Encryption processing method, apparatus, device, and storage medium

Abstract

The application provides an encryption processing method and device, equipment and a storage medium. The Montgomery ladder operation is initialized according to the relative coordinates of a target point on a Montgomery curve, an intermediate coordinate value in a Jacobian coordinate system is obtained, an iteration process of the Montgomery ladder operation is performed according to the intermediate coordinate value, a randomized private key and an order of the target point, it is judged whether a result point corresponding to the target point is on the Montgomery curve according to the intermediate coordinate value, and a target point multiplication result that can be used in a key generation scenario and / or a key agreement scenario is obtained according to a judgment result. The initialization and iteration process based on the relative coordinates of the target point can greatly reduce the calculation amount and improve the operation performance. The horizontal coordinate of the target point is a non-small subgroup element, which can avoid the appearance of an infinite point in the operation process and avoid selection input attacks. It is judged whether the result point corresponding to the target point is on the curve according to the intermediate coordinate value, which can make the encryption processing process have the ability to resist error injection attacks and does not affect the operation performance.

Description

Technical Field

[0001] This application relates to the field of encryption technology, and in particular to an encryption processing method, apparatus, device and storage medium. Background Technology

[0002] The Curve25519 elliptic curve is a 255-bit Montgomery curve. The key negotiation standard X25519, based on Curve25519, is widely used in fields such as TLS (Transport Layer Security) and eSIM (Embedded SIM). In the X25519 standard, each user participating in key negotiation and / or key generation has a 32-byte private key and a corresponding 32-byte public key. The public key is the x-coordinate of a point on the Montgomery curve. During key generation and key negotiation, Curve25519(k,q) represents a dot product operation on the curve using only the x-coordinate.

[0003] Dot product operations on the Curve25519 curve using only the x-coordinate are generally implemented using the Montgomery ladder algorithm with homogeneous projective coordinates. In practical applications, due to the need to defend against side-channel attacks, existing dot product implementations typically, in addition to using the Montgomery ladder algorithm, also employ random numbers during initialization to blind sensitive data such as point coordinates, thereby protecting sensitive data. Furthermore, in practical applications, it is also necessary to defend against false injection attacks. For elliptic curves, checking whether a point lies on the curve before and after the dot product operation is an effective means of resisting false injection attacks. Therefore, the dot product operation using only the x-coordinate needs to be changed to a dot product operation using (x, y), that is, two modular exponentiation operations are needed before the dot product operation to obtain y, and then the dot product operation is performed.

[0004] However, existing solutions for dot product operations suffer from drawbacks such as low performance, vulnerability to selective input attacks, and inability to resist false injection attacks, or the inability to protect against false injection attacks can severely impact performance. Summary of the Invention

[0005] This application provides an encryption processing method, apparatus, device, and storage medium to solve the technical problems of low performance of dot product operations, susceptibility to selected input attacks, and inability to resist false injection attacks or the severe impact of false injection attack protection on the performance of dot product operations in existing encryption processing of key generation and / or key negotiation processes.

[0006] Firstly, this application provides an encryption processing method, including:

[0007] The Montgomery ladder operation is initialized based on the relative coordinates of the target point on the Montgomery curve to obtain the intermediate coordinate values ​​in the Jacobian coordinate system. The relative coordinates of the target point include the x-coordinate and the relative y-coordinate of the target point. The x-coordinate of the target point is a non-small subgroup element.

[0008] The Montgomery ladder operation is performed iteratively based on the median coordinate, the randomized private key, and the order of the target point. The randomized private key is obtained by randomizing the private key of the user key pair with a random number, and the order of the target point is obtained according to Legendre notation.

[0009] Based on the median value of the coordinates, determine whether the result point corresponding to the target point is on the Montgomery curve. Based on the determination result, obtain the target dot product result. The target dot product result is applied to key generation scenarios and / or key negotiation scenarios.

[0010] In one possible design, the initialization of the Montgomery ladder operation based on the relative coordinates of the target point on the Montgomery curve, and the acquisition of intermediate coordinate values ​​in the Jacobian coordinate system, includes:

[0011] The intermediate coordinate values ​​are obtained based on the x-coordinate of the target point and the initialization model of the Montgomery ladder operation. The intermediate coordinate values ​​include the intermediate values ​​of the first y-coordinate, the second y-coordinate, the first x-coordinate, the second x-coordinate, the unified Z-coordinate, and the slope value.

[0012] In one possible design, obtaining the intermediate coordinate value based on the x-coordinate of the target point and the initialization model of the Montgomery ladder operation includes:

[0013] The intermediate value of the first ordinate is obtained based on the x-coordinate of the target point and the first initialization algorithm. The intermediate value of the first ordinate is the square of the ordinate of the target point transformed into the Jacobian coordinate system.

[0014] In one possible design, obtaining the intermediate coordinate value based on the x-coordinate of the target point and the initialization model of the Montgomery ladder operation includes:

[0015] A unified intermediate value of the Z-coordinate is obtained based on the x-coordinate of the target point and the x-coordinate randomization algorithm.

[0016] The second ordinate intermediate value is obtained based on the unified Z-coordinate intermediate value and the second initialization algorithm;

[0017] Wherein, the median value of the second ordinate is the value of the relative ordinate of the target point transformed to the Jacobian coordinate system, and the median value of the unified Z coordinate is the median value of the unified Z coordinate of the target point and the first and second reference points of the target point in the Jacobian coordinate system.

[0018] In one possible design, obtaining the intermediate coordinate value based on the x-coordinate of the target point and the initialization model of the Montgomery ladder operation includes:

[0019] The slope value is obtained based on the x-coordinate of the target point and the third initialization algorithm;

[0020] The intermediate values ​​of the first and second horizontal coordinates are obtained based on the slope value, the x-coordinate of the target point, and the fourth initialization algorithm.

[0021] Wherein, the slope value is the value of the slope of the reference line transformed to the Jacobian coordinate system, the reference line is the straight line passing through the target point, the first reference point, and the second reference point, the midpoint value of the first abscissa is the value of the first relative abscissa transformed to the Jacobian coordinate system, the midpoint value of the second abscissa is the value of the second relative abscissa transformed to the Jacobian coordinate system, the first relative abscissa is obtained based on the abscissa of the first reference point and the abscissa of the target point, and the second relative abscissa is obtained based on the abscissa of the second reference point and the abscissa of the target point.

[0022] In one possible design, the iterative process of performing the Montgomery ladder operation based on the median coordinate value, the randomized private key, and the order of the target point includes:

[0023] The Montgomery operation is performed iteratively based on the randomized private key, the order of the target point, and the iterative input value.

[0024] The iterative input values ​​include the slope value, the median value of the second vertical coordinate, the median value of the unified Z coordinate, and the median values ​​of the first horizontal coordinate and the second horizontal coordinate.

