Certificateless collaborative signature method based on SM2 algorithm

Abstract

The invention discloses a certificateless collaborative signature method based on an SM2 algorithm, and belongs to the technical field of information security and passwords. According to the scheme, a signer and a key generation center generate a signer private key component, a collaborative signature server private key component and a signer declaration public key together, and the signer and the collaborative signature server perform collaborative signature based on an SM2 certificateless signature algorithm to generate a signature result meeting an SM2 certificateless standard. Based on the scheme, the signature party does not need to apply for an SM2 certificate, the storage and transmission pressure of the Internet of Things terminal is relieved, the user private keys are stored in the signature party and the collaborative signature server in a scattered mode, the private keys are not synthesized in the full-key life cycle, and the security of the private keys is effectively improved. The generated signature result completely meets the SM2 certificateless standard, so that the signature can be verified without any change of the existing verification party. According to the scheme, rapid application and popularization of the national secret technology in the field of Internet of Things can be accelerated.

Description

Technical Field

[0001] The present invention relates to the field of information security and cryptographic technology, and in particular to a certificateless collaborative signature method based on an SM2 algorithm. Background Art

[0002] In recent years, with the country's increasing emphasis on information security and the application requirements for domestic cryptographic technology, PKI (Public Key Infrastructure) technology based on the national SM2 algorithm has been widely used in identity authentication. However, in the field of the Internet of Things, most terminal devices have limited resources, limited storage and computing capabilities, and the traditional SM2 digital certificates with a size of nearly 1K bytes have brought great storage and transmission pressure to these devices. In addition, due to the wide variety and complexity of IoT terminals, hardware encryption transformation not only greatly increases the cost, but also brings extremely high transformation risks and technical challenges.

[0003] In response to the above problems, the national secret standard "GM / T 0130-2023 Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm" proposed a certificateless technical solution, which stores the private key completely on the device side to ensure the security of the private key. However, this method requires the use of a hardware security chip to store the private key, which limits its application on resource-constrained devices.

[0004] In order to solve the security risks brought by the complete storage of private keys, the Chinese invention patent "Signature and decryption method and system based on SM2 algorithm for cloud computing" with publication number CN 104243456 A proposed a collaborative signature mechanism based on SM2 algorithm, which effectively alleviated the security risks of storing and using private keys on the device side by dividing the private key into two parts for separate storage and calculation. However, the method in which both parties in communication generate their own sub-private keys in this scheme cannot be directly applied to the certificateless mechanism.

[0005] The Chinese invention patent "A certificateless collaborative signature method based on SM2" with publication number CN 115766028 A proposed a new certificateless collaborative signature method, which introduced collaborative signature into the certificateless mechanism. However, this method uses a self-created signature algorithm, and its signature result is inconsistent with the national secret SM2 standard, which makes it impossible for third-party verifiers to perform signature verification according to the existing national secret standard, thus requiring all verifiers to upgrade accordingly, increasing the difficulty and cost of implementation.

[0006] In view of the actual situation in the field of Internet of Things, there is an urgent need for an SM2 certificateless solution that can replace hardware encryption and ensure that the existing verification party implemented in accordance with the national encryption standard "GM / T 0130-2023 Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm" does not need any changes. This solution should not only effectively solve the storage and transmission pressure of resource-constrained IoT terminals, but also ensure that the signature results comply with the national encryption SM2 standard to promote the rapid application and promotion of national encryption technology in the field of Internet of Things. Summary of the invention

[0007] The technical problem to be solved by the present invention is: in view of the above-mentioned defects of the prior art, a certificateless collaborative signature method based on the SM2 algorithm is provided.

[0008] To achieve the above object, the present invention provides a certificateless collaborative signature method based on the SM2 algorithm. The participating entities of the method include a key generation center, a signatory, and a collaborative signature server. The method includes the following steps:

[0009] Step S1: The key generation center generates the system master private key ms and the system master public key P pub ;

[0010] Step S2: The signer and the key generation center jointly generate the signer private key component d A1 , collaborative signature server private key component d A2 And the signer declares the public key W A ; The actual private key d of the signer A =d A1 -1 *d A2 -1 -1;

[0011] Step S3: The signer and the collaborative signature server perform collaborative signing based on the SM2 certificateless signature algorithm to generate a signature result that complies with the SM2 certificateless standard.

[0012] In the certificateless collaborative signature method based on the SM2 algorithm of the present invention, the signer, the verifier, the key generation center and the collaborative signature server share the elliptic curve parameters E(Fp), G, n, a, and b of the SM2 algorithm, wherein the elliptic curve E is an elliptic curve defined on a finite field Fp, n is the order of the generator that meets security requirements, G is the base point of order n on the elliptic curve E, and a and b are the parameters of the elliptic curve equation corresponding to the elliptic curve E.

[0013] In the certificateless collaborative signature method based on the SM2 algorithm of the present invention, the specific method of step S1 is as follows:

[0014] The key generation center uses a random number generator to generate a random number ms∈[1,n-1] as the system master private key, and then calculates the system master public key P according to the system master private key ms pub = [ms] G, publish the system master public key P pub .

