An identity encryption and decryption method based on SM9 with re-randomizability

Abstract

The present application belongs to the technical field of information security, and relates to an identity encryption and decryption method, in particular to an identity encryption and decryption method with re-randomness based on SM9, comprising the following steps: S2: a key generation center runs an initialization module to generate a master public key, a master private key and public information, and discloses the master public key and the public information; S3: the key generation center runs a key extraction module to generate a private key using an identity of a receiver and sends the private key to the receiver; S4: a sender runs an encryption module to generate original ciphertext from a message to be encrypted and sends the original ciphertext to a trusted third party; S5: the trusted third party runs a re-random module to re-randomize the original ciphertext and sends new ciphertext to the receiver; S6: the receiver uses a decryption module to decrypt the new ciphertext to obtain plaintext, and reversely converts the plaintext to obtain a final message. The present application can solve the problem that ciphertext of a domestic commercial SM9 identity cipher algorithm cannot be re-randomized.

Description

Technical Field

[0001] This invention belongs to the field of information security technology and relates to an identifier encryption and decryption method, specifically an identifier encryption and decryption method based on SM9 with repeatable randomness. Background Technology

[0002] Identity cryptography algorithms, as a crucial component of cryptographic technology, play a vital role in identity-related applications such as network security. However, current practice shows that most cryptographic applications still rely on foreign identity cryptography algorithms. To achieve independent control over identity cryptography algorithms, the State Cryptography Administration issued the "SM9 Identity Cryptography Algorithm" specification in March 2016, formally proposing the domestically developed commercial SM9 identity cryptography algorithm. This algorithm consists of multiple sub-algorithms, primarily including a data signature algorithm, a key exchange protocol, a key encapsulation mechanism, and a public-key encryption algorithm. Part IV, "Key Encapsulation Mechanism and Public Key Encryption Algorithm," was published in March 2016 as an industry standard (Industry Standard No.: GM / T0044.4-2016; Standard Name: SM9 Identifier Cryptography Algorithm Part 4: Key Encapsulation Mechanism and Public Key Encryption Algorithm; Completion Units: National Information Security Engineering Technology Research Center, Shenzhen Aolian Information Security Technology Co., Ltd., Wuhan University, Shanghai Jiao Tong University, Institute of Information Engineering, Chinese Academy of Sciences, Northern Information Technology Research Institute; Publication Date: March 28, 2016). Compared with foreign identifier cryptography algorithms, this algorithm has advantages in key management and practical deployment because it does not require certificate authorization, making it easy to use in fields such as the Internet of Things and the Internet of Vehicles.

[0003] In the SM9 identifier cryptography algorithm, the ciphertext is... Where Q = [h1]P1 + P pub t=g x Given K1||K2=KDF(C1,t,m), based on the properties of the multiplication operation, assuming C1=[x]Q and a new random number x′, we can obtain C′1=[x′]C1=[x′][x]Q=[x′x]Q. Therefore, the first element C1 of the ciphertext can be re-randomized. The re-randomization operation of the ciphertext is usually deployed by a third party, who only knows the public key, public information, identifier, and ciphertext, but not the encrypted information m. Therefore, in the second element C2, the third party cannot calculate the temporary variable K1′ used in the re-randomization process and the temporary variable K1 used in the original encryption process, thus preventing the use of... The re-randomization is performed in the manner described by K′1=KDF(C′1,t′,m) and t′=g. xx′For the third element C3, the third party lacks the encrypted plaintext information m and therefore cannot calculate the temporary variable K′2 needed in the re-randomization process, thus failing to calculate C′3=H(C′2||K2). In conclusion, the ciphertext of the SM9 identifier cryptography algorithm cannot support re-randomization.

[0004] To meet the need for independent control of cryptographic technology in my country, designing a reproducible random identifier encryption and decryption method based on domestically developed commercial cryptographic algorithms is an important problem that urgently needs to be solved.

[0005] To address the aforementioned issues, this invention is based on the domestically developed and commercially available SM9 elliptic curve identifier cryptography algorithm, and designs an identifier encryption and decryption method with repeatable randomness. The aim is to realize a domestically developed identifier encryption and decryption method that supports repeatable randomness and to ensure the independent controllability of such methods. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide an SM9-based identifier encryption and decryption method with repeatable randomness, which solves the problem that the ciphertext of the SM9 identifier cryptography algorithm cannot achieve repeatable randomness, and realizes the domestic independent controllability of the repeatable random identifier encryption and decryption method.

