A certificateless signcryption generation method and system based on SM2 algorithm

Abstract

The present application relates to a certificateless signcryption generation method and system based on the SM2 algorithm. The method includes the following steps: system initialization, partial public key and partial private key extraction, secret value setting, public key setting, private key setting, signcryption, and de-signcryption. The signcryption generation method is based on a certificateless cryptographic system in which users do not need to know the certificates and status of others, thereby simplifying certificate management. The user's private key consists of a partial private key generated by a key generation center and the user's secret value, thus eliminating the key escrow issue. The method of the present application, based on the ciphertext and signature structure of the SM2 algorithm, solves the key escrow issue in identity-based cryptographic systems and the certificate management issue in traditional public key cryptographic systems. It simultaneously completes data encryption and signing in a single logical step, reducing computational complexity and improving practicality while ensuring security.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a certificateless signcryption generation method and system based on the SM2 algorithm. Background Art

[0002] Signcryption can simultaneously encrypt and sign data in a single logical step, at a fraction of the cost of the traditional "sign first, then encrypt" approach. Therefore, it can be flexibly applied to applications involving lightweight devices. Existing signcryption schemes are generally based on traditional public-key cryptography or identity-based cryptography. The former presents complex certificate management issues, while the latter suffers from inherent key escrow issues, reducing the practicality of signcryption schemes. Summary of the Invention

[0003] In order to overcome at least one deficiency in the prior art, the present application provides a certificateless signcryption generation method and system based on the SM2 algorithm.

[0004] In a first aspect, a certificateless signcryption generation method based on the SM2 algorithm is provided, comprising:

[0005] The key generation center generates system parameters and master keys based on security parameters, publishes system parameters to all users in the system, and keeps the master keys secret;

[0006] The key generation center outputs a partial public key and a partial private key corresponding to the user ID based on the system parameters, the master key and the user ID of each user;

[0007] Each user selects a secret value based on system parameters and stores it secretly;

[0008] Each user sets the user's public key based on system parameters, the user's secret value and part of the public key;

[0009] Each user sets the user's private key based on the user's secret value and part of the private key;

[0010] The sender outputs the signcrypted ciphertext based on the system parameters, plaintext data, the receiver’s user ID and public key, and the sender’s private key;

[0011] The receiver decrypts and verifies the signcrypted ciphertext based on the system parameters, the signcrypted ciphertext, the sender's user ID, the sender's public key, and the receiver's private key. If the verification succeeds, the receiver obtains the plaintext data and the sender's signature on the plaintext data. If the verification fails, the receiver refuses to receive the data.

[0012] In one embodiment, the key generation center generates system parameters and a master key based on the security parameters, publishes the system parameters to all users in the system, and secretly stores the master key, including:

[0013] Input security parameter λ;

[0014] The key generation center selects a random number α, is a set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; calculate the master public key P pub , P pub =αP, where P is a generator of the group G, which is an additive cyclic group of order q; select a key derivation function KDF and a cryptographic hash function h;

[0015] Output system parameters params, params = {G, q, P, P pub ,KDF,h}, secretly save the master key msk, msk=α.

[0016] In one embodiment, the key generation center outputs a partial public key and a partial private key corresponding to the user identifier based on the system parameters, the master key, and the user identifier of each user, including:

[0017] Input system parameters params, master key msk and user ID, ID∈{0,1} * ;

[0018] Choose a random number r ID , is a set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; calculate the partial public key R ID , R ID =r ID P and part of the private key d ID , d ID =r ID +msk·h(ID||R ID ); where P is the generator of group G, group G is an additive cyclic group of order q; h is a cryptographic hash function, and || represents concatenation;

[0019] Output partial public key R ID and partial private key d ID .

[0020] In one embodiment, each user selects a user secret value based on system parameters, including:

[0021] Input system parameters params and user ID, ID∈{0,1} * ;

[0022] Randomly select a user's secret value x ID , is a set of integers consisting of 1, 2, …, q-1, where q is a large prime number.

[0023] In one embodiment, each user sets the user's public key based on system parameters, the user's secret value, and a portion of the public key, including:

[0024] Input system parameters params, user secret value x ID and partial public key R ID ;

[0025] Calculate the median value P ID , P ID =x ID P, where P is a generator of the group G, which is an additive cyclic group of order q;

[0026] Calculate the user's public key pk ID , pk ID ={P ID ,R ID}.

