An encryption method and device based on elliptic curve signature, a terminal and a medium

Abstract

The application discloses an encryption method based on an elliptic curve signature, and discloses an apparatus, a terminal and a storage medium with the encryption method based on the elliptic curve signature, wherein the encryption method based on the elliptic curve signature replaces the steps of generating a random number k and calculating [k]*G or [k]*P with the finite field addition operation of x element combinations of a private key combination factor table and the point addition operation of an elliptic curve of x element combinations of a corresponding public key combination factor table on the basis of an existing national encryption SM2 encryption algorithm, and the point addition operation of the elliptic curve of the x public key element combinations is completed by an auxiliary signature operation device, so that the number of operations of a cryptographic device is reduced, the performance during large-scale signature is improved, and the risk of leakage is not increased.

Description

Technical Field

[0001] This invention relates to the field of computer application design, and in particular to an encryption method, apparatus, terminal and medium based on elliptic curve signature. Background Technology

[0002] Currently, there are many scenarios requiring dedicated cryptographic devices (such as cryptographic cards or UKeys) to perform batch signing using the Chinese national cryptographic algorithm SM2. Examples include users signing large amounts of data, users providing signatures for multiple transaction data through cloud platform interfaces, and collaborative signing via mobile devices. Since UKey signing performance is typically low, and mobile app collaborative signing performance is also low, these can become bottlenecks in scenarios involving large-scale or batch signing. Therefore, this paper proposes an encryption method based on elliptic curve signatures, which offloads part of the computational workload of SM2 signing from the cryptographic device to an auxiliary signing device, requiring the cryptographic device to perform only a small amount of computation. Using a cryptographic device protects the security of the private key, preventing external access to it; the auxiliary signing device does not involve the private key and does not leak it, allowing the use of general-purpose clients or multiple servers. For example, when a client uses UKey signing or collaborative signing, the client can be used as an auxiliary signing device; when a server uses cryptographic cards for signing, multiple servers can be used as auxiliary signing devices. This method is also applicable to other elliptic curve signature algorithms, such as ECDSA or Schnorr.

[0003] The process of signing with the national cryptographic SM2 code is as follows:

[0004] Obtain the relevant parameters of the SM2 elliptic curve. Recommended parameters (p, n, a, b, x) for the SM2 elliptic curve on Fp have specific values. G ,y G ,h). Where Fp is a prime field (p is a prime number greater than 3), and a and b are two elements in Fp that satisfy y 2 =x 3 +ax+b. Base point G=(x G ,y G ), is a non-infinity point on the elliptic curve, n is the order of the base point G, and h is the cofactor.

[0005] Distinguished ID of signer A A ENTL A It is by ID A The bit length is converted to two bytes. The identifiable identifier also has recommended parameters with specific values. The signer's private key is d. A The public key is P A =(x A ,y A ), that is, P A =[dA ]*G. The message to be signed is M.

[0006] The specific steps for signing with the national cryptographic standard SM2 are as follows:

[0007] 1. Calculate Z A =H 256 (ENTL A ||ID A ||a||b||x G ||y G ||x A ||y A H 256 It uses the national cryptographic SM3 hash algorithm;

[0008] 2. Calculate e = H v (Z A ||M). Where H is... v Using the SM3 hash algorithm (a national cryptographic standard), the hash value e to be signed is obtained;

[0009] 3. Generate random numbers k∈[1,n-1];

[0010] 4. Calculate the elliptic curve point (x1, y1) = [k] * G;

[0011] 5. Calculate r = (e + x1) mod n. If r = 0 or r + k = n, then skip to step 3.

[0012] 6. Calculate s = ((1+d) A ) -1 *(k–r*d A If s == 0, then skip to step 3.

[0013] 7. Output the signature value (r, s).

[0014] Steps 1 and 2 can be considered SM2 signature preprocessing, generating the hash value e to be signed. This process does not involve parameters that need to be kept secret in the signature and can be processed externally by the cryptographic device. Therefore, the actual operation of the cryptographic device is steps 3 to 6, and the signature result of step 7 is output. The operation of step 6 can be optimized as s = (t * (k + r) - r) mod n, where t = (1 + d) / (k + r) mod n. A ) -1 Therefore, the computational complexity of steps 5 and 6 is 3 finite field addition operations and 1 finite field multiplication operation.

[0015] When users want to perform large-scale signature processes, the computational pressure is high, and the performance of the encryption algorithm cannot meet the requirements. Summary of the Invention

[0016] This invention aims to improve the elliptic curve signature method. To this end, this invention proposes an encryption method based on elliptic curve signatures, which can improve the signature performance of cryptographic devices using elliptic curve signature algorithms.

