Security protection method based on SM9 decryption algorithm

Abstract

The invention discloses a security protection method based on an SM9 decryption algorithm, which masks a private key by using a random number, randomizes the operand of point multiplication, does not leak the private key in the whole decryption algorithm process, and performs full-flow masking in the middle process, so that power consumption, electromagnetism and key information are free from correlation, and the security of the decryption algorithm is improved. Therefore, energy power consumption and electromagnetic attack can be resisted; the operation time is determined according to the value of the random number, and when the NAF point multiplication operation is adopted, the point multiplication operation time of the random window is random, so that the timing attack can be resisted; when the KDF function is used for operation, a ct randomization mode is adopted, and sensitive information is prevented from being leaked; by comparing SM3 hash operation values before and after the SM3 hash operation values, whether the parameter variables are tampered or whether errors are injected is effectively detected; and encryption operation is carried out on the decrypted plaintext, so that whether all parameter variables and intermediate variables are tampered or whether errors are injected in the whole-process operation can be detected, and therefore, fault attacks can be resisted.

Description

Technical Field

[0001] The present invention belongs to the field of data security, and in particular relates to a security protection method based on an SM9 decryption algorithm. Background Art

[0002] The SM9 algorithm is an identity-based cryptographic algorithm (abbreviated as "IBC"), a public key cryptographic system based on elliptic curves, and the first asymmetric cryptographic algorithm in my country to be fully included in the ISO / IEC standard. Compared with traditional cryptographic systems, the biggest advantage of the SM9 cryptographic system is that it does not require certificates, is easy to use, easy to manage, and has a low total cost of ownership. The SM9 algorithm is widely used and can implement security services such as encryption and identity authentication of various types of data; due to its ease of use and high security, it is very suitable for secure communication between massive devices, and has a unique advantage in ensuring data security in the fields of mobile Internet, big data, industrial Internet, Internet of Things, and Internet of Vehicles.

[0003] As a public key cryptography system based on elliptic curves, the SM9 algorithm has a relatively complex implementation process. Complex implementations may increase the risk of side channel leakage, because more hardware resources and calculation steps may generate more physical characteristics such as power consumption and electromagnetic radiation, which may be used by attackers to steal key information. When there are differences in time characteristics when implementing the SM9 algorithm, such as inconsistent execution times for different keys or plaintexts, attackers may infer key information by measuring the time of these operations. In addition, attackers may also deliberately insert an error in the calculation step to cause the relevant key information to be leaked during the calculation process. Summary of the invention

[0004] In order to solve the above problems, the present invention discloses a security protection method based on SM9 decryption algorithm.

[0005] To achieve the above object, the technical solution of the present invention is as follows:

[0006] A security protection method based on SM9 decryption algorithm comprises the following steps:

[0007] Step 1: Take the bit string C1 from the ciphertext C, convert it into a point on the elliptic curve according to the data type, and verify whether C1∈G1 holds. If not, report an error and exit. If yes, calculate hash=SM3(C,K1,K2,de B ), where K1 is the key in the block cipher algorithm, K2 is the key in the function MAC(K2, Z), Z is a bit string, de B is the private key of user B, SM3 is the SM3 hash operation;

[0008] Step 2, generate a 256-bit random number K;

[0009] Step 3: Use NAF dot multiplication algorithm to calculate de B '=K*de B , and calculate K -1 ;

[0010] Step 4: Calculate G T The element w=e(C1,de B '); e is from G1xG2 to G T The bilinear pairings of G1, G2, G T They are all additive cyclic groups of order prime number N;

[0011] Step 5, calculate w'=w^K -1 , convert the data type of w' into a bit string;

[0012] Step 6: Calculate based on the encryption method:

[0013] c) If the method for encrypting plaintext is a stream cipher algorithm based on a key derivation function, then

[0014] 4) Calculate the integer klen = mlen + K2_len, then calculate K' = KDF(C1||w'||ID B ,klen), let K1' be K'

[0015] The leftmost mlen bits, K2' is the remaining K2_mlen bits, where KDF uses ct randomization. If K 1' If it is a string of all 0 bits, an error is reported and the function exits. The KDF function using ct randomization is used in each H v Before the operation, a random number r is generated, the bit width of r is the same as the bit width of ct, and a value is randomly selected from the remaining ct to participate in the operation according to r; where mlen is the bit length of C2 in the ciphertext C=C1||C3||C2, K1_len is the bit length of K1, and K2_len is the bit length of K2;

