A security protection method based on SM9 signature algorithm

Abstract

The present invention discloses a security protection method based on the SM9 signature algorithm. The method determines the operation time according to the value of a random number. The operation time is random. In addition, the point multiplication operation time is also random, which can resist timing attacks. A key mask operation is performed on the user's private key. At the same time, the point multiplication operands are randomized in the point multiplication operation. The NAF point multiplication algorithm is used. The private key is not leaked during the signature algorithm. At the same time, the intermediate process is fully masked, so that power consumption, electromagnetic and key information are unrelated, and the method can resist energy consumption and electromagnetic attacks. By comparing the hash operation at the beginning of the algorithm and before the point multiplication operation, it can detect whether the relevant parameter variables have been tampered with or whether there is error injection. In addition, after the signature is completed, a verification operation is performed on the signature value. It can detect whether all parameter variables and intermediate variables in the full process operation have been tampered with or whether there is error injection, which can resist fault attacks.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology, and specifically relates to a security protection method based on the SM9 signature algorithm. Background Art

[0002] The SM9 algorithm is an identity-based public key cryptography algorithm, also known as an identity cryptography algorithm. It is part of a series of industry standards issued by the State Cryptography Administration on March 28, 2016, and officially became a national standard in 2020. The SM9 algorithm is primarily used for user identity authentication. It uses a 256-bit elliptic curve and uses the user's identity as the public key. It eliminates the need for digital certificates, certificate libraries, or key libraries, omitting the exchange of digital certificates and public keys, making the security system easier to deploy and manage.

[0003] The SM9 algorithm has a wide range of applications in information security, including e-government, e-commerce, the Internet of Things, and mobile payments. It provides strong protection for user identity authentication and data security, and is particularly suitable for end-to-end offline secure communications, cloud data encryption, attribute-based encryption, and policy-based encryption.

[0004] The deployment and application of cryptographic algorithms from cloud to end cannot be separated from the support of cryptographic chips. Various security threats exist in the design and implementation of chips, as well as when they are used in different application scenarios, including chip logical security, physical security, forward security, etc., and the side channel security issue is particularly prominent at present.

[0005] When cryptographic algorithms run in hardware systems, they generate side-channel information beyond input and output, such as computation time, circuit power consumption, and electromagnetic radiation. This occurs because changes in register data during data processing cause the charging and discharging of load capacitance in the hardware system. This manifests itself in operands as changes in the Hamming distance between data before and after instruction execution. Common side-channel attack methods include timing attacks, energy consumption attacks, electromagnetic attacks, and fault attacks.

[0006] Timing attacks primarily analyze key information by analyzing inconsistent execution times for different keys or plaintexts, potentially leaking it. Energy consumption attacks involve analyzing and deciphering key information by collecting energy consumption and leakage information metrics generated by hardware devices such as cryptographic systems and encryption chips during encryption, decryption, or signing operations, and using cryptography, probability, and statistics. Key analysis techniques include SPA (Simple Power Analysis) and DPA (Differential Power Analysis). Electromagnetic analysis attacks involve analyzing and deciphering key information by collecting electromagnetic energy leakage information metrics generated by hardware devices such as cryptographic systems and encryption chips during encryption, decryption, or signing operations, and using cryptography, probability, and statistics. Fault attacks involve intentionally inserting an error into a computational step, thereby leaking relevant key information during the computation.

[0007] These attacks pose a threat to side-channel security and the vulnerability of private keys to leaks. Existing SM9 signature algorithm implementations are weak against timing attacks, energy consumption attacks, electromagnetic attacks, and fault attacks, and urgently need improvement. Summary of the Invention

[0008] To solve the above problems, the present invention discloses a security protection method based on the SM9 signature algorithm. Through the complete SM9 signature security protection solution, side channel attacks can be resisted.

