A secure and controllable use method and system of ECDSA signature private key

Abstract

Safe and controllable use of ECDSA signature private key: The user terminal has Q U =d U G, S B =E(b),d B =(bd U )mod n,d U is the user's ECDSA private key, G is the base point, the order of G is n, Q U is d U The corresponding public key, b is the secret in [1,n‑1], G b =b ‑1 G, E(·) is a homomorphic encryption operation, and the signature auxiliary device or system has or can obtain the private key of the homomorphic encryption decryption operation; when it is necessary to use d U When signing a message M: first calculate the hash value e of the message M; the user terminal, signature auxiliary device or system randomly selects integers k1 and k2 in [1, n-1] and collaboratively calculates R = k1k2G b ; Calculate r = x R mod n,(x R ,y R )=R;The user terminal calculates s1=E((k1) ‑1 (eb+rd B )), or the signature assistance device or system sets c2=E((k2) ‑1 ) is transmitted to the user terminal, and the user terminal calculates s1=E((k1k2) ‑1 (eb+rd B )); The signature auxiliary device or system decrypts s1 to obtain s 12 , calculate s = ((k2) ‑1 s 12 ) mod n or s = s 12 mod n; (r, s) is the digital signature of message M.

Description

Technical Field

[0001] The present invention belongs to the field of cryptographic technology, and in particular to a method and system for securely and controllably using an ECDSA signature private key. Background Art

[0002] For user terminal computing environments (such as personal computers, mobile phones, tablet computers, and other mobile terminals) that do not have cryptographic hardware to store signature private keys and use signature private keys for cryptographic operations, a digital signature collaborative generation scheme based on secret sharing is often used to ensure the security of signature private keys and generated digital signatures. ECDSA (Elliptic Curve Digital Signature Algorithm) is a digital signature algorithm based on elliptic curve point groups that is currently widely used internationally. A brief description is as follows (for details, see "4.1 Elliptic Curve Digital Signature Algorithm" in "Standards for Efficient Cryptography, SEC 1: Elliptic Curve Cryptography", Certicom Research, May 21, 2009 Version 2.0):

[0003] The order of the elliptic curve point group (subgroup) or base point G of ECDSA is a prime number n, and the user's signature private key d U is a randomly selected integer in [1,n-1], and the public key is Q U =d U G; when signing a message M, first use a hash function to calculate the hash value e of the message M (in fact, e is an integer converted and derived from the hash value H=H(M) of the message M, but it is usually simply said that e is the hash value of the message M, and this is also the case in the description of the present invention); randomly select an integer k in [1,n-1] and calculate R=kG; calculate r=x R mod n, where x R Taken from (x R ,y R )=R (The actual calculation is to first convert x R Convert the integer and then take its modulo n remainder, but it is usually described as follows); if r = 0, reselect k and recalculate R and r until r is not 0; calculate s = k -1 (e+rd U ); if s = 0, reselect k and recalculate s until s is not 0; then (r, s) is the digital signature for message M.

[0004] It should be pointed out that there are many digital signature algorithms based on elliptic curve point groups, which belong to different digital signature algorithms. The ECDSA of the present invention specifically refers to a specific elliptic curve digital signature algorithm that is currently widely used internationally, and its name is ECDSA (a name generally accepted internationally, see the above document).

[0005] One problem with the current ECDSA-based secret sharing digital signature is that other digital signature collaborative generation participants other than the user share the user's signature private key, that is, the secret share of the user's signature private key. This is not fully consistent with the "Electronic Signature Law of the People's Republic of China". The "Electronic Signature Law" requires that the signature production data when generating an electronic signature be proprietary and controlled by the signer, and for a digital signature, the signature production data is also the signature private key. Therefore, how to safely store and use the user's ECDSA signature private key in the user terminal without sharing the ECDSA signature private key, that is, how to ensure the validity and security of the generated digital signature when other digital signature collaborative generation participants other than the user do not have the secret share of the signature private key, is a technical problem that needs to be solved. Moreover, in the case of not adopting the secret sharing of the signature private key, how to ensure the safe storage and use of the signature private key (signature production data) stored in the user terminal is particularly important, because the theft of the signature private key (signature production data) stored in the user terminal will lead to the leakage or misappropriation of the signature private key.

[0006] In addition, due to certain special requirements, such as in order to comply with certain technical specifications, it may be necessary to adopt a solution based on secret sharing of signature private keys (some technical specifications are based on secret sharing of signature private keys). Therefore, if an ECDSA digital signature technology solution can be implemented for both application scenarios of non-secret sharing of signature private keys and application scenarios of secret sharing of signature private keys, it will be able to better meet the needs of customers and users. Summary of the invention

[0007] The purpose of the present invention is to propose a corresponding technical solution to overcome the shortcomings of the prior art in view of the problems existing in the current technical solution for collaborative generation of ECDSA digital signatures based on secret sharing, and to enable the proposed technical solution to be implemented in application scenarios for non-secret sharing of signature private keys as well as in application scenarios for secret sharing of signature private keys.

[0008] In view of the purpose of the present invention, the technical solution proposed by the present invention includes a safe and controllable use method of an ECDSA signature private key and a corresponding system.

[0009] In the following description of the technical solution of the present invention, if P and Q are elements (points) in the elliptic curve point group, then P+Q represents the point addition of P and Q, PQ represents the inverse element of P plus Q, and kP represents the point addition of k elliptic curve points P, that is, P+P+...+P (there are k Ps in total, if k is a negative number, then kP is the additive inverse element of the result of the point addition of |k| elliptic curve points P); c -1 represents the modulo n multiplicative inverse of an integer c (i.e., cc -1 mod n=1); unless otherwise specified, the multiplication inverse in this patent application is the modulo n multiplication inverse of the order n of the ECDSA elliptic curve point group (i.e., the order n of the base point G); when multiple integers are multiplied (including integer symbol parameters, variable multiplication, constant and integer symbol parameters, and variable multiplication), the multiplication sign "·" is omitted without causing ambiguity, such as k1·k2 is simplified to k1k2, and 3·c is simplified to 3c; mod n represents modulo operation, and the priority of the operator mod n of the modulo operation is the lowest, such as a+b mod n is equivalent to (a+b)mod n, ab mod n is equivalent to (ab)mod n, and ab mod n is equivalent to (ab)mod n.

[0010] The secure and controllable use method of the ECDSA signature private key proposed in the present invention is as follows.

[0011] User terminal has Q U =d U G, there is a secret B =(bd U )mod n, there is or can be S B =E(b), where d U is the user's ECDSA signature private key, G is the base point of the ECDSA elliptic curve point group (subgroup), Q U The user's ECDSA signature private key d U The corresponding public key, b is an integer secret in [1, n-1], n is the order of the base point G (also the order of the ECDSA elliptic curve point group (subgroup)), n is a prime number, and E(·) is the encryption operation using the homomorphic encryption algorithm;

[0012] The homomorphic encryption algorithm is an additive homomorphic encryption algorithm or a fully homomorphic encryption algorithm; the signature auxiliary device or system has a private key SK1 (private key of the homomorphic encryption algorithm) for decryption operation corresponding to the public key used in the encryption operation E(·) of the homomorphic encryption algorithm, or the private key SK1 for decryption operation corresponding to the public key used in the encryption operation E(·) of the homomorphic encryption algorithm is encrypted into a ciphertext T by using the key of the signature auxiliary device or system. sk1, wherein the key of the signature auxiliary device or system used to encrypt the private key SK1 includes a symmetric key or a public key (wherein the public key includes an ordinary public key, such as the public key of an ordinary public key cryptographic algorithm such as RSA, SM2, or a group public key of a group-oriented encryption algorithm), and the user terminal also stores the ciphertext T of the private key SK1 for decryption operation corresponding to the public key used in the encryption operation E(·) sk1 (T sk1 It is not a secret to the signature auxiliary device or system, but it can be kept secret to the computing device or system other than the signature auxiliary device or system);

[0013] The user terminal does not have and cannot obtain b; the signature auxiliary device or system does not have b and cannot obtain b, or the signature auxiliary device or system has or can obtain b;

[0014] The user terminal can obtain S B = E(b) includes the case where the signature auxiliary device or system converts S B Submit to the user terminal (the signature auxiliary device or system pre-stores S B , or temporarily encrypt b to get S B Then submit it to the user terminal) (here you can get S B It means "there is S B ”);

[0015] The situation where the signature auxiliary device or system can obtain b includes when the user terminal sends S B Submit to the signing auxiliary device or system, which decrypts S (using private key SK1) B Get b (here being able to get b refers to the situation other than “having b”);

[0016] Devices or systems other than user terminals and signature assistance devices or systems do not have b;

[0017] If the signature assisting device or system does not have b and cannot obtain b, then S B As a secret, it is securely stored in the user terminal and protected (in other cases, as long as the user terminal stores S B , and preferably stored securely and protected as a secret);

[0018] If the signature auxiliary device or system does not have b and cannot obtain b, then take G b =b -1 G (calculated by the corresponding program, device or system during initialization b ), b -1 is the modulo n multiplicative inverse of b, and at least one of the user terminal and the signature auxiliary device or system has G b , G bis a non-secret between the two (it may or may not be a secret outside the two); if the signature auxiliary device or system has or can obtain b, then take G b =G;

[0019] The user terminal is a computing device of the user (such as a personal computer, mobile phone, tablet computer); the signature auxiliary device or system is a computing device or system that assists and helps the user terminal to complete the generation and calculation of the digital signature;

[0020] When you need to use the user's ECDSA signature private key d U When digitally signing a message M, the user terminal and the signature auxiliary device or system generate a digital signature for the message M as follows (the user's ECDSA signature private key d U , the subject that digitally signs the message M may be an application or system inside or outside the user terminal that needs to call the digital signature function in the user terminal):

[0021] The user terminal uses the message M and a hash function to calculate a hash value e of the message M for digital signature calculation, and sends e to the signature auxiliary device or system; or the signature auxiliary device or system uses the message M and a hash function to calculate a hash value e of the message M for digital signature calculation, and sends e to the user terminal;

[0022] The user terminal randomly selects an integer k1 in the interval [1, n-1], where n is the order of the base point G;

[0023] The signature auxiliary device or system randomly selects an integer k2 in the interval [1, n-1];

[0024] The user terminal and the signature auxiliary device or system complete the following calculation without exposing their respective secrets k1 and k2:

[0025] The user terminal obtains R=k1k2G by interactively calculating with the signature auxiliary device or system while ensuring that the signature auxiliary device or system does not reselect k2. b ;

[0026] The signature auxiliary device or system obtains R by interactively calculating with the user terminal while ensuring that the user terminal does not reselect k1. f =k1k2G b ;

[0027] or,

[0028] The user terminal calculates R=(k1+k2)G by interacting with the signature auxiliary device or system while ensuring that the signature auxiliary device or system does not reselect k2.b ;

[0029] The signature auxiliary device or system obtains R by interactively calculating with the user terminal while ensuring that the user terminal does not reselect k1. f =(k1+k2)G b ;

[0030] If R and / or R f is zero (infinity point), the user terminal, signature auxiliary device or system reselects k1 and k2 and recalculates R and R f , until R and R f Not zero yuan;

[0031] The user terminal calculates r = x R mod n, where x R Taken from (x R ,y R )=R;

[0032] Signature assisting device or system calculates r f =x Rf mod n, where x Rf Taken from (x Rf ,y Rf )=R f ;

[0033] The user terminal and the signature assisting device or system check r and / or r f Is it 0 (integer 0), if so, the user terminal and the signature auxiliary device or system reselect k1, k2, and recalculate R, R f , recalculate r and r f , until r and r f None of them is 0;

[0034] The user terminal and the signature auxiliary device or system respectively check whether (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0, that is, whether s = 0 will occur, where s is the parameter s in the digital signature (r, s) to be calculated;

[0035] If yes, the user terminal and the signature auxiliary device or system reselect k1 and k2 and recalculate R and R f , recalculate r and r f , until there is no (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0, or, proceed to error handling;

[0036] If it does not appear (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0, then perform subsequent calculations;

[0037] The user terminal calculates s1 in one of the following ways:

[0038] s1 calculation method 1:

[0039] R, R f The calculation formula used is R = k1k2G b , R f =k1k2G b ;

[0040] The user terminal randomly selects an integer q in [1,n-1] and uses q, e, r, S B d B , k1 is calculated by homomorphic encryption algorithm:

[0041] s 10 =E(((k1) -1 eb+q)(mod n)),s 11 =((k1) -1 rd B -q)mod n,

[0042] Or, 10 =E(((k1) -1 (eb+q))(mod n)), s 11 =((k1) -1 (rd B -q))mod n,

[0043] Or, 10 =E(((k1) -1 e(b+q))(mod n)),s 11 =((k1) -1 (rd B -eq))mod n, where (k1) -1 is the modulo n multiplicative inverse of k1 (eq is e*q);

[0044] s 10 、s 11 Value pair (s 10 ,s 11 ) constitutes s1;

[0045] s1 calculation method 2:

[0046] R, Rf The calculation formula used is R = k1k2G b , R f =k1k2G b ;

[0047] The user terminal uses e, r, S B d B , k1 is calculated by homomorphic encryption algorithm:

[0048] s1=E(((k1) -1 (eb+rd B ))(mod n));

[0049] s1 calculation method three:

[0050] R, R f The calculation formula used is R = k1k2G b , R f =k1k2G b ;