[0027] In one embodiment, each user sets the user's private key based on the user's secret value and a portion of the private key, including:

[0028] Input system parameters params, user secret value x ID and partial private key d ID ;

[0029] Calculate the user's private key sk ID ,sk ID ={x ID ,d ID}.

[0030] In one embodiment, the sender outputs a signcrypted ciphertext based on system parameters, plaintext data, the recipient's user ID and the recipient's public key, and the sender's private key, including:

[0031] Step S61: Input system parameters params, plaintext data M, and recipient's user ID R and the recipient's public key and the sender's private key is the middle value, is a partial public key, ID s is the sender's user ID, is the user's secret value, is a partial private key;

[0032] Step S62, select a random number k, is a set of integers consisting of 1, 2, …, q-1, where q is a large prime number; compute the element K1 in the group G, K1 = kP = (x1, y1), where x1 and y1 are the x-coordinate and y-coordinate of K1 respectively, the group G is an additive cyclic group of order q, and P is the generator of the group G;

[0033] Step S63, calculate the hash value e, e=h(M||K1), h is the cryptographic hash function, || represents concatenation; calculate the partial signcrypted ciphertext r, r=e+x1(mod q), mod q is the modulo q operation; calculate the partial signcrypted ciphertext s,

[0034] Step S64, calculate the element K2 in group G, Where x2 and y2 are the x-coordinate and y-coordinate of K2 respectively; P pub is the master public key; h is the cryptographic hash function; || represents concatenation;

[0035] Step S65, calculate the intermediate value t, t = KDF(x2||y2,mlen), KDF is the key derivation function; mlen is the bit length of the plaintext data; || represents concatenation; if t is an all-zero bit string, return to step S62, otherwise, execute step S66;

[0036] Step S66, calculate the partial signcrypted ciphertext C after encrypting the plaintext data M, A bitwise exclusive OR operation that operates on two bit strings of the same length;

[0037] Step S67: output the signcrypted ciphertext σ = {C, r, s}.

[0038] In one embodiment, the receiver decrypts and verifies the signcrypted ciphertext based on the system parameters, the signcrypted ciphertext, the sender's user ID, the sender's public key, and the receiver's private key. If the verification succeeds, the receiver obtains the plaintext data and the sender's signature on the plaintext data. If the verification fails, the receiver refuses to receive the data, including:

[0039] Step S71: Input system parameters params, signcrypted ciphertext σ={C,r,s}, sender's user ID s and the sender's public key and the recipient's private key C, r and s are all partial signcrypted ciphertexts, is the middle value, is a partial public key, ID R is the recipient's user ID, is the user's secret value, is a partial private key;

[0040] Step S72, calculate the element K′1 in the group G, where x′1 and y′1 are the x- and y-coordinates of K′1 respectively; group G is an additive cyclic group of order q, P is the generator of group G; h is a cryptographic hash function; || represents concatenation; P pub is the master public key;

[0041] Step S73, calculate the element K′2 in the group G, Where x′2 and y′2 are the x- and y-coordinates of K′2 respectively;

[0042] Step S74, calculate the intermediate value t', t'=KDF(x'2||y'2,mlen), where || represents concatenation, KDF is the key derivation function, and mlen is the bit length of the plaintext data; if t' is a string of all 0 bits, report an error and exit;

[0043] Step S75, calculate the plaintext data M', A bitwise exclusive OR operation that operates on two bit strings of the same length;

[0044] Step S76, calculate the hash value e', e'=h(M'||K'1), calculate the intermediate variable R, R=e'+x'1(mod q), where h is the cryptographic hash function; || represents concatenation; mod q is the modulo q operation;

[0045] Step S77, verify whether the equation R=r holds true;

[0046] Step S78: If the equation is established, then output the plaintext data M ′ ; Otherwise, verification fails and the program exits with an error.

