SM2 digital signature algorithm spatial impedance confusion protection method

Abstract

The invention belongs to the technical field of identity authentication, and discloses an SM2 digital signature algorithm spatial impedance confusion protection method. The method comprises the following steps: step 1, key generation; step 2, confusion; step 3, signature; and step 4, signature verification. Four algorithms including a key generation algorithm, a confusion algorithm, a signature algorithm and a signature verification algorithm are used in the steps. Based on a spatial impedance confusion method, an original signature algorithm using a private key is confused into a signature algorithm using a lookup table, and the method has the following characteristics: (1) the security is high: private key information is hidden in the lookup table, so that the risk of private key exposure caused by side channel attack is effectively reduced; the method has provable white box safety and reliable black box safety; and (2) the compatibility is strong: the signature generated by the confused signature algorithm can be verified by the SM2 standard signature verification algorithm. The embodiment of the invention shows that the method has relatively high performance and economical energy consumption.

Description

Technical Field

[0001] The present invention belongs to the technical field of identity authentication, and in particular relates to a spatial impedance confusion protection method for an SM2 digital signature algorithm. Background Art

[0002] SM2 is a public key cryptographic algorithm suite based on elliptic curves, published as a Chinese national standard (GBT.32918-2016). The suite includes digital signature algorithms, key exchange protocols, and public key encryption algorithms, among which the SM2 digital signature algorithm has been adopted as an international standard (ISO / IEC.14888-2018). OpenSSL, a well-known open source encryption tool library in the field of secure communications, also supports the implementation of the SM2 digital signature algorithm.

[0003] The digital signature algorithm should have reliable security to prevent key leakage, and no one except the key owner can obtain the private key. Otherwise, once a malicious user obtains the private key, he can impersonate the key owner to generate a digital signature. Under the black box attack model, the SM2 digital signature algorithm can have high security. This model assumes that the cryptographic algorithm is like a black box in the eyes of the attacker, that is, the attacker can only intercept or query the input and output pairs of the algorithm in this model, but cannot access the algorithm code, intermediate variables or execution traces. This assumption is only valid when the channel is insecure but the computing device is trustworthy.

[0004] However, the actual application scenarios of the SM2 digital signature algorithm are relatively complex, and the assumptions of the black box attack model do not always hold. This is because SM2 is usually executed in an untrusted environment, and attackers are able to access the internal design of the algorithm implementation or observe its dynamic execution process. In the case of controlling the execution environment, the attacker can use side channel attacks to extract the signature private key of SM2. In addition, some blockchain nodes running digital signatures are deployed in cloud virtual machines, which are vulnerable to shared cache attacks. If the virtual machine controlled by the attacker is located on the same host as the virtual machine running the blockchain, the former can illegally access the private data on the latter, including the signature private key.

[0005] Given the high susceptibility of SM2 to side-channel attacks, it is crucial to design an effective defense method. Although various countermeasures have been proposed to deal with side-channel attacks, most of them have certain limitations. For example, Das et al. mentioned in the paper "STELLAR: A generic EM side-channel attack protection through ground-uproot-cause analysis" that providing specific electromagnetic shielding to computing devices can effectively reduce the intensity of electromagnetic radiation. Executing cryptographic algorithms in trusted execution environments such as ARM TrustZone and Intel Software Guard Extensions (SGX) can also make signals leaked from side channels difficult to observe. However, these solutions can either only target one or several types of side-channel attacks, or have certain security vulnerabilities. Summary of the invention

[0006] The technical solution of the present invention is as follows:

[0007] A spatial impedance obfuscation protection method for an SM2 digital signature algorithm, suitable for counteracting side channel attacks, comprising:

[0008] Step 1: key generation;

[0009] Step 2: Obfuscation;

[0010] Step 3 Signature;

[0011] Step 4: Signature verification.

[0012] The purpose of the present invention is to solve the shortcomings of the existing SM2 signature private key anti-side channel attack protection method to improve the security of the SM2 private key in the signing process. The present invention uses a spatial impedance obfuscation protection method to hide the private key information by converting the original program into an obfuscated program with a larger code volume and difficult to understand without changing the function of the cryptographic program. If the code volume obtained by the attacker is less than a certain threshold, the attacker cannot extract the hidden information.

