A digital signature method, apparatus, device, and storage medium

Abstract

The present application discloses a digital signature method, apparatus, device and storage medium, relating to the technical field of digital signature, including: performing a hash operation on a private key to obtain a first hash value, and calculating a public key by using the first half of the first hash value; concatenating the second half of the first hash value with the text to be signed to obtain a first concatenated text, performing a hash operation on the first concatenated text to obtain a second hash value, and then calculating the first half of the signature value by using the second hash value; concatenating the first half of the signature value, the public key and the text to be signed, and performing a hash operation on the concatenated text to obtain a third hash value; performing an encryption operation on the third hash value by using the second half of the first hash value and based on the SM4 algorithm; calculating the second half of the signature value by using the third hash value and the first half of the first hash value; decrypting the encrypted ciphertext by using the second half of the first hash value, and verifying the decrypted plaintext. If the verification passes, it indicates that the signature is successful. The present application can resist various side-channel attacks.

Description

Technical Field

[0001] This application relates to the field of digital signature technology, and particularly relates to a digital signature method, apparatus, device, and storage medium. Background Art

[0002] Digital signature algorithms are an extension of handwritten signatures and consist of two parts: signature and authentication. They are usually used for identity authentication and information integrity authentication in information transmission, such as confirming whether the information is sent by the signer and whether the information has been tampered with. Currently, the EdDSA (Edwards-curve Digital Signature Algorithm) digital signature algorithm with two standardized parameter sets, ED25519 and ED448, has been widely used. Among them, the ED25519 algorithm has a short signature (64 bytes), a short public key (32 bytes), fewer branches, better hash collision resilience, and a deterministic signature value (no random number is involved in the signature). Therefore, it has higher performance and security, and clearer parameter selection, thus attracting wide attention in the academic community and being used by many well-known open-source software, such as the private chat software Signals and the anonymous currency Monero.

[0003] However, when digital signature algorithms are applied in hardware form to various communication scenarios, such as in the implementation environments of cryptographic systems such as smart cards, RFID (Radio Frequency Identification) chips, cryptographic co-processors, SoC cryptographic chips, and cryptographic machines, attackers can use side-channel attack (SCA, Side Channel Attack) methods such as power supply, electromagnetic radiation attack, event analysis attack, and fault analysis attack to attack the signature and authentication processes, obtain some key information, and use these key information to achieve more effective cryptographic cracking than traditional mathematical analysis. For example, hashing and point multiplication in the ED25519 algorithm are very vulnerable to power analysis attacks, and due to the deterministic signature feature of this algorithm, error injection attacks are possible.

[0004] In summary, how to defend against side-channel attacks in the ED25519 algorithm is a problem that still needs to be further solved in this field. Summary of the Invention

[0005] In view of this, the purpose of this application is to provide a digital signature method, apparatus, device, and storage medium that can resist various side-channel attacks. The specific solutions are as follows:

[0006] In the first aspect, this application discloses a digital signature method, including:

[0007] Perform a hashing operation on the blinded private key through table lookup to obtain a first hash value, and calculate the public key corresponding to the private key using the first half of the first hash value;

[0008] Concatenate the second half of the first hash value with the text to be signed to obtain a first concatenated text, perform a hashing operation on the first concatenated text to obtain a second hash value, and then calculate the first half of the signature value using the second hash value;

[0009] Concatenate the first half of the signature value, the public key, and the text to be signed to obtain a second concatenated text, and perform a hashing operation on the second concatenated text to obtain a third hash value;

[0010] Use the second half of the first hash value and perform an encryption operation on the third hash value based on the SM4 algorithm to obtain an encrypted ciphertext;

[0011] Calculate the second half of the signature value using the third hash value and the first half of the first hash value;

[0012] Use the second half of the first hash value to decrypt the encrypted ciphertext to obtain a decrypted plaintext, and verify the decrypted plaintext. If the verification passes, it indicates that the digital signature is successful.

[0013] Optionally, the calculating the first half of the signature value using the second hash value includes:

[0014] Perform a modulo operation on the order of the base point using the second hash value to obtain a first modulo result;

[0015] Perform a point multiplication calculation on the first modulo result and the base point using the blinded point multiplication algorithm to obtain a first point multiplication result;

[0016] Perform a linear function transformation on the first point multiplication result to obtain the first half of the signature value.

[0017] Optionally, the performing an encryption operation on the third hash value based on the SM4 algorithm using the second half of the first hash value to obtain an encrypted ciphertext includes:

[0018] Perform a modulo operation on the order of the base point using the third hash value to obtain a second modulo result;

[0019] Concatenate the second modulo result and the first modulo result to obtain a third concatenated text;

[0020] Use the second half of the first hash value as the key and perform an encryption operation on the third concatenated text based on the SM4 algorithm to obtain an encrypted ciphertext.

[0021] Optionally, verifying the decrypted plaintext, and if the verification passes, it indicates that the digital signature is successful, including:

[0022] Performing a hashing operation on the third concatenated text to obtain a fourth hash value;

[0023] Determining whether the fourth hash value is equal to the decrypted plaintext, and if so, it indicates that the digital signature is successful.

[0024] Optionally, the digital signature method further includes:

[0025] Sending the text to be signed, the first half of the signature value, and the second half of the signature value to the signature verification client.

[0026] Optionally, after sending the text to be signed, the first half of the signature value, and the second half of the signature value to the signature verification client, it further includes:

[0027] When the signature verification client obtains the text to be signed, the first half of the signature value, and the second half of the signature value, verifying the text to be signed by using the text to be signed, the first half of the signature value, and the second half of the signature value.