[0025] In one possible design, determining whether the result point corresponding to the target point lies on the Montgomery curve based on the median coordinate value includes:

[0026] The first modulus operation is performed based on the unified Z-coordinate median value, the first ordinate median value, the second abscissa median value, and the abscissa of the target point to obtain the Z-coordinate result value and the abscissa result value;

[0027] A second modulus operation is performed based on the median value of the second ordinate, the median value of the second abscissa, and the slope value to obtain the ordinate result value;

[0028] A third modulus operation is performed based on the x-coordinate result value and the z-coordinate result value to obtain a temporary value;

[0029] Determine whether the result value of the ordinate is equal to the temporary value;

[0030] If so, the judgment result obtained includes the result point corresponding to the target point on the Montgomery curve.

[0031] In one possible design, the step of performing a first modulus operation based on the unified Z-coordinate median value, the first ordinate median value, the second abscissa median value, and the abscissa of the target point to obtain the Z-coordinate result value and the abscissa result value includes:

[0032] The first sub-operation of the first modulus operation is performed based on the unified Z-coordinate median value and the first ordinate median value to obtain the Z-coordinate result value;

[0033] The second sub-operation of the first modulus operation is performed based on the median value of the second horizontal coordinate, the result value of the Z coordinate, and the horizontal coordinate of the target point to obtain the result value of the horizontal coordinate.

[0034] In one possible design, obtaining the target dot product result based on the judgment result includes:

[0035] Based on the judgment result, output the horizontal coordinate result value and the Z coordinate result value;

[0036] The horizontal coordinate result value and the Z coordinate result value are input into the fourth modular operation, and the result obtained is determined as the target dot product result.

[0037] In one possible design, prior to the iterative process of performing the Montgomery ladder operation based on the median coordinate, the randomized private key, and the order of the target point, the following is also included:

[0038] Determine whether the x-coordinate of the target point is an element of the subgroup, wherein the subgroup element is obtained based on the Montgomery curve;

[0039] If not, the order of the target point is obtained through the Legendre symbol, the x-coordinate of the target point, and the Montgomery curve.

[0040] Secondly, this application provides an encryption processing apparatus, comprising:

[0041] An initialization module is used to initialize the Montgomery ladder operation based on the relative coordinates of the target point on the Montgomery curve and obtain the intermediate coordinate values ​​in the Jacobian coordinate system. The relative coordinates of the target point include the abscissa and ordinate of the target point, and the abscissa of the target point is a non-small subgroup element.

[0042] An iterative module is used to perform an iterative process of the Montgomery ladder operation based on the median coordinate value, the randomized private key, and the order of the target point. The randomized private key is obtained by randomizing the private key of the user key pair with a random number, and the order of the target point is obtained according to Legendre notation.

[0043] The result judgment module is used to determine whether the result point corresponding to the target point is on the Montgomery curve based on the median value of the coordinates, and to obtain the target dot product result based on the judgment result. The target dot product result is applied to the key generation scenario and / or key negotiation scenario.

[0044] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0045] The memory stores computer-executed instructions;

[0046] The processor executes computer execution instructions stored in the memory to implement any of the possible encryption methods provided in the first aspect.

[0047] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement any of the possible encryption methods provided in the first aspect.

[0048] Fifthly, this application provides a computer program product including computer execution instructions, which, when executed by a processor, are used to implement any of the possible encryption methods provided in the first aspect.

[0049] This application provides an encryption processing method, apparatus, device, and storage medium. First, the Montgomery ladder operation is initialized based on the relative coordinates of the target point on the Montgomery curve to obtain the median coordinate value in the Jacobian coordinate system. The relative coordinates of the target point include the x-coordinate of the target point and the non-small subgroup element of the x-coordinate. Then, the Montgomery ladder operation is iterated based on the median coordinate value, the randomized private key, and the order of the target point. Specifically, the private key of the user key pair is randomized using random numbers to obtain the randomized private key. Next, the median coordinate value is used to determine whether the result point corresponding to the target point lies on the Montgomery curve. Based on the determination result, the target dot product result is obtained. The target dot product result is applied in key generation and / or key negotiation scenarios. Initializing the Montgomery ladder operation based on the relative coordinates of the target point to obtain the median coordinate value in the Jacobian coordinate system, and using the median coordinate value for the iterative process of the Montgomery ladder operation, can greatly reduce the computational load and improve the performance of the dot product operation. Furthermore, by ensuring that the x-coordinate of the target point in the Montgomery ladder operation is not a member of a small subgroup, the operation avoids points at infinity and prevents selected input attacks. Additionally, the intermediate coordinate value is used to determine whether the result point corresponding to the target point lies on the curve, thus enabling the encryption process to resist fault injection attacks without affecting the performance of dot product operations. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 A schematic diagram of a system architecture provided for an embodiment of this application;

[0052] Figure 2 A flowchart illustrating an encryption method provided in an embodiment of this application;

[0053] Figure 3 A schematic diagram of the Montgomery ladder operation initialization process provided for an embodiment of this application;

[0054] Figure 4 This application provides a schematic diagram of a judgment process.

[0055] Figure 5 This is a schematic diagram of the structure of an encryption processing device provided in an embodiment of this application;

[0056] Figure 6 This is a schematic diagram of the structure of an initialization module provided in an embodiment of this application;

[0057] Figure 7 This is a schematic diagram of another encryption processing device provided in an embodiment of this application;

[0058] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0059] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of methods and apparatus consistent with some aspects of this application as detailed in the appended claims.

[0060] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0061] In existing technologies, the implementation of dot product operations typically involves using the Montgomery ladder, and further protecting sensitive data such as point coordinates by using random numbers during the initialization of the Montgomery ladder operation. However, for Montgomery curves... Taking Curve25519 as an example, the definition is as follows: for The public key, which is the set of x-coordinates of a point, is then... , The following three subgroups cover the public key set:

[0062] (a) ;

[0063] (b) , and The size of this group is 8p1, where p1 = 2. 252Given +27742317777372353535851937790883648493, there exist points of order 1, 2, 4, 8, p1, 8p1. Let this be the first finite field of the Montgomery curve;

[0064] (c) , and The size of this group is 4p², where p² = 2. 253 Given -55484635554744707071703875581767296995, there exist points of order 1, 2, 4, p2, 4p2. Let be the second finite field of the Montgomery curve.

