A signature key generation method based on SM9 cryptographic algorithm

Abstract

The present invention discloses a signature key generation method based on SM9 cryptographic algorithm. The signature key generation method comprises the following steps: M1: generating a random number ks∈[1, N‑1] as a signature master private key through KGC, wherein N is the order of the SM9 elliptic curve; M2: calculating the element Ppub=[ks]P2 in G2 as the signature master public key, wherein the group G2 represents an additive cyclic group with an order of a prime number N, and P2 is a generator of the group G2. The signature key generation method provided by the present invention uses randomized ks' to replace the signature master private key ks for calculation; and uses randomized ds' to replace the signature private key ds for calculation. By using this double random protection mechanism, security is further improved.

Description

Technical Field

[0001] The invention relates to a signature key generation method based on an SM9 cryptographic algorithm, and belongs to the technical field of information security. Background Art

[0002] At present, digital signature and encryption and decryption technologies based on public key cryptography have been widely used in e-commerce, identity authentication and other applications, providing a set of mature and secure technologies and specifications for online transactions and communications. The security of private keys is one of the basic conditions for ensuring the security of these applications.

[0003] The SM9 identity cryptographic algorithm is a commercial cryptographic algorithm based on an identity cryptographic system independently designed in my country. It is an identity-based cryptographic algorithm constructed using bilinear pairings on elliptic curves in a finite field. In the SM9 cryptographic algorithm, the user's private key is calculated by the key generation center based on the master key and the user's identity. The user's public key is uniquely determined by the user's identity and the authenticity of the identity is guaranteed by the user's device manager. The SM9 cryptographic algorithm includes a signature / verification algorithm, an encryption / decryption algorithm, an encapsulation / decapsulation algorithm, and a key exchange algorithm. Compared with the traditional cryptographic system using public key infrastructure technology (PKI), the biggest advantage of the SM9 cryptographic algorithm is that it does not require a data certificate, has a low total cost of ownership, and is easy to manage and use.

[0004] According to Section 3.8 of the Chinese national standard GB / T 38635.2-2020 "Information Security Technology SM9 Cryptographic Algorithm Part 2: Algorithm", the user private key of the SM9 cryptographic algorithm is generated by the key generation center (KGC) based on the master private key and user identification, and the master private key is generally generated by the KGC through a random number generator. The master private key and the user private key are directly related to the security of the SM9 cryptographic algorithm, so it is necessary to develop a method to protect the user private key during the signature key generation algorithm to prevent the leakage of the master private key and the user private key. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a signature key generation method based on the SM9 cryptographic algorithm.

[0006] In order to achieve the above technical objectives, the present invention adopts the following technical solutions:

[0007] A method for generating a signature key based on the SM9 cryptographic algorithm, comprising the following steps:

[0008] M1: Generate a random number ks∈[1, N-1] as the signature master private key through KGC, where N is the order of the SM9 elliptic curve;

[0009] M2: Calculate the element Ppub=[ks]P2 in G2 as the signature master public key, where group G2 represents an additive cyclic group of order prime number N, and P2 is the generator of group G2.

[0010] Preferably, the signature key generation method further comprises the following steps:

[0011] M3: Get the user ID and the one-byte signature private key generation function identifier hi d and concatenate them into Z=ID||hi d;

[0012] M4: Calculate t1=H1(Z,N)+ks in the finite field FN, where H1 is the cryptographic function;

[0013] M5: Calculate t2 = ks*t 1^-1modN;

[0014] M6: Calculate the signature private key ds = [t 2] P 1, where P 1 is the generator of group G1, and group G1 represents an additive cyclic group with an order of prime number N.

[0015] Preferably, the step M2 includes the following sub-steps:

[0016] S 1: Get a random number R1 through a secure random number generator;

[0017] S2: Calculate R1'=R 1^-1modN by the modular inverse operation unit;

[0018] S3: Calculate Q=[R1']P2 using the extended domain point multiplication operation unit;

[0019] S4: Calculate ks'=ks*R1modN by the modular multiplication unit;

[0020] S5: Calculate Ppub'=[ks']Q using the extended domain point multiplication operation unit;

[0021] Preferably, the random number R1 is between [1, N-1], and R1 is smaller than N.

[0022] Preferably, Q is calculated as a random number using an extended-domain point multiplication operation unit.