[0028] Optionally, verifying the text to be signed by using the text to be signed, the first half of the signature value, and the second half of the signature value includes:

[0029] Performing an inverse linear function transformation on the public key and the first half of the signature value respectively to obtain a first inverse transformation result and a second inverse transformation result;

[0030] Concatenating the first half of the signature value, the second inverse transformation result, and the text to be signed to obtain a new concatenated text, and performing a hashing operation on the new concatenated text to obtain a fifth hash value;

[0031] Performing a modulo operation on the fifth hash value with respect to the order of the base point to obtain a third modulo result;

[0032] Performing a point multiplication operation on the third modulo result and the first inverse transformation result to obtain a second point multiplication result, and performing a point addition operation on the second point multiplication result and the second inverse transformation result to obtain a point addition result;

[0033] Performing a point multiplication operation on the second half of the signature value and the base point to obtain a third point multiplication result;

[0034] Determining whether the third point multiplication result is equal to the point addition result. If they are equal, it is determined that the text to be signed is a trusted text. If they are not equal, it is determined that the text to be signed is an untrusted text.

[0035] In a second aspect, the present application discloses a digital signature device, comprising:

[0036] A first hashing operation module, configured to perform a hashing operation on the blinded private key through table look-up to obtain a first hash value;

[0037] A public key calculation module, configured to calculate the public key corresponding to the private key by using the first half of the first hash value;

[0038] A first concatenation module, configured to concatenate the second half of the first hash value with the text to be signed to obtain a first concatenated text;

[0039] A second hashing operation module, configured to perform a hashing operation on the first concatenated text to obtain a second hash value;

[0040] A first calculation module, configured to calculate the first half of the signature value by using the second hash value;

[0041] A second concatenation module, configured to concatenate the first half of the signature value, the public key, and the text to be signed to obtain a second concatenated text;

[0042] A third hashing operation module, configured to perform a hashing operation on the second concatenated text to obtain a third hash value;

[0043] An encryption module, configured to perform an encryption operation on the third hash value by using the second half of the first hash value and based on the SM4 algorithm to obtain an encrypted ciphertext;

[0044] A second calculation module, configured to calculate the second half of the signature value by using the third hash value and the first half of the first hash value;

[0045] A verification module, configured to decrypt the encrypted ciphertext by using the second half of the first hash value to obtain a decrypted plaintext, and verify the decrypted plaintext. If the verification passes, it indicates that the digital signature is successful.

[0046] In a third aspect, the present application discloses an electronic device, comprising a processor and a memory; wherein, when the processor executes the computer program stored in the memory, the foregoing digital signature method is implemented.

[0047] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the foregoing digital signature method is implemented.

[0048] It can be seen that in this application, first, a hash operation is performed on the private key after table look-up blinding to obtain a first hash value, and the public key corresponding to the private key is calculated using the first half of the first hash value. Then, the second half of the first hash value is concatenated with the text to be signed to obtain a first concatenated text, and a hash operation is performed on the first concatenated text to obtain a second hash value. Next, the first half of the signature value is calculated using the second hash value. Further, the first half of the signature value, the public key, and the text to be signed are concatenated to obtain a second concatenated text, and a hash operation is performed on the second concatenated text to obtain a third hash value. Then, the second half of the first hash value is used to encrypt the third hash value based on the SM4 algorithm to obtain an encrypted ciphertext. Next, the second half of the signature value is calculated using the third hash value and the first half of the first hash value. Finally, the encrypted ciphertext is decrypted using the second half of the first hash value to obtain a decrypted plaintext, and the decrypted plaintext is verified. If the verification passes, it indicates that the digital signature is successful. This application performs an adaptive blinding process on the hash operation in the traditional ED25519 algorithm and introduces the SM4 algorithm during the signature process, thereby being able to resist various side-channel attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on the provided drawings.

[0050] Figure 1 It is a flowchart of a digital signature method disclosed in the present application;

[0051] Figure 2 It is a flowchart of a specific digital signature method disclosed in the present application;

[0052] Figure 3 It is a flowchart of a specific digital signature method disclosed in the present application;

[0053] Figure 4 It is a schematic structural diagram of a digital signature device disclosed in the present application;

[0054] Figure 5 It is a structural diagram of an electronic device disclosed in the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0055] The following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without making creative efforts belong to the scope of protection of the present application.

[0056] An embodiment of the present application discloses a digital signature method. As shown in Figure 1 the following, this method includes:

[0057] Step S11: Perform a hashing operation on the private key after table lookup blinding to obtain a first hash value, and calculate the public key corresponding to the private key using the first half of the first hash value.

[0058] It should be noted that the digital signature scheme proposed in the present application mainly aims at various side-channel attacks in the traditional ED25519 algorithm. Since the ED25519 algorithm is vulnerable to energy analysis attacks during the hashing operation, the embodiment of the present application improves the hashing operation and performs a blinding process on the table lookup operation in the adopted hashing algorithm, such as the SHA512 algorithm (Secure Hash Algorithm). In addition, for the point multiplication operation in the ED25519 algorithm, due to its long time and high power consumption, it may be subject to side-channel attacks such as energy analysis attacks, time analysis attacks, and electromagnetic radiation attacks. Therefore, the embodiment of the present application improves the point multiplication operation in the ED25519 algorithm and performs a blinding process on the adopted point multiplication algorithm.

