A signature method based on SM3 and SM4

Abstract

The application discloses a signature method based on SM3 and SM4. The method comprises the following steps: 1) constructing a pseudo-random number generator to generate a key stream; 2) according to a random private key sk=sk0||sk1, the pseudo-random number generator is used to expand sk0 into T signature keys; each signature key is calculated through a hash function to obtain T leaf nodes of a Merkle tree, and a public key pk is generated according to the Merkle tree; 3) for a message M, a signature seed value S is generated and a hash value H of the message M is calculated; then a pseudo-random number stream is generated according to a subset seed value D=Hash(S||H); the pseudo-random number stream is split into 2K unsigned integer values in big-endian sequence, and K values are selected as index values; 4) K signature keys are selected from the T signature keys according to the K index values; 5) K leaf nodes are determined according to the selected K signature keys, and the K leaf nodes are spliced with S to obtain a signature. The application greatly improves the signature and verification efficiency.

Description

Technical Field

[0001] This invention belongs to the field of network security technology and relates to a signature method, particularly a signature method based on SM3 and SM4. Background Technology

[0002] Hash function-based signature schemes are digital signature schemes that use hash functions to implement signing and verification. Unlike traditional digital signature schemes, hash function-based signature schemes require only a small amount of hash calculation and do not need to use complex algorithms, thus making signing and verification faster. Generally, hash function-based signature schemes require steps such as key generation, signing, and verification.

[0003] Existing signature schemes based on hash functions are large in size and have low signing and verification efficiency. Summary of the Invention

[0004] In view of the problems existing in the prior art, the purpose of this invention is to provide a signature method based on SM3 and SM4, which not only fills the gap in the localization of signature schemes, but also improves signature efficiency.

[0005] The technical solution of this invention is as follows:

[0006] A signature method based on SM3 and SM4, comprising the following steps:

[0007] 1) Construct a pseudo-random number generator SM4-256-CTR to generate a key stream; the pseudo-random number generator is input with a 256-bit key, which is used to encrypt the counter of the pseudo-random number generator. The encryption algorithm is SM4, and the counter is a 16-bit value with an initial value of 0000…0000; each time a random number is obtained, the value of the counter is incremented by 1.

[0008] 2) Based on the random private key sk = sk0||sk1, where sk0 and sk1 are each 256-bit; use the pseudo-random number generator SM4-256-CTR to expand sk0 into T 256-bit signature keys ek0, ek1, ..., ek T-1 Each signature key is hashed using a hash function to obtain T leaf nodes L of a Merkle tree. i =Hash(ek) i ), i = 0, ..., T-1; Calculate the parent node corresponding to each pair of adjacent nodes in the c-th level of the Merkle tree, up to the log2C-th level; Use the C nodes in the log2C-th level as the public key pk; C is the number of subtrees in the Merkle tree, T is the number of nodes in the tree.

[0009] Powers of 2, K < T, C < T;

[0010] 3) For a message M to be signed, generate a signature seed value S = Hash(sk1||Hash(M)) and calculate the hash value H = Hash(M) of message M; then calculate the subset seed value D = Hash(S||H); input D into the pseudo-random number generator SM4-256-CTR, and output a pseudo-random number stream of length 64K-bit; split the pseudo-random number stream into 2K unsigned integer values ​​N0, N1, ..., N in big-endian order. 2K-1 Select K values ​​from the 2K unsigned integer values ​​as index values ​​V0,…,V K-1 ;

[0011] 4) Based on the selected K index values ​​V0,…,V K-1 Select K signature keys from T signature keys.

[0012]

[0013] 5) Based on the selected K signature keys Calculated using hash function Identify K leaf nodes The K leaf nodes The sibling node is concatenated with the signature seed value S to obtain the signature sig;

[0014] 6) Starting from the bottom layer of the Merkle tree up to the 1+log2C layer, calculate the parent node corresponding to each pair of adjacent nodes in the previous layer based on each pair of adjacent nodes in the current layer, and then... The values ​​of the sibling nodes of the corresponding K parent nodes are concatenated with the signature seed value S to obtain the K leaf nodes. The authentication path for each leaf node.