[0023] Preferably, the random number R2 is obtained through a secure random number generator.

[0024] Preferably, the step M2 further includes the following sub-steps:

[0025] S7: Calculate t1'=t1*R2modN by the modular multiplication operation unit;

[0026] S8: Calculate t 1''=t 1'^-1modN by the modular inverse operation unit;

[0027] S9: Calculate t 2'=ks*t 1''modN by the modular multiplication operation unit;

[0028] S 10: Calculate D=[R2]P 1 using the base field point multiplication unit;

[0029] S 11: Calculate ds'=[t 2']D using the base field point multiplication operation unit.

[0030] Preferably, the random number R2 is between [1, N-1], and R2 is less than N.

[0031] Compared with the prior art, the signature key generation method provided by the present invention uses randomized ks' to replace the signature master private key ks for calculation. In this way, the use of the signature master private key ks can be reduced, thereby achieving the purpose of reducing the risk of leakage of the signature master private key ks; randomized t 2' is used to replace the intermediate variable t2, and randomized ds' is used to replace the signature private key ds for calculation, thereby reducing the use of the intermediate variable t2, and preventing the leakage of t2 and the signature private key ds due to the public parameter P1. Using this double random protection mechanism, security is further improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a flow chart of generating a signature master public key in an embodiment of the present invention;

[0033] Figure 2 This is a flow chart of generating a signature private key in an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The technical content of the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0035] In order to enable those skilled in the art to better understand the present invention, the relevant background of the present invention is further described below. The SM9 signature key generation algorithm is described in Section 6.1 of the Chinese national standard GB / T 38635.2-2020 "Information Security Technology SM9 Cryptographic Algorithm Part 2: Algorithm", including the system signature master key and the user signature key. The generation process is summarized as follows:

[0036] A1: Generate a random number ks∈[1, N-1] as the signature master private key through KGC;

[0037] A2: Calculate the element Ppu=[ks]P2 in G2 as the signature master public key;

[0038] A3: Get the user ID and the one-byte signature private key generation function identifier hid and concatenate them into Z=ID||hid;

[0039] A4: Calculate t1=H1(Z,N)+ks in the finite field FN, where H1 is the cryptographic function;

[0040] A5: Calculate t2 = ks*t 1^-1modN;

[0041] A6: Calculate the signature private key ds=[t2]P1.

[0042] The embodiment of the present invention discloses a signature key generation method based on the SM9 cryptographic algorithm. Figure 1 The generation flow chart of the signature master public key shown in Figure 2 The signature key generation flow chart shown in the figure replaces the extended domain point multiplication calculation involving the signature master private key ks, that is, replaces the operation Ppub=[ks]P2 in step A2 of the SM9 signature key generation algorithm.

[0043] Therefore, the signature key generation method provided by the embodiment of the present invention at least includes the following steps.

[0044] M1: Generate a random number ks∈[1, N-1] as the signature master private key through KGC;

[0045] M2: Calculate the element Ppub'=[ks']Q in G2 as the signature master public key;

[0046] like Figure 1 As shown, the M2 step specifically includes the following sub-steps:

[0047] S 1: Get a random number R1 through a secure random number generator;

[0048] Specifically, the random number R1 must be between [1, N-1]. If the generated random number R1 is greater than or equal to N, a new random number R1 is generated until R1 is less than N. Wherein N is the order of the SM9 elliptic curve. Specifically, N represents the cyclic group G1, G2, G T The order of N is greater than 2 191 The prime numbers of G1 and G2 represent additive cyclic groups of order N. T represents the multiplicative cyclic group of order prime number N.

[0049] S2: Calculate R1'=R 1^-1modN by the modular inverse operation unit;

[0050] Among them, mod represents the modulo operation, and it can be seen from this formula that R1*R1'=1.

[0051] S3: Calculate Q=[R1']P2 using the extended domain point multiplication operation unit;

[0052] Among them, P2 is the generator of group G2, and [R 1']P2 means P2 times R1'. Since R1 is a random number, it can be known from step S2 that R1' is also a random number. Therefore, Q is also a random number, and the obtained random number Q is used to replace P2 in the original extended domain point multiplication operation Ppub=[ks]P2.

[0053] S4: Calculate ks'=ks*R1modN by the modular multiplication unit;

[0054] Here, the formula means that ks'=ks*R 1, and the obtained ks' replaces ks in the original extended domain point product operation Ppub=[ks]P2.

