Ring signcryption generation method, system and device based on SM9 digital signature algorithm

Abstract

The present invention discloses a ring signcryption generation method, system and device based on the SM9 digital signature algorithm. The present invention utilizes the bilinearity, non-degeneracy and computability characteristics of bilinear mapping, and adopts the SM9 digital signature algorithm and a hash function to construct a ring signcryption scheme. By optimizing the SM9 digital signature algorithm, the present invention has lower computational overhead and communication overhead, is particularly suitable for communication environments with limited energy and bandwidth, and fills the gap of the SM9 digital signature algorithm in ring signcryption schemes.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology and relates to a ring signcryption generation method, system and device, and specifically to a ring signcryption generation method, system and device based on the SM9 digital signature algorithm. Background Art

[0002] Digital signatures are a crucial component of cryptography. They typically exist electronically within data messages or as attachments logically associated with them. They can be used to distinguish the identity of the signatory of a data message and confirm their acceptance of the signed data message. Digital signature technology plays a particularly important role in e-commerce security, utilizing it in source authentication, integrity, and non-repudiation services within e-commerce security. After extensive research, digital signatures have developed their own unique research system and theoretical framework. In addition to classic signature schemes, specialized signature schemes have emerged, including blind signatures, proxy signatures, group signatures, non-repudiation signatures, and ring signatures, all closely related to specific application environments.

[0003] Confidentiality and authentication are two important security goals in cryptography. In 1997, Zheng proposed signcryption, a cryptographic primitive that simultaneously achieves both. To ensure both anonymity, authentication, and confidentiality, the common practice is to ring-sign the data before encrypting it. However, this method suffers from high computational efficiency and communication overhead. Summary of the Invention

[0004] In order to solve the above technical problems, the present invention provides a ring signcryption generation method, system and device based on the SM9 digital signature algorithm.

[0005] The technical solution adopted by the method of the present invention is: a ring signcryption generation method based on the SM9 digital signature algorithm, comprising the following steps:

[0006] Step 1: Input the security parameter λ, and the key generation center KGC selects two additive cyclic groups (G1, +), (G2, +) of order q and a multiplicative group (G T ,·), q is a large prime number; select three hash functions H1(·), H2(·), H3(·); {G1} n+1 ×G T ×{0, 1} * →{0, 1} * ; is a set of integers consisting of 1, 2, ..., q-1;

[0007] The key generation center KGC randomly selects an integer And calculate: g=e(P1,P2) s ; Among them, P1 and P2 represent the generators of groups G1 and G2 respectively; e() is the number from G1×G2 to G T Bilinear pairing mapping of G T is a multiplicative cyclic group of order q; the key generation center KGC publishes system parameters And secretly save your own master private key msk=s;

[0008] Step 2: When ID is i When a user applies to obtain a private key, the key generation center KGC is the user ID i Generate signature private key S i =s i P1 and decryption private key D i =s i P2; where s i =s·(v i +s) -1 , v i =H1(ID i ); the key generation center KGC will sign the private key S i and decryption private key D i Send to user ID i ;

[0009] Step 3: Given a recipient's ID η and an identity set U n ={ID1, ID2, ..., ID n}, the sender uses his signature private key S π Signcrypt the message m; where 1≤π≤n;

[0010] It includes the following sub-steps:

[0011] Step 3.1: Randomly select n+1 integers calculate v η =H1(ID η ),

[0012] Step 3.2: For all i∈{1, 2, ..., n}\{π}, calculate

[0013] Step 3.3: Calculation h=H2(w||m||U n ), v i =H1(ID i);in, Represents group G T Power operation on ; x||y means the concatenation of x and y;

[0014] Step 3.4: Calculation Among them, mod q represents the modulo q operation;

[0015] Step 3.5: Judge; if l π =0, then go back to step 3.1 and restart the signcryption process; otherwise, go to step 3.6;

[0016] Step 3.6: Calculate the ciphertext Among them, R π =l π ·S π ;

[0017] Step 3.7: Output ring signcryption σ = (h, R0, R1, ..., R n , C), will (U n ,σ) is sent to the receiver.