[0051] The homomorphic encryption algorithm corresponding to E(·) is the fully homomorphic encryption algorithm;

[0052] The signature assisting device or system calculates c2=E((k2) -1 ), where (k2) -1 is the modulo n multiplicative inverse of k2, and c2 is sent to the user terminal;

[0053] The user terminal uses e, r, S B d B , k1, c2 are calculated by homomorphic encryption algorithm:

[0054] s1=E(((k1k2) -1 (eb+rd B ))(mod n)), where (k1k2) -1 is the modulo n multiplicative inverse of k1k2 (or (k1k2) mod n);

[0055] s1 calculation method 4:

[0056] R, R f The calculation formula used is R = (k1 + k2) G b , R f =(k1+k2)G b ;

[0057] The signature auxiliary device or system calculates c2=E(k2) and sends c2 to the user terminal;

[0058] The user terminal randomly selects an integer q in [1,n-1] and uses q, e, r, SB d B , k1, c2 are calculated by homomorphic encryption algorithm:

[0059] s 10 =E((q(k1+k2))(mod n)),s 11 =E(q(eb+rd B )(mod n));

[0060] s 10 、s 11 Value pair (s 10 ,s 11 ) constitutes s1;

[0061] After calculating s1, the user terminal sends s1 to the signature auxiliary device or system;

[0062] If the private key SK1 of the decryption operation corresponding to the public key used in the encryption operation E(·) of the homomorphic encryption algorithm is encrypted into the ciphertext T using the key of the signature auxiliary device or system sk1 is saved in the user terminal, the user terminal will also T sk1 is sent to the signature auxiliary device or system, and the signature auxiliary device or system decrypts T sk1 Obtain the private key SK1 of the decryption operation corresponding to the public key used in the encryption operation E(·) of the homomorphic encryption algorithm (the private key SK1 of the homomorphic encryption algorithm, that is, the private key SK1 for the decryption operation of the homomorphic encryption algorithm);

[0063] If the signature auxiliary device or system does not have b and cannot obtain b, that is, G b =b -1 G, then:

[0064] For s1 calculation method 1, the signature auxiliary device or system uses the private key SK1 to decrypt the s in the value pair s1. 10 , get 10 The plaintext s 12 , calculate s = ((k2) -1 (s 11 +s 12 ))mod n;

[0065] For the second calculation method of s1, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = ((k2) -1 s 12 )mod n;

[0066] For s1 calculation method 3, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = s12 mod n;

[0067] For s1 calculation method 4, the signature auxiliary device or system uses the private key SK1 to decrypt the s in the value pair s1. 10 、s 11 , and get s respectively 10 The plaintext s 12 ,s 11 The plaintext s 13 , calculate s = ((s 12 ) -1 s 13 ) mod n, where (s 12 ) -1 For 12 The modulo n multiplicative inverse of ;

[0068] (At this time, for methods 1, 2, and 3, s = ((k1k2) -1 b(e+rd U ))mod n, for method 4, s=((k1+k2) -1 b(e+rd U ))mod n)

[0069] If the signature auxiliary device or system has or can obtain b, that is, G b =G, then:

[0070] For s1 calculation method 1, the signature auxiliary device or system uses the private key SK1 to decrypt the s in the value pair s1. 10 , get 10 The plaintext s 12 , calculate s = ((bk2) -1 (s 11 +s 12 ))mod n, where (bk2) -1 is the modulo n multiplicative inverse of bk2 (or (bk2) mod n);

[0071] For the second calculation method of s1, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = ((bk2) -1 s 12 )mod n;

[0072] For s1 calculation method 3, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = b -1 s 12 mod n;

[0073] For s1 calculation method 4, the signature auxiliary device or system uses the private key SK1 to decrypt the s in the value pair s1. 10 、s 11 , and get s respectively 10 The plaintext s 12 ,s 11 The plaintext s 13 , calculate s = ((bs 12 ) -1 s 13 ) mod n, where (bs 12 ) -1 for bs 12 (or (bs 12 )mod n) modulo n multiplicative inverse;

[0074] (At this time, for methods 1, 2, and 3, s = ((k1k2) -1 (e+rd U ))mod n, for method 4, s=((k1+k2) -1 (e+rd U ))mod n)

[0075] The signature assistance device or system returns s to the user terminal; before returning s to the user terminal, the signature assistance device or system verifies whether s is a signature using e, k1, k2, r f and public key Q U The corresponding private key d U Calculate it using the ECDSA calculation method. If yes, continue. Otherwise, proceed to error handling.

[0076] The user terminal verifies whether s is the same as the public key using e, k1, k2, r and public key Q U The corresponding private key d U Calculated according to the ECDSA digital signature calculation method, if the verification is successful, (r, s) is the digital signature of the message M, otherwise, it goes to error processing;

[0077] In the calculation formula of the encryption operation E(·) using the homomorphic encryption algorithm, a(mod n), where a is an integer, represents an integer that is congruent to a modulo n (two integers a and b modulo n are congruent, that is, a mod n=b mod n, expressed as a≡b(modn), and the (mod n) operator has the lowest priority);

[0078] The signature assisting device or system authenticates and confirms that the user using the user terminal, i.e. the signer, is the public key Q before assisting or helping the user terminal to complete the generation of the digital signature (e.g. before decrypting s1 or calculating s). UThe owner of the public key Q, or the system that relies on calling the signature auxiliary device or system (such as the application service system) first authenticates and confirms that the user using the user terminal, that is, the signer, is U The owner of (note that this is not to identify and confirm that the user, that is, the signer, is the public key Q U The corresponding private key d U the owner of the

[0079] The user terminal implements the above-mentioned digital signature calculation and generation steps through the cryptographic program or cryptographic module or cryptographic component that implements the cryptographic function therein, and implements the ECDSA digital signature function.

[0080] For the secure and controllable use of the ECDSA signature private key described above, B Actually it is d U The private key ciphertext (ciphertext private key) after multiplier encryption (a symmetric key encryption scheme), where b is the symmetric key used for encryption.

[0081] For the above-mentioned secure and controllable use method of the ECDSA signature private key, the user terminal and the signature auxiliary device or system obtain R=k1k2G through interactive calculation without exposing their own secrets k1 and k2 and ensuring that the other party does not reselect k1 and k2. b , R f =k1k2G b One way to do this is as follows:

[0082] The user terminal calculates R1 = k1G b , calculate the hash value h1 of R1 (using any suitable hash algorithm), and send h1 to the signature auxiliary device or system;

[0083] The signature auxiliary device or system calculates R2=k2G b , calculate the hash value h2 of R2, and send h2 to the user terminal;

[0084] After receiving h2 from the signature assistance device or system, the user terminal sends R1 to the signature assistance device or system;

[0085] After receiving h1 from the user terminal, the signature auxiliary device or system sends R2 to the user terminal;

[0086] After receiving R2, the user terminal calculates and checks whether the hash value of the received R2 is h2. If not, it turns to error processing. If so, it calculates R=k1R2;

[0087] After receiving R1, the signature auxiliary device or system calculates and checks whether the hash value of the received R1 is h1. If not, it turns to error processing. If so, it calculates R f =k2R1.

[0088] For the above-mentioned secure and controllable use method of the ECDSA signature private key, the user terminal and the signature auxiliary device or system obtain R = (k1 + k2) G through interactive calculation without exposing their own secrets k1 and k2 and ensuring that the other party does not reselect k1 and k2. b , R f =(k1+k2)G b One way to do this is as follows:

[0089] The user terminal calculates R1 = k1G b , calculate the hash value h1 of R1 (using any suitable hash algorithm), and send h1 to the signature auxiliary device or system;

[0090] The signature auxiliary device or system calculates R2=k2G b , calculate the hash value h2 of R2, and send h2 to the user terminal;

[0091] After receiving h2 from the signature assistance device or system, the user terminal sends R1 to the signature assistance device or system;

[0092] After receiving h1 from the user terminal, the signature auxiliary device or system sends R2 to the user terminal;

[0093] After receiving R2, the user terminal calculates and checks whether the hash value of the received R2 is h2. If not, it turns to error processing. If so, it calculates R=R1+R2;

[0094] After receiving R1, the signature auxiliary device or system calculates and checks whether the hash value of the received R1 is h1. If not, it turns to error processing. If so, it calculates R f =R1+R2.

[0095] Among the above four methods of calculating s1, methods 1, 2, and 4, the user terminal has less comprehensive calculation (including calculation of R and s1), and method 3 has the largest amount of calculation. Method 1 introduces a randomly selected integer q on the basis of the congruent number, which makes it possible to directly crack b and d from the homomorphic encryption operation result. U Become more difficult.

[0096] For the above-mentioned secure and controllable use method of the ECDSA signature private key, the user terminal and the signature auxiliary device or system respectively check whether (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0 (i.e., whether there will be a situation where s = 0, where s is the parameter s in the digital signature (r, s) to be calculated) is as follows:

[0097] User terminal check eG+rQ U Is it a zero element (the point at infinity of the elliptic curve point group)? If so, then (e+rd U ) mod n = 0, otherwise not;

[0098] Signature assist device or system check eG+r f Q U Is it a zero element (the point at infinity of the elliptic curve point group)? If so, then (e+r f d U ) mod n = 0, otherwise not.

[0099] For the above-mentioned secure and controllable use method of the ECDSA signature private key, the signature auxiliary device or system verifies whether s is a signature using e, k1, k2, r f and public key Q U The corresponding private key d U The methods calculated according to the ECDSA calculation method include:

[0100] Signature assist device or system check verification (r f ,s) whether it is the digital signature of message M, if so, the verification passes, otherwise, the verification fails;

[0101] Alternatively, a signature aid or system check check sR f Is the value of eG+r f Q U If they are the same, then the verification passes, otherwise, the verification fails.

[0102] For the above-mentioned secure and controllable use method of the ECDSA signature private key, the user terminal verifies whether s is a signature using e, k1, k2, r and the public key Q. U The corresponding private key d U The methods calculated according to the ECDSA calculation method include:

[0103] The user terminal checks whether (r, s) is the digital signature of message M. If so, the verification succeeds; otherwise, the verification fails.

[0104] Alternatively, the user terminal checks to verify whether the value of sR is equal to eG+rQ U If they are the same, the verification passes, otherwise, the verification fails.

[0105] The key pair of the homomorphic encryption algorithm used to encrypt b can be pre-existing (i.e. permanent) in the (signature auxiliary device or system), or it can be temporarily generated when encrypting b. If the key pair is temporarily generated, then the corresponding key pair S B The private key SK1 for decryption operation is usually encrypted into ciphertext data Tsk1 Saved in the user terminal (of course, SK1 can also be encrypted and saved in the user account of the signature auxiliary device or system).

[0106] The encryption algorithm used to encrypt the private key SK1 can be a symmetric key encryption algorithm or a public key encryption algorithm (asymmetric key encryption algorithm); if the encryption algorithm used to encrypt the private key SK1 is a public key encryption algorithm, it can be an ordinary public key encryption algorithm (non-group-oriented encryption algorithm) or a group-oriented encryption algorithm (referred to as group encryption algorithm). The group-oriented encryption algorithm here refers to a type of public key encryption algorithm: a group has a public key, and each member of the group has a private key (the private keys of different members are usually different). The data encrypted with the group public key can be decrypted by each group member using his or her own private key.

[0107] From the perspective of protecting the user's signature private key, the temporarily generated key pair of the homomorphic encryption algorithm is more secure (because the leakage of the private key SK1 for decryption operation may lead to the leakage of the ECDSA signature private key of one user at most). Therefore, the temporarily generated key pair of the homomorphic encryption algorithm should be used preferably. However, the use of the permanent key pair of the homomorphic encryption algorithm can save the ciphertext data T sk1 .

[0108] For the above-mentioned secure and controllable use of ECDSA signature private key, prevent d B and / or S B The security enhancement scheme for the secure and controllable use of a stolen ECDSA signature private key is as follows.

[0109] When a user (using a program in a user terminal or other terminal) accesses the application service system and needs to use the user's ECDSA signature private key to digitally sign a message M, the application service system issues a security token to the user; the security token is an authorization credential for requesting a signature auxiliary device or system to assist, collaboratively generate or / and calculate a digital signature (the security token indicates to the signature auxiliary device or system that this digital signature collaborative generation request is authorized and guaranteed by the application service system; the security token does not have to contain the user's identity information, but from a security perspective, the user's identity information and public key information must contain at least one);

[0110] The application service system (such as through a client program or other means) transmits the security token or the acquisition information of the security token to the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function in the user terminal; the acquisition information of the security token is information used to obtain the security token issued by the application service system (the security token is stored online at this time);

[0111] The user terminal (the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function) transmits the security token or the acquisition information of the security token and T sk2 Submit to a signature assist device or system;

[0112] If the information submitted to the signature auxiliary device or system is the acquisition information of the security token, the signature auxiliary device or system uses the acquisition information to obtain the security token issued by the application service system;

[0113] The signature auxiliary device or system verifies the validity of the security token (for example, the validity of the asymmetric key or symmetric key digital signature of the security token, and the time validity, where the key digital signature is called HMAC). After that, the user terminal (the cryptographic program or cryptographic module or cryptographic component that implements the ECDSA digital signature function) and the signature auxiliary device or system use the secure and controllable use method of the ECDSA signature private key as described above, using d B , S B Generate a digital signature for message M.