[0047] In a second aspect, a certificateless signcryption generation system based on the SM2 algorithm is provided, comprising:

[0048] The system initialization module is used by the key generation center to generate system parameters and master keys based on security parameters, publish the system parameters to all users in the system, and secretly store the master keys;

[0049] The partial public key and partial private key extraction module is used for the key generation center to output the partial public key and partial private key corresponding to the user ID according to the system parameters, the master key and the user ID of each user;

[0050] The secret value setting module is used for each user to select the user's secret value according to the system parameters and store the secret value secretly;

[0051] The public key setting module is used for each user to set the user's public key based on system parameters, the user's secret value and part of the public key;

[0052] The private key setting module is used for each user to set the user's private key based on the user's secret value and part of the private key;

[0053] The signcryption module is used by the sender to output the signcrypted ciphertext based on the system parameters, plaintext data, the user ID of the receiver, the public key of the receiver, and the private key of the sender;

[0054] The decryption module is used by the receiver to decrypt and verify the signcrypted ciphertext based on the system parameters, the signcrypted ciphertext, the sender's user ID and the sender's public key, and the receiver's private key; if the verification is successful, the plaintext data and the sender's signature on the plaintext data are obtained; if the verification fails, the receiver refuses to receive the data.

[0055] In a third aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the certificateless signcryption generation method based on the SM2 algorithm is implemented.

[0056] Compared with the existing technology, the present application has the following beneficial effects: the present application provides a certificateless signcryption generation method and system based on the SM2 algorithm, including: system initialization, partial public key and partial private key extraction, secret value setting, public key setting, private key setting, signcryption and de-signcryption steps. The signcryption generation method is based on a certificateless cryptographic system. In this system, users do not need to know other people's certificates and status, thereby simplifying the certificate management problem. The user's private key consists of a partial private key generated by the key generation center and the user's secret value, so there is no key escrow problem. The method of the present application is based on the ciphertext and signature structure of the SM2 algorithm, which solves the key escrow problem in the identity-based cryptographic system and the certificate management problem in the traditional public key cryptographic system. It completes the encryption and signing of data simultaneously in one logical step, reduces the computational complexity, and improves practicality while ensuring security. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The present application may be better understood by referring to the following description in conjunction with the accompanying drawings, which together with the following detailed description are incorporated into and form a part of this specification. In the drawings:

[0058] Figure 1 A flow chart of a certificateless signcryption generation method based on the SM2 algorithm according to an embodiment of the present application is shown;

[0059] Figure 2 The figure shows a structural block diagram of a certificateless signcryption generation system based on the SM2 algorithm according to an embodiment of the present application. DETAILED DESCRIPTION

[0060] Exemplary embodiments of the present application are described below with reference to the accompanying drawings. For the sake of clarity and conciseness, not all features of actual embodiments are described in this specification. However, it should be understood that in the process of developing any such actual embodiment, many implementation-specific decisions may be made to achieve the developer's specific goals, and these decisions may vary from one implementation to another.

[0061] It is also necessary to explain here that, in order to avoid obscuring the present application due to unnecessary details, the accompanying drawings only show the device structure closely related to the solution according to the present application, while other details that are not closely related to the present application are omitted.

[0062] It should be understood that the present application is not limited to the described embodiments due to the following description with reference to the accompanying drawings. In this document, where feasible, the embodiments may be combined with each other, features between different embodiments may be replaced or borrowed, and one or more features may be omitted in one embodiment.

[0063] This application embodiment provides a certificateless signcryption generation method based on the SM2 algorithm. Figure 1 A flow chart of a certificateless signcryption generation method based on the SM2 algorithm according to an embodiment of the present application is shown. Figure 1 , methods include:

[0064] Step S1: The key generation center generates system parameters and a master key based on security parameters, publishes the system parameters to all users in the system, and keeps the master key secret.

[0065] Step S2: The key generation center outputs a partial public key and a partial private key corresponding to the user ID based on the system parameters, the master key, and the user ID of each user;

[0066] Step S3: Each user selects a secret value based on the system parameters and stores the secret value secretly.

[0067] Step S4, each user sets the user's public key based on the system parameters, the user's secret value and part of the public key;

[0068] Step S5, each user sets the user's private key based on the user's secret value and part of the private key;

[0069] Step S6: The sender outputs the signcrypted ciphertext based on the system parameters, the plaintext data, the user ID of the receiver, the public key of the receiver, and the private key of the sender;

[0070] In step S7, the receiver decrypts and verifies the signcrypted ciphertext based on the system parameters, the signcrypted ciphertext, the sender's user ID, the sender's public key, and the receiver's private key; if the verification passes, the plaintext data and the sender's signature on the plaintext data are obtained; if the verification fails, the receiver refuses to receive the data.

