A non-interactive zero-knowledge proof method based on SM2 and SM3

Abstract

This invention relates to the field of cryptography, specifically to a non-interactive zero-knowledge proof method based on SM2 and SM3, comprising the following steps: For secret information of arbitrary length to be proven, a preprocessing step is performed to convert it into a private key from an SM2 public-private key pair; another public-private key pair is randomly generated in a non-interactive manner; SM3 hashing is performed based on the two public key information to generate challenge information; response information is calculated modulo SM2 elliptic curve order; the verifier calculates the challenge information based on the two public key information. The beneficial effects are: The non-interactive zero-knowledge proof method based on SM2 and SM3 proposed in this invention adopts a non-interactive approach, that is, the prover generates a random SM2 key pair and uses it to generate a corresponding challenge, hiding the possessed secret information in the challenge and the random SM2 private key, forming the output of the non-interactive zero-knowledge proof. No communication with the verifier is required during the challenge selection process, effectively reducing the communication volume and complexity of the zero-knowledge proof method.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cryptography, in particular to a non-interactive zero-knowledge proof method based on SM2 and SM3. BACKGROUND

[0002] Privacy computing is a technology and system for joint computing by two or more participants, and the participants cooperate to jointly machine learn and analyze their data without revealing their respective data. The participants in privacy computing can be different departments of the same institution or different institutions. Under the privacy computing framework, the data plaintext of the participants does not leave the local, and the multi-source data cross-domain cooperation is realized while the data security is protected, which can solve the problem of data protection and fusion application. Common technical paths for implementing privacy computing include federated learning, secure multi-party computation, trusted computing, etc., and in addition, blockchain is also an important supplement to privacy computing.

[0003] In the prior art, zero-knowledge proof technology, as a branch technology of privacy computing, was first proposed by Goldwasser in the 1980s, and the prover can make the verifier believe that a certain proposition is correct without providing any useful information to the verifier. Zero-knowledge proof is essentially a protocol involving two or more parties, that is, a series of steps taken by two or more parties to complete a task.

[0004] However, the zero-knowledge nature of zero-knowledge proof technology makes it widely used, such as in blockchain applications, zero-knowledge proof can be used as a tool in the privacy protection protocol of blockchain to prove certain knowledge that does not want to be disclosed between transaction parties; in identity authentication, it can prove that I have the private key corresponding to the public key without revealing the private key to complete identity authentication. The current construction of zero-knowledge proof is mostly based on lattice cryptography theory, which is relatively complex and inefficient, and does not meet the needs of real life. SUMMARY

[0005] The purpose of the present application is to provide a non-interactive zero-knowledge proof method based on SM2 and SM3 to solve the problems raised in the background art.

[0006] To achieve the above purpose, the present application provides the following technical solution: a non-interactive zero-knowledge proof method based on SM2 and SM3, the non-interactive zero-knowledge proof method comprising the following steps:

[0007] The secret information to be proved of any length is processed into a private key in a pair of SM2 public and private keys through a preprocessing link;

[0008] Another pair of public and private keys is randomly generated in a non-interactive manner;

[0009] generating challenge information according to two public key information;

[0010] calculating response information under the modulus of SM2 elliptic curve order;

[0011] The verifier calculates challenge information according to two public key information.

[0012] Preferably, the preprocessing link includes that the prover performs SM3 hash on secret information of an arbitrary length to obtain a hash value, and takes the hash value as a private key of the SM2 algorithm, and generates a point on an SM2 elliptic curve by the SM2 key generation algorithm from the private key, to obtain a pair of SM2 public and private keys.

[0013] Preferably, in a non-interactive manner, when another pair of public and private keys is randomly generated, the prover needs to prove possession of the private key.

[0014] Preferably, the challenge information generated by the SM3 hash hides the private key to be proved by the challenge and the randomly generated private key.

[0015] Preferably, when the response information is calculated under the modulus of the SM2 elliptic curve order, the two public keys and the response information are taken as the output of the non-interactive zero-knowledge proof method and are transmitted to the verifier.

[0016] Preferably, when the verifier calculates challenge information according to two public key information, a point on the SM2 elliptic curve is calculated according to the response information, and it is judged whether the point is equal to the point calculated by the two public keys and the challenge, if equal, the verifier accepts, indicating that the prover successfully proves that he possesses the secret information and is accepted by the verifier, otherwise, the prover fails to prove, and the verifier refuses to accept.

