Certificateless online and offline signature generation method, system and device based on SM9 signature

Abstract

The present invention discloses a certificateless online and offline signature generation method, system and device based on SM9 signature, wherein the method includes a user private key extraction algorithm, a signature algorithm (divided into an offline stage and an online stage) and a verification algorithm; the signature structure of the present invention is based on the SM9 algorithm, which eliminates the need for certificates in traditional public key cryptography and the key escrow problem in identity-based cryptography, and divides the signature into two stages: online and offline, which is suitable for low-end computing devices with weak computing power.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology and relates to an online and offline signature generation method, system and device, in particular to a certificateless online and offline signature generation method, system and device based on SM9 signature. Background Art

[0002] Digital signatures are an essential component of public-key cryptography. They can replace traditional manual signatures and seals. Signatures can achieve multiple security objectives, including content verification, approval, validation, and accountability, as well as non-repudiation, anti-forgery, anti-counterfeiting, and anti-tampering. Online and offline signatures are a specialized digital signature technology. Before the message arrives, the majority of the signature calculations are performed offline and the results are stored. Upon receiving the message to be signed, the data stored offline can be used to quickly generate the online signature. This technology is commonly used in resource-constrained IoT scenarios. Currently, mainstream digital signature technologies are based on traditional public-key cryptography (PKC) systems and require a public key infrastructure (PKI) and certificate management mechanisms. Specifically, a third-party certificate authority (CA) issues a public key certificate to verify the trusted binding between the public key and the identity. Identity-based cryptography (IBC) aims to reduce infrastructure requirements by using user identities as public keys. However, it still suffers from the security issue of key escrow because the private key generator (PKG) can generate all users' private keys. In certificateless public key cryptography (CL-PKC), a key generation center (KGC) issues only a portion of the private key to each user. Users independently generate public / private key pairs and perform encryption operations. This not only solves the key escrow issue but also eliminates the use of certificates in traditional digital signature schemes. In 2003, Gentry et al. proposed the concept of certificate-based encryption (CBE). Certificates not only serve as certificates in traditional PKI but also as decryption keys. Each user generates their own public / private key pair and requests a certificate from a CA. The CA uses a key generation algorithm based on identity-based encryption (IBE) to generate a certificate from the user's identity and public key. In 2004, Kang et al. first proposed the concept of certificate-based signature (CBS). The signing process requires both the user's private key and their certificate, while verification only requires the user's public key. Traditional PKI requires sending both the certificate and the signature to the verifier, rather than just the signature, which requires more bandwidth to transmit the signature.Certificate-based signatures, on the other hand, use certificates to generate signatures, without the need to send the certificate along with the signature. The verifier can verify the validity of the signature to ensure the existence of the certificate. This combines the advantages of PKC and IBC, eliminating the need for expensive certificate chain verification and removing the security issues of key escrow. It is suitable for environments with limited computing power or expensive communication bandwidth. For example, in wireless collaborative networks, where communication bandwidth is very expensive, CBS eliminates tedious certificate verification without compromising security, and requires less communication data. However, the disadvantage is that because both the private key and the certificate are used to generate the signature, and the verification of each signature implies verification of the certificate, it requires more operational costs. Summary of the Invention

[0003] In order to solve the above technical problems, the present invention provides a certificate-free online and offline signature generation method, system and device for SM9 signature.

[0004] The technical solution adopted by the method of the present invention is: a certificate-free online and offline signature generation method based on SM9 signature, comprising the following steps:

[0005] Step 1: The key generation center KGC generates a random number As the master private key, and calculate the master public key P pub =[d]P2; where is the set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; P2 is the generator of the group G2, which is an additive cyclic group of order q; [d]P2 represents the d-fold point of P2 on the elliptic curve;

[0006] Step 2: The key generation center KGC calculates G T The element g in g=e(P1,P pub ); where P1 is the generator of the group G1, G1 is an additive cyclic group of order q; G T It is a multiplicative cyclic group of order q; e() is from G1×G2 to G T Bilinear pairing mapping of ;