[0071] The above embodiment is based on a certificateless cryptography system, in which users do not need to know the certificates and status of others, thus simplifying certificate management. A user's private key consists of a partial private key generated by a key generation center and the user's secret value, eliminating key escrow issues. Based on the ciphertext and signature structure of the SM2 algorithm, this embodiment solves both the key escrow issues in identity-based cryptography and the certificate management issues in traditional public-key cryptography. It simultaneously encrypts and signs data in a single logical step, reducing computational complexity and improving practicality while ensuring security.

[0072] In one embodiment, in step S1, the key generation center generates system parameters and a master key based on security parameters, publishes the system parameters to all users in the system, and secretly stores the master key, which may include:

[0073] Input security parameter λ;

[0074] The key generation center selects a random number α, is a set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; calculate the master public key P pub , P pub =αP, where P is a generator of the group G, which is an additive cyclic group of order q; select a key derivation function KDF and a cryptographic hash function h;

[0075] Output system parameters params, params = {G, q, P, P pub ,KDF,h}, secretly save the master key msk, msk=α.

[0076] In one embodiment, in step S2, the key generation center outputs a partial public key and a partial private key corresponding to the user identifier based on the system parameters, the master key, and the user identifier of each user, which may include:

[0077] Input system parameters params, master key msk and user ID, ID∈{0,1} * , that is, the ID is of any bit length between 0 and 1;

[0078] Choose a random number r ID , is a set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; calculate the partial public key R ID , R ID =r ID P and part of the private key d ID , d ID =r ID +msk·h(ID||R ID ); where P is the generator of group G, group G is an additive cyclic group of order q; h is a cryptographic hash function, and || represents concatenation;

[0079] Output partial public key R ID and partial private key d ID .

[0080] In one embodiment, in step S3, each user selects a user secret value based on system parameters, which may include:

[0081] Input system parameters params and user ID, ID∈{0,1} * , that is, the ID is of any bit length between 0 and 1;

[0082] Randomly select a user's secret value x ID , is a set of integers consisting of 1, 2, …, q-1, where q is a large prime number.

[0083] In one embodiment, in step S4, each user sets the user's public key based on the system parameters, the user's secret value and the partial public key, which may include:

[0084] Input system parameters params, user secret value x ID and partial public key R ID ;

[0085] Calculate the median value P ID , P ID =x ID P, where P is a generator of the group G, which is an additive cyclic group of order q;

[0086] Calculate the user's public key pk ID , pk ID ={P ID ,R ID}.

[0087] In one embodiment, in step S5, each user sets the user's private key based on the user's secret value and the partial private key, which may include:

[0088] Input system parameters params, user secret value x IDand partial private key d ID ;

[0089] Calculate the user's private key sk ID ,sk ID ={x ID ,d ID}.

[0090] In one embodiment, in step S6, the sender outputs the signcrypted ciphertext based on the system parameters, the plaintext data, the user identifier of the receiver, the public key of the receiver, and the private key of the sender, which may include:

[0091] Step S61: Input system parameters params, plaintext data M, and recipient's user ID R and the recipient's public key and the sender's private key is the middle value, is a partial public key, ID s is the sender's user ID, is the user's secret value, is a partial private key;

[0092] Step S62, select a random number k, is a set of integers consisting of 1, 2, …, q-1, where q is a large prime number; compute the element K1 in the group G, K1 = kP = (x1, y1), where x1 and y1 are the x-coordinate and y-coordinate of K1 respectively, the group G is an additive cyclic group of order q, and P is the generator of the group G;

[0093] Step S63, calculate the hash value e, e=h(M||K1), h is the cryptographic hash function, || represents concatenation; calculate the partial signcrypted ciphertext r, r=e+x1(mod q), mod q is the modulo q operation; calculate the partial signcrypted ciphertext s,

[0094] Step S64, calculate the element K2 in group G, Where x2 and y2 are the x-coordinate and y-coordinate of K2 respectively; P pub is the master public key; h is the cryptographic hash function; || represents concatenation;

[0095] Step S65, calculate the intermediate value t, t = KDF(x2||y2,mlen), KDF is the key derivation function; mlen is the bit length of the plaintext data; || represents concatenation; if t is an all-zero bit string, return to step S62, otherwise, execute step S66;

[0096] Step S66, calculate the partial signcrypted ciphertext C after encrypting the plaintext data M, is a bitwise exclusive OR operator that operates on two bit strings of the same length;

[0097] Step S67: output the signcrypted ciphertext σ = {C, r, s}.

