Method, blockchain, product, and device for committing and opening a key

Abstract

Construct a commitment primitive to associate / bind the ID with the key, where the ID corresponds to the entity identity ID; Commitment phase: the secret ID is sk=g ID·A+不公开秘密·B The method is associated with the private key, where A·B is equal to G group order 1, and g is preferably the smallest primitive root. Verification phase: first remove the ID to obtain pk_ charller =(g ‑ID·A )*pk, and then use zero-knowledge proof technology to prove that there is a secret k that satisfies the equation pk_ charller =(g B ) k *G discloses two non-circuit-based zero-knowledge proofs. It discloses commitments / open commitments for the SM2 and secp256k1 algorithms, and discloses components related to the promisor P, prover P, and verifier V. Applications include commercial cryptographic products, digital certificate products, blockchain systems, devices, and programs. Advantages of this invention include binding, anonymity, decentralization, and compatibility / transparency.

Description

Technical Field

[0001] The present invention relates to the key generation and application field of public key cryptography, wherein the public key is based on discrete logarithm difficulty, and more specifically to a key commitment and open commitment method, a blockchain system, a national secret commercial cryptographic product, a digital certificate product, a device, a medium and a program, wherein the commitment object is an ID.

[0002] Background

[0003] 1. The Discrete Logarithm Problem (DLP) is one of the most fundamental cryptographic primitives. It is used to construct cryptographic primitives such as digital signatures, key exchange, public-key encryption, and commitments. Industry standards include the ECDSA elliptic curve family, the Curve25519 curve, the SM2 algorithm, the Schnorr signature algorithm, the ElGamal algorithm, Pedersen commitments, DH key exchange, CA certificates, and PKI systems. sk is generally used to represent a secret key or one-time key, and pk represents a public key.

[0004] 2. Key and identity ID association technology is an essential requirement in the industry. CA systems, PKI systems, SM9 algorithms, and CPK systems can all address the public key and identity ID association problem. A similar approach is the identity-based public key system. In 1984, Shamir proposed the identity-based public key cryptography (IBC) system, which realizes that the identity is the public key, greatly simplifying the distribution and management of public keys. The adoption of identity-based public key systems has become the development direction of public key cryptography. Currently, identity-based public key systems include SM9, CPK, CFL, and CLA.

[0005] 3. Commitment is an important cryptographic primitive. The first phase is the Commit phase, where the committer P selects a sensitive data ID, calculates the corresponding commitment c, and makes c public. The second phase is the Open-Verify phase, where the prover P presents the ID and proves the association between the ID and c. The challenger, the verifier V, receives c, the ID, and the associated content, and proves the association between the ID and c through calculation. The Open-Verify phase involves two participants: the prover P and the verifier V. A well-designed cryptographic commitment has the following characteristics:

[0006] 1) Hidding: Before opening the commitment, the verifier does not know the sensitive data ID selected by the promisor P, and even if he knows it, he cannot prove it.

[0007] 2) Binding: It is difficult for the promiser to interpret the promised sensitive data as another ID. Famous examples include Pedersen commitment and hash commitment.

[0008] 4. According to the Chinese standard guidelines, commercial cryptographic products based on the SM2 algorithm include at least USB smart password keys, digital certificate servers, signature verification servers, financial cryptographic machines, server cryptographic machines, cloud server cryptographic machines, timestamp servers, secure electronic signature systems, digital certificate authentication systems, IPSecVPN gateways, and SSLVPN gateways.

[0009] 5. The smart password key (usbkey) is a commercial cryptographic product that is both high-quality and affordable and can perform SM2 key generation, SM2 signature and signature verification functions. The relevant technical standards include GMT0016-2012 "Smart Password Key Password Application Interface Specification", GMT0017-2012 "Smart Password Key Password Application Interface Data Format Specification", GMT0027-2014

[0010] "Technical Specifications for Smart Password Keys".

[0011] 6. There are two commonly used techniques in the field of zero-knowledge proofs: 1. Fiat-Shamir transform, and 2. circuit-based zero-knowledge proof technology. The Fiat-Shamir transform is a technique that converts interactive zero-knowledge proofs into non-interactive zero-knowledge proofs. Its main feature is to replace the random oracle challenge value with a cryptographically secure hash output, where the hash input is one or more sets of commitment phase data. Circuit-based zero-knowledge proof technology can prove the existence of a secret x such that f(x) equals a specified value. Related technologies include the zk-snark algorithm and the Groth16 algorithm used in ZCash. Summary of the Invention

[0012] The inventors discovered that CA systems, PKI systems, the SM9 algorithm, and CPK key systems all require the support of a trusted authentication center. If the central authority cheats or is hijacked for malicious purposes, the entire key system and application will be insecure and untrustworthy. The same conclusion applies to public key identification systems.

[0013] ☆☆1 To overcome these shortcomings, the inventors proposed a new technology. The core idea behind this technology is to construct a commitment primitive to associate / bind IDs with keys. Specifically, during the key generation phase, a private key is defined as a function of the ID, and the commitment phase is used to verify that the ID is indeed associated with the key. This commitment primitive implements the function of associating an ID with a key. This association / binding inherently offers decentralized benefits and allows for self-management of keys. A typical application of this technology is that for sovereign declarative digital signatures, a CA certificate is not required for identity verification. For commitment-based digital signatures, a key can be generated and then filed with a CA or a blockchain system.

[0014] After research, the inventors also found that constructing the type of commitment primitive associated / bound with the key is a technical challenge. The following is the research result.

[0015] Publicly available hash-based signature schemes include LMS, HSS, XMSS, and XMSSMT. Designing a commitment scheme that associates an ID with a hash-based signature is easy to implement. For example, a hash commitment can be used to associate an identity ID at a specific location (such as the first leaf of a Merkel tree). When needed, presenting the hash preimage unlocks the ID commitment.

[0016] After research, the inventors discovered that, in order to achieve simple and efficient zero-knowledge proofs for DLP-type keys, circuit-based zero-knowledge proofs are not recommended for the open commitment phase. For example, in a 1-bit commitment method where ID equals the lowest bit of sk, the inventors have yet to find a non-circuit-based zero-knowledge proof for the open commitment method. Therefore, constructing a non-circuit-based zero-knowledge proof for DLP-type key commitments is a technical challenge. Referring to the background art, I would like to further state the following: the disadvantages of circuit-based zero-knowledge proofs are that they are neither simple nor efficient, and industrial applications require more complex theoretical knowledge and runtime library functions than DLP.

[0017] In order to make the open commitment phase able to prove the ID-associated key without revealing other non-secret information, a 1-bit commitment / open commitment scheme is designed on the elliptic curve group based on the square remainder property. The commitment scheme is then generalized to sk=g ID*A+不公开秘密*B , it is clear that the ID value range is the range modulo B, A*B=N-1, g is the preferred smallest primitive root, and N is the group order of the discrete logarithm G. Here, the 1-bit commitment based on the square remainder property is equivalent to the special case of B being 2.

[0018] In summary, the technical problem of the present invention is to construct a commitment primitive to associate / bind an ID with a key, where the key is a DLP-type key. This technical problem is also the purpose of the invention. Because the present invention does not require the trusted central authority of the background art, the technical problem / purpose of the invention possesses inventiveness.

[0019] ☆☆3 Summary of the invention is briefly described as follows:

[0020] Commitment stage: sk = g ID*A+不公开秘密*B Where g is preferably the smallest primitive root of N-1, where N is the order of the discrete logarithm group G, and A = (N-1) / B;

[0021] Open commitment phase: After removing the ID factor, use zero-knowledge proof technology to prove that there is a "private secret" that satisfies g -A·ID *PK=g 不公开秘密·B *G, where the public key PK = sk*G; a non-circuit type zero-knowledge proof is preferred.

[0022] For ease of understanding, the commitment phase is considered as a function transformation that generates a private key, with input {ID, B} and output {sk, a private secret}. The function transformation implicitly contains a pure random number generation module; the meaning of sk is self-evident. The committer P transmits the "private secret" to the prover P for use in opening the commitment phase.

[0023] Reading Guide: The text with the prefix ☆☆ in this description is the highest level summary. The prefix ☆ and the serial number guide the content of the invention.

