Two-party SM2 signature method based on confusion technology

Abstract

The invention belongs to the technical field of digital signature, and discloses a two-party SM2 signature method based on an obfuscation technology, which comprises the following steps of: 1, generating a key; step 2, confusing and returning the signature program; step 3, generating and sending an encrypted signature; 4, decrypting the encrypted signature, and outputting a standard signature; and 5, verifying the signature. Five algorithms including a key generation algorithm, a confusion SM2 encryption signature algorithm, a confusion algorithm, a decryption algorithm and a verification algorithm are used in the steps. According to the method, an SM2 signature technology and a Paillier encryption technology are combined, the security of a signature private key is effectively protected through program confusion, and provable white box security is achieved; the communication round is low, the efficiency is higher than that of an existing two-party signature method under the condition of high network delay, and high performance and usability are ensured.

Description

Technical Field

[0001] The present invention belongs to the technical field of identity authentication, and in particular relates to a two-party SM2 signature method based on obfuscation technology. Background Art

[0003] Digital signature is a key cryptographic technology used in the central bank's digital currency. The signer uses his or her own private signature key to generate a signature string for the message to be signed, and the verifier uses the signer's signature verification public key to verify whether the signature is legal. Digital signature plays a vital role in identity authentication.

[0004] Therefore, the security of digital signatures is an important part of the security of the central bank's digital currency, and protecting the signature private key is the top priority of digital signature security. However, private key security faces many risks. For example, attackers can conduct various gray box attacks or white box attacks (such as side channel attacks) to steal private keys. Although hardware-based security protection schemes have made great progress, there are still reports of various successful attacks on secure hardware in recent years. For example, Dimitrios Skarlatos et al. proposed a microarchitectural replay attack (Microarchitectural Replay Attacks) against Intel SGX in 2019, which significantly reduced the complexity of key theft; Dongjun Park et al. proposed a side channel attack method for elliptic curve scalar multiplication energy detection in 2023, which can steal user private keys from multiple hardware wallets without pre-adjusting the environment. This shows that over-reliance on hardware security to protect signature private keys is risky. Once an attacker gains control of the program in the secure hardware, the user's signature private key is very easy to leak.

[0005] Threshold signature is an important means to protect the signature private key. The existing two-party SM2 signature schemes based on secret sharing mainly include: lightweight SM2 two-party collaborative signature in mobile Internet environment proposed by Feng Qi et al. in 2019, SM2 two-party joint signature protocol proposed by Su Yinxue et al. in 2020, and efficient two-party signature protocol proposed by Han et al. in 2022. A serious defect of this type of threshold signature is that the communication rounds are high and the efficiency is low in high-latency networks. The existing two-party SM2 signature schemes based on the Paillier algorithm mainly include: secure two-party collaborative SM2 signature algorithm proposed by Hou Hongxia et al. in 2020, and provably practical two-party distributed SM2 signature protocol proposed by Zhang et al. in 2020. Although this type of scheme can maintain fewer communication rounds, it has many encryption and decryption times, high computational complexity, and low computational efficiency.

[0006] Program obfuscation is an effective means of protecting private keys and can make up for the lack of hardware security. The goal of program obfuscation is to make the program "difficult to understand" while maintaining the program's functionality. Even if an attacker obtains the obfuscated program, he or she will not be able to understand the meaning of the program, thereby achieving the purpose of protecting the key parameters inside the program. The two-party signature scheme based on program obfuscation technology has the advantage of low communication rounds and is suitable for use in situations with high network latency. Summary of the invention

[0007] In order to overcome the shortcomings of the prior art and to improve the security of the signature algorithm in digital currency, the present invention provides a two-party SM2 signature method based on obfuscation technology. By using the obfuscation technology, a two-party SM2 signature scheme is constructed, which improves the security in the digital currency signature process and protects the signature private key. At the same time, compared with the two-party SM2 signature scheme based on secret sharing, the present invention has a lower communication round and a smaller number of encryption and decryption operations than the two-party SM2 based on the Paillier algorithm, thereby ensuring higher communication efficiency and computing efficiency.

