An SM9 encryption method supporting single private key decryption of multiple ciphertexts

Abstract

The application discloses an SM9 encryption method supporting single private key decryption of multiple ciphertexts, a key generation center generates a main public and private key pair, discloses the generated main public key to users in a system, and secretly saves the main private key; the key generation center generates a private key of a user by using the main public and private key pair and all identities ID of the user, and sends the private key to the user through a secure channel; an encrypter generates ciphertext corresponding to a message by using the main public key of the key generation center based on a selected encryption ID and the encrypted message; and a decryption algorithm decrypts the ciphertext to obtain plaintext based on the ciphertext corresponding to the message, the main public key of the key generation center and the private key of the decrypter. The private key can decrypt different ciphertexts encrypted by different public keys, greatly reduces the storage cost of the private key of the user and reduces the management of the private key, and is helpful to promote the application of the SM9 encryption algorithm.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and mainly relates to an SM9 encryption method supporting single private key decryption of multiple ciphertexts. BACKGROUND

[0002] Since the PKE encryption needs to determine whether the public key used for encryption is the public key of the user who will receive the message, a trusted third party is introduced to bind the user identity and the public key of the user. At this time, the encrypter only needs to inquire the registration information of the public key from the trusted third party, and can know whether the public key belongs to the receiver. However, when the user base becomes large, the storage and query of a large number of user registration information greatly reduce the running efficiency of the trusted third party. Therefore, in order to solve the problem of public key and identity binding, the identity-based encryption (IBE) is born. In the identity-based encryption system, the public key of the user is no longer a random string, but a unique identifier of the user identity, such as a mobile phone number, an ID card number and the like. The advantage of this is that the encrypter does not need to verify the public key from the trusted third party when encrypting, and the problem of public key and identity binding is solved.

[0003] In the encryption scheme based on IBE, one ID of a user corresponds to one private key. When a user has multiple identity identifiers, multiple corresponding private keys will be generated. When the user receives the ciphertexts encrypted by different identifiers, the corresponding private keys need to be queried for decryption, and the user needs to save a large number of private keys. In order to solve this problem, an IBE scheme using a single private key to decrypt multiple ciphertexts is proposed, that is, the decryption function of multiple private keys to different ciphertexts is converted into the decryption function of a single private key, so as to realize the decryption of the ciphertexts encrypted by different identifiers by using a single private key.

[0004] In order to realize the self-controllable password and protect the network and information security, the SM9 encryption algorithm is independently designed in China and has become an international standard. As a commercial encryption algorithm of China, the SM9 encryption algorithm has strong security and high efficiency, is commonly used for protecting the confidentiality of data, and has been widely applied. However, the SM9 encryption algorithm only meets the basic common demand and does not support the application scene of the user having multiple identifiers, thereby limiting the deployment of the SM9 encryption algorithm. SUMMARY

[0005] The present application is just aimed at the problem that the SM9 encryption algorithm in the prior art does not have the function of decrypting multiple ciphertexts with a single private key, and provides an SM9 encryption method supporting decryption of multiple ciphertexts with a single private key, wherein a key generation center generates a main public-private key pair, discloses the generated main public key to users in the system, and secretly saves the main private key; the key generation center generates a private key of a user by using the main public-private key pair and all identities ID of the user, and sends the private key to the user through a secure channel; an encrypter generates ciphertext corresponding to a message by using the main public key of the key generation center based on a selected encryption ID and the encrypted message; and a decryption algorithm decrypts the ciphertext to obtain plaintext based on the ciphertext corresponding to the message, the main public key of the key generation center and the private key of the decrypter. The private key can decrypt different ciphertexts encrypted by different public keys, greatly reduces the storage cost of the private key of the user and the management of the private key, and helps to promote the application of the SM9 encryption algorithm.

[0006] In order to achieve the above-mentioned purpose, the technical scheme adopted by the present application is as follows: an SM9 encryption method supporting decryption of multiple ciphertexts with a single private key, comprising the following steps:

[0007] S1: a key generation center generates a main public-private key pair, discloses the generated main public key to users in the system, and secretly saves the main private key;

[0008] S2: the key generation center generates a private key of a user by using the main public-private key pair and all identities ID of the user, and sends the private key to the user through a secure channel;

[0009] S3: an encrypter generates ciphertext corresponding to a message by using the main public key of the key generation center based on a selected encryption ID and the encrypted message;

[0010] S4: a decryption algorithm decrypts the ciphertext to obtain plaintext based on the ciphertext corresponding to the message, the main public key of the key generation center and the private key of the decrypter.