[0013] Specifically, the present invention is based on Lagrange interpolation. First, the private key of the SM2 digital signature scheme is split into secret fragments to be integrated into a lookup table, which also contains other built-in parameters in the SM2 signature algorithm. Subsequently, the present invention adopts a new signature algorithm that uses a lookup table instead of a private key to generate a signature. The signature generated by the new signature algorithm designed by the present invention is fully compatible with the verification algorithm of the standard SM2 signature. The present invention has provable security, and the probability of calculating the original private key information is negligible when the code volume obtained by the attacker is limited. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a structural diagram of the lookup table T = (T1, T2, T3);

[0015] Figure 2 A flowchart of the practical application of the present invention;

[0016] Figure 3 Obfuscation algorithm SHObf for different exposed volumes sign Performance test results of

[0017] Figure 4 Obfuscating signature algorithms for different exposed volumes Performance test results of

[0018] Figure 5 SHObf for different exposed volumes sign and Algorithm energy consumption test results; DETAILED DESCRIPTION

[0019] The present invention belongs to the field of identity authentication technology, and discloses a spatial impedance obfuscation protection method for an SM2 digital signature algorithm. The method comprises: step 1 key generation, step 2 obfuscation, step 3 signature, and step 4 signature verification. The above steps use four algorithms, including: key generation algorithm, obfuscation algorithm, signature algorithm, and signature verification algorithm. Based on the spatial impedance obfuscation method, the present invention obfuscates the original signature algorithm using a private key into a signature algorithm using a lookup table, and has the following characteristics: (1) high security: the private key information is hidden in the lookup table, thereby effectively reducing the risk of private key exposure due to side channel attacks, and has provable white box security and reliable black box security; (2) strong compatibility: the signature generated by the obfuscated signature algorithm can be verified by the SM2 standard signature verification algorithm. The embodiment shows that the present method has high performance and economical energy consumption. The technical solution provided by the present invention will be further described below in conjunction with specific embodiments and their accompanying drawings.

[0020] The symbols used in the present invention are shown in Table 1.

[0021] Table 1 Symbols used in the present invention

[0022]

[0023]

[0024] A spatial impedance confusion protection method for an SM2 digital signature algorithm, characterized in that it comprises the following steps:

[0025] Step 1: key generation;

[0026] Step 2: Obfuscation;

[0027] Step 3 Signature;

[0028] Step 4: Signature verification;

[0029] The above steps 1 and 4 reuse the SM2 national standard key generation algorithm and are therefore not original to the present invention.

[0030] Furthermore, the step 1 comprises:

[0031] Step 1.1 The signer generates a key pair based on the security parameters. The key generation algorithm is as described in Algorithm 1:

[0032] Algorithm 1: Key generation algorithm KeyGen(1 λ ), whose input λ∈N (N is a set of natural numbers) is a specified security parameter, and the output is a key pair (d,P). The process includes:

[0033] S1.1.1 From the finite field Z q Uniformly randomly select elements from;

[0034] S1.1.2 Calculate P = dG, where G is the base point of the elliptic curve group;

[0035] S1.1.3 outputs a key pair (d, P), where the private key is d and the public key is P;

[0036] Step 1.2 After Algorithm 1 is executed, the signer needs to make the public key P public, while the private key d needs to be kept secret for the obfuscation step (step 2).