[0015] In the certificateless collaborative signature method based on the SM2 algorithm of the present invention, the specific method of step S2 is as follows:

[0016] Step S21, the signer generates the first part of the signer private key d' using a random number generator A ∈[1,n-1];

[0017] Step S22: the signer uses the first part of the signer's private key d' A Calculate the first part of the signing party's public key U A =[d' A ]G, and the signatory ID A and the first part of the signing party's public key U A Submit to the key generation center;

[0018] Step S23, the key generation center calculates the first hash value H A =H 256 (ENTL A ||ID A ||a||b||x G ||y G ||x Pub ||y Pub ), where H 256 () indicates a cryptographic hash algorithm with a message digest length of 256 bits, ID A Indicates the identity of the signing party, ENTL A Indicates the length of the signatory's identification, x G Represents the x-coordinate of the base point G of the elliptic curve, y G represents the y coordinate of the base point G of the elliptic curve, x Pub represents the x-coordinate of the system master public key, y Pub represents the y coordinate of the system master public key;

[0019] Step S24: the key generation center generates a first random number w 1 ∈[1,n-1], the second random number w 2 ∈[1,n-1];

[0020] Step S25: the key generation center generates a random number w according to the first random number w. 1 and the system master private key ms to calculate the collaborative signature server private key component dA2 =(w 1 *ms) -1 mod n, if 0 < d A2 < n - 1, then securely send the server private key component d of the co-signature server A2 as the server private key component of the signer to the co-signature server, otherwise return to step S24;

[0021] Step S26, the key generation center calculates the public key W of the signer based on the first random number w 1 , the second random number w 2 , the system master private key ms, and the public key U of the first part of the signer A W = [w A *ms]U 1 + [w A *ms - 1]G; 2 *ms - 1]G;

[0022] Step S27, the key generation center calculates the second hash value λ = H A based on the first hash value H A and the public key W of the claim 256 (x WA ||y WA ||H A ) mod n;

[0023] Step S28, the key generation center calculates the second part of the signer's private key t 1 based on the first random number w 2 , the second random number w A t = w 1 -1 *(λ + w 2 ) mod n, and securely returns the second part of the signer's private key t A and the public key W of the claim A to the signer;

[0024] Step S29, the signer calculates the signer's private key component d A based on the first part of the signer's private key d' A and the second part of the signer's private key t A1 d = (d' A + t A ) -1 mod n;

[0025] Step S210, if 0 < d A1 < n - 1, then output (d A1 , W A) as the signatory private key component and the declared public key, the signatory securely stores the signatory private key component d A1 , publish the public key W A ; Otherwise return to step S21.

[0026] In the certificateless collaborative signature method based on the SM2 algorithm of the present invention, the specific method of step S3 is:

[0027] Step S31: The signer calculates the first hash value H A =H 256 (ENTL A ||ID A ||a||b||x G ||y G ||x Pub ||y Pub );

[0028] Step S32: the signer generates a signature based on the first hash value H A , the declared public key W A Calculate the message digest e = H 256 (H A ||x WA ||y WA ||M), where M is the message to be signed;

[0029] Step S33, the signer generates a third random number k1∈[1,n-1] using a random number generator;

[0030] Step S34, the signer calculates the first elliptic curve point Q1=[k1]G according to the third random number k1, and securely submits the message digest e and the first elliptic curve point Q1 to the collaborative signature server;

[0031] Step S35, the collaborative signature server generates a fourth random number k2∈[1,n-1] and a fifth random number k3∈[1,n-1] using a random number generator;

[0032] Step S36, the collaborative signature server calculates a second elliptic curve point Q2=[k3]Q1+[k2]G according to the first elliptic curve point Q1, the fourth random number k2, and the fifth random number k3;

[0033] Step S37: the collaborative signature server generates a signature based on the second elliptic curve point Q2, the message digest e, and the collaborative signature server private key component d. A2 , the fourth random number k2, the fifth random number k3 calculate the first partial signature r=x Q2 +e mod n, the first component of the second part of the signature s2 = dA2 *k3 mod n, the second part of the signature second component s3 = d A2 *(r+k2)mod n; then the first partial signature r, the second partial signature first component s2, and the second partial signature second component s3 are securely returned to the signatory, where x Q2 is the x coordinate of the second elliptic curve point Q2;

[0034] Step S38: the signer generates a random number based on the third random number k1 and the signer private key component d A1 , the first partial signature r, the second partial signature first component s2, the second partial signature second component s3 calculate the second partial signature s=(d A1 *k1)*s2+d A1 *s3-r mod n, and then output the signature result (r, s).