[0024] First, we will explain the 1-bit commitment and open commitment schemes based on the properties of square residues, and then generalize them to the case where A = (N-1) / B. As a prerequisite, we will review elementary number theory and knowledge related to square residues. 1) The product and inverse of square residues are both square residues. The product of two non-square residues is a square residue, and a square residue multiplied by a non-square residue is a non-square residue. 2) The necessary and sufficient condition for the square residue of an element a is a (n-1) / 2 = 1modN (Euler's theorem), where N is the group order of the elliptic curve.

[0025] Commitment phase: If the ID is 0, the committer P randomly selects a squared remainder as sk; if the ID is 1, the committer P randomly selects a non-squared remainder as sk. The public key pk = sk*G, where G can be implemented using the SM2 algorithm or the secp256k1 algorithm elliptic curve generator. Open commitment consists of four phases: commitment, challenge, response, and verification. The basic idea is to remove the ID information from PK to obtain pk_charller. To prove that pk_charller is equal to a squared remainder * G, the commitment phase randomly selects a squared remainder element and generates a temp from it. The challenger has two paths to calculate temp: one from G to temp and one from pk_charller to temp. Therefore, in each round, the challenger has a 1 / 2 probability of discovering that the prover cheated in the commitment phase.

[0026] 1bit Commitment and Open Commitment Scheme:

[0027] Preparatory work, declare the ID, so the method to remove the ID is,

[0028] pk_charlle = 1 given non-square residual ID *pk;

[0029] Commitment phase: (Prover P)

[0030] Randomly select a squared residual element Xr, calculate temp and send it to the verifier V, where temp = Xr * pk_charller;

[0031] Challenge Phase: (Verifier V)

[0032] Randomly select 0 or 1 as the challenge value;

[0033] Response phase: (Prover P)

[0034] Challenge 0, reveal Xr;

[0035] Challenge 1, reveal (Xr·sk·1 given non-square residue ID );

[0036] Verification phase: (Verifier V)

[0037] If 0, verify that temp = Xr*pk_charller and xr is the square residue;

[0038] If 1, verify temp = (Xr·sk·1 given non-square residual ID )*G and (Xr·sk·1 given non-square residue ID ) is the square remainder.

[0039] The ID can be associated with more factors of the N-1 decomposition. The above-mentioned solution based on the squared residual bit is only a special case where B equals 2. Furthermore, the coprime factors of B decomposition are {B1, B2, ..., Bx}, and the corresponding ID is divided into segments {ID1, ID2, ..., IDx}, where the value of IDi ranges from 0 to x modulo Bi. In the explanation of terminology in the specific implementation section, the inventors will demonstrate that {B1, B2, ..., Bx} is a generalization of B, and the basic principles are exactly the same.

[0040] sk=g ID1·A1+ID2·A2…+IDx·Ax+不公开秘密·B ,

[0041] in

[0042] B=B1·B2·…·Bx, {B1,B2,……,Bx} are relatively prime.

[0043] ☆1 Publicly disclose a method for committing to a key, applicable to the public key pk = sk * G, where sk is the key and G is the discrete logarithm generator; the ID association method is set in the following way

[0044] sk=g ID·A+不公开秘密·B

[0045] Or use the following method to set the {ID1, ID2, ..., IDx} association method

[0046] sk=g ID1·A1+ID2·A2…+IDx·Ax+不公开秘密·B

[0047] Where B is a factor of N-1, A = (N-1) / B, N is the group order of G, and g is the smallest primitive root or the root of N.

[0048] Specify a primitive root before;

[0049] ID / {…IDi…} is the content to be committed, the most typical content is identity information;

[0050] {B1, B2, ..., Bx} is a decomposition of B and is relatively prime to each other, and each Ai satisfies Ai = (N-1) / Bi.

[0051] A statement of opinion regarding the preferred choice of A and B being coprime. A coprime equivalent ID has no correlation with "secrets," effectively guaranteeing that the ID will not reveal "secrets." When A and B have a common factor, the inventor believes that some information about the "secret" may be revealed; this question cannot be proven or disproven at this time. In short, it is best to choose A and B coprime, or to have a sufficiently small common factor between A and B.

[0052] The reason why g is preferably the smallest primitive root on N can be found in the terminology explanation in the specific implementation section; specifying a primitive root in advance requires a pre-operation, so it is not preferred.

[0053] In addition, the valid information of the ID is in the sense of modulus B. If B is too large, the security of the public key will be reduced.

[0054] ☆2 For the SM2 algorithm commitment method, the discrete logarithm generator G is a generator based on the SM2 algorithm. The commitment secret is ID, sk = 3 ID·A+不公开秘密·B , where B = 924875007631011282; statement 3 is the smallest primitive root.

[0055] ☆3 Commitment method for SM2 algorithm, the discrete logarithm generator G is a generator based on SM2 algorithm, and the committed secret is {ID1, ID2, ID3, ID4}, characterized in that sk=3 ID1·A1+ID2·A2+ID3·A3+ID4·A4+不公开秘密·B , where {B1, B2, B3, B4} = {14057, 7759, 3, 140571413296869}.

[0056] The 18-digit ID number 370202200511141820 is divided into {3702,2005,0,1114_1820__02} according to the four-digit place of origin, year of birth, gender, and other codes. Therefore, ID = 370202200511141820, {ID1, ID2, ID3, ID4} = {3702,2005,0,1114182002}. In Examples 1 and 2, test vectors and open commitment test vectors will be provided.

[0057] ☆4 For the commitment method of secp256k1 algorithm, the discrete logarithm generator G is a generator based on the secp256k1 algorithm, and the secret to be committed is ID, sk=7 ID·A+不公开秘密·B , statement 7 is the smallest primitive root.

[0058] ☆5 The protocol for opening the commitment ID or {…IDi…} is as follows:

[0059] Step 1: Verifier P declares ID or {…IDi…};

[0060] Step 2: Calculate pk_ charller , where pk_ charller =(g -A·ID )*PK or pk_ charller =

[0061] (…·(g -A1·IDi )·)*PK,pk_ charller The essence is to remove the ID or {…IDi…} information;

[0062] Step 3: The verifier P uses an interactive zero-knowledge proof or a non-interactive zero-knowledge proof to prove to the verifier V / the public that there exists a secret k that satisfies the equation pk_ charller =(g B ) k *G.

[0063] The connection between interactive and non-interactive zero-knowledge proofs is the Fiat-Shamir transform. The Fiat-Shamir transform is a commonly used technique. The consensus in scientific literature and textbooks is that a zero-knowledge proof protocol only requires an interactive protocol, while non-interactive zero-knowledge proofs are naturally derived from the Fiat-Shamir transform.

[0064] ☆☆4 In summary, the concept of the present invention is to construct a commitment primitive to implement the key of the ID association / binding discrete logarithm problem, specifically sk=g ID·A+不公开秘密·B , where ID needs to be associated / bound with information, A=(N-1) / B, and g is preferably the smallest primitive root; in the commitment phase, the prover P uses zero-knowledge proof technology to prove to the verifier V / the public that there is a "private secret" that satisfies g -A·ID *PK=g 不公开秘密·B *G.

[0065] The following is a preferred non-circuit type open commitment scheme. The prover P discloses (g B ) (r+不公开秘密) *G, the verifier V randomly selects one of the computation paths r or (r+undisclosed secret); the equivalence principle of the two paths is, (g B ) r *(g -A·ID*PK)=(g B ) (r+不公开秘密) *G.

[0066] The main effect of the preferred open commitment method is that the circuit-type zero-knowledge proof is not a background technology. The only zero-knowledge proof operations implemented are discrete logarithm library functions and large integer library functions. Specifically, an OpenSSL library is sufficient to support the large integer operations and PK=sk*G operations required by the present invention.

[0067] Specifically, for sk=g ID1·A1+ID2·A2…+IDx·Ax+不公开秘密·B For type commitments, you can disclose all or select information during the open commitment phase. For example, in the above example 2, the commitment {3702,2005,0,1114_1820__02} only discloses the year of birth and gender, and the following operations are performed during the commitment phase:

[0068] sk=3 2005·A2+0·A3+不公开秘密2·(B2·B3) , here B=B2·B3, that is 7759·3.

[0069] Based on the above analysis, ID and {…, IDx} commitment corresponding to the open commitment phase are all used with pk_ charller =(g B ) k *G, as stated in the explanation of terms in the detailed description.