[0037] Furthermore, the step 2 comprises:

[0038] Step 2.1 The signer generates a standard signature circuit based on the key pair (d, P) and the public parameter pub

[0039] Step 2.2 The signer executes Algorithm 2 to confuse the standard signature circuit; Algorithm 2 is designed as follows:

[0040] Algorithm 2: Obfuscation algorithm Its input M is the exposed code volume, and its output is To confuse the signature circuit; the process of Algorithm 2 includes:

[0041] S2.2.1 Calculation of two integers

[0042] S2.2.2 Randomly generate logq t-order polynomials, labeled f i (x)(i=1,…,logq);

[0043] S2.2.3 Generate nlogq secret shares ki,j =f i (j), where i = 1, ..., logq and j = 1, ..., n, create Figure 1 The lookup table T1 shown in ;

[0044] S2.2.4 Randomly generate logq t-order polynomials with constant terms of 0, labeled g i (x)(i=1,…,logq);

[0045] S2.2.5 Generate nlogq shares of secret b i,j =g i (j), where i = 1, ..., logq and j = 1, ..., n;

[0046] S2.2.6 Calculation of u i,j =(1+d) -1 k i,j +b i,j (i=1,…,logq and j=1,…,n), create Figure 1 The lookup table T2 shown in ;

[0047] S2.2.7 Randomly generate logq t-order polynomials with constant terms of 1, labeled h i (x)(i=1,…,logq);

[0048] S2.2.8 Generate nlogq shares of secret c i,j =h i (j), where i = 1, ..., logq and j = 1, ..., n;

[0049] S2.2.9 Calculation of v i,j =d(1+d) -1 c i,j (i=1,…,logq and j=1,…,n), create Figure 1 The lookup table T3 shown in ;

[0050] S2.2.10 Create a lookup table T = (T1, T2, T3), such as Figure 1 As shown;

[0051] S2.2.11 Output

[0052] Step 2.3 The signatory party will Deploy to the device that needs to run the signature algorithm.

[0053] Furthermore, the step 3 comprises:

[0054] Step 3.1 The signer runs the signing device To generate a signature, the process is shown in Algorithm 3:

[0055] Algorithm 3: Obfuscated Signature Circuit (i.e., signature algorithm), whose input m is the message to be signed, and output σ is the signature; the process of Algorithm 3 includes:

[0056] S3.1.1 Parse the lookup table T into (T1, T2, T3);

[0057] S3.1.2 Calculate e = H(m) and e′ = H′(m), and let the l-th bit of e′ be γ(l) (l = 1, …, 256);

[0058] S3.1.3 For each i that satisfies γ(i) = 1, use the lookup table T1 to calculate k j G=∑k i,j G(j=1,…,n);

[0059] S3.1.4 Calculation and r = (e + r x )modq;

[0060] The Lagrange interpolation is defined as follows: Take any k+1 points (x0, y0)…(x k ,y k ), assuming that any two different x j are all different, and the formula for interpolating to obtain the unique k-degree polynomial L(x) is:

[0061]

[0062] It is worth noting that calculating L(x) in the definition does not mean obtaining the coefficients of its polynomial, but rather means that we can substitute any horizontal coordinate to obtain its vertical coordinate value on the polynomial. For example, we can calculate L(0) by definition. Represents the zero value of the polynomial obtained by interpolating multiple points (the horizontal coordinates of these points increase from 1 to n with a step size of 1 by default).

[0063] S3.1.5 For each i that satisfies γ(i) = 1, use the lookup table T2 to calculate u j =∑u i,j (j=1,…,n);

[0064] S3.1.6 Calculation

[0065] S3.1.7 For each i that satisfies γ(i) = 1, use the lookup table T3 to calculate v j =∑v i,j (j=1,…,n);

[0066] S3.1.8 Calculation

[0067] S3.1.9 Calculate s = (s1 - s2) mod q;

[0068] S3.1.10 Output σ = (r, s).

[0069] Step 3.2 broadcast the message m and signature σ = (r, s) to the message verifier;

[0070] Further, the step 4 comprises:

[0071] Step 4.1 The verification node receives the message m and signature σ = (r, s) broadcast by the signer;

[0072] Step 4.2 The verification node executes Algorithm 4 to verify whether the signature is legal; Algorithm 4 is designed as follows:

[0073] Algorithm 4: Verification algorithm Ver(m,σ,P), whose input m is the message, σ is the signature, and P is the public key of the signer; the process of Algorithm 4 includes:

[0074] S4.1 Verify r∈Z q , s∈Z q Is r+s≠q true? If not, output 0;

[0075] S4.2 Calculate (x′1, y′1) = sG + (r + s)P, r′ = (H(m) + r′ x )mod q;

[0076] S4.3 If r′=r, output 1, otherwise output 0.