[0009] To achieve the above object, the technical solution of the present invention is as follows:

[0010] A security protection method based on the SM9 signature algorithm includes the following steps:

[0011] Step 1: Calculate group G T The element g=e(P1,P pub-s ), hash=SM3(M,P pub-s ,ds A ); where e is the distance from G1xG2 to G T Bilinear pairings, G T , G1, G2 are additive cyclic groups of order prime number N, N is greater than 2 191 prime number, P pub-s is the signature master public key, ds A is the signature private key of user A, and SM3 is the SM3 hash operation;

[0012] Step 2, generate a random number r∈[1, N-1];

[0013] Step 3: Calculate group G T The element w=g r ;g r is the rth power of the operation g in the multiplication group;

[0014] Step 4: Calculate the integer h = H2(M||w,N); H2() is a cryptographic function derived from the cryptographic hash function, and the bit string M is the message to be signed;

[0015] Step 5, calculate the integer l = (rh) mod N, if l = 0, return to step 2; mod N is the modulo N operation;

[0016] Step 6, generate a 256-bit random number R1, and calculate R2 = 1 - R1;

[0017] Step 7: Generate a point R on the G1 domain and calculate R'=R+ds A ;

[0018] Step 8, calculate hash'=SM3(M,P pub-s ,ds A ), if hash'≠hash, exit and report an error;

[0019] Step 9, using a dot multiplication operation to calculate S1=[R1]R', the dot multiplication operation uses a random window NAF dot multiplication algorithm;

[0020] Step 10, using a dot multiplication operation to calculate S2=[R2]R', the dot multiplication operation uses a random window NAF dot multiplication algorithm;

[0021] Step 11, using a dot multiplication operation to calculate S3=[R1]R, the dot multiplication operation uses a random window NAF dot multiplication algorithm;

[0022] Step 12, using a dot multiplication operation to calculate S4=[R2]R, wherein the dot multiplication operation uses a random window NAF dot multiplication algorithm;

[0023] Step 13, calculate S5 = S1 - S3;

[0024] Step 14, calculate S6 = S2 - S4;

[0025] Step 15, calculate S=S5+S6;

[0026] Step 16, the signature of the message M is obtained as (h, S);

[0027] Step 17: Perform a signature verification operation on the signature value (h, S). If the verification passes, the signature value (h, S) is valid; otherwise, exit and report an error.

[0028] Furthermore, before each dot product operation, an SM3 hash operation is performed on all parameters again. If the hash value of the parameter at this time is inconsistent with the first operation, an error message is printed. If they are consistent, the dot product operation is performed.

[0029] Furthermore, the signature verification operation step includes the following operation steps:

[0030] B1: Check whether h'∈[1,N-1] holds. If not, the verification fails.

[0031] B2: Check whether S'∈G1 holds. If not, the verification fails.

[0032] B3: Calculation group G T The element g=e(P1,P pub-s ); P1 is the generator of group G1;

[0033] B4: Calculation group G T The element t=g h ';(h',S') is the digital signature;

[0034] B5: Calculate the integer h1=H1(ID A ||hid,N); H1() is a cryptographic function derived from the cryptographic hash function, ID A is the identifier of user A, which can uniquely determine the public key of user A. hid is the signature private key generation function identifier represented by one byte, and || is the splicing symbol;

[0035] B6: Calculate the element P in group G2 = [h1]P2 + P pub-s ; P2 is the generator of group G2;

[0036] B7: Calculation group G T The element u in is equal to e(S',P);

[0037] B8: Calculation group G T The element w'=ut in the , convert the data type of w' into a bit string;

[0038] B9: Calculate the integer h2=H2(M||w',N) and check whether h2=h holds. If so, the verification passes; otherwise, the verification fails.

[0039] Furthermore, the method further includes the following steps:

[0040] Step 18: Output the message M and its digital signature (h, S).

[0041] The beneficial effects of the present invention are:

[0042] 1. The present invention determines the operation time according to the value of the random number, so that the operation time is random. In addition, the dot product operation time of the random window is also random, so it can resist timing attacks.

[0043] 2. The present invention performs a key mask operation on the user's private key, and converts the private key into ds AAdd a random point R on the G1 field and calculate S'=[l]R. When calculating the signature value S, calculate S"=[l](R+ds A ), then calculate S = S" - S' = [l]ds A The final signature S result is obtained, thereby avoiding the correlation between the key and power consumption.