[0016] 5) Calculate hash'=SM3(C,K1,K2,de B ), if hash'≠hash, exit and report an error;

[0017] 6) Calculate M'=C2⊕K1', where ⊕ is the modulo 2 addition operation of two bit strings of equal length;

[0018] d) If the method used to encrypt the plaintext is a block cipher algorithm combined with a key derivation function, then

[0019] 3) Calculate the integer klen = K1_len + K2_len, then calculate K' = KDF(C1||w'||IDB ,klen), let K1' be the leftmost K1_len bits of K', and K2' be the remaining K2_mlen bits. If K 1' If it is a string of all 0 bits, an error is reported and the system exits;

[0020] 4) Calculate hash'=SM3(C,K1,K2,de B ), if hash'≠hash, exit and report an error;

[0021] Calculate M'=Dec(K1',C2), where Dec is the block decryption algorithm;

[0022] Step 7, calculate u=MAC(K2',C2), extract the bit string C3 from C, if u≠C3, report an error and exit;

[0023] Step 8, perform another encryption operation on the plaintext M'. If the encryption result is not equal to C, an error is reported and the program exits.

[0024] Step 9, output plaintext M'.

[0025] Furthermore, before each point multiplication operation, all parameters are subjected to SM3 hash operation again. If the hash value of the parameter is inconsistent with the value of the first operation, it means that the elliptic curve parameter has been tampered with or an error has been injected, and an error message is printed. If the hash value is consistent, the point multiplication operation is performed again.

[0026] Furthermore, the encryption operation in step 8 includes the following steps:

[0027] A1: Calculate the element Q in group G1 B =[H1(ID B ||hid,N)]P1+P pub-e ; where G1 is an additive cyclic group of prime order N, H1() is a cryptographic function derived from a cryptographic hash function, and ID B is the identifier of user B, P1 is the generator of group G1, P pub-s is the signature master public key, hid is the private key generation function identifier;

[0028] A2: Generate a random number r∈[1, N-1], where N is greater than 2 191 prime number of ;

[0029] A3: Calculate the element C1=[r]Q in the group G1 B ;

[0030] A4: Calculate group G T The element g=e(P pub-e ,P2), P2 is the generator of group G2;

[0031] A5: Calculate group G T The element w=g r ; g r is the operation g raised to the power of r in the multiplication group;

[0032] A6: Calculate based on the method of encrypting plaintext:

[0033] c) If the method for encrypting plaintext is a stream cipher algorithm based on a key derivation function, then

[0034] 3) Calculate the integer klen = mlen + k2_len, then calculate K = KDF (C1 || w || ID B , klen), let K1 be the leftmost K1_len bits of K, and K2 be the remaining K2_mlen bits. If K1 is a string of all 0 bits, return to step 2;

[0035] 4) Calculate C2 = M ⊕ K1;

[0036] d) If the method used to encrypt the plaintext is a block cipher algorithm combined with a key derivation function, then

[0037] 3) Calculate the integer klen = K1_len + K2_len, then calculate K = KDF(C1||w||ID B ,klen), let K1 be the leftmost K1_len bits of K, and K2 be the remaining K2_mlen bits. If K1 is a string of all 0 bits, return to step 2;

[0038] 4) Calculate C2 = Enc(K1, M);

[0039] A7: Calculate C3=MAC(K2, C2);

[0040] A8: Output ciphertext C=C1||C3||C2.

[0041] The beneficial effects of the present invention are:

[0042] 1. The present invention converts the private key B First use a 256-bit random number K mask to get de B '=K*de B , and calculate K -1 The value of w'=e(C1, de B '), and then calculate w=(w')^K -1 =e(C1, de B ')^K -1 =e(C1,K*de B )^K -1 =e(C1,K -1*K*de B )=e(C1,de B ) operation to obtain the correct result, and in the point multiplication operation, the operands of the point multiplication are randomized. At the same time, the NAF point multiplication algorithm is used. Therefore, the private key is not leaked during the entire decryption algorithm. At the same time, the intermediate process is fully masked, making the power consumption, electromagnetic and key information unrelated, thereby being able to resist energy consumption and electromagnetic attacks.