[0007] The technical solution adopted in this invention is an SM9-based identifier encryption and decryption method with repeatable randomness, which consists of the following steps:

[0008] S1: Construct an identifier encryption / decryption system. This system has four roles: a key generation center, a sender, a receiver, and a trusted third party. The encryption / decryption system consists of five modules: an initialization module, a key extraction module, an encryption module, a decryption module, and a re-randomization module. The initialization and key extraction modules are deployed at the key generation center, the decryption module is deployed at the receiver, the encryption module is deployed at the sender, and the re-randomization module is deployed at the trusted third party.

[0009] S2: The key generation center runs the initialization module to generate the master public key mpk, the master private key msk, and the public information params, and sends the master public key mpk and the public information params to the sender, the receiver, and a trusted third party. The specific process is as follows:

[0010] S2.1 Input security parameter 1 λ 1 λ Representing a bit string of length λ, implying the security strength of λ bits; in the finite field F q Based on nonsingular elliptic curves E(F) q ):y 2 ≡x 3 +ax+b mod q determines the elliptic curve cyclic group of order n. The elements in the group are the coordinates (x, y) of points on the elliptic curve, where n and q are large prime numbers. P1 and P2 are chosen as the groups respectively. The generator; in the finite field F q extended domain Generate an n-order multiplicative subgroup. It can be represented as a k-dimensional integer array; For a non-degenerate bilinear mapping that can be efficiently computed, i.e. g1 and g2 are respectively The elements in the bilinear mapping result in the group. The elements in; according to the National Institute of Standards and Technology (NIST Recommendations (2020); website: https: / / www.keylength.com / en / 4 / ): when the order of n reaches 2 160 At this point, the corresponding encryption / decryption method can achieve a security level of 80 bits. In this case, the attacker needs to perform at least 2... 80 It takes several operations to crack the code, i.e., inputting security parameter 1. λ When λ = 80, the elliptic curve group The order n needs to reach 2 160 Only orders of magnitude larger are needed to achieve the security corresponding to the security parameters;

[0011] S2.2 Select two random numbers s from the set [1, n-1]. A and s B ;

[0012] S2.3 Calculate the first element P of the public key A =[s A P1, the second element of the public key P B =[s B [P1; [d]P represents the point of power d of the generator P in the cyclic group, which is the point addition of P and P to the order d-1, and can be formally expressed as: Where d is a positive integer, the specific process of dot addition is as follows:

[0013] S2.3.1 Let the coordinate elements on the elliptic curve be g1 = (x1, y1) and g2 = (x2, y2);

[0014] S2.3.2 Calculate the slope k between g1 and g2 12 If g1 = g2, then Where a is a parameter of the elliptic curve in S2.1, and its slope is the slope of the tangent line that passes through g1 and is tangent to the elliptic curve; if g1 ≠ g2, then k 12 = (y1-y2) / (x1-x2);

[0015] S2.3.3 Calculate the x-coordinate after adding g1 and g2. The ordinate y3 after adding g1 and g2 is k 12 (x1-x3)-y1;

[0016] S2.3.4 Returns the result of the point addition (x3, y3).

[0017] S2.4 uses a bilinear mapping to compute the third element of the public key.

[0018] S2.5 uses a bilinear mapping to compute the fourth element of the public key.

[0019] S2.6 Construct three mapping functions F, G, H, where the inputs and outputs of the three mapping functions F, G, H are all groups. The elements in the set, and all mappings are surjective, are constructed as follows:

[0020] S2.6.1 Select a hash function Hash(*) with an output of 256 bits or more, and the input of the hash function is any bit string;

[0021] S2.6.2 Selection Group One of the generators g;

[0022] The input to the mapping function in S2.6.3 is the group. The element x = (x1, ..., x) k ), where x1,…,x k The corresponding element x in the group Calculate the temporary hash h from the k-dimensional data. map =Hash(x1||…||x) k The three mapping functions F, G, and H select the hash function Hash(*) respectively, which are SHA-512, SHA-256, and SHA-384 (all published by the National Institute of Standards and Technology (NIST), website: https: / / www.keylength.com / en / 4 / ).

