Forward security identifier signature method based on commercial cipher SM9

Abstract

The invention discloses a forward security identifier signature method based on commercial cipher SM9. The method comprises a secret key generation center, a signer and a verifier. The key generation center is completely trusted with the signer and the verifier. Wherein the key generation center initializes system parameters and issues an initial key to a signer according to a user identifier (ID). And the signer sends a key updating request to the key generation center so as to obtain the updated key. A signer inputs a system main public key, a message and a secret key in a t time period to execute a signature algorithm to generate a message signature, and sends the message, the signature and a user identifier ID of the signer to a verifier. A verifier inputs a system main public key and the received parameters to execute a signature verification algorithm, if verification succeeds, 1 is output, and if verification fails, 0 is output. According to the signature mechanism, a secret key updating mechanism is introduced, and even under the condition that a private key is leaked, it can be ensured that a signature generated in the past is not counterfeited.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a forward security identification signature method based on commercial secret SM9. Background Art

[0002] Digital signature technology is a key technology in the field of information security. Its core role is to ensure the integrity of data during transmission. With the rapid development of information technology, emerging technologies such as cloud computing, big data, artificial intelligence and blockchain have played an important role in leading the digital transformation of traditional Internet industries and promoting the innovation of e-commerce models. Although these technologies have brought efficiency improvements in the industrial production process, they have also inevitably brought security challenges in terms of data leakage, unauthorized access and data integrity. In this context, the importance of digital signature technology has become increasingly prominent. However, existing traditional signature algorithms are often deployed in some critical infrastructures (such as banking systems). Assuming that a user uses his private key to sign a transaction at a certain moment, if the private key is stolen by hackers in the future, hackers can forge the user's digital signature, thereby conducting unauthorized transactions, ultimately leading to the theft of the user's funds, and thus triggering a series of legal disputes.

[0003] To solve the above problems, in 1994, Turing Award winner Micali and three other cryptographers first proposed the concept of forward secure signatures. Forward signatures, also known as forward secure signatures, are a digital signature technology that ensures that future leaks do not affect past security. Forward signatures are proposed to solve security issues after key leaks. They can ensure that even if the key is leaked at some point in the future, the signatures generated using the key in the past are still valid. This feature is crucial to ensuring data integrity and non-repudiation.

[0004] The design goal of the SM9 identification cryptographic algorithm is to meet the security requirements in specific application scenarios, especially in environments such as mobile communications and the Internet of Things, where a secure and efficient digital signature technology is needed to protect the integrity of data transmission. Although the national commercial encryption SM9 identification cryptographic algorithm provides basic common protection for data security, it is difficult to support the expansion of dedicated security functions on digital signatures. In order to solve the relevant security issues caused by key leakage during the identity authentication process and meet the strategic requirements of independent, secure, effective and controllable domestic cryptographic technology, it is urgent to study a forward secure identification signature algorithm based on the domestic commercial encryption SM9. Summary of the invention

[0005] The purpose of the present invention is to provide a forward secure identification signature method based on the commercial secret SM9, which can ensure that the historical signatures generated by the user in the past will not be forged by the illegal holder of the private key even in the case of private key leakage, thereby effectively resisting the risks brought by key leakage and improving the resilience and security of the system.

[0006] The technical solution adopted by the present invention is:

[0007] A forward secure identification signature method based on commercial secret SM9, comprising:

[0008] In the system initialization Setup phase: the key generation center KGC runs the system initialization algorithm to generate the system's public parameters, master public key, and master private key;

[0009] In the KeyGen phase: the key generation center KGC runs the key generation algorithm to generate an initial key for the user;

[0010] In the key update phase: the key generation center KGC runs the key update algorithm to generate updated keys for users;

[0011] In the Sign phase: the data signer runs the signature algorithm to generate a message signature;

[0012] In the Verify phase: the data verifier runs the verification algorithm to verify the message signature.

