneously. Verifiers can verify the validity of the signature to ensure the certificate's existence.

[0004] The SM9 algorithm is an identifier cryptography algorithm based on elliptic curve bilinear pairing. It was released by the State Cryptography Administration on March 28, 2016 (standard number: GM / T 0044-2016SM9 Identifier Cryptography Algorithm). The standard meets the application requirements of electronic authentication service systems and fills a gap in domestic identifier cryptography systems. It mainly consists of three parts: a digital signature algorithm, a public-key encryption algorithm, and a key exchange protocol. Here, we adopt the parameters and standard of the digital signature algorithm.

[0005] In summary, this patent presents a certificate signing scheme based on the SM9 signature algorithm. Summary of the Invention

[0006] This invention provides a certificate signing scheme based on the SM9 signature algorithm, which aims to solve the problem that traditional digital signature technology requires a public key infrastructure and cumbersome certificate management. While identity-based cryptography gets rid of these shortcomings, it still has security issues due to key escrow.

[0007] The present invention is implemented as follows: a certificate signing scheme based on the SM9 signature algorithm includes the following steps:

[0008] Step S100: The system initializes the calculation. The certificate authority generates a random number as the private key and calculates the public key. Then, it randomly selects the signer's private key and performs public key calculation to produce the signer's private key pair.

[0009] Step S200, Certificate Authorization: The signer provides identity information to the certificate authority. The certificate authority verifies the identity information and the aforementioned key information. After the information is verified, the certificate authority calculates and generates a certificate and sends it back to the signer.

[0010] Step S300: Signature calculation. The signer inputs the message to be signed, performs signature calculation, and outputs the signature value.

[0011] Step S400: Verification calculation. The signature value output in the above steps is verified and its correctness is determined.

[0012] In a preferred embodiment of the present invention, the parameters selected in this method are consistent with the standard parameters of the SM9 signature algorithm, and the specific symbols are described below:

[0013] q: a large prime number;

[0014] The set of integers consisting of 1, 2, ..., q-1;

[0015] An additive cyclic group of order q;

[0016] A multiplicative cyclic group of order q;

[0017] P1, P2: Groups respectively and Generators;

[0018] g u Multiplication group The u-th power of the element g;

[0019] [k]P: A point on the elliptic curve that is k times the value of point P, where k is a positive integer;

[0020] e: from To G T Bilinear pair mapping;

[0021] H1(·), H2(·): Cryptographic functions derived from the cryptographic hash function, both of which are

[0022] A: Signer A;

[0023] CA: Certificate Authority;

[0024] d: The system master private key secretly held by the CA;

[0025] P pub1 P pub2 The system master public key, published by the CA, is calculated using the formula P. pub1=[d]P1, P pub2 =[d]P2;

[0026] AliceInfo: Personal information of signer A;

[0027] ID: Identifier of the signer;

[0028] (SK A PK A ): The public / private key pair of signer A;

[0029] Cert A Certificate of Signer A

[0030] S A The private key of signer A, based on the certificate system;

[0031] m: The message to be signed;

[0032] σ = (h, S): Signature value;

[0033] mod q: Modulo q operation; for example, 23 mod 7 ≡ 2;

[0034] x||y: The concatenation of x and y, where x and y can be bit strings or byte strings.

[0035] As a preferred embodiment of the present invention, the detailed steps of step S100, which involves system initialization calculation, the certificate authority generating a random number as the private key and calculating the public key, then randomly selecting the signer's private key and performing public key calculation to produce the signer's private key pair, are as follows: where A represents the signer and CA represents the certificate authority.

[0036] a) The certificate issuing authority generates random numbers. Used as the private key, and calculate the public key P. pub1 =

[0037] [d]P1, P pub2 =[d]P2.

[0038] b) Signer A is randomly selected Used as the private key, to calculate the public key PK. A =[s A P2, generate your own public / private key pair (SK) A PK A ).

[0039] As a preferred embodiment of the present invention, the detailed steps of step S200, certificate authorization, in which the signer provides identity information to the certificate authority, the certificate authority verifies the identity information and the aforementioned key information, and calculates and generates a certificate after the information is verified, and sends it back to the signer, are as follows:

[0040] a) Signer A provides information to CA

[0041] b) CA verification information

[0042] c) If the verification passes, CA calculates t = H1(P) pub1 P pub2 PK A ID A )

[0043] d) CA generates Certificate (Certificate) A =[d(t+d)] -1 ]P1, and send it to A.

[0044] As a preferred embodiment of the present invention, the information provided by the signer A includes his public key PK. A And any necessary additional identity information.

