A security protection method based on SM9 decryption algorithm

Abstract

The present invention discloses a security protection method based on the SM9 decryption algorithm. The method masks a private key with a random number and performs a random operation on the operands of the point multiplication. The private key is not leaked during the entire decryption algorithm process. At the same time, the intermediate processes are fully masked, so that power consumption, electromagnetic and key information are unrelated, thereby being able to resist energy consumption and electromagnetic attacks. Since the operation time is determined according to the value of the random number, when the NAF point multiplication operation is adopted, the point multiplication operation time of the random window is also random, thereby being able to resist timing attacks. When the KDF function is used for operation, a CT randomization method is adopted to avoid leaking sensitive information. By comparing the previous and next SM3 hash operation values, it is effectively detected whether the parameter variables have been tampered with or whether there is error injection. The decrypted plaintext is encrypted again, and it is possible to detect whether all parameter variables and intermediate variables in the full-process operation have been tampered with or whether there is error injection, thereby being able to resist fault attacks.

Description

Technical Field

[0001] The present invention belongs to the field of data security, and specifically relates to a security protection method based on the SM9 decryption algorithm. Background Art

[0002] The SM9 algorithm is an identity-based cryptographic algorithm (abbreviated as "IBC"), a public-key cryptography system based on elliptic curves, and the first asymmetric cryptographic algorithm in my country to be fully incorporated into ISO / IEC standards. Compared to traditional cryptographic systems, the SM9 cryptographic system's greatest advantages are that it requires no certificates, is easy to use and manage, and has a low total cost of ownership. The SM9 algorithm has a wide range of applications and can implement security services such as encryption and identity authentication for all types of data. Due to its ease of use and high security, it is very suitable for secure communication between massive devices and has a unique advantage in ensuring data security in areas such as mobile Internet, big data, industrial Internet, Internet of Things, and Internet of Vehicles.

[0003] As a public-key cryptosystem based on elliptic curves, the SM9 algorithm has a relatively complex implementation. This complexity can increase the risk of side-channel leaks because the increased number of hardware resources and computational steps can generate increased power consumption, electromagnetic radiation, and other physical characteristics, which attackers can exploit to steal key information. If the SM9 algorithm implementation exhibits discrepancies in timing characteristics, such as inconsistent execution times for different keys or plaintext, attackers can infer key information by measuring the timing of these operations. Furthermore, attackers could intentionally insert errors into computational steps, potentially leaking relevant key information during the operation. Summary of the Invention

[0004] In order to solve the above problems, the present invention discloses a security protection method based on the SM9 decryption algorithm.

[0005] To achieve the above object, the technical solution of the present invention is as follows:

[0006] A security protection method based on the SM9 decryption algorithm includes the following steps:

[0007] Step 1: Take the bit string C1 from the ciphertext C, convert it into a point on the elliptic curve according to the data type, and verify whether C1∈G1 is true. If not, report an error and exit. If true, calculate hash=SM3(C,K1,K2,de B ); where K1 is the key in the block cipher algorithm, K2 is the key in the function MAC(K2, Z), and Z is a bit string. B is the private key of user B, and SM3 is the SM3 hash operation;

[0008] Step 2: Generate a 256-bit random number K;

[0009] Step 3: Use NAF dot multiplication algorithm to calculate de B '=K*de B , and calculate K -1 ;

[0010] Step 4, calculate G T The element w=e(C1,de B '); e is from G1xG2 to G T Bilinear pairings of G1, G2, G T They are all additive cyclic groups of order prime number N;

[0011] Step 5: Calculate w'=w^K -1 , convert the data type of w' into a bit string;

[0012] Step 6: Calculate based on the encryption method:

[0013] c) If the method for encrypting plaintext is a stream cipher algorithm based on a key derivation function, then

[0014] 4) Calculate the integer klen = mlen + K2_len, then calculate K' = KDF(C1||w'||ID B ,klen), let K1' be K'

[0015] The leftmost mlen bits, K2' is the remaining K2_mlen bits, where KDF uses ct randomization. If K 1' If it is a string of all 0 bits, an error is reported and the system exits. The KDF function using ct randomization is used in each H v Before the operation, a random number r is generated. The bit width of r is the same as the bit width of ct. According to r, a value is randomly selected from the remaining ct to participate in the operation; where mlen is the bit length of C2 in the ciphertext C=C1||C3||C2, K1_len is the bit length of K1, and K2_len is the bit length of K2;