[0035] In the certificateless collaborative signature method based on the SM2 algorithm of the present invention, the step S3 further includes:

[0036] Step S4: The signature verification party performs signature verification on the received signature result according to the certificateless digital signature verification mechanism;

[0037] The specific method of step S4 is:

[0038] Step S41: the signature verifier calculates the first hash value H A =H 256 (ENTL A ||ID A ||a||b||x G ||y G ||x Pub ||y Pub );

[0039] Step S42: the signature verification party generates a signature based on the first hash value H A Calculate the second hash value λ = H 256 (x WA ||y WA ||H A )mod n;

[0040] Step S43: the signature verification party verifies the public key W according to the declared public key W. A , the second hash value λ, the system master public key P pub Calculate the actual public key P of the signer A =W A +[λ]P pub ;

[0041] Step S44: the signature verification party executes the standard signature verification algorithm VERIFY (param, H A ,x WA ||y WA ||M',P A ,(r',s')) and output the result, where VERIFY() is the verification function, param is the elliptic curve parameter, M' is the message received by the verifier, and (r',s') is the digital signature received by the verifier.

[0042] The present invention has the following beneficial effects: the certificateless collaborative signature method based on the SM2 algorithm disclosed by the present invention is that the signatory and the key generation center jointly generate the signatory private key component d A1 , collaborative signature server private key component d A2 And the signer declares the public key W A , the signer and the collaborative signature server perform collaborative signing based on the SM2 signature algorithm to generate a signature result that complies with the SM2 standard. Based on this solution, the signer only needs to generate a key pair and does not need to apply for an SM2 certificate, which reduces the storage and transmission pressure of the SM2 certificate. The user's private key is stored in a dispersed manner on the signer and the collaborative signature server. The private key is not synthesized during the entire key life cycle. The attacker only obtains any private key component and cannot restore the complete private key, thereby effectively improving the security of the private key. Since the generated signature result fully complies with the national secret SM2 standard, it ensures that the existing verifier can verify the signature without any changes, which promotes the seamless integration and wide application of the technology. Applying this solution to the national secret transformation of IoT terminal equipment will help accelerate the rapid application and promotion of national secret technology in the field of IoT. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0044] Figure 1 A schematic diagram of the steps of a certificateless collaborative signature method based on the SM2 algorithm provided in an embodiment of the present invention.

[0045] Figure 2 A block diagram of entities participating in a certificateless collaborative signature method based on the SM2 algorithm provided in an embodiment of the present invention.

[0046] Figure 3 A schematic diagram of the key generation steps of the certificateless collaborative signature method based on the SM2 algorithm provided in an embodiment of the present invention.

[0047] Figure 4 A schematic diagram of the digital signature steps of the certificateless collaborative signature method based on the SM2 algorithm provided in an embodiment of the present invention.

[0048] Figure 5 A schematic diagram of signature verification steps of a certificateless collaborative signature method based on the SM2 algorithm provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] The general idea of ​​the present invention is to modify the technical solution of the Chinese invention patent "Signature and decryption method and system based on SM2 algorithm suitable for cloud computing" with publication number CN 104243456 A, so that it can be applied to the SM2 algorithm certificateless cryptographic mechanism specified in the "GM / T0130-2023 Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm" standard, so that in application scenarios with limited bandwidth and resources such as the Internet of Things field, a solution based on SM2 certificateless collaborative signature can be implemented. There is no need to modify the hardware security encryption chip in the Internet of Things terminal to store the certificate, but the Internet of Things terminal and the collaborative signature server jointly sign, and the signature result meets the SM2 certificateless standard, and the signature verification party does not need to change the signature verification algorithm.

[0051] The embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings of the specification. It should be understood that the embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0052] The present invention is applicable to digital signatures of IoT terminals. A typical application scenario is as follows: the signing party is a drone device in the IoT, and the signature verification party is a drone integrated supervision platform. When the drone device reports monitoring data during flight, it needs to be digitally signed to generate credible monitoring data. The drone integrated supervision platform then verifies these signatures to ensure that the monitoring data is indeed derived from a legitimate drone device, thereby effectively preventing the mixing of forged data.

[0053] like Figure 1-Figure 2 As shown, an embodiment of the present invention provides a certificateless collaborative signature method based on the SM2 algorithm. The participating entities of the method include a key generation center KGC, a signer, a collaborative signature server, and a signature verification party. The method includes the following steps:

[0054] Step S1: The key generation center KGC generates the system master private key ms and the system master public key Ppub ;

[0055] Step S2: The signer and the key generation center KGC jointly generate the signer private key component d A1 , collaborative signature server private key component d A2 And the signer declares the public key W A ; The actual private key d of the signer A =d A1 -1 *d A2 -1 -1;

[0056] Step S3, the signer and the collaborative signature server perform collaborative signing based on the SM2 certificateless signature algorithm to generate a signature result that complies with the SM2 certificateless standard;

[0057] Step S4: The signature verification party performs signature verification on the received signature result according to the certificateless digital signature verification mechanism.

[0058] In the embodiment of the present invention, the signer maintains a network connection with the collaborative signature server, the key generation center KGC, and the signature verification party respectively. The signature verification party is connected to the key generation center KGC to obtain system public parameters, and the signature verification party is connected to the signer to receive messages and digital signatures sent by the signer. There is no need for the signature verification party to be connected to the collaborative signature server.

[0059] In an embodiment of the present invention, the signer, the verifier, the key generation center and the collaborative signature server share the elliptic curve parameters E(Fp), G, n, a and b of the SM2 algorithm, wherein the elliptic curve E is an elliptic curve defined on a finite field Fp, n is the order of the generator that meets the security requirements, G is the base point of the nth order on the elliptic curve E, and a and b are the parameters of the elliptic curve equation corresponding to the elliptic curve E.