[0017] The present invention also proposes a device, terminal, and medium having the above-mentioned signature encryption method.

[0018] According to a first aspect of the present invention, an encryption method based on elliptic curve signatures is characterized in that the method is applied to at least two terminals, namely a cryptographic terminal and an auxiliary terminal:

[0019] The cryptographic end generates and stores a private key combination factor table composed of several non-repeating random numbers, calculates the corresponding public key combination factor table based on the private key combination factor table, and sends the public key combination factor table to the auxiliary end.

[0020] The cryptographic end calculates the hash value to be signed based on the signer's identification information and the data to be signed;

[0021] The cryptographic end generates a first random number, calculates its result value based on the first random number using the private key combination factor table, and sends the first random number to the auxiliary end;

[0022] The auxiliary terminal calculates the intermediate signature value corresponding to the random number based on the first random number and the public key combination factor table, and returns the intermediate signature value to the cryptographic terminal.

[0023] The cryptographic end calculates the signature value based on the result value and the intermediate signature value.

[0024] The encryption method based on elliptic curve signature according to embodiments of the present invention has at least the following beneficial effects: Taking the national cryptographic SM2 encryption method as an example, the method replaces the step of generating a random number k and calculating [k]*G or [k]*P with the finite field addition operation of the combination of x elements of the private key combination factor table and the point addition operation of the elliptic curve of the combination of x elements of the corresponding public key combination factor table. The point addition operation of the elliptic curve of the combination of x public key elements is performed by the auxiliary signature operation device, which reduces the number of operations of the cryptographic device, improves the performance of large-scale signatures, and does not increase the risk of leakage.

[0025] According to some embodiments of the present invention, the step of calculating the hash value to be signed based on the signer identification information and the data to be signed by the cryptographic end includes:

[0026] Based on the signer's identification information, along with the elliptic curve recommendation parameters and the signer's public key, the first hash value is generated using the national cryptographic SM3 hash algorithm.

[0027] The first hash value is concatenated with the data to be signed and a second hash value is generated using the national cryptographic SM3 hash algorithm. The second hash value is then used as the hash value to be signed.

[0028] According to some embodiments of the present invention, the auxiliary terminal processes the data in parallel using multiple terminals and / or threads, selecting N repeatable elements from the public key combination factor table based on the first random number, and performing addition operations on the N elements in parallel.

[0029] According to some embodiments of the present invention, the method is implemented on a mobile device and includes a client and a server, specifically including:

[0030] The client generates a first random number and calculates its corresponding result value based on the first random number using the private key combination factor table;

[0031] The server obtains the first random number, calculates the first intermediate signature value corresponding to the first random number based on the first random number and the public key combination factor table, generates a second random number, and calculates the second intermediate signature value based on the second random number and the first intermediate signature result value.

[0032] The server calculates the third intermediate signature value based on the hash value to be signed and the second intermediate signature value, and returns the third intermediate signature value to the client.

[0033] The client calculates a signature value based on the third intermediate signature value and the first result value, which is used to replace the random number and dot product result in the original signature algorithm and calculate the signature value.

[0034] An elliptic curve signature-based encryption device according to a second aspect of the present invention is characterized in that the device comprises at least two terminals, namely a cryptographic terminal and an auxiliary terminal:

[0035] The initialization module in the cryptographic terminal can generate and store a private key combination factor table composed of several non-repeating random numbers, calculate the corresponding public key combination factor table based on the private key combination factor table, and send the public key combination factor table to the auxiliary terminal.

[0036] The preprocessing module in the cryptographic terminal can calculate the hash value to be signed based on the signer's identification information and the data to be signed;

[0037] The private key calculation module in the cryptographic terminal is able to generate random numbers, calculate the corresponding result value based on the random numbers through the private key combination factor table, and send the result value to the auxiliary terminal;

[0038] The intermediate signature module in the auxiliary terminal can calculate the intermediate signature value corresponding to the random number based on the random number and the public key combination factor table, and return the intermediate signature value to the cryptographic terminal.

[0039] The signature combination module in the cryptographic terminal can calculate the signature value based on the intermediate signature value, which is used to replace the random number and dot product result in the original signature algorithm and calculate the signature value.

[0040] According to some embodiments of the present invention, the preprocessing module includes:

[0041] The first hash element is able to generate a first hash value using the national cryptographic SM3 hash algorithm based on the signer's identification information and the elliptic curve recommended parameters;

[0042] The second hash element is capable of concatenating the first hash value with the data to be signed and generating a second hash value using the national cryptographic SM3 hash algorithm, and using the second hash value as the hash value to be signed.

