Strong forward-secure two-party co-signature method based on SM2

Abstract

One technical scheme of the present application provides a strong forward security two-party joint signature method based on SM2. Another technical scheme of the present application provides a method for cooperatively generating a signature. Another technical scheme of the present application provides a private key updating method. The present application proposes a method in which each member can act as a secret share distributor, removes the trusted center, has the ability of anti-supervision group management, and has a server and user two-way authentication, ensures the information integrity and validity when generating a signature, and has the ability of periodically updating the private key held by the member. Under the above conditions, the scheme ensures the forward security and backward security.

Description

Technical Field

[0001] This invention relates to a dynamic strong forward security signature method based on Shamir, belonging to the field of network information security, and the core of cryptography: digital signatures. Background Technology

[0002] As the network environment becomes more international and open, network security issues are becoming increasingly prominent. People are also becoming more sensitive to information and data leaks and breaches of data integrity. To ensure the integrity of user information is not compromised, digital signature technology from modern cryptography is needed. The rapid development of the internet has spurred the widespread application of digital signature technology, and many new algorithms have been developed to meet the needs of digital signatures in specific fields. However, many technical challenges remain in digital signature implementation.

[0003] (1) Standardization issues

[0004] (2) Trust issues (certification authorities and trusted centers)

[0005] (3) Identification and certification issues

[0006] (4) Document display issues

[0007] (5) Registration and authentication issues

[0008] In the SM2 scheme, due to algorithmic limitations, a key distributor (trusted center) must exist, and the server must provide digital certificate support to allow the server to authenticate users for the scheme to function properly. Currently, the scheme lacks forward and backward security for members' private key updates. Summary of the Invention

[0009] The technical problem this invention aims to solve is that, in the SM2 scheme, due to algorithmic limitations, a key distributor (trusted center) must exist, and the server must provide digital certificate support to allow the server to authenticate users in order for the scheme to be complete. In the current scheme, the private key updates of members lack forward and backward security.

[0010] To address the aforementioned technical problems, one technical solution of this invention is to provide a strong forward security two-party joint signature method based on SM2. The method is characterized by having two signing roles, Alice and Bob, and is divided into a key generation protocol, a key update protocol, and a signature protocol. Alice is denoted as A, and Bob as B, then:

[0011] The implementation of the key generation protocol includes the following steps:

[0012] Initialize the algorithm by inputting security parameters:

[0013] Setup(λ) → params = (p, a, b, C, q)

[0014] and generate the master secret α, which is composed of sub - secrets and sub - secrets and α < q, where Setup(λ) represents the initialization algorithm, p is a large prime number, F p is a finite field, the generator on F p is g, a, b ∈ F p as the parameters of the elliptic curve E selected by the two parties in the scheme, define C as a point on the elliptic curve;

[0015] A 101 : Alice randomly selects two elements a ia (i = 1, 2), sub - secrets satisfying the following formula:

[0016]

[0017] a ia (i = 1, 2) ∈ F p

[0018] A 102 : Alice calculates the secret share for Bob and retains

[0019] A 103 : Calculate the verification information Alice sends the set to Bob, where, represents the power of the secret share selected by Alice for Bob to receive parameter verification, represents the power of the parameter for splitting the secret share selected by Alice for Bob to receive parameter verification;

[0020] B 101 : After Bob receives he verifies the correctness according to If the verification is correct, it passes and the next step can be performed; otherwise, it is rejected;

[0021] B 102 : Bob calculates his personal private key sk B his personal public key pk B and the common public key pk, the common private key sk;

[0022] B 103 : Bob randomly selects two elements a i (i = 1, 2), sub - secrets selecting the parameter range to meet the requirements of step A 101Calculate the secret share for Alice And retain

[0023] B 104 Calculate verification information Bob will The set is sent to Alice, where, This represents the power of the secret share chosen by Bob, used by Alice to verify the received parameters. This represents the power of the secret share parameter selected by Bob, used for Alice to verify the received parameters;

[0024] A 104 Alice received Bob's message. Afterwards, according to Verify its correctness. If it is correct, pass and proceed to the next step; otherwise, reject.