[0023] S2.6.4 converts the calculation result of S2.6.3 to decimal: (h′ map ) 10 =(h map 2. Utilize groups Multiply by , calculate the output of the mapping function.

[0024] S2.7 Construct two hash functions H2RF1 and H2RF′1, both of which take as input a bit string of arbitrary length id∈{0,1}. *id is the identifier of the receiver, and the output consists of a group of integers. The elements in the array are constructed as follows:

[0025] S2.7.1 Select the SM3 cryptographic hash algorithm SM3(*). The input of this algorithm is a bit string of arbitrary length, and the output is a bit string of length 256. This algorithm was published on March 21, 2012, and became an industry standard (Industry No.: GM / T0004-2012; Standard Name: SM3 Cryptographic Hash Algorithm; Completion Units: Tsinghua University, Commercial Cryptography Testing Center of State Cryptography Administration, PLA Information Engineering University, Data and Communication Protection Research and Education Center of Chinese Academy of Sciences; Publication Date: March 21, 2012; Website: http: / / www.gmbz.org.cn / main / viewfile / 20180108023812835219.html).

[0026] S2.7.2 The input to the hash function is a bit string of arbitrary length id∈{0,1} * When the function call is H2RF1, let id′ = "0x01"||id; when the function call is H2RF′1, let id′ = "0x02"||id.

[0027] S2.7.3 Calculate the temporary hash value h using the SM3 cryptographic hash algorithm. h2rf =SM3(id′);

[0028] S2.7.4 converts the calculation result of S2.7.3 into decimal (h′) h2rf ) 10 =(h h2rf 2. Calculate the output result h′ of the hash function. h2rf mod n.

[0029] S2.8 will (s A ,s B ) to form the master private key msk, and (P A ,P B ,g A ,g B ) to form the master public key mpk, and then The public information consists of params;

[0030] S2.9 sends the master public key mpk and public information params to the sender, receiver, and trusted third party through a public secure channel.

[0031] S3: The key generation center uses the master private key msk, public information params, and the recipient's identifier id to run the key extraction module to generate the private key sk. idThe receiver's identifier id is a bit string of arbitrary length, and the private key sk is... id Send to the recipient. The specific process is as follows:

[0032] S3.1 Using the hash function H2RF1, calculate the temporary first variable s1 = s A +H2RF1(id);

[0033] S3.2 Determine if the temporary first variable s1 mod n is equal to 0. If it is equal to 0, the extraction fails and proceeds to S7; if it is not equal to 0, proceed to S3.3.

[0034] S3.3 Using the hash function H2RF′1, calculate the temporary second variable s2 = s B +H2RF′1(id);

[0035] S3.4 Determine if the temporary second variable s2 mod n is equal to 0. If it is equal to 0, the extraction fails and proceeds to S7; if it is not equal to 0, proceed to S3.5.

[0036] S3.5 Calculate the first variable of the private key

[0037] S3.6 Calculate the second variable of the private key

[0038] S3.7 will sk A ,sk B Composition of private key sk id and the private key sk id Send to the recipient.

[0039] S4: The sender uses the master public key mpk, public information params, and the receiver's identifier id to run the encryption module, generating the original ciphertext from the message to be encrypted, and then sends it to a trusted third party. The specific process is as follows:

[0040] S4.1 Input the initial plaintext m,

[0041] S4.2 From Group Randomly select an element r from the data;

[0042] S4.3 Utilizing the first mapping function F and the group Multiplication is used to calculate the temporary third variable s = F(r)·m;

[0043] S4.4 utilizes the second mapping function G and the group Multiplication is used to calculate the temporary fourth variable t = G(s)·r;

[0044] S4.5 utilizes the third mapping function H and the group Multiplication is used to calculate the temporary fifth variable u = H(t)·s;

[0045] S4.6 Use the hash function H2RF1 to calculate the temporary sixth variable h1 = H2RF1(id);

[0046] S4.7 Use the hash function H2RF′1 to calculate the temporary seventh variable h2=H2RF′1(id);

[0047] S4.8 Calculate the temporary eighth variable Q A =[h1]P1+P A ;

[0048] S4.9 Calculate the temporary ninth variable Q B =[h2]P1+P B ;

[0049] S4.10 Select two random numbers x from the set [1, n-1]. A ,x B ;

[0050] S4.11 Calculate the first element C1 of the original ciphertext: C1 = [x A Q A The second element of the original ciphertext, C2 = [x B Q B The third element of the original ciphertext The fourth element of the original ciphertext

[0051] S4.12 combines C1, C2, C3, and C4 to form the original ciphertext C, and sends the original ciphertext C to a trusted third party.