[0044] 3. The present invention is due to the private key ds A Masking is performed, and the operands of the point multiplication are randomized in the point multiplication operation. At the same time, the NAF point multiplication algorithm is used. Therefore, the private key is not leaked during the entire signature algorithm. At the same time, the intermediate processes are fully masked, so that there is no correlation between power consumption, electromagnetic and key information in the entire process of operation, so it can resist energy consumption and electromagnetic attacks.

[0045] 4. The present invention performs an SM3 hash operation on all parameter variables at the beginning of the algorithm, and performs a comparison of the SM3 hash operation again before the dot multiplication operation, so as to detect whether the relevant parameter variables have been tampered with or whether there is any error injection before the dot multiplication operation. In addition, after the signature is completed, a verification operation is performed on the signature value, so as to detect whether all parameter variables and intermediate variables including the private key in the entire process of operation have been tampered with or whether there is any error injection, thereby resisting fault attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 This is a flow chart of the improved SM9 signature algorithm in the present invention.

[0047] Figure 2 This is a flow chart of the signature verification algorithm. DETAILED DESCRIPTION

[0048] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0049] Assume that the message to be signed is a bit string M. In order to obtain the digital signature (h, S) of the message M, user A, as the signer, adopts a security protection method based on the SM9 signature algorithm. The process is as follows: Figure 1 As shown, the following operation steps should be implemented:

[0050] A1: Calculate group G T The element g=e(P1,P pub-s ), hash=SM3(M,P pub-s ,ds A ); e is from G1xG2 to G T Bilinear pairings, G T, G1, G2 are additive cyclic groups of order prime number N, N is greater than 2 191 prime number, P pub-s is the signature master public key, ds A is the signature private key of user A, and SM3 is the SM3 hash operation;

[0051] A2: Generate a random number r∈[1, N-1];

[0052] A3: Calculate group G T The element w=g r ;g r is the rth power of the operation g in the multiplication group;

[0053] A4: Calculate the integer h = H2(M||w,N); H2() is a cryptographic function derived from the cryptographic hash function;

[0054] A5: Calculates the integer l = (rh) mod N. If l = 0, returns to A2. mod N is a modulo N operation.

[0055] A6: Generate a 256-bit random number R1 and calculate R2 = 1 - R1.

[0056] A7: Generate a point R on the G1 domain and calculate R' = R + ds A ;

[0057] A8: Calculate hash'=SM3(M,P pub-s ,ds A ), if hash'≠hash, exit and report an error;

[0058] A9: Calculate S1 = [R1]R'. The point multiplication here uses the random window NAF point multiplication algorithm. Before each point multiplication, all parameters are hashed again using SM3. If the hash value of the parameters does not match the first calculation (in A1), it indicates that the elliptic curve parameters have been tampered with or an error has been injected. An error message is printed. If they match, the point multiplication is repeated.

[0059] The point multiplication algorithm of the random window NAF method aims to increase NAF w The number of 0s in (k) makes NAF w(k) When performing bit-by-bit scanning, the number of point additions is reduced, which can improve the efficiency of point multiplication. Through the random window NAF algorithm, the order of the keys is rearranged, and the key arrangement is very regular. The non-zero number in each window is the last bit in the window, and the other bits in the window are all zero. When performing point multiplication using this sequence, the operating power consumption only reveals the number of point additions and multiplications, but does not disclose the key arrangement information. Suppose an attacker uses SPA to obtain the arrangement of the regular window NAF, but the specific value of each non-zero bit is unknown. Because the arrangement is regular and unchanging, it is impossible to exhaustively enumerate each window and determine the non-zero value within it. The only option is to exhaustively enumerate the entire sequence, which would be computationally intensive and would not yield a result within the key's lifetime, preventing the attacker from obtaining the key.

