A certificateless digital signcryption method based on SM9

Abstract

The present invention provides a certificateless digital signcryption method based on SM9. The method comprises: a system establishment step, a user secret value generation step, a user partial private key extraction step, a user private key generation step, a user public key generation step, a certificateless signcryption step and a de-signcryption step. Compared with the existing commercial secret SM9 identification signcryption method, the present invention can solve the user private key trusteeship problem through the above steps, thereby solving the deficiency that the identification-based signcryption method does not meet the signature unforgeability.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a certificateless digital signcryption method based on SM9. Background Art

[0002] The SM9 identification cryptographic algorithm was determined as a national industry standard in 2016 (GM / T 0044-2016). This algorithm uses the user's identity information (such as name, ID number, email address, etc.) as the public key, which can simplify the complex certificate management problem in traditional PKI. However, since the user's private key is generated by the system's key management center for the user and sent to the user in a secure manner, the identification cryptography has a key escrow problem, and when the number of users in the system is large, the key management center also has a heavy management burden problem. Certificateless public key cryptography (CL-PKC) overcomes the weaknesses of both at the same time, requiring neither a public key certificate nor the private key escrow problem. In the CL-PKC cryptographic system, the key generation center KGC generates a partial private key for the user, the user selects a secret value and combines it with the partial private key to generate the user's private key, which is jointly generated by the KGC and the user, thus avoiding the private key escrow problem.

[0003] The existing SM9-based identity signcryption scheme has a private key custody problem due to the use of identity technology. If the private key generation center is dishonest, the non-repudiation of digital signcryption cannot be achieved. Summary of the invention

[0004] In order to solve the problem of being unable to achieve non-repudiation of digital signcryption due to key escrow in the existing SM9-based identification signcryption method, the present invention provides a certificateless digital signcryption method based on SM9.

[0005] The present invention provides a certificateless digital signcryption method based on SM9, comprising:

[0006] System establishment steps: The key generation center selects system parameters, generates the system's master public and private key pair, then sends the system's master public key to the system user and keeps the master private key secret;

[0007] User secret value generation steps: The user selects his own secret value based on the system parameters, then calculates his own partial public key and saves the secret value secretly;

[0008] User partial private key extraction step: The key generation center generates a user partial private key for the user using the master public-private key pair and the user ID, and sends the user partial private key to the user through a secure channel;

[0009] User private key generation step: The user uses his own secret value and the received partial private key to generate his own complete private key;

[0010] User public key generation steps: The user generates and publishes his complete public key based on system parameters, his own private value and part of the public key;

[0011] Certificateless signcryption steps: The user as the sender generates the signcrypted text based on the plaintext message and the receiver's ID using the system master public key and his own complete private key;

[0012] Decryption steps: As a legitimate recipient, the user decrypts and verifies the signciphertext based on the signciphertext and his own complete private key. If the verification passes, the plaintext message and the sender's signature on the plaintext message are obtained; if the verification fails, the user refuses to receive the signciphertext.

[0013] Furthermore, the system establishment step specifically includes:

[0014] The key generation center selects a bilinear group Select Group The generator P1 of The generator P2, and ψ(P2) = P1, randomly select α∈[1,N-1], and select three Hash functions, namely H3: {0,1} * →{0,1} n ; where N>2 λ , λ represents a given security parameter; ψ represents the group To the group The mapping of n is the length of the plaintext message;

[0015] Key Generation Center Computing Group The element P pub =αP2, group The element g=e(P1,P pub );

[0016] The key generation center generates the system's master public key mpk: mpk = (BP, g, P1, P2, P pub ,H1,H2,H3,hid), the system's master private key msk: msk=α;

[0017] Where N is a cyclic group The order of , and N is a prime number; and is an additive cyclic group; is a multiplicative cyclic group; e is derived from arrive Bilinear mapping; [1, N-1], Both represent a set of integers not less than 1 and not greater than N-1; P T For the group The generator of ; hid is the signature private key generation function identifier represented by one byte, which is selected and made public by the key generation center.

[0018] Furthermore, in the user secret value generation step, it specifically includes:

[0019] Given a user ID∈{0,1} * , randomly select x ID ∈[1,N-1], calculate U ID =x ID P2, user saves x ID As its own secret value, publish U ID As part of your public key.

[0020] Furthermore, in the step of extracting the user's partial private key, it specifically includes:

[0021] Given a user ID∈{0,1} * , in the finite field F N Calculate t1=H1(ID||hid,N)+α. If t1=0, regenerate the master public key, calculate and publish the master public key, and update the private key of the existing user; otherwise calculate t2=α·t1 -1 and d ID =t2·P2, d ID As part of the user's private key.

[0022] Furthermore, in the user private key generation step, it specifically includes:

[0023] Given a user ID∈{0,1} * , using the secret value x ID and part of the private key d ID , calculate SK ID =x ID -1 .d ID , put SK ID As the user's full private key.