[0059] In this embodiment, when performing digital signature, first perform a hashing operation on the private key using the table lookup blinded hashing algorithm to obtain a first hash value, and then calculate the public key corresponding to the private key using the first half of the first hash value and based on the blinded point multiplication algorithm. Specifically, the obtaining process of the first hash value can be expressed as:

[0060] hash1[15:0] = H(d[7:0]);

[0061] In the formula, d represents the user's private key, with a length of 8 word lengths, hash1 is the first hash value, with a length of 16 word lengths, and H() is the SHA512 hashing algorithm after table lookup blinding. The specific implementation method of table lookup blinding is as follows:

[0062] The look-up table operation in the hashing algorithm is represented as α = S(β); where α is the output, β is the input, and S is the look-up table operation. Let there be three matrices of row transformation A, column transformation B, and random number transformation C, as well as random numbers k1 and k2. Let A[i] = E[i ⊕ k1], B[i] = E[i ⊕ k2]; where E is the identity matrix and i = 0, 1, 2, 3. Let k3 = k1 * 16 + k2, and calculate: S’(β) = A * S(β) * B ⊕ C(β). When performing the look-up table operation in the ED25519 algorithm each time, replacing the function α = S(β) in the SHA512 hashing algorithm with α = S’(β ⊕ k3) ⊕ C(β ⊕ k3) can complete the blinding process of the look-up table.

[0063] Since S’(β) = A * S(β) * B ⊕ C(β), then S’(β ⊕ k3) = A * S(β ⊕ k3) * B ⊕ C(β ⊕ k3) = S(β) ⊕ C(β ⊕ k3). From the above equation, it can be seen that the output result obtained by using S’ to look up the table after inputting β ⊕ k3 is S(β) ⊕ C(β ⊕ k3). That is to say, the result after looking up the table according to S’ only needs to be XORed with the result of looking up the table C again to obtain the output S(β), that is, the original output α, and the actual power consumption of α and β participating in the calculation process is completely masked, so it can resist energy analysis attacks.

[0064] Furthermore, the specific process of calculating the public key corresponding to the private key by using the first half of the first hash value and based on the blinded point multiplication algorithm is as follows:

[0065] Generate a random number k4 with 8-bit length, and then calculate the product of k4 and the order l of the base point G:

[0066] k4[7:0] * l[7:0];

[0067] Then perform a modulo addition operation on the result obtained from the above product and the first 8 words (i.e., the first half) of the first hash value hash1:

[0068] Hash1[7:0] + k4[7:0] * l[7:0];

[0069] Furthermore, perform a point multiplication operation on the result obtained from the above modulo addition operation and the base point G:

[0070] (Hash1[7:0] + k4[7:0] * l[7:0]) * G[31:0];

[0071] Then substitute the result of the obtained point multiplication operation into the linear function f to obtain the public key corresponding to the above private key d:

[0072] Publickey[7:0] = f((Hash1[7:0] + k4[7:0] * l[7:0]) * G[31:0]));

[0073] In the formula, G is the base point coordinate on the selected twisted Edwards curve, with a length of 32 words. hash1[7:0] represents the first 8 words (i.e., the first half) of the first hash value hash1. Publickey is the generated public key. The definition of the function f is as follows:

[0074] y[7:0] = f(x[31:0]) = (((x[23:16] - 1 * x[7:0]) & 1) << 255) | (x[23:16] - 1 * x[15:8]);

[0075] Where, & represents the bitwise AND operation, | is the bitwise OR operation, and <<n represents shifting left by n bit positions.

[0076] Since hash1’[7:0] = k4[7:0] * l[7:0] + hash1[7:0], the public key Publickey[7:0] can be rewritten as: Publickey[7:0] = f(hash1’[7:0] * G[31:0]) = f((k[7:0] * l[7:0] + hash1[7:0]) * G[31:0]) = f(k[7:0] * l[7:0] * G[31:0] + hash1[7:0] * G[31:0]) = f(hash1[7:0] * G[31:0]);

[0077] It can be seen that since the result of multiplying the order l of the base point G by the base point G is 0, that is, l * G = 0, the calculation result using hash1’ is the same as the result calculated using the ED25519 algorithm. However, the actual running power consumption of the first hash value hash1 is completely masked by the intermediate value hash1’. Therefore, this application can resist various power analysis attacks.

[0078] Step S12: Concatenate the second half of the first hash value with the text to be signed to obtain a first concatenated text, perform a hash operation on the first concatenated text to obtain a second hash value, and then calculate the first half of the signature value using the second hash value.

[0079] In this embodiment, after calculating the public key corresponding to the private key by using the first half of the first hash value, the second half of the first hash value can be concatenated with the text message to be signed to obtain a corresponding first concatenated text. Then, a hash operation is performed on the first concatenated text after table look-up blinding to obtain a second hash value hash2. Next, the first half of the signature value is calculated by using the second hash value hash2 and based on the blinded point multiplication algorithm. Among them, the process of obtaining the second hash value hash2 is specifically as follows:

[0080] hash2[15:0] = H((hash1[15:8] || message));

[0081] In the formula, message is the text to be signed, hash1[15:8] represents the last 8 words of the first hash value hash1, || represents concatenation, and the length of the second hash value hash2 is 16 words.

[0082] Specifically, the calculation of the first half of the signature value by using the second hash value may include: performing a modulo operation on the order of the base point by using the second hash value to obtain a first modulo result; performing a point multiplication calculation on the first modulo result and the base point by using the blinded point multiplication algorithm to obtain a first point multiplication result; and performing a linear function transformation on the first point multiplication result to obtain the first half of the signature value.