[0045] As a preferred embodiment of the present invention, the detailed steps of step S300, signature calculation, in which the signer inputs the message to be signed, performs signature calculation, and outputs the signature value, are as follows:

[0046] a) Calculate the signer's private key based on the certificate system.

[0047] b) Calculation The element g1 = e(P1, P) in the set is denoted as g1 = e(P1, P). pub2 )

[0048] c) Random selection And calculate h = H2(m||w),

[0049] d) Calculate S = [l]S A

[0050] e) The signature of the output message m is σ = (h, S).

[0051] In a preferred embodiment of the present invention, step S400, verification calculation, involves verifying the signature value output in the above steps and determining its correctness using the following algorithm:

[0052] a) Calculation The element g2 = e(P) in pub1 PK A )

[0053] b) Calculate t = H1(P) pub1 P pub2 PK A IDA )

[0054] c) Calculate u = e(S, [t]P² + P) pub2 )

[0055] d) Calculation

[0056] e) Determine whether h = H2(m||w) is true. If it is true, then σ is a valid signature; otherwise, the signature is invalid.

[0057] As a preferred embodiment of the present invention, the correctness verification algorithm in step S400 is as follows:

[0058]

[0059]

[0060]

[0061] A certificate signing scheme based on the SM9 signature algorithm, comprising:

[0062] An initialization unit, which is used to perform system initialization calculations;

[0063] Certificate authorization unit, which is used to perform certificate authorization calculation;

[0064] A signature calculation unit, which is used to calculate a signature value;

[0065] A verification calculation unit is used to complete the verification algorithm.

[0066] As a preferred embodiment of the present invention, the parameter selection in this system is consistent with the standard parameters of the SM9 signature algorithm.

[0067] The beneficial effects of this invention are as follows: This scheme, based on the signature structure of the SM9 national cryptographic algorithm, combines the advantages of traditional public-key cryptography and identity-based encryption techniques, while simultaneously solving complex certificate management and key escrow problems. This scheme can resist both Type 1 and Type 2 attacks. Attached Figure Description

[0068] Figure 1 This is a flowchart illustrating the method steps of a certificate signing scheme based on the SM9 signature algorithm according to the present invention.

[0069] Figure 2 This is a schematic diagram of a certificate signing scheme based on the SM9 signature algorithm of the present invention;

[0070] Figure 3This is a structural block diagram of a certificate signing scheme based on the SM9 signature algorithm of the present invention. Detailed Implementation

[0071] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0072] This invention solves the problem that existing SM9-based certificate signing cannot resist Type 2 adversary attacks, and combines the advantages of traditional public-key cryptography and identity-based encryption technology, while also solving the complex problems of certificate management and key escrow.

[0073] The present invention is implemented as follows: a certificate signing scheme based on the SM9 signature algorithm includes the following steps:

[0074] Step S100: The system initializes the calculation. The certificate authority generates a random number as the private key and calculates the public key. Then, it randomly selects the signer's private key and performs public key calculation to produce the signer's private key pair.

[0075] Step S200, Certificate Authorization: The signer provides identity information to the certificate authority. The certificate authority verifies the identity information and the aforementioned key information. After the information is verified, the certificate authority calculates and generates a certificate and sends it back to the signer.

[0076] Step S300: Signature calculation. The signer inputs the message to be signed, performs signature calculation, and outputs the signature value.

[0077] Step S400: Verification calculation. The signature value output in the above steps is verified and its correctness is determined.

[0078] Furthermore, the parameter selection in this method is consistent with the standard parameters of the SM9 signature algorithm, and the specific symbol descriptions are as follows:

[0079] q: a large prime number;

[0080] The set of integers consisting of 1, 2, ..., q-1;

[0081] An additive cyclic group of order q;

[0082] A multiplicative cyclic group of order q;

[0083] P1, P2: respectively group and Generators;

[0084] g u Multiplication group The u-th power of the element g;

[0085] [k]P: A point on the elliptic curve that is k times the value of point P, where k is a positive integer;

[0086] e: from To G T Bilinear pair mapping;

[0087] H1(·), H2(·): Cryptographic functions derived from the cryptographic hash function, both of which are

[0088] A: Signer A;

[0089] CA: Certificate Authority;

[0090] d: The system master private key secretly held by the CA;

[0091] P pub1 P pub2 The system master public key, published by the CA, is calculated using the formula P. pub1 =[d]P1, P pub2 =[d]P2;

[0092] AliceInfo: Personal information of signer A;

[0093] ID: Identifier of the signer;

[0094] (SK A PK A ): The public / private key pair of signer A;

[0095] Cert A Certificate of Signer A

[0096] S A The private key of signer A, based on the certificate system;

[0097] m: The message to be signed;

[0098] σ = (h, S): Signature value;

[0099] mod q: Modulo q operation; for example, 23 mod 7 ≡ 2;

[0100] x||y: The concatenation of x and y, where x and y can be bit strings or byte strings.