[0024] Furthermore, in the user public key generation step, it specifically includes:

[0025] Given a user ID∈{0,1} * , using the system parameter P pub and your own private value x ID , calculate V ID =x ID P pub , then generate PK ID =(U ID , V ID ), announce PK IDAs your full public key.

[0026] Furthermore, in the certificateless signcryption step, it specifically includes:

[0027] Step A1: Calculate intermediate variables Among them, Q belongs to the group Elements in the R is the receiver identifier, is the recipient's partial public key, is the other part of the recipient’s public key;

[0028] Step A2: Randomly select a random number r∈[1, N-1] and calculate the intermediate variable ω=g r , and convert the ω data type to a bit string; where ω belongs to the group Elements of

[0029] Step A3: Calculate the intermediate variable h = H2(M||ω, N) and the intermediate variable l = (rh) mod N. If l = 0, return to step A2 and reselect the random number r; where M is the plaintext message; h and l both belong to the finite field F N middle element;

[0030] Step A4: Calculate the signature of the plaintext message M Among them, ID S is the sender ID, is the sender’s complete private key; where S belongs to the group Elements in

[0031] Step A5: Calculate the intermediate variable T = rQ and convert the data type of T into a bit string; where T belongs to the group Elements in

[0032] Step A6: Calculate the ciphertext after encrypting the plaintext message M

[0033] Step A7: Output the ciphertext CT = (c, S, T).

[0034] Furthermore, in the decryption step, the following steps are specifically included: R After the receiver receives the ciphertext CT=(c, S, T), it executes steps B1 to B5;

[0035] Step B1: Calculate intermediate variables And convert the ω′ data type into a bit string; where ω′ belongs to the group Elements of is the recipient’s full private key;

[0036] Step B2: Calculate the plaintext data

[0037] Step B3: Calculate the intermediate variable h′=H2(M′||ω′, N) and the intermediate variable t=g h′ ;

[0038] Step B4: Calculate intermediate variables

[0039] Step B5: Verify whether e(S, P)·t=ω′ holds. If so, the verification succeeds and the plaintext data M′ and its signature σ=(h′, S) are obtained; otherwise, the verification fails and returns ⊥.

[0040] Furthermore, the decryption correctness verification process includes:

[0041]

[0042] Furthermore, the signature correctness verification process includes:

[0043]

[0044] Beneficial effects of the present invention:

[0045] Compared with the existing certificateless digital signcryption method, the present invention is based on the commercial secret SM9 identification cryptographic algorithm, and realizes the localization of the certificateless digital signcryption method. Compared with the existing commercial secret SM9 identification signcryption method, the user private key trusteeship problem can be solved, thereby solving the deficiency of the identification signcryption method that does not meet the signature unforgeability. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A flowchart of a certificateless signcryption method based on SM9 is provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] like Figure 1 As shown, the embodiment of the present invention provides a certificateless signcryption method based on SM9, including a system establishment step - a user secret value generation step - a user partial private key generation step - a user private key generation step - a user public key generation step - a certificateless signcryption step - a decryption step. Among them:

[0049] S101: System establishment step: The key generation center selects system parameters, generates a master public and private key pair for the system, then sends the master public key of the system to the system user and keeps the master private key secret;

[0050] Specifically, the key generation center chooses a bilinear group Select Group The generator P1 of The generator P2, and ψ(P2) = P1, randomly select α∈[1, N-1], select three Hash functions, namely H3: {0, 1} * →{0, 1} n ; Where N>2 λ , λ represents a given security parameter; ψ represents the group To the group The mapping of n is the length of the plaintext message;

[0051] Key Generation Center Computing Group The element P pub =αP2, group The element g = e(P1, P pub );

[0052] The key generation center generates the master public key mpk of the system: mpk = (BP, g, P1, P2, P pub , H1, H2, H3, hid), the system's master private key msk: msk = α;

[0053] Where N is a cyclic group The order of , and N is a prime number; and is an additive cyclic group; is a multiplicative cyclic group; e is derived from arrive bilinear mapping; [1, N-1], Both represent a set of integers not less than 1 and not greater than N-1; P T For the group The generator of ; hid is the signature private key generation function identifier represented by one byte, which is selected and made public by the key generation center.

[0054] S102: User secret value generation step: The user selects his own secret value according to the system parameters, then calculates his own partial public key, and secretly saves the secret value;

[0055] Specifically, given a user ID∈{0,1} * , randomly select x ID ∈[1, N-1], calculate U ID =xID P2, user saves x ID As its own secret value, publish U ID As part of your public key.