[0018] The technical solution adopted by the system of the present invention is: a ring signcryption generation system based on the SM9 digital signature algorithm, including the following modules:

[0019] Module 1 is used to input the security parameter λ, and the key generation center KGC selects two additive cyclic groups (G1, +), (G2, +) of order q and a multiplicative group (G T ,·), q is a large prime number; select three hash functions H1(·), H2(·), H3(·); H3: {G1} n+1 ×G T ×{0, 1} * →{0, 1} * ; is a set of integers consisting of 1, 2, ..., q-1;

[0020] The key generation center KGC randomly selects an integer And calculate: g=e(P1,P2) s ; Among them, P1 and P2 represent the generators of groups G1 and G2 respectively; e() is the number from G1×G2 to G T Bilinear pairing mapping of G T is a multiplicative cyclic group of order q; the key generation center KGC publishes system parameters And secretly save your own master private key msk=s;

[0021] Module 2, used when ID is ID iWhen a user applies to obtain a private key, the key generation center KGC is the user ID i Generate signature private key S i =s i P1 and decryption private key D i =s i P2; where s i =s·(v i +s) -1 , v i =H1(ID i ); the key generation center KGC will sign the private key S i and decryption private key D i Send to user ID i ;

[0022] Module 3, used to give a recipient an identity ID n and an identity set U n ={ID1, ID2, ..., ID n}, the sender uses his signature private key S π Signcrypt the message m; where 1≤π≤n;

[0023] Specifically includes the following sub-modules:

[0024] Module 3.1, for randomly selecting n+1 integers calculate v η =H1(ID η ),

[0025] Module 3.2 is used to calculate for all i∈{1, 2, ..., n}\{π}

[0026] Module 3.3, for calculation h=H2(w||m||U n ), v i =H1(ID i );in, Represents group G T Power operation on ; x||y means the concatenation of x and y;

[0027] Module 3.4, for calculation Among them, mod q represents the modulo q operation;

[0028] Module 3.5, used for judgment; if l π =0, then return to module 3.1 and restart the signcryption process; otherwise, execute module 3.6;

[0029] Module 3.6, for calculating ciphertext Among them, R π =l π ·S π ;

[0030] Module 3.7, for outputting ring signcryption σ=(h,R0,R1,...,R n , C), will (U n ,σ) is sent to the receiver.

[0031] The technical solution adopted by the device of the present invention is: a ring signcryption generation device based on the SM9 digital signature algorithm, comprising:

[0032] one or more processors;

[0033] A storage device is used to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the ring signcryption generation method based on the SM9 digital signature algorithm.

[0034] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0035] (1) The present invention optimizes the SM9 digital signature algorithm, which has lower computational and communication overheads and is particularly suitable for communication environments with limited energy and bandwidth.

[0036] (2) Due to the characteristics of the ring signcryption scheme of the present invention, the ring signcryption algorithm based on SM9 can be applied to anonymous voting, electronic voting systems or electronic cash systems, further promoting the application of the SM9 digital signature algorithm.

[0037] (3) The present invention innovatively proposes a ring signcryption algorithm based on SM9, which fills the gap of the SM9 digital signature algorithm in the ring signcryption scheme. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a flow chart of a method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to facilitate ordinary technicians in this field to understand and implement the present invention, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention and are not used to limit the present invention.

[0040] The SM9 identity cryptography algorithm, officially adopted as a national cryptography industry standard in 2016, has been extensively researched in recent years. It is an identity-based cryptographic system comprised of three components: a digital signature algorithm, a key exchange algorithm, and a public-key encryption algorithm. Regarding curve parameters, the SM9 algorithm utilizes a 256-bit BN curve to implement bilinear pairings, a pairing-friendly curve that is fast in engineering implementation. The SM9 standard can be applied to systems such as electronic authentication services, identity verification, and email, effectively ensuring the integrity and authenticity of data during transmission. This fills a gap in domestic identity cryptography systems. Due to its technological advantages, the SM9 identity cryptography algorithm has been widely adopted in government and enterprise sectors.

[0041] In the ring signcryption scheme, a ring user can generate a signcryption on behalf of the ring and send it. The recipient can decrypt it using his or her own private key and verify that the signcryption was indeed sent by a ring member, but the identity of the sending member is anonymous.