[0070] ☆6 The first non-circuit type zero-knowledge proof (hereinafter referred to as temp type zero-knowledge proof) is recommended:

[0071] Commitment phase: (Prover P) randomly selects r, calculates temp and sends it to the verifier V,

[0072] Where temp=(g B ) (不公开秘密+r) *G;

[0073] Challenge phase: (Verifier V) randomly selects 0 or 1 as the challenge value and sends it to the prover;

[0074] Response phase: (Prover P)

[0075] If the challenge value is 0, reveal rmodA;

[0076] If the challenge value is 1, reveal (unrevealed secret + r) mod A;

[0077] Verification phase: (Verifier V)

[0078] If the challenge value is 0, verify temp=(g B ) r *pk_charller;

[0079] If the challenge value is 1, verify temp=(g B ) (不公开秘密+r) *G.

[0080] ☆8 I recommend a similar second non-circuit zero-knowledge proof:

[0081] Commitment phase: (Prover P) randomly selects w0, calculates w1 = private secret - w0 mod A, calculates Y0 and Y1 and sends them to the verifier V; where Y0 = (g B ) w0 *G,Y1=(g B ) w1 *G;

[0082] Challenge phase: (Verifier V) randomly selects 0 or 1 as the challenge value and sends it to the prover P;

[0083] Response phase: (Prover P)

[0084] If the challenge value is 0, reveal w0;

[0085] If the challenge value is 1, reveal w1;

[0086] Verification phase: (Verifier V)

[0087] If the challenge value is 0, verify (g B ) w0 *Y1=pk_charller and satisfy Y0=(g B ) w0 *G;

[0088] If the challenge value is 1, verify (g B ) w1 *Y0=pk_charller and satisfy Y1=(g B ) w1 *G.

[0089] The above two zero-knowledge proofs have the same principles and effects. Because they are both 2-choose-1 challenges, the probability of the verifier cheating in each round is 1 / 2. Based on background knowledge, industrial applications require multiple rounds of operations.

[0090] Because the temp type requires less data than the {Y0, Y1} type during the commitment phase, the inventors recommend the temp type zero-knowledge proof. The detailed implementation details provide the results of the SM2 algorithm. A non-interactive zero-knowledge proof method for the commitment phase is disclosed. Inputs include the ID and PK, a cryptographically secure hash is selected, and the data is grouped into x groups.

[0091] ☆7 Perform Fiat-Shamir transformation on the temp-type zero-knowledge proof protocol to obtain a non-commutative zero-knowledge proof protocol; the specific steps include:

[0092] The input includes ID and PK, select a cryptographically secure hash, and group the data into x groups. It should be noted that the reference industry standards for cryptographically secure hashes include SHA2, SM3, SHA3, etc.

[0093] Prover P: Input "undisclosed secret", construct and output: {X, Y};

[0094] Step P001: where z is the number of elements, i ranges from 0 to z-1;

[0095] X={…,(g B ) (不公开秘密+ri) ,…},ri is a pure random number;

[0096] Step P002: hash(X) indicates to choose 1 from 2;

[0097] Y = {…, hash(x)[i] == 0? ri: (undisclosed secret + ri), …};

[0098] Step P003: Output: {X, Y};

[0099] Verifier V: Input: {X, Y}, Output: Pass / Fail;

[0100] Step V002: Calculate hash(X);

[0101] Step V003: i ranges from 0 to z-1, and each i verifies the following relationship:

[0102] X[i] is (g B ) (不公开秘密+ri) Is Hash(X)[i]==0? (g B ) ri *pk_charller:(g B ) (ri+不公开秘密)

[0103] *G;

[0104] Output pass / fail; where the pass criterion is that the equation is true for each i.

[0105] ☆☆5 Because the association / binding of IDs and keys is based on the commitment primitive, binding and concealment are inherent properties. Furthermore, because the commitment content is simply the public key pk itself, decentralization and compatibility / transparency with the original key system are easily derived. Another explanation for the unique binding property is that {sk, pk} is categorized by ID, which is equivalent to decomposing the key space into ID classes. Therefore, no centralized authority or endorsement is required. The advantages of the invention are summarized below.

[0106] 1. Hidding: Even if the challenger obtains the ID, the challenger cannot prove that {sk, pk} is associated with the ID;

[0107] 2. Binding: ID is uniquely bound to {sk, pk}, which will be proved by contradiction later.

[0108] 3. Decentralized Property: Compared to background standards such as SM9 and CPK, this technology does not require endorsement from a central authority. The detailed description of decentralization and weak centralization in Example 6 supports this point. This property can be derived from binding. PKs ​​are naturally classified by ID, so there is no need for a central authority to endorse the association / binding of IDs and keys.

[0109] 4. Transparency / Compatibility with Public Key Systems: Transparency / Compatibility means that after upgrading the commitment / opening the commitment function of the present invention, the digital certificate format and original application scenarios remain unchanged.

[0110] This effect is achieved primarily for two reasons: 1. The output information during the commitment phase is simply the public key PK itself; 2. In engineering implementation, there's no correlation between opening the commitment and key application. That is, opening the commitment can prove ID association / binding to the key, but it doesn't affect the key's original purpose or the associated modules. In Example 5 of the present invention, the smart cryptographic key upgraded by the committed component and the open-commitment component can demonstrate transparency and compatibility.

[0111] The commitment primitives of 5, ☆6 and ☆7 can prove that there exists a non-circuit type zero-knowledge proof scheme.

[0112] Prove unique binding using the inverse method:

[0113] If there exists a different ID' and a secret' that also satisfies sk=g ID’·A+不公开秘密’·B .

[0114] Then ID'·A+private secret'·B=ID·A+private secret·BmodA·B holds true.

[0115] Therefore, A*(ID'-ID)-B(private secret'-private secret)=0modA·B, which means there exists t that satisfies the following equation

[0116] A·(ID′-ID)+B·t=0.

[0117] Known theorem: The necessary and sufficient condition for A and B to be coprime is that u and v exist such that A·u+B·v=1.

[0118] It contradicts the known theorem; therefore, the assumption is wrong and the proposition is proved.

[0119] The commitment and open commitment protocols of the present invention involve two stages and three roles, wherein the three roles are respectively the committer P, the prover P, and the verifier V. In order to support the three roles to complete their cryptographic functions, three corresponding components are defined. According to the previous description, the commitment component corresponding to the committer P must be integrated with the key generation unit module, and the (corresponding to the prover P) open commitment component and the (corresponding to the verifier V) verify commitment component respectively implement the cryptographic functions of the prover P and the verifier V. There are two points to note: 1. The open commitment component and the verify commitment component are only used at the moment of required disclosure; 2. Taking into account the "non-disclosure secret" factor, the commitment component and the open commitment component must work in a trusted execution environment (TEE), while the verify commitment component can work in a development environment (open). The following is a demonstration of the two components.

[0120] ☆81 Open commitment component for temp type commitment,

[0121] Input "undisclosed secret" and z; output {X, Y};

[0122] Where X={…,(g B ) (不公开秘密+ri) , ...}, i ranges from 0 to z-1,

[0123] Y = {…, hash(X)[i] == 0? ri: (undisclosed secret + ri), …}, where i ranges from 0 to z-1.

[0124] ☆91 verification component for temp type commitment,

[0125] Input {X, Y}; Output pass / fail;

[0126] Is X[i] equal to Hash(X)[i]==0? (g B ) ri *pk_charller:(g B ) (ri+不公开秘密) *G;

[0127] The passing criterion is that the equation holds for every i.

[0128] It should be noted that when the verification component works in the interactive zero-knowledge proof state, Hash(X)[i] is regarded as the i-th round challenge value given by the verifier V.

[0129] ☆9 discloses a blockchain system that uses a digital signature protocol or a Pedersen commitment protocol. Specifically, the key of the digital signature or the Pedersen commitment is generated by the key commitment method described in any one of ☆1-☆4, wherein the key holder is a miner or user of the blockchain system.

[0130] Technical Solution Effect: In blockchain systems, digital signature primitives or Pedersen commitment primitives are widely used by miners and / or users. As previously discussed, the association / binding of IDs and keys can be achieved through the commitment primitives of this invention, thus making the keys and their applications decentralized. Further details are provided in Example 8, "Research on Decentralized and Weakly Centralized Application Scenarios." When necessary, miners or users can use the open commitment primitive to prove key binding / association with an ID or {…IDi…}. Furthermore, a new benefit of this blockchain system is that, when necessary, national regulatory authorities can require miners or users to provide evidence of the association between keys and IDs. Therefore, this blockchain system possesses both decentralization and the ability to be regulated by the state.