[0008] The main idea of ​​the present invention is to use program obfuscation technology to provide security protection for the signature private key. Program obfuscation technology uses a program called an obfuscator to convert the original program into an "incomprehensible" form while retaining its original function. By introducing obfuscation technology, the unilateral SM2 signature is converted into a two-party SM2 signature. As long as the two parties are not compromised at the same time, the attacker cannot construct a legal signature, which significantly improves the security of the signature private key.

[0009] The symbols used in the present invention are shown in Table 1.

[0010] Table 1 Explanation of symbols used in the present invention

[0011]

[0012]

[0013] The technical solution of the present invention is as follows:

[0014] A two-party SM2 signature method based on obfuscation technology involves two participants P1, P2 and an external verifier. The specific execution steps are as follows:

[0015] Step 1, key generation:

[0016] a.P1 executes the key generation algorithm to obtain the decryption private key and encryption public key (SK e ,PK e ) and the signature private key and the signature verification public key (d A ,P A );

[0017] b. Use the signature private key and the verification public key (d A ,P A ) is sent to P2;

[0018] c.P1 deletes the local signature private key and signature verification public key (d A ,P A );

[0019] Step 2, the signature program is obfuscated and returned:

[0020] a.P2 will obfuscate the original implementation of the SM2 encryption signature algorithm Send to P1;

[0021] b. P1 performs obfuscation algorithm processing Obtain the obfuscated signature program

[0022] c. The obfuscated program Send to P2;

[0023] Step 3, generate an encrypted signature and send it:

[0024] a.P2 runs the obfuscated program Get the encrypted signature value Ω;

[0025] b. Send the encrypted signature value Ω to P1;

[0026] Step 4: Decrypt the encrypted signature and output the standard signature:

[0027] a.P1 runs the decryption algorithm and obtains the standard SM2 signature (r, s);

[0028] b. Send the standard signature (r, s) to the verifier;

[0029] Step 5, verify the signature:

[0030] The verifier executes the verification algorithm and outputs the signature verification result.

[0031] At this point, the steps of the entire program are completed.

[0032] A two-party SM2 signature method based on obfuscation technology includes a key generation algorithm, an obfuscated SM2 encryption signature algorithm, an obfuscation algorithm, a decryption algorithm and a verification algorithm.

[0033] The key generation algorithm input is SM2 security parameter λ, Paillier security parameter l and public parameter pp = (q, a, b, g, p, H v ), where q is the finite field in the SM2 standard algorithm The number of elements of a, b is The two elements in On the elliptic curve E, g is the additive group of all points on E A specific element in , p is the prime order of g, H v is a cryptographic hash function with an output length of vbits. The output is the Paillier decryption private key and encryption public key (SK e ,PK e ) and SM2 signature private key and signature verification public key (d A ,P A ), the specific steps are as follows:

[0034] Step 1: Generate decryption private key and encryption public key:

[0035] The decryption private key and encryption public key are generated by standard Paillier key generation: (SK e ,PK e )←Paillier_KeyGen(1 l ). Among them, ← represents assignment, Paillier_KeyGen(1 l ) is the standard Paillier key generation algorithm.

[0036] Step 2: Generate a private signature key and a public signature verification key:

[0037] a.Signature private key d A From the multiplication group Random uniform selection in

[0038] b. Verification public key P A =d A g;

[0039] Step 3: Output the decryption private key, encryption public key, signature private key and signature verification public key:

[0040] Output the decryption private key and encryption public key (SK e ,PK e ) and the signature private key and the signature verification public key (d A ,P A ).

[0041] The input of the obfuscated SM2 encryption signature algorithm is the message to be signed M, the public parameter pp, and the signature private key d A , encrypted public key PK e , the output is the encrypted signature value Ω:

[0042] Step 1, parse the common parameters:

[0043] Parse the public parameters into the values ​​required by the algorithm: (q, a, b, g, p, H v )←pp.