[0042] Please see Figure 1 The present invention provides a ring signcryption generation method based on the SM9 digital signature algorithm, comprising the following steps:

[0043] Step 1: Input the security parameter λ, and the key generation center KGC selects two additive cyclic groups (G1, +), (G2, +) of order q and a multiplicative group (G T ,·), q is a large prime number; select three hash functions H1(·), H2(·), H3(·); H3: {G1} n+1 ×G T ×{0, 1} * →{0, 1} * ; is a set of integers consisting of 1, 2, ..., q-1;

[0044] The key generation center KGC randomly selects an integer And calculate: g=e(P1,P2) s ; Among them, P1 and P2 represent the generators of groups G1 and G2 respectively; e() is the number from G1×G2 to G T Bilinear pairing mapping of G T is a multiplicative cyclic group of order q; the key generation center KGC publishes system parameters And secretly save your own master private key msk=s;

[0045] Step 2: When ID is ID i When a user applies to obtain a private key, the key generation center KGC is the user ID i Generate signature private key Si =s i P1 and decryption private key D i =s i P2; where s i =s·(v i +s) -1 , v i =H1(ID i ); the key generation center KGC will sign the private key S i and decryption private key D i Send to user ID i ;

[0046] Step 3: Given a recipient's ID η and an identity set U n ={ID1, ID2, ..., ID n}, the sender uses his signature private key S π Signcrypt the message m; where 1≤π≤n;

[0047] It includes the following sub-steps:

[0048] Step 3.1: Randomly select n+1 integers calculate v η =H1(ID η ),

[0049] Step 3.2: For all i∈{1, 2, ..., n}\{π}, calculate

[0050] Step 3.3: Calculation h=H2(w||m||U n ), v i =H1(ID i );in, Represents group G T Power operation on ; x||y means the concatenation of x and y;

[0051] Step 3.4: Calculation Among them, mod q represents the modular μ operation;

[0052] Step 3.5: Judge; if l π =0, then go back to step 3.1 and restart the signcryption process; otherwise, go to step 3.6;

[0053] Step 3.6: Calculate the ciphertext Among them, R π =l π ·S π ;

[0054] Step 3.7: Output ring signcryption σ = (h, R0, R1, ..., R n , C), will (U n ,σ) is sent to the receiver.

[0055] Step 4: When the receiver receives (U n , σ′=(h′, R′0, R′1,…, R′ n , C′)), decrypt to obtain the plaintext message m′ and verify the ring signature; the specific implementation includes the following steps:

[0056] Step 4.1: Calculation Where w′0=e(R′0,D η );

[0057] Step 4.2: For all i∈1,2,…,n, calculate v′ i =H1(ID i ),

[0058] Step 4.3: Verify the equation h′=H2(w′||m′||U n ) is established;

[0059] If the equation holds, the ring signature passes verification and m′ is the plaintext message; otherwise, the ring signature fails verification.

[0060] Correctness analysis of signature verification: The key to correct encryption and decryption lies in the validity of the equation w=w.

[0061]

[0062] And because:

[0063]

[0064] R π =l π ·S π

[0065] So we have:

[0066]

[0067] therefore:

[0068]

[0069] There are also:

[0070]

[0071] Therefore, w=w′ holds true, and the signature verification of this scheme is correct.

[0072] Ring signcryption is a hybrid scheme that extends signcryption technology to ring signatures. It can simultaneously perform ring signing and encryption operations on data, achieving both signer anonymity and message confidentiality and authentication within the same algorithm logic. This makes the ring signcryption algorithm more efficient than traditional methods in terms of both communication and computational overhead.

[0073] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of protection of the patent of the present invention. Under the guidance of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested by the present invention shall be based on the attached claims.

Claims

1. A ring signcryption generation method based on the SM9 digital signature algorithm, characterized in that: The following steps are involved: Step 1: Input the security parameter λ, and the key generation center KGC selects two additive cyclic groups (G1, +), (G2, +) of order q and a multiplicative group (G T , ·), q is a large prime number; select three hash functions H1(·), H2(·), H3(·); H1: H2: H3: {G1} n+1 ×G T ×{0, 1} * →{0, 1} * ; is a set of integers consisting of 1, 2, ...., q-1; The key generation center KGC randomly selects an integer And calculate: g=e(P1,P2) s ; Among them, P1 and P2 represent the generators of groups G1 and G2 respectively; e() is the number from G1×G2 to G T Bilinear pairing mapping of G T is a multiplicative cyclic group of order q; the key generation center KGC publishes system parameters And secretly save your own master private key msk=s; Step 2: When the ID i When a user applies to obtain a private key, the key generation center KGC is the user ID i Generate signature private key S i =s i P1 and decryption private key D i =s i P2; where s i =s·(v i +s) -1 , v i =H1(ID i ); the key generation center KGC will sign the private key S i and decryption private key D i Send to user ID i ; Step 3: Given a recipient's ID η and an identity set U n ={ID1, ID2, ..., ID n }, the sender uses his signature private key S π Signcrypt the message m; where 1≤π≤n; It includes the following sub-steps: Step 3.1: Randomly select n+1 integers calculate v η =H1(ID η ), Step 3.2: For all i∈{1, 2, ..., n}\{π}, calculate Step 3.3: Calculation h=H2(w||m||U n ), v i =H1(ID i );in, Represents group G T Power operation on ; x||y means the concatenation of x and y; Step 3.4: Calculation Among them, mod q represents the modulo q operation; Step 3.5: Judge; if l π =0, then go back to step 3.1 and restart the signcryption process; otherwise, go to step 3.6; Step 3.6: Calculate the ciphertext Among them, R π =l π ·S π ; Step 3.7: Output ring signcryption σ = (h, R0, R1, ..., R n , C), will (U n ,σ) is sent to the receiver.