[0043] According to some embodiments of the present invention, the device includes at least two terminals, namely a cryptographic terminal and an auxiliary terminal. The cryptographic terminal includes a preprocessing module, a private key calculation module and a signature combination module, and the auxiliary terminal includes an intermediate signature module.

[0044] According to some embodiments of the present invention, the auxiliary terminal processes data in parallel using multiple terminals and / or threads, thereby reducing the computational load on the cryptographic terminal.

[0045] According to some embodiments of the present invention, the device is implemented based on a mobile terminal and includes a client and a server, specifically including:

[0046] The client generates a first random number and calculates its corresponding result value based on the first random number using the private key combination factor table;

[0047] The server obtains the first random number, calculates the first intermediate signature value corresponding to the first random number based on the first random number and the public key combination factor table, generates a second random number, and calculates the second intermediate signature value based on the second random number and the first intermediate signature result value.

[0048] The server calculates the third intermediate signature value based on the hash value to be signed and the second intermediate signature value, and returns the third intermediate signature value to the client.

[0049] The client calculates a signature value based on the third intermediate signature value, which is used to replace the random number and dot product result in the original signature algorithm and calculate the signature value.

[0050] According to a third aspect of this application, a terminal is provided, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described elliptic curve signature-based encryption method.

[0051] According to a fourth aspect of this application, a computer-readable storage medium is provided that stores computer-executable instructions for performing the above-described elliptic curve signature-based encryption method.

[0052] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0053] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which:

[0054] Figure 1 This is a schematic diagram illustrating the steps of an encryption method based on elliptic curve signatures according to an embodiment of the present invention.

[0055] Figure 2 This is a schematic diagram illustrating the implementation of the elliptic curve signature-based encryption method using a cryptographic device and an auxiliary signature processing device in an embodiment of the present invention.

[0056] Figure 3 This is a structural block diagram of an encryption device based on elliptic curve signatures provided in an embodiment of the present invention. Detailed Implementation

[0057] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0058] In the description of this invention, it should be understood that the orientation descriptions, such as up, down, front, back, left, right, etc., are based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting this invention.

[0059] In the description of this invention, "several" means one or more, "more than" means two or more, "greater than," "less than," and "exceeding" are understood to exclude the stated number, while "above," "below," and "within" are understood to include the stated number. The use of "first" and "second" in the description is merely for distinguishing technical features and should not be construed as indicating or implying relative importance, or implicitly indicating the number of indicated technical features, or implicitly indicating the order of the indicated technical features.

[0060] In the description of this invention, unless otherwise explicitly defined, terms such as "setting," "installing," and "connecting" should be interpreted broadly, and those skilled in the art can reasonably determine the specific meaning of the above terms in this invention in conjunction with the specific content of the technical solution.

[0061] Example 1

[0062] Reference Figure 1 The present invention provides an encryption method based on elliptic curve signatures, which is applied to at least two terminals, namely a cryptographic terminal and an auxiliary terminal, and includes the following steps:

[0063] Step S100: The cryptographic terminal generates and stores a private key combination factor table composed of several non-repeating random numbers, calculates the corresponding public key combination factor table based on the private key combination factor table, and sends the public key combination factor table to the auxiliary terminal.

[0064] The cryptographic device generates y unique random numbers k. i Given elements ∈ [1, n-1], construct a private key combination factor table and store it in a cryptographic device. Calculate the corresponding public key combination factor table, where the elements P in the public key combination factor table are... i =[k i The system then sends the public key combination factor table to the auxiliary signature processing device. The auxiliary signature processing device stores the public key combination factor table.

[0065] Step S200: The cryptographic terminal calculates the hash value to be signed based on the signer's identification information and the data to be signed. Specifically, this includes:

[0066] Step S201: Based on the signer's identification information and the recommended parameters of the elliptic curve, generate the first hash value using the national cryptographic SM3 hash algorithm.

[0067] Obtain the relevant parameters of the SM2 elliptic curve. Recommended parameters (p, n, a, b, x) for the SM2 elliptic curve on Fp have specific values. G ,y G ,h). Where Fp is a prime field (p is a prime number greater than 3), and a and b are two elements in Fp that satisfy y 2 =x 3 +ax+b. Base point G=(x G ,y G ), is a non-infinity point on the elliptic curve, n is the order of the base point G, and h is the cofactor.

[0068] Distinguished ID of signer A A ENTL A It is by ID A The bit length is converted to two bytes. The identifiable identifier also has recommended parameters with specific values. The signer's private key is d.A The public key is P A =(x A ,y A ), that is, P A =[d A ]*G. The message to be signed is M.