[0011] As an improvement of the present application, in the step S1: a bilinear group BP=(G1, G2, G T , e, N) is selected, wherein G1 is an additive cyclic group with a prime number N as the order; G2 is an additive cyclic group with a prime number N as the order; G T is a multiplicative cyclic group with a prime number N as the order; e is a bilinear mapping from G1xG2 to G T ; the generators of the group G1 and the group G2 are P1 and P2 respectively, a random number a∈[1, N-1] is generated as the main private key, and an element in G1 is calculated , wherein k is 0-q, and q is the maximum number of possible identities of the user; an encryption private key generation function identifier hid represented by one byte is selected and disclosed.

[0012] As an improvement of the present application, in step S2, assuming that the number of the identities owned by the user is y, in order to generate the private key sk of the user, the key generation center first calculates a series of non-zero elements in the finite field F N above: t1=H1(ID1||hid,N)+α, t2=H1(ID2||hid,N)+α, ···, t y =H1(ID y ||hid,N)+α, where it is required that each of the elements H1(ID i ||hid,N) i∈[1,y] is not equal to -α mod p, and then calculates t * =α y ·t1 -1 ·t2 -1 ···t y -1 , and the private key of the user is calculated as sk=t * ·P2.

[0013] As another improvement of the present application, step S3 specifically comprises: the encrypter uses the ID1 of the receiver to encrypt, and calculates where i=1, 2, ···, q;

[0014] selects a random number σ∈{0,1} n , and lets r=H3(σ,m);

[0015] calculates where i=1, 2, ···, q;

[0016] lets the ciphertext be:

[0017]

[0018] It is known that U i+1 =α -1 U i , thus the ciphertext can be implicitly expressed as C=(U1,α -1 U1,···,α -(q-1) U1,V,W).

[0019] As another improvement of the present application, in step S4, for the ciphertext C=(U1,U2,···,U q ,V,W) to be decrypted, where It is known that U i+1 =α -1 U i , the decrypter first calculates U=a1U y +a2U y-1 +···+a yU1, where; the decryptor uses the private key sk and U to calculate: e(U,sk), calculate calculate And calculate r′=H3(σ′,m′), and finally calculate Compare whether U1 in the ciphertext and the calculated U1′ are equal. If they are equal, it means that the decrypted m' is the message m encrypted by the encryptor.

[0020] As a further improvement of the present invention, a i The calculation method is as follows: First, in the set {H1(ID)} j ||jid,N)} j∈[2,y] Take any i-1 values ​​from the set, multiply the remaining values, then iterate through all possible choices and obtain the corresponding products, finally sum all the products and multiply by 1.

[0021] Compared with existing technologies, the present invention offers the following advantages: It provides an SM9 encryption method that supports decrypting multiple ciphertexts with a single private key. Without altering the overall architecture of the SM9 encryption algorithm, the algorithm is optimized to support decryption of different ciphertexts encrypted with different identifiers using a single private key. Specifically, when a user needs to decrypt different ciphertexts encrypted with multiple IDs, they do not need to look up the private keys corresponding to each ID and then decrypt the different ciphertexts; instead, a single private key is used to decrypt the different ciphertexts encrypted with different identifiers. In multi-identifier application scenarios, this method does not require generating a corresponding private key for each identifier. Users do not need to store multiple private keys; only a single private key is required, effectively reducing the burden of private key storage and management and promoting the application of the SM9 encryption algorithm. Detailed Implementation

[0022] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the present invention.

[0023] Example 1

[0024] An SM9 encryption scheme that supports decrypting multiple ciphertexts with a single private key. Multiple SM9 encrypted messages generated from multiple IDs of the same user can be decrypted using only one private key. The method specifically includes the following steps:

[0025] S1. The key generation center generates a master-public-private key pair, discloses the generated master-public key to users in the system, and secretly stores the master-private key.

