Verifiable key sharing method based on elliptic curve public key cryptographic algorithm and SM3 password hash algorithm

Abstract

The invention provides a verifiable key sharing method based on an elliptic curve public key cryptographic algorithm and an SM3 cryptographic hash algorithm, which comprises a key distribution step and a key reconstruction step, a public key, a private key and an authenticable value are distributed to each participant, a pair of public and private keys is used for confirming the identity of the participant, and the authenticable value is used for authenticating the identity of the participant. The authenticable value is used for verifying the compliance of the key segment provided by the participant in a subsequent key reconstruction phase. A Shamir scheme based on Lagrange interpolation is adopted for key fragment distribution and shared key value recovery, so that key fragment distribution and an algorithm for recovering an original key by using a key fragment are correct after verification for many years. The difficulty of successfully realizing the key sharing by the non-compliant participant or the fraud party is the same as the difficulty of cracking the offline logarithm problem of the elliptic curve, and the probability is very low, so that the method provided by the invention is unconditionally safe. According to the invention, key sharing of non-compliant participants or fraudulent parties is avoided, and the security is high.

Description

Technical Field

[0001] The invention relates to a verifiable key sharing method based on an elliptic curve public key cryptographic algorithm and an SM3 cryptographic hash algorithm. Background Art

[0002] Cryptography is the core technology to ensure the security of cyberspace. According to modern cryptographic systems, the security of keys is the basis for ensuring the cryptographic system. Among them, key sharing is a key research topic in the field of information security. Shamir proposed the concept of key sharing in 1979 and proposed a (k,n) threshold key sharing scheme based on the Lagrange interpolation formula. Therefore, key sharing provides a new idea and direction for key management technology. Many researchers are committed to the research of key sharing mechanism.

[0003] By participants P1, P2, ..., P n The key sharing mechanism formed by the key distributor D generally includes two processes: (1) Key distribution process: In this process, the key distributor D shares the key s among n participants, and each participant P i A fragment is distributed i ,i=1,2,…,n. (2) Key reconstruction process: In this process, any number of participants, not less than k, cooperate to reconstruct the original key s using their distributed fragments as input.

[0004] The above key sharing mechanism must meet the following conditions: (1) any k participants can cooperate to recover the original key s through their respective distributed fragments; (2) if there are fewer than k participants, it is impossible to cooperate to recover the original key s.

[0005] The (k,n) threshold key sharing scheme proposed by Shamir is based on polynomial interpolation. On a given two-dimensional plane, there are (x1,y1),(x2,y2),…,(x k ,y k ) and other k points, for different x i , there is only one k-1 degree polynomial q(x) that satisfies q(x i )=y i , (i=1,2,…,k). For an integer Z, in order to divide it into n parts, randomly select a k-1 degree polynomial q(x)=a0+a1x+…+a k-1 x k-1 , where a0=Z, the distributable fragments are as follows:

[0006] Z1=q(1),…,Z i =q(i),…,Z n =q(n).

[0007] In the set {(1,Z1),(2,Z2),…,(1,Z n )}, and according to the Lagrange interpolation formula, the key fragments of any k authorized members are calculated polynomials: make therefore

[0008] The coefficients of the polynomial q(x) can be determined to obtain Z=q(0), that is, the data Z can be reconstructed.

[0009] In the above research process of the key sharing scheme, there is a premise that the key fragment holders in the scheme are all trustworthy. However, in reality, such an assumption is not necessarily true in all cases. Once the key distributor sends the wrong key fragment to one or more participants, or the key fragment holder provides a false key fragment during the reconstruction phase, the original key cannot be recovered, which ultimately damages the interests of other compliant participants. Summary of the invention

[0010] In view of the shortcomings of the (k, n) threshold key sharing scheme proposed by Shamir, the present invention provides a verifiable key sharing method based on elliptic curve public key cryptography algorithm and SM3 cryptographic hash algorithm to prevent non-compliant participants or fraudulent parties from achieving key sharing.