[0055] S5: Calculate Ppub'=[ks']Q using the extended domain point multiplication operation unit;

[0056] It can be seen that, through the above sub-process, the present invention does not allow the signature master private key ks to participate in the extended domain multiplication operation in the SM9 standard process, but uses the randomized name master private key ks' to participate in the operation. This can reduce the number of times the signature master private key ks is used in the operation, thereby reducing the risk of leakage of the signature master private key ks.

[0057] like Figure 2 As shown, the base domain point multiplication operation involving the signature private key ds is replaced, that is, the operation t 2 = ks*t 1^-1modN in step A5 of the SM9 signature key generation algorithm and the operation ds = [t 2]P 1 in step A6 are replaced.

[0058] Therefore, the signature key generation method provided by the embodiment of the present invention further includes the following steps:

[0059] M3: Get the user ID and the one-byte signature private key generation function identifier hi d and concatenate them into Z=ID||hi d;

[0060] M4: Calculate t1=H1(Z,N)+ks in the finite field FN, where H1 is the cryptographic function;

[0061] M5: calculate t2'=ks*t1''mod N;

[0062] M6: Calculate the signature private key ds' = [t 2'] D;

[0063] like Figure 2 As shown, M5-M6 specifically include the following sub-steps:

[0064] S6: Obtain a random number R2 through a secure random number generator;

[0065] Same as S1, the random number R2 needs to be between [1, N-1], which will not be repeated here.

[0066] S7: Calculate t 1'=t 1*R2 mod N by the modular multiplication operation unit;

[0067] S8: Calculate t 1''=t 1'^-1mod N by the modular inverse operation unit;

[0068] S9: Calculate t 2'=ks*t 1''mod N by the modular multiplication operation unit;

[0069] Through S7~S9, the obtained t2' is randomized by R2 and will replace t2 in the original basis domain dot multiplication operation ds=[t 2]P 1.

[0070] S 10: Calculate D=[R2]P 1 using the base field point multiplication unit;

[0071] Among them, P1 is the generator of group G1, [R2]P1 means R2 times P1. Because R2 is a random number, D is also a random number, and the obtained D will replace P1 in the original basis domain dot multiplication operation ds=[t2]P1.

[0072] S 11: Calculate ds'=[t2']D using the base field point multiplication operation unit.

[0073] It can be seen from the above sub-process that the intermediate variable t2 does not participate in the modular inverse operation and base field point multiplication operation in the SM9 standard, and the randomized t2' is used to participate in the operation in the present invention. This can reduce the number of times the intermediate variable t2 is used in the operation, thereby reducing the risk of leakage of the intermediate variable t2, and further reducing the risk of leakage in the signature private key ds generation process, thereby enhancing the security of the key generation process.

[0074] In order to illustrate the feasibility of the signature key generation method provided by the embodiment of the present invention, further demonstration is given as follows.

[0075] 1) Replace ks' in step M2 of the private key protection method of the SM9 signature key generation algorithm to obtain Ppub' = [ks*R1]Q;

[0076] 2) Replace Q in the previous step and get Ppub' = [ks*R1]*[R1']P2

[0077] 3) That is, Ppub' = [ks*R1*R1']P2 = [ks]P2, and the result is consistent with the description of Ppub = [ks]P2 in the SM9 standard process;

[0078] 4) Replace D in step M6 of the private key protection method of the SM9 signature key generation algorithm to obtain ds'=[t2'*R2]P1;

[0079] 5) Replace t 2' in the previous step to obtain ds' = [ks*t 1''*R2]P 1;

[0080] 6) Replace t 1'' in the previous step to obtain ds' = [ks*t 1'^-1*R2]P 1;

[0081] 7) Replace t 1' in the previous step and obtain ds' = [ks*(t 1*R2)^-1*R2]P 1;

[0082] 8) From the previous step, we get ds' = [ks*t 1^-1*R2^-1*R2]P 1 = [ks*t 1^-1]P 1. Since t2 = ks*t1^-1mod N, the result is consistent with the description of step 6 of the original process, ds = [t2]P 1.