[0083] Among them, the process of obtaining the first half of the signature value is specifically as follows:

[0084] Performing a modulo operation on the second hash value with respect to the order l of the base point G to obtain an 8-word parameter r, that is:

[0085] r[7:0] = hash2[15:0] mod l;

[0086] Next, use the above-mentioned blinded point multiplication algorithm to calculate the point multiplication result of the parameter r and the base point G. The specific steps are as follows:

[0087] Generate a random number k5 and calculate the product of the random number k5 and the order l of the base point G:

[0088] k5[7:0] * l[7:0];

[0089] Perform a modulo addition operation on the obtained result of the above product and the parameter r:

[0090] r[7:0] + k5[7:0] * l[7:0];

[0091] Then perform a point multiplication on the obtained result of the above modulo addition operation and the base point G to obtain a 32-word parameter R:

[0092] R[31:0] = (r[7:0] + k5[7:0] * l[7:0]) * G[31:0];

[0093] Further, perform a linear function f transformation on the above parameter R to obtain a parameter Rs with 8 word lengths. Rs is the first half of the signature value, that is: Rs[7:0] = f(R[31:0]).

[0094] Step S13: Concatenate the first half of the signature value, the public key, and the text to be signed to obtain a second concatenated text, and perform a hashing operation on the second concatenated text to obtain a third hash value.

[0095] In this embodiment, after calculating the first half of the signature value using the second hash value, further, concatenate the first half of the signature value, the public key, and the text to be signed to obtain a second concatenated text, and then perform a hashing operation on the concatenated second concatenated text to obtain a third hash value hash3.

[0096] Specifically, the process of obtaining the third hash value hash3 can be expressed as: hash3 = H(Rs[7:0] || Publickey[7:0] || message).

[0097] Step S14: Use the second half of the first hash value and perform an encryption operation on the third hash value based on the SM4 algorithm to obtain an encrypted ciphertext.

[0098] In this embodiment, after performing a hashing operation on the second concatenated text to obtain a third hash value, further, use the last 8 words of the first hash value hash1 as the key and perform an encryption operation on the third hash value hash3 using the SM4 algorithm to obtain the corresponding encrypted ciphertext Cipher.

[0099] Specifically, the encryption operation on the third hash value using the second half of the first hash value and based on the SM4 algorithm to obtain the encrypted ciphertext may include: performing a modulo operation on the order of the base point using the third hash value to obtain a second modulo result; concatenating the second modulo result and the first modulo result to obtain a third concatenated text; using the second half of the first hash value as the key and performing an encryption operation on the third concatenated text based on the SM4 algorithm to obtain the encrypted ciphertext. In this embodiment, after performing a table-lookup blinding hash operation on the second concatenated text to obtain the third hash value, further, a modulo operation is performed on the order l of the base point G using the above third hash value hash3 to obtain a second modulo result. Specifically, the process of obtaining the second modulo result is: performing a modulo operation on the order l of the base point G using the obtained third hash value hash3 to obtain an 8-word-length parameter h, that is: h[7:0] = H(Rs[7:0]||Publickey[7:0]||message) mod l. Then, the above second modulo result h and the above first modulo result r are concatenated to obtain a third concatenated text. Further, using the second half of the above first hash value hash1 as the key and performing an encryption operation on the above third concatenated text based on the SM4 algorithm to obtain the encrypted ciphertext Cipher. The process of obtaining the encrypted ciphertext Cipher can be expressed as:

[0100] Cipher = SM4_encrypt(H(h[7:0]||r[7:0]), hash1[15:8]);

[0101] In the formula, SM4_encrypt() is the SM4 encryption algorithm, the encrypted text is the hash value after concatenating h[7:0] and r[7:0], the key is the last 8 words of the first hash value hash1, and Cipher is the generated ciphertext.

[0102] Step S15: Calculate the second half of the signature value using the third hash value and the first half of the first hash value.

[0103] In this embodiment, after obtaining the encrypted ciphertext by performing an encryption operation on the third hash value using the second half of the first hash value and based on the SM4 algorithm, the second half of the signature value can be further calculated using the above third hash value and the above first half of the first hash value.

[0104] Specifically, the process of obtaining the second half of the signature value specifically includes: performing a modulo operation on the order l of the base point G using the obtained above third hash value hash3 to obtain an 8-word-length parameter h:

[0105] h[7:0] = H(Rs[7:0] || Publickey[7:0] || message) mod l;

[0106] Next, perform modular multiplication on the above parameter h and the first 8 words of the above first hash value hash1, and then perform modular addition of the result of the modular multiplication to the above parameter r to obtain an 8-word parameter s, where s is the second half of the signature value, that is:

[0107] s[7:0] = r[7:0] + h[7:0] * hash1[7:0] mod l.

[0108] Step S16: Use the second half of the first hash value to decrypt the encrypted ciphertext to obtain the decrypted plaintext, and verify the decrypted plaintext. If the verification passes, it indicates that the digital signature is successful.

[0109] In this embodiment, after calculating the second half of the signature value using the third hash value and the first half of the first hash value, the above encrypted ciphertext Cipher can be decrypted to obtain the decrypted plaintext plain, and then the above decrypted plaintext plain can be used to determine whether the digital signature is successful.

[0110] In this embodiment, the verification of the decrypted plaintext, if the verification passes, it indicates that the digital signature is successful, specifically including: performing a hash operation on the third concatenated text to obtain a fourth hash value; determining whether the fourth hash value is equal to the decrypted plaintext, if equal, it indicates that the digital signature is successful. In this embodiment, after calculating the second half of the signature value using the third hash value and the first half of the first hash value, the second half of the above first hash value hash1 can be further used to decrypt the above encrypted ciphertext to obtain the corresponding decrypted plaintext plain, and then perform a hash operation on the above third concatenated text after table lookup blinding to obtain a fourth hash value hash4. Specifically, the process of obtaining the decrypted plaintext plain can be expressed as:

[0111] Plain = SM4_decrypt(cipher, hash1[15:8]);

[0112] In the formula, SM4_decrypt() is the SM4 decryption algorithm, the decrypted text is Cipher, the key is the last 8 words of the first hash value hash1, and plain is the decrypted plaintext.