[0077] Taking the Internet of Things (IoT) system as an example, the following introduces the various participants in this application scenario. Figure 2 :

[0078] The signatories in the Internet of Things (IoT) system are the users of each IoT device.

[0079] The devices deployed in an untrusted environment are embedded devices (such as surveillance cameras and sensors). The signer is the user of these IoT devices, and the verifier can be the IoT gateway used to verify the identity of the embedded device to be connected.

[0080] First, execute step 1 and run Algorithm 1 to generate their own key pairs. Then, the user executes step 2 and runs Algorithm 2 to convert their own private keys (d1,…,d n )Hidden in the obfuscated program In this paper, these programs will be deployed on embedded devices (device 1, ..., device n) in an untrusted environment. Then, the embedded device will execute step 3 and run algorithm 3 to generate a series of signatures. Finally, the signature verifier executes step 4 and runs algorithm 4 to verify whether the signature generated in step 3 is valid.

[0081] Figure 2 An intuitive description of the proposed method is given. To prevent key leakage, Algorithm 1KeyGen and Algorithm 2SHObf sign It should be executed in a trusted environment, otherwise the private keys used in these algorithms may be obtained by side-channel attacks. ) secure generation, which can be deployed in untrusted environments, and different devices can run their own To generate a digital signature. The operation process of is exposed to side channel attacks, and the characteristics of the lookup table T will also effectively protect the private key from being stolen. Since Algorithm 4Ver does not use private keys and is not related to key leakage, there is no requirement for its execution environment.

[0082] Test effect verification

[0083] The spatial impedance obfuscation protection method for the SM2 digital signature algorithm proposed in the present invention is tested on cloud virtual machines, embedded devices, personal computers and smart phones. The experimental equipment is shown in Table 2.

[0084] Table 2 Experimental equipment list

[0085]

[0086] The cloud virtual machines are Alibaba Elastic Compute Service c6 (Cloud VM-1) and Alibaba Elastic Compute Service hfc6 (Cloud VM-2). The embedded devices are two devices with different architectures, namely Raspberry Pi4Model B (Embedded device-1) using ARM Cortex architecture and UP2 Grove (Embedded device-2) using Intel x86 architecture. The smartphones are two Android smartphones, Honor Magic 4Pro (Smartphone-1) and Honor 60 (Smartphone-2). The personal computers are a thin and light Surface Laptop 4 (PC-1) and a gaming laptop HP OMEN 16 (PC-2).

[0087] Figure 3 For SHObf sign The execution time changes with M, where Figure 3(a) is the evaluation result on high-performance equipment. Figure 3 (b) is the evaluation result on resource-constrained devices. The results show that SHObf sign They can be completed in 27s, 32s, 50s, and 250s respectively. Such short execution time can be ignored in practical applications because SHObf sign This only needs to be done once, and the resulting lookup table can be reused for any number of signatures unless the private key d needs to be updated.

[0088] Figure 4 It shows that when the exposed volume M increases The changes in execution time, where Figure 4 (a) is the result on a high-performance device. Figure 4 (b) is the result on a resource-constrained device. The highest efficiency is on personal computers, with execution times ranging from 0.3s to 1.6s, and the lowest efficiency is on embedded devices, with execution times ranging from 1.1s to 7.4s. The efficiency of the signature algorithm is lower than that of the standard SM2 signature scheme, but it is still suitable for scenarios where signatures do not need to be generated frequently, such as the authentication process between IoT devices and IoT gateways.

[0089] Devices with limited resources and power supply, such as embedded devices and smart phones, are also potential application scenarios of the present invention. The energy consumption of cryptographic algorithms used on these devices should not be too high. Test SHObf sign and The results of energy consumption in one execution on embedded devices and smartphones are as follows Figure 5 The experimental results show that under different exposure conditions, SHObf sign The energy consumption range is about 16.1J~292.0J. The energy consumption ranges from 1.0J to 7.9J.