[0052] S5: A trusted third party uses the master public key mpk, public information params, and the recipient's identifier id to run the re-randomization module, re-randomize the original ciphertext C generated in S4, and sends the new ciphertext to the recipient. The specific process is as follows:

[0053] S5.1 parses the original ciphertext C into (C1, C2, C3, C4);

[0054] S5.2 Select two random numbers x′ from the set [1, n-1]. A ,x′ B ;

[0055] S5.3 Use the hash function H2RF1 to recalculate the temporary sixth variable h1 = H2RF1(id);

[0056] S5.4 Use the hash function H2RF′1 to recalculate the temporary seventh variable h2=H2RF′1(id);

[0057] S5.5 Recalculate the temporary eighth variable Q A =[h1]P1+P A ;

[0058] S5.6 Recalculate the temporary ninth variable Q B = [h2]P1+P B ;

[0059] S5.7 Calculate the first element of the new ciphertext C′1 = C1 + [x′ A Q A The second element of the new ciphertext is C′2=C2+[x′ B Q B The third element of the new ciphertext The fourth element of the new cipher.

[0060] S5.8 Combines C′1, C′2, C′3, and C′4 into a new ciphertext C′ and sends the new ciphertext C′ to the receiver.

[0061] S6: The receiver uses the decryption module, via the private key sk id The received ciphertext C′ is decrypted using the publicly available information params to obtain the plaintext, and then reverse-engineered to obtain the final message. The specific process is as follows:

[0062] S6.1 parses the new ciphertext C′ into (C′1, C′2, C′3, C′4);

[0063] S6.2 Determine whether C′1 belongs to If it does not belong to the category, the ciphertext is invalid, proceed to S7; if it belongs to the category, proceed to S6.3.

[0064] S6.3 Determine whether C′2 belongs to If it does not belong to the category, the ciphertext is invalid, proceed to S7; if it belongs to the category, proceed to S6.4.

[0065] S6.4 utilizes bilinear mappings and groups Division, calculating the temporary tenth variable

[0066] S6.5 utilizes bilinear mappings and groups Division to calculate the temporary eleventh variable

[0067] S6.6 utilizes the third mapping function H and the group The division is used to calculate the temporary twelfth variable s′=u′ / H(t′);

[0068] S6.7 utilizes the second mapping function G and the group The division is used to calculate the temporary thirteenth variable r′=t′ / G(s′);

[0069] S6.8 utilizes the first mapping function F and the group Division to calculate the temporary plaintext result m ′ =s′ / F(r′);

[0070] S6.9 Determine if the temporary plaintext result m′ is equal to the initial plaintext m. If they are not equal, the ciphertext is invalid, output the "ciphertext invalid" message, and go to S7; if they are equal, the decryption result is m, and go to S7.

[0071] S7: Indicates the end of the encryption / decryption system operation.

[0072] The following effects can be achieved by using this invention:

[0073] 1. Due to the existence of S5.2-5.7, this invention ensures the reproducible randomness of the encryption and decryption method. A trusted third party only needs the original ciphertext information, the master public key and public information of the encryption and decryption system, and the identifier of the recipient to use the reproducible randomness module to reproduce randomness on the original ciphertext. Specifically, the reproducible randomness is manifested in S5.2, where the trusted third party randomly selects two random numbers x′ from the set [1, n-1] for the new ciphertext. A ,x′ B In S5.3-5.4, the trusted third party recalculates h1 and h2; in S5.5-5.6, the trusted third party recalculates Q. A Q B In S5.7, the trusted third party uses random numbers and the calculation results from S5.3-5.6 to recalculate the four elements in the new ciphertext. The first element C′1 = C1 + [x′ A Q A The second element of the new ciphertext is C′2=C2+[x′ B Q B The third element of the new ciphertext The fourth element of the new cipher. Compared to the original SM9 identifier cryptography algorithm, this invention enables the ciphertext to have repeatable randomness through modifications to the initialization module, key extraction module, encryption module, and decryption module.