[0098] In one embodiment, in step S7, the receiver decrypts and verifies the signcrypted ciphertext based on the system parameters, the signcrypted ciphertext, the sender's user ID, the sender's public key, and the receiver's private key. If the verification succeeds, the plaintext data and the sender's signature on the plaintext data are obtained; if the verification fails, the receiver refuses to receive the data, which may include:

[0099] Step S71: Input system parameters params, signcrypted ciphertext σ={C,r,s}, sender's user ID s and the sender's public key and the recipient's private key Among them, C, r and s are all partial signcrypted ciphertexts. is the middle value, is a partial public key, is the recipient's user ID, is the user's secret value, is a partial private key;

[0100] Step S72, calculate the element K1 in group G ′ , where x1 ′ and y1 ′ K1 ′ The x- and y-coordinates of ; group G is an additive cyclic group of order q, P is the generator of group G; h is a cryptographic hash function; || represents concatenation; P pub is the master public key;

[0101] Step S73, calculate the element K2 in group G ′ , where x2 ′ and y2 ′ K2 ′ The x- and y-coordinates of

[0102] Step S74, calculate the intermediate value t ′ , t ′ =DF(x2 ′ ||y2 ′,mlen),|| represents concatenation, KDF is the key derivation function, and mlen is the bit length of the plaintext data; if t ′ If it is a string of all 0 bits, the program will report an error and exit;

[0103] Step S75, calculate the plaintext data M ′ , is a bitwise exclusive OR operator that operates on two bit strings of the same length;

[0104] Step S76, calculate the hash value e ′ , e ′ =h(M ′ ||K1 ′ ), calculate the intermediate variable R, R = e ′ +x1 ′ (mod q), where h is the cryptographic hash function; || represents concatenation; mod is the modulo q operation;

[0105] Step S77, verify whether the equation R=r holds true;

[0106] Step S78: If the equation is established, then output the plaintext data M ′ ; Otherwise, verification fails and the program exits with an error.

[0107] Using the same inventive concept as the certificateless signcryption generation method based on the SM2 algorithm, this embodiment also provides a corresponding certificateless signcryption generation device based on the SM2 algorithm. Figure 2 The following is a structural block diagram of a certificateless signcryption generation device based on the SM2 algorithm according to an embodiment of the present application, including:

[0108] System initialization module 21, used by the key generation center to generate system parameters and master keys based on security parameters, publish the system parameters to all users in the system, and secretly store the master keys;

[0109] The partial public key and partial private key extraction module 22 is used for the key generation center to output the partial public key and partial private key corresponding to the user ID according to the system parameters, the master key and the user ID of each user;

[0110] The secret value setting module 23 is used for each user to select a secret value according to system parameters and to store the secret value secretly;

[0111] A public key setting module 24 is used for each user to set the user's public key based on system parameters, the user's secret value and part of the public key;

[0112] A private key setting module 25 is used for each user to set the user's private key based on the user's secret value and part of the private key;

[0113] The signcryption module 26 is used for the sender to output the signcrypted ciphertext based on the system parameters, the plaintext data, the user ID of the receiver and the public key of the receiver and the private key of the sender;

[0114] The decryption module 27 is used for the receiver to decrypt and verify the signcrypted ciphertext based on the system parameters, the signcrypted ciphertext, the sender's user ID and the sender's public key, and the receiver's private key; if the verification is successful, the plaintext data and the sender's signature on the plaintext data are obtained; if the verification fails, the receiver refuses to receive the data.

[0115] The certificateless signcryption generation device of this embodiment has the same inventive concept as the certificateless signcryption generation method based on the SM2 algorithm mentioned above. Therefore, the specific implementation method of the device can be seen in the embodiment part of the certificateless signcryption generation method based on the SM2 algorithm mentioned above, and its technical effect corresponds to the technical effect of the above method, which will not be repeated here.

[0116] An embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned certificateless signcryption generation method based on the SM2 algorithm.