[0026] First, select the bilinear group BP = (G1, G2, G...). T Given groups G1 and G2, with generators P1 and P2 respectively, generate random numbers α∈[1,N-1] as the master private key and compute the elements in G1. where k takes 0 to q (q is the maximum number of possible IDs that a user can have). Select and disclose the encrypted private key generation function identifier hid represented by one byte.

[0027] where,

[0028] BP: bilinear group;

[0029] N: order of cyclic group G1, G2, G T , and N > 2 191 is a prime number;

[0030] G1: additive cyclic group whose order is a prime number N;

[0031] G2: additive cyclic group whose order is a prime number N;

[0032] G T : multiplicative cyclic group whose order is a prime number N;

[0033] e: bilinear mapping from G1 x G2 to G T ; P1: generator of group G1;

[0034] α: master private key;

[0035] q: maximum number of IDs that different users can have;

[0036] [1, N-1], set of integers not less than 1 and not greater than N-1;

[0037] P1: generator of group G1;

[0038] P2: generator of group G2;

[0039] element in group G1;

[0040] hid: encrypted private key generation function identifier represented by one byte, selected and disclosed by the key generation center.

[0041] S2, the key generation center generates the private key of the user by using the master public and private key pair and all the IDs of the user, and sends the private key to the user through a secure channel.

[0042] The step S2 of generating the private key of the user by the key generation center specifically includes: assuming that the number of IDs that the user has is y, to generate the private key sk of the user, the key generation center first calculates a series of non-zero elements on the finite field F N : t1 = H1(ID1 || hid, N) + α, t2 = H1(ID2 || hid, N) + α, ···, t y = H1(ID y||hid,N)+a, where a is required to be {H1(ID i ||hid,N)} i∈[1,y] Each element in the set is not equal to -a mod p, then calculate t * = a y · t1 -1 · t2 -1 ··· t y -1 Finally, the user's private key is calculated as sk = t * · P2.

[0043] where,

[0044] y: the number of IDs that the decrypter has;

[0045] ID1~ID y : all the IDs of the decrypter;

[0046] sk: the aggregated decryption key of the decrypter, which is an element in the group G2;

[0047] F N : a finite field;

[0048] ID||hid: the concatenation of ID and hid, where ID and hid are bit strings or byte strings;

[0049] t1~t y : temporary variables, which are elements in the finite field F N

[0050] H1(·): a hash function from to

[0051] S3, the encrypter generates the ciphertext of the corresponding message based on the selected encryption ID and the encrypted message, and the master public key of the key generation center.

[0052] Suppose the encrypter encrypts using the ID1 of the receiver; calculate where i = 1, 2, ···, q; since we consider that the encrypter does not know the number of IDs of the receiver, the encrypter only needs to calculate with the maximum number of ID identifiers that the receiver may have.

[0053] Select a random number σ∈{0,1} n , and let r = H3(σ, m);

[0054] Calculate where i = 1, 2, ···, q;

[0055] Let the ciphertext be:

[0056] ​

[0057] Easy to know U i+1 =α -1 U i Therefore, the ciphertext can be implicitly represented as C = (U1, α) -1 U1,···,α -(q-1) U1,V,W)

[0058] in,

[0059] r: belongs to the group Elements in;

[0060] σ: A random bit string of length n;

[0061] m: The plaintext message to be encrypted, with a message length of n;

[0062] H2:G T to {0,1} n Hash function;

[0063] H3: {0,1} * arrive Hash function;

[0064] H4: {0,1} n to {0,1} n Hash function;

[0065] C: The ciphertext corresponding to the plaintext message m.

[0066] S4. The decryption algorithm decrypts the ciphertext based on the ciphertext corresponding to the message, the master public key of the key generation center, and the decryptor's private key sk to obtain the plaintext.

[0067] Suppose the ciphertext to be decrypted is C = (U1, U2, ..., U... q ,V,W), where Easy to know U i+1 =α -1 U i The decoder first calculates U = a1U y +a2U y-1 +···+a y U1, where a i The calculation method is as follows: First, in the set {H1(ID)} j ||hid,N)} j∈[2,y] Take any i-1 values ​​from the set, multiply the remaining values, then iterate through all possible choices and obtain the corresponding products, finally sum all the products and multiply by 1.

[0068] in

[0069] The formula calculation needs to be explained here:

[0070] Assume that G1, G2, G T are cyclic groups of order large prime number N, P1, P2 are the generators of groups G1, G2 respectively, Z N is an integer field containing N elements, and the bilinear group BP consists of five tuples (G1, G2, G T , e, N).