[0131] ☆11 discloses a smart cryptographic key that complies with the SM2 algorithm standard. In addition to the key generation module, it also includes a commitment primitive module and an open commitment primitive module. Among them, the commitment primitive module corresponds to the role of the committer P in ☆2-☆3, and the open commitment primitive module corresponds to the role of the prover P in ☆5-☆8; the calling relationship of the commitment primitive module is that the key generation module calls the commitment primitive module.

[0132] The detailed design and implementation of the smart password key are described in the accompanying drawings and specific embodiments of the specification. It should be noted that the smart password key is a private key / public key generation module by default, and the typical industry standard interfaces are GenECCKeyPair and ECCExportSessionKey. The commitment and open commitment methods and role corresponding components of the present invention are also applicable to the processing of one-time keys. Typical examples of one-time keys are the DH algorithm and the random number of the digital signature. There are many commercial cryptographic products and applications that comply with the SM2 algorithm. According to the use of the SM2 algorithm as the standard, there are many SM2-related commercial cryptographic products and commercial cryptographic services based on the smart password key, which will be extended to a wider range of commercial cryptographic products below.

[0133] ☆10 Disclosed is a commercial cryptographic product that complies with the SM2 algorithm standard. The product includes a smart cryptographic key, a digital certificate server, a signature verification server, a financial cryptographic machine, a server cryptographic machine, a cloud server cryptographic machine, a timestamp server, a secure electronic signature system, a digital certificate authentication system, an IPSecVPN gateway, an SSLVPN gateway, a blockchain block writing device, or a blockchain block verification device; the product includes at least one component that can implement the role function of the cryptographic protocol.

[0134] The cryptographic protocol roles include: a committer P who uses the key commitment method described in ☆2-☆3 to make a commitment, or a prover P or a verifier V who uses any one of the verification commitment methods described in ☆5-☆8 to verify.

[0135] The following is the background technology: Digital certificates are the most important products / services of CA organizations and PKI systems. Taking the X509 certificate as an example to illustrate the principle of digital certificates, the CA organization uses a digital signature to endorse the TBSCertificate structure (the part of the certificate to be signed, To Be Signed Certificate). The core function is to confirm the association between the "signee name (subject Name)" and "signee public key (subjectPublicKeyInfo)" of the TBSCertificate structure. In addition, the CA structure must confirm the entity identity of the "signee name" before digital signing.

[0136] If the user ID is associated with the subjectPublicKeyInfo through the commitment primitive, the following two effects will occur. Here, it is considered that ID = "subject Name". 1) Because subjectPublicKeyInfo is the function output of ID, the ID can first construct and use the key, and then file the subjectPublicKeyInfo with the CA organization; of course, the CA organization needs to confirm the entity identity of the ID and the binding between the ID and the subjectPublicKeyInfo. 2) The subjectPublicKeyInfo of the TBSCertificate structure does not necessarily record the ID, and in theory it can be NULL. Because open commitment (Open-Verify) can prove that the ID is associated / bound to the subjectPublicKeyInfo. Example 7. "X509 certificate based on commitment primitive" and the accompanying drawings are described in more detail.

[0137] In summary, ☆12 discloses a digital certificate product with a public key type of PK = sk*G, where G is a discrete logarithm generator and sk is generated using the methods of ☆1-☆4. The entity identity corresponding to ID / {…IDi…} is equal to or related to the "subject Name" information.

[0138] ☆13 discloses a device including an input unit, an output unit, and a processing unit. The processing unit includes at least one component capable of implementing the function of a cryptographic protocol role, and the role is one of the following: the committer P corresponding to ☆1-☆4, and the prover P or verifier V corresponding to ☆5-☆8.

[0139] ☆14 discloses a medium on which data is stored. The information after the encoding is removed includes one of the following two types of data: 1) a private key sk or a public key PK, where sk is generated by the method of ☆1-☆4; 2) interactive data for opening the zero-knowledge proof in the commitment phase, wherein the interactive data is generated and used by the prover P or verifier V corresponding to ☆5-☆8.

[0140] The device forms of the media include electronic media, paper media, and cloud evidence media. There are also many demonstrations of eliminated codes. Please see the specific implementation method section for more details.

[0141] ☆15 A computer program product, comprising a computer program / instruction, characterized in that when the program / instruction is executed, the execution steps corresponding to the cryptographic protocol role of the present invention are implemented, and the cryptographic protocol role is one of the following situations: ☆1-☆4 corresponding to the committer P, ☆5-☆8 corresponding to the prover P or verifier V. BRIEF DESCRIPTION OF THE DRAWINGS

[0142] The embodiments and drawings are used to explain the present invention and do not constitute an undue limitation of the present invention. In the drawings:

[0143] Figure 1 This is the commitment / open commitment principle diagram of Example 1;

[0144] Figure 2 are three components of the present invention and associated schematic diagrams;

[0145] Figure 3 Hardware structure diagram of the smart password key that enables the commitment component and the open commitment component;

[0146] Figure 4 Algorithm standards and industrial ecology associated with this invention;

[0147] Figure 5 For example X509 certificate DETAILED DESCRIPTION

[0148] In order to guide readers to read the specific implementation methods faster and better, the index of key contents is organized as follows.

[0149] Example 1. Commitment and opening commitment for SM2 algorithm ID card number;

[0150] Example 2. Commitment and opening of commitment for SM2 algorithm {native place, year of birth, gender, other codes};

[0151] Example 3. Commitment scheme for secp256k1 algorithm digital signature;

[0152] Example 4. Commitment and open commitment design of module p domain;

[0153] Example 5. A committed component and a smart password key for opening an upgrade of the committed component;

[0154] Implementation method 6. Figure 4 Regarding commercial secret products and industrial ecology;

[0155] Example 7. X509 certificate based on commitment primitive;

[0156] Example 8. Research on decentralized and weakly centralized application scenarios.

[0157] In order to describe the inventive concept and technical solution, two terms are first defined.

[0158] ID or {ID1, ID2, ..., IDx}

[0159] The essential technical features of the commitment / opening commitment phase are: In a narrow sense, ID refers to identity ID; in a broad sense, ID refers to the information bound to the content being committed. This broad definition includes identification card numbers, IMSI numbers, phone numbers, vehicle license plates, business registration numbers, and unified social credit codes for enterprises. More broadly, in Example 3, the secp256k1 signature algorithm combined with the commitment method of the present invention is used to store 125.14 bits of information as a commitment on Bitcoin; therefore, depending on the scenario, the interpretation of ID should not be limited to identity ID.

[0160] Because ID1·A1+ID2·A2…+IDx·Ax+Secret2'·B2'=ID·A+SecretBmodN-1, {ID1, ID2,…,IDx} can be considered a generalization and equivalent of ID-type commitments. The above equation is taken from the definition of commitments. Using a technique similar to Sun Tzu's theorem, we can calculate ID and Secret2 from the inputs (ID·A+Secret·B) and B. Therefore, we can obtain the following two conclusions.

[0161] When B2=B, the relationship between {ID1,ID2,……,IDx} and ID is as follows:

[0162] ID=A modB -1 modA·(ID1·A1+ID2·A2…+IDx·Ax)modB,

[0163] in A modB -1 is the multiplicative inverse of A over the ring modular B.

[0164] When {ID1, ID2, ..., IDx} are selectively disclosed, the undisclosed secret 2' can be inferred from B2'. B2 is the product of Bi corresponding to the selective disclosure. For example, if only ID1 and ID2 are disclosed, then B2' = B1 * B2;

[0165]

[0166] Among them B2 -1 It is a model Multiplicative inverse of B2 over the ring;

[0167] If all ID1, ..., IDx are disclosed, then B2'=B1*B2...*Bx=B; the above formula degenerates to;

[0168]

[0169] The above two sets of expressions are mainly used for conversion of commitment components, and are exemplified and applied in Examples 2 and 5. It can be considered that {ID1, ID2, ..., IDx} is a generalization and equivalent of ID commitment.

[0170] Minimum primitive root g

[0171] Necessary technical features in the commitment stage refer to sk=g ID·A+不公开秘密·B , g is the smallest primitive root on the domain modulo N. State the reasons for the preference. The essence of the invention promised: the entropy space of sk ranges from 1 to N-1, s t It is just one-to-one mapping with the entropy space of sk, where S is the primitive root on the modulo N field; according to the coprime A and B, it is decomposed into the residual system (ID, a secret that is not disclosed), so (s A ) ID ·(s B ) 不公开的秘密 1 to 1 mappings t A more general one-to-one mapping is that sk corresponds to the ID power of a specified B-order element multiplied by the undisclosed secret power of a specified A-order element. g A is a B-order element, g B For an A-order element, g will omit the specified steps if the smallest primitive root is preferred. Therefore, the smallest primitive root is the recommended preferred solution.