[0060] In the embodiment of the present invention, the method of step S1 is the same as Section 6.1 of "GM / T 0130-2023 Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm", which is as follows:

[0061] The key generation center uses a random number generator to generate a random number ms∈[1,n-1] as the system master private key, and then calculates the system master public key P according to the system master private key ms pub = [ms] G, publish the system master public key P pub .

[0062] like Figure 3 As shown, in the embodiment of the present invention, in step S2, the signer and the key generation center KGC jointly generate the user's key pair: the signer private key component d A1, collaborative signature server private key component d A2 and declare the public key W A , so that the actual private key d A =d A1 -1 *d A2 -1 -1, in order to meet the private key requirements of the Chinese invention patent with publication number CN 104243456 A for the signer and the collaborative signature server. The specific method is as follows:

[0063] Step S21, the signer generates the first part of the signer private key d' using a random number generator A ∈[1,n-1].

[0064] Step S22: the signer uses the first part of the signer's private key d' A Calculate the first part of the signing party's public key U A =[d' A ]G, and the signatory ID A and the first part of the signing party's public key U A Submit to the key generation center KGC.

[0065] Step S23, the key generation center KGC calculates a first hash value H A =H 256 (ENTL A ||ID A ||a||b||x G ||y G ||x Pub ||y Pub ), where H 256 () indicates a cryptographic hash algorithm with a message digest length of 256 bits, ID A Indicates the identity of the signing party, ENTL A Indicates the length of the signatory's identification, x G Represents the x-coordinate of the base point G of the elliptic curve, y G represents the y coordinate of the base point G of the elliptic curve, x Pub represents the x-coordinate of the system master public key, y Pub Represents the y coordinate of the system master public key.

[0066] Steps S21 to S23 are the same as those in Section 6.2 of GM / T 0130-2023 Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm.

[0067] Step S24: the key generation center KGC generates a first random number w 1 ∈[1,n-1], the second random number w2 ∈ [1, n - 1].

[0068] In step S24, different from generating a single private key in "GM / T 0130 - 2023 Certificate - less and Implicit - Certificate Public - Key Mechanism Based on SM2 Algorithm", in the embodiments of the present invention, in order to generate two private - key components, the key - generation center KGC generates two random numbers.

[0069] Step S25, the key - generation center KGC calculates the collaborative - signature server private - key component d 1 according to the first random number w A2 and the system master private key ms 1 d=(w -1 *ms) A2 mod n. If 0 < d A2 <n - 1, the collaborative - signature server private - key component d

[0070] is securely sent to the collaborative - signature server as the server private - key component of the signer; otherwise, return to step S24. A2 In the embodiments of the present invention, in step S25, the collaborative - signature server private - key component d 1 is generated by the first random number w 1 and the system master private key ms. Because of the randomness of the first random number w A2 any operation or leakage of the collaborative - signature server private - key component d

[0071] will not leak the system master private key ms. 1 Step S26, the key - generation center KGC calculates the declarative public key W 2 of the signer according to the first random number w A , the second random number w A , the system master private key ms, and the first - part signer public key U 1 W = [w A *ms]U 2 +[w

[0072] In the embodiments of the present invention, in step S25, the declarative public key W A is calculated from the first random number w 1 , the second random number w 2 , the system master private key ms, and the first - part signer public key U A . Therefore, the system master private key ms cannot be directly obtained from the declarative public key W A . Combining the declarative public key W A and the collaborative - signature server private - key component d A2 also cannot obtain the system master private key ms.

[0073] Step S27: the key generation center KGC generates a key according to the first hash value H A , the declared public key W A Calculate the second hash value λ = H 256 (x WA ||y WA ||H A )mod n.

[0074] Step S28: the key generation center KGC generates a random number w according to the first random number w. 1 , the second random number w 2 , the second hash value λ calculates the second part of the signing party private key t A =w 1 -1 *(λ+w 2 )mod n, and the second part of the signing party's private key t A and the declared public key W A Returned securely to the signing party.

[0075] In this embodiment of the present invention, the second part of the signing party private key t A The first random number w is also added in the calculation process 1 The second random number w 2 , therefore, the second part of the signing party's private key t A The system master private key ms will not be leaked.

[0076] Step S29: the signer uses the first part of the signer's private key d' A , the second part of the signing party's private key t A Calculate the signing party's private key component d A1 =(d' A +t A ) -1 mod n.

[0077] The actual public key P of the signer A The signer's declared public key W will be used by other users during signature verification and public key encryption. A Restore, the specific method is: A =W A +[λ]P pub , the actual public key P of the signer A and the signing party's private key component d A1 , collaborative signature server private key component d A2 The relationship is as follows:

[0078] P A =W A +[λ]Ppub = [w 1 *ms]U A + [w 2 *ms-1]G + [λ*ms]G

[0079] = [w 1 *ms*d’ A + w 2 *ms-1 + λ*ms]G

[0080] = [w 1 *ms*(d’ A + w 1 -1 *(w 2 + λ)) - 1]G

[0081] = [d A2 -1 *(d’ A + t A ) - 1]G

[0082] = [d A1 -1 *d A2 -1 - 1]G

[0083] Refer to Section 6.4 of "GM / T 0130-2023 Certificate-Free and Implicit-Certificate Public Key Mechanism Based on SM2 Algorithm", P A = [d A G, where d A is the actual private key of the signer. Therefore, d A = d A1 -1 *d A2 -1 - 1.