[0044] Step 2, generate a standard SM2 signature:

[0045] a. Calculation Where Z A is a specific format string related to user A information specified in standard SM2, || represents string concatenation; and calculate The hash value of

[0046] b. From the multiplication group Randomly and uniformly select k,δ;

[0047] c. Calculate the point R=k·δ·g on the elliptic curve, and calculate the value of r in the standard SM2 signature pair: r=(e+f(R))modp, where f(x) is the function of the horizontal coordinate of the point, x is the point on the elliptic curve, and mod is the modulus operation. If r=0 or r+k·δ=p occurs, re-execute sub-step b and the following sub-steps;

[0048] d. Then calculate the value of s in the standard SM2 signature pair: s = ((1 + d A ) -1 ·(k·δ-r·d A ))modp, if s=0, re-execute steps b and b below.

[0049] Step 3: Concatenate the standard signature pair and calculate the encrypted signature:

[0050] a. Shift r left by L bits and calculate the concatenated signature u = (r + s) mod p;

[0051] b. Calculate the encrypted signature Ω = Paillier_Enc(u,PK e ), where Paillier_Enc is the standard Paillier encryption algorithm.

[0052] The obfuscation algorithm is used to confuse the SM2 encryption signature algorithm and generate an obfuscated signature program with private key protection function. The input is the original implementation program that can confuse the SM2 encryption signature algorithm. The output is the obfuscated signed program The specific steps are as follows:

[0053] Step 1: Obfuscate the signature private key information in the original program:

[0054] a.From Read (pp,d A ,P A ,PK e );

[0055] b. From the multiplication group Randomly and uniformly select δ from the equation, and calculate Δ = δ g;

[0056] c. Calculate z1 = Paillier_Enc((1+d A ) -1 ·δ,PK e ), z2=Paillier_Enc((1+d A ) -1 ·d A ,PK e );

[0057] Step 2: Replace the plaintext private key information in the original program with the obfuscated signature private key information and output the obfuscated program. The workflow is as follows:

[0058] a. Calculation And calculate The hash value of

[0059] b. From the multiplication group k is randomly selected uniformly from;

[0060] c. Calculate the point R=k·Δ on the elliptic curve, and calculate the value of r in the standard SM2 signature pair: r=(e+f(R))modp. If r=0 or r+k·δ=p occurs, re-execute sub-step b and the following sub-steps;

[0061] d. Calculation Where n is the modulus in the standard Paillier algorithm.

[0062] e. Shift r left by L bits and calculate

[0063] f. Calculation

[0064] g. Calculate the encrypted signature value

[0065] For higher efficiency, steps e and g can be omitted and As the encrypted signature value, the following decryption algorithm is also adjusted accordingly, which can reduce one Paillier encryption operation without affecting security and improve computational efficiency.

[0066] The decryption algorithm input is the encrypted signature value Ω, the decryption private key SK e , the output is a standard SM2 signature pair (r, s). The specific steps are as follows:

[0067] Step 1: Decrypt the encrypted signature value to obtain the concatenated signature:

[0068] Call the standard Paillier decryption algorithm to calculate the concatenated signature u = Paillier_Dec(Ω,SK e ), where Paillier_Dec is the standard Paillier decryption algorithm.

[0069] Step 2: Process the concatenated signatures to obtain a standard SM2 signature pair:

[0070] a. Take the lower L bits of u as s in the standard signature pair;

[0071] b. Shift u right by L bits as r in the standard signature pair, and combine it with s to obtain the standard SM2 signature pair (r, s).

[0072] If in the obfuscation algorithm, the obfuscated program omits steps e and g, then this algorithm only needs to call the standard Paillier decryption algorithm in step 1 to calculate the plaintext signature value. And omitting step 2, we can obtain the standard SM2 signature pair (r, s).