[0117] The above descriptions are merely examples of various embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any modifications or substitutions that can be readily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included within the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A certificateless signcryption generation method based on the SM2 algorithm, characterized in that: include: The key generation center generates system parameters and a master key based on the security parameters, publishes the system parameters to all users in the system, and secretly stores the master key; The key generation center outputs a partial public key and a partial private key corresponding to the user identifier according to the system parameters, the master key and the user identifier of each user; Each user selects a secret value of the user according to the system parameters and secretly stores the secret value; Each user sets the user's public key according to the system parameters, the user's secret value and part of the public key; Each user sets a private key of the user according to the user's secret value and part of the private key; The sender outputs the signcrypted ciphertext based on the system parameters, the plaintext data, the user ID of the receiver, the public key of the receiver, and the private key of the sender; The receiver decrypts and verifies the signcrypted ciphertext based on the system parameters, the signcrypted ciphertext, the sender's user ID and the sender's public key, and the receiver's private key; If the verification is successful, the plaintext data and the sender's signature on the plaintext data will be obtained; if the verification fails, the data will be rejected. The sender outputs the signcrypted ciphertext according to the system parameters, the plaintext data, the user ID of the receiver, the public key of the receiver, and the private key of the sender, including: Step S61: Input system parameters params, plaintext data M, and recipient's user ID R and the recipient's public key and the sender's private key is the middle value, is a partial public key, ID s is the sender's user ID, is the user's secret value, is a partial private key; Step S62, select a random number k, is a set of integers consisting of 1, 2, …, q-1, where q is a large prime number; compute the element K1 in the group G, K1 = kP = (x1, y1), where x1 and y1 are the x-coordinate and y-coordinate of K1 respectively, the group G is an additive cyclic group of order q, and P is the generator of the group G; Step S63, calculate the hash value e, e=h(M||K1), h is the cryptographic hash function, || represents concatenation; calculate the partial signcrypted ciphertext r, r=e+x1(modq), modq is the modulo q operation; calculate the partial signcrypted ciphertext s, Step S64, calculate the element K2 in group G, Where x2 and y2 are the x-coordinate and y-coordinate of K2 respectively; P pub is the master public key; h is the cryptographic hash function; || represents concatenation; Step S65, calculate the intermediate value t, t = KDF(x2||y2,mlen), KDF is the key derivation function; mlen is the bit length of the plaintext data; || represents concatenation; if t is an all-zero bit string, return to step S62, otherwise, execute step S66; Step S66, calculate the partial signcrypted ciphertext C after encrypting the plaintext data M, A bitwise exclusive OR operation that operates on two bit strings of the same length; Step S67: output the signcrypted ciphertext σ = {C, r, s}.

2. The method according to claim 1, wherein in, The key generation center generates system parameters and a master key based on the security parameters, publishes the system parameters to all users in the system, and secretly stores the master key, including: Input security parameter λ; The key generation center selects a random number α, is a set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; calculate the master public key P pub , P pub =αP, where P is a generator of the group G, which is an additive cyclic group of order q; select a key derivation function KDF and a cryptographic hash function h; Output system parameters params, params = {G, q, P, P pub ,KDF,h}, secretly save the master key msk, msk=α.

3. The method according to claim 1, wherein in, The key generation center outputs a partial public key and a partial private key corresponding to the user identifier according to the system parameters, the master key, and the user identifier of each user, including: Input system parameters params, master key msk and user ID, ID∈{0,1} * ; Choose a random number r ID , is a set of integers consisting of 1, 2, ..., q-1, where q is a large prime number; calculate the partial public key R ID , R ID =r ID P and part of the private key d ID , d ID =r ID +msk·h(ID||R ID ); where P is the generator of group G, group G is an additive cyclic group of order q; h is a cryptographic hash function, and || represents concatenation; Output partial public key R ID and partial private key d ID .

4. The method according to claim 1, wherein in, Each user selects a secret value of the user according to the system parameters, including: Input system parameters params and user ID, ID∈{0,1} * ; Randomly select a user's secret value x ID , is a set of integers consisting of 1, 2, …, q-1, where q is a large prime number.

5. The method according to claim 1, wherein in, Each user sets the user's public key according to the system parameters, the user's secret value and the partial public key, including: Input system parameters params, user secret value x ID and partial public key R ID ; Calculate the median value P ID , P ID =x ID P, where P is a generator of the group G, which is an additive cyclic group of order q; Calculate the user's public key pk ID , pk ID ={P ID ,R ID }.

6. The method according to claim 1, wherein in, Each user sets the user's private key according to the user's secret value and part of the private key, including: Input system parameters params, user secret value x ID and partial private key d ID ; Calculate the user's private key sk ID ,sk ID ={x ID ,d ID }.