[0084] In the embodiments of the present invention, the actual public key P A of the signer and the signer's private key component d A1 , the private key component d A2 of the co-signature server have the same correspondence as that of the Chinese patent with the publication number CN 104243456 A. Therefore, the co-signature method disclosed in the Chinese patent with the publication number CN 104243456 A can be referred to for co-signature to obtain a signature result that complies with the national cryptographic SM2 signature standard.

[0085] Step S210, if 0 < d A1 < n - 1, then output (d A1 , W A ) as the signer's private key component and the declared public key, and the signer securely stores the signer's private key component dA1 , publish the public key W A ; Otherwise return to step S21.

[0086] In this embodiment of the present invention, the signing party private key component d A1 , collaborative signature server private key component d A2 The generation idea is as follows: the actual public key P of the signer in the original SM2 certificateless scheme A =W A +[λ]P pub =[w+d ’ A +λ*ms]G's private key is decomposed into the form of collaborative signature private key d A1 -1 *d A2 -1 -1, where the signing party's private key component d A1 is d ’ A The transformation of the collaborative signature server private key component d A2 is the transformation of the system master private key ms. Specifically, first declare the public key W A From [w]G+U A Modify to [w 1 *ms]U A , at this time the actual public key of the signer is P A =[w 1 *ms*d' A +λ*ms]G=[w 1 *ms*(d' A +λ*w 1 -1 )]G, successfully separated into ms and d' A The product of; in order for the signer to calculate d' A +λ*w 1 -1 Without leaking the system master private key ms, give λ*w 1 -1 Add the random variable w 2 , and add the last item -G of the collaborative signature key pair, and finally modify the declared public key W A =[w 1 *ms]U A +[w 2 *ms-1]G, then the actual public key of the signer is P A =[w 1 *ms*(d' A +w 1 -1 *(w 2+λ))-1]G, which conforms to the formula form of the collaborative signature key pair in the Chinese invention patent with publication number CN104243456 A. The second part of the signatory private key t sent by the key generation center KGC to the signatory A and declare the public key W A The system master private key ms will not be leaked; the collaborative signature server private key component d A2 Contains the random variable w 1 , collaborative signature server private key component d A2 The system master private key ms will not be leaked even if the key generation center KGC uses the collaborative signature server private key component d A2 Distributed to independent third-party collaborative signature servers, signatories and owners of d A2 The third-party collaborative signature server cannot recover ms.

[0087] It can be understood that the specific method for generating the above collaborative key pair is only one embodiment of the present invention. As long as the form of the collaborative key pair conforms to the formula form of the collaborative signature key pair in the Chinese invention patent with publication number CN 104243456 A, that is, P A =[d A1 -1 *d A2 -1 -1]G or d A =d A1 -1 *d A2 -1 -1, you can refer to the collaborative signature method in the Chinese invention patent with publication number CN 104243456A to generate a signature result that meets the national encryption SM2 standard.

[0088] like Figure 4 As shown, in the embodiment of the present invention, assuming that the message to be signed is M, in order to obtain the digital signature (r, s) of the message M, the signer and the collaborative signature server use their respective private key components to perform the following collaborative operation steps together:

[0089] Step S31: The signer calculates the first hash value H A =H 256 (ENTL A ||ID A ||a||b||x G ||y G ||x Pub ||y Pub );

[0090] Step S32: the signer generates a signature based on the first hash value H A , the declared public key W ACalculate the message digest e = H 256 (H A ||x WA ||y WA ||M);

[0091] Step S33, the signer generates a third random number k1∈[1,n-1] using a random number generator;

[0092] Step S34, the signer calculates the first elliptic curve point Q1=[k1]G according to the third random number k1, and securely submits the message digest e and the first elliptic curve point Q1 to the collaborative signature server;

[0093] Step S35, the collaborative signature server generates a fourth random number k2∈[1,n-1] and a fifth random number k3∈[1,n-1] using a random number generator;

[0094] Step S36, the collaborative signature server calculates a second elliptic curve point Q2=[k3]Q1+[k2]G according to the first elliptic curve point Q1, the fourth random number k2, and the fifth random number k3;

[0095] Step S37: the collaborative signature server generates a signature based on the second elliptic curve point Q2, the message digest e, and the collaborative signature server private key component d. A2 , the fourth random number k2, the fifth random number k3 calculate the first partial signature r=x Q2 +e mod n, the first component of the second part of the signature s2 = d A2 *k3 mod n, the second part of the signature second component s3 = d A2 *(r+k2)mod n; then the first partial signature r, the second partial signature first component s2, and the second partial signature second component s3 are securely returned to the signatory, where x Q2 is the x coordinate of the second elliptic curve point Q2;

[0096] Step S38: the signer generates a random number based on the third random number k1 and the signer private key component d A1 , the first partial signature r, the second partial signature first component s2, the second partial signature second component s3 calculate the second partial signature s=(d A1 *k1)*s2+d A1 *s3-r mod n, and then output the signature result (r, s).