[0065] This reveals the following shortcomings in the existing scheme: First, since the input to Curve25519() only contains the x-coordinate, it's impossible to determine which subgroup the point belongs to, and therefore, the specific value of the point's order n cannot be confirmed. Since the order n is used for key randomization, an incorrect n will lead to an incorrect dot product result. Therefore, we can only let... To ensure the correctness of the order, this makes randomization... And if the length of k is 255 bits, and the length of r is 128 bits, then The length is 638 bits, and its performance will decrease by 150% compared to dot product operations without key randomization. Secondly, existing dot product operations for resisting side-channel attacks are computationally very expensive. For example, the computational cost of point coordinate blinding is 5M+4A, and the computational cost of the iteration process in the Montgomery ladder operation is 11M+8A. M refers to modular multiplication, and A refers to modular addition or subtraction. This high computational cost inevitably affects the performance of dot product operations. Furthermore, the computational cost of using (x, y) for dot product operations to resist fault injection attacks is far greater than that of dot product operations using only x coordinates. For example, the computational cost of the iteration process is as high as 32M+19A, and the computation of y when it belongs to the second finite field requires... Onwards, The computational cost of modular multiplication is The power consumption is three times that of the normal point, which has a significant impact on performance. This severely affects the protection against false injection attacks and the performance of dot multiplication. However, if only side-channel attacks are defended against, false injection attacks cannot be defended against. Third, when the point is a small subgroup point, an infinite point O will appear periodically during the Montgomery ladder operation. The power consumption of the operation when the infinite point appears is lower than that of the operation when the normal point appears. Therefore, attackers can identify relevant features from the power consumption curve to obtain the private key k, thus suffering selected input attacks.

[0066] In view of the above-mentioned problems existing in the prior art, this application provides an encryption processing method, apparatus, device and storage medium. The inventive concept of the encryption processing method provided in this application is as follows: (1) Obtain the order of the target point according to Legendre symbols, determine the order of the target point, effectively reduce the length of order n in randomization, improve the performance of dot product operation, and overcome the first defect in the prior art; (2) Obtain the intermediate coordinate value by initializing the Montgomery ladder operation according to the relative coordinate of the target point, and use the intermediate coordinate value to perform the iterative process of the Montgomery ladder operation. In the point coordinate blinding process during initialization, the vertical coordinate of the target point can be set to 1, avoiding the operation process of obtaining the vertical coordinate of the target point according to the horizontal coordinate of the target point, and reducing the computational amount of the iterative process of the Montgomery ladder operation, thereby improving the operation performance. Furthermore, the result point corresponding to the target point is determined based on the median value of the coordinates, so that the encryption process has the ability to resist error injection attacks and does not affect the performance of dot product operation, thereby overcoming the second defect in the prior art; (3) The horizontal coordinate of the target point that performs the Montgomery ladder operation is not a small subgroup element, that is, only the horizontal coordinate of the target point that does not belong to the small subgroup element is subjected to the Montgomery ladder operation, avoiding the occurrence of infinite points in the operation process, thereby avoiding being subjected to selected input attacks, and overcoming the third defect in the prior art.

[0067] Figure 1 This is a schematic diagram of a system architecture provided for an embodiment of this application. Figure 1 As shown, the Central Processing Unit (CPU) 100 can be configured to execute the encryption processing method provided in this embodiment. For example, when a user needs to perform encrypted communication, the corresponding upper-layer application needs to initiate a dot product operation and thus issues a dot product command. The CPU 100 responds to the dot product command and obtains a scalar value, such as reading the scalar value k from the first memory 200. This scalar value can be used to represent the private key of the user key pair. Subsequently, the CPU 100 initializes the Montgomery ladder operation according to the relative coordinates of the target point on the Montgomery curve, obtains the coordinate median value in the Jacobian coordinate system, and performs an iterative process of the Montgomery ladder operation based on the coordinate median value, the randomized private key, and the order of the target point. Then, it determines whether the result point corresponding to the target point is on the Montgomery curve based on the coordinate median value. Finally, it obtains the target dot product result based on the determination result and applies the obtained target dot product result to the key generation scenario and / or key negotiation scenario for encrypted communication.

[0068] The CPU 100 can read random numbers from the random number generator 300 to randomize the private key of the user key pair, i.e., the scalar value k, to obtain the randomized private key.

[0069] Optionally, when the CPU 100 executes the encryption processing method provided in the embodiments of this application, the process can also be run by a coprocessor 400 with a fast computing speed, for example, to speed up initialization and Montgomery ladder operations and improve computing efficiency.

[0070] Optionally, the system architecture may also include a second memory 500 for storing dot product code, candidate dot product results, and target dot product results. The dot product code is used to implement the encryption processing method and also includes Montgomery ladder operations.

[0071] Optionally, the first memory 200 may include non-volatile memory (NVM), and the second memory 500 may include random access memory (RAM).

[0072] It should be noted that the above Figure 1 The system architecture shown is merely illustrative. The encryption processing methods, apparatus, devices, and storage media provided in the embodiments of this application include, but are not limited to, the above-described system architecture.

[0073] Figure 2 This is a flowchart illustrating an encryption method provided in an embodiment of this application. Figure 2 As shown, the encryption processing method provided in this application embodiment includes:

[0074] S101: Determine whether the x-coordinate of the target point is an element of a small subgroup.

[0075] The elements of the small subgroup are obtained from the Montgomery curve.

[0076] Determine whether the x-coordinate of the target point belongs to a small subgroup, that is, determine the x-coordinate (x) of the target point T. T Is the target point T in a small subgroup? T ) is the public key used to represent a user key pair.

[0077] The goal is to obtain all points within the small subgroups of the Montgomery curve. These points are the elements of the small subgroup. A small subgroup is a subgroup whose order is much smaller than the order of the Montgomery curve. An array `smallorder` can be used to represent the x-coordinates of all points within the small subgroups modulo `p`, thus reducing the number of elements in the small subgroups. An example Montgomery curve is `Curve25519`, which is a 255-bit Montgomery curve.

[0078] For example, smallorder[5]={0,1,32560625091655743179598362635611063129400}

[0079] 8115727848805560023387167927233504,39382357235489614581723060781553021112529911719440698176882885853963445705823,57896044618658097711785492504343953926634992332820282019728792003956564819948}.

[0080] Determine the x-coordinate (x) of the target point T T If the value obtained by taking the modulo of p is in the array, then it represents the x-coordinate (x-coordinate) of the target point T. T ) belongs to the small subgroup element. If not, it represents the x-coordinate (x) of the target point T. T (Non-small subgroup elements)

[0081] Since the set of private keys (i.e., scalar value k) of a user key pair is Therefore, during the Montgomery ladder operation [k]T, O will appear periodically, where O represents the point at infinity. In other words, if the x-coordinate of the target point T is (x... T If the elements of the target point T are elements of a small subgroup, then the point at infinity will periodically appear during the dot product process, and the point at infinity will be output. Conversely, if the x-coordinate of the target point T is (x-coordinate of the target point T), then the point at infinity will be output. T If it is not in the array, it represents the x-coordinate of the target point T. T For elements not belonging to a small subgroup, the Montgomery ladder operation [k]T will not periodically produce points at infinity. Therefore, performing small subgroup screening before the Montgomery ladder operation can avoid the periodic occurrence of points at infinity during the operation. This prevents attackers from exploiting the power consumption differences in the dot product operation implemented by the small subgroup in the Montgomery ladder operation, thus preventing key leakage and effectively avoiding selected input attacks, thereby improving the ability to resist channel-to-channel attacks.

[0082] S102: If the x-coordinate of the target point is determined to be a non-small subgroup element, the order of the target point is obtained through Legendre notation, the x-coordinate of the target point, and the Montgomery curve.