[0060] In addition, the random window NAF dot multiplication algorithm uses the Montgomery modular multiplication algorithm, which itself has basic resistance to power consumption attacks because the calculation operation is consistent regardless of whether each window bit of K is equal to 0. The window bandwidth w is also randomly selected. Each dot multiplication operation uses a different w, where w is randomly selected from 2, 3, or 4, making it impossible to distinguish the bit information of K from the collected power consumption. The random window NAF dot multiplication algorithm includes the following steps:

[0061] Input: point P, integer K = (k t-1 ...k1k0)2, window bandwidth w

[0062] Output: Q = [K] P

[0063] 1) Calculate NAF w (k)=k0*2 0 +k1*2 1 +…+k t-1 2 t-1

[0064] 2) For i = 1, 3, 5, ..., 2 w-1 -1, calculate P i =[i]P

[0065] 3) Q = 0

[0066] 4) for (i = t - 1, i > = 0; i -)

[0067] {

[0068] Q = [2] Q;

[0069] if(k i ≠0)

[0070] {

[0071] if(k i >0) then Q=Q+P ki

[0072] else Q=QP ki

[0073] }

[0074] }

[0075] 5) Return to Q

[0076] A10: Calculate S2 = [R2]R'. The dot product operation here uses the random window NAF dot product algorithm.

[0077] A11: Calculate S3 = [R1]R. The dot product operation here uses the random window NAF dot product algorithm.

[0078] A12: Calculate S4 = [R2]R. The dot product operation here uses the random window NAF dot product algorithm.

[0079] A13: Calculate S5 = S1 - S3;

[0080] A14: Calculate S6 = S2 - S4;

[0081] A15: Calculate S = S5 + S6. Combining A9-A15, we can see that this example uses two random point multiplications and one point addition to calculate the signature value. The calculation process uses the random window NAF point multiplication algorithm, which further increases the security of R1 and R2.

[0082] A16: The signature of the message M is obtained as (h, S);

[0083] A17: Perform a signature verification operation on the signature value (h, S). If the verification passes, the signature value (h, S) is valid. Otherwise, exit and report an error. After executing the SM9 signature operation once, this step performs another SM9 signature verification operation with the public key to verify whether the result is correct. If it is not correct, it indicates that the operation is incorrect or an error has been injected. At the same time, the error message is printed. If it is consistent, it indicates that the private key has not been tampered with or no error has been injected.

[0084] The signature verification process is as follows Figure 2 As shown, the following steps are included:

[0085] Assume that the message to be signed is the bit string M', and the digital signature is (h', S'). In this example, M' is the message M in step A16, and the digital signature is the signature (h, S) obtained in step A16. User B, acting as the verifier, should perform the following operations:

[0086] B1: Check whether h'∈[1,N-1] holds. If not, the verification fails.

[0087] B2: Check whether S'∈G1 holds. If not, the verification fails.

[0088] B3: Calculation group G T The element g=e(P1,P pub-s ); P1 is the generator of group G1;

[0089] B4: Calculation group G T The element t=g h ';

[0090] B5: Calculate the integer h1=H1(ID A ||hid,N); H1() is a cryptographic function derived from the cryptographic hash function, ID A is the identifier of user A, which can uniquely determine the public key of user A. hid is the signature private key generation function identifier represented by one byte, and || is the splicing symbol;

[0091] B6: Calculate the element P in group G2 = [h1]P2 + P pub-s ; P2 is the generator of group G2;

[0092] B7: Calculation group G T The element u in is equal to e(S',P);

[0093] B8: Calculation group G T The element w'=ut in the , convert the data type of w' into a bit string;

[0094] B9: Calculate the integer h2=H2(M||w',N) and check whether h2=h holds. If so, the verification passes; otherwise, the verification fails.

[0095] A18: Output message M and its digital signature (h, S).

[0096] Since a random number r is generated in step A2, the calculation time in step A3 is determined by the value of r, so the calculation time is random. In addition, in steps A9 to A12, NAF dot multiplication operations are used, and the dot multiplication operation time of this random window is also random. Therefore, this scheme can resist timing attacks.

[0097] Since the private key ds is AMasking is performed, and in the point multiplication operations from steps A9 to A12, the point multiplication operands are randomized. At the same time, the NAF point multiplication algorithm is used. Therefore, the private key is not leaked during the entire signature algorithm. At the same time, the intermediate processes are fully masked, so that in the entire process of operation, power consumption, electromagnetic and key information are unrelated. Therefore, this solution can resist energy consumption and electromagnetic attacks.