[0069] Calculate Z A =H 256 (ENTL A ||ID A ||a||b||x G ||y G ||x A ||y A ).

[0070] Where H 256 It uses the national cryptographic SM3 hash algorithm.

[0071] Step S202: Concatenate the first hash value with the data to be signed and use the national cryptographic SM3 hash algorithm to generate a second hash value, and use the second hash value as the hash value to be signed.

[0072] Calculate e = H v (Z A ||M). Where H is... v Using the SM3 hash algorithm (a national cryptographic standard), the hash value e to be signed is obtained.

[0073] Step S300: The cryptographic terminal generates a first random number, divides the first random number into multiple parts, uses each part as an index to select the corresponding element from the private key combination factor table, calculates the result value by performing finite field addition on the selected multiple elements, and sends the first random number to the auxiliary terminal.

[0074] The cryptographic device generates a random number k2, and calculates k based on k2 using the private key combination factor table. If k == 0, step 2 is repeated; otherwise, k2 is sent to the auxiliary signature processing device. The operation involves grouping k2 into x blocks, where k2 has a length of x * log2(y) bits. Each block's value is an index in the private key combination factor table. Finite field addition is performed on the corresponding x elements of the private key combination factor table to obtain the result k.

[0075] Step S400: The auxiliary terminal divides the first random number into multiple parts based on the first random number. Each part is used as an index to select the corresponding element from the public key combination factor table. The intermediate value of the signature is calculated by performing a point addition operation of an elliptic curve on the selected multiple elements, and the intermediate value of the signature is returned to the cryptographic terminal.

[0076] The auxiliary signature processing device calculates [k]*G based on k2 and the public key combination factor table, and returns the result (x1, y1) of [k]*G to the cryptographic device. The operation involves dividing k2 into x groups, where the length of k2 is x*log2(y) bits. Each group's value is an index in the public key combination factor table. The corresponding x elements of the public key combination factor table are then subjected to elliptic curve point addition to obtain the result [k]*G.

[0077] Step S500: The cryptographic end calculates a signature value based on the result value and the intermediate signature value, which is used to replace the random number and dot product result in the original signature algorithm and calculate the signature value.

[0078] Calculate r = (e + x1) mod n. If r = 0 or r + k = n, then regenerate random numbers.

[0079] Calculate s = ((1+d) A ) -1 *(k–r*d A ))mod n, if s=0, then regenerate random numbers.

[0080] Output the signature value (r, s).

[0081] In the process of generating a random number k2, k2 is sent to an auxiliary signature calculation device, which calculates the equivalent [k]*G, i.e. (x1, y1) in step S300, and returns it to the cryptographic device. Then, the cryptographic device completes the subsequent calculations.

[0082] The auxiliary signature processing device cannot obtain the value of k through k2 or related operations, because if the auxiliary processing device could obtain the value of k, it could calculate the private key d through step 6. A The value of k is lost, leading to the leakage of the private key. The returned result [k]*G can be considered as a public key, and its corresponding private key is k. Because of the Elliptic Curve Discrete Logarithm Problem (ECDLP), the corresponding private key cannot be known from the public key. Only the cryptographic device can calculate the value of k from k², and the relevant operations are all performed within the cryptographic device, ensuring that the private key is not leaked.

[0083] Elliptic curve-based public-key combinatorial algorithms are algorithms that use a finite number of private keys and public-key combination factor tables to compute public and private keys using mapping algorithms and combination factor tables respectively. For example, to compute the matrix element coordinates (index1, 1), (index2, 2), ..., (index...) corresponding to an ID (random number k2). h (,h). Where (index) j (i) represents the row number of the key matrix (i.e., the combination factor table) at index. jThe element with column number i. Based on the matrix element coordinates corresponding to the ID, select elements in the public key matrix to calculate PK = [Rindex1, 1 + Rindex2, 2 + ... + Rindex...]. h ,h]*G, select elements from the private key matrix to calculate sk=(Rindex1,1+Rindex2,2+…+Rindex h Therefore, the public key PK = [sk] * G, which satisfies the elliptic curve public-private key pair correspondence.

[0084] The first problem with public-key combination algorithms is the existence of linear collusion attacks. However, this attack requires an external source to know the result of the private key operation, `sk`, and to calculate the elements in the private key combination factor table using the linear relationship of `sk`. In this scenario, only the public key combination factor table is provided. The algorithm calculates [k]*G using the public key combination factor table and a random number `k2`. That is, the auxiliary signature processing device adds the public keys corresponding to the values ​​of each element in `k2` to obtain [k]*G = [Rindex1,1+Rindex2,2+…+Rindex...]. h The cryptographic device calculates k = (Rindex1,1 + Rindex2,2 + ... + Rindex) * G. h The public key combination factor table can be viewed as an array of multiple public keys. The addition operation of related elements does not reveal information related to k. Neither the private key combination factor table nor the operation result k appears outside the cryptographic device.