[0097] The above signing process is executed in accordance with the method in Section 6.1 of GM / T 0003.2-2012SM2 Elliptic Curve Public Key Cryptography Algorithm Part 2: Digital Signature Algorithm, except that the unilateral signature is changed into a bilateral collaborative signature. The random number k in Section 6.1 of GM / T 0003.2-2012SM2 Elliptic Curve Public Key Cryptography Algorithm Part 2: Digital Signature Algorithm is equivalent to k1*k3+k2 in this scheme, d A Equivalent to d in this scheme A =d A1 -1 *d A2 -1 -1, so the collaborative signing is performed according to the above signing process, and the result obtained is in compliance with the SM2 certificateless standard.

[0098] In the embodiment of the present invention, a signature result that meets the requirements of the SM2 standard is generated in step S3, and the signature can be verified by referring to Section 7.2 of "GM / T0130-2023 Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm". Figure 5 As shown, assuming that the verifier receives the message M' and the digital signature (r', s'), the verifier knows the system elliptic curve parameters a, b, the base point G, and the system public key P pub , the signatory's ID A and declare the public key W A , the verification party performs the following operation steps to verify whether the digital signature is issued by the signing party:

[0099] Step S41: the signature verifier calculates the first hash value H A =H 256 (ENTL A ||ID A ||a||b||x G ||y G ||x Pub ||y Pub );

[0100] Step S42: the signature verification party generates a signature based on the first hash value H A Calculate the second hash value λ = H 256 (x WA ||y WA ||H A )mod n;

[0101] Step S43: the signature verification party verifies the public key W according to the declared public key W. A , the second hash value λ, the system master public key P pub Calculate the actual public key P of the signer A =W A +[λ]P pub ;

[0102] Step S44: the signature verification party executes the standard signature verification algorithm VERIFY (param, H A ,x WA ||y WA ||M',P A ,(r',s')) and output the result, where VERIFY() is the verification function, param is the elliptic curve parameter, M' is the message received by the verifier, and (r',s') is the digital signature received by the verifier.

[0103] Based on the solution of the embodiment of the present invention, the signer only needs to generate a key pair and does not need to apply for an SM2 certificate, which is equivalent to using the public key to replace the original SM2 certificate. The public key data length is 64 bytes, which greatly saves the amount of storage and transmission data compared to the SM2 certificate data length, and reduces the storage and transmission pressure of the Internet of Things terminal. The user private keys of this solution are dispersedly stored in the signer and the collaborative signature server. The private key is not synthesized during the life cycle of the entire key. The attacker only obtains any private key component and cannot restore the complete private key, thereby effectively improving the security of the private key.

[0104] The following is a specific data example provided in an embodiment of the present invention. The format of the data example refers to the format of Appendix A of "GM / T0130-2023 Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm", and the meaning of the symbols in the data example refers to the above.

[0105] Elliptic Curve System Parameters

[0106] q:FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFF

[0107] a:FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC

[0108] b:28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E93

[0109] n:FFFFFFFEFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123

[0110] Gx:32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7

[0111] Gy:BC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0

[0112] Master Key

[0113] ms:4c2b72d6926ba84fc89574bed0f2b76dc1ca6f32cd2fc2bcd6b18e679bf6f9f0

[0114] P pub =[ms]G=(x Pub ,y Pub ):

[0115] x Pub :82203230d5a2680e8735750319da5edf82c9c37e4196557a7123766af79bfc87

[0116] y Pub :f1d278ce76a18dec5c5f81a3dd4b21a8ed7ae8dde7d62dad7287cd04db115c59 Signer key generation process

[0117] Signing Party ID A ="1234567812345678"

[0118] Signature generation

[0119] d' A :018c9898301698a6cee8739a7f9d10171fabe276a47151fa7e7d33d0c5e1833aU A =[d' A ]G=(x U ,y U ):

[0120] x U :0c7ef27c7ac82e04d08fe3bb3989364f526a373ecfd125bcc8397bc99a694a36y U: The key generation center KGC generates the key d5acf4ec7272c4a817ccc69531a319239351ad24d73d6a3cfa9c8cafc50b634b

[0121] w 1 : 54d0c9831a13fda6ed0eff26243372b10825bcc56e64f33e08c36bc4defbbbf0w 2 : 5116f58a4441a115765e7627ddf7b283a5508621916648ed2b93baed89b80e65d A2 =(w 1 *ms) - 1 mod n

[0122] d A2 :949b7633c91bc455daa90f5cb3b942b6fe56efd774d2240e2bea92ae36f09cffW A =[w 1 *ms]U A +[w 2 *ms - 1]G=(x WA ,y WA ):

[0123] x WA : 585cce1567bf9a5d505afb20be65a3cfd36dce1a2343fedd9d2058db243467e4y WA : d1be5c45fab3be5f45d8950d898bf266b057806d99e31aacf575cb1e2ba2a0b7

