A method and system for key splitting of elliptic curves

Abstract

This invention discloses a method and system for key splitting based on elliptic curves, wherein the method includes: determining the terminal signature private key component hd based on elliptic curves. A server-side signature private key component hd S The terminal signature private key component and the server signature private key component are respectively subjected to secure splitting calculations to generate the corresponding terminal decryption private key component e. A Server-side decryption of private key component e S The terminal signature private key component hd A The server-side signature private key component hd S The terminal decryption private key component e A The server-side decryption private key component e S Satisfy: (e A +e S )modn=(hd A ×hd S )modn, where n is the order of the elliptic curve, and modn represents modulo n operation; the terminal decrypts the private key component e based on the terminal. A The server decrypts the private key component e based on the server's decryption. S Perform decryption calculations.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, more particularly, to an elliptic curve key splitting method and system. BACKGROUND

[0002] With the development and application of CA technology, and the implementation of digital signature method, digital signature technology occupies an increasingly important position in the digital world. Based on network business administrative approval, electronic contract, electronic invoice, network transaction payment, etc. all use digital signature technology to protect the non-repudiation of business. The rise of new generation mobile networks and intelligent mobile terminals makes many network businesses migrate to mobile terminals. However, due to the lack of password chips in the current mobile terminals, the security of the signature private key stored in the mobile terminal user is extremely low, and it is difficult to guarantee the security of the mobile application system. Therefore, the current technology adopts the signature private key splitting technology, that is, the user's signature private key is split into a mobile terminal signature private key component and a server signature private key component through secure calculation, and is stored in the mobile terminal and the server with higher security respectively. However, sometimes in order to meet the convenience and feasibility of other purpose password calculation, such as decryption calculation, the stored two signature private key components need to be re-split, and the splitting calculation process cannot be combined into the whole signature private key, nor can the existing signature private key components be exposed. After re-splitting, the user's signature private key and public key do not change.

[0003] Therefore, a technology is needed to split the key of the elliptic curve. SUMMARY

[0004] The technical scheme of the present application provides an elliptic curve key splitting method and system to solve the problem of how to split the key of the elliptic curve.

[0005] To solve the above problems, the present application provides an elliptic curve key splitting method, which comprises:

[0006] determining a terminal signature private key component hd A and a server signature private key component hd S based on the elliptic curve respectively;

[0007] performing secure splitting calculation on the terminal signature private key component and the server signature private key component respectively to generate corresponding terminal decryption private key component e A and server decryption private key component e S ;

[0008] The terminal signature private key component hd A , the server signature private key component hd S , the terminal decryption private key component e A, the server-side decryption private key component e S satisfies: (e A + e S ) mod n = (h A × h S ) mod n, wherein n is an order of an elliptic curve, and mod n represents a modulo n operation;

[0009] the terminal performs a decryption calculation based on the terminal decryption private key component e A , and the server performs a decryption calculation based on the server decryption private key component e S .

[0010] Preferably, the secure split calculation is performed on the terminal signature private key component and the server signature private key component respectively, to generate a corresponding terminal decryption private key component e A and a server decryption private key component e S , including:

[0011] The elliptic curve is E(F q p), a base point is G = (x G , y G ), an order is n, a bit length of n is l+1, F q p is a finite field containing q elements, x G , y G are an x-coordinate and a y-coordinate of the base point;

[0012] The terminal signature private key component h A d ∈ [1, n-1] is represented as:

[0013] h A d = a0+a1·2+a2·2 2 +…+a l ·2 l

[0014] wherein a0, a1, a2…a l are integers belonging to [0, 1], and are binary bit positions of the terminal signature private key component h A d;

[0015] The server signature private key component h S d ∈ [1, n-1] is represented as:

[0016] h S d = b0+b1·2+b2·2 2 +…+b l ·2 l

[0017] wherein b0, b1, b2…b linteger belonging to [0,1] is the server signature private key component hd S .

[0018] Preferably, the secure split computation is performed on the terminal signature private key component and the server signature private key component respectively to generate the corresponding terminal decryption private key component e A and the server decryption private key component e S , including:

[0019] The terminal selects l+3 random numbers from [1, n-1]:

[0020] r1, r2, r 00 , r 10 , …, r l0

[0021] The terminal calculates Z1=[r1]G, and calculates the terminal decryption private key component e A :

[0022] e A =-(r 00 +r 10 +r 20 +…+r l0 )mod n

[0023] and sends Z1 to the server; wherein Z1 is the point multiplication result of [r1]G.