[0016] 5) Calculate hash'=SM3(C,K1,K2,de B ), if hash'≠hash, exit and report an error;

[0017] 6) Calculate M'=C2⊕K1', where ⊕ is the modulo-2 addition of two bit strings of equal length;

[0018] d) If the method used to encrypt the plaintext is a block cipher algorithm combined with a key derivation function, then

[0019] 3) Calculate the integer klen = K1_len + K2_len, then calculate K' = KDF(C1||w'||IDB ,klen), let K1' be the leftmost K1_len bits of K', and K2' be the remaining K2_mlen bits. If K 1' If it is a string of all 0 bits, an error is reported and the system exits;

[0020] 4) Calculate hash'=SM3(C,K1,K2,de B ), if hash'≠hash, exit and report an error;

[0021] Calculate M'=Dec(K1',C2), where Dec is the block decryption algorithm;

[0022] Step 7: Calculate u = MAC(K2', C2), extract the bit string C3 from C, and if u ≠ C3, report an error and exit;

[0023] Step 8: Perform another encryption operation on the plaintext M'. If the encryption result is not equal to C, an error is reported and the program exits.

[0024] Step 9: Output the plaintext M'.

[0025] Furthermore, before each point multiplication operation, all parameters are again subjected to SM3 hash operation. If the hash value of the parameter at this time is inconsistent with the value of the first operation, it means that the elliptic curve parameter has been tampered with or an error has been injected, and an error message is printed at the same time. If the hash value is consistent, the point multiplication operation is performed again.

[0026] Furthermore, the encryption operation in step 8 includes the following steps:

[0027] A1: Calculate the element Q in group G1 B =[H1(ID B ||hid,N)]P1+P pub-e ; Where G1 is an additive cyclic group of order prime number N, H1() is a cryptographic function derived from the cryptographic hash function, ID B is the identifier of user B, P1 is the generator of group G1, P pub-s is the signature master public key, and hid is the private key generation function identifier;

[0028] A2: Generate a random number r∈[1, N-1], where N is greater than 2 191 prime numbers;

[0029] A3: Calculate the element C1 = [r]Q in the group G1 B ;

[0030] A4: Calculate group G T The element g=e(P pub-e ,P2), P2 is the generator of group G2;

[0031] A5: Calculation group G T The element w=g r ;g r is the rth power of the operation g in the multiplication group;

[0032] A6: Calculation is performed based on the method used to encrypt the plaintext:

[0033] c) If the method for encrypting plaintext is a stream cipher algorithm based on a key derivation function, then

[0034] 3) Calculate the integer klen = mlen + k2_len, then calculate K = KDF(C1||w||ID B , klen), let K1 be the leftmost K1_len bits of K, and K2 be the remaining K2_mlen bits. If K1 is a string of all 0 bits, return to step 2;

[0035] 4) Calculate C2 = M⊕K1;

[0036] d) If the method used to encrypt the plaintext is a block cipher algorithm combined with a key derivation function, then

[0037] 3) Calculate the integer klen = K1_len + K2_len, then calculate K = KDF(C1||w||ID B ,klen), let K1 be the leftmost K1_len bits of K, and K2 be the remaining K2_mlen bits. If K1 is a string of all 0 bits, return to step 2;

[0038] 4) Calculate C2 = Enc(K1, M);

[0039] A7: Calculate C3 = MAC(K2, C2);

[0040] A8: Output ciphertext C=C1||C3||C2.

[0041] The beneficial effects of the present invention are:

[0042] 1. The present invention will de the private key B First use a 256-bit random number K mask to get de B '=K*de B , and calculate K -1 The value of w'=e(C1, de B '), then calculate w=(w')^K -1 =e(C1, de B ')^K -1 =e(C1, K*de B )^K -1 =e(C1, K -1*K*de B )=e(C1,de B ) operation to obtain the correct result, and in the point multiplication operation, the operands of the point multiplication are randomized. At the same time, the NAF point multiplication algorithm is used. Therefore, the private key is not leaked during the entire decryption algorithm. At the same time, the intermediate processes are fully masked, making the power consumption, electromagnetic and key information unrelated, thereby being able to resist energy consumption and electromagnetic attacks.