[0074] 2. Due to the existence of S5.7 and S6.2-6.5, this invention ensures that the identifier encryption / decryption method correctly decrypts the newly re-randomized ciphertext, demonstrating the validity of the new ciphertext. Specifically, the validity is manifested in S5.7, where, according to the calculation formulas in S4.11 and S5.7, the first element can be expressed as C′1=C1+[x′ A Q A =[x A +x′ A Q AThe second element can be represented as C′2=C2+[x′ B Q B =[x B +x′ B Q B The third element can be represented as The fourth element can be represented as In S6.2-6.3, two checks guarantee the validity of the ciphertext and the correctness of the calculations in S6.4-6.5; in S6.4, the calculation... Where h1 = H2RF1(id); in S6.5, calculate Where h2 = H2RF′1(id). It can be seen that although the old and new ciphertexts have changed in form, the correct u and t can still be calculated for use in the subsequent calculations of S6.7-9, without affecting the correctness of decryption, so that the repeatable randomness of the present invention is correct in the operation process.

[0075] The ciphertext of this invention can be re-randomized using its own elements, the master public key of the encryption / decryption system, public information, and the receiver's identifier, without changing the validity of the ciphertext or the plaintext at its underlying layer. In practical applications, this feature allows a trusted third party running the re-randomization algorithm to re-randomize the received ciphertext after S2 is completed; however, to achieve re-randomization, an operand on the extended field group is added in this invention, resulting in a performance loss. Attached Figure Description

[0076] Figure 1 This is a logical structure diagram of the encryption / decryption system constructed in this invention;

[0077] Figure 2 This is a flowchart of the present invention. Detailed implementation method:

[0078] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0079] The symbols and definitions used in this embodiment are as follows:

[0080] q, n: large prime numbers.

[0081] F q : A finite field with characteristic q.

[0082] Finite field F qk-th extension of the domain.

[0083] E(F q ): In the finite field F q Zhongyou An elliptic curve is defined.

[0084] The elements in the set {1,2,…,q-1} that are relatively prime to element q constitute a subset.

[0085] The set {0,1,2,…,n-1}.

[0086] a, b: sets The elements in the formula are used to determine the elliptic curve.

[0087] An elliptic curve cyclic group of order n.

[0088] Extended Domain Multiplicative subgroups of intermediate order n.

[0089] P1, P2: Groups respectively A generator randomly selected from the set.

[0090] A non-degenerate bilinear mapping that can be efficiently computed is specifically represented as Right now g1 and g2 are respectively The elements in.

[0091] [d]P: The point in the cyclic group where element P is a multiple of d, expressed as: Where d is a positive integer.

[0092] x||y: The concatenation of the numerical values ​​x and y into binary bit strings.

[0093] {0,1} * : A bit string of any length.

[0094] F, G, H: All three inputs and outputs are group functions. Mapping function for elements in the array.

[0095] H2RF1, H2RF′1: Two bit strings of arbitrary length {0,1} as inputs. * The output is A hash function for the elements in the array.

[0096] params: Globally public information.

[0097] mpk: The master public key, used for all algorithms.

[0098] msk: Master private key, used to generate the private key used for decryption.

[0099] id: The identifier of the receiver, which is a bit string of arbitrary length.

[0100] sk id : The private key used for decryption, corresponding to the recipient's identifier.

[0101] m: the group corresponding to the message A certain element in.

[0102] C = (C1, C2, C3, C4): Ciphertext generated by the sender using the master public key and the encryption module.

[0103] C′=(C′1,C′2,C′3,C′4): The ciphertext that the receiver wants to decrypt after being rerandomized by a trusted third party.

[0104] like Figure 2 The diagram shows a flowchart of an SM9-based identifier encryption / decryption method with reproducible randomness.