[0114] The manner in which the application service system transmits the security token or the acquisition information of the security token to the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function in the user terminal includes:

[0115] If the client program used by the user to access the application service system and the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function are located in the same user terminal, the application service system transmits the security token or security token acquisition information to the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function in the user terminal through the client program;

[0116] Alternatively, if the client program used by the user to access the application service system and the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function are located in different user terminals, the application service system displays a barcode (two-dimensional code, multi-dimensional code) through the client program used by the user, and then transmits the security token or the acquisition information of the security token to the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function in the user terminal by the user scanning the barcode with the user terminal;

[0117] Alternatively, if the user terminal is a mobile communication terminal (such as a mobile phone), the application service system sends a text message through the user's mobile communication terminal, starts the cryptographic program that implements the ECDSA digital signature function in the user's mobile communication terminal through the information contained in the text message (such as URL Schema), and passes the security token or the acquisition information of the security token to the cryptographic program that implements the ECDSA digital signature function in the user's mobile communication terminal automatically through the startup information (such as URL Schema) or through the information input by the user in the text message.

[0118] In the above to prevent d B and / or S B The security enhancement scheme of a secure and controllable use method of the ECDSA signature private key based on the stolen security enhancement scheme is as follows:

[0119] The homomorphic encryption algorithm corresponding to the homomorphic encryption operation E(·) is a fully homomorphic encryption algorithm;

[0120] When the application service system issues a security token to the user (terminal), it randomly selects an integer k0 in [1,n-1] and calculates R0=k0G b , using homomorphic encryption to calculate c0 = E((k0) -1 ) or c0=E(k0), where (k0) -1 is the modular n multiplicative inverse of k0, and then R0 is transmitted together with the security token to the signature auxiliary device or system through the user terminal, R0 is protected by the security token (for example, the hash value of R0 is part of the security token, or R0 is part of the security token), and c0 or the acquisition information of c0 is transmitted to the user terminal;

[0121] The signature assisting device or system determines the validity of R0 through the security token after verifying the validity of the received security token;

[0122] If the user terminal receives the acquisition information of c0, the user terminal obtains c0 using the acquisition information;

[0123] After calculating the hash value e of the message M using the message M, the user terminal randomly selects an integer k1 in the interval [1, n-1], and the signature auxiliary device or system randomly selects an integer k2 in the interval [1, n-1];

[0124] The user terminal and the signature auxiliary device or system complete the following calculation without exposing their respective secrets k1 and k2:

[0125] The user terminal calculates R=k1k2R0 by interacting with the signature auxiliary device or system while ensuring that the signature auxiliary device or system does not reselect k2;

[0126] The signature auxiliary device or system obtains R by interactively calculating with the user terminal while ensuring that the user terminal does not reselect k1. f =k1k2R0;

[0127] or,

[0128] The user terminal calculates R=(k1+k2)R0 by interacting with the signature assisting device or system while ensuring that the signature assisting device or system does not reselect k2;

[0129] The signature auxiliary device or system obtains R by interactively calculating with the user terminal while ensuring that the user terminal does not reselect k1. f =(k1+k2)R0;

[0130] If R and / or R f is zero (infinity point), the user terminal, signature auxiliary device or system reselects k1 and k2 and recalculates R and R f , until R and R f Not zero yuan;

[0131] The user terminal calculates r = x R mod n, where x R Taken from (x R ,y R )=R;

[0132] Signature assisting device or system calculates r f =x Rf mod n, where x Rf Taken from (x Rf ,y Rf )=R f ;

[0133] The user terminal and the signature assisting device or system check r and / or r f Is it 0 (integer 0), if so, the user terminal and the signature auxiliary device or system reselect k1, k2, and recalculate R, R f , recalculate r and r f , until r and r f None of them is 0;

[0134] The user terminal and the signature auxiliary device or system respectively check whether (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0, that is, whether s = 0 will occur, where s is the parameter s in the digital signature (r, s) to be calculated;

[0135] If yes, the user terminal and the signature auxiliary device or system reselect k1 and k2 and recalculate R and R f , recalculate r and r f , until there is no (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0, or, proceed to error handling;

[0136] If it does not appear (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0, then perform subsequent calculations;

[0137] The user terminal calculates s1 in one of the following ways:

[0138] s1 calculation method 5:

[0139] R, R f The calculation formula used is R = k1k2R0, R f =k1k2R0,c0=E((k0) -1 );

[0140] The user terminal uses e, r, S B d B , c0, k1 are calculated by homomorphic encryption algorithm:

[0141] s1=E(((k0k1) -1 (eb+rd B ))(mod n)), where (k0k1) -1 is the modulo n multiplicative inverse of k0k1 (or (k0k1) mod n);

[0142] s1 calculation method six:

[0143] R, R f The calculation formula used is R = k1k2R0, R f =k1k2R0,c0=E((k0) -1 );

[0144] The signature assisting device or system calculates c2=E((k2) -1 ), send c2 to the user terminal;

[0145] The user terminal uses e, r, S B d B , c0, k1, c2 are calculated by homomorphic encryption algorithm:

[0146] s1=E(((k0k1k2)-1 (eb+rd B ))(mod n)), where (k0k1k2) -1 is the modulo n multiplicative inverse of k0k1k2 (or (k0k1k2) mod n);

[0147] s1 calculation method seven:

[0148] R, R f The calculation formula used is R = (k1 + k2) R0, R f =(k1+k2)R0, c0=E(k0);

[0149] The signature auxiliary device or system calculates c2=E(k2) and sends c2 to the user terminal;

[0150] The user terminal randomly selects an integer q in [1,n-1] and uses q, e, r, S B d B , c0, k1, c2 are calculated by homomorphic encryption algorithm:

[0151] s 10 =E((qk0(k1+k2))(mod n)),s 11 =E(q(eb+rd B )(mod n));

[0152] s 10 、s 11 Value pair (s 10 ,s 11 ) constitutes s1;

[0153] After calculating s1, the user terminal sends s1 to the signature auxiliary device or system;

[0154] If the private key SK1 of the decryption operation corresponding to the public key used in the encryption operation E(·) of the homomorphic encryption algorithm is encrypted into the ciphertext T using the key of the signature auxiliary device or system sk1 , the user terminal will also T sk1 is sent to the signature auxiliary device or system, and the signature auxiliary device or system decrypts T sk1 Obtain the private key SK1 of the decryption operation corresponding to the public key used in the encryption operation E(·) of the homomorphic encryption algorithm (i.e., the private key SK1 of the homomorphic encryption algorithm, i.e., the private key SK1 for the decryption operation of the homomorphic encryption algorithm);

[0155] If the signature auxiliary device or system does not have b and cannot obtain b, that is, G b =b -1 G, then:

[0156] For s1 calculation method 5, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = ((k2) -1 s 12 )mod n;

[0157] For s1 calculation method 6, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = s 12 mod n;

[0158] For s1 calculation method 7, the signature auxiliary device or system uses the private key SK1 to decrypt the s in the value pair s1. 10 、s 11 , and get s respectively 10 The plaintext s 12 ,s 11 The plaintext s 13 , calculate s = ((s 12 ) -1 s 13 )mod n;

[0159] (At this time, for s1 calculation method five and six, s=((k0k1k2) -1 b(e+rd U ))mod n, for s1 calculation method seven, s=((k0(k1+k2)) -1 b(e+rd U ))mod n)

[0160] If the signature auxiliary device or system has or can obtain b, that is, G b =G, then:

[0161] For s1 calculation method 5, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = ((bk2) -1 s 12 )mod n;

[0162] For s1 calculation method 6, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = (b -1 s 12 )mod n;

[0163] For s1 calculation method 7, the signature auxiliary device or system uses the private key SK1 to decrypt the s in the value pair s1. 10 、s 11 , and get s respectively 10 The plaintext s 12,s 11 The plaintext s 13 , calculate s = ((bs 12 ) -1 s 13 )mod n;

[0164] Among them, if the signature auxiliary device or system decrypts S B Get b, then the user terminal will S B Sent to the signing auxiliary device or system, which decrypts S (using private key SK1) B get b;

[0165] (At this time, for s1 calculation method five and six, s=((k0k1k2) -1 (e+rd U ))mod n, for s1 calculation method seven, s=((k0(k1+k2)) -1 (e+rd U ))mod n)

[0166] The signature assistance device or system returns s to the user terminal; before returning s to the user terminal, the signature assistance device or system verifies whether s is a signature using e, k0, k1, k2, r f and public key Q U The corresponding private key d U Calculate it according to the ECDSA calculation method. If it is, continue. If the verification fails, go to error processing;

[0167] The user terminal verifies whether s is the same as the public key using e, k0, k1, k2, r and public key Q U The corresponding private key d U Calculated according to the ECDSA digital signature calculation method, if the verification is successful, (r, s) is the digital signature of the message M, otherwise, it goes to error processing;

[0168] Before assisting and helping the user terminal to complete the generation of the digital signature, the signature assistance device or system authenticates and confirms that the user using the user terminal, i.e. the signer, is the public key Q U The owner of the public key Q, or the system that relies on calling the signature auxiliary device or system (such as the application service system) first authenticates and confirms that the user using the user terminal, that is, the signer, is U (Of course, a security token can also include this effect, but it is not required to do so).

[0169] The user terminal and the signature auxiliary device or system obtain R=k1k2R0, R by interactive calculation while ensuring that the other party does not reselect k2 and k1. f =k1k2R0 or R = (k1+k2)R0, R f=(k1+k2)R0, and the user terminal and the signature auxiliary device or system, under the condition of ensuring that the other party does not reselect k2, k1, obtain R=k1k2G through interactive calculation b , R f =k1k2G b Or R = (k1 + k2)G b , R f =(k1+k2)G b The same method can be used, except that R0 replaces G b (R0 is not secret);

[0170] The signature assisting device or system verifies whether s is a signature using e, k0, k1, k2, r f and public key Q U The corresponding private key d U Calculated according to the ECDSA calculation method, the user terminal verifies whether s is using e, k0, k1, k2, r and public key Q U The corresponding private key d U It is calculated using the ECDSA digital signature calculation method and can be verified in the same way as when there is no k0 (because the verification method does not use specific k0, k1, k2).

[0171] Based on the security enhancement scheme described above, a scheme to prevent security tokens from being stolen is as follows:

[0172] When the application service system issues a security token to a user (terminal), it randomly selects an integer w in [1, n-1] as a perturbation parameter, encrypts w into ciphertext data that can only be decrypted by the signature auxiliary device or system (for example, it is encrypted with the public key of the signature auxiliary device or system, or the application service system and the signature auxiliary device or system share a secret, thereby deriving the encryption key from the secret), and then transmits the ciphertext data of w together with the security token to the signature auxiliary device or system through the user terminal, and the plaintext or ciphertext data of w is protected by the security token (for example, the hash value of w or the ciphertext data of w is part of the security token, or the ciphertext data of w is part of the security token);

[0173] After verifying the validity of the received security token, the signature auxiliary device or system decrypts the ciphertext of the perturbation parameter w to obtain the plaintext of w, and at the same time determines the validity of the plaintext or ciphertext of w through the security token;

[0174] After calculating s, the signature auxiliary device or system calculates s w =(s+w)mod n or s w =(sw)mod n, and obtain the digital signature of the disturbance (r,s w );

[0175] (r,s w ) is not submitted or returned to the application service system through the user terminal;

[0176] The application service system calculates s = (s w -w)mod n or s=(w -1 s w ) mod n, where w -1 The modulo n multiplicative inverse of w restores the digital signature (r, s) for the message M.

[0177] The above solution can prevent the security token from being stolen, because only the application service system that signs the security token can obtain the correct digital signature.

[0178] For the ciphertext d of the above schemes B and / or S B Can be encrypted again (double encryption) to become ciphertext T U (Double Encryption)(T U Can also contain d B and S B The encrypted result). If d B and / or S B is encrypted again into ciphertext T U After being saved in the user terminal, when generating a digital signature for message M, the user terminal decrypts the re-encrypted d B and / or S B The ciphertext data T U , and get d B and / or S B (Note that here d B It is also a ciphertext encrypted by the multiplier, S B is the ciphertext after homomorphic encryption). Here, d B and / or S B Encryption again is to solve d B and / or S B Storage security to prevent d B and / or S B It was stolen and then used.

[0179] Use the security token with d B and / or S B Combined with the re-encryption method, there is a further security enhancement solution for the secure and controllable use of ECDSA signature private keys as follows:

[0180] d B and / or S B After being encrypted by (symmetric key or public key), it becomes ciphertext data T U ; Used to decrypt ciphertext data T UThe key SK2 (symmetric key or private key) is encrypted (using a symmetric key or public key) to become the ciphertext data T sk2 , the signature auxiliary device or system is used to decrypt the ciphertext data T sk2 The key SK3 (symmetric key or private key); ciphertext data T U and ciphertext data T sk2 Save in the user terminal;

[0181] When a user (using a program in a user terminal or other terminal) accesses the application service system and needs to use the user's ECDSA signature private key to digitally sign a message M, the application service system issues a security token to the user; the application service system (such as through a client program or other means) transmits the security token or the acquisition information of the security token to the cryptographic program or cryptographic module or cryptographic component that implements the ECDSA digital signature function in the user terminal;

[0182] The user terminal (the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function) transmits the security token or the acquisition information of the security token and T sk2 Submit to a signature assist device or system;

[0183] If the information submitted to the signature auxiliary device or system is the acquisition information of the security token, the signature auxiliary device or system uses the acquisition information to obtain the security token issued by the application service system;

[0184] After the signature auxiliary device or system verifies the validity of the security token (such as verifying the validity of the asymmetric key or symmetric key digital signature of the security token, and the time validity, wherein the key digital signature is called HMAC), the ciphertext data T is decrypted using the key SK3 sk2 , obtain the key SK2, and return the key SK2 to the user terminal;

[0185] The user terminal (the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function) uses the key SK2 to decrypt the ciphertext data T U Get B and / or S B (d B is the ciphertext encrypted by the multiplier, S B is the ciphertext after homomorphic encryption), then the user terminal and the signature auxiliary device or system use the secure and controllable use method of the ECDSA signature private key described above, using d B , S B Perform calculation to generate digital signature.