[0011] The technical solution adopted by the present invention to solve the technical problem is: a verifiable key sharing method based on elliptic curve public key cryptography algorithm and SM3 cryptographic hash algorithm, including key distribution and key reconstruction, characterized in that:

[0012] The key distribution comprises the following steps:

[0013] Step 1: Select a k-1 degree polynomial f(x) = b k-1 x k-1 +…+b1x+smodp, where b1,b2,…,b k-1 and f(x) both belong to F p ;

[0014] Step 2: For i=1,2,…,n, perform the following processing:

[0015] (a) Calculate m i =f(i), m i As a participant P i The private key of i =(x i ,y i )=[m i ]G;

[0016] (b) Let ZAi =SM3(len i ||ID i ||a||b||x G ||y G ||x i ||y i ), use the SM3 cryptographic hash function to obtain the hash value Z of the i-th key sharing participant Ai ;

[0017] (c)Z Ai As a bit string type, first convert Z Ai Convert to a byte string, then convert the byte string to an integer, and convert Z Ai The data type is converted to an integer;

[0018] (d) Generate a random number u∈[1,N-1] using a random number generator;

[0019] (e) Calculate the elliptic curve point (x ui ,y ui )=[u]G,x ui As F p The domain elements in x are converted to integers according to the method of converting domain elements to integers. ui The data type is converted to an integer;

[0020] (f) Calculate r i =(Z Ai +x ui )modN, if r i =0 or r i +u=N, then return (d);

[0021] (g) Calculate s i =((1+m i ) -1 ·(ur i ·m i ))modN, if s i =0, then return (d);

[0022] (h) According to the method of converting integer to byte string, r i ,s i Convert the data type to a string, and then i ,s i ) as a participant P i The authentication value.

[0023] The key reconstruction comprises the following steps:

[0024] Step 1: The reconstructor verifies the authentication value (r i ',si '), as a verifier, the following operation steps should be implemented to determine that the reconstruction participant is compliant and the key fragment held is correct;

[0025] For i = 1, 2, ..., n, the following processing is performed:

[0026] (a) Test r i '∈[1,N-1] and s i '∈[1,N-1] is true, if not, the participant may be a fraud and cannot participate in key reconstruction;

[0027] (b) Calculation of Z Ai =SM3(len i ||ID i ||a||b||x G ||y G ||x i ||y i ), use the SM3 cryptographic hash function to find the i-th key to reconstruct the hash value Z of the participant Ai ;

[0028] (c)Z Ai As a bit string type, first convert Z Ai Convert to a byte string, then convert the byte string to an integer, and convert Z Ai The data type is converted to an integer;

[0029] (d) According to the method of converting integer to byte string, (r i ',s i ') is converted to an integer and t = (r i '+s i ')modN, if t=0, the participant may be a fraud and cannot participate in key reconstruction;

[0030] (e) Calculate the elliptic curve point (x' ui ,y' ui )=[s i ']G+[t]P i ;

[0031] (f)x' ui As F p The domain elements in x' are converted to integers according to the method of converting domain elements to integers. ui The data type is converted to an integer, and R = (Z Ai +x' ui )modN, check R = r i 'Whether it is established, if it is established, it means that the participant is compliant, otherwise it cannot participate in key reconstruction;

[0032] Step 2: Select any k compliant participants from the n participants to reconstruct the key. Suppose P1, P2, …, P k If they collaborate, then using the k key fragments they assign, we can get k interpolation points (1,m1), (2,m2), …, (k,m k ), and then Lagrange interpolation can be used to generate a k-1 degree polynomial f(x), so that s = f(0), and the key s can be recovered;

[0033] The beneficial effects of the present invention are as follows: the key fragment distribution and the recovery of the shared key value adopt the Shamir scheme based on Lagrange interpolation, so the key fragment distribution and the algorithm for recovering the original key using the key fragment have been verified to be correct for many years. The verification of whether the participants are compliant is based on the elliptic curve discrete logarithm problem, that is, the difficulty for non-compliant participants or fraudulent parties to successfully achieve key sharing is the same as the difficulty of cracking the elliptic curve offline logarithm problem, and the probability is very low, so the method proposed by the present invention is unconditionally secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is the key distribution process;

[0035] Figure 2 This is the key reconstruction process. DETAILED DESCRIPTION

[0036] 1. The relevant parameters of the present invention are defined as follows:

[0037] The main parameter symbols involved in the present invention are explained as shown in Table 1.