[0056] S103: User partial private key extraction step: The key generation center generates a user partial private key for the user using the master public-private key pair and the user identifier, and sends the user partial private key to the user through a secure channel;

[0057] Specifically, given a user ID∈{0,1} * , in the finite field F N Calculate t1 = H1(ID||hid, N) + α. If t1 = 0, regenerate the master public key, calculate and publish the master public key, and update the private key of the existing user; otherwise calculate t2 = α·t1 -1 and d ID =t2·P2, d ID As part of the user's private key.

[0058] S104: User private key generation step: The user generates his own complete private key using his own secret value and the received partial private key;

[0059] Specifically, given a user ID∈{0,1} * , using the secret value x ID and part of the private key d ID , calculate SK ID =x ID - 1 .d ID , put SK ID As the user's full private key.

[0060] S105: User public key generation step: The user generates and publishes his complete public key based on system parameters, his own private value and part of the public key;

[0061] Specifically, given a user ID∈{0,1} * , using the system parameter P pub and your own private value x ID , calculate V ID =x ID P pub , then generate PK ID =(U ID , V ID ), announce PK ID As your full public key.

[0062] S106: Certificateless signcryption step: The user as the sender generates a signcrypted message based on the plaintext message and the receiver's ID using the system master public key and his own complete private key;

[0063] Specifically, given a plaintext message M∈{0,1} n , the sender is identified by ID S , the receiver is identified by ID R , sender ID S Execute steps A1 to A7 to obtain the sign-cryptographic text of the plaintext message.

[0064] Step A1: Calculate intermediate variables Among them, Q belongs to the group Elements in the R is the receiver identifier, is the recipient's partial public key, is the other part of the recipient’s public key;

[0065] Step A2: Randomly select a random number r∈[1, N-1] and calculate the intermediate variable ω=g r , and convert the ω data type to a bit string; where ω belongs to the group Elements of

[0066] Step A3: Calculate the intermediate variable h = H2(M||ω, N) and the intermediate variable l = (rh) mod N. If l = 0, return to step A2 and reselect the random number r; where M is the plaintext message; h and l both belong to the finite field F N Medium element; H2(M||w,N): arrive A cryptographic function derived from a cryptographic hash function.

[0067] Step A4: Calculate the signature of the plaintext message M Among them, ID S is the sender ID, is the sender’s complete private key; where S belongs to the group Elements in

[0068] Step A5: Calculate the intermediate variable T = rQ and convert the data type of T into a bit string; where T belongs to the group Elements in

[0069] Step A6: Calculate the ciphertext after encrypting the plaintext message M H3(T||w||ID R ): to {0, 1} n , a cryptographic function derived from a cryptographic hash function.

[0070] Step A7: Output the ciphertext CT = (c, S, T).

[0071] S107: Decryption step: The user, as a legitimate recipient, decrypts and verifies the sign-ciphertext based on the sign-ciphertext and his own complete private key. If the verification passes, the plaintext message and the sender's signature on the plaintext message are obtained; if the verification fails, the user refuses to receive the sign-ciphertext.

[0072] Specifically, the ID R After the receiver receives the ciphertext CT=(c, S, T), it executes steps B1 to B5;

[0073] Step B1: Calculate intermediate variables And convert the ω′ data type into a bit string; where ω′ belongs to the group Elements of is the recipient’s full private key;

[0074] Step B2: Calculate the plaintext data M′ is the plaintext calculated by the receiver.

[0075] Step B3: Calculate the intermediate variable h′=H2(M′||ω′, N) and the intermediate variable t=g h′ ; h′ is the finite field F calculated by the receiver N element, t is the group calculated by the receiver The elements in .

[0076] Step B4: Calculate intermediate variables P is the group calculated by the receiver The elements in .

[0077] Step B5: Verify whether e(S, P)·t=ω′ holds. If so, the verification succeeds and the plaintext data M and its signature σ=(h′, S) are obtained; otherwise, the verification fails and returns ⊥.

[0078] The decryption correctness verification process includes:

[0079]

[0080]

[0081] The signature correctness verification process includes:

[0082]