[0043] 2. Since the operation time during masking is determined based on the value of the random number, the operation time is random. In addition, when using the NAF dot multiplication operation, the dot multiplication operation time of the random window is also random. Therefore, the solution of the present invention can resist timing attacks.

[0044] 3. In some cases, the present invention uses the ct randomization method when using the KDF function operation, which can ensure that H cannot be known on the energy trace of the private key operation. v The corresponding ct is calculated, so CPA (Correlation Power Analysis) analysis cannot be performed. Since ct is randomized, sensitive information is avoided from being leaked.

[0045] 4. By comparing the SM3 hash value before the decryption algorithm operation with the SM3 hash value before each point multiplication operation, the present invention can effectively detect whether the relevant parameter variables have been tampered with or whether there has been error injection before the point multiplication operation. By performing another encryption operation on the decrypted plaintext, it can also detect whether all parameter variables and intermediate variables, including the private key, in the entire process of operation have been tampered with or whether there has been error injection. Therefore, the solution of the present invention can resist fault attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A schematic flow chart of the security protection method based on the SM9 decryption algorithm provided by the present invention.

[0047] Figure 2 The figure is a flowchart of the encryption algorithm. DETAILED DESCRIPTION

[0048] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0049] Let mlen be the bit length of C2 in the ciphertext C=C1||C3||C2, || be the concatenation symbol, K1_len be the bit length of the key K1 in the block cipher algorithm, and K2_len be the bit length of the key K2 in the function MAC(K2, Z). To decrypt C, user B, as the decryptor, adopts a security protection method based on the SM9 decryption algorithm. The process is as follows: Figure 1 As shown, the following operation steps should be implemented:

[0050] B1: Take the bit string C1 from C, convert it into a point on the elliptic curve according to the data type, and verify whether C1∈G1 is true. If not, report an error and exit. If true, calculate hash=SM3(C,K1,K2,de B ); SM3 is the SM3 hash operation.

[0051] B2: Generate a 256-bit random number K.

[0052] B3: Calculate B '=K*de B and K -1 ,de B The private key of user B is a value on the additive cyclic group G2 field of order N, where N is greater than 2. 191 The point multiplication operation here uses the NAF point multiplication algorithm; before each point multiplication operation, all parameters are again SM3 hashed. If the hash value of the parameter at this time is inconsistent with the first operation (in step B1, before the SM9 decryption algorithm is performed, all relevant parameters are SM3 hashed and the hash value obtained) it means that the elliptic curve parameter has been tampered with or an error has been injected. At the same time, an error message is printed. If they are consistent, the point multiplication operation is performed again. This step is used to calculate the private key de in the decryption algorithm. B Masking. B It is a value on the G2 domain, and here is the calculation of the double line pair G T A value on the domain that satisfies the bilinearity property on bilinear pairings.

[0053] The point multiplication algorithm of the random window NAF method aims to increase NAF w The number of 0s in (k) makes NAF w(k) When performing bit-by-bit scanning, the number of point additions is reduced, which can improve the efficiency of point multiplication. Through the random window NAF algorithm, the order of the keys is rearranged, and the key arrangement is very regular. The non-zero number in each window is the last bit in the window, and the other bits in the window are all zero. When performing point multiplication using this sequence, the operating power consumption only reveals the number of point additions and multiplications, but does not disclose the key arrangement information. Suppose an attacker uses SPA to obtain the arrangement of the regular window NAF, but the specific value of each non-zero bit is unknown. Because the arrangement is regular and unchanging, it is impossible to exhaustively enumerate each window and determine the non-zero value within it. The only option is to exhaustively enumerate the entire sequence, which would be computationally intensive and would not yield a result within the key's lifetime, preventing the attacker from obtaining the key.

[0054] In addition, the random window NAF point multiplication algorithm uses the Montgomery modular multiplication algorithm, which itself has basic resistance to power consumption attacks. This is because regardless of whether each window bit of K is equal to 0, the calculation operation is consistent. In addition, the window bandwidth w is also randomly selected. Each point multiplication operation uses a different w, where w is randomly selected from 2, 3, or 4. This makes it impossible to distinguish the bit information of K from the collected power consumption.