[0038] Table 1 Symbols

[0039]

[0040] Prime field: Let p (p>3) be an odd prime number, F p It consists of p elements in {0,1,2,…,p-1}, and p>2 191 , has the following properties:

[0041] (1) The additive identity is the integer 0;

[0042] (2) The multiplicative identity is the integer 1;

[0043] (3) The addition of domain elements is the addition of integers modulo p, that is, if a, b∈F p , then a+b=(a+b)modp;

[0044] (4) The multiplication of domain elements is integer modulo p multiplication, that is, if a, b∈F p, then a·b=(a·b)modp.

[0045] Defined in F p The equation of the elliptic curve on is:

[0046] y 2 =x 3 +ax+ba,b∈F p , and (4a 3 +27b 2 )modp≠0

[0047] Elliptic Curve E(F p ) is defined as:

[0048] E(F p )={(x,y)x,y∈F p , and satisfies equation (1)}∪{O}, where O is the point at infinity.

[0049] Let point G = (x G ,y G )(G≠O) is the elliptic curve E(F p ) is a base point whose order is a prime number, where x G and G Yes F p The two elements in . <g>Represents the cyclic group generated by the base point G.

[0050] Elliptic curve multiple point operations:

[0051] Multiple additions of the same point on an elliptic curve are called multiple point operations of the point. Let k be a positive integer, P be a point on the elliptic curve, and the k-times addition of point P is called the k-times point operation of point P, denoted by Because [k]P=[k-1]P+P, the k-fold point can be obtained recursively.

[0052] Known elliptic curve E(F p ), the point G∈E(F p ) and Q∈ <g>, the elliptic curve discrete logarithm problem refers to determining an integer l∈[0,N-1] such that Q=[l]G holds.

[0053] 2. The data type conversion involved in the present invention is explained as follows:

[0054] 1. Conversion from integer to byte string:

[0055] Input: non-negative integer x, and target length k of byte string (where k satisfies 2 8k >x).

[0056] Output: A byte string M of length k.

[0057] a) Let M k-1 ,M k-2 ,…,M0 is the leftmost to rightmost byte of M;

[0058] b) The bytes of M satisfy:

[0059] 2. Conversion from byte string to integer:

[0060] Input: A byte string M of length k.

[0061] Output: Integer x.

[0062] a) Let M k-1 ,M k-2 ,…,M0 is the leftmost to rightmost byte of M;

[0063] b) Convert M to an integer x:

[0064] 3. Conversion from bit string to byte string:

[0065] Input: A bit string s of length m.

[0066] Output: A byte string M of length k, where

[0067] a) Assume s m-1 ,s m-2 ,…,s0 is the bit from the leftmost to the rightmost bit of s;

[0068] b) Let M k-1 ,M k-2 ,…,M0 is the leftmost to rightmost byte of M, then

[0069] M i =s 8i+7 s 8i+6 …s 8i+1 s 8i , where 0≤i<k; when 8i+j≥m(0<j≤7), s 8i+j =0.

[0070] 4. Conversion from byte string to bit string:

[0071] Input: A byte string M of length k.

[0072] Output: A bit string s of length m, where m = 8k.

[0073] a) Let M k-1 ,M k-2 ,…,M0 is the leftmost to rightmost byte of M;

[0074] b) Assume s m-1 ,s m-2 ,…,s0 is the bit from the leftmost to the rightmost of s, then s i (0≤i<m) is M j The i-8j+1th bit from the right, where

[0075] 5. Conversion of domain elements to byte strings:

[0076] Input: F p The element α in .

[0077] Output: length The byte string S, where

[0078] a) If p is an odd prime number, then α must be an integer in the interval [0, p-1]. α is converted into a byte string S of length l according to the integer to byte string conversion method;

[0079] b) If p = 2 m , then α must be a bit string of length m, and α is converted into a byte string S of length l according to the bit string to byte string conversion method.

[0080] 6. Conversion from byte string to domain element:

[0081] Input: F p The type and length are A byte string S, where

[0082] Output: F p The element α in .