[0013] In one embodiment of the present invention, during the system initialization Setup phase, the key generation center KGC runs a system initialization algorithm to generate the system's public parameters, master public key, and master private key, specifically including:

[0014] Given a known safety parameter of λ and a maximum number of time periods in the system of T, a complete binary tree BT is constructed, and the time periods t on the time axis are mapped to the nodes w of a complete binary tree in the order of pre-order traversal. Calculate the depth of the binary tree The key generation center KGC first selects a second type bilinear group Where e is a bilinear map p is a prime number and satisfies p>2 λ , are all additive cyclic groups of prime order p, is a multiplicative cyclic group of prime order p, with randomly selected generators Select a random number i0, in Let be a set of integers of order p not containing 0, and let the function H:{I0,I1}→{i0,i1} be:

[0015]

[0016] Select random number Two cryptographic hash functions Computing Group The element P in pub =αP, calculation group The element g=e(P pub ,Q), let the input of the time conversion function T2PV be time period t, the output be the path vector of the time period t corresponding to the node w on the binary tree, select a byte-represented private key generation function identifier hid. The output system master public key mpk and master private key msk are:

[0017]

[0018] In one embodiment of the present invention, in the key generation KeyGen stage, the key generation center KGC runs a key generation algorithm to generate an initial key for the user, specifically including:

[0019] Known user identity ID∈{0,1} * , the identifier ID is a string of any length consisting of 0 or 1. The key generation center KGC first generates a p Calculate the non-zero integer h1 = H1 (ID || hid, p), || is the cascade symbol, and select a random number And generate the root node key

[0020] The user private key is composed of a stack ST. The generated node key k is pushed into the stack ST.push(k), where push() represents the stack push operation. Let the user private key with the identity ID in time period 0 be sk ID|0 =ST.

[0021] In one embodiment of the present invention, during the key update phase, the key generation center KGC runs a key update algorithm to generate an updated key for the user, specifically including:

[0022] It is known that the private key of the user with the identity ID in time period t is sk ID|t , use stack ST to represent the user's private key, and pop a node key k from the stack = ST.pop(), where pop() is the operation of popping the top element of the stack. Call the time conversion function T2PV to generate the path vector of the binary tree node w corresponding to the time period t as (x0, x1, x2, ..., x d ), where x0=∈, ∈ represents the root node of the binary tree, x i∈{I0,I1}, x represents the value of function H, I0 represents the left branch in the binary tree, I1 represents the right branch in the binary tree, d is the level number of node w, and d is required to be less than or equal to the depth l of the binary tree. If node w is a leaf node, set the private key sk for time period t+1 ID|t+1 =ST, the operation ends and returns. If node w is a non-leaf node, it is necessary to generate the keys k0 and k1 of the left and right child nodes of node w respectively, and first push the key k1 of the right node into the stack, and then push the key k0 of the left node into the stack. Suppose the key k of node w is in the form of: (a0, a1, b d+1 ,b d+2 ,…,b l ), where a0, a1 represent the part of the private key containing the user identification information, {b i} i∈{d+1,…,l} represents the proxy private key used for timestamp update, {Q i} i∈{d+1,…,l} Represents the group selected from layer d+1 to layer l The generator on , select a random number The left child node key k0 is calculated as:

[0023]

[0024]

[0025] in Indicates the updated left child node key k0 contains the part of the private key of the user identification information, Represents the proxy private key used for timestamp update in the updated left child node key k0.

[0026] Pick a random number The calculation method of the right child node key k1 is:

[0027]

[0028]

[0029] in Indicates the updated right child node key k1 contains the partial private key of the user identification information, Represents the proxy private key used for timestamp update in the updated right child node key k1.

[0030] In one embodiment of the present invention, in the Sign phase, the data signer runs the signature algorithm to generate a message signature, which specifically includes:

[0031] Let the message to be signed be M∈{0,1} *, M is a string of any length consisting of 0 or 1, let the signer's identifier be ID, and use the stack ST to represent the corresponding user private key sk ID|t =ST, get the top element of the stack, that is, the binary tree node key k of the current period = ST.getTop(), the key k is recorded as: (a0, a1, b d+1 ,b d+2 ,…,b l ), the signer performs the following operation to generate the signature of message M: select a random number calculate The element z=g s , calculate the integer h = H2(M||z,p), calculate the integer y = (sh) mod p, and calculate The elements S0=y·a0, S1=y·s1 in the output message M are signature σ=(h, S0, S1).