[0105] Both the SM9 identifier cryptography algorithm and the one used in this invention are group cryptographic algorithms. For a plaintext length of |m|, the time cost of any hash algorithm is expressed as T. hash The output of the hash function H in the SM9 identifier cryptography algorithm is represented as {0,1}. hash The time cost of the KDF function call in the SM9 identifier cryptography algorithm is T. kdf ,group The time costs of multiplication and addition are T respectively. e1 and T a1 ,group The time costs of multiplication, division, and multiplication are T, respectively. e2 T m2 and T d2 Calculate a bilinear mapping. The time cost is T e Ignoring the time overhead of XOR, concatenation, and random selection in the algorithm; the theoretical cost analysis of both is shown in the table below:

[0106]

[0107] As can be seen from the table above, compared to the SM9 identifier cryptography algorithm, the size of the master public key, master private key, and private key in this invention are all twice that of the original algorithm; regarding the ciphertext size, since the SM9 identifier cryptography algorithm uses part of the bit string ciphertext, this invention uses group ciphertext. and The elements in the algorithm cause the ciphertext size to be more than twice that of the original algorithm; regarding the private key generation time, this invention calls the private key generation process of the original algorithm twice, thus doubling the time cost; regarding encryption time, the SM9 identifier cryptographic algorithm has only 2 hash function calls, 1 KDF function call, and 1 group function call. Multiplication by a factor of 1 and group of 1 The invention requires 5 hash function calls and 4 group multiplications. Multiplication by a factor of two, group of two addition, group of 5 Multiplication by a factor of 5 and group of 5 The multiplication, taking into account the parameter selection of the SM9 identifier cryptography algorithm, generates a group from the extended field. The computational overhead is much greater than that of the group. The computational overhead of this invention results in an encryption time several times that of the original algorithm; while for decryption time, the SM9 identifier cryptographic algorithm only requires one bilinear mapping calculation, one hash function call, and one KDF function call, while this invention requires two bilinear mapping calculations and five group... Division, whether in bilinear mappings or group The time overhead of division is much greater than that of function calls, resulting in the decryption time of this invention being several times that of the original algorithm. However, this invention possesses repeatable randomness, which is not available in the SM9 identifier cipher algorithm. It can be seen that this invention sacrifices the performance advantages of the original SM9 identifier cipher algorithm for repeatable randomness.

Claims

1. A method for encrypting and decrypting identifiers with repeatable randomness based on SM9, characterized in that, This method consists of the following steps: S1: Construct an identifier encryption / decryption system; this system has four roles: key generation center, sender, receiver, and trusted third party; the encryption / decryption system consists of five modules: initialization module, key extraction module, encryption module, decryption module, and re-randomization module; the initialization module and key extraction module are deployed at the key generation center, the decryption module is deployed at the receiver, the encryption module is deployed at the sender, and the re-randomization module is deployed at the trusted third party; S2: The key generation center runs the initialization module to generate the master public key mpk, the master private key msk, and the public information params, and sends the master public key mpk and the public information params to the sender, the receiver, and a trusted third party; the specific process is as follows: S2.1 Input security parameter 1 λ 1 λ Representing a bit string of length λ, implying the security strength of λ bits; in the finite field F q Based on nonsingular elliptic curves E(F) q ):y 2 ≡x 3 +ax+bmodq determines the elliptic curve cyclic group of order n. The elements in the group are the coordinates (x, y) of points on the elliptic curve, where n and q are large prime numbers. P1 and P2 are chosen as the groups respectively. The generator; in the finite field F q extended domain Generate an n-order multiplicative subgroup. It can be represented as a k-dimensional integer array; For a non-degenerate bilinear mapping that can be efficiently computed, i.e. g1 and g2 are respectively The elements in the bilinear mapping result in the group. Elements in; S2.2 Select two random numbers s from the set [1, n-1]. A and s B ; S2.3 Calculate the first element P of the public key A =[s A P1, the second element of the public key P B =[s B [P1; [d]P represents the point of power d of the generator P in the cyclic group, which is the point addition of P and P to the order d-1, and can be formally expressed as: Where d is a positive integer; S2.4 uses a bilinear mapping to compute the third element of the public key. S2.5 uses a bilinear mapping to compute the fourth element of the public key. S2.6 Construct three mapping functions F, G, H, where the inputs and outputs of the three mapping functions F, G, H are all groups. The elements in the set are all surjective; S2.7 Construct two hash functions H2RF1 and H2RF′1, both of which take as input a bit string of arbitrary length id∈{0,1}. * id is the identifier of the receiver, and the output consists of a group of integers. Elements in; S2.8 will (s A ,s B ) to form the master private key msk, and (P A ,P B ,g A ,g B ) to form the master public key mpk, and then The public information consists of params; S2.9 sends the master public key mpk and public information params to the sender, receiver and trusted third party through a public secure channel; S3: The key generation center uses the master private key msk, public information params, and the recipient's identifier id to run the key extraction module to generate the private key sk. id The receiver's identifier id is a bit string of arbitrary length, and the private key sk is... id Send to the recipient; the specific process is as follows: S3.1 Using the hash function H2RF1, calculate the temporary first variable s1 = s A +H2RF1(id); S3.2 Determine if the temporary first variable s1mod n is equal to 0. If it is equal to 0, the extraction fails and proceed to S7; otherwise, proceed to S3.