[0025] A 105 Alice calculates her private key sk A Personal public key PK A The shared public key pk and shared private key sk will be sent to Bob;

[0026] Alice storage (sk A ,sk,pk,pk B Bob storage (sk) B ,pk,pk A );

[0027] The implementation of the signature protocol includes the following steps:

[0028] A 201 Alice selects random numbers. Calculate R A and R' A and R A and R' A Send to Bob, where R A This indicates Change_A(k) A →R A The parameters are passed in by Alice. The calculated value of the exchange verification parameter, R' A This indicates Change_A(k) A ,pk B )→R' A The parameter is passed in by Alcie. with PK B The calculated values ​​of the exchange verification parameters;

[0029] B 201Bob received R A and R' A Next, verify its correctness. If the verification is correct, proceed to the next step; otherwise, terminate the signature generation process. Bob selects a random number. And calculate R B and R' B Send to Alice, where R B This indicates Change_B(k) B →R B The parameter is passed in by Bob. The calculated value of the exchange verification parameter, R' B This indicates Change_B(k) B ,pk A )→R' B The parameter is passed in by Bob. with PK A The calculated values ​​of the exchange verification parameters;

[0030] A 202 Alice received R B and R' B Next, its correctness is verified. If the verification fails, the signature operation is terminated. If the verification is successful, the group elements R', r, and s' are calculated, and s' is sent to Bob, where R' represents R. A +R B →R received by each of (x1, y1) A With R B The summation, where r represents the signature parameters generated by Alice, and s' represents... These are the parameters of the exchange verification signature that Alice calculated for Bob;

[0031] B 202 Bob calculates t' after receiving s'. Send t' to Alice, where t' represents s'+k. B →t' receives s' and selects k B The sum of Indicates substituting x B The Lagrange difference theorem allows this parameter to be included in the signature so that the verifier can verify the correctness of the signature;

[0032] A 203 Alice received t' calculation Given s and t, output the signature σ(r,s). Indicates substituting x AThe Lagrange difference theorem allows the signature to include this parameter so that the verifier can verify the correctness of the signature. `s` represents Sign(t,r)→σ(r,s), which is part of the final generated signature parameters. `t` represents... These are some of the parameters in the signature;

[0033] The implementation of the key update protocol includes the following steps:

[0034] Since Alice initiates the signature request, she must first perform the key update operation. Let the update time period be T, then:

[0035] A 301 Alice randomly selects two elements a. i (i = 1, 2) Select a range that satisfies the initial conditions, and calculate the key update factor. Verification information as well as Update the verification information factor and Send to Bob, where, express The first part of the verification parameters for the secret share of the update factor calculated by Alice. express The second part of the verification parameters for the secret share of the update factor calculated by Alice;

[0036] B 301 Bob receives the update factor and verification information and verifies their correctness. If correct, he proceeds to the next step; otherwise, he rejects the update operation. Bob randomly selects two elements a. i (i = 1, 2) Select a range that satisfies the initial conditions, and calculate the key update factor. Verification information as well as Update the verification information factor and Send to Alice, where, express The first part of the verification parameters for the secret share of the update factor calculated by Alice. express Alice calculates the second part of the verification parameters for the secret share of the update factor; Bob calculates the personal private key for time period T.

[0037] A 302 After receiving the update factor and verification information, Alice verifies their correctness. If the verification is correct, she proceeds to the next step; otherwise, she rejects the key update operation. Alice then calculates her personal private key for time period T.

[0038] Another technical solution of the present invention provides a method for collaborative signature generation, characterized by implementing the signature protocol based on the aforementioned strong forward security two-party joint signature method, based on a C / S architecture, and completed by Alice and Bob through mutual operation; Alice is regarded as the client and Bob as the server. Alice calculates the signature parameters and sends them to Bob; after verifying the correctness of the content transmitted by Alice, Bob calculates Bob's collaborative signature parameters and sends them to Alice; Alice verifies the correctness of the message sent by Bob to prevent attackers from tampering with or impersonating Bob's identity; after both parties verify the correctness of their identities, they will generate signature elements for each other, and finally Alice generates the final signature σ(r,s); when the verifier receives the signature σ(r,s) for message M, it uses the group public key PK to verify the correctness of the signature.