[0083] This shows that replacing the signature master public key and signature private key generation steps in Section 6.1 of GB / T 38635.2-2020 "Information Security Technology SM9 Cryptographic Algorithm Part 2: Algorithm" with the signature key generation method provided in the embodiment of the present invention will not affect the final signature private key calculation result, that is, the replacement method of the private key protection method provided by the present invention is feasible in principle.

[0084] In summary, the signature key generation method provided in the embodiment of the present invention includes protection of both the signature master private key and the signature private key.

[0085] The protection of the signature master private key is to first obtain a random number R1 between [1, N-1] through a secure random number generator, then use the modular inverse operation unit to calculate R1'=R 1^-1mod N, then use the extended domain point multiplication operation unit to calculate Q=[R1']P2, then use the modular multiplication operation unit to calculate ks'=ks*R1 mod N, and finally use the extended domain point multiplication operation unit to calculate Ppub'=[ks']Q. Through the above steps, the operation Ppub=[ks]P2 in the SM9 standard process can be replaced with Ppub'=[ks']Q, so that the randomized ks' can be used instead of the signature master private key ks for operation. In this way, the use of the signature master private key ks can be reduced, achieving the purpose of reducing the risk of leakage of the signature master private key ks.

[0086] The protection of the signature private key is to first obtain a random number R2 through a secure random number generator, then use the modular multiplication unit to calculate t1'=t1*R2modN, the modular inverse unit to calculate t1''=t1'^-1modN, and the modular multiplication unit to calculate t2'=ks*t1''modN, then use the base field point multiplication unit to calculate D=[R2]P1, and finally use the base field point multiplication unit to calculate ds'=[t2']D. Through the above steps, the operations t2=ks*t1^-1modN and ds=[t2]P1 in the SM9 standard process can be replaced by t2'=ks*t1''modN and ds'=[t2']D, and the randomized t2' can be used to replace the intermediate variable t 2. Using the randomized ds' to replace the signature private key ds for calculation can reduce the use of the intermediate variable t2 and prevent the leakage of t2 and the signature private key ds due to the public parameter P1. Therefore, the present invention uses this double random protection mechanism to further improve security.

[0087] The above is a detailed description of the signature key generation method based on the SM9 cryptographic algorithm provided by the present invention. For those skilled in the art, any obvious changes made to it without departing from the essence of the present invention will constitute an infringement of the patent right of the present invention and will bear corresponding legal responsibilities.

Claims

1. A signature key generation method based on the SM9 cryptographic algorithm, characterized in that The following steps are involved: M1: Generate a random number ks∈[1, N-1] as the signature master private key through KGC, where N is the order of the SM9 elliptic curve; M2: Calculate the element Ppub=[ks]P2 in the group G2 as the signature master public key, where the group G2 represents an additive cyclic group with an order of prime number N, and P2 is a generator of the group G2; wherein the following sub-steps are included: S1: Obtain a random number R1 through a secure random number generator; S2: Calculate R1'=R1^-1modN by a modular inverse operation unit; S3: Calculate Q=[R1']P2 by using an extended field point multiplication operation unit; S4: Calculate ; S5: use the extended domain point multiplication operation unit to calculate Ppub' = [ks'] Q; S6: obtain the random number R2 through a secure random number generator; S7: calculate by the modular multiplication operation unit ; S8: The modular inverse operation unit calculates t1'' = t1'^-1modN; S9: The modular multiplication operation unit calculates ; S10: using the base domain dot multiplication operation unit to calculate D = [R2] P1; S11: using the base domain dot multiplication operation unit to calculate ds' = [t2'] D; M3: Get the user ID and a one-byte signature private key generation function identifier hid and concatenate them into Z=ID||hid; M4: Calculate t1=H1(Z,N)+ks in the finite field FN, where H1 is the cryptographic function; M5: Calculation ; M6: Calculate the signature private key ds=[t2]P1, where P1 is the generator of group G1, and group G1 represents an additive cyclic group with an order of prime number N.

2. The method for generating a signature key based on the SM9 cryptographic algorithm according to claim 1, characterized in that: The random number R1 is between [1, N-1], and R1 is smaller than N.

3. The method for generating a signature key based on the SM9 cryptographic algorithm according to claim 1, wherein: The Q is a random number.

4. The method for generating a signature key based on the SM9 cryptographic algorithm according to claim 1, wherein: The random number R2 is between [1, N-1], and R2 is less than N.

Images