[0113] Specifically, the process of obtaining the fourth hash value hash4 can be expressed as:

[0114] hash4 = H(h[7:0] || r[7:0]).

[0115] Further, after performing a hash operation on the third concatenated text after table lookup blinding to obtain the fourth hash value hash4, it can be determined whether the above fourth hash value hash4 is equal to the above decrypted plaintext plain. If plain = hash4, it indicates that the digital signature is successful.

[0116] In this embodiment, for the error injection attack that is vulnerable during the signature process, the present application provides a principle for resisting the attack: If an attacker flips a certain bit in the above parameter h to obtain h' through an electromagnetic injection attack, then the s' calculated using h' is: s'[7:0] = r[7:0] + h'[7:0] * hash1[7:0] mod l; then s[7:0] - s'[7:0] = (h[7:0] - h'[7:0]) * hash1[7:0] mod l. Since both s and s' are known, and the value of h[7:0] - h'[7:0] can also be controlled by the attacker, the value of hash1[7:0] can also be calculated; although the value of hash[15:8] is still unknown, due to the particularity or vulnerability of the ED25519 algorithm design, the confidentiality of r completely loses its effect after hash1[7:0] is broken. At this time, if the attacker substitutes any value into r to continue signature verification, it still holds. That is to say, the attacker only needs to crack half of the hash1 value and can still forge the entire signature without knowing any other parameters, making the ED25519 algorithm have a security vulnerability. To solve this problem, the SM4 algorithm is introduced in the present application. The h value and the r value are concatenated, and the resulting result is used as the key with the second half of hash1 to calculate the SM4 encrypted ciphertext Cipher, and the encrypted ciphertext Cipher is decrypted to obtain the plaintext plain. Finally, by determining whether plain is equal to hash4, it can be ensured that the attacker cannot forge the signature whether they obtain hash1[7:0] or hash1[15:8], so the error injection attack can be effectively resisted.

[0117] It can be seen that in the embodiment of the present application, a hash operation is performed on the private key after table lookup blinding to obtain a first hash value, and a public key corresponding to the private key is calculated using the first half of the first hash value. Then, the second half of the first hash value is concatenated with the text to be signed to obtain a first concatenated text, and a hash operation is performed on the first concatenated text to obtain a second hash value. Further, the first half of the signature value is calculated using the second hash value. Furthermore, the first half of the signature value, the public key, and the text to be signed are concatenated to obtain a second concatenated text, and a hash operation is performed on the second concatenated text to obtain a third hash value. Then, an encryption operation is performed on the third hash value using the second half of the first hash value based on the SM4 algorithm to obtain an encrypted ciphertext. Next, the second half of the signature value is calculated using the third hash value and the first half of the first hash value. Finally, the encrypted ciphertext is decrypted using the second half of the first hash value to obtain a decrypted plaintext, and the decrypted plaintext is verified. If the verification passes, it indicates that the digital signature is successful. In the embodiment of the present application, an adaptive blinding process is performed on the hash operation in the traditional ED25519 algorithm, and the SM4 algorithm is introduced during the signature process, so as to be able to resist various side-channel attacks including power analysis attacks, timing analysis attacks, electromagnetic radiation attacks, and fault injection attacks.

[0118] An embodiment of the present application discloses a specific digital signature method. Refer to Figure 2 as shown, the method includes:

[0119] Step S21: Perform a hash operation on the private key after table lookup blinding to obtain a first hash value, and calculate a public key corresponding to the private key using the first half of the first hash value.

[0120] Step S22: Concatenate the second half of the first hash value with the text to be signed to obtain a first concatenated text, perform a hash operation on the first concatenated text to obtain a second hash value, and calculate the first half of the signature value using the second hash value.

[0121] Step S23: Concatenate the first half of the signature value, the public key, and the text to be signed to obtain a second concatenated text, and perform a hash operation on the second concatenated text to obtain a third hash value.

[0122] Step S24: Perform an encryption operation on the third hash value using the second half of the first hash value based on the SM4 algorithm to obtain an encrypted ciphertext.

[0123] Step S25: Calculate the second half of the signature value using the third hash value and the first half of the first hash value.

[0124] Step S26: Use the second half of the first hash value to decrypt the encrypted ciphertext to obtain the decrypted plaintext, and verify the decrypted plaintext. If the verification passes, it indicates that the digital signature is successful.

[0125] Step S27: Send the text to be signed, the first half of the signature value, and the second half of the signature value to the signature verification client.

[0126] In this embodiment, if plain = hash4, it indicates that the digital signature is successful. At this time, the text to be signed, the first half of the signature value, and the second half of the signature value can be sent to the signature verification client, that is, (message, Rs, s) is sent to the signature verification client; if plain is not equal to hash4, all memory can be cleared and the current signature process can be exited.

[0127] Step S28: After the signature verification client obtains the text to be signed, the first half of the signature value, and the second half of the signature value, use the text to be signed, the first half of the signature value, and the second half of the signature value to verify the text to be signed.

[0128] In this embodiment, after the signature verification client obtains the above (message, Rs, s), the above (message, Rs, s) can be used to verify the text to be signed message.