[0085] The second problem with combined public-key algorithms is that the coverage of the result (k value) may not meet security requirements. For example, if the number of combinations corresponding to k2 is insufficient (one combination can produce one k value), the range of the resulting k value will be limited, failing to cover [1, n-1], where n is no greater than 2^256, thus leading to a decrease in security. To meet security requirements, the number of combinations corresponding to k2 must not be less than n (ignoring the probability of combination value collisions).

[0086] Assuming a cryptographic device UKey is used, the private key combination factor table generated during initialization is a one-dimensional array of 256 elements. This means k2 can be grouped into 8-bit blocks (256 = 2^8), and the value of each block can be represented as the index i of the private key combination factor table. Therefore, the length of k2, x * 8 bits, can be seen as the combination of x repeatable elements from the 256 elements. The formula for combining repeatable elements is... Let k be the number of combinations of selecting x repeatable elements from y distinct elements. Therefore, to satisfy the condition that the number of combinations is greater than 2^256, k2 >= 78 * 8 bits, or 78 elements, are needed, because (256 + 78 - 1)! / (256 - 1)! 78! ≈ 2^257.233. Therefore, the private key combination factor table that the cryptographic device needs to store is 256 * 32B = 8KB, and the public key combination factor table that the auxiliary signature processing device needs to store is 256 * 64B = 16KB. A single signature operation requires the cryptographic device to generate 78B random numbers and perform 80 finite field addition operations and 1 finite field multiplication operation; the auxiliary signature processing device needs to perform 77 elliptic curve point addition operations.

[0087] Assuming a cryptographic device using a cryptographic card, the private key combination factor table initially displayed is a one-dimensional array of 16384 elements (because the cryptographic card stores more keys than a UKey). This means k2 can be grouped into 14-bit blocks (16384 = 2^14), and each block's value can be represented as the index i of the private key combination factor table. The length of k2 is x * 14 bits. To satisfy the requirement of a combination number greater than 2^256, the formula for repeatable elements calculates that k2 >= 24 * 14 bits, or 24 elements, is needed. This is because (16384 + 24 - 1)! / (16384 - 1)! 24! ≈ 2^256.986. Therefore, the size of the private key combination factor table that the cryptographic device needs to store is 16384 * 32B = 512KB, and the size of the public key combination factor table that the auxiliary signature processing device needs to store is 16384 * 64B = 1MB. A single signature operation requires a cryptographic device to generate 42 bytes of random numbers, as well as to perform 26 finite field addition operations and 1 finite field multiplication operation; an auxiliary signature operation requires to perform 23 elliptic curve point addition operations.

[0088] like Figure 2 As shown, based on the above embodiment of the encryption method based on elliptic curve signatures, the computational workload of a single signature cryptographic device is (x+2) finite field addition operations and 1 finite field multiplication operation, while the computational workload of the auxiliary signature computing device is (x-1) elliptic curve point addition operations. Furthermore, the auxiliary signature computing device can be used in parallel with multiple processors / threads; for example, m threads can simultaneously calculate (x-1) / m elliptic curve point addition operations, and then the results are merged. Since the computational workload required for a single signature by the cryptographic device is very small, the signature performance of the cryptographic device can be improved. Because there is a probability of collision after combination, the value of x can be appropriately increased to increase the number of combinations, and the elements of the private key combination factor table generated during the initialization of the cryptographic device can be constrained to random prime numbers, which may reduce the probability of collisions, ensuring that the result k value can cover the range [1, n-1] as much as possible.

[0089] Example 2

[0090] In mobile collaborative signing scenarios, the signing involves both the client and server. Specifically, each party may possess a portion of the private key, and the signature is completed through joint computation and interaction. For example, the client may have private key d. A Public key P A =[d A *G; The server has the private key d S Public key P S =[d S ]*G; The public key jointly created by both parties is P=[d A ]*P S -G=[d S ]*P A -G=[d A *d S -1]*G, so the private key corresponding to P is d=d A *d S -1, transformed into t = (1 + d) -1 modn=(d A ) -1 *(d S ) -1 mod n.

[0091] When the above method is applied to mobile devices, traditional signature methods typically include:

[0092] Step A100: The client generates a first random number and calculates the hash value to be signed based on the first random number, the signer identification information, and the data to be signed.

[0093] The client generates a random number k. A ∈[1,n-1], calculate Q A =[k A ]*P S Q A The hash value e to be signed is sent to the server.