[0083] After determining the non-small subgroup element of the x-coordinate of the target point, the order of the target point is further obtained based on the Montgomery curve using Legendre notation and the x-coordinate of the target point. This clarifies the order of the target point, reduces the length of order n in randomization, and improves the efficiency and performance of dot product operations.

[0084] For example, the x-coordinate of the target point is input into the curve model of the Montgomery curve as shown in formula (1) to obtain the square value of the y-coordinate of the target point as shown in formula (2). Then, formulas (3), (4) and (5) are used to obtain the Legendre symbol corresponding to the square value of the y-coordinate of the target point. The Legendre symbol is used to determine the subgroup to which the y-coordinate of the target point belongs. Then, the order n of the target point is determined according to the subgroup to which it belongs.

[0085] (1)

[0086] (2)

[0087] (3)

[0088] (4)

[0089] p12=289480223093290488558927462521719769633174961664101410098643 96001978282409974 (5)

[0091] Where x and y represent the abscissa and ordinate of a point on the Montgomery curve, respectively, and formula (1) represents the curve model of the Montgomery curve, such as Curve 25519. The abscissa (x, y) of the target point T is... T By inputting formula (1), the ordinate (y) of the target point T represented by formula (2) can be obtained. T The square value of y T 2 v represents the ordinate (y) of the target point T. T The square value of y T 2 The remainder obtained by dividing by p, where p is the Curve25519 parameter. ls_pre represents the Legendre symbol corresponding to the square of the target point's ordinate. If the Legendre symbol ls_pre is 1, then the subgroup to which the target point's ordinate belongs is the first finite field of the Montgomery curve, i.e. Referring to subgroup (b) of the three subgroups covering the public key set mentioned above, if The order n of the target point T is 8p1; if the Legendre symbol ls_pre is p-1, then the subgroup to which the ordinate of the target point belongs is the second finite field of the Montgomery curve, i.e. Referring to the content of subgroup (c) of the three subgroups covering the public key set mentioned above, it can be seen that if The order n of the target point T is 4p². Therefore, the specific value of the order n of the target point T is determined. It can be understood that 8p¹ and 4p² are both known during the encryption process.

[0092] S103: Initialize the Montgomery ladder operation based on the relative coordinates of the target point on the Montgomery curve, and obtain the intermediate coordinate values ​​in the Jacobian coordinate system.

[0093] Initialize the Montgomery ladder operation using the relative coordinates (x, y') of a point, for example, the relative coordinates (x, y') of the target point T. T , y'), to obtain the intermediate coordinate values ​​in the Jacobian coordinate system. Where y' = y / y T (x, y) are the actual coordinates of the point in the Montgomery Ladder operation, y T It is the x-coordinate of the target point (x) T The corresponding y-coordinate, the relative coordinates of the target point include the x-coordinate and the relative y-coordinate of the target point.

[0094] In some embodiments, the median value of the coordinates may include the median value of the first ordinate, Y. s The median value of the second ordinate, Y' T The median value of the first horizontal axis, X RT The median value of the second horizontal axis, X QT And to unify the intermediate Z-coordinate value Z and the slope value M. In the initialization of the Montgomery ladder operation, (x,y') is used instead of (x, y). This can be achieved by setting y in the initialization model (new_mtg_ladder_setup_msk). T =1, thus eliminating the need to calculate y. T Avoid based on x T Restore y T This reduces the computational load and improves the performance of dot product operations.

[0095] For example, step S103 can be implemented using the following formula (6):

[0096] X RT X QT , M, Y' T , Z, Y s = new_mtg_ladder_setup_msk(x T (6)

[0097] That is, the x-coordinate of the target point (x) TThe input is fed into the initialization model of the Montgomery ladder operation (new_mtg_ladder_setup_msk), and the output is the median value of the coordinates in the Jacobian coordinate system. Specifically, it can include the median value of the first ordinate, the median value of the second ordinate, the median value of the first abscissa, the median value of the second abscissa, as well as the median value of the unified Z coordinate and the slope value.

[0098] It should be noted that the x-coordinate of the target point in step S103 is the element whose non-small subgroup has been determined by the judgment in step S101.

[0099] S104: The iterative process of Montgomery ladder operation based on the median coordinate, the randomized private key, and the order of the target point.

[0100] The randomized private key is obtained by randomizing the private key of the user key pair using a random number. For example, the randomized private key can be obtained by randomizing the private key of the user key pair using the formula (7) shown below.

[0101] / / r is a random number (7)

[0102] Here, km indicates that the scalar value k is randomized using a random number. For Curve25519, the length of the random number r can be 128 bits or longer.

[0103] Optionally, before randomizing the private key of the user key pair, the private key of the user key pair, i.e., the scalar value k, can be obtained in response to a dot product command, for example, by obtaining the scalar value k from the first memory in response to a dot product command.

[0104] The Montgomery ladder operation is performed based on the median coordinates, the randomized private key, and the order of the target point to obtain the corresponding result, i.e., the candidate dot product. It should be noted that the order of the target point is obtained using the Legendre symbol from step S102.

[0105] In one possible design, step S104 could be implemented in the following ways:

[0106] The iterative process of performing Montgomery computation based on the randomized private key, the order of the target point, and the iterative input value.

[0107] For example, the iterative input values ​​may include the slope value M and the median value of the second ordinate Y'. T Unify the median value of the Z-coordinate (Z) and the median value of the first x-coordinate (X). RT The middle value of the second x-axis X QT The iterative process can then be achieved through the following steps:

[0108] For t = bits-1 to 0: / / bits is the bit length of km

[0109] if(km t ==1)

[0110] X QT X RT , M, Y' T Z = new_mtg_ladder_update(X QT X RT , M, Y' T , Z)

[0111] else

[0112] X QT X RT , M, Y' T Z = new_mtg_ladder_update(X RT X QT , M, Y' T , Z)

[0113] Where t represents the current bit position polled, km t This represents the value of the t-th bit in km, and new_mtg_ladder_update represents the iteration process.

[0114] The specific implementation of the iterative process can be shown in Table 1 below:

[0115] Table 1

[0116]

[0117] The relationship between the first iteration reference point A and the second iteration reference point B is A = T + B, X AT It is x AT =x A -x T The value transformed to the Jacobian coordinate system, X BT It is x BT =x B -x T The values ​​transformed to the Jacobian coordinate system, m' is the slope of the straight line passing through points A, B, and T, M' is the value of m' transformed to the Jacobian coordinate system, and y' is the value of m' in the Jacobian coordinate system. T Y' is the relative ordinate of point T. T It is y' T The value converted to the Jacobian coordinate system, Z is the intermediate value of the unified Z coordinate in the Jacobian coordinate system; the third reference point C = A + B, X CT It is xCT =x C -x T Values ​​converted to Jacobian coordinates, fourth reference point D=[2]B, X DT It is x DT =x D -x T The values ​​transformed to the Jacobian coordinate system, m'' is the slope of the straight line passing through points C, D, and T, M'' is the value of m'' transformed to the Jacobian coordinate system, and Y'' is the value of Y''. T It is y' T Based on the value of Z' transformed to the Jacobian coordinate system, Z' is the unified intermediate value of the Z coordinate in the updated Jacobian coordinate system. Furthermore, the first iteration reference point A includes the first reference point R, and the second iteration reference point B includes the second reference point Q; correspondingly, X... AT and X BT They can be X respectively QT X RT Or X RT X QT S105: Determine whether the result point corresponding to the target point lies on the Montgomery curve based on the median coordinate value, and obtain the target dot product result based on the determination result.