[0055] The random window NAF dot multiplication algorithm is as follows:

[0056] Input: point P, integer K = (k t-1 ...k1k0)2, window bandwidth w

[0057] Output: Q = [K] P

[0058] 1) Calculate NAF w (k)=k0*2 0 +k1*2 1 +…+k t-1 2 t-1

[0059] 2) For i = 1, 3, 5, ..., 2 w-1 -1, calculate P i =[i]P

[0060] 3) Q = 0

[0061] 4) for (i = t - 1, i > = 0; i -)

[0062] {

[0063] Q = [2] Q;

[0064] if(k i ≠0)

[0065] {

[0066] if(k i >0) then Q=Q+P ki

[0067] else Q=QP ki

[0068] }

[0069] }

[0070] 5) Return to Q

[0071] B4: Calculate G T The element w=e(C1,de B '); e is from G1xG2 to G T Bilinear pairings of G1, G2, G T are all additive cyclic groups of order prime number N.

[0072] B5: Calculate w'=w^K -1 , convert the data type of w' to a bit string.

[0073] B6: Calculate by encryption method:

[0074] a) If the method for encrypting plaintext is a stream cipher algorithm based on a key derivation function, then

[0075] 1) Calculate the integer klen = mlen + K2_len, then calculate K' = KDF(C1||w'||ID B ,klen). Let K1' be K'

[0076] The leftmost mlen bits, K2' is the remaining K2_mlen bits, where KDF uses ct randomization. If K 1' If it is a string of all 0 bits, an error is reported and the system exits;

[0077] 2) Calculate hash'=SM3(C,K1,K2,de B ), if hash'≠hash, exit and report an error;

[0078] 3) Calculate M'=C2⊕K1', where ⊕ refers to the modulo-2 addition operation of two bit strings of equal length.

[0079] b) If the method used to encrypt the plaintext is a block cipher algorithm combined with a key derivation function, then

[0080] 5) Calculate the integer klen = K1_len + K2_len, then calculate K' = KDF(C1||w'||IDB ,klen), let K1' be the leftmost K1_len bits of K', and K2' be the remaining K2_mlen bits. If K 1' If it is a string of all 0 bits, an error is reported and the system exits;

[0081] 6) Calculate hash'=SM3(C,K1,K2,de B ), if hash'≠hash, exit and report an error;

[0082] 7) Calculate M'=Dec(K1', C2), where Dec is the block decryption algorithm.

[0083] The KDF function using ct randomization is used in each H v Before the operation, a random number r is generated. The bit width of r is the same as the bit width of ct. According to r, a value is randomly selected from the remaining ct to participate in the operation. Therefore, it can be guaranteed that H cannot be known on the energy trace of the private key operation. v The corresponding ct is calculated, so CPA (Correlation Power Analysis,

[0084] Correlated energy attack) analysis, because if ct is calculated from 1 each time, it is easy to leak sensitive information.

[0085] Specifically, the calculation process of the KDF function is as follows:

[0086] Let the cryptographic hash function be H v (), the output is a hash value of length v bits. Input: bit string Z, integer klen (indicates the bit length of the key data to be obtained, which is required to be less than (2 32 -1)v)

[0087] Output: key data bit string K of length klen

[0088] a) Initialize a 32-bit counter ct = 0x00000001;

[0089] b) For i from 1 to implement:

[0090] 1) Calculate Ha i =H v (Z||ct)

[0091] 2)ct++

[0092] 3) If klen / v is an integer, let otherwise for The leftmost

[0093] Bit

[0094] 4) Order

[0095] B7: Calculate u = MAC(K2', C2), extract the bit string C3 from C, and if u ≠ C3, report an error and exit.

[0096] B8: Perform another encryption operation on the plaintext M'. If the encryption result is not equal to C, an error is reported and the program exits.