[0073] The verification algorithm is used to verify whether the signature is valid, which is consistent with the standard SM2 signature verification algorithm. The input is the signature message M and the verification public key P A , standard SM2 signature pair (r, s), and public parameter pp, the output is the verification result (pass / fail) b, the specific steps are as follows:

[0074] Step 1, parse the common parameters:

[0075] Parse the public parameters into the values ​​required by the algorithm: (q, a, b, g, p, H v )←pp.

[0076] Step 2: Determine the validity of the signature:

[0077] If r does not belong to or s does not belong to Then the output b=0, indicating that the verification failed.

[0078] Step 3: Calculate whether the signature passes:

[0079] a. Calculation And calculate The hash value of

[0080] b. Calculate t = (r + s) mod p;

[0081] c. If t = 0, then output b = 0, indicating that the verification failed;

[0082] d. Calculate R′=s·g+t·P A, and calculate r'=(e+f(R'))modp;

[0083] e. If r'=r, then output b=1, indicating that the verification is successful; otherwise, output b=0, indicating that the verification is not successful.

[0084] Beneficial effects:

[0085] Through the above technical solutions, the present invention realizes a secure two-party signature scheme, which is suitable for the identity authentication of central bank digital currency transactions. This scheme combines SM2 signature and Paillier encryption technology, obfuscates the encrypted signature program in step 2, converts the original program into an "incomprehensible" form, and retains its original function, protecting the security of the private key of the signature. The present invention ensures that in a network environment with high latency, the efficiency of the signature is higher than that of the existing two-party SM2 signature scheme, reducing the time and energy consumption during the execution of the algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] Figure 1 This is a working principle diagram of step 1 and step 2 of the embodiment of the present invention;

[0087] Figure 2 This is a working principle diagram of step 3, step 4, and step 5 of the embodiment of the present invention;

[0088] Figure 3 The experimental results of the execution efficiency of various algorithms in the embodiments of the present invention on different devices;

[0089] Figure 4 The energy consumption experimental results of executing various algorithms of the embodiments of the present invention on different devices;

[0090] Figure 5 The figure compares the signature efficiency of the embodiment of the present invention with that of the existing two-party SM2 signature method (taking into account the wide area network delay). DETAILED DESCRIPTION

[0091] The technical solution provided by the present application will be further described below in conjunction with specific embodiments and accompanying drawings. The advantages and features of the present application will become more apparent with the following description.

[0092] like Figure 1 , Figure 2 This is an embodiment of the present invention used in the digital currency signature process, involving two participants P1, P2 and an external verification party.

[0093] Among them, the signer P1 is responsible for key generation, program obfuscation and decryption of encrypted signatures, and the generation of standard signature operations;

[0094] The signer P2 is responsible for generating the encrypted signature;

[0095] The verifier is the banking system (existing facilities), which verifies the validity of the signature in the digital currency transaction by executing a verification algorithm (standard SM2 signature verification algorithm, existing technology), thereby completing the identity authentication of the transaction party and ensuring that the source of the transaction is valid.

[0096] The specific steps are as follows:

[0097] Step 1, key generation:

[0098] a.P1 executes the key generation algorithm to obtain the decryption private key and encryption public key (SK e ,PK e ) and the signature private key and the signature verification public key (d A ,P A );

[0099] b. Use the signature private key and the verification public key (d A ,P A ) is sent to P2;

[0100] c.P1 deletes the local signature private key and signature verification public key (d A ,P A );

[0101] Step 2, the signature program is obfuscated and returned:

[0102] a.P2 will obfuscate the original implementation of the SM2 encryption signature algorithm Send to P1;

[0103] b. P1 performs obfuscation algorithm processing Obtain the obfuscated signature program

[0104] c. The obfuscated program Send to P2;

[0105] Step 3, generate an encrypted signature and send it:

[0106] a.P2 runs the obfuscated program Get the encrypted signature value Ω;

[0107] b. Send the encrypted signature value Ω to P1;

[0108] Step 4: Decrypt the encrypted signature and output the standard signature:

[0109] a.P1 runs the decryption algorithm and obtains the standard SM2 signature (r, s);

[0110] b. Send the standard signature (r, s) to the verifier;

[0111] Step 5, verify the signature:

[0112] The verifier executes the verification algorithm and outputs the signature verification result.