[0039] Another technical solution of the present invention provides a method for updating a private key, characterized by implementing the key update protocol based on the aforementioned strong forward security two-party joint signature method. Alice initiates the signature request, therefore Alice performs the key update operation first. Let the update time period be T. During the update period T, Alice and Bob calculate the secret share for time T based on the secret share for time T-1 and perform private key calculation, while ensuring that the public key remains unchanged.

[0040] Alice randomly selects two elements a. i (i = 1, 2), and satisfy the initial conditions, according to Calculate the update factor And update factor Send to Bob, broadcast Set up and calculate broadcast verification information. as well as Bob received a message from Alice. According to the broadcast message Verify its accuracy to ensure that the information has not been tampered with.

[0041] The newly generated private key can still be signed and verified according to the signing process. The group public key remains unchanged during the update, so the signature from before the update can still be verified. However, the updated private key cannot forge the signature from before the update, ensuring forward security. Of course, an attacker cannot forge the subsequent private key using the current private key, ensuring backward security. Therefore, the scheme has strong forward security.

[0042] This invention proposes a scheme in which each member can act as a secret share distributor, eliminating the trusted center, possessing the ability to manage anti-supervised groups, and having built-in server-user two-way authentication to ensure the integrity, freshness, and validity of information when generating signatures. Members also have the ability to periodically update their private keys. Under these conditions, the scheme simultaneously ensures forward security and backward security. Attached Figure Description

[0043] Figure 1 It is a finite state machine for Alice key generation;

[0044] Figure 2 It is a Bob key generation finite state machine;

[0045] Figure 3 It is the Alice digital signature finite state machine;

[0046] Figure 4 It is Bob's digital signature finite state machine;

[0047] Figure 5 It is a finite state machine for Alice key updates;

[0048] Figure 6 It is Bob's key update finite state machine. Detailed Implementation

[0049] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0050] The strong forward security two-party joint signature method based on SM2 disclosed in this invention has advantages such as high efficiency in secret share distribution, member private key update, and elliptic discrete curve scalar multiplication on SM2. In the method disclosed in this invention, Alice (also denoted as A) and Bob (also denoted as B) are designated as the two signing parties, and the method is divided into three protocols: key generation, key update, and signature. Here, p is defined as a large prime number, and F... p For a finite field, F p The generators on x are g and x A x B x is a non-zero constant. i ∈F p (i∈A, B), two elements a N (N = A, B), a, b ∈ F pAs the parameters of the elliptic curve E selected by both parties in the scheme, define C as a point on the elliptic curve and serve as the generator of the group G, q as the order of G, H as the hash algorithm, and publicly disclose p, g, x i , a, b.

[0051] I) Key Generation Protocol

[0052] The initialization algorithm inputs the security parameter:

[0053] Setup(λ) → params = (p, a, b, C, q)

[0054] And generate the master secret α, which is composed of the sub - secrets and the sub - secret and α < q, where Setup(λ) represents the initialization algorithm.

[0055] A1: Alice randomly selects two elements a ia (i = 1, 2), sub - secrets satisfying the following formula:

[0056]

[0057] a ia (i = 1, 2) ∈ F p

[0058] A2: Alice calculates the secret share for Bob and retains

[0059] A3: Calculate the verification information Alice sends the set to Bob, where represents the power of the secret share selected by Alice for Bob to verify the received parameters, represents the power of the split secret share parameter selected by Alice for Bob to verify the received parameters.

[0060] B1: After Bob receives he verifies the correctness according to If the verification is correct, it passes and the next step can be performed; otherwise, it is rejected.

[0061] B2: Bob calculates his personal private key sk B , his personal public key pk B and the common public key pk, the common private key sk.