[0032] In one embodiment of the present invention, in the Verify stage, the data verifier runs a verification algorithm to verify the message signature pair, specifically including:

[0033] In order to distinguish the message M from the signature σ in the signature algorithm, M is used here ′ Represents the message input in the verification algorithm, and σ ′ =(h′,s0′,s1′) represents the message signature input in the verification algorithm, h′ represents the integer information contained in the message signature in the verification algorithm, S′0,S′1 represent the two integers contained in the message signature in the verification algorithm The time conversion function T2PV is called to generate the path vector of the binary tree node w corresponding to the time period t as (x0, x1, x2, ..., x d ), the verifier performs the following operations to verify the validity of the signature: The element u=g h′ , calculate the integer h1 = H1 (ID || hid, p), calculate The element C1=P pub +h1P, calculation Elements in calculate Elements in calculate Take the element z′=u·v in M′, calculate the integer h2=H2(M′||z′,p), and check whether h2=h′. If so, the verification succeeds and outputs “1”; otherwise, the verification fails and outputs “0”.

[0034] The present invention adopts the above technical solution, which can ensure that the historical signatures generated by the user in the past will not be forged by the illegal holder of the private key even in the case of private key leakage, thereby effectively resisting the risks brought by key leakage and improving the resilience and security of the system. It provides a better solution to the relevant security issues caused by key leakage in the identity authentication process, and meets the strategic needs of domestic cryptographic technology to be independent, safe, effective and controllable. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments;

[0036] Figure 1 This is a system architecture diagram of a forward secure identification signature method based on commercial secret SM9;

[0037] Figure 2 This is a flow chart of a forward secure identification signature method based on commercial secret SM9. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0039] like Figure 1 As shown in or 2, in response to the relevant security issues caused by key leakage during the identity authentication process, the present invention discloses a forward secure identification signature method based on the commercial secret SM9, which is a signature mechanism that can ensure that the signatures generated in the past cannot be forged even in the event of private key leakage.

[0040] Please refer to Figure 1 A forward secure identification signature system based on the commercial secret SM9 mainly includes three types of entities: key generation center, signer, and verifier. The key generation center is fully trusted by the signer and the verifier. The key generation center initializes the system parameters and issues the initial key to the signer based on the user identification ID. The signer can send a key update request to the key generation center to obtain the updated key. The signer enters the system master public key mpk, the message M, and the key sk for the time period t. ID|t Execute the signature algorithm to generate the message signature σ, and send the message M, signature σ and its own user ID to the verifier. The verifier inputs the system master public key mpk and the above parameters received to execute the signature verification algorithm. If the verification is successful, it outputs "1", and if the verification fails, it outputs "0".

[0041] Please refer to Figure 2 A forward security identification signature method based on commercial secret SM9, characterized in that it includes the steps of:

[0042] In the system initialization Setup phase: the key generation center KGC runs the system initialization algorithm to generate the system's public parameters, master public key, and master private key;

[0043] In the KeyGen phase: the key generation center KGC runs the key generation algorithm to generate an initial key for the user;

[0044] In the key update phase: the key generation center KGC runs the key update algorithm to generate updated keys for users;

[0045] In the Sign phase: the data signer runs the signature algorithm to generate a message signature;

[0046] In the Verify phase: the data verifier runs the verification algorithm to verify the message signature.