[0017] Compared with the prior art, the present application has the following beneficial effects:

[0018] The non-interactive zero-knowledge proof method based on SM2 and SM3 adopts a non-interactive idea, that is, the prover generates a random SM2 key pair, and hides the secret information in the challenge and the random SM2 private key to form the output of the non-interactive zero-knowledge proof, and communication with the verifier is not required in the process of selecting the challenge, thereby effectively reducing the communication amount and complexity of the zero-knowledge proof method and improving the communication efficiency of the method. -256 The present application has a small reliability error of 2 , and can be executed in one round, which is lower in complexity than multi-round zero-knowledge proof calculation; the present application has been verified by experiments, and can generate a proof of 160KB in size in less than 1 millisecond, which is highly practical and can be efficiently applied in a blockchain or a privacy computing platform. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1The flowchart of the method of the present application. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solutions of the present application clear, complete and the advantages more clear and obvious, the embodiments of the present application are further described in detail below in combination with the drawings. It should be understood that the specific embodiments described here are part of the embodiments of the present application, not all embodiments, and are only used to explain the embodiments of the present application, and do not limit the embodiments of the present application. All other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0021] Embodiment one

[0022] Please refer to Figure 1 The present application provides a technical solution: a non-interactive zero-knowledge proof method based on SM2 and SM3, the non-interactive zero-knowledge proof method comprising the following steps:

[0023] For any length of secret information to be proved, it is processed into a private key in a pair of SM2 public and private keys through a preprocessing link; the preprocessing link includes that the prover performs SM3 hash on the secret information of any length to obtain its hash value, and takes the hash value as the private key of the SM2 algorithm, and generates a point on the SM2 elliptic curve by the SM2 key generation algorithm from the private key, to obtain a pair of SM2 public and private keys;

[0024] Another pair of public and private keys is randomly generated in a non-interactive manner; the prover needs to prove possession of the private key;

[0025] SM3 hash is generated according to the two public key information to generate challenge information; the challenge information generated by SM3 hash and the randomly generated private key are used to hide the private key to be proved;

[0026] The response information is calculated under the modulus SM2 elliptic curve order; the two public keys and the response information are transmitted to the verifier as the output of the non-interactive zero-knowledge proof method;

[0027] The verifier calculates the challenge information according to the two public key information; the point on the SM2 elliptic curve is calculated according to the response information, and it is judged whether the point is equal to the point calculated by the two public keys and the challenge, if equal, the verifier accepts, indicating that the prover successfully proves that he possesses the secret information and is accepted by the verifier, otherwise, the prover fails to prove, and the verifier refuses to accept.

[0028] Embodiment two

[0029] On the basis of embodiment one, in order to describe clearly, first, the notations, abbreviations and symbols used in the present application are explained:

[0030] s: secret information owned by the prover, arbitrary length string;

[0031] sk: SM2 private key;

[0032] pk: SM2 public key;

[0033] G: base point of the elliptic curve;

[0034] [k]·P: k times point of point P on the elliptic curve;

[0035] x||y: concatenation of x and y, where x, y can be bit strings or byte strings;

[0036] n: order of the elliptic curve;

[0037] Reference Figure 1 , implement a non-interactive zero-knowledge proof method based on SM2 and SM3, including the following steps:

[0038] Step 101, the prover owns an arbitrary length secret information s, does SM3 hash on it to get sh = SM3(s), and takes the hash value as the SM2 private key sk1 = sh;

[0039] Step 102, the prover generates a corresponding public key pk1 by calling the SM2 key generation algorithm according to the private key sk1, and gets the key pair (sk1, pk1);

[0040] Step 103, the prover randomly generates a new pair of public and private keys (sk2, pk2) by calling the SM2 key generation algorithm again, if sk1≠sk2, step 104 is executed, otherwise step 103 is repeated until sk1≠sk2 is met;

[0041] Step 104, concatenate the two public keys pk1 and pk2 to do SM3 hash to get the challenge c = SM3(pk1||pk2);

[0042] Step 105, calculate z = sk2 + c·sk1 (mod n), where n is the order of the SM2 elliptic curve;

[0043] Step 106, the prover sends (pk1||pk2||z) as the output of the proof, which is 160 bytes, to the verifier;

[0044] Step 107, the verifier receives the 160-byte string, and takes 64 bytes, 64 bytes, and 32 bytes as pk1', pk2', and z', respectively;

[0045] Step 108, the verifier calculates the challenge c' = SM3(pk1'||pk2');

[0046] Step 109, the verifier takes z' as a private key sk'=z', and generates a corresponding public key pk' according to the SM2 key generation algorithm;

[0047] Step 110, the verifier judges whether pk' is equal to pk2'+[c']·pk1', if yes, the verifier accepts the proof, otherwise, the verifier rejects the acceptance.