[0172] In addition, the execution of zero-knowledge proof must involve multiple rounds of interaction, including the commitment phase, the challenge phase, the response phase, and the verification phase. (g B )-th power represents the exponential space modulo A, which saves space compared to directly recording an A-order element. From the perspective of space saving, the exponential representation is recommended.

[0173] Example 1. Commitment and opening commitment for SM2 algorithm ID card number

[0174] To better understand the principles and key steps of this embodiment, please refer to the attached Figure 1 and attached Figure 2 The attached Figure 1 Describe the commitment phase and the steps involved in opening the commitment phase of the SM2 algorithm. Figure 2 Describe the specific details of the three components that implement the promiser P, prover P, and verifier V.

[0175] 0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123 is the group order N of the SM2 elliptic curve. The prime factors of N-1 are 2, 3, 7759, 14057, 1413296869, 125197554539772723432468576818475380947471091418362477724521.

[0176] Considering the 18 digits of the Chinese ID number, we take B = 924875007631011282 (2 3 7759 14057 1413296869), A = (N-1) / B;

[0177] Use a large integer calculator to determine that 3 is the smallest primitive root on the modulo N field;

[0178] The method of binding the ID number to the SM2 public key is as follows:

[0179] sk=3 身份证号ID·A+不公开秘密·B modN.

[0180] Test vector:

[0181] The ID number is 370202200511141820 (the ending x is treated as 0),

[0182] The "undisclosed secret" is 12; by introducing the OpenSSL large integer library and elliptic curve library, we get:

[0183] sk=0x6E7428A952D906CACA345C9FCDF12BD899058E486A0B6C06D4DE55FDFDD5D451pk=sk* G={Gx,GY}=0x6A60CC77A4CAB8B1DE67DF68C86A81DFF71883DF8C488A160C3417E3B1615BDA

[0184] 0x26FB3A3A66863F4C6AC09C69636E2F0BDA9F54ADC9B97A7F65AAC331F01134AC.

[0185] Open the preparatory stage of commitment: remove (g -A ) ID *PK gets pk_charller as follows:

[0186] 0x90A345619CDD942ED18F2D268593A15A1BFF236AD3DCA4696F5C0B0FD6B2E1B8

[0187] 0x4FE2FCC6A3EF4E706DEC99FBCCAE68D11473C53A6D6EBB27A9B4DE523F1625E6

[0188] in (g -A ) ID 65039367220346850763326696703480445449321897656048293178767360130174932601406

[0189] (g B ) (r+不公开秘密) Operational steps and test vectors for the Open-Commit phase:

[0190] Verification phase: prover p: selects a random number r,

[0191] Here, we take r = 76 MODA, then (r + undisclosed secret) = 88 MODA;

[0192] Calculate and publish temp, where temp = (3 B ) (r+不公开秘密) *G Temp={Gx,Gy}=

[0193] {0xA87EEB15577ADD3222E246E37ED5B3C3BD740C2E85B5E4BD6F1E9789455949B6

[0194] 0xF4C4E5672D95238CFA5DCB93975E4C2828E5443361744C163ED3E5B868FED727}

[0195] Challenge phase: Verifier V: selects a challenge value of 0 or 1 and sends it to prover p;

[0196] Response phase: Prover p:

[0197] Challenge value 0 reveals 76

[0198] Challenge value 1 reveals 88

[0199] Verification phase: Verifier V:

[0200] Challenge value 0 verification (3 B ) r *pk_charler?=Temp

[0201] Challenge value 1 verification (3 B ) r *G? =Temp

[0202] Intermediate results of test vectors: (3 B ) 76 and (3 B ) 88 They are,

[0203] 39690810969377621653679713924826377779630123217826521254791976836989239444417 and 91017565000410237174138909841537965593049911956824357868921504966555989310476.

[0204] Example 2. Commitment and opening commitment for SM2 algorithm {native place, year of birth, gender, other codes}

[0205] The way to define commitment is, sk=3 ID1·A1+ID2·A2+ID3·A3+ID4·A4+不公开秘密·B ,

[0206] Where {B1, B2, B3, B4} = {14057, 7759, 3, 1413296869},

[0207] Here B is B1·B2·B3·B4, that is, 462437503815505641.

[0208] The 18-digit ID number 370202200511141820 (the ending x is treated as 0) corresponds to the code {3702,2005,0,1114_1820_02};

[0209] For the "secret" test vector, select 12;

[0210] Substituting into the formula we get:

[0211] sk=3 3702·A1+2005·A2+0·A3+1114182002·A4+12·462437503815505641

[0212] =3 35909742114646898062611115081933716055166385948449039631443914438078484108928

[0213] According to the term interpretation, input B to find the equivalent ID:

[0214] Equivalent ID = 143412314428390458;

[0215] Reference result Sk=3 143412314428390458*A+12*B .

[0216] Open Commitment 1: Selective Disclosure {*,2005,0,*}; where 2005 is associated with 7759, and 0 is associated with 3, what is the equivalent equation?

[0217] B2=7759·3, so the equivalent equation is:

[0218] sk=3 6015·A2+257247753062340172322707857704629916232089679233711874743147690446573394·B2 , where B2=23277.

[0219] Open Commitment 2: Selective Disclosure {3702, 2005, 0, *}; 2005 is associated with 7759, 0 is associated with 3, and 3702 is associated with 14057. What is the equivalent equation?

[0220] B2=14057·7759·3, so the equivalent equation is:

[0221] sk=3 170724309·A2+278985723925256323237960301443399381063531994947272249985591384104512·B2 , where B2=327204789.

[0222] Open Commitment 3: Full disclosure {3702, 2005, 0, 1114_1820_02}; among them, 2005 is associated with 7759, 0 is associated with 3, 3702 is associated with 14057, and 1114_182002 is associated with 1413296869. What is the equivalent equation?

[0223] So the equivalent equation is: sk=3 143412314428390458·A2+12·B2, where B2=462437503815505641.

[0224] Example 3. Commitment scheme for secp256k1 algorithm digital signature

[0225] 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD03641 is the 256k1 curve group. Decomposing the factors of N-1 yields 2, 2, 2, 2, 2, 2, 3, 149, 631, 107361793816595537, 174723607534414371449, 34*…*189. In order to cover the 18-digit ID card, it is recommended to choose B.

[0226] B=107361793816595537·64=2 62.57 ; After testing, 7 is the smallest primitive root.

[0227] Commitment method, private key sk or one-time key r equals 7 ID*A+不公开秘密 * B modN.

[0228] If both the key and the one-time key used for digital signature are set to B, then the key and digital signature can commit a total of 125.14 bits of information.

[0229] In this invention, if B is too large, the security of the original discrete logarithm will be reduced. Therefore, it is recommended that A be no less than 2 for elliptic curve cryptography. 192 .

[0230] Example 4. Commitment and open commitment design of module p domain

[0231] Discrete logarithms over the modulo p field are widely used in industry, such as the 768-bit and 1024-bit prime numbers in the RFC 2409 document, and the 1536-bit, 2048-bit, 3072-bit, 4096-bit, 6144-bit, and 8192-bit prime numbers in the RFC 3526 document.

[0232] The method for committing to discrete logarithms over a field modulo p is to commit to the q-order group of the largest prime factor of p-1. Specifically, the (p-1) / q power of PK is exactly a q-order group. Similar to ID binding, the effect of the (p-1) / q power must be agreed upon.

[0233] p is 2^1024-2^960-1+2^64*{[2^894pi]+129093}, which is the 1024-bit prime number specified in the RFC 2409 document. Using the publicly available large number factorization software yafu.exe, we decompose p-1 to get 2*q. We then decompose q-1 to get some of the prime factors: 2, 101119, 16184417, and 688868423471.

[0234] To cover the 18-digit ID number, select B = 16184417 * 688868423471 = 11148933823587251407;

[0235] By elimination, the smallest primitive root of the q-domain is 3.