[0015] A signature result verification method based on the aforementioned signature method comprises the following steps:

[0016] 1) For a signature sig and a message M, calculate the hash value H = Hash(M) of message M; then extract the signature seed value S from the signature sig and calculate the subset seed value D' = Hash(S||H); input D' into the pseudo-random number generator SM4-256-CTR, which outputs a pseudo-random number stream of length 64K-bit; split the pseudo-random number stream into 2K unsigned integer values ​​of length 32-bit in big-endian order and select K values ​​as index values ​​V0',…,V K-1 ';

[0017] 2) Use these K values ​​as indexes V0', ..., V K-1 Each index value Vi ':

[0018] (a) Retrieve the signing key, index value V, from the signature sig. i The signature key is the (i+1)th 256-bit string in the signature sig;

[0019] (b) Using the signature sig in V i 'Calculate the corresponding parent node up to the log2C layer for the authentication path of the corresponding child node;

[0020] (c) Verify whether the subtree root of the log2C layer is the same as that in the public key pk. If they are the same, then V i 'The authentication path of the corresponding child node has been verified.'

[0021] 3) Once the authentication paths of all K child nodes have been verified, the signature sig is verified.

[0022] Furthermore, select K values ​​from these 2K unsigned integer values ​​as index values ​​V0,…,V K-1 The method is as follows: First, select V0 = N0, then satisfy N i ≠ the first N of V0 i As V1, i>0; then the first value different from V0 and V1 is taken as V2, and selection continues in the manner that the next selected index value is different from the previously selected index value, until V is selected. K-1 .

[0023] Furthermore, the hash value of each pair of adjacent nodes in the current layer is calculated as the parent node corresponding to those two adjacent nodes in the previous layer.

[0024] Furthermore, the legend is characterized by T=8, K=2, and C=2.

[0025] Furthermore, the length of the message M is 256 bits.

[0026] The advantages of this invention are as follows:

[0027] This scheme employs domestically developed algorithms to achieve efficient signature and verification, filling a gap in domestic signature schemes. Because it uses only symmetric cryptographic primitives, it is resistant to quantum computing attacks. Compared to existing hash-based signature schemes, this scheme features smaller signature sizes and higher signing and verification efficiency.

[0028] The digital signature scheme mentioned in this invention is a stateless few-times signature scheme with a structure similar to Hash to Obtain Random Subset (HORS) using SM3 as the hash function. Compared to the HORS scheme, this scheme reduces the size of the public key through its Merkle tree structure. In the HORS scheme, a hash function is used to randomly obtain a subset of the integer set, while the digital signature scheme mentioned in this invention uses a variant of SM4 as a pseudo-random number generator to randomly obtain a subset of the integer set, ensuring that the elements of the subset are unique. Furthermore, the digital signature scheme mentioned in this invention reduces the size of the signature by eliminating redundant key nodes, at the cost of increasing the public key size.

[0029] The digital signature scheme mentioned in this invention is simple to implement, requiring only a small amount of code; it has strong security, relying on the collision resistance of the hash function SM3 used; the balance between efficiency and security can be easily adjusted through its parameters; if the number of messages to be signed exceeds the limit, even if signature forgery occurs, the legitimate signer can detect the corresponding forged signature. Attached Figure Description

[0030] Figure 1 This is a method for generating public and private key pairs.

[0031] Figure 2 For message signing methods.

[0032] Figure 3 To verify the signature method. Detailed Implementation

[0033] The present invention will now be described in further detail with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0034] 1. Symbols and Parameters

[0035] || String concatenation symbol

[0036] The size of set T must be a power of 2.

[0037] The size of subset K must be less than the size of the set T.

[0038] The number of subtrees C must be a power of 2 and strictly less than T.

[0039] 2. Terms and Definitions

[0040] pk public key, 32C bytes in size.

[0041] The SIG signature has a size of 32 × (K + K(log2T - log2C) + 1) bytes.

[0042] For the hash function, choose SM3 to calculate a hash of 32 for any length of input message.

[0043] byte hash value

[0044] The SM4-256-CTR pseudo-random number generator has a 32-byte key size and calculates several 32-byte output values ​​from a single 32-byte input value.

[0045] 3. Signature Scheme

[0046] 3.1 Construction Method of Pseudo-random Number Generator

[0047] The pseudo-random number generator SM4-256-CTR used in this invention is constructed based on the SM4 algorithm. Since the SM4-256-CTR requires a 256-bit key length while the SM4 algorithm requires a 128-bit key length, to preserve the internal structure of the SM4 algorithm to the greatest extent possible, the SM4-256-CTR in this invention uses the SM4 algorithm twice. The first 128 bits of the 256-bit key are used as the key for the first use of the SM4 algorithm, and the last 128 bits of this 256-bit key are used as the key for the second use of the SM4 algorithm.