[0113] The standard signature can be sent directly from P1 to the verifier, or it can be sent to P2 first and then sent to the verifier by P2.

[0114] Figure 1 This is the running process of step 1 key generation and step 2 signature program obfuscation and return. These two steps do not need to be executed every time a signature is signed, but only need to be executed once at a fixed time to ensure the security of the key and the obfuscated signature program. Figure 2 Generate an encrypted signature for step 3 and send it, decrypt the encrypted signature for step 4 and output a standard signature, and verify the signature for step 5. These three steps need to be performed in each signing and verification process.

[0115] Test effect verification

[0116] The two-party SM2 signature method based on obfuscation technology proposed in the present invention is tested on a workstation, a cloud server, a Raspberry Pi development board, and a UP2 Grove development board. The experimental equipment is shown in Table 2.

[0117] Table 2 Experimental equipment

[0118]

[0119] Figure 3 , Figure 4 The execution speed and energy consumption of each major algorithm are shown respectively, and the results of the Paillier algorithm modulus n length are tested when it is 2048 bits and 2560 bits. Among them, algorithms 1, 2, 3, 4, and 5 represent the key generation algorithm, the obfuscated SM2 encryption signature algorithm, the obfuscation algorithm, the decryption algorithm, and the verification algorithm respectively. Algorithm 2' represents the obfuscated encryption signature program obtained after the corresponding program of algorithm 2 is obfuscated by algorithm 3, that is, the signature program actually executed by the signer 2.

[0120] It can be seen from the experimental results that in terms of execution speed, the execution of each algorithm of the two-party SM2 signature method based on the obfuscation technology proposed by the present invention does not exceed 35 milliseconds on the server and does not exceed 260 milliseconds on the embedded device; the frequently called algorithms 2', 4, and 5 do not exceed 25 milliseconds on the server and do not exceed 200 milliseconds on the embedded device. In terms of energy consumption, the energy consumption of executing each algorithm once does not exceed 390 millijoules on the Raspberry Pi development board and does not exceed 220 millijoules on the UP2 Grove development board; the frequently called algorithms 2', 4, and 5 do not exceed 280 millijoules on the Raspberry Pi development board and do not exceed 160 millijoules on the embedded device.

[0121] Figure 5The comparison results of the signature time between this scheme and the existing two-party SM2 signature scheme are shown. The execution time represents the total time to complete a round of two-party signature, including the calculation time of P1 and P2 respectively, and the total communication delay between P1 and P2. Among them, Feng represents the lightweight SM2 two-party collaborative signature in the mobile Internet environment proposed by Feng Qi et al. in 2019, Su represents the SM2 two-party joint signature protocol proposed by Su Yinxue et al. in 2020, Han represents the efficient two-party signature protocol proposed by Han et al. in 2022, Zhang represents the provably practical two-party distributed SM2 signature protocol proposed by Zhang et al. in 2020, Hou represents the secure two-party collaborative SM2 signature algorithm proposed by Hou Hongxia et al. in 2020, and Ours represents this scheme. The test was run on two cloud servers (with the same configuration as above) in Shanghai, with a communication bandwidth of 100Mbps. The test shows that the communication delay for each message sent between cloud servers is about 5.6 milliseconds. Through experiments, it can be seen that the execution time of this scheme is better than all existing two-party SM2 signature schemes, because this scheme has a low communication round and few encryption and decryption operations. This scheme will be significantly better than the two-party SM2 signature scheme based on secret sharing under high network delay conditions, and is better than the two-party SM2 signature scheme based on the Paillier algorithm under all conditions.