[0236] The one-time key PK of the DH algorithm, let PK = 2 sk1*2+sk2*q modp, here to 2 is the provisions of rfc2409; the method of associating ID sk1 on the modulo q order group is: sk1 = 3 ID*A+不公开秘密*B modq.

[0237] According to the congruence residue system, the secret is divided into two parts of information, modulo 2 and modulo q. The above agreement 2 is the same as the terminology interpretation of the present invention, in which g is the smallest primitive root. There must be an equivalent method here with the same effect. In essence, they are all associated with a factor of q-1 through mathematical mapping ID.

[0238] Example 5. Committed component and smart password key for opening committed component upgrade

[0239] The background technology of the smart password electronic key (USBKEY) is a widely used and low-cost TEE (Trusted Execution Environment) device. This embodiment will guide manufacturers or R&D personnel to embed the commitment component and the verification component of the opening commitment phase of the present invention into the smart password key of the SM2 algorithm to complete the functions of the promiser P and the prover P. Figure 3 The solid black box within the USBKEY block diagram represents background technology. Its primary function is to generate private and public keys through GenECCKeyPair (generating an ECC signature key pair) and ECCExportSessionKey (generating and exporting an ECC session key). The key principle is that the random number module generates a pure random number into sk, which is then used by the sk*G module to generate PK. PK can be exported and called by the SM2 signature verification module. In theory, the private key sk cannot be exported from the USBKEY and can only be called internally by the SM2 signature module, reflecting the nature of the TEE. The specific standard is GM / T0017-2012, "Intelligent Password Key Cryptographic Application Interface Data Format Specification."

[0240] Attachment Figure 3The red dotted line part and the purple dotted line part are the commitment component and the open commitment component respectively. The entity implementation is equivalent to adding several registers and 4 function modules. Figure 2 The three-component diagram shows the basic principles of the three components and the collaborative relationship between the three components. Figure 3 The verification component is not included. For implementation, the recommended form of an executable program plus a computer is recommended. Because the verification component does not contain confidential information, it does not require a TEE-like environment, making external execution more economical and trustworthy.

[0241] Refer to the attached Figure 3 Describe in detail the added registers and function modules. The commitment component corresponds to the call1 function call, and the open commitment group corresponds to the call2, call3, and call4 function calls. The function input parameters are:

[0242] Set the function of {_B,_ID,_ secret}: Call1(_B,_ID)

[0243] Input parameter description: _B and _ID are 64-bit integers, _ID is smaller than _B,

[0244] And _B can only be the factor product of 2·3·7759·14057·1413296869;

[0245] Functional Description: Check if _B meets the conditions. If it fails, the _B register is -1. If it passes, set the registers {_B, _ID, _private secret}, where the value of _private secret is generated and filled by the random number module.

[0246] It should be noted that after calling call1, the private key sk generated by calling GenECCKeyPair or ECCExportSessionKey function may be equal to the calculation component sk=g _ID·A+_不公开秘密 Get, the _B register is not -1.

[0247] Set up a function of {_B2,_undisclosed secret 2}: ​​Call2(_B2);

[0248] Input parameter: _B2 is a 64-bit integer, _B2 is _B or a factor of _B;

[0249] Functional Description:

[0250] 1) Input _B2 is equal to the _B register, copy {_B, _undisclosed secret} of the commitment register to the open commitment register;

[0251] 2) Input _B2 is not a factor of _B, so the call fails. In theory, call3 and call4 cannot be called correctly.

[0252] 3) Input _B2 is a factor of _B. First, use the three values ​​of the commitment register group {_B, _ID, _private secret} to calculate sk=3 等价结果 , Equivalent result = ID·A+private secret·B, update the result to {_B2,_private secret2'}.

[0253] Open the output temp function of the promise component: Call3(x, output buffer)

[0254] Input parameter: x is 1 to 256 (can be larger),

[0255] Functional description: Step 1) Fill the register group of rx with x random numbers modulo N / _B2;

[0256] Step 2) x g _B2···(ri+_不公开秘密2) Output to the output buffer.

[0257] Open the output of the commitment component to reveal the data function: Call4(x, x challenge value guidance, output buffer)

[0258] Input parameter: x is 1 to 256 (can be larger), a guide for x challenge values;

[0259] Function description: Step 1) Output according to the guidance of x challenge values, and choose 1 from 2 to output ri or (ri+ _不公开秘密2 );

[0260] Step 2) Clear the output x to zero.

[0261] Compatible with the operation of uskkey, if call1 is not called, the uskkey compatibility principle is met. Therefore, the components of the present invention have a compatible effect.

[0262] Function calling method and test vector for Example 1:

[0263] Calling during the promise phase:

[0264] First execute Call1(B, ID), where B = 924875007631011282, ID = 370202200511141820;

[0265] Then call GenECCKeyPair or ECCExportSessionKey, and the generated private key meets the requirements.

[0266] Private key sk = 3 370202200511141820*A+不公开秘密*924875007631011282 , where A = N / B;

[0267] Open the call demo of the promise stage:

[0268] Step 1) Execute Call1(924875007631011282);

[0269] Step 2) Continue from step 1), Call 2 (256, 256 output buffer 1)

[0270] Step 3) is a continuation of step 2), where challenge value = hash(256 output buffers), where hash is cryptographically secure.

[0271] Step 4) continues from step 3), Call3(256, 256 output buffers 2).

[0272] Step 5) Finally, 256 output buffers 1 and 256 output buffers 2 are output.

[0273] The above demonstration demonstrates the production of non-interactive zero-knowledge proof data, where the prover P's commitment and response phases are linked via a cryptographically secure hash. In an interactive scenario, call2 and call3 correspond to the prover P's commitment and response phases, respectively, and the number of outputs can be as low as 1.

[0274] Function calling method and test vector for Example 2:

[0275] Directly refer to the equivalent equations given in Example 2 to set the call parameters for call1 and call2. To achieve the production of non-interactive or interactive zero-knowledge proof data, the deployment and effects of call3 and call4 after call2 are completely equivalent to the stated results of the function calls in Example 1 above.

[0276] Sk=3 143412314428390458*A+12*B .

[0277] Open Commitment 1: The equivalent equation for selective disclosure of {*,2005,0,*} is,

[0278] sk=s 6015·A2+257247753062340172322707857704629916232089679233711874743147690446573394·B2 , where B2=23277;

[0279] Therefore, after call2(23277), {_B2,_Non-disclosed secret 2'} is updated with the parameters of the above equation.

[0280] Open Commitment 2: The equivalent equation for selective disclosure of {3702, 2005, 0, *} is,

[0281] sk=s 170724309·A2+278985723925256323237960301443399381063531994947272249985591384104512·B2 , where B2=327204789.

[0282] Therefore, after call2(327204789), {_B2,_Non-disclosed secret 2'} is updated with the parameters of the above equation.

[0283] Open Commitment 3: Disclose all {3702,2005,0,1114_1820__02};

[0284] So the equivalent equation is: sk=s 143412314428390458·A2+12·B2 , where B2=462437503815505641.

[0285] Therefore, after call2(462437503815505641), the updated content of {_B2,_Non-disclosed secret 2'} is equal to the parameters of the above equation.

[0286] The statements in Example 5 can prove that it is feasible to integrate the commitment component and the opening commitment into the original smart password key. It can also be proved that in engineering implementation, the {…, IDx} type commitment and the ID commitment can be combined into a set of hardware processing.

[0287] This embodiment 5 is only the implementation of the ID-associated key sk. The above two components can also support the one-time key related to the SM2 algorithm. The specific documents and locations of the one-time key of the SM2 algorithm are in the three appendices of "SM2 Elliptic Curve Public Key Cryptography Algorithm - Part 5 Parameter Definition" (GM / TO003.5-2012).

[0288] 1) Appendix A "Digital Signature and Verification Example", generating random numbers: calculating the elliptic curve point (x1, yl);

[0289] 2) Appendix B "Key Exchange and Verification Example", generate random number rA: calculate elliptic curve point RA, generate random number rB: calculate elliptic curve point RB;

[0290] 3) Appendix C shows an example of message encryption and decryption, generating a random number k and calculating the elliptic curve point Cl.

[0291] This specification declares that GenECCKeyPair (generate ECC signature key pair) and ECCExportSessionKey (ECC generate and export session key) are the function call names given in the GM / T 0017-2012 standard; the smart key may use other function prototypes to implement the functions of private key and public key generation, and the specific implementation call shall prevail.