[0071] Where the mapping e: G1x G2→ G T is a bilinear mapping, satisfying the following three conditions:

[0072] (1) Bilinearity: for any generators P1∈G1, P2∈G2 and all have e(aP1, bP2) = e(P1, P2) ab ;

[0073] (2) Non-degeneracy: there exists at least one element P∈G1, Q∈G2 such that e(P, Q)≠1;

[0074] (3) Computability: for any P∈G1, Q∈G2, there exists a polynomial-time algorithm to efficiently compute e(P, Q).

[0075] Then the decrypter calculates H3(σ', m') = r', and finally calculates and compares whether U1 in the ciphertext and the calculated U1' are equal. If they are equal, it means that the decrypted m' is the message m encrypted by the encrypter.

[0076] Where,

[0077] σ': temporary variable, n-bit length string;

[0078] m': decrypted information, n-bit length string;

[0079] r': temporary variable, element in the finite field ;

[0080] U1': temporary variable, element in the finite field .

[0081] From the above description, it can be known that the application optimizes the algorithm without changing the overall architecture of the SM9 encryption algorithm, so that it supports single private key decryption of different ciphertexts obtained by different identification encryption. That is, when a user needs to decrypt different ciphertexts obtained by multiple ID encryption of himself, the user does not need to find the private key corresponding to different IDs and then decrypt different ciphertexts, but uses a single private key to decrypt different ciphertexts obtained by different identification encryption. In the multi-identification application scenario, the method does not need to generate a private key corresponding to each identification, and the user does not need to save multiple private keys, but only needs to save a single private key, which effectively reduces the storage and management of the private key by the user, and helps to promote the application of the SM9 encryption algorithm.

[0082] It should be noted that the above content only illustrates the technical idea of the application, and cannot limit the protection scope of the application. For ordinary skilled persons in the art, without departing from the principles of the application, a number of improvements and refinements can be made, which fall within the protection scope of the claims of the application.

Claims

1. An SM9 encryption method supporting single private key decryption of multiple ciphertexts, characterized in that, comprising the steps of: S1: the key generation center generates a main public-private key pair, discloses the generated main public key to the users in the system, and secretly saves the main private key; selects a bilinear group wherein, is a cyclic additive group of prime order ; is a cyclic additive group of prime order ; is a cyclic multiplicative group of prime order ; is a bilinear mapping from to ; the generators of the groups and are and respectively, a random number is generated as the main private key, and an element in is calculated, wherein takes , is the maximum number of possible identities of a user; a one-byte encryption private key generation function identifier is selected and disclosed; S2: the key generation center uses the master public-private key pair and all the identities of the users generates the decryption private key for the user and sends the private key to the user through a secure channel; S3: The encryptor generates the ciphertext of the message corresponding to the message based on the selected encryption and the encrypted message, using the master public key of the key generation center. S4: The decryption algorithm is based on the ciphertext corresponding to the message, the main public key of the key generation center and the private key of the decrypter to decrypt the ciphertext to obtain the plaintext; for the ciphertext to be decrypted , wherein , it is easy to know , the decrypter first calculates , wherein The calculation is: after taking out i-1 values in the set , multiply the remaining values, then traverse all possible methods and obtain the corresponding products, finally sum these products and multiply by 1, wherein ; the decrypter calculates using the private key and : , calculate , calculate , and calculate , and finally calculate ; compare whether the in the ciphertext and the calculated are equal, if equal, it means that the decrypted is the message encrypted by the encrypter; wherein , is a hash function, , , is the plaintext message to be encrypted, , is the identity of the receiver, , is the number of user identities.

2. The SM9 encryption method of claim 1, wherein the method supports decryption of multiple ciphertexts with a single private key. The step S2, assuming the number of the user's identity is , for generating the user's private key , the key generation center first calculates a series of non-zero elements on the finite field : , , ···, , where each element in is not equal to , then calculates , and the user's private key is .

3. The SM9 encryption method of claim 2, wherein: In the step S3: assuming that the encryptor uses the receiver's to perform encryption, calculate where ; selecting a random number and let ; Computing wherein ; Let the ciphertext: ； It is known Thus, the ciphertext can be implicitly represented as .

Images