[0118] The target dot product result is applied to key generation and / or key negotiation scenarios.

[0119] After completing the iteration, check the result point (x) corresponding to the target point T based on the median coordinate value. out , y' out Whether it lies on the Montgomery curve is determined by checking, and the x-value of the target dot product [k]T is obtained based on the determination result. out The coordinates are then used to apply the target dot product result to key generation and / or key negotiation scenarios.

[0120] In some embodiments, the target dot product result can be obtained by checking using the following formula (8):

[0121] x out = new_mtg_ladder_final(Z, Y s X QT , x T , M, Y' T (8)

[0122] Where, x out The target dot product result is represented by `new_mtg_ladder_final`, which represents the algorithm used to check and obtain the target dot product result. Z and Y... s X QT M, Y'T Then, in sequence, these are the median values ​​of the uniform Z-coordinate, the median value of the first ordinate, the median value of the second x-coordinate, the slope value, and the median value of the second ordinate, x. T Represents the x-coordinate of the target point.

[0123] In this step, the check of whether the result point lies on the Montgomery curve is based on the median value of the coordinates, which differs from existing techniques that require checking the x-coordinate of the result point. out Restore the corresponding y-coordinate (y out This greatly reduces the amount of computation, improves computing performance, and enables the encryption process to resist error injection attacks without affecting computing performance.

[0124] In one possible design, Figure 2 The algorithm implementation process of the encryption processing method described in the illustrated embodiment is shown in Table 2 below:

[0125] Table 2

[0126]

[0127] The implementation process of the Montgomery ladder operation in step 5 of Table 2 using relative coordinates (x, y') can be shown in Table 1 above, where the iteration process ends when t=0.

[0128] The encryption method provided in this application first initializes the Montgomery ladder operation based on the relative coordinates of the target point on the Montgomery curve, obtaining the median coordinate value in the Jacobian coordinate system. The relative coordinates of the target point include the non-small subgroup element of the target point's x-coordinate. Then, the Montgomery ladder operation is iterated based on the median coordinate value, the randomized private key, and the order of the target point. Next, the result point corresponding to the target point is determined based on the median coordinate value to see if it lies on the Montgomery curve. The target dot product result is obtained based on the determination result and applied to key generation and / or key negotiation scenarios. Initializing the Montgomery ladder operation based on the relative coordinates of the target point to obtain the median coordinate value in the Jacobian coordinate system, and using this median coordinate value for the iterative process of the Montgomery ladder operation, can significantly reduce the computational load and improve the performance of the dot product operation. Furthermore, ensuring that the x-coordinate of the target point in the Montgomery ladder operation is not a small subgroup element avoids the occurrence of infinity points during the operation, thus preventing selected input attacks. Furthermore, the result point corresponding to the candidate dot product is determined based on the median value of the coordinates to ensure that the encryption process is resistant to error injection attacks without affecting the performance of the dot product operation.

[0129] In one possible design, one possible implementation of step S103 is as follows: The intermediate coordinate values ​​obtained based on the x-coordinate of the target point and the initialization model of the Montgomery ladder operation are as follows... Figure 3 As shown. Figure 3 This is a schematic diagram illustrating the initialization process of the Montgomery ladder operation, provided as an embodiment of this application. Figure 3 As shown, the embodiments of this application include:

[0130] S201: Obtain the intermediate value of the first ordinate based on the x-coordinate of the target point and the first initialization algorithm.

[0131] The initialization model shown in formula (6) includes the first initialization algorithm shown in formula (10). Inputting the x-coordinate of the target point into the first initialization algorithm can obtain the intermediate value of the first y-coordinate. The intermediate value of the first y-coordinate Y s The square of the ordinate of the target point is y. s Values ​​converted to Jacobian coordinates.

[0132] (10)

[0133] Where A represents the Curve25519 curve parameter, A=486662.

[0134] S202: Obtain a unified intermediate value of the Z-coordinate based on the x-coordinate of the target point and the x-coordinate randomization algorithm.

[0135] The initialization model shown in formula (6) includes the horizontal coordinate randomization algorithm shown in formulas (11) and (12). By inputting the horizontal coordinate of the target point into the horizontal coordinate randomization algorithm, a unified Z coordinate intermediate value Z can be obtained. The unified Z coordinate intermediate value is the unified Z coordinate of the target point T and the first reference point R and the second reference point Q of the target point in the Jacobian coordinate system.

[0136] (11)

[0137] (12)

[0138] Where R' is another random number of length 256 bits, and A is the Curve25519 curve parameter, which is 486662.

[0139] S203: Obtain the second intermediate value of the ordinate based on the unified Z-coordinate intermediate value and the second initialization algorithm.

[0140] The initialization model shown in formula (6) includes a second initialization algorithm as shown in formula (13). The transition value of the unified Z-coordinate intermediate value, as shown in formula (11), is input into the second initialization algorithm to obtain the second ordinate intermediate value Y'.T The median value of the second ordinate, Y' T The relative ordinate y' of the target point T Transform the value to the Jacobian coordinate system. y' T Let T be the relative y-coordinate of the target point T.

[0141] Y' T = Z2 2 mod p (13)

[0142] S204: Obtain the slope value based on the x-coordinate of the target point and the third initialization algorithm.

[0143] The initialization model shown in formula (6) includes a third initialization algorithm as shown in formula (14). Inputting the x-coordinate of the target point into the third initialization algorithm yields the slope value M. The slope value M is the value of the slope of the reference line transformed to the Jacobian coordinate system. The reference line is the line passing through the target point, the first reference point R, and the second reference point Q. The relationship between the first reference point R and the second reference point Q is R = T + Q.

[0144] (14)

[0145] S205: Obtain the median value of the first and second horizontal coordinates based on the slope value, the x-coordinate of the target point, and the fourth initialization algorithm.

[0146] The initialization model shown in formula (6) includes the fourth initialization algorithm shown in formulas (15) and (16), which inputs the x-coordinate and slope value of the target point and the transition value of the unified Z-coordinate intermediate value into formula (15) to obtain the first x-coordinate intermediate value X. RT The median value X of the second horizontal axis can be obtained through formula (16). QT Among them, the median value of the first horizontal axis, X RT It is the first relative x-coordinate (x) RT =x R -x T The value converted to the Jacobian coordinate system, the median value of the second horizontal axis X. QT It is the second relative x-coordinate (x) QT =x Q -x T The value of x converted to Jacobian coordinates. R and x Q These are the x-coordinates of the first reference point R and the second reference point Q, respectively.