[0101] Further, in step S100, the system initializes the calculation, the certificate authority generates a random number as the private key, calculates the public key, then randomly selects the signer's private key, and performs public key calculation to produce the signer's private key pair. The detailed steps are as follows: where A represents the signer and CA represents the certificate authority.

[0102] a) The certificate issuing authority generates random numbers. Used as the private key, and calculate the public key P. pub1 =

[0103] [d]P1, P pub2 =[d]P2.

[0104] b) Signer A is randomly selected Used as the private key, to calculate the public key PK. A =[s A P2, generate your own public / private key pair (SK) A PK A ).

[0105] Furthermore, in step S200, certificate authorization, the signer provides identity information to the certificate authority, which verifies the identity based on this information and the aforementioned key information. After the information is verified, the certificate authority calculates and generates a certificate and sends it back to the signer. The detailed steps are as follows:

[0106] a) Signer A provides information to CA

[0107] b) CA verification information

[0108] c) If the verification passes, CA calculates t = H1(P) pub1 P pub2 PK A ID A )

[0109] d) CA generates Certificate (Certificate) A =[d(t+d)] -1 ]P1, and send it to A.

[0110] Furthermore, the information provided by the signer A includes his public key PK. A And any necessary additional identity information.

[0111] Furthermore, the detailed steps of step S300, signature calculation, where the signer inputs the message to be signed, performs signature calculation, and outputs the signature value, are as follows:

[0112] a) Calculate the signer's private key based on the certificate system.

[0113] b) Calculation The element g1 = e(P1, P) in the set is denoted as g1 = e(P1, P). pub2 )

[0114] c) Random selection And calculate h = H2(m||w),

[0115] d) Calculate S = [l]S A

[0116] e) The signature of the output message m is σ = (h, S).

[0117] Further, in step S400, the signature value output in the above steps is verified and calculated. The algorithm for determining its correctness is as follows:

[0118] a) Calculation The element g2 = e(P) in pub1 PK A )

[0119] b) Calculate t = H1(P) pub1 P pub2 PK A ID A )

[0120] c) Calculate u = e(S, [t]P² + P) pub2 )

[0121] d) Calculation

[0122] e) Determine whether h = H2(m||w) is true. If it is true, then σ is a valid signature; otherwise, the signature is invalid.

[0123] Furthermore, the correctness verification algorithm in step S400 is as follows:

[0124]

[0125]

[0126]

[0127]

[0128] A certificate signing scheme based on the SM9 signature algorithm, comprising:

[0129] An initialization unit, which is used to perform system initialization calculations;

[0130] Certificate authorization unit, which is used to perform certificate authorization calculation;

[0131] A signature calculation unit, which is used to calculate a signature value;

[0132] A verification calculation unit is used to complete the verification algorithm.

[0133] Furthermore, the parameter selection in this system is consistent with the standard parameters of the SM9 signature algorithm.

[0134] Example 1

[0135] See Figures 1-3 This invention proposes a certificate signing scheme based on the SM9 signature algorithm, which is described in detail below.

[0136] The specific solution process is as follows: A represents the user, and CA represents the certificate authority.

[0137] 1) Initialization

[0138] a) The certificate issuing authority generates random numbers. Used as the private key, and calculate the public key P. pub1 =

[0139] [d]P1, P pub2 =[d]P2.

[0140] b) User A randomly selects Used as the private key, to calculate the public key PK. A =[s A P2, generate your own public / private key pair (SK) A PK A ).

[0141] 2) Certificate Authorization

[0142] a) User A provides the information AliceInfo to the CA, which includes his public key PK. A And any necessary additional identifying information, such as her name.

[0143] b) CA verification information.

[0144] c) If the verification passes, CA calculates t = H1(P) pub1 P pub2 PK A ID A ),

[0145] d) CA generates Certificate (Certificate) A =[d(t+d)] -1 ]P1, and send it to A.

[0146] 3) Signature

[0147] a) Users calculate their own certificate-based private keys.

[0148] b) Calculation The element g1 = e(P1, P) in the set is denoted as g1 = e(P1, P). pub2 ).

[0149] c) Random selection And calculate h = H2(m||w),

[0150] d) Calculate S = [l]S A .

[0151] e) The signature of the output message m is σ = (h, S).

[0152] 4) Verification

[0153] a) Calculation The element g2 = e(P) in pub1 PK A ).

[0154] b) Calculate t = H1(P) pub1 P pub2 PK A ID A ).

[0155] c) Calculate u = e(S, [t]P² + P) pub2 )

[0156] d) Calculation

[0157] e) Determine whether h = H2(m||w) is true. If it is true, then σ is a valid signature; otherwise, the signature is invalid.