7. The method according to claim 1, wherein in, The receiver decrypts and verifies the signcrypted ciphertext based on the system parameters, the signcrypted ciphertext, the sender's user ID, the sender's public key, and the receiver's private key. If the verification is successful, the receiver obtains the plaintext data and the sender's signature on the plaintext data. If verification fails, the receipt will be rejected, including: Step S71: Input system parameters params, signcrypted ciphertext σ={C,r,s}, sender's user ID s and the sender's public key and the recipient's private key c, r and s are all partial signcrypted ciphertexts, is the middle value, is a partial public key, ID R is the recipient's user ID, is the user's secret value, is a partial private key; Step S72, calculate the element K1 in group G ′ , where x1 ′ and y1 ′ K1 ′ The x- and y-coordinates of ; group G is an additive cyclic group of order q, P is the generator of group G; h is a cryptographic hash function; || represents concatenation; P pub is the master public key; Step S73, calculate the element K′2 in the group G, Where x′2 and y′2 are the x- and y-coordinates of K′2 respectively; Step S74, calculate the intermediate value t', t'=KDF(x'2||y'2,mlen), where || represents concatenation, KDF is the key derivation function, and mlen is the bit length of the plaintext data; if t' is a string of all 0 bits, report an error and exit; Step S75, calculate the plaintext data M', A bitwise exclusive OR operation that operates on two bit strings of the same length; Step S76, calculate the hash value e', e'=h(M'||K'1), calculate the intermediate variable R, R=e'+x'1(mod q), where h is the cryptographic hash function; || represents concatenation; mod q is the modulo q operation; Step S77, verify whether the equation R=r holds true; Step S78: If the equation is established, then output the plaintext data M ′ ; Otherwise, verification fails and the program exits with an error.

8. A certificateless signcryption generation system based on the SM2 algorithm, characterized in that: include: The system initialization module is used by the key generation center to generate system parameters and a master key based on security parameters, publish the system parameters to all users in the system, and secretly store the master key; A partial public key and partial private key extraction module, configured for the key generation center to output the partial public key and partial private key corresponding to the user identifier according to the system parameters, the master key and the user identifier of each user; A secret value setting module, configured for each user to select a secret value according to the system parameters and to secretly store the secret value; A public key setting module, configured for each user to set the user's public key according to the system parameters, the user's secret value and a partial public key; A private key setting module, configured for each user to set the user's private key based on the user's secret value and part of the private key; A signcryption module, configured for the sender to output a signcrypted ciphertext based on the system parameters, the plaintext data, the user identifier of the receiver, the public key of the receiver, and the private key of the sender; a decryption module for the receiver to decrypt and verify the signcrypted ciphertext based on the system parameters, the signcrypted ciphertext, the sender's user ID and the sender's public key, and the receiver's private key; if the verification succeeds, the plaintext data and the sender's signature on the plaintext data are obtained; if the verification fails, the receiver refuses to receive the plaintext data; The sender outputs the signcrypted ciphertext according to the system parameters, the plaintext data, the user ID of the receiver, the public key of the receiver, and the private key of the sender, including: Step S61: Input system parameters params, plaintext data M, and recipient's user ID R and the recipient's public key and the sender's private key is the middle value, is a partial public key, ID s is the sender's user ID, is the user's secret value, is a partial private key; Step S62, select a random number k, is a set of integers consisting of 1, 2, …, q-1, where q is a large prime number; compute the element K1 in the group G, K1 = kP = (x1, y1), where x1 and y1 are the x-coordinate and y-coordinate of K1 respectively, the group G is an additive cyclic group of order q, and P is the generator of the group G; Step S63, calculate the hash value e, e=h(M||K1), h is the cryptographic hash function, || represents concatenation; calculate the partial signcrypted ciphertext r, r=e+x1(modq), modq is the modulo q operation; calculate the partial signcrypted ciphertext s, Step S64, calculate the element K2 in group G, Where x2 and y2 are the x-coordinate and y-coordinate of K2 respectively; P pub is the master public key; h is the cryptographic hash function; || represents concatenation; Step S65, calculate the intermediate value t, t = KDF(x2||y2,mlen), KDF is the key derivation function; mlen is the bit length of the plaintext data; || represents concatenation; if t is an all-zero bit string, return to step S62, otherwise, execute step S66; Step S66, calculate the partial signcrypted ciphertext C after encrypting the plaintext data M, A bitwise exclusive OR operation that operates on two bit strings of the same length; Step S67: output the signcrypted ciphertext σ = {C, r, s}.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements the certificateless signcryption generation method based on the SM2 algorithm according to any one of claims 1 to 7.

Images