[0129] Specifically, refer to Figure 3 As shown, the verification of the text to be signed using the text to be signed, the first half of the signature value, and the second half of the signature value may include:

[0130] Step S31: Perform inverse linear function transformations on the public key and the first half of the signature value respectively to obtain a first inverse transformation result and a second inverse transformation result;

[0131] Step S32: Concatenate the first half of the signature value, the second inverse transformation result, and the text to be signed to obtain a new concatenated text, and perform a hash operation on the new concatenated text to obtain a fifth hash value;

[0132] Step S33: Perform a modulo operation on the fifth hash value with respect to the order of the base point to obtain a third modulo result;

[0133] Step S34: Perform a point multiplication operation on the third modulo result and the first inverse transformation result to obtain a second point multiplication result, and perform a point addition operation on the second point multiplication result and the second inverse transformation result to obtain a point addition result;

[0134] Step S35: Perform a point multiplication operation on the second half of the signature value and the base point to obtain a third point multiplication result;

[0135] Step S36: Determine whether the third point multiplication result is equal to the point addition result. If they are equal, it is determined that the text to be signed is a trustworthy text; if not, it is determined that the text to be signed is an untrustworthy text.

[0136] Specifically, the process of verifying the text to be signed using the text to be signed, the first half of the signature value, and the second half of the signature value may include: performing an inverse transformation of the public key with the linear function f to obtain a 32-bit parameter P, that is, P[31:0]=f-1(Publickey[7:0]), then performing an inverse transformation of the first half of the signature with the linear function f to obtain a 32-bit parameter R', then concatenating the first half of the signature value, the above parameter P, and the text to be signed message to obtain a new concatenated text, then performing the 5th SHA512 hashing operation on the above new concatenated text to obtain the fifth hash value hash5, and then taking the modulo operation of the above fifth hash value hash5 with the order l of the base point G to obtain an 8-bit parameter h', that is, h'[7:0]=H(Rs[7:0]||P[7:0]||message)mod l; further, performing the 3rd point multiplication operation on the above parameter h' and the above parameter P, and performing a point addition operation on the result of the point multiplication operation and the above parameter R' to obtain a 32-bit parameter sR, that is, sR[31:0]=R'[31:0]+h'[7:0]*P[31:0]mod l; finally, performing the 4th point multiplication operation on the second half of the signature value and the base point G to obtain a 32-bit parameter sR', and determining whether sR is equal to sR'. If sR = sR', the signature verification is successful, indicating that the text to be signed message is a text trustworthy by the user; if sR is not equal to sR', it indicates that the text to be signed message is an untrustworthy text by the user. At this time, the text to be signed message can be discarded.

[0137] Among them, for the more specific processing processes of the above steps S21, S22, S23, and S27, reference can be made to the corresponding content disclosed in the foregoing embodiments, and details will not be elaborated herein.

[0138] It can be seen that the embodiments of the present application can effectively resist various side-channel attacks such as error injection attacks, power analysis attacks, timing analysis attacks, and electromagnetic radiation attacks by performing table-lookup blinding processing on the hashing operations in the traditional ED25519 algorithm, performing blinding processing on the point multiplication operations, and introducing the SM4 algorithm.

[0139] Correspondingly, the embodiments of the present application also disclose a digital signature device. SeeFigure 4 As shown, the device includes:

[0140] A first hashing operation module 11, configured to perform a hashing operation on the blinded private key by looking up a table to obtain a first hash value;

[0141] A public key calculation module 12, configured to calculate a public key corresponding to the private key by using the first half of the first hash value;

[0142] A first concatenation module 13, configured to concatenate the second half of the first hash value with the text to be signed to obtain a first concatenated text;

[0143] A second hashing operation module 14, configured to perform a hashing operation on the first concatenated text to obtain a second hash value;

[0144] A first calculation module 15, configured to calculate the first half of the signature value by using the second hash value;

[0145] A second concatenation module 16, configured to concatenate the first half of the signature value, the public key, and the text to be signed to obtain a second concatenated text;

[0146] A third hashing operation module 17, configured to perform a hashing operation on the second concatenated text to obtain a third hash value;

[0147] An encryption module 18, configured to perform an encryption operation on the third hash value by using the second half of the first hash value and based on the SM4 algorithm to obtain an encrypted ciphertext;

[0148] A second calculation module 19, configured to calculate the second half of the signature value by using the third hash value and the first half of the first hash value;

[0149] A verification module 110, configured to decrypt the encrypted ciphertext by using the second half of the first hash value to obtain a decrypted plaintext, and verify the decrypted plaintext. If the verification passes, it indicates that the digital signature is successful.

[0150] Wherein, for the specific working processes of the above-mentioned various modules, reference can be made to the corresponding content disclosed in the foregoing embodiments, and details are not described herein again.

[0151] It can be seen that in the embodiments of the present application, a hash operation is performed on the private key after table lookup blinding to obtain a first hash value, and the public key corresponding to the private key is calculated using the first half of the first hash value. Then, the second half of the first hash value is concatenated with the text to be signed to obtain a first concatenated text, and a hash operation is performed on the first concatenated text to obtain a second hash value. Further, the first half of the signature value is calculated using the second hash value. Furthermore, the first half of the signature value, the public key, and the text to be signed are concatenated to obtain a second concatenated text, and a hash operation is performed on the second concatenated text to obtain a third hash value. Then, the second half of the first hash value is used to perform an encryption operation on the third hash value based on the SM4 algorithm to obtain an encrypted ciphertext. Next, the second half of the signature value is calculated using the third hash value and the first half of the first hash value. Finally, the second half of the first hash value is used to decrypt the encrypted ciphertext to obtain a decrypted plaintext, and the decrypted plaintext is verified. If the verification passes, it indicates that the digital signature is successful. The embodiments of the present application perform an adaptive blinding process on the hash operation in the traditional ED25519 algorithm and introduce the SM4 algorithm during the signature process, thereby being able to resist various side-channel attacks including power analysis attacks, timing analysis attacks, electromagnetic radiation attacks, and fault injection attacks.