[0083] Compared with the existing certificateless digital signcryption method, the present invention is based on the commercial secret SM9 identification cryptographic algorithm, and realizes the localization of the certificateless digital signcryption method. Compared with the existing commercial secret SM9 identification signcryption method, the user private key trusteeship problem can be solved, thereby solving the deficiency of the identification signcryption method that does not meet the signature unforgeability.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A certificateless digital signcryption method based on SM9, characterized in that: include: System establishment steps: The key generation center selects system parameters, generates the system's master public and private key pair, then sends the system's master public key to the system user and keeps the master private key secret; specifically, the key generation center selects a bilinear group Select Group The generator P1 of The generator P2, and ψ(P2) = P1, randomly select α∈[1, N-1], select three Hash functions, namely H3: {0, 1} * →{0, 1} n ; Where N>2 λ , λ represents a given security parameter; ψ represents the group To group The mapping of n is the length of the plaintext message; Key Generation Center Computing Group The element P pub =αP2, group The element g = e(P1, P pub ); The key generation center generates the master public key mpk of the system: mpk = (BP, g, P1, P2, P pub , H1, H2, H3, hid), the system's master private key msk: msk = α; Where N is a cyclic group The order of , and N is a prime number; and is an additive cyclic group; is a multiplicative cyclic group; e is derived from arrive bilinear mapping; [1, N-1], Both represent a set of integers not less than 1 and not greater than N-1; P T For the group The generator of the key; hid is the identifier of the signature private key generation function represented by one byte, which is selected and made public by the key generation center; User secret value generation steps: The user selects his own secret value based on the system parameters, then calculates his own partial public key and saves the secret value secretly; User partial private key extraction step: The key generation center generates a user partial private key for the user using the master public-private key pair and the user ID, and sends the user partial private key to the user through a secure channel; User private key generation step: The user uses his own secret value and the received partial private key to generate his own complete private key; User public key generation steps: The user generates and publishes his complete public key based on system parameters, his own private value and part of the public key; Certificateless signcryption steps: As the sender, the user generates a signcrypted message based on the plaintext message and the receiver's ID using the system master public key and his own complete private key. Specifically, it includes: Step A1: Calculate intermediate variables Among them, Q belongs to the group Elements in the R is the receiver identifier, is the recipient's partial public key, is the other part of the recipient’s public key; Step A2: Randomly select a random number r∈[1, N-1] and calculate the intermediate variable ω=g r , and convert the ω data type to a bit string; where ω belongs to the group Elements of Step A3: Calculate the intermediate variable h = H2(M||ω, N) and the intermediate variable l = (rh) mod N. If l = 0, return to step A2 and reselect the random number r; where M is the plaintext message; h and l both belong to the finite field F N middle element; Step A4: Calculate the signature of the plaintext message M Among them, ID S is the sender ID, is the sender’s complete private key; where S belongs to the group Elements in Step A5: Calculate the intermediate variable T = rQ and convert the data type of T into a bit string; where T belongs to the group Elements in Step A6: Calculate the ciphertext after encrypting the plaintext message M Step A7: Output the ciphertext CT = (c, S, T); Decryption steps: As a legitimate recipient, the user decrypts and verifies the ciphertext based on the ciphertext and his own complete private key. If the verification is successful, the plaintext message and the sender's signature on the plaintext message are obtained; if the verification fails, the ciphertext is rejected; specifically, the ID is used to identify the recipient. R After the receiver receives the ciphertext CT=(c, S, T), it executes steps B1 to B5; Step B1: Calculate intermediate variables And convert the ω′ data type into a bit string; where ω′ belongs to the group Elements of is the recipient’s full private key; Step B2: Calculate the plaintext data Step B3: Calculate the intermediate variable h′=H2(M′||ω′, N) and the intermediate variable t=g h ; Step B4: Calculate intermediate variables Step B5: Verify whether e(S, P)·t=ω′ holds. If so, the verification succeeds and the plaintext data M′ and its signature σ=(h′, S) are obtained; otherwise, the verification fails and returns ⊥.

2. According to claim 1, a certificateless digital signcryption method based on SM9 is characterized in that: The user secret value generation step specifically includes: Given a user ID∈{0,1} * , randomly select x ID ∈[1, N-1], calculate U ID =x ID P2, user saves x ID As its own secret value, publish U ID As part of your public key.

3. A certificateless digital signcryption method based on SM9 according to claim 2, characterized in that: The steps for extracting the user's partial private key include: Given a user ID∈{0,1} * , in the finite field F N Calculate t1 = H1(ID||hid, N) + α. If t1 = 0, regenerate the master public key, calculate and publish the master public key, and update the private key of the existing user; otherwise calculate t2 = α·t1 -1 and d ID =t2·P2, d ID As part of the user's private key.

4. According to the SM9-based certificateless digital signcryption method of claim 3, it is characterized in that: The steps for generating the user private key include: Given a user ID∈{0,1} * , using the secret value x ID and part of the private key d ID , calculate SK ID =x ID -1 ·d ID , put SK ID As the user's full private key.

5. The certificateless digital signcryption method based on SM9 according to claim 2, characterized in that: The steps for generating the user public key include: Given a user ID∈{0,1} * , using the system parameter P pub and your own private value x ID , calculate V ID =xI D P pub , then generate PK ID =(U ID , V ID ), announce PK ID as your full public key.

6. A certificateless digital signcryption method based on SM9 according to claim 1, characterized in that: In step B5, verifying whether e(S, P)·t=ω′ is established specifically includes: a decryption correctness verification process and a signature correctness verification process; the decryption correctness verification process specifically includes: The signature correctness verification process specifically includes:

Images