[0007] Step 3: The key generation center KGC generates the signer's partial private key as usk0 = [d (H1 (ID) + d) -1 ]P1, and send usk0 to the signer; where H1(·) is a cryptographic function derived from the cryptographic hash function, ID is the user's identifiable identifier;

[0008] Step 4: Signers are randomly selected Set x as your secret value;

[0009] Step 5: The signer calculates Q = [H1(ID)]P2+P pub, upk1=[x]Q; where [x]Q represents the x-times point Q on the elliptic curve;

[0010] Step 6: The signer calculates s=H3(upk1); where H3(·) is a cryptographic function derived from the cryptographic hash function, which is

[0011] Step 7: The signer calculates his own private key usk1 = [(x + s) -1 ]usk0;

[0012] Step 8: Signers are randomly selected Calculate W = g w , Y=[y]P, Z=[z]P; where, g w is the multiplicative group G T The wth power of the element g in P; P is the generator of the group G, which is an additive cyclic group of order q;

[0013] Step 9: The signer calculates h = H2(ID||upk1||Z||W); where H2(·) is a cryptographic function derived from the cryptographic hash function, which is

[0014] Step 10: The signer calculates l = w - h mod q; where mod q is the modulo q operation;

[0015] Step 11: The signer calculates V = [l]usk1;

[0016] Step 12: The signer sets the signer's private key usk=(usk1, x, y) and the signer's public key upk=(upk1, Y, V);

[0017] Step 13: The signer signs;

[0018] The signer performs offline signing and first randomly selects Then calculate T i =[t i ]P;

[0019] The signer signs online and calculates r i =ZF(m i , T i )(t i +y)mod q; where F() represents the hash function m i is the message to be signed;

[0020] Step 14: Output signature value σ i =(T i , r i ).

[0021] The technical solution adopted by the system of the present invention is: a certificateless online and offline signature generation system based on SM9 signature, including the following modules:

[0022] Module 1, used by the key generation center KGC to generate random numbers As the master private key, and calculate the master public key P pub =[d]P2; where is the set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; P2 is the generator of the group G2, which is an additive cyclic group of order q; [d]P2 represents the d-fold point of P2 on the elliptic curve;

[0023] Module 2, used by the key generation center KGC to calculate G T The element g in g=e(P1,P pub ); where P1 is the generator of the group G1, G1 is an additive cyclic group of order q; G T It is a multiplicative cyclic group of order q; e() is from G1×G2 to G T Bilinear pairing mapping of ;

[0024] Module 3, used by the key generation center KGC to generate the signer's partial private key as usk0 = [d (H1 (ID) + d) -1 ]P1, and send usk0 to the signer; where H1(·) is a cryptographic function derived from the cryptographic hash function, ID is the user's identifiable identifier;

[0025] Module 4, for random selection of signers Set x as your secret value;

[0026] Module 5, for the signer to calculate Q = [H1(ID)]P2+P pub , upk1=[x]Q; where [x]Q represents the x-times point Q on the elliptic curve;

[0027] Module 6 is used by the signer to calculate s=H3(upk1); where H3(·) is a cryptographic function derived from the cryptographic hash function, which is

[0028] Module 7, used by the signer to calculate his own private key usk1 = [(x + s) -1 ]usk0;

[0029] Module 8, for random selection of signers Calculate W = g w , Y=[y]P, Z=[z]P; where, g w is the multiplicative group G TThe wth power of the element g in P; P is the generator of the group G, which is an additive cyclic group of order q;

[0030] Module 9 is used for the signer to calculate h=H2(ID||upk1||Z||W); where H2(·) is a cryptographic function derived from the cryptographic hash function, which is

[0031] Module 10, for the signer to calculate l = w - h mod q; where mod q is a modulo q operation;

[0032] Module 11, for the signer to calculate V=[l]usk1;

[0033] Module 12, for the signer to set the signer's private key usk=(usk1, x, y), the signer's public key upk=(upk1, Y, V);

[0034] Module 13, used for the signer to sign;

[0035] The signer performs offline signing and first randomly selects Then calculate T i =[t i ]P;

[0036] The signer signs online and calculates r i =zF(m i , T i )(t i +y)mod q; where F() represents the hash function m i is the message to be signed;

[0037] Module 14, used to output signature value σ i =(T i , r i ).