[0186] How does a signature auxiliary device or system, or a system that calls a signature auxiliary device or system (such as an application service system) confirm that the user is the public key Q UThe owner of is not part of the present invention. The possible implementation methods include: a signature auxiliary device or system, or a system that calls a signature auxiliary device or system, manages and maintains a user account, and the user account stores the user's public key Q U ; or the user's account is bound to the user's digital certificate, and the user's digital certificate contains the user's public key Q U .

[0187] For the above-mentioned secure and controllable use of ECDSA signature private keys, the generation and distribution methods of the user's ECDSA signature key pair include (not all possible methods):

[0188] Method 1:

[0189] The ECDSA signature key pair Q is generated by the trusted program in the user terminal U d U , randomly select an integer b in [1,n-1] and calculate d B =(bd U )mod n,S B =E(b), d U , b is discarded, and then d B , S B (and Q U ) secure storage; the trusted program is a program (that has undergone security testing and evaluation) provided by a cryptographic program or cryptographic module developer, or a cryptographic service provider;

[0190] If you need to calculate G b =b -1 G, then the trusted program uses b to calculate G b =b -1 G, and G b (Secure) storage in the user terminal or submission to a signature assistance device or system;

[0191] Method 2:

[0192] Generate an ECDSA signature key pair Q using a trusted program in another terminal (such as a script in a browser) U d U , randomly select an integer b in [1,n-1] and calculate d B =(bd U )mod n,S B =E(b), d U , b discarded, and then d transferred by barcode (such as QR code, multi-dimensional code) scanning or other transmission methods (such as email, file copying) B , S B (and Q U) is transferred to the user terminal for storage; the other terminal refers to the storage and use of d B , S B a computing device other than a user terminal;

[0193] If you need to calculate G b =b -1 G, then the trusted program uses b to calculate G b =b -1 G, and transmit G via barcode or other transmission methods (such as email, file copy) b Pass it to the user terminal for (safe) storage, or G b Submit to a signature assisting device or system for storage;

[0194] Method 3:

[0195] The key generation device or system generates an ECDSA signature key pair Q U d U , randomly select an integer b in [1,n-1] and calculate d B =(bd U )mod n,S B =E(b), d U , b discarded, and then d B , S B (and Q U ) is transmitted to the user terminal for storage;

[0196] If you need to calculate G b =b -1 G, the key generation device or system uses b to calculate G b =b -1 G, then G b Send to the user terminal (safe) for storage, or G b Submit to a signature assisting device or system for storage;

[0197] Method 4:

[0198] The key generation device or system randomly selects an integer d1 and b1 in [1, n-1], and encrypts b1 using the homomorphic encryption algorithm to obtain S B1 =E(b1), calculate d B1 =(b1d1)mod n,Q U1 = d1G, discard d1 and b1, and replace S B1 d B1 , Q U1 Send to the user terminal;

[0199] The user terminal randomly selects an integer d2 and b2 in [1, n-1], or randomly selects an integer d2 in [1, n-1] and fixes the value of b2 in [1, n-1] (for example, b2 = 1), and uses the homomorphic encryption algorithm, S B1 d B1 And the ciphertext operation is calculated to get S B =E(b1b2),d B =(b2d2d B1 ) mod n, calculate Q U =d2Q U1 ;

[0200] The user terminal verifies S without exposing d1d2 B =E(b1b2),d B =(b1b2d1d2)mod n, d1d2 and an ECDSA signature private key d in [1,n-1] U Modulo n congruence means d1d2=d U (mod n) and Q U =d U G, that is, verify that there is d U =(d1d2)mod n and Q U =d U G, then b1b2 is congruent to an integer b in [1,n-1] modulo n, that is, b1b2 = b (mod n);

[0201] The user terminal discards d2 and b2 and sends S B d B , Q U save;

[0202] If you need to calculate G b =b -1 G, the key generation device or system uses b1 to calculate G b1 =(b1) -1 G, then G b1 Transmitted to the user terminal, the user terminal calculates G b =(b2) -1 G b1 ; or the user terminal uses b2 to calculate G b2 =(b2) -1 G, G b2 Submit to the signature auxiliary device or system, the key generation device or system calculates G b =(b1) -1 G b2 ;

[0203] The user terminal and / or the signature auxiliary device or system will b save;

[0204] For the above-mentioned ECDSA signature private key generation and issuance method, if the homomorphic encryption algorithm public key used to encrypt b is temporarily generated, then d is generated. U The device, system or program of d1 uses a symmetric key or a public key to encrypt the private key SK1 of the homomorphic encryption algorithm for decryption operation to obtain the ciphertext T of SK1. sk1 , where using the public key to encrypt SK1 is applicable to all four ECDSA signature key pair generation and distribution methods, and using the symmetric key to encrypt SK1 is only applicable to ECDSA signature key pair generation and distribution methods three and four.

[0205] For the above-mentioned user's ECDSA signature key pair generation and distribution methods 1, 2, and 3, if (defined in the specific implementation) the signature auxiliary device or system does not have b and cannot obtain b, then select b = (d U ) -1 (d U The modular n multiplicative inverse of B =1.

[0206] For the fourth method of generating and distributing the ECDSA signature key pair of the user described above, the following methods b1 and b2 are allowed:

[0207] b1=(d1) -1 , b2=1, where (d1) -1 is the modulo n multiplicative inverse of d1, in which case b = (d1) -1 , d B =d2;

[0208] b1=(d1) -1 , b2=(d2) -1 , where (d2) -1 is the modulo n multiplicative inverse of d2, in which case b = (d1d2) -1 , d B =1, (defined in the specific implementation) the signature assistance device or system does not have b and cannot obtain b.

[0209] For the fourth method of generating and distributing the user's ECDSA signature key pair described above, if b1 = (d1) -1 , b2=1, that is, b=(d1) -1 , d B =d2, and the signature auxiliary device or system has or can obtain b, then the corresponding implementation is an implementation method of the above-mentioned secure and controllable use method of the ECDSA signature private key based on secret sharing of the signature private key.

[0210] Typically, a program, device, or system that generates an ECDSA private signature key uses the generated private signature key to sign information proving that the user owns the corresponding public key, such as a Certificate Signing Request (CSR), to establish an initial connection between the user and the public key.

[0211] Based on the above secure and controllable use method of ECDSA signature private key, a corresponding secure and controllable use system of ECDSA signature private key can be constructed, the system includes a signature auxiliary device or system, a cryptographic program or a cryptographic module or a cryptographic component in a user terminal; the user terminal stores the user ECDSA signature private key d U The ciphertext d B , stored or available for decryption d B The ciphertext S of the key b B ; When the user's ECDSA signature private key needs to be used to digitally sign a message M, the cryptographic program or cryptographic module or cryptographic component in the user terminal, as well as the signature auxiliary device or system, jointly generate a digital signature for the message M according to the above-mentioned secure and controllable use method of the ECDSA signature private key, wherein the cryptographic program or cryptographic module or cryptographic component in the user terminal implements the operation processing and / or function of the user terminal in the above-mentioned digital signature generation method. Further, the system may also include a key generation device or system and a trusted program for generating an ECDSA signature key pair.

[0212] From the above description, it can be seen that based on the solution of the present invention, the user's signature private key d for generating the ECDSA digital signature U After encryption, the ciphertext d B The form is completely saved and used by the user, and other entities do not have the signature private key d U The secret share, i.e. the user's digital signature (electronic signature) is used to make data d U It is user-specific and is completely controlled by the user (terminal) when generating a digital signature (if the signature auxiliary device or system has b or can obtain b, b does not appear in the digital signature, that is, it is not the signature production data). At the same time, the present invention also has various schemes to further ensure the safe use and storage of the ciphertext private key. Therefore, the preservation and use of the signature production data of the present invention better comply with the Electronic Signature Law of the People's Republic of China, and its storage and use are subject to strict security protection; furthermore, in the implementation of the present invention, if b1=(d1) -1 , b2=1, that is, b=b1=(d1) -1 , and the signature auxiliary device or system has or can obtain b, then the corresponding implementation is an implementation method based on secret sharing of the signature private key, that is, the solution of the present invention can also be used in situations where it is necessary to implement an ECDSA digital signature based on secret sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0213] Figure 1 It is a basic structure and application diagram of the system of the present invention.

[0214] Figure 2 A schematic diagram of a deployment scenario of a signature auxiliary device or system center of the present invention.

[0215] Figure 3 A schematic diagram of a distributed deployment scenario of the signature assistance device or system of the present invention.

[0216] Figure 4 It is a schematic diagram of an independent deployment scenario of the signature auxiliary device or system of the present invention. DETAILED DESCRIPTION

[0217] The following is a description of the specific implementation of the present invention. The following content is only a description of possible implementations of the present invention and is not intended to limit the scope of protection of the present invention.

[0218] The implementation of the present invention adopts a homomorphic encryption algorithm, which can be an additive homomorphic encryption algorithm (such as the Paillier algorithm) and a fully homomorphic encryption algorithm (such as BGV, BFV, CKKS), an exact homomorphic encryption algorithm (such as Paillier, BGV, BFV) or an approximate homomorphic encryption algorithm (such as CKKS). For the approximate homomorphic encryption algorithm, after decrypting the data, its absolute value is rounded to the nearest integer, and the sign bit remains unchanged.

[0219] In the following description, Represents the multiplication of two ciphertext numbers in homomorphic encryption, the result of which corresponds to the ciphertext number of the product of the two corresponding plaintext numbers; Represents the addition of two ciphertext numbers in homomorphic encryption, and the result corresponds to the ciphertext number of the sum of the two corresponding plaintext numbers; ⊙ represents the multiplication of a plaintext number and a ciphertext number in homomorphic encryption, and the result corresponds to the ciphertext number of the product of the two corresponding plaintext numbers.

[0220] In the homomorphic encryption operation of the present invention, E(a(mod n)) often appears, where a is an integer, and a(mod n) represents a number that is congruent to a modulo n. In the present invention, a number that is congruent to a modulo n is used instead of directly using a. This is to avoid the secret being cracked by directly decomposing a when a is the result of an operation of two or more secret numbers (confidential numbers) (such as a product). For example, a=pq, since p and q have relatively few digits (relatively speaking, not very large numbers), it is relatively easy to decompose p and q from a, which will cause p and q to be cracked. However, if a number that is congruent to a modulo n is used, this will make the direct cracking of p and q more difficult or computationally impossible.

[0221] A specific implementation of E(a(mod n)) is as follows (of course not all possible):

[0222] The calculation E(a(mod n)) is changed to the calculation Wherein z is an integer randomly selected during the calculation process (such as a signature device) (not limited to an integer selected within the range of [1, n-1]), or an integer calculated from an integer randomly selected (such as a signature device) (z may be positive, negative, or zero). The selection principle of z is: the plaintext number encrypted during the calculation process, i.e., a+zn, does not exceed the representation range of the encrypted integer by the encryption operation E(·) of the homomorphic encryption algorithm, or the probability of exceeding the representation range of the encrypted integer by the encryption operation E(·) of the homomorphic encryption algorithm is extremely small (the probability of exceeding is within the specified range) (the encryption operation E(·) of the homomorphic encryption algorithm uses complements to represent positive, negative, and zero. If the modulus of E(·) for the encrypted integer is m, then m is divided into two parts, the lower half of which represents positive integers and zero, and the upper half represents negative integers, which is similar to the complement code in binary numbers).

[0223] When generating a digital signature for a message M, the present invention has seven s1 calculation methods, of which the first four are basic calculation methods, and the last three are enhanced s1 calculation methods when an application service system participates in the generation of a digital signature. How these calculation methods are specifically implemented is related to whether the homomorphic encryption algorithm used by E(·) is an additive homomorphic encryption algorithm or a fully homomorphic encryption algorithm. The following is an explanation of how the four s1 calculation methods are specifically implemented.

[0224] For s1 calculation method 1, the user terminal can use q, e, r, S B d B , k1 is calculated by homomorphic encryption as follows to obtain s 10 =E(((k1) -1 eb+q)(mod n)), or s 10 =E(((k1) -1 (eb+q))(mod n)), or s 10 =E(((k1) -1 e(b+q))(mod n)):

[0225] For the first s 10 Calculation formula, calculation s 01 =((k1) -1 e) mod n,

[0226]

[0227] For the second s 10 Calculation formula, calculation s 01=((k1) -1 e)mod n,s 02 =((k1) -1 q)mod n,

[0228]

[0229] For the third s 10 Calculation formula, calculation s 01 =((k1) -1 e)mod n,s 02 =((k1) -1 qe)mod n,

[0230]

[0231] Alternatively, if E(·) is the encryption operation of the fully homomorphic encryption algorithm, then:

[0232] For the first s 10 Calculation formula, calculation s 01 =((k1) -1 e) mod n,

[0233]

[0234] For the second s 10 Calculation formula, calculation s 01 =((k1) -1 e)mod n,s 02 =((k1) -1 q)mod n,

[0235]

[0236] For the third s 10 Calculation formula, calculation s 01 =((k1) -1 e)mod n,s 02 =((k1) -1 qe)mod n,

[0237]

[0238] s 11 Direct calculation; 10 、s 11 Value pair (s 10 ,s 11 ) constitute s1.