[0124] λ=H 256 (x WA ||y WA ||H A )mod n:

[0125] 95d26e384842e07b52ef1da588e32db766fa3efe259b097e5c710df7f432ab9f

[0126] t A =w 1 -1 *(λ + w 2 )mod n

[0127] t A :15ee1e7761dcf7e2459de7d04d4c4c15b637b10d10c19a8d5e1e1266fe3ed94f Signature party generated

[0128] d A1 =(d' A +t A ) -1 mod n:

[0129] d A1 :91cb0b39834b2c74005cacc2421b2c964b9b7b66abc41be1e9b7b466111879ecDigital signature process original data:31323334353637380000000000000000

[0130] Signature calculation

[0131] e:49c651bb48893e075ee39dd0b8989fde0370b1ca63ac2ff07aff56898f18efb5k1:83036e6800d26ebefa70edfccc17f27378be03dd99ba0b7534544afe51da6ee2

[0132] Q1=[k1]G=(x Q1 ,y Q1 ):

[0133] x Q1 :27be3b5a4768beb62bab51d690bc447c900536a0712fe356a541f961b27b54aay Q1 :040919b2bbd5d6a3b212eee5dcb454711c605c4a700f348f0f0d1ee19c2a7252

[0134] Collaborative signature server calculation

[0135] k2:99bc0a72172e0ca8f286449c792d4022431d835a5c1c6507873727bd46a405ee

[0136] k3:bca8a66bdf3ca23528ae84ddb15becb38de00ff5432fde24ae3723a9f0ee9788

[0137] Q2=[k3]Q1+[k2]G,r=x Q2 +e mod n,s2=d A2 *k3 mod n,s3=d A2 *(r+k2)mod n

[0138] r:e31d7d4bc603efb43e035edd9893597a758c5f5e3ac9ac77db140c511a7b0ee9

[0139] s2:23ec01e0ac802dbe1382500fa4ecce57e3e4540596ab08234f7e93a91a2b7a40

[0140] s3:91882c837188c4eafc6d3452fd286462d54af2c15f340919d7e2d2233db49c55

[0141] Signature calculation

[0142] s=(d A1 *k1)*s2+d A1 *s3-r mod n:

[0143] s:e31d7d4bc603efb43e035edd9893597a758c5f5e3ac9ac77db140c511a7b0ee9

[0144] Output signature value (r, s):

[0145] e31d7d4bc603efb43e035edd9893597a758c5f5e3ac9ac77db140c511a7b0ee9 39d733934f3e1b1fa111397450a6a3cdd78539f5f3089ca8fb35cbbd2e38f0a5.

[0146] Digital Signature Verification Process

[0147] Calculation by the verification party

[0148] P A =W A +[λ]P pub =(xPA ,y PA ):

[0149] x PA :a546f508a59034fbec20deac5486abb369230c940904e3d841a4e9f4f441ca09

[0150] y PA :45ddf465140d141b6acecf0ae3303e174ced6ec5d324b81104ba27b5c7188a7b

[0151] Signature verification result: success.

[0152] The present invention integrates the collaborative signature mechanism into the national secret SM2 certificateless technology system, transforms the algorithm process of the national secret SM2 certificateless technology system, and provides a software implementation scheme for the SM2 certificateless cryptographic module. The scheme is applied to the national secret transformation of IoT terminal equipment, which can effectively solve the problems of high cost, long cycle, and complex transformation process in the traditional transformation process. By simplifying the hardware encryption requirements, the transformation cost and technical risks are reduced, which is conducive to accelerating the rapid application and promotion of national secret technology in the field of IoT.

[0153] The above are only specific implementations of the present invention, which cannot be used to limit the scope of the present invention. Equivalent changes made by ordinary technicians in this technical field based on this creation, as well as changes known to technicians in this field, should still fall within the scope of the present invention.

Claims

1. A certificateless collaborative signature method based on the SM2 algorithm, wherein the participating entities of the method include a key generation center, a signatory, and a collaborative signature server, characterized in that: The method comprises the following steps: Step S1: The key generation center generates the system master private key ms and the system master public key P pub ; Step S2: The signer and the key generation center jointly generate the signer private key component d A1 , collaborative signature server private key component d A2 And the signer declares the public key W A ; The actual private key d of the signer A =d A1 -1 *d A2 -1 -1; Step S3: The signer and the collaborative signature server perform collaborative signing based on the SM2 certificateless signature algorithm to generate a signature result that complies with the SM2 certificateless standard.

2. The certificateless collaborative signature method based on the SM2 algorithm according to claim 1 is characterized in that: The signer, the verifier, the key generation center and the collaborative signature server share the elliptic curve parameters E(Fp), G, n, a and b of the SM2 algorithm, wherein the elliptic curve E is an elliptic curve defined on the finite field Fp, n is the order of the generator that meets the security requirements, G is the base point of the nth order on the elliptic curve E, and a and b are the parameters of the elliptic curve equation corresponding to the elliptic curve E.