[0038] The technical solution adopted by the device of the present invention is: a certificateless online and offline signature generation device based on SM9 signature, comprising:

[0039] one or more processors;

[0040] A storage device is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the certificateless online and offline signature generation method based on SM9 signature.

[0041] Compared with existing technologies, this invention offers the following advantages and benefits: It pioneers a certificateless online and offline signature scheme based on SM9. This scheme eliminates the need to transmit large amounts of certificate data and separates the signature process into two phases, online and offline. This makes it suitable for resource-constrained applications, addressing the gaps in the SM9 digital signature algorithm within certificateless systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a flow chart of a method according to an embodiment of the present invention.

[0043] Figure 2 This is a flow chart of a signature verification method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to facilitate ordinary technicians in this field to understand and implement the present invention, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the implementation examples described herein are only used to illustrate and explain the present invention and are not used to limit the present invention.

[0045] The SM9 algorithm is an identity cryptographic algorithm based on elliptic curve bilinear pairings. It was published by the State Cryptography Administration on March 28, 2016 (Standard No.: GM / T 0044-2016SM9 Identity Cryptographic Algorithm) and adopted as an international standard in November 2018. It primarily consists of three components: a digital signature algorithm, a public-key encryption algorithm, and a key exchange protocol. SM9 can be applied in email systems, secure data transmission protocols, the Internet of Things, and other scenarios.

[0046] Please see Figure 1 The present invention provides a certificate-free online and offline signature generation method based on SM9 signature, comprising the following steps:

[0047] Step 1: The key generation center KGC generates a random number As the master private key, and calculate the master public key P pub =[d]P2; where is the set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; P2 is the generator of the group G2, which is an additive cyclic group of order q; [d]P2 represents the d-fold point of P2 on the elliptic curve;

[0048] Step 2: The key generation center KGC calculates G T The element g in g=e(P1,P pub ); where P1 is the generator of the group G1, G1 is an additive cyclic group of order q; G T It is a multiplicative cyclic group of order q; e() is from G1×G2 to G T Bilinear pairing mapping of ;

[0049] Step 3: The key generation center KGC generates the signer's partial private key as usk0 = [d (H1 (ID) + d) -1 ]P1, and send usk0 to the signer; where H1(·) is a cryptographic function derived from the cryptographic hash function, ID is the user's identifiable identifier;

[0050] Step 4: Signers are randomly selected Set x as your secret value;

[0051] Step 5: The signer calculates Q = [H1(ID)]P2+P pub , upk1=[x]Q; where [x]Q represents the x-times point Q on the elliptic curve;

[0052] Step 6: The signer calculates s=H3(upk1); where H3(·) is a cryptographic function derived from the cryptographic hash function, which is

[0053] Step 7: The signer calculates his own private key usk1 = [(x + s) -1 ]usk0;

[0054] Step 8: Signers are randomly selected Calculate W = g w , Y=[y]P, Z=[z]P; where, g w is the multiplicative group G T The wth power of the element g in P; P is the generator of the group G, which is an additive cyclic group of order q;

[0055] Step 9: The signer calculates h = H2(ID||upk1||Z||W); where H2(·) is a cryptographic function derived from the cryptographic hash function, which is

[0056] Step 10: The signer calculates l = w - h mod q; where mod q is the modulo q operation;

[0057] Step 11: The signer calculates V = [l]usk1;

[0058] Step 12: The signer sets the signer's private key usk=(usk1, x, y) and the signer's public key upk=(upk1, Y, V);

[0059] Step 13: The signer signs

[0060] The signer performs offline signing and first randomly selects Then calculate T i =[t i ]P;

[0061] The signer signs online and calculates r i =zF(m i , T i )(t i +y)mod q; where F() represents the hash function m i is the message to be signed;

[0062] Step 14: Output signature value σ i =(T i , r i ).