[0024] Preferably, the secure split computation is performed on the terminal signature private key component and the server signature private key component respectively to generate the corresponding terminal decryption private key component e A and the server decryption private key component e S , including:

[0025] After receiving Z1, the server selects l+1 random numbers from [1, n-1]:

[0026] u0, u1, u2, …, u l

[0027] The server calculates:

[0028]

[0029] wherein, is the point multiplication result of [u i ]G, i=0, 1, …, l, is the result of , i=0, 1, …, l; b0, b1, b2…b l is an integer belonging to [0,1];

[0030] P 00 , P 10 , P 20 , …, P l0 are sent to the terminal, wherein P 00 , P 10 , P 20 , …, P l0 are the point multiplication results of [u i ]G or results;

[0031] After receiving P 00 , P 10 , P 20 , …, P l0 by the terminal, the following is calculated:

[0032] r 01 = h d A + r 00 mod n

[0033] r 11 = h d A · 2 + r 10 mod n

[0034] r 21 = h d A · 2 2 + r 20 mod n

[0035] …

[0036] r l1 = h d A · 2 l + r l0 mod n

[0037] wherein r 01 , r 11 , r 21 , …, r l1 are random numbers, and r 00 , r 10 , r 20 , …, r l0 are random numbers;

[0038] The following is calculated:

[0039] Z2 = [r2]G

[0040] wherein Z2 is the point multiplication result of [r2]G;

[0041] Loop calculation from i = 0 to l:

[0042] K i0 = [r2]Pi0 K i1 = [r2]Z1-K i0 ,

[0043]

[0044] wherein H() is a hash function, i is a temporary symbol, K i0 , K i1 is e i0 , e i1 is a temporary symbol;

[0045] Let W A = {(e 00 , e 01 ), (e 10 , e 11 ), (e 20 , e 21 ), …, (e l0 , e l1 )}, send Z2 and W A to the server by the terminal; wherein W A is a data set of (e i0 , e i1 ), wherein i = 0, 1, …, l;

[0046] The server calculates from i = 0 to l after receiving Z2 and W A :

[0047]

[0048] wherein, is a temporary symbol, is a value extracted from W A ;

[0049] Calculate the server decryption private key component:

[0050]

[0051] Preferably, further comprising: merging the terminal decryption private key component e A , the server decryption private key component e S :

[0052] (e A + e S ) mod n = (hd A × hd S ) mod n, that is:

[0053]

[0054] Based on another aspect of the present application, the present application provides an elliptic curve key splitting system, the system comprising:

[0055] a determining unit configured to determine a terminal signature private key component hd A and a server signature private key component hd S based on an elliptic curve respectively;

[0056] a calculating unit configured to perform secure splitting calculation on the terminal signature private key component and the server signature private key component respectively to generate a corresponding terminal decryption private key component e A and a server decryption private key component e S ; the terminal signature private key component hd A , the server signature private key component hd S , the terminal decryption private key component e A , the server decryption private key component e S satisfy: (e A +e S )mod n=(hd A ×hd S )mod n, wherein n is an order of the elliptic curve, and mod n represents a modulo n operation; the terminal performs decryption calculation based on the terminal decryption private key component e A , and the server performs decryption calculation based on the server decryption private key component e S .

[0057] Preferably, the calculating unit is configured to perform secure splitting calculation on the terminal signature private key component and the server signature private key component respectively to generate a corresponding terminal decryption private key component e A and a server decryption private key component e S , and further configured to:

[0058] the elliptic curve is E(F q ), a base point is G=(x G , y G ), an order is n, a bit length of n is l+1, F q is a finite field containing q elements, x G , y G are an x coordinate and a y coordinate of the base point;

[0059] the terminal signature private key component hd A ∈[1, n-1] is represented as:

[0060] hd A =a0+a1·2+a2·2 2 +…+a l ·2 l

[0061] Among them, a0, a1, a2…a l Let hd be an integer belonging to the range [0,1]. A binary bits;

[0062] Server-side signature private key component hd S ∈[1,n-1], represented as:

[0063] HD S =b0 + b1·2 + b2·2 2 +…+b l ·2 l

[0064] Among them, b0, b1, b2…b l Let hd be an integer belonging to the range [0,1], representing the server-side signature private key component. S The binary bits.

[0065] Preferably, the calculation unit is used to perform secure splitting calculations on the terminal signature private key component and the server signature private key component respectively, to generate the corresponding terminal decryption private key component e. A Server-side decryption of private key component e S It is also used for:

[0066] Select l+3 random numbers from [1, n-1] via the terminal:

[0067] r1,r2,r 00 ,r 10 ,…,r l0

[0068] And calculate Z1 = [r1]G through the terminal, and calculate the terminal decryption private key component e. A :

[0069] e A =-(r 00 +r 10 +r 20 +…+r l0 )mod n

[0070] And send Z1 to the server; where Z1 is the dot product of [r1]G.