[0043] 2. Since the operation time is determined according to the value of the random number when performing masking, the operation time is random. In addition, when using the NAF dot multiplication operation, the dot multiplication operation time of the random window is also random. Therefore, the scheme of the present invention can resist timing attacks.

[0044] 3. In some cases, the present invention uses the ct randomization method when using the KDF function operation, which can ensure that H cannot be known on the energy trace of the private key operation. v The ct corresponding to the operation is calculated, so CPA (Correlation Power Analysis) analysis cannot be performed. Since ct is randomized, sensitive information is avoided from being leaked.

[0045] 4. The present invention can effectively detect whether the relevant parameter variables have been tampered with or whether there are errors injected before the point multiplication operation by comparing the SM3 hash operation value before the decryption algorithm operation and the SM3 hash operation value before each point multiplication operation; and perform another encryption operation on the decrypted plaintext, thereby being able to detect whether all parameter variables and intermediate variables including the private key in the whole process operation have been tampered with or whether there are errors injected, so the scheme of the present invention can resist fault attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A schematic flow chart of the security protection method based on the SM9 decryption algorithm provided by the present invention.

[0047] Figure 2 The figure is a schematic diagram of the encryption algorithm flow. DETAILED DESCRIPTION

[0048] The technical solution provided by the present invention will be described in detail below in conjunction with specific embodiments. It should be understood that the following specific implementation methods are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0049] Let mlen be the bit length of C2 in the ciphertext C=C1||C3||C2, || is the concatenation symbol, K1_len is the bit length of the key K1 in the block cipher algorithm, and K2_len is the bit length of the key K2 in the function MAC(K2, Z). In order to decrypt C, user B, as the decryptor, adopts a security protection method based on the SM9 decryption algorithm, and its process is as follows: Figure 1 As shown, the following operation steps should be implemented:

[0050] B1: Take the bit string C1 from C, convert it to a point on the elliptic curve according to the data type, and verify whether C1∈G1 holds. If not, report an error and exit. If it holds, calculate hash=SM3(C,K1,K2,de B );SM3 is SM3 hash operation.

[0051] B2: Generate a 256-bit random number K.

[0052] B3: Calculate B '=K*de B and K -1 , B is the private key of user B, which is a value on the additive cyclic group G2 field with order N being a prime number, where N is greater than 2. 191 prime number; the point multiplication operation here uses the NAF point multiplication algorithm; before each point multiplication operation, all parameters are again SM3 hashed. If the hash value of the parameter at this time is inconsistent with the first operation (in step B1, before the SM9 decryption algorithm is performed, all relevant parameters are SM3 hashed, and the hash value obtained) it means that the elliptic curve parameter has been tampered with or an error is injected, and an error message is printed at the same time. If they are consistent, the point multiplication operation is performed again. This step is to decrypt the private key de in the algorithm. B Masking. B is a value on the G2 domain, and here is the calculation of the double line pair G T A value on the domain that satisfies the bilinearity property on the bilinear pairings.

[0053] The point multiplication algorithm of the random window NAF method aims to increase the NAF w The number of 0s in (k) makes NAF w(k) When performing bit-by-bit scanning, the number of point additions is reduced, which can improve the efficiency of point multiplication. After the random window NAF algorithm, the order of the keys is rearranged, and the arrangement of the keys is very regular. The "non-0" numbers in each window are in the last bit of this window, and the other bits in the window are all "0". When performing point multiplication with such a sequence, the power consumption of its operation can only expose the number of point additions and doublings, but does not leak the arrangement information of the key. Suppose the attacker uses SPA to obtain the arrangement of the regular window NAF, but the specific value of each "non-0" bit is unknown. Because the arrangement is regular and unchanged, it is impossible to exhaustively enumerate and determine the "non-0" value in each window separately. It is only possible to exhaustively enumerate the entire sequence. In this case, the amount of calculation will be very large, and no results can be obtained within the life cycle of the key, and the attacker cannot obtain the key.