[0147] (15)

[0148] X QT = 0 (16)

[0149] The Montgomery ladder operation can be initialized by using the initialization model shown in formulas (10) to (16) above, and the intermediate coordinate values ​​in the Jacobian coordinate system can be obtained.

[0150] like Figure 3 As described in the embodiments, the algorithm implementation process for initializing the Montgomery ladder operation using relative coordinates (x, y') in step 3 of Table 2 can be shown in Table 3 below:

[0151] Table 3

[0152]

[0153] As can be seen from the above embodiments, in Figure 3 During the initialization process of the embodiment shown, y can be set... T =1, thus eliminating the need to calculate y. T Avoid based on x T Restore y T The calculation process can reduce the amount of computation and improve the performance of dot product operation, making the computational performance of the initialization process based on the relative coordinates of the target point 1.7 times that of the existing technology.

[0154] In one possible design, step S105 determines whether the result point corresponding to the target point lies on the Montgomery curve based on the median coordinate value, and determines the possible implementation methods of the target point multiplication result based on the determination result, such as... Figure 4 As shown. Figure 4 This is a schematic diagram of a judgment process provided for an embodiment of this application. For example... Figure 4 As shown, the embodiments of this application include:

[0155] S301: Perform the first modulus operation based on the unified Z-coordinate median value, the first ordinate median value, the second abscissa median value, and the abscissa of the target point to obtain the Z-coordinate result value and the abscissa result value.

[0156] The algorithm shown in formula (8) includes the first sub-operation and the second sub-operation of the first modulus operation as shown in formulas (17) and (18), for example, unifying the median value Z of the Z coordinate and the median value Y of the first ordinate. s Input the first suboperation of the first modular operation shown in formula (17) to obtain the Z coordinate result value Z. s The median value of the second x-axis, X. QT Z-coordinate result value Z s and the x-coordinate of the target point T Input the second sub-operation of the first modular operation shown in formula (18) to obtain the x-coordinate result value X. Q .

[0157] (17)

[0158] (18)

[0159] S302: Perform a second modulus operation based on the median value of the second ordinate, the median value of the second abscissa, and the slope value to obtain the ordinate result value.

[0160] The algorithm shown in formula (8) includes a second modulus operation as shown in formula (19), for example, taking the median value Y' of the second ordinate. T The median value of the second horizontal axis, X QT The slope value M is input into the second modulus operation shown in formula (19) to obtain the vertical coordinate result value Y. Qs .

[0161] (19)

[0162] S303: Perform a third modulus operation based on the x-coordinate and z-coordinate results to obtain a temporary value.

[0163] The algorithm shown in formula (8) includes a third modulus operation as shown in formula (20), for example, converting the horizontal coordinate result value X... Q and the Z coordinate result value Z s Inputting the value into the third modulus operation shown in formula (20) will yield a temporary value tmp2.

[0164] (20)

[0165] Where A is the Curve25519 curve with parameters of 486662.

[0166] S304: Determine whether the result value of the ordinate is equal to the temporary value.

[0167] Determine the result value of the ordinate Y Qs If the result point is equal to the temporary value tmp2, it means that the result point corresponding to the target point is on the Montgomery curve, and step S305 is executed. Otherwise, if they are not equal, an error is reported, and step S306 is executed.

[0168] S305: Output the x-coordinate and z-coordinate values ​​based on the judgment result.

[0169] The judgment result obtained after step S304 includes the fact that the result point corresponding to the target point is on the Montgomery curve. Then, the horizontal coordinate result value X is further output. Q and the Z coordinate result value Z s And further execute step S307.

[0170] S306: Generate and output error messages.

[0171] The judgment result obtained after step S304 includes that the result point corresponding to the target point is not on the Montgomery curve. An error message can be generated and the error message can be output by the error message function (21) shown below.

[0172] assert Y Qs == tmp2: “fault detected” (21)

[0173] Here, assert represents the error reporting function.

[0174] S307: Input the x-coordinate result and z-coordinate result into the fourth modulus operation, and determine the result as the target dot product result.

[0175] The algorithm shown in formula (8) includes the fourth modulus operation shown in formulas (22) and (23), for example, the Z coordinate result value Z s Inputting the Z-coordinate transition value Z into formula (22) yields the transition value Z. sinv Then the x-axis result value X Q and the Z-coordinate transition value Z sinv Input the result into formula (23), and determine the result of formula (23) as the target dot product result X. out The output target dot product result X out .

[0176] Z sinv = Z s -1 mod p (22)

[0177] (twenty three)

[0178] Optionally, before step S307, the result value of the Z coordinate may also be included. s The system checks whether the value is not equal to 0. If the condition is true, step S307 is executed normally; otherwise, an error is reported.

[0179] like Figure 4 As described in the example, step 6 in Table 2 checks whether the result point lies on the curve and obtains the x-axis of the final result point. out The algorithm implementation process for coordinates is shown in Table 4 below:

[0180] Table 4

[0181]

[0182] Using the corresponding algorithms shown in formulas (17) to (23) above, it is possible to determine whether the result point lies on the Montgomery curve and to determine the target dot product result based on the determination result, thereby enabling the encryption processing method provided in this application embodiment to resist error injection attacks. Furthermore, this implementation differs from the prior art, which requires determining the horizontal coordinate (x, y) of the result point when judging whether it lies on the Montgomery curve. out Restore the corresponding y-coordinate (y out The corresponding implementation method of ) greatly reduces the amount of computation and improves the computing performance, so that the encryption process has the ability to resist error injection attacks without affecting the computing performance.

[0183] In one possible design, to further improve computational efficiency and performance, before reading the scalar value in response to the dot product command in the above embodiments, the following may also be included:

[0184] The decision to transfer the dot product code from the first memory to the second memory depends on the processor's configuration. For example, if the processor has a lower configuration, transfer is necessary to improve computational efficiency; otherwise, transfer is not required. If transfer is necessary, the dot product code can be transferred from the first memory to the second memory. The base point is then obtained from the second memory or a data interface. This base point is used to perform the dot product operation. The dot product code implements the operation, which includes the initialization and iteration processes of the Montgomery ladder algorithm.

[0185] Optionally, the target dot product result obtained in the above embodiments can be stored in a first memory and / or a second memory.

[0186] Figure 5 This is a schematic diagram of an encryption processing device provided in an embodiment of this application. Figure 5 As shown, the encryption processing device 400' provided in this application embodiment includes:

[0187] Initialization module 401 is used to initialize the Montgomery ladder operation based on the relative coordinates of the target point on the Montgomery curve, and obtain the intermediate coordinate values ​​in the Jacobian coordinate system. The relative coordinates of the target point include the x-coordinate and the y-coordinate of the target point. The x-coordinate of the target point is a non-small subgroup element.