[0071] Preferably, the calculation unit is used to perform secure splitting calculations on the terminal signature private key component and the server signature private key component respectively, to generate the corresponding terminal decryption private key component e. A Server-side decryption of private key component e S It is also used for:

[0072] After receiving Z1 by the server, l+1 random numbers are selected from [1, n-1]:

[0073] u0, u1, u2, …, u l

[0074] And the server calculates:

[0075]

[0076] Wherein, is the point multiplication result of [u i ]G, wherein i=0, 1, …, l, is the result of , wherein i=0, 1, …, l; b0, b1, b2…b l are integers belonging to [0,1] ;

[0077] P 00 , P 10 , P 20 , …, P l0 are sent to the terminal, wherein P 00 , P 10 , P 20 , …, P l0 are the point multiplication results of [u i ]G or the results of ;

[0078] After receiving P 00 , P 10 , P 20 , …, P l0 by the terminal, the following is calculated:

[0079] r 01 =hd A +r 00 mod n

[0080] r 11 =hd A ·2+r 10 mod n

[0081] r 21 =hd A ·2 2 +r 20 mod n

[0082] …

[0083] r l1 =hd A ·2 l +r l0 mod n

[0084] wherein r 01 , r 11 , r 21 … r l1 are random numbers, r 00 , r 10 , r 20 … r l0 are random numbers;

[0085] Calculate:

[0086] Z2 = [r2]G

[0087] wherein Z2 is the point multiplication result of [r2]G;

[0088] Loop from i = 0 to l to calculate:

[0089] K i0 = [r2]P i0 , K i1 = [r2]Z1-K i0 ,

[0090]

[0091] wherein H() is a hash function, i is a temporary symbol, K i0 , K i1 , e i0 , e i1 are temporary symbols;

[0092] Let W A = {(e 00 , e 01 ), (e 10 , e 11 ), (e 20 , e 21 ), …, (e l0 , e l1 )}, send Z2 and W A to the server through the terminal; wherein W A is a data set of (e i0 , e i1 ), wherein i = 0, 1, …, l;

[0093] After receiving Z2 and W A , the server loops from i = 0 to l to calculate:

[0094]

[0095] wherein, is a temporary symbol, is a value extracted from W A ;

[0096] Compute the server decryption private key component:

[0097]

[0098] Preferably, the computing unit is further configured to combine the terminal decryption private key component e A and the server decryption private key component e S

[0099] (e A +e S )mod n=(hd A ×hd S )mod n, i.e.:

[0100]

[0101] The present application provides a key splitting method and system for elliptic curve, wherein the method comprises: determining a terminal signature private key component hd A and a server signature private key component hd S based on an elliptic curve, respectively; performing secure splitting computation on the terminal signature private key component and the server signature private key component, respectively, to generate a corresponding terminal decryption private key component e A and a server decryption private key component e S ; the terminal signature private key component hd A , the server signature private key component hd S , the terminal decryption private key component e A , and the server decryption private key component e S satisfy (e A +e S )mod n=(hd A ×hd S )mod n, wherein n is the order of the elliptic curve, and mod n represents modulo n operation; the terminal performs decryption computation based on the terminal decryption private key component e A , and the server performs decryption computation based on the server decryption private key component e S . The present application provides a secure key splitting computation method and system based on elliptic curve, which can transform two signature private key components originally stored in a mobile terminal and a server into two decryption private key components stored in the mobile terminal and the server through secure splitting computation, to meet the requirement of decryption computation, while the signature private key and the public key of the user remain unchanged. BRIEF DESCRIPTION OF DRAWINGS

[0102] The exemplary embodiments of the present application can be more completely understood in reference to the following drawings: ​

[0103] Figure 1 This is a flowchart of a key splitting method for elliptic curves according to a preferred embodiment of the present invention;

[0104] Figure 2 A flowchart illustrating the secure splitting calculation of the mobile terminal signature private key component and the server terminal signature private key component according to a preferred embodiment of the present invention; and

[0105] Figure 3 This is a structural diagram of an elliptic curve key splitting system according to a preferred embodiment of the present invention. Detailed Implementation

[0106] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.

[0107] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.

[0108] Figure 1 This is a flowchart of an elliptic curve key splitting method according to a preferred embodiment of the present invention. The present invention provides a secure key splitting calculation method based on elliptic curves. This method can transform two signature private key components originally stored on the mobile terminal and the server terminal into two additional decryption private key components stored on the mobile terminal and the server terminal through a secure splitting calculation, thereby meeting the requirements of decryption calculation, while the user's signature private key and public key remain unchanged.

[0109] The elliptic curve used in this invention is denoted as E(F). q ), with the base point being G = (x G ,y G The order is n, the bit length of n is l+1, and the participants in the secure splitting calculation are mobile terminal A and server terminal S. Let [k]P represent the dot product operation on the elliptic curve, where k is an integer and P is a point on the elliptic curve.

[0110] like Figure 1 As shown, the present invention provides a key splitting method for elliptic curves, the method comprising:

[0111] Step 101: determining an elliptic curve-based terminal signature private key component hd A and a server signature private key component hd S ;

[0112] In the present application, the terminal signature private key component stored by the mobile terminal A is hd A ∈[1,n-1], and the server signature private key component stored by the server S is hd S ∈[1,n-1].