[0097] The encryption algorithm steps are as follows:

[0098] Let the message to be sent be the bit string M (in this case, M' in B8), mlen be the bit length of M, K1_len be the bit length of the key K1 in the block cipher algorithm, K2_len be the bit length of the key K2 in the function MAC(K2,Z), and MAC() be the message authentication code function. To encrypt plaintext M to user B, user A, as the encryptor, should perform the following operations:

[0099] A1: Calculate the element Q in group G1 B =[H1(ID B ||hid,N)]P1+P pub-e ; Where G1 is an additive cyclic group of order prime number N, H1() is a cryptographic function derived from the cryptographic hash function, ID B is the identifier of user B, P1 is the generator of group G1, P pub-s is the signature master public key, and hid is the private key generation function identifier;

[0100] A2: Generate a random number r∈[1, N-1];

[0101] A3: Calculate the element C1 = [r]Q in the group G1 B ;

[0102] A4: Calculate group G T The element g=e(P pub-e ,P2), P2 is the generator of group G2;

[0103] A5: Calculation group G T The element w=g r ;g r is the rth power of the operation g in the multiplication group;

[0104] A6: Calculation is performed based on the method of encrypting plaintext:

[0105] e) If the method for encrypting the plaintext is a stream cipher algorithm based on a key derivation function, then

[0106] 5) Calculate the integer klen = mlen + k2_len, then calculate K = KDF(C1||w||ID B , klen). Let K1 be the leftmost K1_len bits of K, and K2 be the remaining K2_mlen bits. If K1 is a string of all 0 bits, return A2.

[0107] 6) Calculate C2 = M⊕K1;

[0108] f) If the method used to encrypt the plaintext is a block cipher algorithm combined with a key derivation function, then

[0109] 5) Calculate the integer klen = K1_len + K2_len, then calculate K = KDF(C1||w||ID B ,klen), let K1 be the leftmost K1_len bits of K, and K2 be the remaining K2_mlen bits. If K1 is a string of all 0 bits, return A2

[0110] 6) Calculate C2 = Enc(K1, M), where Enc is the encryption algorithm;

[0111] A7: Calculate C3 = MAC(K2, C2);

[0112] A8: Output ciphertext C = C1||C3||C2;

[0113] B9: Output plaintext M'.

[0114] Since a random number K is generated in step B2, the operation time in step B3 is determined based on the value of K. Therefore, the operation time is random. In addition, in step B3, the NAF dot multiplication operation is used, and the dot multiplication operation time of the random window is also random. Therefore, the solution of the present invention can resist timing attacks.

[0115] Since the private key de is generated by using the 256-bit random number K in step B3 B Masking is performed, and in the point multiplication operation in step B3, the point multiplication operands are randomized. At the same time, the NAF point multiplication algorithm is used. Therefore, the private key is not leaked during the entire decryption algorithm. At the same time, the entire intermediate process is masked, so that in the entire process of operation, power consumption and electromagnetic and key information are not correlated. Therefore, the solution of the present invention can resist energy consumption attacks.

[0116] Because the SM3 hash operation is performed on all parameter variables in step B1 and compared again in step B6, it is possible to detect whether the relevant parameter variables have been tampered with or whether errors have been injected before the dot multiplication operation. In addition, the decrypted plaintext is encrypted again in step B8, which can also detect whether all parameter variables and intermediate variables in the entire operation process, including the private key, have been tampered with or whether errors have been injected. Therefore, the solution of the present invention can resist fault attacks.

[0117] In summary, through the complete decryption security protection logic, the protection method based on the SM9 decryption algorithm can resist multiple side channel attacks.

[0118] It should be noted that the above content merely illustrates the technical idea of ​​the present invention and cannot be used to limit the scope of protection of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications all fall within the scope of protection of the claims of the present invention.