[0152] In some specific embodiments, the first calculation module 15 may specifically include:

[0153] A first modulo operation unit, configured to perform a modulo operation on the order of the base point using the second hash value to obtain a first modulo result;

[0154] A point multiplication calculation unit, configured to perform a point multiplication calculation on the first modulo result and the base point using a blinded point multiplication algorithm to obtain a first point multiplication result;

[0155] A linear function transformation unit, configured to perform a linear function transformation on the first point multiplication result to obtain the first half of the signature value.

[0156] In some specific embodiments, the encryption module 18 may specifically include:

[0157] A second modulo operation unit, configured to perform a modulo operation on the order of the base point using the third hash value to obtain a second modulo result;

[0158] A first concatenation unit, configured to concatenate the second modulo result and the first modulo result to obtain a third concatenated text;

[0159] An encryption unit, configured to use the second half of the first hash value as a key and perform an encryption operation on the third concatenated text based on the SM4 algorithm to obtain an encrypted ciphertext.

[0160] In some specific embodiments, the verification module 110 may specifically include:

[0161] A first hashing operation unit, configured to perform a hashing operation on the third concatenated text to obtain a fourth hash value;

[0162] A first determination unit, configured to determine whether the fourth hash value is equal to the decrypted plaintext. If they are equal, it indicates that the digital signature is successful.

[0163] In some specific embodiments, the digital signature device may further include:

[0164] A data sending unit, configured to send the text to be signed, the first half of the signature value, and the second half of the signature value to the signature verification client.

[0165] In some specific embodiments, after the data sending unit, it may further include:

[0166] A text verification unit, configured to, after the signature verification client obtains the text to be signed, the first half of the signature value, and the second half of the signature value, verify the text to be signed by using the text to be signed, the first half of the signature value, and the second half of the signature value.

[0167] In some specific embodiments, the text verification unit may specifically include:

[0168] A linear function inverse transformation unit, configured to perform an inverse transformation of the linear function on the public key and the first half of the signature value respectively to obtain a first inverse transformation result and a second inverse transformation result;

[0169] A second concatenation unit, configured to concatenate the first half of the signature value, the second inverse transformation result, and the text to be signed to obtain a new concatenated text;

[0170] A second hashing operation unit, configured to perform a hashing operation on the new concatenated text to obtain a fifth hash value;

[0171] A third modulo operation unit, configured to perform a modulo operation on the fifth hash value with respect to the order of the base point to obtain a third modulo result;

[0172] A first point multiplication operation unit, configured to perform a point multiplication operation on the third modulo result and the first inverse transformation result to obtain a second point multiplication result;

[0173] A point addition operation unit, configured to perform a point addition operation on the second point multiplication result and the second inverse transformation result to obtain a point addition result;

[0174] A second dot multiplication unit, configured to perform a dot multiplication operation on the second half of the signature value and the base point to obtain a third dot multiplication result;

[0175] A second determination unit, configured to determine whether the third dot multiplication result is equal to the point addition result;

[0176] A first determination unit, configured to determine that the text to be signed is a trustworthy text if the third dot multiplication result is equal to the point addition result;

[0177] A second determination unit, configured to determine that the text to be signed is an untrustworthy text if the third dot multiplication result is not equal to the point addition result.

[0178] Furthermore, an embodiment of the present application also discloses an electronic device. Figure 5 It is a structural diagram of an electronic device 20 shown according to an exemplary embodiment. The content in the figure should not be considered as any limitation on the scope of use of the present application.

[0179] Figure 5 It is a schematic structural diagram of an electronic device 20 provided by an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the digital signature method disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0180] In this embodiment, the power supply 23 is used to provide a working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows is any communication protocol applicable to the technical solution of the present application, and no specific limitation is imposed on it here; the input / output interface 25 is used to obtain external input data or output data to the outside, and the specific interface type thereof can be selected according to specific application requirements, and no specific limitation is made here.

[0181] In addition, as a carrier for resource storage, the memory 22 may be a read-only memory, a random access memory, a disk, or an optical disc, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be short-term storage or permanent storage.

[0182] Among them, the operating system 221 is used to manage and control each hardware device and computer program 222 on the electronic device 20, and it can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program that can be used to complete the digital signature method executed by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs that can be used to complete other specific tasks.

[0183] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the digital signature method disclosed above is implemented. For the specific steps of this method, reference can be made to the corresponding content disclosed in the foregoing embodiments, and details will not be repeated here.

[0184] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. For the same or similar parts between the various embodiments, reference can be made to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and reference can be made to the description in the method part for related parts.

[0185] Those skilled in the art can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in this article can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0186] The steps of the method or algorithm described in combination with the embodiments disclosed in this article can be directly implemented by hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, or any other form of storage medium well-known in the technical field.

[0187] Finally, it should also be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0188] The above has introduced in detail a digital signature method, apparatus, device and storage medium provided by the present application. Specific examples are used in this text to elaborate on the principle and implementation manner of the present application. The description of the above embodiments is only used to help understand the method and its core idea of the present application; at the same time, for those of ordinary skill in the art, according to the idea of the present application, there will be changes in the specific implementation manner and application scope. In summary, the content of this specification should not be construed as a limitation to the present application.