[0292] This Example 5 demonstrates that the commitment and open-commitment functions of the present invention can be implemented by upgrading components. This upgrade is compatible with devices, standards, and applications. More specifically, the commitment component acts as a prerequisite for generating sk, while the open-commitment component and the inputs to the open-commitment component, verification component, and verification function module are only associated with "private secrets" and have no association with the original device, standard, or application. Therefore, the implementation of the present invention is compatible.

[0293] In summary, Example 5 and its implementation can guide more commercial cryptographic products to implement component upgrades. These products and systems include but are not limited to cryptographic machines based on the SM2 algorithm, signature verification servers, timestamp servers, and CA authentication certificate servers.

[0294] Implementation method 6. Figure 4 About commercial secret products and industrial ecology

[0295] There are many commercial cryptographic products and systems based on the SM2 algorithm. According to the inventor's investigation, the cryptographic product standards and service standards related to the SM2 algorithm include at least GM / T0003.1 to 5-2012, GM / T0009-2012, GM / T0010-2012, GM / T0015-2012, GM / T0016-2012, GM / T0017-2012, GM / T0022-2014, GM / T0023-2014, GM / T0024-2014, and GM / T00 GM / T0025-2014, GM / T0027-2014, GM / T0028-2014, GM / T0029-2014, GM / T0034-2014, GM / T0043-2015, GM / T0045-2016, GM / T0059-2018, GM / T0060-2018, GMY5001-2017, GMY5002-2018, GM / T0104, GM / T0111. In addition to the above statements, you can also refer to the National Cryptography Administration's product certification catalog and certification service guide materials.

[0296] It should be noted that on December 23, 2023, the State Cryptography Administration issued Announcement (No. 45) on the release of 25 cryptographic industry standards, including the "GM / T0009-2012SM2 Cryptographic Algorithm Usage Specification" and the "GM / T0014-2012 Digital Certificate Authentication System Cryptographic Protocol Specification", which will be implemented from June 1, 2024; 18 standards involving VPN, SM2 algorithm, digital certificate, cryptographic equipment, etc. are the abolition of the original standards. The replacement of the above 18 standards is only an upgrade or redescription of the interface standard of the SM2 algorithm, and does not affect the connection between the SM2 algorithm and the invention content of the present invention. In short, the invention content of the present invention can connect and enable the above-mentioned commercial cryptographic products or commercial cryptographic systems that include the application of the SM2 algorithm.

[0297] Not limited to the applications of the SM2 algorithm described above, Figure 4 Guidelines, based on the public key of discrete logarithm difficulty, the green-labeled industrial standards are derived, and commercial encryption products, VPN equipment, commercial encryption systems, and blockchain systems are derived from the green-labeled industrial standards; so the attached Figure 4 This is equivalent to providing references for related devices, products, and application systems. In addition to the SM2 algorithm standard, industry standards include at least the ECDSA elliptic curve family, the Curve25519 curve, the SM2 algorithm, the Schnorr signature algorithm, the ElGamal algorithm, and Pedersen commitments.

[0298] It should be noted that given a discrete logarithm standard, the method for analyzing and extracting parameters A and B is to factor N-1 using yafu.exe (a public program). For example, for the ECDSA-384r1 elliptic curve, factoring (N-1) yields the following parameters: 2, 3, 3, 7, 7, 13, 1124679999981664229965379347, 30…71.

[0299] Example 7. X509 certificate based on commitment primitive

[0300] Attachment Figure 5 The X509 certificate has four entities: an X509 certificate, evidence data that opens the commitment primitive, evidence that can prove the entity identity is ID, and entity whose identity is ID.

[0301] The X509 certificate mainly consists of subjectPublicKeyInfo and CA signature value, where the most important information of subjectPublicKeyInfo is {subjectName, SubjectPublicKeyinfo}.

[0302] The PK of SubjectPublicKeyinfo is generated by the present invention's Commit primitive. SubjectName is not limited to an ID or an ID-related identifier and can be NULL. The Open Commit primitive verifies that the PK is associated / bound to the ID. Therefore, subjectName can be NULL. The key holder can disclose it using the Open Commit primitive when necessary.

[0303] PK is the output of a function with ID as input, so PK is classified by ID, and different IDs must have different keys.

[0304] 1. X509 certificate that is used first and then filed

[0305] Alice can first create the aforementioned X509 certificate, with the ID being _Alice, and then sign a commitment contract with Bob. The contract can specify that it must be filed with the CA or a notary office within three days. The filing and endorsement content is that PK is associated with _Alice, and the entity identity of the holder of {PK, sk} is Alice. For Bob and the CA, the ID is uniquely bound to {sk, pk}, and no other ID can correspond to PK. This is why the CA dares to endorse {PK, ID}.

[0306] The implementation steps are as follows:

[0307] 1) Alice: First make your own Figure 5 X509 certificate, where sk=g A·__Alice+不公开秘密·B , at this time the public key of the CA signature value is the PK corresponding to sk;

[0308] 2) Alice: Shows Bob the open commitment proof, proving that the PK is associated / bound to Alice;

[0309] 3) Alice: Signs the contract using the PK of the X509 certificate, which states that it must be filed with the CA within 3 days.

[0310] 4) Alice: Registers the X509 certificate with a CA. The CA registration method is to sign the subjectPublicKeyInfo portion. The CA signature value is generated by the CA. Obviously, the registration requires proof of identity and a registration application.

[0311] 5) Alice sends the record receipt to Bob. The record receipt is the digital signature of the CA. Figure 5 Purple part.

[0312] The above effect is to first make your own key and then file it within the specified time.

[0313] 2. Self-made X509 certificate for sovereignty declaration

[0314] If Alice's PK is only used to sign content related to sovereignty declarations, Alice's key does not need to be endorsed by a CA and can be maintained independently. Content related to sovereignty declarations includes keys for digital currencies, various innovative content, or information sources. The PK holder only discloses the association between the ID and PK when necessary.

[0315] 1) Fully compatible with standard X509 certificates and blockchain formats;

[0316] 2) Open commitment disclosure only when disclosure is required;

[0317] 3) If necessary, it can be filed into a certificate.

[0318] In summary, for the Figure 5 Digital certificates, CA organizations and PK users have new business forms.

[0319] Not limited to x509 certificates, certificate standards also include PKCS12, SPKI (the simple public key infrastructure), PGP, etc., but the main idea is that the CA structure (centralized organization) endorses the association between the user's public key and the user name (subject name).

[0320] Example 8. Research on decentralized and weakly centralized application scenarios

[0321] The ID is uniquely bound to {sk, pk}, so the entity with the ID inherently has the ability to assert sovereignty over the key and its signature content.

[0322] A decentralized application scenario that requires CA participation:

[0323] The entity with the identity ID digitally signs the content it invents or creates, or audiovisual content. This content and its digital signature are stored together on an official website or blockchain. The digital signature key is constructed using the commitment primitive of this invention. This allows the entity with the identity ID to provide the following three sets of evidence at any time, especially when defending its rights, to prove its sovereignty over the content and digital signature.

[0324] Evidence 1. "Content + digital signature" stored on the official website or blockchain.

[0325] Prove that the content + digital signature actually exists at the time of storage.

[0326] Evidence 2. Open the committed data, prove that the ID is uniquely associated / bound to the key of the digital signature.

[0327] Evidence 3. The entity whose identity is ID is associated with the ID (such as the identity number and ID card, the phone number and the owner's information).

[0328] Proof, the ID number is associated / bound to the entity ID.

[0329] The combination of the three sets of evidence can prove that at the time of evidence storage, the entity with the identity ID stored the content to confirm the ownership.

[0330] A weakly centralized scenario where the system is activated first and then registered:

[0331] The commitment-obligation digital signature scenario between Alice and Bob, discussed in the Summary of the Invention, demonstrates the feasibility of enabling the use of the device first and then filing it. However, filing with a CA is not necessary for the subsequent filing. Filing can be accomplished through methods such as a newspaper declaration, notarization at a notary office, or blockchain storage. Alice can send the declaration or notarization information to Bob. The result is a chain of evidence: 1. Bob's signature, 2. filing, and 3. opening the commitment. Importantly, the declaration and notarization information above do not need to include the zero-knowledge proof information from the opening commitment stage.

[0332] Based on the above analysis and the two scenario descriptions, the application based on the present invention has the ability to be decentralized or weakly centralized.