[0113] Step 102: performing secure split computation on the terminal signature private key component and the server signature private key component respectively to generate corresponding terminal decryption private key components e A and server decryption private key components e S ;

[0114] Preferably, the secure split computation is performed on the terminal signature private key component and the server signature private key component respectively to generate corresponding terminal decryption private key components e A and server decryption private key components e S , including:

[0115] The elliptic curve is E(F q ), the base point is G=(x G ,y G ), the order is n, the bit length of n is l+1, F q is a finite field containing q elements, x G ,y G are the x coordinate and y coordinate of the base point.

[0116] The terminal signature private key component hd A ∈[1,n-1] is expressed as:

[0117] hd A =a0+a1·2+a2·2 2 +…+a l ·2 l

[0118] Wherein, a0, a1, a2…a l are integers belonging to [0,1], and are binary bit positions of the terminal signature private key component hd A .

[0119] The server signature private key component hd S ∈[1,n-1] is expressed as:

[0120] hd S =b0+b1·2+b2·2 2 +…+b l ·2 l

[0121] wherein b0, b1, b2…b l is an integer belonging to [0,1], and hd is the service end signature private key component S .

[0122] Preferably, the terminal signature private key component and the service end signature private key component are respectively subjected to a secure split calculation to generate the corresponding terminal decryption private key component e A and the service end decryption private key component e S , including:

[0123] The terminal selects l+3 random numbers from [1, n-1]:

[0124] r1, r2, r 00 , r 10 , …, r l0

[0125] The terminal calculates Z1=[r1]G, and calculates the terminal decryption private key component e A :

[0126] e A =-(r 00 +r 10 +r 20 +…+r l0 )mod n

[0127] and sends Z1 to the service end; wherein Z1 is the point multiplication result of [r1]G.

[0128] Preferably, the terminal signature private key component and the service end signature private key component are respectively subjected to a secure split calculation to generate the corresponding terminal decryption private key component e A and the service end decryption private key component e S , including:

[0129] After receiving Z1, the service end selects l+1 random numbers from [1, n-1]:

[0130] u0, u1, u2, …, u l

[0131] The service end calculates:

[0132]

[0133] wherein, is the point multiplication result of [u i ]G, wherein i=0, 1, …, l, is the result of , wherein i=0, 1, …, l; b0, b1, b2…bl is an integer belonging to [0,1] ;

[0134] P 00 , P 10 , P 20 , …, P l0 are sent to the terminal, wherein P 00 , P 10 , P 20 , …, P l0 are point multiplication results of [u i ]G or results of ;

[0135] After receiving P 00 , P 10 , P 20 , …, P l0 by the terminal, the following is calculated:

[0136] r 01 = h d A + r 00 mod n

[0137] r 11 = h d A ·2 + r 10 mod n

[0138] r 21 = h d A ·2 2 + r 20 mod n

[0139] …

[0140] r l1 = h d A ·2 l + r l0 mod n

[0141] wherein r 01 , r 11 , r 21 , …, r l1 are random numbers, and r 00 , r 10 , r 20 , …, r l0 are random numbers;

[0142] The following is calculated:

[0143] Z2 = [r2]G

[0144] wherein Z2 is a point multiplication result of [r2]G;

[0145] The following is calculated in a loop from i = 0 to l:

[0146] K i0 = [r2]P i0 ,K i1 = [r2]Z1-K i0 ,

[0147]

[0148] wherein H() is a hash function, i is a temporary symbol, K i0 , K i1 are e i0 , e i1 are temporary symbols;

[0149] Let W A = {(e 00 , e 01 ), (e 10 , e 11 ), (e 20 , e 21 ), …, (e l0 , e l1 )}, send Z2 and W A to the server by the terminal; wherein W A is a data set of (e i0 , e i1 ), wherein i = 0, 1, …, l;

[0150] The server calculates from i = 0 to l after receiving Z2 and W A :

[0151]

[0152] wherein, is a temporary symbol, is a value extracted from W A ;

[0153] The server calculates the decryption private key component:

[0154]

[0155] Preferably, further comprising: merging the terminal decryption private key component e A and the server decryption private key component e S :

[0156] (e A + e S ) mod n = (hd A × hd S ) mod n, that is:

[0157]

[0158] In order to meet the requirement of decryption calculation, the mobile terminal decryption private key component e is generated by the secure split calculation method A and the server decryption private key component e S , so that (e A +e S )mod n=(hd A ×hd S )mod n, that is, the public signature public key and the private key of the mobile terminal and the server are kept unchanged to ensure the correctness of the decryption calculation. At the same time, in the split calculation process, the mobile terminal and the server do not expose their private key components hd A and hd S , and e A and e S to each other. The split calculation process is shown in Figure 2 .

[0159] The split calculation principle of the application is as follows:

[0160] The bit length of n is l+1, and the mobile terminal signature private key component hd A and the server signature private key component hd S can be represented as:

[0161] hd A =a0+a1·2+a2·2 2 +…+a l ·2 l

[0162] hd S =b0+b1·2+b2·2 2 +…+b l ·2 l

[0163] Wherein a i , b i ∈[0,1] are integers, which are the binary bits of hd A and hd S , i=0,1, …, l.