[0090] The above description is only a description of the preferred embodiments of the present application, and is not intended to limit the scope of the present application. Any changes or modifications made by any person skilled in the art based on the above disclosed technical contents shall be deemed as equivalent effective embodiments and shall fall within the scope of protection of the technical solution of the present application.

Claims

1. A spatial impedance obfuscation protection method for SM2 digital signature algorithm, characterized in that: Suitable for defending against side-channel attacks, including: Step 1: key generation; Step 2: Obfuscation; Step 3 Signature; Step 4: Signature verification.

2. A method for protecting the spatial impedance of an SM2 digital signature algorithm according to claim 1, characterized in that: The step 2 comprises: Step 2.1 The signer generates a standard signature circuit based on the key pair (d, P) and the public parameter pub Step 2.2 The signer executes Algorithm 2 to confuse the standard signature circuit; Algorithm 2 is designed as follows: Algorithm 2: Obfuscation algorithm Its input M is the exposed code volume, and its output is To obfuscate the signature circuit; Step 2.3 The signatory party will Deploy to the device that needs to run the signature algorithm.

3. A method for protecting the spatial impedance of an SM2 digital signature algorithm according to claim 2, characterized in that: In step 2.2, the process of Algorithm 2 includes: S2.2.1 Calculation of two integers n=t+1; S2.2.2 Randomly generate logq t-order polynomials, labeled f i (x)(i=1,…,logq); S2.2.3 Generate nlogq secret shares k i,j =f i (j), where i = 1, ..., logq and j = 1, ..., n, create a lookup table T1; S2.2.4 Randomly generate logq t-order polynomials with constant terms equal to 0, labeled g i (x)(i=1,…,logq); S2.2.5 Generate nlogq shares of secret b i,j =g i (j), where i = 1, ..., logq and j = 1, ..., n; S2.2.6 Calculation of u i,j =(1+d) -1 k i,j +b i,j (i=1,…,logq and j=1,…,n), create Create a lookup table T2; S2.2.7 Randomly generate logq t-order polynomials with constant terms of 1, labeled h i (x)(i=1,…,logq); S2.2.8 Generate nlogq shares of secret c i,j =h i (j), where i = 1, ..., logq and j = 1, ..., n; S2.2.9 Calculation of v i,j =d(1+d) -1 c i,j (i=1,…,logq and j=1,…,n), create a lookup table T3; S2.2.10 Create a lookup table T = (T1, T2, T3); S2.2.11 Output 4. A method for protecting the spatial impedance of an SM2 digital signature algorithm according to claim 1, characterized in that: The step 3 comprises: Step 3.1 The signer runs the signing device To generate a signature, the process is shown in Algorithm 3: Algorithm 3: Obfuscated Signature Circuit (i.e., signature algorithm), whose input m is the message to be signed, and output σ is the signature; Step 3.2 broadcasts the message m and signature σ = (r, s) to the message verifier.

5. A method for protecting the spatial impedance of an SM2 digital signature algorithm according to claim 4, characterized in that: In step 3.1, the process of Algorithm 2 includes: S3.1.1 Parse the lookup table T into (T1, T2, T3); S3.1.2 Calculate e = H(m) and e′ = H ′ (m), let the l-th bit of e′ be γ(l) (l=1,…,256); S3.1.3 For each i that satisfies γ(i) = 1, use the lookup table T1 to calculate k j G=∑k i,j G(j=1,…,n); S3.1.4 Calculation and r = (e + r x )mod q; S3.1.5 For each i that satisfies γ(i) = 1, use the lookup table T2 to calculate u j =∑u i,j (j=1,…,n); S3.1.6 Calculation S3.1.7 For each i that satisfies γ(i) = 1, use the lookup table T3 to calculate v j =∑v i,j (j=1,…,n); S3.1.8 Calculation S3.1.9 Calculate s = (s1 - s2) mod q; S3.1.10 Output σ = (r, s).

6. A method for protecting the spatial impedance of an SM2 digital signature algorithm according to claim 3, characterized in that: The lookup table is characterized as:

Images