Claims

1. A security protection method based on the SM9 decryption algorithm, characterized in that: The steps include: Step 1: Take the bit string C1 from the ciphertext C, convert it into a point on the elliptic curve according to the data type, and verify whether C1∈G1 is true. If not, report an error and exit. If true, calculate hash=SM3(C,K1,K2,de B ); where K1 is the key in the block cipher algorithm, K2 is the key in the function MAC(K2, Z), and Z is a bit string. B is the private key of user B, and SM3 is the SM3 hash operation; Step 2: Generate a 256-bit random number K; Step 3: Use NAF dot multiplication algorithm to calculate de B '=K*de B , and calculate K -1 ; Step 4, calculate G T The element w=e(C1,de B '); e is from G1xG2 to G T Bilinear pairings of G1, G2, G T They are all additive cyclic groups of order prime number N; Step 5: Calculate w'=w^K -1 , convert the data type of w' into a bit string; Step 6: Calculate based on the encryption method: a) If the method for encrypting plaintext is a stream cipher algorithm based on a key derivation function, then 1) Calculate the integer klen = mlen + K2_len, then calculate K' = KDF(C1||w'||ID B ,klen), let K1' be the leftmost mlen bits of K', and K2' be the remaining K2_mlen bits, where KDF uses ct randomization. If K 1' If it is a string of all 0 bits, an error is reported and the system exits. The KDF function using ct randomization is used in each H v Before the operation, a random number r is generated. The bit width of r is the same as the bit width of ct. According to r, a value is randomly selected from the remaining ct to participate in the operation; where mlen is the bit length of C2 in the ciphertext C=C1||C3||C2, K1_len is the bit length of K1, and K2_len is the bit length of K2; 2) Calculate hash'=SM3(C,K1,K2,de B ), if hash'≠hash, exit and report an error; 3) Calculate M'=C2⊕K1', where ⊕ is the modulo-2 addition of two bit strings of equal length; b) If the method used to encrypt the plaintext is a block cipher algorithm combined with a key derivation function, then 1) Calculate the integer klen = K1_len + K2_len, then calculate K' = KDF(C1||w'||ID B ,klen), let K1' be the leftmost K1_len bits of K', and K2' be the remaining K2_mlen bits. If K 1' If it is a string of all 0 bits, an error is reported and the system exits; 2) Calculate hash'=SM3(C,K1,K2,de B ), if hash'≠hash, exit and report an error; Calculate M'=Dec(K1',C2), where Dec is the block decryption algorithm; Step 7: Calculate u = MAC(K2', C2), extract the bit string C3 from C, and if u ≠ C3, report an error and exit; Step 8: Perform another encryption operation on the plaintext M'. If the encryption result is not equal to C, an error is reported and the program exits. Step 9: Output the plaintext M'.

2. The security protection method based on the SM9 decryption algorithm according to claim 1, characterized in that: Before each point multiplication operation, all parameters are hashed again. If the hash value of the parameter is inconsistent with the value of the first operation, it means that the elliptic curve parameter has been tampered with or an error has been injected. At the same time, an error message is printed. If the hash value is consistent, the point multiplication operation is performed again.

3. The security protection method based on the SM9 decryption algorithm according to claim 1, characterized in that: The encryption operation in step 8 includes the following steps: A1: Calculate the element Q in group G1 B =[H1(ID B ||hid,N)]P1+P pub-e ; Where G1 is an additive cyclic group of order prime number N, H1() is a cryptographic function derived from the cryptographic hash function, ID B is the identifier of user B, P1 is the generator of group G1, P pub-s is the signature master public key, and hid is the private key generation function identifier; A2: Generate a random number r∈[1, N-1], where N is greater than 2 191 prime numbers; A3: Calculate the element C1 = [r]Q in the group G1 B ; A4: Calculate group G T The element g=e(P pub-e ,P2), P2 is the generator of group G2; A5: Calculation group G T The element w=g r ;g r is the rth power of the operation g in the multiplication group; A6: Calculation is performed based on the method used to encrypt the plaintext: a) If the method for encrypting plaintext is a stream cipher algorithm based on a key derivation function, then 1) Calculate the integer klen = mlen + k2_len, then calculate K = KDF(C1||w||ID B , klen), let K1 be the leftmost K1_len bits of K, and K2 be the remaining K2_mlen bits. If K1 is a string of all 0 bits, return to step 2; 2) Calculation b) If the method used to encrypt the plaintext is a block cipher algorithm combined with a key derivation function, then 1) Calculate the integer klen = K1_len + K2_len, then calculate K = KDF(C1||w||ID B ,klen), let K1 be the leftmost K1_len bits of K, and K2 be the remaining K2_mlen bits. If K1 is a string of all 0 bits, return to step 2; 2) Calculate C2 = Enc(K1, M); A7: Calculate C3 = MAC(K2, C2); A8: Output ciphertext C=C1||C3||C2.

Images