[0047] Furthermore, the above steps are detailed as follows:

[0048] In the Setup phase of the system initialization, the key generation center KGC runs the system initialization algorithm to generate the system's public parameters, master public key, and master private key, specifically including:

[0049] Given a known safety parameter of λ and a maximum number of time periods in the system of T, a complete binary tree BT is constructed, and the time periods t on the time axis are mapped to the nodes w of a complete binary tree in the order of pre-order traversal. Calculate the depth of the binary tree The key generation center KGC first selects a second type bilinear group Where e is a bilinear map p is a prime number and satisfies p>2 λ , are all additive cyclic groups of prime order p, is a multiplicative cyclic group of prime order p, with randomly selected generators Select a random number i0, in Let be a set of integers of order p not containing 0, and let the function H:{I0,I1}→{i0,i1} be:

[0050]

[0051] Select random number Two cryptographic hash functions Computing Group The element P in pub =αP, calculation group The element g=e(P pub,Q), let the input of the time conversion function T2PV be time period t, the output be the path vector of the time period t corresponding to the node w on the binary tree, select a byte-represented private key generation function identifier hid. The output system master public key mpk and master private key msk are:

[0052]

[0053] In the KeyGen stage, the key generation center KGC runs a key generation algorithm to generate an initial key for the user, specifically including:

[0054] Known user identity ID∈{0,1} * , the identifier ID is a string of any length consisting of 0 or 1. The key generation center KGC first generates a p Calculate the non-zero integer h1 = H1 (ID || hid, p), || is the cascade symbol, and select a random number And generate the root node key

[0055] The user private key is composed of a stack sT. The generated node key k is pushed into the stack sT.push(k), where push() represents the stack push operation. Let the user private key with the identity ID in time period 0 be sk ID|0 =ST.

[0056] In the key update phase, the key generation center KGC runs a key update algorithm to generate an updated key for the user, specifically including:

[0057] It is known that the private key of the user with the identity ID in time period t is sk ID|t , use stack ST to represent the user's private key, and pop a node key k from the stack = ST.pop(), where pop() is the operation of popping the top element of the stack. Call the time conversion function T2PV to generate the path vector of the binary tree node w corresponding to the time period t as (x0, x1, x2, ..., x d ), where x0=∈, ∈ represents the root node of the binary tree, x i ∈{I0,I1}, x represents the value of function H, I0 represents the left branch in the binary tree, I1 represents the right branch in the binary tree, d is the level number of node w, and d is required to be less than or equal to the depth l of the binary tree. If node w is a leaf node, set the private key sk for time period t+1 ID|t+1 =ST, the operation ends and returns. If node w is a non-leaf node, it is necessary to generate the keys k0 and k1 of the left and right child nodes of node w respectively, and first push the key k1 of the right node into the stack, and then push the key k0 of the left node into the stack. Suppose the key k of node w is in the form of: (a0, a1, b d+1,b d+2 ,…,b l ), where a0, a1 represent the part of the private key containing the user identification information, {b i} i∈{d+1,…,l} represents the proxy private key used for timestamp update, {Q i} i∈{d+1,…,l} Represents the group selected from layer d+1 to layer l The generator on , select a random number The left child node key k0 is calculated as:

[0058]

[0059]

[0060] in Indicates the updated left child node key k0 contains the part of the private key of the user identification information, Represents the proxy private key used for timestamp update in the updated left child node key k0.

[0061] Pick a random number The calculation method of the right child node key k1 is:

[0062]

[0063]

[0064] in Indicates the updated right child node key k1 contains the partial private key of the user identification information, Represents the proxy private key used for timestamp update in the updated right child node key k1.

[0065] In the Sign phase, the data signer runs the signature algorithm to generate a message signature, which specifically includes:

[0066] Let the message to be signed be M∈{0,1} * , M is a string of any length consisting of 0 or 1, let the signer's identifier be ID, and use the stack ST to represent the corresponding user private key sk ID|t =ST, get the top element of the stack, that is, the binary tree node key k of the current period = ST.getTop(), the key k is recorded as: (a0, a1, b d+1 ,b d+2 ,…,b l ), the signer performs the following operation to generate the signature of message M: select a random number calculate The element z=g s, calculate the integer h = H2(M||z,p), calculate the integer y = (sh) mod p, and calculate The elements S0=y·a0, S1=y·a1 in the output message M are signature σ=(h, S0, S1).