[0122] Experimental results show that the algorithm of the two-party SM2 signature method based on obfuscation technology in the present invention has high computational efficiency on various experimental platforms and economical energy consumption on embedded devices.

[0123] The above description is only a description of the preferred embodiments of the present application, and is not intended to limit the scope of the present application. Any changes or modifications made by any person skilled in the art based on the above disclosed technical contents shall be deemed as equivalent effective embodiments and shall fall within the scope of protection of the technical solution of the present application.

Claims

1. A two-party SM2 signature method based on obfuscation technology, involving two participants P1, P2 and an external verifier, characterized in that: The specific steps are as follows: Step 1, key generation: a.P1 executes the key generation algorithm to obtain the decryption private key and encryption public key (SK e ,PK e ) and the signature private key and the signature verification public key (d A ,P A ); b. Use the signature private key and the verification public key (d A ,P A ) is sent to P2; c.P1 deletes the local signature private key and signature verification public key (d A ,P A ); Step 2, the signature program is obfuscated and returned: a.P2 will obfuscate the original implementation of the SM2 encryption signature algorithm Send to P1; b. P1 performs obfuscation algorithm processing Obtain the obfuscated signature program c. The obfuscated program Send to P2; Step 3, generate an encrypted signature and send it: a.P2 runs the obfuscated program Get the encrypted signature value Ω; b. Send the encrypted signature value Ω to P1; Step 4: Decrypt the encrypted signature and output the standard signature: a.P1 runs the decryption algorithm and obtains the standard SM2 signature (r, s); b. Send the standard signature (r, s) to the verifier; Step 5, verify the signature: The verifier executes the verification algorithm and outputs the signature verification result.

2. According to claim 1, a two-party SM2 signature method based on obfuscation technology is characterized in that: The key generation algorithm input is SM2 security parameter λ, Paillier security parameter l and public parameter pp = (q, a, b, g, p, H v ), where q is the finite field in the SM2 standard algorithm The number of elements of a, b is The two elements in On the elliptic curve E, g is the additive group of all points on E A specific element in , p is the prime order of g, H v is a cryptographic hash function with an output length of vbits; the output is the Paillier decryption private key and encryption public key (SK e ,PK e ) and SM2 signature private key and signature verification public key (d A ,P A ), the specific steps are as follows: Step 1: Generate decryption private key and encryption public key: The decryption private key and encryption public key are generated by standard Paillier key generation: (SK e ,PK e )←Paillier_KeyGen(1 l ), where ← represents assignment, Paillier_KeyGen(1 l ) is the standard Paillier key generation algorithm; Step 2: Generate a private signature key and a public signature verification key: a.Signature private key d A From the multiplication group Random uniform selection in b. Verification public key P A =d A g; Step 3: Output the decryption private key, encryption public key, signature private key and signature verification public key: Output the decryption private key and encryption public key (SK e ,PK e ) and the signature private key and the signature verification public key (d A ,P A ).

3. According to claim 1, a two-party SM2 signature method based on obfuscation technology is characterized in that: The input of the obfuscated SM2 encryption signature algorithm is the message to be signed M, the public parameter pp, and the signature private key d A , encrypted public key PK e , the output is the encrypted signature value Ω: Step 1, parse the common parameters: Parse the public parameters into the values ​​required by the algorithm: (q, a, b, g, p, H v )←pp; Step 2, generate a standard SM2 signature: a. Calculation Where Z A is a specific format string related to user A information specified in standard SM2, || represents string concatenation; and calculate The hash value of b. From the multiplication group Randomly and uniformly select k,δ; c. Calculate the point R=k·δ·g on the elliptic curve, and calculate the value of r in the standard SM2 signature pair: r=(e+f(R))modp, where f(x) is the function of the horizontal coordinate of the point, x is the point on the elliptic curve, and mod is the modulus operation. If r=0 or r+k·δ=p occurs, re-execute sub-step b and the following sub-steps; d. Then calculate the value of s in the standard SM2 signature pair: s = ((1 + d A ) -1 ·(k·δ-r·d A ))mod p, if s=0, then re-execute step b and the following steps; Step 3: Concatenate the standard signature pair and calculate the encrypted signature: a. Shift r left by L bits and calculate the concatenated signature u = (r + s) mod p; b. Calculate the encrypted signature Ω = Paillier_Enc(u,PK e ), where Paillier_Enc is the standard Paillier encryption algorithm.