[0188] The iteration module 402 is used to perform the Montgomery ladder operation iterative process based on the coordinate median value, the randomized private key and the order of the target point. The randomized private key is obtained by randomizing the private key of the user key pair with a random number.

[0189] The result judgment module 403 is used to determine whether the result point corresponding to the target point is on the Montgomery curve based on the median value of the coordinates, and to obtain the target dot product result based on the judgment result. The target dot product result is applied to the key generation scenario and / or key negotiation scenario.

[0190] In one possible design, initialization module 401 is used for:

[0191] The intermediate coordinate values ​​are obtained based on the x-coordinate of the target point and the initialization model of the Montgomery ladder operation. The intermediate coordinate values ​​include the intermediate values ​​of the first y-coordinate, the second y-coordinate, the first x-coordinate, the second x-coordinate, the unified Z-coordinate, and the slope value.

[0192] In one possible design, Figure 6 This is a schematic diagram of the structure of an initialization module provided in an embodiment of this application, such as... Figure 6 As shown, the initialization module 401 includes: a first initialization algorithm module 4011; the first initialization algorithm module 4011 is used for:

[0193] The first intermediate value of the ordinate is obtained based on the x-coordinate of the target point and the first initialization algorithm. The first intermediate value of the ordinate is the square of the ordinate of the target point transformed into the Jacobian coordinate system.

[0194] In one possible design, the initialization module 401 further includes: a second initialization algorithm module 4012; the second initialization algorithm module 4012 is used for:

[0195] A unified intermediate value of the Z-coordinate is obtained based on the x-coordinate of the target point and the x-coordinate randomization algorithm.

[0196] The intermediate value of the second ordinate is obtained based on the unified intermediate value of the Z-coordinate and the second initialization algorithm;

[0197] The midpoint of the second ordinate is the value of the relative ordinate of the target point transformed to the Jacobian coordinate system, and the midpoint of the unified Z coordinate is the unified Z coordinate of the target point and its first and second reference points in the Jacobian coordinate system.

[0198] In one possible design, the initialization module 401 further includes: a third initialization algorithm module 4013; the third initialization algorithm module 4013 is used for:

[0199] The slope value is obtained based on the x-coordinate of the target point and the third initialization algorithm;

[0200] The intermediate values ​​of the first and second x-coordinates are obtained based on the slope value, the x-coordinate of the target point, and the fourth initialization algorithm.

[0201] Wherein, the slope value is the value of the slope of the reference line transformed into the Jacobian coordinate system. The reference line is the straight line passing through the target point, the first reference point, and the second reference point. The midpoint value of the first abscissa is the value of the first relative abscissa transformed into the Jacobian coordinate system. The midpoint value of the second abscissa is the value of the second relative abscissa transformed into the Jacobian coordinate system. The first relative abscissa is obtained based on the abscissa of the first reference point and the abscissa of the target point. The second relative abscissa is obtained based on the abscissa of the second reference point and the abscissa of the target point.

[0202] In one possible design, the iteration module 402 is used for:

[0203] The iterative process of Montgomery computation based on the randomized private key, the order of the target point, and the iterative input value;

[0204] The iterative input values ​​include the slope value, the median value of the second ordinate, the median value of the unified Z-coordinate, and the median value of the first abscissa and the median value of the second abscissa.

[0205] In one possible design, the result determination module 403 is used for:

[0206] The first modulus operation is performed based on the unified Z-coordinate median value, the first ordinate median value, the second abscissa median value, and the abscissa of the target point to obtain the Z-coordinate result value and the abscissa result value.

[0207] The second modulus operation is performed based on the median value of the second ordinate, the median value of the second abscissa, and the slope value to obtain the ordinate result value.

[0208] A third modulus operation is performed based on the x-coordinate and z-coordinate results to obtain a temporary value;

[0209] Determine if the result value of the ordinate is equal to the temporary value;

[0210] If so, the judgment result includes the result point corresponding to the target point being on the Montgomery curve.

[0211] In one possible design, the result determination module 403 is also used for:

[0212] The first sub-operation of the first modulus operation is performed based on the unified Z-coordinate result value and the median value of the first ordinate to obtain the Z-coordinate result value;

[0213] The second sub-operation of the first modulus operation is performed based on the median value of the second horizontal coordinate, the result value of the Z coordinate, and the horizontal coordinate of the target point to obtain the result value of the horizontal coordinate.

[0214] In one possible design, the result determination module 403 is also used for:

[0215] Output the x-coordinate and z-coordinate values ​​based on the judgment result;

[0216] Input the x-coordinate and z-coordinate results into the fourth modulus operation, and determine the result as the target dot product result.

[0217] exist Figure 5 On this basis, Figure 7 This is a schematic diagram of another encryption processing device provided in an embodiment of this application. Figure 7 As shown, the encryption processing device 400' provided in this application embodiment further includes: a subgroup filtering and order acquisition module 404, which is used for:

[0218] Determine whether the x-coordinate of the target point is an element of a small subgroup. The elements of the small subgroup are obtained from the Montgomery curve.

[0219] If not, the order of the target point is obtained through Legendre notation, the x-coordinate of the target point, and the Montgomery curve.

[0220] The encryption processing device provided in this application embodiment can execute each step of the encryption processing method in the above method embodiment. Its implementation principle and technical effect are similar, and will not be repeated here.

[0221] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 8 As shown, the electronic device 500' may include: a processor 501, and a memory 502 communicatively connected to the processor 501.

[0222] Memory 502 is used to store programs. Specifically, the program may include program code, which includes computer-executable instructions.

[0223] Memory 502 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0224] The processor 501 is used to execute computer execution instructions stored in the memory 502 to implement the encryption processing method.

[0225] The processor 501 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0226] Optionally, the memory 502 can be either standalone or integrated with the processor 501. When the memory 502 is a device independent of the processor 501, the electronic device 500' may further include:

[0227] Bus 503 is used to connect processor 501 and memory 502. The bus can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc., but this does not mean there is only one bus or one type of bus.

[0228] Optionally, in a specific implementation, if the memory 502 and the processor 501 are integrated on a single chip, the memory 502 and the processor 501 can communicate through an internal interface.

[0229] This application also provides a computer-readable storage medium, which may include various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk. Specifically, the computer-readable storage medium stores computer-executable instructions, which are used in the various steps of the methods described in the above embodiments.

[0230] This application also provides a computer program product, including computer execution instructions that, when executed by a processor, implement the steps of the methods described above.

[0231] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the claims.