[0164] First, the mobile terminal A selects l+3 random numbers

[0165] r1,r2,r 00 ,r 10 ,…,r l0

[0166] Then calculate Z1=[r1]G and send Z1 to the server S.

[0167] Server S receives Z1, and selects l+1 random numbers from [1, n-1]

[0168] u0, u1, u2, …, u l

[0169] And calculate:

[0170] Then send P 00 , P 10 , P 20 , …, P l0 to mobile terminal A.

[0171] Mobile terminal A receives P 00 , P 10 , P 20 , …, P l0 , and first calculates:

[0172] r 01 = hd A + r 00 mod n

[0173] r 11 = hd A · 2 + r 10 mod n

[0174] r 21 = hd A · 2 2 + r 20 mod n

[0175] …

[0176] r l1 = hd A · 2 l + r l0 mod n

[0177] Then calculate again:

[0178] Z2 = [r2]G

[0179] Loop from i = 0 to l to calculate:

[0180] K i0 = [r2]P i0 , K i1 = [r2]Z1 - K i0 ,

[0181]

[0182] Where H() is a hash function.

[0183] Let W A= {(e 00 , 01 )(e 10 , 11 )(e 20 , 21 ),…,(e l0 , l1 )} and the mobile terminal A sends Z2 and W A to the server S. And the mobile terminal A calculates the mobile terminal A decryption private key component e

[0184] e A = -(r 00 + r 10 + r 20 +…+ r l0 ) mod n

[0185] After the server S receives Z2 and W A , the server S calculates the server S decryption private key component e

[0186] Loop from i = 0 to l to calculate:

[0187]

[0188] Finally, the server S calculates the server S decryption private key component e

[0189]

[0190] At this time, the e A calculated by the mobile terminal A and the e S calculated by the server S satisfy (e A + e S ) mod n = (hd A × hd S ) mod n, that is:

[0191]

[0192] Step 103: The terminal signature private key component hd A , the server signature private key component hd S , the terminal decryption private key component e A , and the server decryption private key component e S satisfy (e A + e S ) mod n = (hd A × hd S ) mod n, where n is the order of the elliptic curve, and mod n represents the modulo n operation.

[0193] Step 104: The terminal calculates based on the terminal decryption private key component e A , and the server calculates based on the server decryption private key component eS A decryption calculation is performed.

[0194] Therefore, the present application realizes that the mobile terminal A and the server S obtain another component representation of the common signature private key of the mobile terminal A and the server S through the secure split calculation without exposing the respective signature private key components hd A and hd S , and without synthesizing the common signature private key of the mobile terminal A and the server S, which can be conveniently used for other calculations, such as decryption calculation.

[0195] The present application relates to a key security split method based on an elliptic curve. The method generates another form of decryption private key component for the mobile terminal and the server through the secure split calculation without exposing the original mobile terminal signature private key component, the server signature private key component, and the common signature private key of the mobile terminal and the server, and without synthesizing the common signature private key of the mobile terminal and the server, which can be used for decryption calculation. The whole process needs the joint participation of the mobile terminal and the server, but the mobile terminal and the server cannot obtain the calculation key result of the other party, which guarantees the security of the overall system key.

[0196] The present application realizes that another private key component representation is generated for the mobile terminal and the server through the secure calculation without exposing the respective private key components and without synthesizing the overall private key, and the original overall private key is kept unchanged, so as to meet the decryption calculation or other form of password calculation requirement, which guarantees the security of the private key as a whole. The method can be used in any scene where the respective private key components need to be redistributed or transformed without synthesizing the overall private key.

[0197] The key security split method based on the elliptic curve of the present application is further described through specific embodiments.

[0198] Step 11: The mobile terminal A selects l+3 random numbers from [1, n-1]

[0199] r1,r2,r 00 ,r 10 ,…,r l0

[0200] Step 12: The mobile terminal A calculates

[0201] Z1=[r1]G

[0202] and the decryption private key component of the mobile terminal A

[0203] e A =-(r 00 +r 10 +r 20 +…+r l0 )mod n

[0204] And send Z1 to the server S.

[0205] Step 13: After receiving Z1, the server S selects l+1 random numbers from [1, n-1]

[0206] u0, u1, u2, …, ul l

[0207] Step 14: The server S calculates:

[0208]

[0209] And send P 00 , P 10 , P 20 , …, P l0 to the mobile terminal A.

[0210] Step 15: After receiving P 00 , P 10 , P 20 , …, P l0 , the mobile terminal A calculates:

[0211] r 01 = hd A + r 00 mod n

[0212] r 11 = hd A · 2 + r 10 mod n

[0213] r 21 = hd A · 2 2 + r 20 mod n

[0214] …

[0215] r l1 = hd A · 2 l + r l0 mod n

[0216] Z2 = [r2] G

[0217] Loop from i = 0 to l to calculate:

[0218] K i0 = [r2] P i0 , K i1 = [r2] Z1 - K i0 ,

[0219]

[0220] H() is a hash function.