[0054] In addition, the Montgomery modular multiplication algorithm is used in the point multiplication algorithm of the random window NAF. The algorithm itself also has basic resistance to power consumption attacks, because regardless of whether each window bit of K is equal to 0, the calculation operation is consistent, and the selection of the window bandwidth w is also random. Each point multiplication operation uses a different w, where w randomly selects a value from 2, 3, and 4, so that the collected power consumption cannot distinguish the bit information of K.

[0055] The random window NAF dot multiplication algorithm is as follows:

[0056] Input: point P, integer K = (k t-1 ...k1k0)2, window bandwidth w

[0057] Output: Q = [K] P

[0058] 1) Calculate NAF w (k) = k0*2 0 +k1*2 1 +…+k t-1 2 t-1

[0059] 2) For i = 1, 3, 5, ..., 2 w-1 -1, calculate P i =[i]P

[0060] 3) Q = 0

[0061] 4)for(i=t-1,i>=0;i--)

[0062] {

[0063] Q = [2] Q;

[0064] if(k i ≠0)

[0065] {

[0066] if(k i >0) then Q=Q+P ki

[0067] else Q=QP ki

[0068] }

[0069] }

[0070] 5) Return to Q

[0071] B4: Calculate G T The element w=e(C1,de B '); e is from G1xG2 to G T The bilinear pairings of G1, G2, G T are all additive cyclic groups of order prime number N.

[0072] B5: Calculate w'=w^K -1 , convert the data type of w' to a bit string.

[0073] B6: Calculate by encryption method:

[0074] a) If the method for encrypting plaintext is a stream cipher algorithm based on a key derivation function, then

[0075] 1) Calculate the integer klen = mlen + K2_len, then calculate K' = KDF(C1||w'||ID B ,klen). Let K1' be K'

[0076] The leftmost mlen bits, K2' is the remaining K2_mlen bits, where KDF uses ct randomization. If K 1' If it is a string of all 0 bits, an error is reported and the system exits;

[0077] 2) Calculate hash'=SM3(C,K1,K2,de B ), if hash'≠hash, exit and report an error;

[0078] 3) Calculate M'=C2⊕K1', where ⊕ refers to the modulo 2 addition operation of two bit strings of equal length.

[0079] b) If the method used to encrypt the plaintext is a block cipher algorithm combined with a key derivation function, then

[0080] 5) Calculate the integer klen = K1_len + K2_len, then calculate K' = KDF(C1||w'||IDB ,klen), let K1' be the leftmost K1_len bits of K', and K2' be the remaining K2_mlen bits. If K 1' If it is a string of all 0 bits, an error is reported and the system exits;

[0081] 6) Calculate hash'=SM3(C,K1,K2,de B ), if hash'≠hash, exit and report an error;

[0082] 7) Calculate M'=Dec(K1',C2), where Dec is the block decryption algorithm.

[0083] The KDF function using ct randomization is used in each H v Before the operation, a random number r is generated, the bit width of r is the same as the bit width of ct, and a value is randomly selected from the remaining ct to participate in the operation according to r, so that it can be guaranteed that H cannot be known on the energy trace of the private key operation. v The corresponding ct is calculated, so CPA (Correlation Power Analysis,

[0084] Correlated energy attack) analysis, because if ct is calculated from 1 each time, it is easy to leak sensitive information.

[0085] Specifically, the calculation process of the KDF function is as follows:

[0086] Let the cryptographic hash function be H v (), whose output is a hash value of length v bits. Input: bit string Z, integer klen (indicates the bit length of the key data to be obtained, which is required to be less than (2 32 -1)v)

[0087] Output: key data bit string K of length klen

[0088] a) Initialize a 32-bit counter ct = 0x00000001;

[0089] b) for i from 1 to implement:

[0090] 1) Calculate Ha i =H v (Z||ct)

[0091] 2)ct++

[0092] 3) If klen / v is an integer, let otherwise for The leftmost

[0093] Bit

[0094] 4) Order

[0095] B7: Calculate u=MAC(K2',C2), extract the bit string C3 from C, if u≠C3, report an error and exit;

[0096] B8: Perform another encryption operation on the plaintext M'. If the encryption result is not equal to C, an error is reported and the program exits.