[0239] For the second method of calculating s1, the user terminal can use e, r, S B d B, k1 is calculated by homomorphic encryption as follows s1=E(((k1) -1 (eb+rd B ))(mod n)):

[0240] s 10 =((k1) -1 e)mod n,s 11 =((k1) -1 rd B )mod n,

[0241]

[0242] Alternatively, if E(·) is the encryption operation of the fully homomorphic encryption algorithm, then:

[0243]

[0244] For s1 calculation method 3, the user terminal can use e, r, S B d B , k1, c2 are calculated by homomorphic encryption as follows to obtain s1=E(((k1k2) -1 (eb+rd B ))(mod n)), where c2=E((k2) -1 ), the homomorphic encryption algorithm corresponding to E(·) is the fully homomorphic encryption algorithm:

[0245] s 10 =((k1) -1 e)mod n,s 11 =((k1) -1 rd B )mod n,

[0246]

[0247] or,

[0248]

[0249] For s1 calculation method 4, the user terminal randomly selects an integer q in [1,n-1] and uses q, e, r, S B d B , k1, c2, where c2 = E(k2), and s is calculated by homomorphic encryption algorithm 10 =E((q(k1+k2))(mod n)),s 11 =E(q(eb+rd B )(mod n)):

[0250] s 01=(qk1)mod n,s 02 =(qe)mod n,s 03 =(qrd B )mod n;

[0251]

[0252] Or, if the homomorphic encryption algorithm corresponding to E(·) is a fully homomorphic encryption algorithm, then:

[0253]

[0254] s 10 、s 11 Value pair (s 10 ,s 11 ) constitute s1.

[0255] For s1 calculation method 5, the user terminal can use e, r, S B d B , c0, k1 are calculated by homomorphic encryption as follows to obtain s1 = E((k0k1) -1 (eb+rd B )(mod n)), where c0=E((k0) -1 ), the encryption algorithm corresponding to E(·) is a fully homomorphic encryption algorithm:

[0256] s 10 =((k1) -1 e)mod n,s 11 =((k1) -1 rd B )mod n,

[0257]

[0258] or,

[0259]

[0260] or,

[0261]

[0262] For s1 calculation method 6, the user terminal can use e, r, S B d B , c0, k1, c2 are calculated by homomorphic encryption as follows to obtain s1 = E((k0k1k2) -1 (eb+rd B )(mod n)), where c0=E((k0) -1 ), c2=E((k2) -1), the encryption algorithm corresponding to E(·) is a fully homomorphic encryption algorithm:

[0263] s 10 =((k1) -1 e)mod n,s 11 =((k1) -1 rd B )mod n,

[0264]

[0265] or,

[0266]

[0267] For s1 calculation method 7, the user terminal can use q, e, r, S B d B , c0, k1, c2 are calculated by homomorphic encryption as follows to obtain s 10 =E((qk0(k1+k2))(mod n)),s 11 =E(q(eb+rd B )(mod n)), where c0=E(k0), c2=E(k2), and the encryption algorithm corresponding to E(·) is the fully homomorphic encryption algorithm:

[0268] s 01 =(qk1)mod n,s 02 =(qe)mod n,s 03 =(qrd B )mod n;

[0269]

[0270] Or, if the homomorphic encryption algorithm corresponding to E(·) is a fully homomorphic encryption algorithm, then:

[0271]

[0272] s 10 、s 11 Value pair (s 10 ,s 11 ) constitute s1.

[0273] In the specific implementation of the present invention, for b encryption and for the ciphertext S B The decryption method is related to the deployment method of the signature auxiliary device or system, and the generation and distribution method of the user's ECDSA signature key pair.

[0274] The signature assistance device or system may include the following deployment methods:

[0275] (1) Central deployment: centralized deployment by professional cryptographic service organizations, such as centralized deployment in the form of cloud services, providing digital signature services for different customers, users, and applications;

[0276] (2) Distributed deployment: professional cryptographic service organizations provide distributed deployment and digital signature services to customers, users, and applications in different places and regions;

[0277] (3) Independent deployment: Each enterprise, organization or application system deploys its own signature auxiliary device or system to provide digital signature services to its own customers, users and applications.

[0278] Regardless of the deployment method adopted by the signature auxiliary device or system, the four methods for generating and distributing ECDSA signature key pairs described above can be implemented. Of course, other methods for generating and distributing ECDSA signature key pairs can also be implemented. The present invention has no limitation on this as long as the relevant security requirements are met.

[0279] In a specific implementation, if a key generation device or system generates or participates in generating a user's ECDSA signature private key d U (or ECDSA signature key pair), the key generation device or system is usually implemented as a server-side device or system, but it can also be implemented as a user-side device such as a USB Key. The server-side key generation device or system can be implemented as plug-and-play cryptographic hardware (such as a cryptographic card) or a hardware and software combined device or system (such as a cryptographic machine, cryptographic server).

[0280] If, in specific implementation, the ECDSA signature key pair is generated and distributed (including independent generation and collaborative generation) by the key generation device or system on the server side, the key generation device or system can also be centrally deployed, distributedly deployed or independently deployed. Independent deployment is mainly used for specialized key services provided to institutions and enterprises. In this case, the users of the ECDSA signature key pair are usually only the customers and users of the institution or enterprise itself.

[0281] If, during the specific implementation, the ECDSA signature key pair is generated by a trusted program in the user terminal, the cryptographic program or cryptographic module developer, or the cryptographic service provider, can provide the corresponding program and ensure that the program is executed in a secure user terminal environment, such as ensuring that there is no Trojan horse in the user terminal, or that it is executed in a trusted execution environment (TEE).

[0282] If, in a specific implementation, an ECDSA signature key pair is generated by a program in another terminal, the cryptographic program or cryptographic module developer, or the cryptographic service provider, may provide a corresponding program for generating an ECDSA signature key pair, and scan a barcode (such as a QR code or a multi-dimensional code) to obtain the signature private key d U The ciphertext d B , b's ciphertext S B And other parameters, data (such as public key Q U ) to the user terminal, or transmit them to the user terminal through other means such as email or file copying. Alternatively, the user can use a browser in another terminal to visit a dedicated trusted website, and the script returned by the trusted website generates an ECDSA signature key pair in the browser, and then scans the barcode (such as a QR code or multi-dimensional code) to send the signature private key d U The ciphertext d B , b's ciphertext S B and other parameters and data to the user terminal, or transmit them to the user terminal through other means such as email or file copying.

[0283] The following describes the encryption of b and the encryption of the ciphertext S in combination with the implementation of the signature auxiliary device or system and the generation and distribution of the ECDSA signature key pair. B Decryption related implementation methods.

[0284] Regardless of the deployment method or implementation mode adopted by the signature auxiliary device or system, regardless of the implementation method or deployment mode adopted for the generation and distribution of the ECDSA signature key pair, the encryption of b and the ciphertext S B The key pair of the decrypted homomorphic encryption algorithm can be pre-existing in the signature auxiliary device or system, or can be temporarily generated when b is encrypted (by a key pair generation program, device or system).

[0285] If b is encrypted and S B If the key pair of the decrypted homomorphic encryption algorithm is pre-existing in the signature auxiliary device or system, the following are some possible implementation scenarios:

[0286] Encryption of b and S B The key pair of the homomorphic encryption algorithm for decryption is pre-existing in the signature auxiliary device or system, and the signature auxiliary device or system adopts a central deployment implementation method. In this case, b is usually encrypted using a public key in a public key pair of a homomorphic encryption algorithm of the signature auxiliary device or system (a public key pair, i.e., multiple signature auxiliary devices or systems share a key pair), and the ciphertext S of b is decrypted. BThe private key SK1 of the homomorphic encryption algorithm is the private key in the public key pair of this homomorphic encryption algorithm. At this time, the generation and distribution of the ECDSA signature key pair can be implemented and deployed in any way;

[0287] Encryption of b and S B If the key pair of the homomorphic encryption algorithm for decryption is pre-existing in the signature auxiliary device or system, and the signature auxiliary device or system adopts a distributed deployment implementation method, the public key pair b in the public key pair of the homomorphic encryption algorithm of the signature auxiliary device or system can be used to encrypt b (that is, multiple signature auxiliary devices or systems deployed in a distributed manner share a key pair), and the ciphertext S of b can be decrypted. B The private key SK1 of the homomorphic encryption algorithm is the private key in the public key pair of this homomorphic encryption algorithm. At this time, the generation and distribution of the ECDSA signature key pair can be implemented and deployed in any way;

[0288] Encryption of b and S B The key pair of the homomorphic encryption algorithm for decryption is pre-existing in the signature auxiliary device or system, and the signature auxiliary device or system adopts an independently deployed implementation method, then S is usually encrypted using the public key pair b in the key pair of the homomorphic encryption algorithm of the independently deployed signature auxiliary device or system. B At this time, the generation and distribution of ECDSA signature key pairs can be implemented in any way and deployed in any manner. However, the program or system used to generate and distribute ECDSA signature key pairs needs to be configured or customized to use the public key of the corresponding homomorphic encryption algorithm for the independently deployed signature auxiliary device or system.

[0289] Encryption of b and S B If the key pair of the decrypted homomorphic encryption algorithm is pre-existing in the signature auxiliary device or system, special instructions are given for the following implementation scenarios:

[0290] Signature auxiliary devices or systems are independently deployed in different institutions and enterprises. They belong to different institutions and enterprises, but the user's ECDSA signature private key (and the corresponding digital certificate) may need to be used in the application systems of different institutions and enterprises. For example, the ECDSA signature private key corresponds to a digital certificate trusted by all institutions and enterprises. The certificate and private key are used in the application systems of different institutions. That is, signature auxiliary devices or systems independently deployed by different institutions and enterprises may need to decrypt s1 generated by the user terminal of the same user during the generation of digital signatures. In this regard, the following methods can be used (but not the only possible methods):

[0291] User's B , S BIt is only bound to a signature auxiliary device or system of an institution or enterprise. B , S B When generating a digital signature, no matter which organization or enterprise's system the user (terminal) interacts with, the user terminal only interacts with the bound signature auxiliary device or system to generate a digital signature.

[0292] If b is encrypted and S B The key pair of the homomorphic encryption algorithm for decryption is generated temporarily, so the following are some possible implementation scenarios:

[0293] Encryption of b and S B The key pair of the decrypted homomorphic encryption algorithm is temporarily generated, and the encryption of the private key SK1 adopts the public key encryption algorithm, and the signature auxiliary device or system adopts the central deployment implementation method, then the public key of a public key pair of the signature auxiliary device or system is usually used to encrypt SK1 (the public key pair means that multiple signature auxiliary devices or systems share a key pair). At this time, the generation and distribution of the ECDSA signature key pair can be implemented in any way.

[0294] Encryption of b and S B The key pair of the decrypted homomorphic encryption algorithm is temporarily generated, and the encryption of the private key SK1 adopts the public key encryption algorithm, and the signature auxiliary device or system adopts a distributed deployment implementation method, then the public key in a public key pair of the signature auxiliary device or system can be used to encrypt SK1 (that is, multiple distributed signature auxiliary devices or systems share a key pair), or, a group public key can be used to encrypt SK1 using a group-oriented encryption algorithm (that is, multiple distributed signature auxiliary devices or systems belong to a group, and group members can have their own private keys). At this time, the generation and distribution of the ECDSA signature key pair can be implemented and deployed in any way.

[0295] Encryption of b and S B The key pair of the decrypted homomorphic encryption algorithm is temporarily generated, and the encryption of the private key SK1 adopts the public key encryption algorithm, and the signature auxiliary device or system adopts an independently deployed implementation method, then the public key SK1 in a key pair of the independently deployed signature auxiliary device or system is usually used to encrypt SK1. At this time, the generation and distribution of the ECDSA signature key pair can be implemented in any way, but the program and system used to generate and distribute the ECDSA signature key pair need to be configured or customized to use the corresponding public key for the independently deployed signature auxiliary device or system;

[0296] Encryption of b and S BThe key pair of the homomorphic encryption algorithm for decryption is temporarily generated, and the encryption of the private key SK1 adopts a symmetric key encryption algorithm. In this case, the generation and distribution of the ECDSA signature key pair needs to be implemented by the key generation device or system on the server side (including separate or collaborative generation and distribution implementation methods), and the key generation device or system needs to be compatible with the corresponding key generation device or system that needs to decrypt T sk1 The signing auxiliary device or system shares the symmetric key.