[0333] The media involved in this invention, from the perspective of encoded content, can be either PK and / or sk, or data related to the zero-knowledge proof during the open commitment phase. PK and sk may be data encapsulated in the X509 or pks standards. The zero-knowledge proof data for the open commitment is most likely non-interactive zero-knowledge proof data, but interactive zero-knowledge data is also included.

[0334] From the perspective of hardware entities, the media involved in the present invention include at least the following: electronic media, paper media, and cloud evidence storage services. Electronic media include permanent and non-permanent, removable and non-removable media, and information storage can be achieved by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. The following examples illustrate possible media forms: 1) a USB flash drive or cloud storage containing an executable program for the component function, which can be executed in a Windows or Linux environment; 2) a printed paper material containing a digital certificate related to the present invention; and 3) a USB flash drive or cloud storage on which the non-interactive zero-knowledge proof data related to the present invention is stored.

[0335] A related explanation of the program / instructions in a computer program product. The functions need to refer to the functional definitions corresponding to the three cryptographic protocol roles. The corresponding embodiments of the cryptographic protocol roles are attached. Figure 2 Program / instruction types include binary executable code and directly / indirectly executed scripting languages, where indirect means compiled and executed by a general compiler, such as Go language code. Computers herein include but are not limited to general-purpose CPUs, single-chip microcomputers, and FPGA-type programmable hardware. Compilable code includes but is not limited to source code such as C and Go. Scripting languages ​​include but are not limited to Java, Shell, etc.

[0336] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the concept of this application. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A key commitment method, applicable to a public key pk = sk * G, where sk is the key, G is the discrete logarithm generator; it is characterized in that based on the public key pk=sk*G, the ID association method is set in the following way sk=g ID·A+不公开秘密·B Or use the following method to set the {ID1, ID2, ..., IDx} association method sk=g ID1·A1+ID2·A2…+IDx·Ax+不公开秘密·B Where B is a factor of N-1, N is the group order of G, and g is the smallest primitive root on N or a primitive root specified in advance; ID or {…IDi…} is the content to be committed. The ID association method corresponds to B not being factored. In this case, A=(N-1) / B, The association mode of {…IDi…} corresponds to the factorization of B. In this case, {B1, B2,…, Bx} is the factorization of B and they are relatively prime to each other, and each Ai satisfies Ai=(N-1) / Bi.

2. The method according to claim 1, characterized in that The discrete logarithm generator G is a generator based on the SM2 algorithm, then sk=3 ID·A+不公开秘密·B Among them, B=924875007631011282.

3. The method according to claim 1, characterized in that The discrete logarithm generator G is a generator based on the SM2 algorithm, then, Among them, {B1, B2, B3, B4} = {14057, 7759, 3, 140571413296869}.

4. The method according to claim 1, wherein The discrete logarithm generator G is a generator based on the secp256k1 algorithm, then sk=7 ID·A+不公开秘密·B 。 5. A verification and commitment method corresponding to the key commitment method according to any one of claims 1 to 4, characterized in that: declare ID or {…IDi…}; Eliminate the ID or {…IDi…} information and calculate pk_ in the following way charller , pk_ charller =(g -A·ID )*PK or pk_ charller =(…·(g -Ai·IDi )·…)*PK; Adopting interactive zero-knowledge proof protocol Or a non-interactive zero-knowledge proof protocol to prove that there is a secret k that satisfies the equation pk_ charller =(g B ) k *G.

6. The method according to claim 5, characterized in that The specific steps of the interactive zero-knowledge proof protocol include: Commitment phase: For the prover P, randomly select r, calculate temp in the following way and send it to the verifier V. temp=(g B ) (不公开秘密+r) *G Challenge phase: For the verifier V, 0 or 1 is randomly selected as the challenge value; Response phase: For the prover P, If the challenge value is 0, then r mod A is revealed; If the challenge value is 1, reveal (unrevealed secret + r) mod A; Verification phase: For the verifier V, If the challenge value is 0, then verify temp=(g B ) r *pk_charller; If the challenge value is 1, then verify temp=(g B ) (不公开秘密+r) *G.

7. The method according to claim 6, characterized in that The interactive zero-knowledge proof protocol is transformed into Non-interactive zero-knowledge proof protocol; The specific steps of the non-interactive zero-knowledge proof protocol include: Prover P: Input "not disclosed secret", construct and output: {X, Y}; Step P001: X={…,(g B ) (不公开秘密+ri) , …} Among them, i is the number of elements, ri is a purely random number; Step P002: Calculate hash(X) based on X, and use hash(X) as the challenge value. The selection method is as follows; Y = {…, hash(x)[i] == 0? ri: (private secret + ri), …}, where hash(x)[i] is the i-th bit of hash(x); Step P003: Output: {X, Y}; Verifier V: Input: {X, Y}, Output: Pass / Fail; Step V002: Calculate hash(X); Step V003: Verify each i in the following way: For the i-th element of X, that is (g B ) (不公开秘密+ri) , Judgment (g B ) (不公开秘密+ri) Is it equal to hash(X)[i]==0? (g B ) ri *pk_charller:(g B ) (ri+不公开秘密) *G Output pass / fail; The passing criterion is that the equation holds for each i.

8. The method according to claim 5, characterized in that The specific steps of the interactive zero-knowledge proof protocol include: Commitment phase: The prover P first randomly selects w0, calculates w1 = (undisclosed secret - w0) mod A, calculates Y0 and Y1 using the following method and sends them to the verifier V; Y0=(g B ) w0 *G Y1=(g B ) w1 *G Challenge phase: For the verifier V, 0 or 1 is randomly selected as the challenge value; Response phase: For the prover P If the challenge value is 0, then w0 is revealed; If the challenge value is 1, then w1 is revealed; Verification phase: For the verifier V If the challenge value is 0, then verify (g B ) w0 *Y1=pk_charller and satisfy Y0=(g B ) w0 *G; If the challenge value is 1, then verify (g B ) w1 *Y0=pk_charller and satisfy Y1=(g B ) w1 *G.

9. A blockchain system, wherein the blockchain system uses a digital signature protocol or a Pedersen commitment protocol, characterized in that: The digital signature or the key of the Pedersen commitment is generated by any one of the commitment methods of claims 1 to 4.

10. A commercial cryptographic product that complies with the SM2 algorithm standard, characterized in that: The products include smart password keys, digital certificate servers, signature verification servers, financial cryptographic machines, server cryptographic machines, cloud server cryptographic machines, timestamp servers, secure electronic signature systems, digital certificate authentication systems, IPSec VPN gateways, SSL VPN gateways, blockchain block writing devices, or blockchain block verification devices; The product includes at least one component capable of implementing the cryptographic protocol role function, The cryptographic protocol roles include: a committer P who uses the key commitment method described in claim 2 or 3 to make a commitment, or a prover P or a verifier V who uses the verification commitment method described in any one of claims 6 to 8 to perform verification.

11. The commercial cryptographic product according to claim 10, which complies with the SM2 algorithm standard, is characterized in that: When the product type is a smart password key, the smart password key includes a key generation module, a commitment primitive component and an open commitment primitive component; Wherein, the commitment primitive component is the committer P; The open commitment primitive component is the prover P; The commitment primitive component is called by the key generation module.

12. A digital certificate product, wherein the public key type is PK=sk*G, where G is a discrete logarithm generator, characterized in that: The key sk is generated using the key commitment method described in any one of claims 1 to 4.

13. A device comprising an input unit, an output unit and a processing unit, characterized in that: The processing unit includes at least one component that can realize the function of a cryptographic protocol role, and the role includes at least one of the following roles: a committer P who uses the key commitment method described in any one of claims 1 to 4 to make a commitment, or a prover P or verifier V who uses the verification commitment method described in any one of claims 5 to 8 to make a verification.

14. A computer-readable storage medium storing data, characterized in that: The stored data, after being de-encoded, includes one of the following two types of data: 1) a secret key sk or a public key PK, wherein sk is generated by the secret key commitment method described in any one of claims 1 to 4; 2) interactive data of the zero-knowledge proof protocol, wherein the interactive data is generated and used by the prover P or verifier V corresponding to the verification commitment method described in any one of claims 5 to 8.

15. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed, the execution steps corresponding to the cryptographic protocol role are implemented, and the cryptographic protocol role is one of the following situations: the committer P corresponding to the key commitment method described in any one of claims 1 to 4, and the prover P or verifier V corresponding to the verification commitment method described in any one of claims 5 to 8.

Images