[0062] B3: Bob randomly selects two elements a i (i = 1, 2), sub - secrets Select parameters that satisfy A1 to calculate the secret share for Alice. And retain

[0063] B4: Calculate verification information Bob will The set is sent to Alice, where, This represents the power of the secret share chosen by Bob, used by Alice to verify the received parameters. This represents the power of the secret share parameter selected by Bob, used for Alice's parameter verification.

[0064] A4: Alice received Bob's message. Afterwards, according to Verify its correctness. If it is correct, the operation is passed and the next step can be performed; otherwise, it is rejected.

[0065] A5: Alice calculates her private key sk A Personal public key PK A The shared public key pk and shared private key sk will be sent to Bob.

[0066] Alice storage (sk A ,sk,pk,pk B Bob storage (sk) B ,pk,pk A ).

[0067] (ii) Digital Signature Protocol

[0068] A1: Alice selects a random number. Calculate R A and R' A and R A and R' A Send to Bob, where R A This indicates Change_A(k) A →R A The parameters are passed in by Alice. The calculated value of the exchange verification parameter, R' A This indicates Change_A(k) A ,pk B )→R' A The parameter is passed in by Alcie. with PK B The calculated values ​​of the exchange verification parameters.

[0069] B1: Bob received R A and R' ANext, verify its correctness. If the verification is correct, proceed to the next step; otherwise, terminate the signature generation process. Bob selects a random number. And calculate R B and R' B Send to Alice, where R B This indicates Change_B(k) B →R B The parameter is passed in by Bob. The calculated value of the exchange verification parameter, R' B This indicates Change_B(k) B ,pk A )→R' B The parameter is passed in by Bob. with PK A The calculated values ​​of the exchange verification parameters.

[0070] A2: Alice received R B and R' B Next, its correctness is verified. If the verification fails, the signature operation is terminated. If the verification is successful, the group elements R', r, and s' are calculated, and s' is sent to Bob, where R' represents R. A +R B →R received by each of (x1, y1) A With R B The summation, where r represents the signature parameters generated by Alice, and s' represents... These are the parameters of the exchange verification signature that Alice calculated for Bob.

[0071] B2: After Bob receives s', he calculates t' and... Send t' to Alice, where t' represents s'+k. B →t' receives s' and selects k B The sum of Indicates substituting x B The Lagrange difference theorem allows this parameter to be included in the signature so that the verifier can verify the correctness of the signature.

[0072] A3: Alice receives t' calculation Given s and t, output the signature σ(r,s). Indicates substituting x A The Lagrange difference theorem allows the signature to include this parameter so that the verifier can verify the correctness of the signature. `s` represents Sign(t,r)→σ(r,s), which is part of the final generated signature parameters. `t` represents... These are some of the parameters for the signature.

[0073] (iii) Key Update Protocol

[0074] The scheme begins with Alice initiating the signature request, therefore Alice will first perform the key update operation. Let the update time period be T, and the detailed steps are as follows:

[0075] A1: Alice randomly selects two elements a. i (i = 1, 2) Select a range that satisfies the initial conditions, and calculate the key update factor. Verification information as well as Update the verification information factor and Send to Bob, where, express The first part of the verification parameters for the secret share of the update factor calculated by Alice. express The second part of the verification parameters for the secret share of the update factor calculated by Alice.

[0076] B1: After receiving the update factor and verification information, Bob verifies their correctness. If correct, he proceeds to the next step; otherwise, he rejects the update operation. Bob randomly selects two elements a. i (i = 1, 2) Select a range that satisfies the initial conditions, and calculate the key update factor. Verification information as well as Update the verification information factor and Send to Alice, where, express The first part of the verification parameters for the secret share of the update factor calculated by Alice. express The second part of the verification parameters for the update factor secret share calculated by Alice. Bob calculates the personal private key for time period T.

[0077] A2: After receiving the update factor and verification information, Alice verifies their correctness. If the verification is correct, she proceeds to the next step; otherwise, she rejects the key update operation. Alice calculates her personal private key for time period T.

[0078] Figure 1 Generate a finite state machine diagram for Alice's key. This diagram includes Alice sending initialization parameters and then waiting for Bob to generate parameters. The diagram also includes Alice verifying the correctness of the parameters sent by Bob. If the verification fails, Alice continues to wait for Bob's correct parameters.