3. S3.3 Using the hash function H2RF′1, calculate the temporary second variable s2 = s B +H2RF′1(id); S3.4 Determine if the temporary second variable s2mod n is equal to 0. If it is equal to 0, the extraction fails and proceeds to S7; if it is not equal to 0, proceed to S3.

5. S3.5 Calculate the first variable of the private key S3.6 Calculate the second variable of the private key S3.7 will sk A ,sk B Composition of private key sk id and the private key sk id Send to the recipient; S4: The sender uses the master public key mpk, public information params, and the receiver's identifier id to run the encryption module, generating the original ciphertext of the message to be encrypted, and then sends it to a trusted third party; the specific process is as follows: S4.1 Input the initial plaintext m, S4.2 From Group Randomly select an element r from the data; S4.3 Utilizing the first mapping function F and the group Multiplication is used to calculate the temporary third variable s = F(r)·m; S4.4 utilizes the second mapping function G and the group Multiplication is used to calculate the temporary fourth variable t = G(s)·r; S4.5 utilizes the third mapping function H and the group Multiplication is used to calculate the temporary fifth variable u = H(t)·s; S4.6 Use the hash function H2RF1 to calculate the temporary sixth variable h1 = H2RF1(id); S4.7 Use the hash function H2RF′1 to calculate the temporary seventh variable h2=H2RF′1(id); S4.8 Calculate the temporary eighth variable Q A =[h1]P1+P A ; S4.9 Calculate the temporary ninth variable Q B =[h2]P1+P B ; S4.10 Select two random numbers x from the set [1, n-1]. A ,x B ; S4.11 Calculate the first element C1 of the original ciphertext: C1 = [x A Q A The second element of the original ciphertext, C2 = [x B Q B The third element of the original ciphertext The fourth element of the original ciphertext S4.12 combines C1, C2, C3, and C4 to form the original ciphertext C, and sends the original ciphertext C to a trusted third party; S5: A trusted third party uses the master public key mpk, public information params, and the recipient's identifier id to run the re-randomization module, re-randomize the original ciphertext C generated in S4, and sends the resulting new ciphertext to the recipient; the specific process is as follows: S5.1 parses the original ciphertext C into (C1, C2, C3, C4); S5.2 Select two random numbers x′ from the set [1, n-1]. A ,x′ B ; S5.3 Use the hash function H2RF1 to recalculate the temporary sixth variable h1 = H2RF1(id); S5.4 Use the hash function H2RF′1 to recalculate the temporary seventh variable h2=H2RF′1(id); S5.5 Recalculate the temporary eighth variable Q A =[h1]P1+P A ; S5.6 Recalculate the temporary ninth variable Q B =[h2]P1+P B ; S5.7 Calculate the first element of the new ciphertext C′1 = C1 + [x′ A Q A The second element of the new ciphertext is C′2=C2+[x′ B Q B The third element of the new ciphertext The fourth element of the new cipher. S5.8 Combines C′1, C′2, C′3, and C′4 into a new ciphertext C′ and sends the new ciphertext C′ to the receiver; S6: The receiver uses the decryption module, via the private key sk id The received ciphertext C′ is decrypted using the publicly available information params to obtain the plaintext, and then reverse-converted to obtain the final message; the specific process is as follows: S6.1 parses the new ciphertext C′ into (C′1, C′2, C′3, C′4); S6.2 Determine whether C′1 belongs to If it does not belong to the category, the ciphertext is invalid, proceed to S7; if it belongs to the category, proceed to S6.