[0221] Step 16: Mobile device A sends W A ={(e 00 ,e 01 ),(e 10 ,e 11 ),(e 20 ,e 21 ),…,(e l0 ,e l1 )} and send Z2 to the server S.

[0222] Step 17: Server S receives z2 and W A back,

[0223] Calculate iteratively from i = 0 to l:

[0224]

[0225] Finally, calculate the server-side decryption private key component:

[0226]

[0227] Step 18: Mobile device A and server S complete the calculation of their respective decryption private key components.

[0228] Figure 3 This is a structural diagram of an elliptic curve key splitting system according to a preferred embodiment of the present invention.

[0229] like Figure 3 As shown, the present invention provides an elliptic curve key splitting system, the system comprising:

[0230] Determining unit 301 is used to determine the terminal signature private key component hd based on elliptic curves. A server-side signature private key component hd S ;

[0231] The calculation unit 302 is used to perform secure splitting calculations on the terminal signature private key component and the server signature private key component respectively, and generate the corresponding terminal decryption private key component e. A Server-side decryption of private key component e S Terminal signature private key component hd A Server-side signature private key component hd S Terminal decryption private key component e A Server-side decryption of private key component e S Satisfy: (e) A +e S )mod n=(hd A ×hdS mod n, where n is the order of the elliptic curve, and mod n represents modulo n operation; the terminal decrypts the private key component e based on the terminal's decryption. A The server decrypts the private key component e based on the server's decryption. S Perform decryption calculations.

[0232] Preferably, the calculation unit 302 is used to perform secure splitting calculations on the terminal signature private key component and the server signature private key component respectively, to generate the corresponding terminal decryption private key component e. A Server-side decryption of private key component e S It is also used for:

[0233] The elliptic curve is E(F) q ), with the base point being G = (x G ,y G ), of order n, where the bit length of n is l+1, F q Let x be a finite field containing q elements. G ,y G The x and y coordinates of the base point;

[0234] Terminal signature private key component hd A ∈[1,n-1], represented as:

[0235] HD A =a0 + a1·2 + a2·2 2 +…+a l `2 l

[0236] Among them, a0, a1, a2…a l Let hd be an integer belonging to the range [0,1]. A binary bits;

[0237] Server-side signature private key component hd S ∈[1,n-1], represented as:

[0238] HD S =b0 + b1·2 + b2·2 2 +…+b l ·2 l

[0239] Among them, b0, b1, b2…b l Let hd be an integer belonging to the range [0,1], representing the server-side signature private key component. S The binary bits.

[0240] Preferably, the calculation unit 302 is used to perform secure splitting calculations on the terminal signature private key component and the server signature private key component respectively, to generate the corresponding terminal decryption private key component e.A and server decryption private key component e S , and is further configured to:

[0241] selecting l+3 random numbers from [1, n-1] by the terminal:

[0242] r1, r2, r 00 , r 10 , …, r l0

[0243] calculating Z1 = [r1]G by the terminal, and calculating terminal decryption private key component e A :

[0244] e A = -(r 00 + r 10 + r 20 + … + r l0 ) mod n

[0245] and sending Z1 to the server; wherein Z1 is the point multiplication result of [r1]·

[0246] Preferably, the calculation unit 302 is configured to perform secure split computation on the terminal signature private key component and the server signature private key component respectively, to generate corresponding terminal decryption private key component e A and server decryption private key component e S , and is further configured to:

[0247] selecting l+1 random numbers from [1, n-1] by the server after receiving Z1:

[0248] u0, u1, u2, …, u l

[0249] and calculating by the server:

[0250]

[0251] wherein, is the point multiplication result of [u i ]G, wherein i = 0, 1, …, l, is the result of , wherein i = 0, 1, …, l; b0, b1, b2, …, b l are integers belonging to [0,1] ;

[0252] sending P 00 , P 10 , P 20 , …, P l0 to the terminal, wherein P 00 , P 10 , P20 ,…,P l0 is the point multiplication result of [u i ]G or the result of [u

[0253] P 00 ,P 10 ,P 20 ,…,P l0 , and then calculates:

[0254] r 01 = hd A +r 00 mod n

[0255] r 11 = hd A ·2+r 10 mod n

[0256] r 11 = hd A ·2 2 +r 20 mod n

[0257] …

[0258] r l1 = hd A ·2 l +r l0 mod n

[0259] wherein r 01 , r 11 , r 21 …r l1 are random numbers, and r 00 , r 10 , r 20 …r l0 are random numbers;

[0260] calculates:

[0261] Z2= [r2]G

[0262] wherein Z2is the point multiplication result of [r2]G;

[0263] loops from i=0 to l to calculate:

[0264] K i0 = [r2]P i0 ,K i1 = [r1]Z1-K i0 ,

[0265]