4. According to claim 1, a two-party SM2 signature method based on obfuscation technology is characterized in that: The obfuscation algorithm is used to confuse the SM2 encryption signature algorithm and generate an obfuscated signature program with a private key protection function; the input is the original implementation program that can confuse the SM2 encryption signature algorithm The output is the obfuscated signed program The specific steps are as follows: Step 1: Obfuscate the signature private key information in the original program: a.From Read (pp,d A ,P A ,PK e ); b. From the multiplication group Randomly and uniformly select δ from the equation, and calculate Δ = δ g; c. Calculate z1 = Paillier_Enc((1+d A ) -1 ·δ,PK e ), z2=Paillier_Enc((1+d A ) -1 ·d A ,PK e ); Step 2: Replace the plaintext private key information in the original program with the obfuscated signature private key information and output the obfuscated program. The workflow is as follows: a. Calculation And calculate The hash value of b. From the multiplication group k is randomly and uniformly selected from;. c. Calculate the point R=k·Δ on the elliptic curve, and calculate the value of r in the standard SM2 signature pair: r=(e+f(R))mod p. If r=0 or r+k·δ=p occurs, re-execute sub-step b and the following sub-steps; d. Calculation Where n is the modulus in the standard Paillier algorithm. e. Shift r left by L bits and calculate f. Calculation g. Calculate the encrypted signature value The decryption algorithm input is the encrypted signature value Ω, the decryption private key SK e , the output is a standard SM2 signature pair (r, s); the specific steps are as follows: Step 1: Decrypt the encrypted signature value to obtain the concatenated signature: Call the standard Paillier decryption algorithm to calculate the concatenated signature u = Paillier_Dec(Ω,SK e ), where Paillier_Dec is the standard Paillier decryption algorithm; Step 2: Process the concatenated signature to obtain a standard SM2 signature pair: a. Take the lower L bits of u as s in the standard signature pair; b. Shift u right by L bits as r in the standard signature pair, and combine it with s to obtain the standard SM2 signature pair (r, s).

5. According to claim 4, a two-party SM2 signature method based on obfuscation technology is characterized in that: Omit steps e and g in step 2 of the obfuscation algorithm and directly As the encrypted signature value Ω; In step 1 of the decryption algorithm, the standard Paillier decryption algorithm is used to calculate the plaintext signature value. By omitting step 2, we can obtain the standard SM2 signature pair (r, s).

6. According to claim 1, a two-party SM2 signature method based on obfuscation technology is characterized in that: The verification algorithm is used to verify whether the signature is valid, which is consistent with the standard SM2 signature verification algorithm; the input is the signature message M, the verification public key P A , standard SM2 signature pair (r, s), and public parameter pp, the output is the verification result (pass / fail) b, the specific steps are as follows: Step 1, parse the common parameters: Parse the public parameters into the values ​​required by the algorithm: (q, a, b, g, p, H v )←pp; Step 2: Determine the validity of the signature: If r does not belong to or s does not belong to Then the output b=0, indicating that the verification failed; Step 3: Calculate whether the signature passes: a. Calculation And calculate The hash value of b. Calculate t = (r + s) mod p; c. If t = 0, then output b = 0, indicating that the verification failed; d. Calculate R′=s·g+t·P A , and calculate r'=(e+f(R'))modp; e. If r'=r, then output b=1, indicating that the verification is successful; otherwise, output b=0, indicating that the verification is not successful.

Images