[0098] Because the SM3 hash operation is performed on all parameter variables in step A1 and compared again in step A8, it is possible to detect whether the relevant parameter variables have been tampered with or errors have been injected before the dot multiplication operation. In addition, the signature value is verified in step A17, which can also detect whether all parameter variables and intermediate variables, including the private key, have been tampered with or errors have been injected throughout the entire operation process. Therefore, this solution is resistant to fault attacks.

[0099] It should be noted that the above content merely illustrates the technical idea of ​​the present invention and cannot be used to limit the scope of protection of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications all fall within the scope of protection of the claims of the present invention.

Claims

1. A security protection method based on the SM9 signature algorithm, characterized in that: The steps include: Step 1: Calculate group G T The element g=e(P1,P pub-s ), hash=SM3(M,P pub-s ,ds A ); where e is the distance from G1xG2 to G T Bilinear pairings, G T , G1, G2 are additive cyclic groups of order prime number N, N is greater than 2 191 prime number, P pub-s is the signature master public key, ds A is the signature private key of user A, and SM3 is the SM3 hash operation; Step 2, generate a random number r∈[1, N-1]; Step 3: Calculate group G T The element w=g r ;g r is the rth power of the operation g in the multiplication group; Step 4: Calculate the integer h = H2(M||w,N); H2() is a cryptographic function derived from the cryptographic hash function, and the bit string M is the message to be signed; Step 5, calculate the integer l = (rh) mod N, if l = 0, return to step 2; mod N is the modulo N operation; Step 6, generate a 256-bit random number R1, and calculate R2 = 1 - R1; Step 7: Generate a point R on the G1 domain and calculate R'=R+ds A ; Step 8, calculate hash'=SM3(M,P pub-s ,ds A ), if hash'≠hash, exit and report an error; Step 9, using a dot multiplication operation to calculate S1=[R1]R', the dot multiplication operation uses a random window NAF dot multiplication algorithm; Step 10, using a dot multiplication operation to calculate S2=[R2]R', the dot multiplication operation uses a random window NAF dot multiplication algorithm; Step 11, using a dot multiplication operation to calculate S3=[R1]R, the dot multiplication operation uses a random window NAF dot multiplication algorithm; Step 12, using a dot multiplication operation to calculate S4=[R2]R, wherein the dot multiplication operation uses a random window NAF dot multiplication algorithm; Step 13, calculate S5 = S1 - S3; Step 14, calculate S6 = S2 - S4; Step 15, calculate S=S5+S6; Step 16, the signature of the message M is obtained as (h, S); Step 17: Perform a signature verification operation on the signature value (h, S). If the verification passes, the signature value (h, S) is valid; otherwise, exit and report an error.

2. The security protection method based on the SM9 signature algorithm according to claim 1 is characterized in that: Before each dot product operation, all parameters are hashed again. If the hash value of the parameter at this time is inconsistent with the first operation, an error message is printed. If they are consistent, the dot product operation is performed.

3. The security protection method based on the SM9 signature algorithm according to claim 1, characterized in that: The signature verification operation step includes the following operation steps: B1: Check whether h'∈[1,N-1] holds. If not, the verification fails. B2: Check whether S'∈G1 holds. If not, the verification fails. B3: Calculation group G T The element g=e(P1,P pub-s ); P1 is the generator of group G1; B4: Calculation group G T The element t=g h ';(h',S') is the digital signature; B5: Calculate the integer h1=H1(ID A ||hid,N); H1() is a cryptographic function derived from the cryptographic hash function, ID A is the identifier of user A, which can uniquely determine the public key of user A. hid is the signature private key generation function identifier represented by one byte, and || is the splicing symbol; B6: Calculate the element P in group G2 = [h1]P2 + P pub-s ; P2 is the generator of group G2; B7: Calculation group G T The element u in is equal to e(S',P); B8: Calculation group G T The element w'=ut in the , convert the data type of w' into a bit string; B9: Calculate the integer h2=H2(M||w',N) and check whether h2=h holds. If so, the verification passes; otherwise, the verification fails.

4. The security protection method based on the SM9 signature algorithm according to claim 1, characterized in that: The following steps are also included: Step 18: Output the message M and its digital signature (h, S).

Images