[0266] Wherein, H() is a hash function, i is a temporary symbol, K i0 , K i1 , e i0 , e i1 is a temporary symbol;

[0267] Let W A ={(e 00 , e 01 ), (e 10 , e 11 ), (e 20 , e 21 ), …, (e l0 , e l1 )} be sent by the terminal to the server with Z2 and W A ; wherein, W A is a data set of (e i0 , e i1 ), wherein i=0, 1, …, l;

[0268] After receiving Z2 and W A , the server calculates from i=0 to l:

[0269]

[0270] Wherein, e is a temporary symbol, is a value extracted from W A ;

[0271] The server calculates the decryption private key component:

[0272]

[0273] Preferably, the calculation unit 302 is further configured to combine the terminal decryption private key component e A and the server decryption private key component e S :

[0274] (e A +e S )mod n=(hd A ×hd S )mod n, that is:

[0275]

[0276] The key splitting system of the elliptic curve of the preferred embodiment of the application corresponds to the key splitting method of the elliptic curve of the preferred embodiment of the application, which will not be described here.

[0277] Those skilled in the art will appreciate that embodiments of the present application can be readily used as software, hardware, or a combination of software and hardware. In a software embodiment, the methods can be tangibly embodied in a machine-readable storage medium having stored thereon instructions that can be used to program a computer to perform any of the methods. The software implementation can be initialized by loading and executing a set of instructions arranged to perform one of the methods into the computer's memory. Alternatively, hard-wired circuitry can be used in place of, or in combination with, software instructions. Thus, the

[0278] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams. Figure 1 means for performing each of the functions specified in the flowchart illustrations and / or block diagrams.

[0279] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams. Figure 1 means for performing each of the functions specified in the flowchart illustrations and / or block diagrams.

[0280] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams. Figure 1 means for performing each of the functions specified in the flowchart illustrations and / or block diagrams.

[0281] While preferred embodiments of the application have been described, modifications and variations can be apparent to those skilled in the art once aware of the general underlying concepts. Accordingly, the appended claims are intended to encompass all modifications and variations as falling within the scope of the application.

[0282] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims, and their equivalents, the application can be practiced otherwise than as specifically described.

[0283] The present application has been described in terms of particular embodiments. However, other embodiments apparent to those of ordinary skill in the art to which the present application pertains are intended to be within the scope of the claims that follow. It is therefore intended to cover any and all such applications, modifications and variations within the scope of the present application along with all equivalent techniques.

[0284] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise herein. All references to "a / an / the [device, component, etc.] are to be interpreted openly as referring to at least one instance of the referenced device, component, etc., unless otherwise indicated. The steps of any methods disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated.