[0297] If b is encrypted and S B The key pair of the decrypted homomorphic encryption algorithm is temporarily generated, so special instructions are given for the following implementation scenarios:

[0298] Signature auxiliary devices or systems are independently deployed in different institutions and enterprises. They belong to different institutions and enterprises, but the user's ECDSA signature private key (and the corresponding digital certificate) may need to be used in the application systems of different institutions and enterprises. For example, the ECDSA signature private key corresponds to a digital certificate trusted by all institutions and enterprises. The certificate and private key are used in the application systems of different institutions. That is, signature auxiliary devices or systems independently deployed by different institutions and enterprises may face the problem of decrypting the s1 and T generated by the user terminal of the same user during the generation of the digital signature. sk1 For this problem, the following two methods are possible (but not all possible methods):

[0299] (1) User's d B , S B 、T sk1 It is only bound to a signature auxiliary device or system of an institution or enterprise. B , S B 、T sk1 When generating a digital signature, no matter which institution or enterprise's system the user (terminal) is interacting with, the user terminal only interacts with the bound signature auxiliary device or system to generate the digital signature;

[0300] (2) The public key of the homomorphic encryption algorithm for encrypting b is temporarily generated. The encryption of the temporarily generated private key SK1 of the homomorphic encryption algorithm adopts a group-oriented encryption method. The signature auxiliary devices or systems independently deployed by different institutions and enterprises are all members of the group and have a group member private key.

[0301] If a group-oriented encryption method is implemented, the lifecycle management (generation, update, revocation) of the group key (public key, private key) is provided by the key service system of a dedicated cryptographic service agency.

[0302] Description of an implementation scenario in which a user terminal, a signature assistance device, or a system has E(b) or b.

[0303] Scenario 1: The user terminal stores E(b), but the signature auxiliary device or system does not have E(b) and b. When signing, the user terminal does not send E(b) to the signature auxiliary device or system.

[0304] Scenario 2: The user terminal stores E(b), but the signature auxiliary device or system does not have E(b) and b. When signing, the user terminal sends E(b) to the signature auxiliary device or system.

[0305] Scenario 3: the user terminal does not store E(b), but the signature auxiliary device or system stores b and / or E(b). When signing, the signature auxiliary device or system sends E(b) to the user terminal;

[0306] Scenario 4: the user terminal stores E(b), the signature auxiliary device or system stores b and / or E(b), and the signature auxiliary device or system does not send E(b) to the user terminal when signing;

[0307] Scenario five: the user terminal stores E(b), the signature assistance device or system stores b and / or E(b), and when signing, the signature assistance device or system sends E(b) to the user terminal (although this is not necessary, it is a possible implementation method).

[0308] As long as the signature assistance device or system has or can obtain b, press G b =G generates a digital signature (the generated signature data will not contain b).

[0309] In the specific implementation of the present invention, although d B and / or S B is d U The encrypted form of d and b is stored in the user terminal, but in order to prevent it from being stolen, the encrypted form of d stored in the user terminal is B and / or S B Further security measures can still be taken, such as fingerprint protection, PIN code protection, and even re-encryption.

[0310] In the implementation of the present invention, in order to prevent d B and / or S B Before the signature auxiliary device or system assists in completing the digital signature generation for the user terminal, it must pass strict and secure identity authentication, such as through SMS, identity authentication based on biometrics, or by calling the signature auxiliary device or system system such as the application service system to complete the user's identity authentication to ensure that the user is the public key Q U The owner of.

[0311] Generation and distribution method of ECDSA signature key pair 4: The user terminal verifies S without exposing d1d2B =E(b1b2),d B =(b1b2d1d2)mod n, d1d2 and an ECDSA signature private key d in [1,n-1] U Modulo n congruence means d1d2=d U (mod n), and Q U =d U G, that is, verify that there is d U =(d1d2)mod n and Q U =d U G, there are many ways, the following is one way you can use.

[0312] The user terminal randomly selects an integer t, w in [1, n-1] and uses d B , S B And homomorphic encryption operation to get S w =E((wb1b2(d B ) -1 +t)(mod n)), where (d B ) -1 is d B The modular n multiplicative inverse of S w , Q U Send to a key generation device or system;

[0313] The key generation device or system calculates Q w =(D(S w )mod n)Q U , where D(·) is the decryption operation of the private key using the homomorphic encryption algorithm (assuming that the key generation device or system is capable of completing this operation, for example, sharing a cryptographic device with the signature auxiliary device or system, or using the signature auxiliary device or system); the key generation device or system converts Q w Sending user terminal;

[0314] User terminal checks w -1 (Q w -tQ U ) is the same as G, where w -1 is the multiplicative inverse of w modulo n. If they are the same, the verification passes, otherwise the verification fails;

[0315] Alternatively, the user terminal randomly selects an integer t, w in [1, n-1] and uses b1, S B And homomorphic encryption operation to get S w =E((wb1b2+t)(mod n)), S w , Q U Send to a key generation device or system;

[0316] The key generation device or system calculates Q w =(D(S w )mod n)Q U , where D(·) is the decryption operation of the private key using the homomorphic encryption algorithm (assuming that the key generation device or system is capable of completing this operation, for example, sharing a cryptographic device with the signature auxiliary device or system, or using the signature auxiliary device or system); the key generation device or system converts Q w Sending user terminal;

[0317] User terminal checks w -1 (Q w -tQ U ) and d B G is the same, where w -1 is the multiplicative inverse of w modulo n. If they are the same, the verification passes, otherwise the verification fails.

[0318] The security token issued by the application service system is a temporary authorization credential. It can use either a standard security token (such as WS-Security security token, SAML assertion, security ticket, Json Web Token (JWT), etc.) or a security token in a custom format. The security token is signed with an asymmetric key (such as SM2, SM9, RSA, ECDSA) or a symmetric key signature (such as HMAC).

[0319] In the implementation of the present invention, if d B and / or S B Encrypted again into ciphertext T U After that, T U If the signature is stored in the user terminal, the encryption is (usually) not performed in the signature auxiliary device or system, but (usually) in the user terminal. Otherwise, the signature auxiliary device or system can obtain the secret of the user terminal. B and / or S B This obviously does not meet the security requirements and security goals of the solution. The question now is what is the T U Who generates the decryption key SK2 and who encrypts SK2? Note that SK2 is not a secret between the user terminal and the signature auxiliary device or system. Therefore, SK2 and its corresponding key for encrypting d B and / or S B The encryption key (if SK2 is a private key, the corresponding encryption key is the corresponding public key; if SK2 is a symmetric key, the corresponding encryption key is also a symmetric key) can be generated by the user terminal (when the user signature key is initialized) or generated by the signature auxiliary device or system (when the user signature key is initialized) and then transmitted to the user terminal; if the ciphertext T of decrypting SK2 issk2 If the key SK3 is a private key, the corresponding public key is used to encrypt SK2, which can be completed in the user terminal or in the signature auxiliary device or system; if the ciphertext T of SK2 is decrypted sk2 The key SK3 is a symmetric key, then the encryption of SK2 using SK3 can be completed by the signature auxiliary device or system, and then the encryption result T sk2 Return to the user terminal, because SK2 is not a secret for the signature auxiliary device or system. The remaining question is, for different deployment methods of the signature auxiliary device or system, which signature auxiliary device or system's SK3 corresponding encryption key should be used to encrypt SK2? A simple principle is: when performing digital signatures, the user terminal interacts with which signature auxiliary device or system, and the encryption key corresponding to SK3 of that signature auxiliary device or system is used to encrypt SK2, where the encryption key corresponding to SK3 includes a symmetric key or a public key. If the public key includes a common public key and a group public key, it is the same as the encryption key corresponding to SK3 of the S B When the key pair of the encrypted homomorphic encryption algorithm is temporarily generated, the encryption of the temporarily generated private key SK1 of the homomorphic encryption algorithm is similar.

[0320] The present invention involves many keys, which should not be confused in specific implementation: SK1 is used to decrypt the ciphertext S after b is homomorphically encrypted B The private key of d B SK2 is used to decrypt d B and / or S B The encrypted ciphertext T U The key is not used to decrypt the ciphertext T of SK1 sk1 The key to decrypt T sk1 The key (not specifically named) belongs to the signature auxiliary device or system, SK2 does not belong to the key of the signature auxiliary device or system; SK3 is used to decrypt the ciphertext T of SK2 sk2 SK1 is the key of the signature auxiliary device or system, and SK3 is the key of the signature auxiliary device or system; there is no direct or indirect connection between SK1 and SK2 and SK3.

[0321] Based on the secure and controllable use method of the ECDSA signature private key of the present invention, a corresponding secure and controllable use system of the ECDSA signature private key can be implemented, the system includes a signature auxiliary device or system, a cryptographic program or a cryptographic module or a cryptographic component in a user terminal; the user terminal stores the user's ECDSA signature private key d U The ciphertext d B , stored or available for decryption d B The ciphertext S of the key b B; When the user's ECDSA signature private key needs to be used to digitally sign a message M, the cryptographic program or cryptographic module or cryptographic component in the user terminal, as well as the signature auxiliary device or system, jointly generate a digital signature for the message M according to the aforementioned secure and controllable use method of the ECDSA signature private key, wherein the cryptographic program or cryptographic module or cryptographic component in the user terminal implements the operation processing and / or function performed by the user terminal in the aforementioned secure and controllable use method of the ECDSA signature private key. Further, the implemented system may also include a key generation device or system and a trusted program for generating an ECDSA signature key pair.

[0322] In the implementation of the present invention, the signature assistance device or system can be a software device or system, or a device or system that combines software and hardware. The software device can be an independently running program or cryptographic module, and the device that combines software and hardware can be plug-and-play cryptographic hardware such as a cryptographic card, or a cryptographic machine / cryptographic server.

[0323] In the implementation of the present invention, the user terminal is various computing devices used by the user, such as computers, mobile phones, tablet computers, etc. The user terminal implements the digital signature generation function in the user terminal of the present invention by running a cryptographic program or cryptographic module or cryptographic component therein, that is, the program that implements cryptographic functions such as digital signatures in the user terminal can be an independently running cryptographic program, such as a program formed by an app or WeChat applet, or it can be a cryptographic module or cryptographic component that implements cryptographic functions such as digital signatures, such as a cryptographic API, SDK, WeChat applet plug-in, browser plug-in or control, etc. If the program that implements cryptographic functions such as digital signatures is an independently running cryptographic program, the program in the same user terminal can transfer data to the cryptographic program by using the mechanism for transferring data between programs in the same computing device provided by the user terminal and program development technology; if the program that implements cryptographic functions such as digital signatures is a cryptographic module or cryptographic component, the program that calls the cryptographic module or cryptographic component directly transfers data to the called cryptographic module or cryptographic component; if another terminal other than the user terminal that implements the digital signature function needs to use the digital signature function in the user terminal, the program in the other terminal, such as the client program of the application service system, can transfer the call information and data to the cryptographic program or cryptographic module or cryptographic component that implements the digital signature function in the user terminal by displaying a barcode or by the user scanning the barcode; if the user terminal is a mobile communication terminal (such as a mobile phone), the application service system can send a text message through the user's mobile communication terminal, and start the cryptographic program that implements the ECDSA digital signature function in the user's mobile communication terminal through the information contained in the text message, such as the URL Schema, and automatically transfer the security token or the acquisition information of the security token to the cryptographic program that implements the ECDSA digital signature function in the user's mobile communication terminal through a URL link or through the information entered by the user in the text message.

[0324] Figure 1 The basic structure and application diagram of the system of the present invention is shown in FIG. Figure 2 It is a schematic diagram of the deployment scenario of the signature auxiliary device or system center of the present invention, Figure 3 It is a schematic diagram of a distributed deployment scenario of the signature auxiliary device or system of the present invention, Figure 4 It is a schematic diagram of an independent deployment scenario of the signature auxiliary device or system of the present invention.

[0325] Other specific technical implementations not described are well known and self-evident to technicians in the relevant fields.