[0079] Figure 2 Generate a finite state machine diagram for Bob's key. Bob receives the parameters of Alice's initialization operation and verifies their correctness. If the verification fails, the process exits. Otherwise, Bob calculates the key parameters and sends them to Alice.

[0080] Figure 3 The diagram shows the finite state machine for Alice's digital signature. This operation waits for the system's Alice digital signature instruction. After receiving the Alice instruction, it calculates the parameters and sends them to Bob, and waits for Bob to verify and send the calculated parameters. After receiving the signature parameters sent by Bob, it performs a correctness verification. If the verification is correct, it calculates the next stage signature parameters, sends them to Bob, and waits for Bob's calculation parameter t'. After receiving t' sent by Bob, Alice calculates the signature and outputs it.

[0081] Figure 4 This is a finite state machine diagram for Bob's digital signature. This operation waits for parameters sent by Alice, verifies the correctness of the signature parameters sent by Alice, and if correct, calculates the signature parameters and sends them to Alice; otherwise, it rejects the signature parameter generation operation.

[0082] Figure 5 The finite state machine diagram for Alice's key is updated. After T cycles, Alice reselects the initial parameters, calculates the secret share for Bob, sends the secret share to Bob, and enters the waiting state for Bob to calculate the parameters. After receiving the parameters sent by Alice, Alice verifies the correctness of the parameters. If the parameters are correct, she performs the key update calculation and outputs the updated key. If the parameters are incorrect, she exits.

[0083] Figure 6 Update the finite state machine diagram for Bob's key. Bob waits for the key update parameters calculated during the AliceT period and verifies their correctness. If correct, he calculates the key update parameters and outputs the updated key. If incorrect, he exits.