[0067] In the Verify phase, the data verifier runs the verification algorithm to verify the message signature pair, including:

[0068] In order to distinguish the message M from the signature σ in the signature algorithm, M is used here ′ Represents the message input in the verification algorithm, and σ ′ =(h′,S0′,S1′) represents the message signature input in the verification algorithm, h′ represents the integer information contained in the message signature in the verification algorithm, S′0,S′1 represents the two integers contained in the message signature in the verification algorithm The time conversion function T2PV is called to generate the path vector of the binary tree node w corresponding to the time period t as (x0, x1, x2, ..., x d ), the verifier performs the following operations to verify the validity of the signature: The element u=g h′ , calculate the integer h1 = H1 (ID || hid, p), calculate The element C1=P pub +h1P, calculation Elements in calculate Elements in calculate Take the element z′=u·v in M′, calculate the integer h2=H2(M′||z′,p), and check whether h2=h′. If so, the verification succeeds and outputs “1”; otherwise, the verification fails and outputs “0”.

[0069] The present invention adopts the above technical solution, utilizes the characteristics of the SM9 algorithm, and combines the hierarchical encryption design principle to propose an SM9 signature algorithm with forward security. The present invention introduces a key update mechanism to ensure that the signature generated in the past is not forged even in the case of private key leakage. This signature mechanism can not only resist the risks brought by key leakage, but also effectively manage the user's key life cycle and enhance the robustness of the system.

[0070] Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians of the art without making creative work are within the scope of protection of the present application.

Claims

1. A forward secure identification signature method based on commercial secret SM9, characterized in that: It includes three types of entities, namely the key generation center KGC, data signer and data verifier. The method is divided into five stages: system initialization Setup, key generation KeyGen, key update Update, signature Sign and verification Verify. The specific steps are as follows; S1, in the system initialization Setup phase: the key generation center KGC runs the system initialization algorithm to generate the system's public parameters, master public key, and master private key; S2, in the key generation KeyGen phase: the key generation center KGC runs the key generation algorithm to generate an initial key for the user; S3, in the key update phase: the key generation center KGC runs the key update algorithm to generate an updated key for the user; S4, in the Sign phase: the data signer runs the signature algorithm to generate a message signature; S5, in the Verify phase: the data verifier runs the verification algorithm to verify the message signature.

2. A forward secure identification signature method based on commercial secret SM9 according to claim 1, characterized in that: The S1 system initialization Setup phase specifically includes: S1-1, obtain the known security parameter λ and the maximum number of time periods T of the system, and construct a complete binary tree BT; map the time period t on the time axis to the node w of the complete binary tree in the order of pre-order traversal; S1-2, calculate the depth of the binary tree S1-3, the key generation center KGC first selects a second type bilinear group Where e is a bilinear map e: p is a prime number and satisfies p>2 λ , are all additive cyclic groups of prime order p, G T is a multiplicative cyclic group of prime order p; S1-4, randomly select generators Select random number in Let be a set of integers of order p not containing 0, and let the function H:{I0,I1}→{i0,i1} be: Where x represents the value of function H; I0 represents the left branch in the binary tree, and I1 represents the right branch in the binary tree; S1-5, select random number Two cryptographic hash functions Computing Group The element P in pub =αP, calculation group The element g=e(P pub , Q); S1-6, let the input of the time conversion function T2PV be the time period t, the output be the path vector of the time period t corresponding to the node w on the binary tree, and select a private key generation function identifier hid represented by a byte; S1-7, output the system master public key mpk and master private key msk as follows:

3. A forward secure identification signature method based on commercial secret SM9 according to claim 2, characterized in that: The key generation phase of S2 specifically includes: S2-1, obtain user identity ID∈{0,1} * , the identifier ID is a string of any length consisting of 0 or 1; S2-2, the key generation center KGC firstly generates a key in the finite field F p Calculate the non-zero integer h1 = H1 (ID || hid, p), || is the cascade symbol, select a random number And generate the root node key S2-3, the user private key is composed of a stack ST, and the generated node key k is pushed into the stack ST.push(k), where push() represents the stack push operation. Let the user private key with identity ID in time period 0 be sk ID|0 =ST.