[0094] Step A200: The server generates a second random number and calculates its corresponding result value based on the second random number using the private key combination factor table.

[0095] The server generates a random number k. S ∈[1,n-1], calculate (x1,y1)=[k S ]*G+q A The corresponding (x1, y1) = [k S +k A *d S ]*G, that is, k = k S +k A *d S.

[0096] Step A300: The server calculates the intermediate signature value corresponding to the second random number based on the second random number and the public key combination factor table.

[0097] The server calculates r = (e + x1) mod n and s1 = (d S ) -1 *(k S +r)mod n, and return the intermediate value r of the signature and s1 to the client.

[0098] Step A400: The client calculates the signature value based on the intermediate signature value.

[0099] Client-side calculation s = ((d) A ) -1 *(k A +s1)-r)mod n=((d A ) -1 *(d S ) -1 *(k A *d S +k S +r)-r)mod n=(t*(k+r)-r))mod n. The client outputs the signature value (r,s).

[0100] It can be seen that the collaborative signature client needs to compute [k] A ]*P S and s=((d A ) -1 *(k A +s1)-r)mod n, where (d A ) -1 This can be preprocessed, so an elliptic curve k is needed. A The doubling operation, two finite field addition operations, and one finite field multiplication operation.

[0101] Preferably, based on the traditional method described above, the client can generate two unique random numbers k (y2) during initialization. Ai ∈[1,n-1], construct and store the private key combination factor table, and calculate the corresponding public key combination factor table, where the elements P of the public key combination factor table are... Si =[k Ai ]*P S The client sends its public key combination factor table to the server (which acts as an auxiliary signature processing device for the client), and the server stores the client's public key combination factor table. The signing steps are as follows:

[0102] Step B100: The client generates a first random number k2, and calculates its corresponding result value k based on the first random number k2 using the private key combination factor table. A .

[0103] The client generates a random number k2, and calculates k based on k2 using the private key combination factor table. A .

[0104] If k A If the result is 0, repeat step 1; otherwise, send k2 and the hash value e to be signed to the server. The operation involves dividing k2 into x2 groups, meaning k2 has a length of x2 * log2(y2) bits. Each group's value is an index of the private key combination factor table. Finite field addition is performed on the corresponding x2 elements of the private key combination factor table to obtain the result k. A .

[0105] Step B200: The server obtains the first random number k2, and calculates the first signature intermediate value [k] corresponding to the first random number based on the first random number k2 and the public key combination factor table. A ]*P S And generate a second random number k. S Based on the second random number k S and the intermediate result value of the first signature [k A ]*P S The intermediate value (x1, y1) of the second signature is calculated.

[0106] The server calculates [k] based on k2 and using the public key combination factor table. A ]*P S This step replaces the traditional collaborative signature step of directly calculating [k] A ]*P S (The process) and generate random number k S ∈[1,n-1], calculate (x1,y1)=[k S ]*G+[k A ]*P S .

[0107] The operation involves grouping k2 into x2 groups, where k2 has a length of x2 * log2(y2) bits. Each group's value is an index of the public key combination factor table. The result is obtained by performing an elliptic curve point addition operation on the corresponding x2 elements of the public key combination factor table. A ]*P S ;

[0108] Step B300: The server calculates the third signature intermediate value r and s1 based on the hash value e to be signed and the second signature intermediate value (x1, y1), and returns the third signature intermediate value to the client.

[0109] The server calculates r = (e + x1) mod n and s1 = (d S ) -1 *(k S +r)mod n, and return the third signature intermediate value r and s1 to the client.

[0110] Step B400: Client calculates s = ((d A ) -1 *(k A +s1)-r)mod n=((d A ) -1 *(d S ) -1 *(k A *d S +k S +r)-r)mod n=(t*(k+r)-r))mod n. The client outputs the signature value (r,s).

[0111] With this optimization method, the computational cost for a single collaborative signature by the client is (x² + 1) finite field additions and 1 finite field multiplication. The computational cost by the server is x² elliptic curve point additions, 2 finite field additions, 1 finite field multiplication, and 1 elliptic curve k-fold point operation. The 1 elliptic curve k-fold point operation can also be further optimized using the aforementioned signature optimization method. Because the client reduces the computational cost of collaborative signatures, the client's collaborative signature performance can be improved.

[0112] Another aspect of this application provides an encryption device based on elliptic curve signatures, such as... Figure 3 As shown, the device 30 includes: an initialization module 301, a preprocessing module 302, a private key calculation module 303, an intermediate signature module 304, and a signature combination module 305.