Claims

1. A method for securely and controllably using an ECDSA signature private key, characterized by: User terminal has Q U =d U G, there is a secret B =(bd U )mod n, there is or can be obtained S B =E(b), where d U is the user's ECDSA signature private key, G is the base point of the ECDSA elliptic curve point group, Q U The user's ECDSA signature private key d U The corresponding public key, b is an integer secret in [1, n-1], n is the order of the base point G, n is a prime number, and E(·) is the encryption operation using the homomorphic encryption algorithm; The homomorphic encryption algorithm is an additive homomorphic encryption algorithm or a fully homomorphic encryption algorithm; the signature auxiliary device or system has a private key SK1 for decryption operation corresponding to the public key used in the encryption operation E(·) of the homomorphic encryption algorithm, or the private key SK1 for decryption operation corresponding to the public key used in the encryption operation E(·) of the homomorphic encryption algorithm is encrypted into a ciphertext T by using the key of the signature auxiliary device or system. sk1 , wherein the key of the signature auxiliary device or system used to encrypt the private key SK1 includes a symmetric key or a public key, and the user terminal also stores the ciphertext T of the private key SK1 for decryption operation corresponding to the public key used in the encryption operation E(·) sk1 ; The user terminal does not have and cannot obtain b; the signature auxiliary device or system does not have b and cannot obtain b, or the signature auxiliary device or system has or can obtain b; The user terminal can obtain S B = E(b) includes the case where the signature auxiliary device or system converts S B Submit to the user terminal; The situation where the signature auxiliary device or system can obtain b includes when the user terminal sends S B Submit to the signature auxiliary device or system, which decrypts S B get b; Devices or systems other than user terminals and signature assistance devices or systems do not have b; If the signature assisting device or system does not have b and cannot obtain b, then S B It is stored securely on the user's terminal as a secret and is protected; If the signature auxiliary device or system does not have b and cannot obtain b, then take G b =b -1 G, b -1 is the modulo n multiplicative inverse of b, and at least one of the user terminal and the signature auxiliary device or system has G b , G b is a non-secret between the two; if the signature auxiliary device or system has or can obtain b, then take G b =G; The user terminal is a computing device of the user; the signature auxiliary device or system is a computing device or system that assists and helps the user terminal to complete the generation and calculation of the digital signature; When you need to use the user's ECDSA signature private key d U When digitally signing a message M, the user terminal and the signature auxiliary device or system generate a digital signature for the message M in the following manner: The user terminal uses the message M and the hash function to calculate the hash value e of the message M used for digital signature calculation, and sends e to the signature auxiliary device or system. Alternatively, the signature auxiliary device or system uses the message M and the hash function to calculate the hash value e of the message M used for digital signature calculation, and sends e to the user terminal. The user terminal randomly selects an integer k1 in the interval [1, n-1], where n is the order of the base point G; The signature auxiliary device or system randomly selects an integer k2 in the interval [1, n-1]; The user terminal and the signature auxiliary device or system complete the following calculation without exposing their respective secrets k1 and k2: The user terminal obtains R=k1k2G by interactively calculating with the signature auxiliary device or system while ensuring that the signature auxiliary device or system does not reselect k2. b ; The signature auxiliary device or system obtains R by interactively calculating with the user terminal while ensuring that the user terminal does not reselect k1. f =k1k2G b ; or, The user terminal calculates R=(k1+k2)G by interacting with the signature auxiliary device or system while ensuring that the signature auxiliary device or system does not reselect k2. b ; The signature auxiliary device or system obtains R by interactively calculating with the user terminal while ensuring that the user terminal does not reselect k1. f =(k1+k2)G b ; If R and / or R f is zero, the user terminal, signature auxiliary device or system reselects k1 and k2 and recalculates R and R f , until R and R f Not zero yuan; The user terminal calculates r = x R mod n, where x R Taken from (x R ,y R )=R; Signature assisting device or system calculates r f =x Rf mod n, where x Rf Taken from (x Rf ,y Rf )=R f ; The user terminal and the signature assisting device or system check r and / or r f Is it 0? If so, the user terminal and the signature auxiliary device or system reselect k1 and k2 and recalculate R and R f , recalculate r and r f , until r and r f None of them is 0; The user terminal and the signature auxiliary device or system respectively check whether (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0, that is, whether s = 0 will occur, where s is the parameter s in the digital signature (r, s) to be calculated; If yes, the user terminal and the signature auxiliary device or system reselect k1 and k2 and recalculate R and R f , recalculate r and r f , until there is no (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0, or, proceed to error handling; If it does not appear (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0, then perform subsequent calculations; The user terminal calculates s1 in one of the following ways: s1 calculation method 1: R, R f The calculation formula used is R = k1k2G b , R f =k1k2G b ; The user terminal randomly selects an integer q in [1,n-1] and uses q, e, r, S B d B , k1 is calculated by homomorphic encryption algorithm: s 10 =E(((k1) -1 eb+q)(mod n)),s 11 =((k1) -1 rd B -q)mod n, Or, 10 =E(((k1) -1 (eb+q))(mod n)), s 11 =((k1) -1 (rd B -q))mod n, Or, 10 =E(((k1) -1 e(b+q))(mod n)),s 11 =((k1) -1 (rd B -eq))mod n, where (k1) -1 is the modulo n multiplicative inverse of k1; s 10 、s 11 Value pair (s 10 ,s 11 ) constitutes s1; s1 calculation method 2: R, R f The calculation formula used is R = k1k2G b , R f =k1k2G b ; The user terminal uses e, r, S B d B , k1 is calculated by homomorphic encryption algorithm: s1=E(((k1) -1 (eb+rd B ))(mod n)); s1 calculation method three: R, R f The calculation formula used is R = k1k2G b , R f =k1k2G b ; The homomorphic encryption algorithm corresponding to E(·) is the fully homomorphic encryption algorithm; The signature assisting device or system calculates c2=E((k2) -1 ), where (k2) -1 is the modulo n multiplicative inverse of k2, and c2 is sent to the user terminal; The user terminal uses e, r, S B d B , k1, c2 are calculated by homomorphic encryption algorithm: s1=E(((k1k2) -1 (eb+rd B ))(mod n)), where (k1k2) -1 is the modulo n multiplicative inverse of k1k2; s1 calculation method 4: R, R f The calculation formula used is R = (k1 + k2) G b , R f =(k1+k2)G b ; The signature auxiliary device or system calculates c2=E(k2) and sends c2 to the user terminal; The user terminal randomly selects an integer q in [1,n-1] and uses q, e, r, S B d B , k1, c2 are calculated by homomorphic encryption algorithm: s 10 =E((q(k1+k2))(mod n)),s 11 =E(q(eb+rd B )(mod n)); s 10 、s 11 Value pair (s 10 ,s 11 ) constitutes s1; After calculating s1, the user terminal sends s1 to the signature auxiliary device or system; If the private key SK1 of the decryption operation corresponding to the public key used in the encryption operation E(·) of the homomorphic encryption algorithm is encrypted into the ciphertext T using the key of the signature auxiliary device or system sk1 is saved in the user terminal, the user terminal will also T sk1 is sent to the signature auxiliary device or system, and the signature auxiliary device or system decrypts T sk1 Obtain the private key SK1 of the decryption operation corresponding to the public key used in the encryption operation E(·) of the homomorphic encryption algorithm; If the signature auxiliary device or system does not have b and cannot obtain b, that is, G b =b -1 G, then: For s1 calculation method 1, the signature auxiliary device or system uses the private key SK1 to decrypt the s in the value pair s1. 10 , get 10 The plaintext s 12 , calculate s = ((k2) -1 (s 11 +s 12 ))mod n; For the second calculation method of s1, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = ((k2) -1 s 12 )mod n; For s1 calculation method 3, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = s 12 mod n; For s1 calculation method 4, the signature auxiliary device or system uses the private key SK1 to decrypt the s in the value pair s1. 10 、s 11 , and get s respectively 10 The plaintext s 12 ,s 11 The plaintext s 13 , calculate s = ((s 12 ) -1 s 13 ) mod n, where (s 12 ) -1 For 12 The modulo n multiplicative inverse of ; If the signature auxiliary device or system has or can obtain b, that is, G b =G, then: For s1 calculation method 1, the signature auxiliary device or system uses the private key SK1 to decrypt the s in the value pair s1. 10 , get 10 The plaintext s 12 , calculate s = ((bk2) -1 (s 11 +s 12 ))mod n, where (bk2) -1 is the modulo n multiplicative inverse of bk2; For the second calculation method of s1, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = ((bk2) -1 s 12 )mod n; For s1 calculation method 3, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = b -1 s 12 mod n; For s1 calculation method 4, the signature auxiliary device or system uses the private key SK1 to decrypt the s in the value pair s1. 10 、s 11 , and get s respectively 10 The plaintext s 12 ,s 11 The plaintext s 13 , calculate s = ((bs 12 ) -1 s 13 ) mod n, where (bs 12 ) -1 for bs 12 The modulo n multiplicative inverse of ; The signature assistance device or system returns s to the user terminal; before returning s to the user terminal, the signature assistance device or system verifies whether s is a signature using e, k1, k2, r f and public key Q U The corresponding private key d U Calculate it according to the ECDSA calculation method. If yes, continue. Otherwise, go to error handling. The user terminal verifies whether s is the same as the public key using e, k1, k2, r and public key Q U The corresponding private key d U Calculated according to the ECDSA digital signature calculation method, if the verification is successful, (r, s) is the digital signature of the message M, otherwise, it goes to error processing; In the calculation formula of the encryption operation E(·) using the homomorphic encryption algorithm, a(mod n), where a is an integer, represents an integer that is congruent to a modulo n; The signature assisting device or system authenticates and confirms that the user using the user terminal, i.e. the signer, is the public key Q before assisting and helping the user terminal to complete the generation of the digital signature. U The owner of the public key Q U The owner of The user terminal implements the above-mentioned digital signature calculation and generation steps through the cryptographic program or cryptographic module or cryptographic component that implements the cryptographic function therein, and implements the ECDSA digital signature function.

2. The method for securely and controllably using an ECDSA signature private key according to claim 1, wherein: The user terminal and the signature auxiliary device or system respectively check whether (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0 is as follows: User terminal check eG+rQ U Is it zero? If so, (e+rd U ) mod n = 0, otherwise not; Signature assist device or system check eG+r f Q U Is it zero? If so, (e+r f d U ) mod n = 0, otherwise not.

3. The method for securely and controllably using an ECDSA signature private key according to claim 1, wherein: The signature assisting device or system verifies whether s is a signature using e, k1, k2, r f and public key Q U The corresponding private key d U The methods calculated according to the ECDSA calculation method include: Signature assist device or system check verification (r f ,s) whether it is the digital signature of message M, if so, the verification passes, otherwise, the verification fails; Alternatively, the signature assist device or system check verifies sR f Is the value of eG+r f Q U If they are the same, the verification is successful, otherwise, the verification fails; The user terminal verifies whether s is the same as the public key using e, k1, k2, r and public key Q U The corresponding private key d U The methods calculated according to the ECDSA calculation method include: The user terminal checks whether (r, s) is the digital signature of message M. If so, the verification succeeds; otherwise, the verification fails. Alternatively, the user terminal checks to verify whether the value of sR is equal to eG+rQ U If they are the same, the verification passes, otherwise, the verification fails.

4. The method for securely and controllably using an ECDSA signature private key according to claim 1, wherein: A way to prevent B and / or S B The safe and controllable use of the stolen ECDSA signature private key is as follows: When a user accesses the application service system and needs to use the user's ECDSA signature private key to digitally sign a message M, the application service system issues a security token to the user; the security token is an authorization certificate for requesting a signature auxiliary device or system to assist, collaboratively generate or / and calculate a digital signature; The application service system transmits the security token or the acquisition information of the security token to the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function in the user terminal; the acquisition information of the security token is information used to obtain the security token issued by the application service system; The user terminal sends the security token or the security token acquisition information and T sk2 Submit to a signature assist device or system; If the information submitted to the signature auxiliary device or system is the acquisition information of the security token, the signature auxiliary device or system uses the acquisition information to obtain the security token issued by the application service system; The signature auxiliary device or system verifies the validity of the security token. After that, the user terminal and the signature auxiliary device or system use the secure and controllable use method of the ECDSA signature private key as described above to use the d B , S B Generate a digital signature for message M.

5. The method for securely and controllably using an ECDSA signature private key according to claim 4, wherein: The manner in which the application service system transmits the security token or the acquisition information of the security token to the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function in the user terminal includes: If the client program used by the user to access the application service system and the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function are located in the same user terminal, the application service system transmits the security token or security token acquisition information to the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function in the user terminal through the client program; Alternatively, if the client program used by the user to access the application service system and the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function are located in different user terminals, the application service system displays the barcode through the client program used by the user, and then transmits the security token or the acquisition information of the security token to the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function in the user terminal by the user scanning the barcode with the user terminal; Alternatively, if the user terminal is a mobile communication terminal, the application service system sends a text message through the user's mobile communication terminal, starts the cryptographic program that implements the ECDSA digital signature function in the user's mobile communication terminal through the information contained in the text message, and passes the security token or the acquisition information of the security token to the cryptographic program that implements the ECDSA digital signature function in the user's mobile communication terminal automatically through the startup information or through the user inputting information in the text message.