Claims

1. A digital signature method, characterized in that, Including: Performing a hashing operation on the blinded private key through table lookup to obtain a first hash value, and calculating a public key corresponding to the private key by using the first half of the first hash value; Concatenating the second half of the first hash value with the text to be signed to obtain a first concatenated text, performing a hashing operation on the first concatenated text to obtain a second hash value, and then calculating the first half of the signature value by using the second hash value; Concatenating the first half of the signature value, the public key, and the text to be signed to obtain a second concatenated text, and performing a hashing operation on the second concatenated text to obtain a third hash value; Performing an encryption operation on the third hash value by using the second half of the first hash value based on the SM4 algorithm to obtain an encrypted ciphertext; Calculating the second half of the signature value by using the third hash value and the first half of the first hash value; Decrypting the encrypted ciphertext by using the second half of the first hash value to obtain a decrypted plaintext, and verifying the decrypted plaintext. If the verification passes, it indicates that the digital signature is successful; The calculating the first half of the signature value by using the second hash value includes: performing a modulo operation on the order of the base point by using the second hash value to obtain a first modulo result; performing a point multiplication calculation on the first modulo result and the base point by using a blinded point multiplication algorithm to obtain a first point multiplication result; performing a linear function transformation on the first point multiplication result to obtain the first half of the signature value; The calculating the second half of the signature value by using the third hash value and the first half of the first hash value includes: performing a modulo operation on the obtained third hash value by the order of the base point to obtain a first parameter with 8 word lengths; performing a modular multiplication on the first parameter and the first 8 words of the first hash value, and then performing a modular addition on the result of the modular multiplication with a second parameter to obtain the second half of the signature value; the second parameter is a parameter with 8 word lengths obtained by performing a modulo operation on the second hash value by the order of the base point.

2. The digital signature method according to claim 1, wherein The performing an encryption operation on the third hash value by using the second half of the first hash value based on the SM4 algorithm to obtain an encrypted ciphertext includes: Performing a modulo operation on the third hash value by the order of the base point to obtain a second modulo result; Concatenating the second modulo result and the first modulo result to obtain a third concatenated text; Using the second half of the first hash value as a key and performing an encryption operation on the third concatenated text based on the SM4 algorithm to obtain an encrypted ciphertext.

3. The digital signature method according to claim 2, wherein The verifying the decrypted plaintext. If the verification passes, it indicates that the digital signature is successful includes: Performing a hashing operation on the third concatenated text to obtain a fourth hash value; Judging whether the fourth hash value is equal to the decrypted plaintext. If they are equal, it indicates that the digital signature is successful.

4. The digital signature method according to claim 3, wherein It further includes: Sending the text to be signed, the first half of the signature value, and the second half of the signature value to a signature verification client.

5. The digital signature method according to claim 4, wherein After the sending the text to be signed, the first half of the signature value, and the second half of the signature value to a signature verification client, it further includes: After the signature verification client obtains the text to be signed, the first half of the signature value, and the second half of the signature value, it verifies the text to be signed by using the text to be signed, the first half of the signature value, and the second half of the signature value.

6. The digital signature method according to claim 5, characterized in that The verifying the text to be signed by using the text to be signed, the first half of the signature value, and the second half of the signature value includes: Performing an inverse linear function transformation on the public key and the first half of the signature value respectively to obtain a first inverse transformation result and a second inverse transformation result; Cascading the first half of the signature value, the second inverse transformation result, and the text to be signed to obtain a new cascaded text, and performing a hashing operation on the new cascaded text to obtain a fifth hash value; Performing a modulo operation on the fifth hash value with respect to the order of the base point to obtain a third modulo result; Performing a point multiplication operation on the third modulo result and the first inverse transformation result to obtain a second point multiplication result, and performing a point addition operation on the second point multiplication result and the second inverse transformation result to obtain a point addition result; Performing a point multiplication operation on the second half of the signature value and the base point to obtain a third point multiplication result; Determining whether the third point multiplication result is equal to the point addition result. If they are equal, it is determined that the text to be signed is a trusted text. If they are not equal, it is determined that the text to be signed is an untrusted text.

7. A digital signature device, characterized in that, including: A first hashing operation module for performing a hashing operation on the blinded private key through table lookup to obtain a first hash value; A public key calculation module for calculating the public key corresponding to the private key by using the first half segment of the first hash value; A first cascading module for cascading the second half segment of the first hash value and the text to be signed to obtain a first cascaded text; A second hashing operation module for performing a hashing operation on the first cascaded text to obtain a second hash value; A first calculation module for calculating the first half of the signature value by using the second hash value; A second cascading module for cascading the first half of the signature value, the public key, and the text to be signed to obtain a second cascaded text; A third hashing operation module for performing a hashing operation on the second cascaded text to obtain a third hash value; An encryption module for encrypting the third hash value by using the second half segment of the first hash value and based on the SM4 algorithm to obtain an encrypted ciphertext; A second calculation module for calculating the second half of the signature value by using the third hash value and the first half segment of the first hash value; A verification module for decrypting the encrypted ciphertext by using the second half segment of the first hash value to obtain a decrypted plaintext, and verifying the decrypted plaintext. If the verification passes, it indicates that the digital signature is successful; The first calculation module is specifically configured to perform a modulo operation on the second hash value with respect to the order of the base point to obtain a first modulo result; performing a point multiplication calculation on the first modulo result and the base point by using a blinded point multiplication algorithm to obtain a first point multiplication result; performing a linear function transformation on the first point multiplication result to obtain the first half of the signature value; The second calculation module is specifically configured to perform a modulo operation on the obtained third hash value with respect to the order of the base point to obtain a first parameter of 8 word lengths; perform modular multiplication on the first parameter and the first 8 words of the first hash value, and then perform modular addition of the result of the modular multiplication with a second parameter to obtain the second half of the signature value. The second parameter is a parameter of 8 word lengths obtained by performing a modulo operation on the second hash value with respect to the order of the base point.

8. An electronic device, characterized in that, It includes a processor and a memory; wherein, when the processor executes the computer program stored in the memory, the digital signature method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that, It is used to store a computer program; wherein, when the computer program is executed by a processor, the digital signature method according to any one of claims 1 to 6 is implemented.

Images