[0113] The initialization module 301 is capable of generating and storing a private key combination factor table composed of several non-repeating random numbers, calculating the corresponding public key combination factor table based on the private key combination factor table, and sending the public key combination factor table to the auxiliary terminal.

[0114] The preprocessing module 302 is capable of calculating the hash value to be signed based on the signer identification information and the data to be signed.

[0115] The private key calculation module 303 is capable of generating random numbers, calculating the corresponding result value based on the random numbers using the private key combination factor table, and sending the result value to the auxiliary terminal.

[0116] The intermediate signature module 304 is capable of calculating the intermediate signature value corresponding to the random number based on the random number and the public key combination factor table, and returning the intermediate signature value to the cryptographic end.

[0117] The signature combination module 305 is capable of calculating a signature value based on the intermediate signature value, which is used to replace the random number and dot product result in the original signature algorithm and calculate the signature value.

[0118] The embodiments of this application replace the original signature step of generating a random number k and calculating [k]*G or [k]*P with a finite field addition operation of x elements of the private key combination factor table and a point addition operation of the elliptic curve of the corresponding x elements of the public key combination factor table. The point addition operation of the elliptic curve of the x public key elements is then performed by an auxiliary signature processing device. This scheme unifies publicly computable data into multiple multi-processor or multi-threaded parallel devices for processing, reducing the number of computations required by the cryptographic devices and improving the signature performance of cryptographic devices in large-scale signature scenarios.

[0119] Meanwhile, this scheme is also applicable to all signature algorithms based on elliptic curve cryptography, especially ECDSA or Schnorr signature algorithms, which also involve random number k∈[1,n-1] and the calculation of k times the point[k]*G. This step is replaced by a finite field addition operation of x elements from the private key factor table and a point addition operation of x elements from the corresponding public key factor table, with the point addition operation delegated to an auxiliary signature processing device. The cryptographic device only needs to perform a small number of operations, thus improving signature performance.

[0120] Furthermore, the preprocessing module 302 includes:

[0121] The first hash element is able to generate a first hash value using the national cryptographic SM3 hash algorithm based on the signer's identification information and the elliptic curve recommended parameters;

[0122] The second hash element is capable of concatenating the first hash value with the data to be signed and generating a second hash value using the national cryptographic SM3 hash algorithm, and using the second hash value as the hash value to be signed.

[0123] Furthermore, the device includes at least two terminals, namely a cryptographic terminal and an auxiliary terminal. The cryptographic terminal includes a preprocessing module, a private key calculation module, and a signature combination module, and the auxiliary terminal includes an intermediate signature module.

[0124] Furthermore, the auxiliary terminal processes data in parallel using multiple terminals and / or threads, reducing the computational load on the cryptographic terminal.

[0125] Another embodiment of this application provides a terminal, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described encryption method based on elliptic curve signature.

[0126] Specifically, the processor can be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA, or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0127] Specifically, the processor connects to the memory via a bus, which may include a path for transmitting information. The bus can be a PCI bus or an EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc.

[0128] The memory may be a ROM or other type of static storage device capable of storing static information and instructions, a ROM or other type of dynamic storage device capable of storing information and instructions, or an EEPROM, CD-ROM or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0129] Optionally, the memory stores the code of the computer program that executes the scheme of this application, and the execution is controlled by the processor. The processor executes the application code stored in the memory to implement... Figure 2 The operation of the encryption device based on elliptic curve signature provided in the illustrated embodiment.

[0130] Another embodiment of this application provides a computer-readable storage medium storing computer-executable instructions for performing the above-described... Figure 1 The encryption method shown is based on elliptic curve signatures.

[0131] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0132] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0133] The above is a detailed description of the preferred embodiments of this application. However, this application is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. An encryption method based on elliptic curve signature, characterized by, The method is applied to at least two terminals, namely a password terminal and an auxiliary terminal: The password terminal generates a private key combination factor table composed of a plurality of non-repeating random numbers and stores the table, calculates a corresponding public key combination factor table based on the private key combination factor table, and sends the public key combination factor table to the auxiliary terminal; The password terminal calculates a hash value to be signed based on the identifier information of the signer and the data to be signed; The password terminal generates a first random number, divides the first random number into a plurality of parts, selects corresponding elements from the private key combination factor table as indexes, calculates a result value by performing finite field addition operation on the selected elements, and sends the first random number to the auxiliary terminal; The auxiliary terminal divides the first random number into a plurality of parts according to the first random number, selects corresponding elements from the public key combination factor table as indexes, calculates a signature intermediate value by performing point addition operation of an elliptic curve on the selected elements, and returns the signature intermediate value to the password terminal; The password terminal calculates a signature value based on the result value and the signature intermediate value, which is used to replace the random number and point multiplication result in the original signature algorithm and calculate the signature value.