Claims

1. A method for SM2-based strong forward-secure two-party co-signature, characterized in that, There are two signature roles of Alice and Bob, which are divided into key generation protocol, key update protocol and signature protocol. Alice is denoted as A and Bob is denoted as B. The key generation protocol includes the following steps: The implementation of the key generation protocol includes the following steps: The initialization algorithm inputs the security parameters: Setup (λ)→params=(p,a,b,C,q) and a master secret α, which is composed of the sub-secrets and the sub-secrets and α<q, wherein Setup(λ) represents an initialization algorithm, p is a large prime number, F p is a finite field, and the generator on F p is g, and a, b∈F p are parameters of an elliptic curve E selected by two parties in the scheme, and C is defined as a point on the elliptic curve. A 101 : Alice randomly selects two elements a ia (ia=1,2), a sub-secret satisfies the following equation: a ia (ia = 1,2) e F p A 102 : Alice computes a secret share for Bob and retains A 103 : computing verification information Alice sends to Bob a set of , where represents the power of the secret share chosen by Alice for Bob to receive parameter verification, represents the power of the split secret share parameter chosen by Alice for Bob to receive parameter verification; B 101 : Bob receives : Bob receives : Bob receives : Bob receives B 102 : Bob computes personal private key sk B , personal public key pk B and common public key pk, common private key sk; B 103 : Bob randomly selects two elements a i (i = 1, 2), sub-secret Select parameter range to meet step A 101 , calculate the secret share for Alice and keep B 104 : compute verification information Bob sends to Alice a set of , where represents the power of the secret share chosen by Bob for Alice to receive parameter verification, represents the power of the split secret share parameter chosen by Bob for Alice to receive parameter verification; A 104 : Alice receives Bob's , and verifies its correctness according to . If the verification is correct, it passes and the next operation can be performed, otherwise it is rejected. A 105 : Alice computes personal private key sk A , personal public key pk A and common public key pk, common private key sk, to be sent to Bob; Alice storage (sk A ,sk,pk,pk B Bob storage (sk) B ,pk,pk A ); The implementation of the signature protocol includes the following steps: A 201 : Alice picks a random number Computes R A and R' A and sends R A and R' A to Bob, where R A represents Change_A(k A )→R A , the value of the exchange verification parameter computed by Alice taking in the parameter R' A represents Change_A(k A , pk B )→R' A , the value of the exchange verification parameter computed by Alice taking in the parameter and pk B ; B 201 : Bob receives R A and R' A , verifies its correctness, if correct, proceeds to the next step, if not, terminates the signature generation; Bob selects a random number and computes R B and R' B and sends to Alice, wherein R B denotes Change_B(k B )→R B , a value of the exchange verification parameter computed by Bob with the parameter , R' B denotes Change_B(k B , pk A )→R' B , a value of the exchange verification parameter computed by Bob with the parameter and pk A ; A 202 Alice received R B and R' B Next, its correctness is verified. If the verification fails, the signature operation is terminated. If the verification is successful, the group elements R', r, and s' are calculated, and s' is sent to Bob, where R' represents R. A +R B →R received by each of (x1, y1) A With R B The summation, where r represents the signature parameters generated by Alice, and s' represents... These are the parameters of the exchange verification signature that Alice calculated for Bob; B 202 : Bob computes t' = s' + k after receiving s' sends t' to Alice, where t' represents s' + k B → t' receives s' and adds it to the k he chose, B represents the Lagrange difference theorem with x B included in the signature to facilitate the verifier's verification of the signature's correctness;​ A 203 : Alice receives t' computation s, t, output signature σ(r,s), denotes the Lagrange difference theorem with x A included in the signature to facilitate verification of the signature's correctness by the verifier, s denotes Sign(t,r)→σ(r,s), is the part of the last generated signature parameter, t denotes is the part of the signature parameter; The implementation of the key update protocol includes the following steps: The signature request is initiated by Alice, so Alice first performs the key update operation. Assuming that the update time period is T, then: A 301 : Alice randomly selects two elements a i (i = 1, 2) satisfying the initial condition selection range, and calculates the key update factor authentication information and The authentication information update factor and is sent to Bob, wherein, represents the first part of the verification parameter of the update factor secret share calculated by Alice, represents the second part of the verification parameter of the update factor secret share calculated by Alice; B 301 : Bob receives the update factor and the verification information, and verifies its correctness. If correct, it proceeds to the next step, and if incorrect, it rejects the update operation; Bob randomly selects two elements a i (i = 1, 2) that satisfy the initial condition selection range, and calculates the key update factor Verification information And The verification information update factor And Send to Alice, wherein, Indicates The first part of the verification parameter of the update factor secret share calculated by Alice, Indicates The second part of the verification parameter of the update factor secret share calculated by Alice; Bob calculates the T period personal private key A 302 : Alice receives the update factor and the verification information, verifies the correctness, and if the verification is correct, proceeds to the next step, otherwise rejects the key update operation; Alice calculates the T period personal private key 2. A method of collaboratively generating a signature, the method comprising: The signature protocol implementation in the strong forward security two-party joint signature method based on claim 1 is implemented based on the C / S architecture and is completed by the mutual operation of Alice and Bob. Alice is regarded as a client and Bob is regarded as a server. Alice calculates the signature parameters and sends them to Bob. Bob verifies the correctness of the transmission content of Alice, calculates the cooperative signature parameters of Bob and sends them to Alice. Alice verifies the correctness of the message sent by Bob to prevent attackers from tampering or impersonating Bob. After the identity of both parties is verified, the signature elements are generated by each other, and finally the final signature σ(r,s) is generated by Alice. When the verifier receives the signature σ(r,s) of the message M, the correctness of the signature is verified using the group public key PK.

3. A method of private key update, the method comprising: The key update protocol implementation in the strong forward security two-party joint signature method based on claim 1 is initiated by Alice, so Alice first performs the key update operation. Assuming that the update time period is T, during the update period T, Alice and Bob calculate the secret share of the T period based on the secret share of the T-1 period and perform private key calculation, and ensure that the public key remains unchanged: Alice randomly selects two elements a i (i = 1, 2) and satisfies the initial condition, according to Compute update factor And send the update factor To Bob, broadcast Set, and calculate broadcast verification information And Bob receives the Alice sent According to the broadcast message Verify its correctness to ensure that the information has not been tampered with.

Images