3. S6.3 Determine whether C′2 belongs to If it does not belong to the category, the ciphertext is invalid, proceed to S7; If so, proceed to S6.4; S6.4 utilizes bilinear mappings and groups Division, calculating the temporary tenth variable S6.5 utilizes bilinear mappings and groups Division to calculate the temporary eleventh variable S6.6 utilizes the third mapping function H and the group The division is used to calculate the temporary twelfth variable s′=u′ / H(t′); S6.7 utilizes the second mapping function G and the group The division is used to calculate the temporary thirteenth variable r′=t′ / G(s′); S6.8 utilizes the first mapping function F and the group The division is used to calculate the temporary plaintext result m′=s′ / F(r′); S6.9 Determine if the temporary plaintext result m′ is equal to the initial plaintext m. If they are not equal, the ciphertext is invalid. Output the message "ciphertext is invalid" and go to S7. If they are equal, the decryption result is m, then proceed to S7; S7: Indicates the end of the encryption / decryption system operation.

2. A method for encrypting and decrypting identifiers with repeatable randomness based on SM9 according to claim 1, characterized in that: In S2.1, input security parameter 1 λ When λ = 80, the elliptic curve group The order n needs to reach 2 160 Only orders of magnitude larger can achieve the security corresponding to the security parameters.

3. A method for encrypting and decrypting identifiers with repeatable randomness based on SM9 according to claim 1, characterized in that: In S2.3, the specific process of dot addition is as follows: S2.3.1 Let the coordinate elements on the elliptic curve be g1 = (x1, y1) and g2 = (x2, y2); S2.3.2 Calculate the slope k between g1 and g2 12 If g1 = g2, then Where a is a parameter of the elliptic curve in S2.1, and its slope is the slope of the tangent line that passes through g1 and is tangent to the elliptic curve; if g1 ≠ g2, then k 12 = (y1-y2) / (x1-x2); S2.3.3 Calculate the x-coordinate after adding g1 and g2. The ordinate y3 after adding g1 and g2 is k 12 (x1-x3)-y1; S2.3.4 Returns the result of the point addition (x3, y3).

4. A method for encrypting and decrypting identifiers with repeatable randomness based on SM9 according to claim 1, characterized in that: In S2.6, the three mapping functions F, G, and H are constructed as follows: S2.6.1 Select a hash function Hash(*) with an output of 256 bits or more, and the input of the hash function is any bit string; S2.6.2 Selection Group One of the generators g; The input to the mapping function in S2.6.3 is the group. The element x = (x1, ..., x) k ), where x1,…,x k The corresponding element x in the group Calculate the temporary hash h from the k-dimensional data. map =Hash(x1||…||x) k ); S2.6.4 converts the calculation result of S2.6.3 to decimal: (h′ map ) 10 =(h map 2. Utilize groups Multiply by , calculate the output of the mapping function.

5. A method for encrypting and decrypting identifiers with repeatable randomness based on SM9 according to claim 4, characterized in that: In S2.6.3, the hash functions selected for the three mapping functions F, G, and H are SHA-512, SHA-256, and SHA-384, respectively.

6. A method for encrypting and decrypting identifiers with reproducible randomness based on SM9 according to claim 1, characterized in that: In S2.7, the two hash functions H2RF1 and H2RF′1 are constructed as follows: S2.7.1 Select the SM3 cryptographic hash algorithm SM3(*), which takes a bit string of arbitrary length as input and outputs a bit string of length 256; S2.7.2 The input to the hash function is a bit string of arbitrary length id∈{0,1} * When the function call is H2RF1, let id′ = "0x01"||id; when the function call is H2RF′1, let id′ = "0x02"||id. S2.7.3 Calculate the temporary hash value h using the SM3 cryptographic hash algorithm. h2rf =SM3(id′); S2.7.4 converts the calculation result of S2.7.3 into decimal (h′) h2rf ) 10 =(h h2rf 2. Calculate the output result h′ of the hash function. h2rf mod n.

Images