[0083] a) If p is an odd prime number, convert S to an integer α using the byte string to integer conversion method. If Then an error is reported;

[0084] b) If p = 2 m , then convert S into a bit string α of length m according to the byte string to bit string conversion method.

[0085] 7. Conversion of domain elements to integers:

[0086] Input: F p The element α in .

[0087] Output: Integer x.

[0088] a) If p is an odd prime number, then x = α (no conversion is required);

[0089] b) If p = 2 m , then α must be a bit string of length m, let s m-1 ,s m-2 ,…,s0 is the leftmost to rightmost bit of α, convert α to integer x:

[0090] 3. Implementation process of the present invention:

[0091] The key to be shared in this key sharing scheme is s.

[0092] n key sharing parties P1, P2, ..., P n They have length len i The identifiable ID i .

[0093] A verifiable key sharing method based on elliptic curve public key cryptography algorithm and SM3 cryptographic hash algorithm includes the following two processes: a key distribution process and a key reconstruction process.

[0094] Key distribution process:

[0095] Step 1: Select a k-1 degree polynomial f(x) = b k-1 x k-1 +…+b1x+smodp, where b1,b2,…,b k-1 and f(x) both belong to F p ;

[0096] Step 2: For i=1,2,…,n, perform the following processing:

[0097] (a) Calculate m i =f(i), m i As a participant P i The private key of i =(x i ,y i )=[m i ]G;

[0098] (b) Let Z Ai =SM3(len i ||ID i ||a||b||x G ||y G ||x i ||y i ), use the SM3 cryptographic hash function to find the hash value Z of the i-th key sharing participant Ai ;

[0099] (c)Z Ai As a bit string type, first convert Z Ai Convert to a byte string, then convert the byte string to an integer, and convert Z Ai The data type is converted to an integer;

[0100] (d) Generate a random number u∈[1,N-1] using a random number generator;

[0101] (e) Calculate the elliptic curve point (x ui ,y ui )=[u]G, change x ui The data type is converted to an integer;

[0102] (f) Calculate r i =(Z i +x ui )modN, if r i =0 or r i +u=N, then return (d);

[0103] (g) Calculate s i =((1+m i ) -1 ·(ur i ·m i ))modN, if s i =0, then return (d);

[0104] (h) r i ,s i Convert the data type to a string, and then i ,s i ) as a participant P i The authentication value.

[0105] Key reconstruction process:

[0106] Step 1: The reconstructor verifies the authentication value (r i ',s i ') to verify that the party is compliant and the key fragments it holds are correct. For i = 1, 2, ..., n, the following processing is performed:

[0107] (a) Test r i '∈[1,N-1] and s i '∈[1,N-1] is true, if not, the participant may be a fraud and cannot participate in key reconstruction;

[0108] (b) Calculation of Z Ai =SM3(len i ||ID i ||a||b||x G ||y G ||x i ||y i ), use the SM3 cryptographic hash function to find the i-th key to reconstruct the hash value Z of the participant Ai ;

[0109] (c) Z Ai The data type is converted to an integer;

[0110] (d) i ',s i ') is converted to an integer and t = (r i '+s i ')modN, if t=0, the participant may be a fraud and cannot participate in key reconstruction;

[0111] (e) Calculate the elliptic curve point (x' ui ,y' ui )=[s i ']G+[t]P i ;

[0112] (f)x' ui As F p The domain elements in x' are converted to integers according to the method of converting domain elements to integers. ui The data type is converted to an integer, and R = (Z Ai +x' ui )modN, check R = r i 'Whether it is established, if it is established, it means that the participant is compliant, otherwise it cannot participate in key reconstruction.

[0113] Step 2: Select any k compliant participants from the n participants to reconstruct the key. Suppose P1, P2, …, P k If they collaborate, then using the k key fragments they assign, we can get k interpolation points (1,m1), (2,m2), …, (k,m k ), and then use Lagrange interpolation to generate a k-1 degree polynomial f(x), so that s = f(0), and the key s can be recovered.