[0063] Please see Figure 2 , the present invention targets the signature value σ i The signature verification process includes the following steps:

[0064] Step 15: The verifier calculates the value of the given message m. i , the signer's public key upk, identity ID and signature value σ i ,calculate:

[0065] Z′=[r i ]P+[F(m i , T i )](T i +Y);

[0066] Q=[H1(ID)]P2+P pub ;

[0067] s=H3(upk1);

[0068] u=e(V,upk1+[s]Q);

[0069] W′=u·g;

[0070] Among them, [r i ] represents the elliptic curve point multiplication, g h is the multiplicative group G T The element g in h is raised to the power of h;

[0071] Step 16: Determine whether h=H2(ID||upk1||Z′||W′) holds. If so, then σ i is a legal signature; otherwise, the signature is invalid; where m||n represents the concatenation of m and n;

[0072] The correctness analysis process is as follows:

[0073] Z′=[r i ]P+[F(m i , T i)](T i +Y)

[0074] =[z-F(m i ,T i )(t i +y)]P+[F(m,T i )]([t i ]P+[y]P)

[0075] =[z]P-[F(m i ,T i )(t i +y)]P+[F(m,T i )]([t i ]P+[y]P)

[0076] =[z]P-[F(m i ,T i )(t i +y)]P+[F(m i ,T i )(t i +y)]P

[0077] =[z]P;

[0078] u=e(V,upk1+[H3(upk1)]Q)

[0079] =e([l]usk1,[x]Q+[s]Q)

[0080] =e([l·(x+s) -1 ]usk0,[x]Q+[s]Q)

[0081] =e([l·d·(x+s) -1 ·(H1(ID)+d) -1 ]P1,[(x+s)·(H1(ID)+d)]P2)

[0082] =e(P1,Pp ub ) l

[0083] =g l ;

[0084] W′=u·g h

[0085] =g l ·g h

[0086] =g w-h ·g h

[0087] =gw

[0088] h=H2(ID||upk1||Z′||W′)

[0089] =H2(ID||upk1||[z]P||g w )

[0090] Certificateless public-key cryptography solves the key escrow problem of identity-based cryptography. A key generation center uses a master key to derive partial keys from the user's identity. Users, in turn, generate their own private and public keys, which are independent of the partial keys. Both the user's private and partial keys are required to generate signatures. Compared to traditional public-key infrastructure cryptography and identity-based cryptography, certificateless cryptography does not require any certificates to ensure the authenticity of public / private key pairs. Furthermore, because private keys are generated with the help of both the user and the key generation center, the key escrow problem is eliminated. With these advantages, certificateless cryptography can provide strong security for mobile devices while meeting the efficiency requirements of resource-constrained devices.

[0091] The signature structure of the present invention is based on the SM9 algorithm, which eliminates the need for certificates in traditional public key cryptography and the key custody problem in identity-based cryptography, and divides the signature into two stages: online and offline, which is suitable for low-end computing devices with weak computing power.

[0092] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of protection of the patent of the present invention. Under the guidance of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested by the present invention shall be based on the attached claims.