6. The method for securely and controllably using an ECDSA signature private key according to claim 5, wherein: In the above mentioned prevention B and / or S B A security enhancement scheme based on the secure and controllable use of the stolen ECDSA signature private key is as follows: The homomorphic encryption algorithm corresponding to the homomorphic encryption operation E(·) is a fully homomorphic encryption algorithm; When the application service system issues a security token to the user, it randomly selects an integer k0 in [1,n-1] and calculates R0=k0G b , using homomorphic encryption to calculate c0 = E((k0) -1 ) or c0=E(k0), where (k0) -1 is the modular n multiplicative inverse of k0, and then R0 is transmitted together with the security token to the signature auxiliary device or system through the user terminal, R0 is protected by the security token, and c0 or the acquisition information of c0 is transmitted to the user terminal; The signature assisting device or system determines the validity of R0 through the security token after verifying the validity of the received security token; If the user terminal receives the acquisition information of c0, the user terminal obtains c0 using the acquisition information; After calculating the hash value e of the message M using the message M, the user terminal randomly selects an integer k1 in the interval [1, n-1], and the signature auxiliary device or system randomly selects an integer k2 in the interval [1, n-1]; The user terminal and the signature auxiliary device or system complete the following calculation without exposing their respective secrets k1 and k2: The user terminal calculates R=k1k2R0 by interacting with the signature auxiliary device or system while ensuring that the signature auxiliary device or system does not reselect k2; The signature auxiliary device or system obtains R by interactively calculating with the user terminal while ensuring that the user terminal does not reselect k1. f =k1k2R0; or, The user terminal calculates R=(k1+k2)R0 by interacting with the signature assisting device or system while ensuring that the signature assisting device or system does not reselect k2; The signature auxiliary device or system obtains R by interactively calculating with the user terminal while ensuring that the user terminal does not reselect k1. f =(k1+k2)R0; If R and / or R f is zero, the user terminal, signature auxiliary device or system reselects k1 and k2 and recalculates R and R f , until R and R f Not zero yuan; The user terminal calculates r = x R mod n, where x R Taken from (x R ,y R )=R; Signature assisting device or system calculates r f =x Rf mod n, where x Rf Taken from (x Rf ,y Rf )=R f ; The user terminal and the signature assisting device or system check r and / or r f Is it 0? If so, the user terminal and the signature auxiliary device or system reselect k1 and k2 and recalculate R and R f , recalculate r and r f , until r and r f None of them is 0; The user terminal and the signature auxiliary device or system respectively check whether (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0, that is, whether s = 0 will occur, where s is the parameter s in the digital signature (r, s) to be calculated; If yes, the user terminal and the signature auxiliary device or system reselect k1 and k2 and recalculate R and R f , recalculate r, r f , until there is no (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0, or, proceed to error handling; If it does not appear (e+rd U ) mod n = 0 and / or (e + r f d U ) mod n = 0, then perform subsequent calculations; The user terminal calculates s1 in one of the following ways: s1 calculation method 5: R, R f The calculation formula used is R = k1k2R0, R f =k1k2R0,c0=E((k0) -1 ); The user terminal uses e, r, S B d B , c0, k1 are calculated by homomorphic encryption algorithm: s1=E(((k0k1) -1 (eb+rd B ))(mod n)), where (k0k1) -1 is the modulo n multiplicative inverse of k0k1; s1 calculation method six: R, R f The calculation formula used is R = k1k2R0, R f =k1k2R0,c0=E((k0) -1 ); The signature assisting device or system calculates c2=E((k2) -1 ), send c2 to the user terminal; The user terminal uses e, r, S B d B , c0, k1, c2 are calculated by homomorphic encryption algorithm: s1=E(((k0k1k2) -1 (eb+rd B ))(mod n)), where (k0k1k2) -1 is the modulo n multiplicative inverse of k0k1k2; s1 calculation method seven: R, R f The calculation formula used is R = (k1 + k2) R0, R f =(k1+k2)R0, c0=E(k0); The signature auxiliary device or system calculates c2=E(k2) and sends c2 to the user terminal; The user terminal randomly selects an integer q in [1,n-1] and uses q, e, r, S B d B , c0, k1, c2 are calculated by homomorphic encryption algorithm: s 10 =E((qk0(k1+k2))(mod n)),s 11 =E(q(eb+rd B )(mod n)); s 10 、s 11 Value pair (s 10 ,s 11 ) constitutes s1; After calculating s1, the user terminal sends s1 to the signature auxiliary device or system; If the private key SK1 of the decryption operation corresponding to the public key used in the encryption operation E(·) of the homomorphic encryption algorithm is encrypted into the ciphertext T using the key of the signature auxiliary device or system sk1 , the user terminal will also T sk1 is sent to the signature auxiliary device or system, and the signature auxiliary device or system decrypts T sk1 Obtain the private key SK1 of the decryption operation corresponding to the public key used in the encryption operation E(·) of the homomorphic encryption algorithm; If the signature auxiliary device or system does not have b and cannot obtain b, that is, G b =b -1 G, then: For s1 calculation method 5, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = ((k2) -1 s 12 )mod n; For s1 calculation method 6, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = s 12 mod n; For s1 calculation method 7, the signature auxiliary device or system uses the private key SK1 to decrypt the s in the value pair s1. 10 、s 11 , and get s respectively 10 The plaintext s 12 ,s 11 The plaintext s 13 , calculate s = ((s 12 ) -1 s 13 )mod n; If the signature auxiliary device or system has or can obtain b, that is, G b =G, then: For s1 calculation method 5, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = ((bk2) -1 s 12 )mod n; For s1 calculation method 6, the signature auxiliary device or system uses the private key SK1 to decrypt s1 and obtain the plaintext s1 12 , calculate s = (b -1 s 12 )mod n; For s1 calculation method 7, the signature auxiliary device or system uses the private key SK1 to decrypt the s in the value pair s1. 10 、s 11 , and get s respectively 10 The plaintext s 12 ,s 11 The plaintext s 13 , calculate s = ((bs 12 ) -1 s 13 )mod n; Among them, if the signature auxiliary device or system decrypts S B Get b, then the user terminal will S B Sent to the signature auxiliary device or system, which decrypts S B get b; The signature assistance device or system returns s to the user terminal; before returning s to the user terminal, the signature assistance device or system verifies whether s is a signature using e, k0, k1, k2, r f and public key Q U The corresponding private key d U Calculate it according to the ECDSA calculation method. If it is, continue. If the verification fails, go to error processing; The user terminal verifies whether s is the same as the public key using e, k0, k1, k2, r and public key Q U The corresponding private key d U Calculated according to the ECDSA digital signature calculation method, if the verification is successful, (r, s) is the digital signature of the message M, otherwise, it goes to error processing; Before assisting and helping the user terminal to complete the generation of the digital signature, the signature assistance device or system authenticates and confirms that the user using the user terminal, i.e. the signer, is the public key Q U The owner of the public key Q U The owner of.

7. The method for securely and controllably using an ECDSA signature private key according to claim 5, wherein: In the above mentioned prevention B and / or S B A solution to prevent security token theft based on the secure and controllable use of stolen ECDSA signature private keys is as follows: When the application service system issues a security token to a user, it randomly selects an integer w in [1, n-1] as a perturbation parameter, encrypts w into ciphertext data that can only be decrypted by the signature auxiliary device or system, and then transmits the ciphertext data of w together with the security token to the signature auxiliary device or system through the user terminal. The plaintext or ciphertext data of w is protected by the security token. After verifying the validity of the received security token, the signature auxiliary device or system decrypts the ciphertext of the perturbation parameter w to obtain the plaintext of w, and at the same time determines the validity of the plaintext or ciphertext of w through the security token; After calculating s, the signature auxiliary device or system calculates s w =(s+w)mod n or s w =(sw)mod n, and obtain the digital signature of the disturbance (r,s w ); (r,s w ) is not submitted or returned to the application service system through the user terminal; The application service system calculates s = (s w -w)mod n or s=(w -1 s w ) mod n, where w -1 The modulo n multiplicative inverse of w restores the digital signature (r, s) for the message M.

8. The method for securely and controllably using an ECDSA signature private key according to any one of claims 1 to 7, characterized in that: A method for securely and controllably using the ECDSA signature private key based on the method B and / or S B The security enhancement scheme for encryption protection is as follows: d B and / or S B After encryption, it becomes ciphertext data T U ; Used to decrypt ciphertext data T U The key SK2 is encrypted to become the ciphertext data T sk2 , the signature auxiliary device or system is used to decrypt the ciphertext data T sk2 The key SK3; the ciphertext data T U and ciphertext data T sk2 Save in the user terminal; When a user accesses the application service system and needs to use the user's ECDSA signature private key to digitally sign the message M, the application service system issues a security token to the user; The application service system transmits the security token or the acquisition information of the security token to the cryptographic program or cryptographic module or cryptographic component implementing the ECDSA digital signature function in the user terminal; The user terminal sends the security token or the security token acquisition information and T sk2 Submit to a signature assist device or system; If the information submitted to the signature auxiliary device or system is the acquisition information of the security token, the signature auxiliary device or system uses the acquisition information to obtain the security token issued by the application service system; After the signature auxiliary device or system verifies the validity of the security token, it uses the key SK3 to decrypt the ciphertext data T sk2 , obtain the key SK2, and return the key SK2 to the user terminal; The user terminal uses the key SK2 to decrypt the ciphertext data T U Get B and / or S B , then the user terminal and the signature auxiliary device or system use the secure and controllable use method of the ECDSA signature private key described above, using d B , S B Perform calculation to generate digital signature.

9. The method for securely and controllably using an ECDSA signature private key according to any one of claims 1 to 7, characterized in that: The generation and distribution methods of the user's ECDSA signature key pair include: Method 1: The ECDSA signature key pair Q is generated by the trusted program in the user terminal U d U , randomly select an integer b in [1,n-1] and calculate d B =(bd U )mod n,S B =E(b), d U , b is discarded, and then d B , S B Secure storage; the trusted program is a program provided by a cryptographic program or cryptographic module developer, or a cryptographic service provider; If you need to calculate G b =b -1 G, then the trusted program uses b to calculate G b =b -1 G, and G b storing in a user terminal or submitting to a signature assistance device or system; Method 2: Generate an ECDSA signature key pair Q using a trusted program in another terminal U d U , randomly select an integer b in [1,n-1] and calculate d B =(bd U )mod n,S B =E(b), d U , b discarded, and then d transmitted by barcode scanning or other transmission methods B , S B Delivered to the user terminal for storage; the other terminal refers to storage and use of d B , S B a computing device other than a user terminal; If you need to calculate G b =b -1 G, then the trusted program uses b to calculate G b =b -1 G, and transmit G through barcode or other transmission methods b Pass it to the user terminal for storage, or G b Submit to a signature assisting device or system for storage; Method 3: The key generation device or system generates an ECDSA signature key pair Q U d U , randomly select an integer b in [1,n-1] and calculate d B =(bd U )mod n,S B =E(b), d U , b discarded, and then d B , S B Transmit to the user terminal for storage; If you need to calculate G b =b -1 G, the key generation device or system uses b to calculate G b =b -1 G, then G b Send it to the user terminal for storage, or save G b Submit to a signature assisting device or system for storage; Method 4: The key generation device or system randomly selects an integer d1 and b1 in [1, n-1], and encrypts b1 using the homomorphic encryption algorithm to obtain S B1 =E(b1), calculate d B1 =(b1d1)mod n,Q U1 = d1G, discard d1 and b1, and replace S B1 d B1 , Q U1 Send to the user terminal; The user terminal randomly selects an integer d2 and b2 in [1, n-1], or randomly selects an integer d2 in [1, n-1] and fixes the value of b2 in [1, n-1], and uses the homomorphic encryption algorithm, S B1 d B1 And the ciphertext operation is calculated to get S B =E(b1b2),d B =(b2d2d B1 ) mod n, calculate Q U =d2Q U1 ; The user terminal verifies S without exposing d1d2 B =E(b1b2),d B =(b1b2d1d2)mod n, d1d2 and an ECDSA signature private key d in [1,n-1] U Modulo n congruence means d1d2=d U (mod n) and Q U =d U G, that is, verify that there is d U =(d1d2)mod n and Q U =d U G, then b1b2 is congruent to an integer b in [1,n-1] modulo n, that is, b1b2 = b (mod n); The user terminal discards d2 and b2 and sends S B d B , Q U save; If you need to calculate G b =b -1 G, the key generation device or system uses b1 to calculate G b1 =(b1) -1 G, then G b1 Transmitted to the user terminal, the user terminal calculates G b =(b2) -1 G b1 ; or the user terminal uses b2 to calculate G b2 =(b2) -1 G, G b2 Submit to the signature auxiliary device or system, the key generation device or system calculates G b =(b1) -1 G b2 ; The user terminal and / or the signature auxiliary device or system will b save; For the above-mentioned ECDSA signature private key generation and issuance method, if the homomorphic encryption algorithm public key used to encrypt b is temporarily generated, then d is generated. U The device, system or program of d1 uses the symmetric key or public key to encrypt the private key SK1 of the homomorphic encryption algorithm corresponding to the decryption operation to obtain the ciphertext T of SK1 sk1 , where using the public key to encrypt SK1 is applicable to all four ECDSA signature key pair generation and distribution methods, and using the symmetric key to encrypt SK1 is only applicable to ECDSA signature key pair generation and distribution methods three and four.

10. The method for securely and controllably using an ECDSA signature private key according to claim 9, wherein: For the above-mentioned user's ECDSA signature key pair generation and distribution methods 1, 2, and 3, if the signature auxiliary device or system does not have b and cannot obtain b, then select b = (d U ) -1 is allowed, at this time d B =1.

11. The method for securely and controllably using an ECDSA signature private key according to claim 9, wherein: For the fourth method of generating and distributing the ECDSA signature key pair of the user described above, the following methods b1 and b2 are allowed: b1=(d1) -1 , b2=1, where (d1) -1 is the modulo n multiplicative inverse of d1, in which case b = (d1) -1 , d B =d2; b1=(d1) -1 , b2=(d2) -1 , where (d2) -1 is the modulo n multiplicative inverse of d2, in which case b = (d1d2) -1 , d B =1, the signature assistance device or system does not have b and cannot obtain b.

12. A system for secure and controllable use of an ECDSA signature private key based on the method for secure and controllable use of an ECDSA signature private key as described in any one of claims 1 to 7, characterized in that: The system includes a signature auxiliary device or system, a cryptographic program or a cryptographic module or a cryptographic component in a user terminal; the user terminal stores a user ECDSA signature private key d U The ciphertext d B , stored or available for decryption d B The ciphertext S of the key b B ; When it is necessary to use the user's ECDSA signature private key to digitally sign a message M, the cryptographic program or cryptographic module or cryptographic component in the user terminal, and the signature auxiliary device or system, jointly generate a digital signature for the message M according to the above-mentioned safe and controllable use method of the ECDSA signature private key, wherein the cryptographic program or cryptographic module or cryptographic component in the user terminal implements the operation processing and / or function of the user terminal in the above-mentioned digital signature generation method.

Images