[0097] The steps of the encryption algorithm are as follows:

[0098] Suppose the message to be sent is a bit string M (M' in B8 in this example), mlen is the bit length of M, K1_len is the bit length of key K1 in the block cipher algorithm, K2_len is the bit length of key K2 in the function MAC(K2,Z), and MAC() is the message authentication code function. In order to encrypt plaintext M to user B, user A, as the encryptor, should implement the following operation steps:

[0099] A1: Calculate the element Q in group G1 B =[H1(ID B ||hid,N)]P1+P pub-e ; where G1 is an additive cyclic group of prime order N, H1() is a cryptographic function derived from a cryptographic hash function, and ID B is the identifier of user B, P1 is the generator of group G1, P pub-s is the signature master public key, hid is the private key generation function identifier;

[0100] A2: Generate a random number r∈[1, N-1];

[0101] A3: Calculate the element C1=[r]Q in the group G1 B ;

[0102] A4: Calculate group G T The element g=e(P pub-e ,P2), P2 is the generator of group G2;

[0103] A5: Calculate group G T The element w=g r ; g r is the operation g raised to the power of r in the multiplication group;

[0104] A6: Calculate by encryption method:

[0105] e) If the method for encrypting the plaintext is a stream cipher algorithm based on a key derivation function, then

[0106] 5) Calculate the integer klen = mlen + k2_len, then calculate K = KDF (C1 || w || ID B , klen). Let K1 be the leftmost K1_len bits of K, and K2 be the remaining K2_mlen bits. If K1 is a string of all 0 bits, return A2.

[0107] 6) Calculate C2 = M ⊕ K1;

[0108] f) If the method used to encrypt the plaintext is a block cipher algorithm combined with a key derivation function, then

[0109] 5) Calculate the integer klen = K1_len + K2_len, then calculate K = KDF(C1||w||ID B ,klen), let K1 be the leftmost K1_len bits of K, and K2 be the remaining K2_mlen bits. If K1 is a string of all 0 bits, return A2

[0110] 6) Calculate C2 = Enc (K1, M), where Enc is the encryption algorithm;

[0111] A7: Calculate C3=MAC(K2, C2);

[0112] A8: Output ciphertext C=C1||C3||C2;

[0113] B9: Output plaintext M'.

[0114] Since a random number K is generated in step B2, the operation time of step B3 is determined according to the value of K, so the operation time is random. In addition, in step B3, NAF dot multiplication operation is adopted, and the dot multiplication operation time of the random window is also random. Therefore, the scheme of the present invention can resist timing attacks.

[0115] Since the private key de is generated by using the 256-bit random number K in step B3 B Masking is performed, and in the point multiplication operation in step B3, the point multiplication operands are randomized, and the NAF point multiplication algorithm is used. Therefore, the private key is not leaked during the entire decryption algorithm. At the same time, the entire intermediate process is masked, so that in the entire process of operation, power consumption and electromagnetic and key information are not correlated. Therefore, the solution of the present invention can resist energy consumption attacks.

[0116] Since the SM3 hash operation of all parameter variables is performed in step B1, and the SM3 hash operation is compared again in step B6, it is possible to detect whether the relevant parameter variables are tampered with or whether there is an error injection before the point multiplication operation. In addition, in step B8, the decrypted plaintext is encrypted again, so that it is also possible to detect whether all parameter variables and intermediate variables including the private key in the whole process operation are tampered with or whether there is an error injection. Therefore, the solution of the present invention can resist fault attacks.

[0117] In summary, through the complete decryption security protection logic, the protection method based on the SM9 decryption algorithm can resist multiple side channel attacks.

[0118] It should be noted that the above content only illustrates the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications all fall within the protection scope of the claims of the present invention.