[0048] The SM4 algorithm has a block size of 128 bits. During each encryption process, the counter is incremented by 1. Then, two 128-bit keys for the SM4 algorithm are used to encrypt the counter. The resulting two 128-bit keys are then XORed sequentially with the plaintext blocks to obtain two 128-bit ciphertext blocks. In SM4-256-CTR, the above encryption calculation is performed the required number of times for the desired 256-bit result.

[0049] 3.2 Public-Private Key Pair Generation Method

[0050] The private key sk is a random 512-bit value, which can be regarded as the concatenation of two 256-bit values ​​sk0 and sk1, i.e., sk0||sk1=sk.

[0051] The public key pk can be calculated from the sk0 part of the private key, the process is as follows: Figure 1 , where T = 8, K = 2, C = 2.

[0052] Step 1: By using a pseudo-random number generator SM4-256-CTR with sk0 as the key and a 128-bit counter initially set to 0000…0000, a 256T-bit result is obtained, that is, the private key sk0 is expanded into K 256-bit signing keys ek0, ek1, …, ek K-1 .

[0053] Step 2: Calculate the T leaf nodes L of the Merkle tree for each signature key using a hash function. i =Hash(ek) i ), i = 0, ..., T-1.

[0054] Step 3: Calculate Hash(L0||L1), Hash(L2||L3), ... up to the log2C level; that is, calculate the parent node corresponding to each pair of adjacent nodes in the (c-1)th level based on each pair of adjacent nodes in the c-th level of the Merkle tree. Use the C nodes at the log2C level as the public key pk = pk0, ..., pk c-1 Each of the C nodes is the hash value of its two child nodes.

[0055] 3.3 Subset Generation Methods

[0056] The subset generation function is the core component of the digital signature scheme mentioned in this invention. Given a 256-bit signature seed value S and a 256-bit message M hash value H = Hash(M), this function selects K values ​​from 0, 1, ..., T-1. The specific steps are as follows:

[0057] Step 1: Calculate the subset seed value D = Hash(S||H).

[0058] Step 2: By inputting a pseudo-random number generator SM4-256-CTR with D as the key and an initial value of 0000…0000, a pseudo-random number stream of length 64K-bit is obtained (used to represent the node sequence number).

[0059] Step 3: Split the pseudo-random number stream obtained in Step 2 into 32-bit unsigned integer values ​​N0, N1, ..., N in big-endian order. 2K-1 Each of these integer values ​​is a simplified modulus T.

[0060] Step 4: Determine K distinguishing values ​​V0,…,V as follows. K-1 :

[0061] a) V0 = N0;

[0062] b) V1 satisfies N i ≠ the first N of V0 i , where i > 0;

[0063] c) V2 is the first value that differs from V0 and V1, and so on, up to V K-1 .

[0064] 3.4 Message Signature Method

[0065] Given a private key sk = sk0||sk1 and a message M, calculate the signature sig as follows (see below for details). Figure 2 , where T = 8, K = 2, C = 2.

[0066] Step 1: Let the seed value of the signature be S = Hash(sk1||Hash(M)), and calculate the subset of index values ​​V0, V1, ..., V using the method described above. K-1 Use a 256-bit initial signature value S.

[0067] Step 2: Using the same method as generating the public key pk, expand sk0 in the private key sk into T 256-bit signing keys ek0, ek1, ..., ek T-1 .

[0068] Step 3: Based on the K index value sets V0, V1, ..., V K-1 K signing keys will be selected from T signing keys. By appending it to the signature seed value S, we get...

[0069] Step 4: Similar to the public key generation phase, calculate the 1+log2C level of the Merkle tree, but record the authentication path of each of the K leaf nodes in the subset. The process is as follows:

[0070] (a) Calculate the hash value for each signature key to obtain the leaf node L. i =Hash(ek) i ), i = 0, ..., T-1;

[0071] (b) Leaf nodes The sibling node is appended after the S value;

[0072] (c) Calculate the parent node of each pair of leaf nodes by computing Hash(L0||L1), Hash(L2||L3), ... . Then, use the signing key. The values ​​of the K sibling nodes of the parent node are appended to the end of S;

[0073] (d) Repeat step (c) in the previous layer to add the nodes of the upper layer of the Merkle tree to S, forming K authentication paths, until the 1+log2C layer, which is one layer deeper than the root of the subtree in the public key.