2. The method of claim 1, wherein, The step of calculating a hash value to be signed by the password terminal based on the identifier information of the signer and the data to be signed includes: A first hash value is generated using the national standard SM3 hash algorithm based on the identifier information of the signer, the recommended parameters of the elliptic curve, and the public key of the signer; The first hash value is concatenated with the data to be signed, and a second hash value is generated using the national standard SM3 hash algorithm, and the second hash value is used as the hash value to be signed.

3. The method of claim 1, wherein, The auxiliary terminal processes in a multi-core and / or thread parallel manner, selects N repeatable elements from the public key combination factor table according to the first random number, and calculates the addition operation result of the N elements in parallel.

4. An encryption method based on elliptic curve signature, characterized by, The method is implemented based on a mobile terminal, including a client and a server, specifically including: The client generates a first random number, divides the first random number into a plurality of parts, selects corresponding elements from the private key combination factor table as indexes, calculates a first result value by performing finite field addition operation on the selected elements, and sends the first random number to the server; The server obtains the first random number, divides the first random number into a plurality of parts, selects corresponding elements from the public key combination factor table as indexes, calculates a first signature intermediate value by performing point addition operation of an elliptic curve on the selected elements, generates a second random number, and calculates a second signature intermediate value based on the second random number and the first signature intermediate result value; The server calculates a third signature intermediate value based on the hash value to be signed and the second signature intermediate value, and returns the third signature intermediate value to the client; The client calculates a signature value based on the third signature intermediate value and the first result value, which is used to replace the random number and point multiplication result in the original signature algorithm and calculate the signature value.

5. An encryption device based on elliptic curve signature, characterized by, The device includes at least two terminals, namely a password terminal and an auxiliary terminal: The initialization module in the password terminal can generate a plurality of non-repeated random numbers to form a private key combination factor table and store the table, calculate a corresponding public key combination factor table based on the private key combination factor table, and send the public key combination factor table to the auxiliary terminal; The preprocessing module in the password terminal can calculate a hash value to be signed based on the identifier information of the signer and the data to be signed; The private key calculation module in the password terminal can generate a first random number, divide the first random number into a plurality of parts, select corresponding elements from the private key combination factor table as indexes, calculate a result value by performing finite field addition operation on the selected elements, and send the first random number to the auxiliary terminal; The intermediate signature module in the auxiliary terminal can divide the first random number into a plurality of parts as indexes, select corresponding elements from the public key combination factor table, calculate an intermediate signature value by performing point addition operation of an elliptic curve on the selected elements, and return the intermediate signature value to the password terminal; The signature combination module in the password terminal can calculate a signature value based on the result value and the intermediate signature value, and replace the random number and the point multiplication result in the original signature algorithm to calculate the signature value.

6. The apparatus of claim 5, wherein, The preprocessing module comprises: The first hash element can generate a first hash value based on the identifier information of the signer, the elliptic curve recommendation parameter, and the signer public key using the SM3 hash algorithm of the national cryptography standard; The second hash element can cascade the first hash value with the data to be signed and generate a second hash value using the SM3 hash algorithm of the national cryptography standard, and use the second hash value as the hash value to be signed.

7. The apparatus of claim 5, wherein, The auxiliary terminal processes in a multi-process and / or thread parallel manner, selects N repeatable elements from the public key combination factor table according to the first random number, and calculates the addition operation results of the N elements in parallel.

8. An encryption device based on elliptic curve signature, characterized by, The device is implemented based on a mobile terminal and comprises a client and a server, specifically comprising: The client generates a first random number, divides the first random number into a plurality of parts, selects corresponding elements from the private key combination factor table as indexes, calculates a first result value by performing finite field addition operation on the selected elements, and sends the first random number to the server; The server obtains the first random number, divides the first random number into a plurality of parts, selects corresponding elements from the public key combination factor table as indexes, calculates a first intermediate signature value by performing point addition operation of an elliptic curve on the selected elements, generates a second random number, and calculates a second intermediate signature value based on the second random number and the first intermediate signature value; The server calculates a third intermediate signature value based on the hash value to be signed and the second intermediate signature value, and returns the third intermediate signature value to the client; The client calculates a signature value based on the third intermediate signature value and the first result value, and replaces the random number and the point multiplication result in the original signature algorithm to calculate the signature value.

9. A terminal comprising: Memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that the processor executes the computer program to implement the method of any one of claims 1 to 4.

10. A computer-readable storage medium storing computer-executable instructions for performing the method of any one of claims 1 to 4.

Images