Claims

1. A certificateless online and offline signature generation method based on SM9 signature, characterized in that: The following steps are involved: Step 1: The key generation center KGC generates a random number As the master private key, and calculate the master public key P pub =[d]P2; where is the set of integers consisting of 1, 2, ....., q-1, where q is a large prime number; P2 is the generator of the group G2, which is an additive cyclic group of order q; [d]P2 represents the d-fold point of P2 on the elliptic curve; Step 2: The key generation center KGC calculates G T The element g in g=e(P1,P pub ); where P1 is the generator of the group G1, G1 is an additive cyclic group of order q; G T It is a multiplicative cyclic group of order q; e() is from G1×G2 to G T Bilinear pairing mapping of ; Step 3: The key generation center KGC generates the signer's partial private key as usk0 = [d (H1 (ID) + d) -1 ]P1, and send usk0 to the signer; where H1(·) is a cryptographic function derived from the cryptographic hash function, ID is the user's identifiable identifier; Step 4: Signers are randomly selected Set x as your secret value; Step 5: The signer calculates Q = [H1(ID)]P2+P pub , upk1=[x]Q; where [x] represents the elliptic curve point product; Step 6: The signer calculates s=H3(upk1); where H3(·) is a cryptographic function derived from the cryptographic hash function, which is Step 7: The signer calculates his own private key usk1 = [(x + s) -1 ]usk0; Step 8: The signer randomly selects w, y, Calculate W = g w , Y=[y]P, Z=[z]P; where, g w is the multiplicative group G T The wth power of the element g in P; P is the generator of the group G, which is an additive cyclic group of order q; Step 9: The signer calculates h = H2(ID||upk1||Z||W); where H2(·) is a cryptographic function derived from the cryptographic hash function, which is Step 10: The signer calculates l = wh mod q; where mod q is a modulo q operation; Step 11: The signer calculates V = [l]usk1; Step 12: The signer sets the signer's private key usk=(usk1, x, y) and the signer's public key upk=(upk1, Y, V); Step 13: The signer signs The signer performs offline signing and first randomly selects Then calculate T i =[t i ]P; The signer signs online and calculates r i =zF(m i , T i )(t i +y) mod q; where F() represents the hash function F: m i is the message to be signed; Step 14: Output signature value σ i =(T i , r i ).

2. The certificateless online and offline signature generation method based on SM9 signature according to claim 1 is characterized in that: For the signature value σ i The signature verification process includes the following steps: Step 15: The verifier calculates the value of the given message m. i , the signer's public key upk, identity ID and signature value σ i ,calculate: Z′=[r i ]P+[F(m i ,T i )](T i +Y); Q=[H1(ID)]P2+P pub ; s=H3(upk1); u=e(V,upk1+[s]Q); W′=u·g; Among them, [r i ] represents the elliptic curve point multiplication, g h is the multiplicative group G T The element g in h is raised to the power of h; Step 16: Determine whether h=H2(ID||upk1||Z′||W′) holds. If so, then σ i is a legal signature; otherwise, the signature is invalid; where m||n represents the concatenation of m and n; The correctness analysis process is as follows: Z′=[r i ]P+[F(m i ,T i )](T i +Y) =[z-F(m i ,T i )(t i +y)]P+[F(m,T i )]([t i ]P+[y]P) =[z]P-[F(m i ,T i )(t i +y)]P+[F(m,T i )]([t i ]P+[y]P) =[z]P-[F(m i ,T i )(t i +y)]P+[F(m i ,T i )(t i +y)]P =[z]P; u=e(V,upk1+[H3(upk1)]Q) =e([l]usk1, [x]Q+[s]Q) =e([l·(x+s) -1 ]usk0,[x]Q+[s]Q) =e([l·d·(x+s) -1 ·(H1(ID)+d) -1 ]P1,[(x+s)·(H1(ID)+d)]P2) =e(P1,P pub ) l ＝g l ； W′=u·g h =g l ·g h =g w-h ·g h ＝g w h=H2(ID||upk1||Z′||W′) =H2(ID||upk1||[z]P||g w )。 3. A certificateless online and offline signature generation system based on SM9 signature, characterized in that: Includes the following modules: Module 1, used by the key generation center KGC to generate random numbers As the master private key, and calculate the master public key P pub =[d]P2; where is the set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; P2 is the generator of the group G2, which is an additive cyclic group of order q; [d]P2 represents the d-fold point of P2 on the elliptic curve; Module 2, used by the key generation center KGC to calculate G T The element g in g=e(P1,P pub ); where P1 is the generator of the group G1, G1 is an additive cyclic group of order q; G T It is a multiplicative cyclic group of order q; e() is from G1×G2 to G T Bilinear pairing mapping of ; Module 3, used by the key generation center KGC to generate the signer's partial private key as usk0 = [d (H1 (ID) + d) -1 ]P1, and send usk0 to the signer; where H1(·) is a cryptographic function derived from the cryptographic hash function, ID is the user's identifiable identifier; Module 4, for random selection of signers Set x as your secret value; Module 5, for the signer to calculate Q = [H1(ID)]P2+P pub , upk1=[x]Q; where [x]Q represents the x-times point Q on the elliptic curve; Module 6 is used by the signer to calculate s=H3(upk1); where H3(·) is a cryptographic function derived from the cryptographic hash function, which is Module 7, used by the signer to calculate his own private key usk1 = [(x + s) -1 ]usk0; Module 8, for the signer to randomly select w, y, Calculate W = g w , Y=[y]P, Z=[z]P; where, g w is the multiplicative group G T The wth power of the element g in P; P is the generator of the group G, which is an additive cyclic group of order q; Module 9 is used for the signer to calculate h=H2(ID||upk1||Z||W); where H2(·) is a cryptographic function derived from the cryptographic hash function, which is Module 10, for the signer to calculate l = w - h mod q; where mod q is a modulo q operation; Module 11, for the signer to calculate V=[l]usk1; Module 12, for the signer to set the signer's private key usk=(usk1, x, y) and the signer's public key upk=(upk1, Y, V); Module 13, for the signer to sign The signer performs offline signing and first randomly selects Then calculate T i =[t i ]P; The signer signs online and calculates r i =zF(m i , T i )(t i +y) mod q; where F() represents the hash function F: m i is the message to be signed; Module 14, used to output signature value σ i =(T i , r i ).