[0074] 3.5 Signature Verification Method

[0075] Given a public key pk and a message M, verify the signature sig using the following method, as follows: Figure 3 As shown, where T = 8, K = 2, C = 2.

[0076] Step 1: Following the subset generation method, use the first 256 bits of sig to calculate the subsets of index values ​​V0, V1, ..., V K-1 .

[0077] Step 2: For each of the K index values:

[0078] (a) Retrieve the signature key, index value V, from the signature. i The signature key is the (i+1)th 256-bit string in the signature;

[0079] (b) Using the authentication path in the signature, compute its parent nodes up to the log2C layer;

[0080] (c) Verify whether the subtree root of the log2C layer is the same as that in the public key;

[0081] Step 3: The signature sig is valid if and only if all K verifications are successful.

[0082] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A signature method based on SM3 and SM4, comprising the following steps: 1) Construct a pseudo-random number generator SM4-256-CTR to generate a key stream; the pseudo-random number generator is input with a 256-bit key, which is used to encrypt the counter of the pseudo-random number generator. The encryption algorithm is SM4, and the counter is a 16-bit value with an initial value of 0000…0000. Each time a random number is obtained, the counter increments by 1. 2) Based on a random private key || , , Each 256-bit; using the pseudo-random number generator SM4-256-CTR to... Expanded to T 256-bit signature keys , , ..., Each signature key is hashed using a hash function to obtain T leaf nodes of a Merkle tree. = , ; Calculate the parent node corresponding to each pair of adjacent nodes in the (c-1)th layer based on each pair of adjacent nodes in the c-th layer of the Merkle tree, until the... Layer; will the first On the layer Each node serves as the public key. ; T Powers of 2 K Less than T , C Power of 2 and less than T ; 3) For messages awaiting signature Generate signature seed value And calculate the message Hash value Then calculate the subset seed value. ;Will Input a pseudo-random number generator SM4-256-CTR, output a number of length 64 K A pseudo-random number stream of 32 bits; the pseudo-random number stream is split into 32-bit length 2... K Unsigned integer values , , …, From the 2 K Select from unsigned integer values Each value is used as an index. , …, ; 4) Based on the selected K index values , …, from Select from the signature keys Signature key , ,…, ; 5) Based on the selected K indivual , ,…, Calculated through hash function = , Determine K leaf nodes , … , , will K leaf nodes , … , sibling nodes and signature seed value By piecing together the pieces, a signature can be obtained. ; 6) Starting from the bottom layer of the Merkle tree up to the th The layer calculates the parent node corresponding to each pair of adjacent nodes in the previous layer based on the current layer's adjacent nodes, and then... , … , corresponding The sibling node values ​​of the parent node and the signature seed value By piecing them together, we can obtain the following. K leaf nodes , … , The authentication path for each leaf node.

2. A signature result verification method based on the signature method of claim 1, comprising the following steps: 1) Regarding signatures and messages M , calculate message Hash value Then from the signature Extract the signature seed value And calculate the subset seed value. ;Will Input a pseudo-random number generator SM4-256-CTR, output a number of length 64 K A pseudo-random number stream of 32 bits; the pseudo-random number stream is split into 32-bit length 2... K Select from unsigned integer values. Each value is used as an index. , …, ; 2) Regarding this Each value is used as an index. , …, Each index value : (a) From the signature Retrieve the signature key and index value The signature key is the signature key. The first in A 256-bit string; (b) Using a signature middle For the authentication path of the corresponding child node, calculate its corresponding parent node up to... layer; (c) Verification Does the subtree root of the layer match the public key? If they are the same, then The authentication path verification for the corresponding child node has passed; 3) When all After all the authentication paths of each child node have been verified, then the signature is generated. Verification passed.

3. The method according to claim 1, characterized in that, From that 2 K Select from unsigned integer values Each value is used as an index. , …, The method is as follows: First select = Then satisfy ≠ The first As , Then the first difference is... and The value as The selection continues in the order that the next selected index value is different from the previously selected index value, until a value is selected. .

4. The method according to claim 1, characterized in that, Calculate the hash value of each pair of adjacent nodes in the current layer and use it as the parent node of the corresponding pair of adjacent nodes in the previous layer.

5. The method according to claim 1, 2, or 3, characterized in that, 。 6. The method according to claim 1, 2, or 3, characterized in that, The message The length is 256 bits.

Images