4. A forward secure identification signature method based on commercial secret SM9 according to claim 3, characterized in that: The S3 key update phase specifically includes: S3-1, obtain the private key of the user with the identity ID in time period t as sk ID|t , use stack ST to represent the user's private key, and pop a node key k = ST.pop() from the stack, where pop() is the operation of popping the top element of the stack; S3-2, call the time conversion function T2PV to generate the path vector of the binary tree node w corresponding to the time period t as (x0, x1, x2, ..., x d ), where x0=∈, ∈ represents the root node of the binary tree, x i ∈{I0, I1}, I0 represents the left branch in the binary tree, I1 represents the right branch in the binary tree, d is the level number of the node w, and d is required to be less than or equal to the depth l of the binary tree; S3-3, determine whether node w is a leaf node; if so, set the private key sk for time period t+1 ID|t+1 =ST, the operation ends and returns; otherwise, generate the keys k0 and k1 of the left and right child nodes of node w respectively, and push the key k1 of the right node into the stack first, and then push the key k0 of the left node into the stack.

5. A forward secure identification signature method based on commercial secret SM9 according to claim 4, characterized in that: The specific steps for generating the keys k0 and k1 of the left and right child nodes of node w in S3-3 are: S3-3-1, suppose the key k of node w is in the form of: (a0, a1, b d+1 , b d+2 , ..., b l ), where a0, a1 represent the part of the private key containing the user identification information, {b i } i∈{d+1，...，l} represents the proxy private key used for timestamp update, {Q i } i∈{d+1，...，l} Represents the group selected from layer d+1 to layer l The generator on , select a random number The left child node key k0 is calculated as: in, Indicates the updated left child node key k0 contains the part of the private key of the user identification information, Represents the proxy private key used for timestamp update in the updated left child node key k0; S3-3-2, select random number The calculation method of the right child node key k1 is: in Indicates the updated right child node key k1 contains the partial private key of the user identification information, Represents the proxy private key used for timestamp update in the updated right child node key k1.

6. A forward secure identification signature method based on commercial secret SM9 according to claim 4, characterized in that: The S4 signature phase specifically includes: S4-1, let the message to be signed be M∈{0,1} * , M is a string of any length consisting of 0 or 1, let the signer's identifier be ID, and use the stack ST to represent the corresponding user private key sk ID|t =ST; S4-2, get the top element of the stack, that is, the binary tree node key k of the current period = ST.getTop(), the key k is recorded as: (a0, a1, b d+1 , b d+2 , …, b l ); S4-3, the signer generates a signature for message M: select a random number calculate The element z=g s , calculate the integer h = H2(M||z, p), calculate the integer y = (sh) mod p, and calculate The elements S0=y·a0, S1=y·a1 in the output message M are signature σ=(h, S0, s1).

7. A forward secure identification signature method based on commercial secret SM9 according to claim 6, characterized in that: The S5 verification phase specifically includes: S5-1, M' represents the message input in the verification algorithm, σ' = (h', s0', S1') represents the message signature input in the verification algorithm, h' represents the integer information contained in the message signature in the verification algorithm, S0', S1' represent the two integers contained in the message signature in the verification algorithm. Elements in S5-2, calling the time conversion function T2PV to generate the path vector of the binary tree node w corresponding to the time period t is (x0, x1, x2, ..., x d ), S5-3, the verifier verifies the validity of the signature: calculate G T The element u=g h , calculate the integer h1=H1(ID||hid,p), calculate The element C1=P pub +h1P, calculation Elements in calculate Elements in calculate The element z′=u·v in , calculate the integer h2=H2(M′||z′,p); S5-4, check whether h2=h′ holds; if so, the verification passes and outputs “1”; otherwise, the verification fails and outputs “0”.

Images