[0048] A non-interactive zero-knowledge proof method based on SM2 and SM3, the prover pre-processes the secret information of any length to be proved by SM3 hash algorithm as the private key of SM2, and maps it to the SM2 elliptic curve, so that the prover converts the secret information to be proved into the private key of the SM2 algorithm to be proved, the pre-processing method efficiently converts the secret information of any length into the private key satisfying the multiple point equation on the SM2 elliptic curve, effectively widening the length and optional range of secret information in zero-knowledge proof; the method adopts the idea of non-interactive, that is, the prover generates a random SM2 key pair and generates a corresponding challenge with it, hides the secret information in the challenge and the random SM2 private key, forms the output of the non-interactive zero-knowledge proof, and does not need to communicate with the verifier in the process of selecting the challenge, effectively reducing the communication amount and complexity of the zero-knowledge proof method, and improving the communication efficiency of the method; the present application has a small reliability error -256 , and can be executed in one round, which is lower in calculation complexity than multi-round zero-knowledge proof; the present application has been verified by experiment, and can generate a proof of 160KB size in less than 1ms, which is high in practicability and can be efficiently applied in a blockchain or a privacy computing platform.

[0049] Although the embodiments of the present application have been shown and described, it can be understood by those of ordinary skill in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A non-interactive zero-knowledge proof method based on SM2 and SM3, characterized in that: The non-interactive zero-knowledge proof method includes the following steps: For any length of secret information to be proven, after preprocessing, it is converted into a private key in an SM2 public-private key pair. The prover has any length of secret information s, performs SM3 hashing on it, and obtains sh = SM3(s), and uses the hash value as the SM2 private key sk1 = sh. The prover calls the SM2 key generation algorithm based on the private key sk1 to generate the corresponding public key pk1, and obtains the key pair (sk1, pk1). The prover uses a non-interactive method to randomly generate another public-private key pair (sk2, pk2); The challenge information is generated by performing an SM3 hash based on the two public key information. The two public keys pk1 and pk2 are concatenated and then subjected to an SM3 hash to obtain the challenge c = SM3(pk1||pk2). The response information is calculated in the modulo SM2 elliptic curve order, and z = sk2 + c·sk1 (mod n) is calculated, where n is the order of the SM2 elliptic curve. The prover sends pk1, pk2, and z as the output of the proof, i.e., (pk1||pk2||z) totaling 160 bytes, to the verifier. The verifier calculates the challenge information based on the two public key information. After receiving the 160-byte string, the verifier uses 64 bytes, 64 bytes, and 32 bytes as pk1′, pk2′, and z′ respectively. The verifier calculates the challenge c′=SM3(pk1′||pk2′). The verifier uses z′ as the private key sk′=z′ and generates the corresponding public key pk′ according to the SM2 key generation algorithm. The verifier determines whether pk′ is equal to pk2′+[c′]·pk1′. If they are equal, the verifier accepts the proof; otherwise, the verifier rejects it.

2. The non-interactive zero-knowledge proof method based on SM2 and SM3 according to claim 1, characterized in that: The preprocessing stage includes the prover performing SM3 hashing on secret information of arbitrary length to obtain its hash value, and using the hash value as the private key of the SM2 algorithm. The private key is then used to generate a point on the SM2 elliptic curve through the SM2 key generation algorithm to obtain a pair of SM2 public and private keys.

3. The non-interactive zero-knowledge proof method based on SM2 and SM3 according to claim 1, characterized in that: When another public-private key pair is randomly generated in a non-interactive manner, the prover needs to prove that they possess the private key.

4. The non-interactive zero-knowledge proof method based on SM2 and SM3 according to claim 1, characterized in that: The challenge information is generated using SM3 hashing, and the randomly generated private key is used to hide the private key to be proven.

5. The non-interactive zero-knowledge proof method based on SM2 and SM3 according to claim 1, characterized in that: When computing the response information under the modulo SM2 elliptic curve order, the two public keys and the response information are passed to the verifier as the output of the non-interactive zero-knowledge proof method.

6. The non-interactive zero-knowledge proof method based on SM2 and SM3 according to claim 1, characterized in that: When the verifier calculates the challenge information based on the two public key information, it calculates the point on the SM2 elliptic curve based on the response information and determines whether the point is equal to the point calculated by the two public keys and the challenge. If they are equal, the verifier accepts it, indicating that the prover has successfully proven that he has the secret information and that it is accepted and recognized by the verifier. Otherwise, the prover fails to prove it and the verifier rejects it.

Images