[0232] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. An encryption processing method, characterized in that, include: Determine whether the x-coordinate of the target point on the Montgomery curve is a small subgroup element, wherein the small subgroup element is obtained based on the Montgomery curve; If not, the order of the target point is obtained by using Legendre notation, the x-coordinate of the target point, and the Montgomery curve; The user key pair's private key is randomized using a random number and the order of the target point to obtain a randomized private key. The Montgomery ladder operation is initialized based on the relative coordinates of the target point on the Montgomery curve to obtain the median coordinate value in the Jacobian coordinate system. The relative coordinates of the target point include the x-coordinate and the relative y-coordinate of the target point. The x-coordinate of the target point is a non-small subgroup element. The relative y-coordinate is the ratio of the y-coordinate of the actual point in the Montgomery ladder operation to the y-coordinate of the target point. The Montgomery ladder operation is performed iteratively based on the median coordinate value, the randomized private key, and the order of the target point. After the iteration process, it is determined whether the result point corresponding to the target point is on the Montgomery curve based on the median value of the coordinates. If the result is that the result point is on the Montgomery curve, then the target dot product result is obtained based on the median value of the coordinates. The target dot product result is applied to the key generation scenario and / or key negotiation scenario.

2. The encryption processing method according to claim 1, characterized in that, The initialization of the Montgomery ladder operation based on the relative coordinates of the target point on the Montgomery curve, and the acquisition of intermediate coordinate values ​​in the Jacobian coordinate system, includes: The intermediate coordinate values ​​are obtained based on the x-coordinate of the target point and the initialization model of the Montgomery ladder operation. The intermediate coordinate values ​​include the intermediate values ​​of the first y-coordinate, the second y-coordinate, the first x-coordinate, the second x-coordinate, the unified Z-coordinate, and the slope value.

3. The encryption processing method according to claim 2, characterized in that, The step of obtaining the intermediate coordinate value based on the x-coordinate of the target point and the initialization model of the Montgomery ladder operation includes: The intermediate value of the first ordinate is obtained based on the x-coordinate of the target point and the first initialization algorithm. The intermediate value of the first ordinate is the square of the ordinate of the target point transformed into the Jacobian coordinate system.

4. The encryption processing method according to claim 2, characterized in that, The step of obtaining the intermediate coordinate value based on the x-coordinate of the target point and the initialization model of the Montgomery ladder operation includes: A unified intermediate value of the Z-coordinate is obtained based on the x-coordinate of the target point and the x-coordinate randomization algorithm. The second ordinate intermediate value is obtained based on the unified Z-coordinate intermediate value and the second initialization algorithm; Wherein, the median value of the second ordinate is the value of the relative ordinate of the target point transformed to the Jacobian coordinate system, and the median value of the unified Z coordinate is the unified Z coordinate of the target point and the first and second reference points of the target point in the Jacobian coordinate system.

5. The encryption processing method according to claim 4, characterized in that, The step of obtaining the intermediate coordinate value based on the x-coordinate of the target point and the initialization model of the Montgomery ladder operation includes: The slope value is obtained based on the x-coordinate of the target point and the third initialization algorithm; The intermediate values ​​of the first and second horizontal coordinates are obtained based on the slope value, the x-coordinate of the target point, and the fourth initialization algorithm. Wherein, the slope value is the value of the slope of the reference line transformed to the Jacobian coordinate system, the reference line is the straight line passing through the target point, the first reference point, and the second reference point, the midpoint value of the first abscissa is the value of the first relative abscissa transformed to the Jacobian coordinate system, the midpoint value of the second abscissa is the value of the second relative abscissa transformed to the Jacobian coordinate system, the first relative abscissa is obtained based on the abscissa of the first reference point and the abscissa of the target point, and the second relative abscissa is obtained based on the abscissa of the second reference point and the abscissa of the target point.

6. The encryption processing method according to any one of claims 2-5, characterized in that, The iterative process of performing the Montgomery ladder operation based on the median coordinate value, the randomized private key, and the order of the target point includes: The Montgomery operation is performed iteratively based on the randomized private key, the order of the target point, and the iterative input value. The iterative input values ​​include the slope value, the median value of the second vertical coordinate, the median value of the unified Z coordinate, and the median values ​​of the first horizontal coordinate and the second horizontal coordinate.

7. The encryption processing method according to claim 6, characterized in that, The step of determining whether the result point corresponding to the target point lies on the Montgomery curve based on the median value of the coordinates includes: The first modulus operation is performed based on the unified Z-coordinate median value, the first ordinate median value, the second abscissa median value, and the abscissa of the target point to obtain the Z-coordinate result value and the abscissa result value; A second modulus operation is performed based on the median value of the second ordinate, the median value of the second abscissa, and the slope value to obtain the ordinate result value; A third modulus operation is performed based on the x-coordinate result value and the z-coordinate result value to obtain a temporary value; Determine whether the result value of the ordinate is equal to the temporary value; If so, the judgment result obtained includes the result point corresponding to the target point on the Montgomery curve.

8. The encryption processing method according to claim 7, characterized in that, The step of performing a first modulus operation based on the unified Z-coordinate median value, the first ordinate median value, the second abscissa median value, and the abscissa of the target point to obtain the Z-coordinate result value and the abscissa result value includes: The first sub-operation of the first modulus operation is performed based on the unified Z-coordinate median value and the first ordinate median value to obtain the Z-coordinate result value; The second sub-operation of the first modulus operation is performed based on the median value of the second horizontal coordinate, the result value of the Z coordinate, and the horizontal coordinate of the target point to obtain the result value of the horizontal coordinate.

9. The encryption processing method according to claim 7, characterized in that, The target dot product result is obtained based on the judgment result, including: Based on the judgment result, output the horizontal coordinate result value and the Z coordinate result value; The horizontal coordinate result value and the Z coordinate result value are input into the fourth modular operation, and the result obtained is determined as the target dot product result.

10. An encryption processing device, characterized in that, include: The subgroup filtering and order acquisition module is used to determine whether the x-coordinate of the target point on the Montgomery curve is a small subgroup element, wherein the small subgroup element is obtained based on the Montgomery curve; if not, the order of the target point is obtained through Legendre notation, the x-coordinate of the target point, and the Montgomery curve. An initialization module is used to randomize the private key of the user key pair using a random number and the order of the target point to obtain a randomized private key; it initializes the Montgomery ladder operation based on the relative coordinates of the target point on the Montgomery curve, and obtains the median coordinate value in the Jacobian coordinate system. The relative coordinates of the target point include the x-coordinate and the relative y-coordinate of the target point. The x-coordinate of the target point is a non-small subgroup element. The relative y-coordinate is the ratio of the y-coordinate of the actual point in the Montgomery ladder operation to the y-coordinate of the target point. An iterative module is used to perform the Montgomery ladder operation iteratively based on the median coordinate value, the randomized private key, and the order of the target point. The result judgment module is used to determine whether the result point corresponding to the target point is on the Montgomery curve based on the median value of the coordinates after the iteration process. If the judgment result is that the result point is on the Montgomery curve, the target dot product result is obtained based on the median value of the coordinates. The target dot product result is applied to the key generation scenario and / or key negotiation scenario.

11. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the encryption processing method as described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the encryption processing method as described in any one of claims 1-9.

13. A computer program product comprising computer-executable instructions, which, when executed by a processor, are used to implement the encryption processing method as described in any one of claims 1-9.

Images