4. The certificateless online and offline signature generation system based on SM9 signature according to claim 3 is characterized in that: For the signature value σ i The signature verification system specifically includes the following modules: Module 15 is used for the verifier to verify the given message m i , the signer's public key upk, identity ID and signature value σ i ,calculate: Z′=[r i ]P+[F(m i ,T i )](T i +Y); Q=[H1(ID)]P2+P pub ; s=H3(upk1); u=e(V,upk1+[s]Q); W′=u·g; Among them, [r i ] represents the elliptic curve point multiplication, g h is the multiplicative group G T The element g in h is raised to the power of h; Module 16 is used to determine whether h=H2(ID||upk1||Z′||W′) holds. If so, then σ i is a legal signature; otherwise, the signature is invalid; where m||n represents the concatenation of m and n; The correctness analysis process is as follows: Z′=[r i ]P+[F(m i ,T i )](T i +Y) =[z-F(m i ,T i )(t i +y)]P+[F(m,T i )]([t i ]P+[y]P) =[z]P-[F(m i ,T i )(t i +y)]P+[F(m,T i )]([t i ]P+[y]P) =[z]P-[F(m i ,T i )(t i +y)]P+[F(m i ,T i )(t i +y)]P =[z]P; u=e(V,upk1+[H3(upk1)]Q) =e([l]usk1, [x]Q+[s]Q) =e([l·(x+s) -1 ]usk0,[x]Q+[s]Q) =e([l·d·(x+s) -1 ·(H1(ID)+d) -1 ]P1,[(x+s)·(H1(ID)+d)]P2) =e(P1,P pub ) l ＝g l ； W′=u·g h =g l ·g h =g w-h ·g h ＝g w h=H2(ID||upk1||Z′||W′) =H2(ID||upk1||[z]P||g w )。 5. A certificateless online and offline signature generation device based on SM9 signature, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the certificateless online and offline signature generation method based on SM9 signature as described in claim 1 or 2.

Images