Claims

1. A key splitting method of elliptic curve, the method comprising: respectively determining an elliptic curve based terminal signature private key component hd A and a server signature private key component hd S ; respectively, to generate corresponding terminal decryption private key components e A and server decryption private key components e S , comprising: The elliptic curve is E(F q ), the base point is G=(x G , y G ), the order is n, the bit length of n is l+1, F q is a finite field containing q elements, x G and y G are the x coordinate and y coordinate of the base point. Terminal signing private key component hd A ∈ [1, n-1], denoted as: hd A = a0+ a1·2+ a2·2 2 +…+a l ·2 l where a0, a1, a2...a l is an integer belonging to [0, 1] and is the terminal signing private key component hd A binary bit of ; Server signing private key component hd S ∈ [1, n - 1], denoted as: hd s = b0+ b1·2+ b2·2 2 +…+b l ·2 l Wherein, b0, b1, b2…b1 are integers belonging to [0, 1], and is a binary bit of the private key component hd of the server signature S . selecting l+3 random numbers from [1, n-1] by a terminal: r1，r2，r 00 ，r 10 ，…，r l0 and computing the terminal decryption private key component e A : e A = -(r 00 + r 10 + r 20 +... + r l0 ) mod n and sending Z1 to a server; wherein Z1 is a point multiplication result of [r1]G; selecting l+1 random numbers from [1, n-1] by the server after receiving Z1: U0, u1, u2,..., U l and calculating by the server: wherein, is [u i ]G the dot product result of [u is the result of wherein i = 0, 1,..., l; b0, b1, b2...bl are integers belonging to [0, 1]; l is the result of P 00 , P 10 , P 20 ,..., P l0 are sent to the terminal, where P 00 , P 10 , P 20 ,..., P l0 are the point multiplication results of [u i ]G or the results of . P is received by the terminal 00 , P 10 , P 20 , …, P l0 , and then calculates: r 01 = hd A + r 00 mod n r 11 = hd A · 2 + r 10 mod n r 21 = hd A ·2 2 + r 20 mod n …… r l1 = hd A ·2 l + r l0 mod n wherein r 01 , r 11 , r 21 ... r l1 are random numbers, r 00 , r 10 , r 20 ... r l0 are random numbers; calculating: Z2=[r2]G wherein Z2 is a point multiplication result of [r2]G; calculating in a loop from i=0 to l: where H() is a hash function, i is a temporary symbol, K i0 , K i1 , e i0 , e i1 is a temporary symbol; Let W A ={(e 00 e 01 ), (e 10 e 11 ), (e 20 e 21 ), ..., (e l0 e l1 Z2 and W are sent via the terminal. A For the server; where W A For (e) i0 e i1 A data set, where i = 0, 1, ..., l; The server receives Z2 and W A After that, the server calculates from i = 0 to l in a loop: wherein is a temporary symbol, is W A the values extracted in the middle; calculating a server decryption private key component: the terminal signing private key component hd A , the server signing private key component hd S , the terminal decryption private key component e A , the server decryption private key component e S satisfies: (e A + e S ) mod n = (hd A * hd S ) mod n, wherein n is an order of an elliptic curve, and mod n represents a modulo n operation. The terminal performs a decryption computation based on the terminal decryption private key component e A The server performs a decryption computation based on the server decryption private key component e S The server performs a decryption computation based on the server decryption private key component e 2. The method of claim 1, further comprising: decrypting the terminal private key component e A decrypting the server private key component e S merge (e A +e S )mod n=(hd A ×hd s )mod n, i.e.: 3.A key splitting system of elliptic curve, the system comprising: determining unit configured to determine a terminal signature private key component hd based on an elliptic curve A and a server signature private key component hd s respectively a computing unit, configured to perform secure split computation on the terminal signature private key component and the server signature private key component respectively, to generate corresponding terminal decryption private key component e A and server decryption private key component e S and further configured to: The elliptic curve is E(F q ), the base point is G=(x G , y G ), the order is n, the bit length of n is l+1, F q is a finite field containing q elements, x G and y G are the x coordinate and y coordinate of the base point. Terminal signing private key component hd A ∈ [1, n-1], denoted as: hd A = a0+ a1- 2 + a2- 2 2 +…+a l ·2 l where a0, a1, a2...a l is an integer belonging to [0, 1] and is the binary bit of the terminal signing private key component hd A is an integer belonging to [0, 1] and is the binary bit of the terminal signing private key component hd Server signing private key component hd S ∈ [1, n - 1], denoted as: hd s = b0+ b1- 2 + b2- 2 2 +…+b l ·2 l where b0, b1, b2... b l is an integer belonging to [0, 1] and is the server signing private key component hd S binary bit of the server signing private key selecting l+3 random numbers from [1, n-1] by a terminal: r1，r2，r 00 ，r 10 ，…，r l0 and computing the terminal decryption private key component e A : e A = -(r 00 + r 10 + r 20 +... + r l0 ) mod n and sending Z1 to a server; wherein Z1 is a point multiplication result of [r1]G; selecting l+1 random numbers from [1, n-1] by the server after receiving Z1: u0, u1, u2,..., u l and calculating by the server: wherein, is [u i ]G, where i = 0, 1,..., l, is the result of , where i = 0, 1,..., l; b0, b1, b2...bl l is an integer belonging to [0, 1]; P 00 , P 10 , P 20 , …, P l0 are sent to the terminal, where P 00 , P 10 , P 20 , …, P l0 are the point multiplication results of [u i ]G or the results of . P is received by the terminal 00 P 10 P 20 P l0 After this, calculate: r 01 = hd A + r 00 mod n r 11 = hd A · 2 + r 10 mod n r 21 = hd A ·2 2 + r 20 mod n …… r l1 = hd A ·2 l + r l0 mod n wherein r 01 , r 11 , r 21 ... r l1 are random numbers; r 00 , r 10 , r 20 ... r l0 are random numbers; calculating: Z2=[r2]G wherein Z2 is a point multiplication result of [r2]G; calculating in a loop from i=0 to l: where H() is a hash function, i is a temporary symbol, K i0 , K i1 , e i0 , e i1 is a temporary symbol; Let W A ={(e 00 e 01 ), (e 10 e 11 ), (e 20 e 21 ), ..., (e l0 e l1 Z2 and W are sent via the terminal. A For the server; where W A For (e) i0 e i1 A data set, where i = 0, 1, ..., l; The server receives Z2 and W A After that, the server calculates from i = 0 to l in a loop: wherein is a temporary symbol, is W A the values extracted in the middle; calculating a server decryption private key component: The terminal signature private key component hd A The server signature private key component hd S The terminal decryption private key component e A The server decryption private key component e S Satisfies: (e A + e s ) mod n = (hd A * hd S ) mod n, wherein n is an order of an elliptic curve, and mod n represents modulo n operation; the terminal performs decryption calculation based on the terminal decryption private key component e A The server performs decryption calculation based on the server decryption private key component e S .

4. The system of claim 3, the computing unit is further configured to combine the terminal decryption private key component e A , the server decryption private key component e S . (e A +e S )modn=(hd A ×hd S )mod n, i.e.:

Images