Claims

1. A security protection method based on SM9 decryption algorithm, characterized in that: The steps include: Step 1: Take the bit string C1 from the ciphertext C, convert it into a point on the elliptic curve according to the data type, and verify whether C1∈G1 holds. If not, report an error and exit. If yes, calculate hash=SM3(C,K1,K2,de B ), where K1 is the key in the block cipher algorithm, K2 is the key in the function MAC(K2, Z), Z is a bit string, de B is the private key of user B, SM3 is the SM3 hash operation; Step 2, generate a 256-bit random number K; Step 3: Use NAF dot multiplication algorithm to calculate de B '=K*de B , and calculate K -1 ; Step 4: Calculate G T The element w=e(C1,de B '); e is from G1xG2 to G T The bilinear pairings of G1, G2, G T They are all additive cyclic groups of order prime number N; Step 5, calculate w'=w^K -1 , convert the data type of w' into a bit string; Step 6: Calculate based on the encryption method: a) If the method for encrypting plaintext is a stream cipher algorithm based on a key derivation function, then 1) Calculate the integer klen = mlen + K2_len, then calculate K' = KDF(C1||w'||ID B ,klen), let K1' be the leftmost mlen bits of K', and K2' be the remaining K2_mlen bits, where KDF uses ct randomization. If K 1' If it is a string of all 0 bits, an error is reported and the function exits. The KDF function using ct randomization is used in each H v Before the operation, a random number r is generated, the bit width of r is the same as the bit width of ct, and a value is randomly selected from the remaining ct to participate in the operation according to r; where mlen is the bit length of C2 in the ciphertext C=C1||C3||C2, K1_len is the bit length of K1, and K2_len is the bit length of K2; 2) Calculate hash'=SM3(C,K1,K2,de B ), if hash'≠hash, exit and report an error; 3) Calculate M'=C2⊕K1', where ⊕ is the modulo 2 addition operation of two bit strings of equal length; b) If the method used to encrypt the plaintext is a block cipher algorithm combined with a key derivation function, then 1) Calculate the integer klen = K1_len + K2_len, then calculate K' = KDF(C1||w'||ID B ,klen), let K1' be the leftmost K1_len bits of K', and K2' be the remaining K2_mlen bits. If K 1' If it is a string of all 0 bits, an error is reported and the system exits; 2) Calculate hash'=SM3(C,K1,K2,de B ), if hash'≠hash, exit and report an error; Calculate M'=Dec(K1',C2), where Dec is the block decryption algorithm; Step 7, calculate u=MAC(K2',C2), extract the bit string C3 from C, if u≠C3, report an error and exit; Step 8, perform another encryption operation on the plaintext M'. If the encryption result is not equal to C, an error is reported and the program exits. Step 9, output plaintext M'.

2. The security protection method based on the SM9 decryption algorithm according to claim 1 is characterized in that: Before each point multiplication operation, all parameters are hashed again. If the hash value of the parameter is inconsistent with the value of the first operation, it means that the elliptic curve parameter has been tampered with or an error has been injected, and an error message is printed. If the hash value is consistent, the point multiplication operation is performed again.

3. The security protection method based on the SM9 decryption algorithm according to claim 1 is characterized in that: The encryption operation in step 8 includes the following steps: A1: Calculate the element Q in group G1 B =[H1(ID B ||hid,N)]P1+P pub-e ; where G1 is an additive cyclic group of prime order N, H1() is a cryptographic function derived from a cryptographic hash function, and ID B is the identifier of user B, P1 is the generator of group G1, P pub-s is the signature master public key, hid is the private key generation function identifier; A2: Generate a random number r∈[1, N-1], where N is greater than 2 191 prime number of ; A3: Calculate the element C1=[r]Q in the group G1 B ; A4: Calculate group G T The element g=e(P pub-e ,P2), P2 is the generator of group G2; A5: Calculate group G T The element w=g r ; g r is the operation g raised to the power of r in the multiplication group; A6: Calculate based on the method of encrypting plaintext: a) If the method for encrypting plaintext is a stream cipher algorithm based on a key derivation function, then 1) Calculate the integer klen = mlen + k2_len, then calculate K = KDF (C1 || w || ID B , klen), let K1 be the leftmost K1_len bits of K, and K2 be the remaining K2_mlen bits. If K1 is a string of all 0 bits, return to step 2; 2) Calculation b) If the method used to encrypt the plaintext is a block cipher algorithm combined with a key derivation function, then 1) Calculate the integer klen = K1_len + K2_len, then calculate K = KDF(C1||w||ID B ,klen), let K1 be the leftmost K1_len bits of K, and K2 be the remaining K2_mlen bits. If K1 is a string of all 0 bits, return to step 2; 2) Calculate C2 = Enc(K1, M); A7: Calculate C3=MAC(K2, C2); A8: Output ciphertext C=C1||C3||C2.

Images