[0114] In the key distribution process, the present invention allocates a public key, a private key, and an authenticatable value to each participant. A pair of public and private key pairs is used to confirm the identity of the participant, and the authenticatable value is used to verify the compliance of the key fragments provided by the participant in the subsequent key reconstruction stage. The key fragment distribution and the recovery of the shared key value adopt the Shamir scheme based on Lagrange interpolation, so the distribution of key fragments and the algorithm for recovering the original key using the key fragments have been verified to be correct over many years. The verification of whether the participant is compliant is based on the elliptic curve discrete logarithm problem, that is, the difficulty for a non-compliant participant or a fraudulent party to successfully achieve key sharing is the same as the difficulty of cracking the elliptic curve offline logarithm problem, and the probability is very low, so the method proposed by the present invention is unconditionally secure.< / g> < / g>

Claims

1. A verifiable key sharing method based on elliptic curve public key cryptography algorithm and SM3 cryptographic hash algorithm, including key distribution and key reconstruction, characterized in that: The key distribution comprises the following steps: Step 1: Select a k-1 degree polynomial f(x) = b k-1 x k-1 +…+b1x+smodp, where b1,b2,…,b k-1 and f(x) both belong to F p ; Step 2: For i=1,2,…,n, perform the following processing: (a) Calculate m i =f(i), m i As a participant P i The private key of i =(x i ,y i )=[m i ]G; (b) Let Z Ai = SM3(len i || ID i || a || b || x G || y G || x i || y i ); (c)Z Ai As a bit string type, first convert Z Ai Convert to a byte string, then convert the byte string to an integer, and convert Z Ai The data type is converted to an integer; (d) Generate a random number u∈[1,N-1] using a random number generator; (e) Calculate the point (x) on the elliptic curve ui ,y ui )=[u]G,x ui As F p The domain elements in x are converted to integers according to the method of converting domain elements to integers. ui The data type is converted to an integer; (f) Calculate r i =(Z Ai +x ui )modN, if r i =0 or r i +u=N, then return (d); (g) Calculate s i =((1+m i ) -1 ·(ur i ·m i ))modN, if s i =0, then return (d); (h) According to the method of converting integer to byte string, r i ,s i Convert the data type to a string, and then i ,s i ) as a participant P i The authentication value of The key reconstruction comprises the following steps: Step 1: The reconstructor verifies the authentication value (r i ',s i ') to verify that the party is compliant and the key fragments it holds are correct; for i = 1, 2, ..., n, the following processing is performed: (a) Test r i '∈[1,N-1] and s i '∈[1,N-1] is true, if not, the participant may be a fraud and cannot participate in key reconstruction; (b) Calculation of Z Ai =SM3(len i ||ID i ||a||b||x G ||y G ||x i ||y i ), use the SM3 cryptographic hash function to find the i-th key to reconstruct the hash value Z of the participant Ai ; (c)Z Ai As a bit string type, first convert Z Ai Convert to a byte string, then convert the byte string to an integer, and convert Z Ai The data type is converted to an integer; (d) According to the method of converting integer to byte string, (r i ',s i ') is converted to an integer and t = (r i '+s i ')modN, if t=0, the participant may be a fraud and cannot participate in key reconstruction; (e) Calculate the elliptic curve point (x' ui ,y' ui )=[s i ']G+[t]P i ; (f)x' ui As F p The domain elements in x' are converted to integers according to the method of converting domain elements to integers. ui The data type is converted to an integer, and R = (Z Ai +x' ui )modN, check R = r i 'Whether it is established, if it is established, it means that the participant is compliant, otherwise it cannot participate in key reconstruction; Step 2: Select any k compliant participants from the n participants to reconstruct the key. Suppose P1, P2, …, P k If they collaborate, then using the k key fragments they assign, we can get k interpolation points (1,m1), (2,m2), …, (k,m k ), and then Lagrange interpolation can be used to generate a k-1 degree polynomial f(x), so that s = f(0), and the key s can be recovered; Among them, F p is a prime field containing p elements; s is the key to be shared; G is a base point of the elliptic curve, whose order is a prime number; P i =(x i ,y i ) is the public key of the key participant (i=1,2,…,n); ID i is the distinguishable identifier of the key sharing participant; len i ID i The length of F; a, b are p The elements in F p An elliptic curve on G(x G ,y G ) is a base point of the elliptic curve, whose order is a prime number; E(F p ) is F p The set of all rational points on the elliptic curve, including the point O at infinity.

Images