2. The ring signcryption generation method based on the SM9 digital signature algorithm according to claim 1, characterized in that: When the receiver receives (U n , σ′=(h′, R′0, R′1,…, R′ n , C′)), decrypt to obtain the plaintext message m′ and verify the ring signature; the specific implementation includes the following steps: Step 4.1: Calculation Where w′0=e(R′0,D η ); Step 4.2: For all i∈1,2,…,n, calculate v′ i =H1(ID i ), Step 4.3: Verify the equation h′=H2(w′||m′||U n ) is established; If the equation holds, the ring signature passes verification and m′ is the plaintext message; otherwise, the ring signature fails verification.

3. A ring signcryption generation system based on the SM9 digital signature algorithm, characterized in that: Includes the following modules: Module 1 is used to input the security parameter λ, and the key generation center KGC selects two additive cyclic groups (G1, +), (G2, +) of order q and a multiplicative group (G T , ·), q is a large prime number; select three hash functions H1(·), H2(·), H3(·); H1: H2: H3: {G1} n+1 ×G T ×{0, 1} * →{0, 1} * ; is a set of integers consisting of 1, 2, ...., q-1; The key generation center KGC randomly selects an integer And calculate: g=e(P1,P2) s ; Among them, P1 and P2 represent the generators of groups G1 and G2 respectively; e() is the number from G1×G2 to G T Bilinear pairing mapping of G T is a multiplicative cyclic group of order q; the key generation center KGC publishes system parameters And secretly save your own master private key msk=s; Module 2, used when ID is ID i When a user applies to obtain a private key, the key generation center KGC is the user ID i Generate signature private key S i =s i P1 and decryption private key D i =s i P2; where s i =s·(v i +s) -1 , v i =H1(ID i ); the key generation center KGC will sign the private key S i and decryption private key D i Send to user ID i ; Module 3, used to give a recipient an identity ID η and an identity set U n ={ID1, ID2, ..., ID n }, the sender uses his signature private key S π Signcrypt the message m; where 1≤π≤n; Specifically includes the following sub-modules: Module 3.1, for randomly selecting n+1 integers calculate v η =H1(ID η ), Module 3.2 is used to calculate for all i∈{1, 2, ..., n}\{π} Module 3.3, for calculation h=H2(w||m||U n ), v i =H1(ID i );in, Represents group G T Power operation on ; x||y means the concatenation of x and y; Module 3.4, for calculation Among them, mod q represents the modulo q operation; Module 3.5, used for judgment; if l π =0, then return to module 3.1 and restart the signcryption process; otherwise, execute module 3.6; Module 3.6, for calculating ciphertext Among them, R π =l π ·S π ; Module 3.7, for outputting ring signcryption σ=(h,R0,R1,...,R n , C), will (U n ,σ) is sent to the receiver.

4. The ring signcryption generation system based on the SM9 digital signature algorithm according to claim 3, characterized in that: When the receiver receives (U n , σ′=(h′, R′0, R′1,…, R′ n , C′)), decrypt to obtain the plaintext message m′ and verify the ring signature; the specific implementation includes the following modules: Module 4.1, for calculation Where w′0=e(R′0,D η ); Module 4.2 is used to calculate v′ for all i∈1,2,…,n i =H1(ID i ), Module 4.3, for verifying the equation h′=H2(w′||m′||U n ) is established; If the equation holds, the ring signature passes verification and m′ is the plaintext message; otherwise, the ring signature fails verification.

5. A ring signcryption generation device based on the SM9 digital signature algorithm, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the ring signcryption generation method based on the SM9 digital signature algorithm as described in claim 1 or 2.

Images