[0158] Correctness:

[0159]

[0160]

[0161]

[0162] Example 2

[0163] Please see Figure 3 The present invention also provides a certificate signing scheme based on the SM9 signature algorithm. In use, firstly, the initialization unit performs system initialization calculation; then the certificate authorization unit performs certificate authorization calculation; the signature calculation unit calculates the signature value; and the verification calculation unit performs verification algorithm to verify it.

[0164] Furthermore, the parameter selection in this system is consistent with the standard parameters of the SM9 signature algorithm.

[0165] In summary, this invention, based on the SM9 signature structure, combines the advantages of traditional public-key cryptography and identity-based encryption, while simultaneously solving complex certificate management and key escrow problems. Compared to existing research, this scheme has lower communication costs and is suitable for environments with limited computing power or expensive communication bandwidth.

[0166] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0167] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0168] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

[0169] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A certificate signing method based on the SM9 signature algorithm, characterized in that, Includes the following steps: Step S100: The system initializes the calculation. The certificate authority generates a random number as the private key and calculates the public key. Then, it randomly selects the signer's private key and performs public key calculation to produce the signer's private key pair. Step S200, Certificate Authorization: The signer provides identity information to the certificate authority. The certificate authority verifies the identity information and the aforementioned key information. After the information is verified, the certificate authority calculates and generates a certificate and sends it back to the signer. Step S300: Signature calculation. The signer inputs the message to be signed, performs signature calculation, and outputs the signature value. Step S400: Verification calculation. The signature value output from the above steps is verified to determine its correctness. The parameter selection in this method is consistent with the standard parameters of the SM9 signature algorithm. Specific symbol descriptions are as follows: : a large prime number; :From 1,2,…., A set of integers; : Rank The addition cyclic group; : Rank Multiplication cyclic group; : respectively group and Generators; Multiplication group Middle elements of Power of; Points on the elliptic curve of Double point, is a positive integer; :from arrive Bilinear pair mapping; , Cryptographic functions derived from cryptographic hash functions are all... Signer Certificate issuing body; :Depend on The system's master private key is held secretly; :Depend on The publicly available system master public key is calculated using the following formula: Signer Personal information; Signer's identification; Signer The public / private key pair; Signer Certificate Signer A private key based on a certificate system; Message awaiting signature; : Signature value; :mold Operations; : and The splicing, among which It can be a bit string or a byte string; In step S100, the system initializes the calculation. The certificate authority generates a random number as the private key and calculates the public key. Then, it randomly selects the signer's private key and performs public key calculation to produce the signer's private key pair. The detailed steps are as follows: where A represents the signer and CA represents the certificate authority. a) The certificate issuing authority generates random numbers. Used as the private key, and used to calculate the public key. ; Signer Random selection Use the private key to calculate the public key. Generate your own public / private key pair In step S200, certificate authorization, the signer provides identity information to the certificate authority, which verifies the identity based on this information and the aforementioned key information. After verification, the certificate authority calculates and generates a certificate, which is then sent back to the signer. The detailed steps are as follows: Signer Provide information to ; CA verification information; If the verification passes, CA is calculated. ; CA generates certificate And send it to A; The detailed steps of step S300, signature calculation, where the signer inputs the message to be signed, performs signature calculation, and outputs the signature value, are as follows: The signer's private key based on the certificate system is calculated. calculate elements in Random selection and calculate calculate Output message signature 2. The certificate signing method based on the SM9 signature algorithm as described in claim 1, characterized in that, The signer The information provided includes his public key. And any necessary additional identity information.

3. The certificate signing method based on the SM9 signature algorithm as described in claim 2, characterized in that, In step S400, the signature value output from the above steps is verified and calculated. The algorithm for determining its correctness is as follows: calculate elements in ; calculate ; calculate ; calculate ; judge Is it true? If it is true, then... A valid signature is one that is not valid; otherwise, the signature is invalid.

4. The certificate signing method based on the SM9 signature algorithm as described in claim 3, characterized in that, The correctness verification algorithm in step S400 is as follows: 。 5. The certificate signing method based on the SM9 signature algorithm as described in claim 4, characterized in that, The specific steps of the signature method are executed in the following units, which specifically include: An initialization unit, which performs system initialization calculations; Certificate authorization unit, which is used to perform certificate authorization calculation; A signature calculation unit, which is used to calculate a signature value; A verification calculation unit is used to complete the verification algorithm.

6. The certificate signing method based on the SM9 signature algorithm as described in claim 5, characterized in that, The parameters selected in this system are consistent with the standard parameters of the SM9 signature algorithm.

Images