3. The certificateless collaborative signature method based on the SM2 algorithm according to claim 2 is characterized in that: The specific method of step S1 is as follows: The key generation center uses a random number generator to generate a random number ms∈[1,n-1] as the system master private key, and then calculates the system master public key P according to the system master private key ms pub = [ms] G, publish the system master public key P pub .

4. The certificateless collaborative signature method based on the SM2 algorithm according to claim 3 is characterized in that: The specific method of step S2 is as follows: Step S21, the signer generates the first part of the signer private key d' using a random number generator A ∈[1,n-1]; Step S22: the signer uses the first part of the signer's private key d' A Calculate the first part of the signing party's public key U A =[d' A ]G, and the signatory ID A and the first part of the signing party's public key U A Submit to the key generation center; Step S23, the key generation center calculates the first hash value H A =H 256 (ENTL A ||ID A ||a||b||x G ||y G ||x Pub ||y Pub ), where H 256 () indicates a cryptographic hash algorithm with a message digest length of 256 bits, ID A Indicates the identity of the signing party, ENTL A Indicates the length of the signatory's identification, x G Represents the x-coordinate of the base point G of the elliptic curve, y G represents the y coordinate of the base point G of the elliptic curve, x Pub represents the x-coordinate of the system master public key, y Pub represents the y coordinate of the system master public key; Step S24, the key generation center generates a first random number w1∈[1,n-1] and a second random number w2∈[1,n-1]; Step S25, the key generation center calculates the private key component d of the collaborative signature server according to the first random number w1 and the system master private key ms A2 =(w1 * ms) -1 mod n, if 0 < d A2 < n - 1, then securely send the private key component d of the collaborative signature server A2 as the private key component of the server of the signer to the collaborative signature server, otherwise return to step S24; Step S26: the key generation center generates a random number based on the first random number w1, the second random number w2, the system master private key ms, and the first partial signer public key U A Calculate the declared public key W of the signer A =[w1*ms]U A +[w2*ms-1]G; Step S27: the key generation center generates a key according to the first hash value H A , the declared public key W A Calculate the second hash value λ = H 256 (x WA ||y WA ||H A )mod n; Step S28: The key generation center calculates the second part of the signer private key t according to the first random number w1, the second random number w2, and the second hash value λ. A =w1 -1 *(λ+w2)mod n, and the second part of the signing party's private key t A and the declared public key W A securely returned to the signing party; Step S29: the signer uses the first part of the signer's private key d' A , the second part of the signing party's private key t A Calculate the signing party's private key component d A1 =(d' A +t A ) -1 mod n; Step S210, if 0 < d A1 <n - 1, then output (d A1 , W A ) as the signer's private key component and the declared public key, and the signer securely stores the signer's private key component d A1 , and publicly announces the declared public key W A ; otherwise, return to Step S21.

5. The certificateless collaborative signature method based on the SM2 algorithm according to claim 4 is characterized in that: The specific method of step S3 is: Step S31: The signer calculates the first hash value H A =H 256 (ENTL A ||ID A ||a||b||x G ||y G ||x Pub ||y Pub ); Step S32: the signer generates a signature based on the first hash value H A , the declared public key W A Calculate the message digest e = H 256 (H A ||x WA ||y WA ||M), where M is the message to be signed; Step S33, the signer generates a third random number k1∈[1,n-1] using a random number generator; Step S34, the signer calculates the first elliptic curve point Q1=[k1]G according to the third random number k1, and securely submits the message digest e and the first elliptic curve point Q1 to the collaborative signature server; Step S35, the collaborative signature server generates a fourth random number k2∈[1,n-1] and a fifth random number k3∈[1,n-1] using a random number generator; Step S36, the collaborative signature server calculates a second elliptic curve point Q2=[k3]Q1+[k2]G according to the first elliptic curve point Q1, the fourth random number k2, and the fifth random number k3; Step S37: the collaborative signature server generates a signature based on the second elliptic curve point Q2, the message digest e, and the collaborative signature server private key component d. A2 , the fourth random number k2, the fifth random number k3 calculate the first partial signature r=x Q2 +e mod n, the first component of the second part of the signature s2 = d A2 *k3 mod n, the second part of the signature second component s3 = d A2 *(r+k2)mod n; then the first partial signature r, the second partial signature first component s2, and the second partial signature second component s3 are securely returned to the signatory, where x Q2 is the x coordinate of the second elliptic curve point Q2; Step S38: the signer generates a random number based on the third random number k1 and the signer private key component d A1 , the first partial signature r, the second partial signature first component s2, the second partial signature second component s3 calculate the second partial signature s=(d A1 *k1)*s2+d A1 *s3-r mod n, and then output the signature result (r, s).

6. The certificateless collaborative signature method based on the SM2 algorithm according to claim 5 is characterized in that: After step S3, the following steps are also included: Step S4: The signature verification party performs signature verification on the received signature result according to the certificateless digital signature verification mechanism; The specific method of step S4 is: Step S41: the signature verifier calculates the first hash value H A =H 256 (ENTL A ||ID A ||a||b||x G ||y G ||x Pub ||y Pub ); Step S42: the signature verification party generates a signature based on the first hash value H A Calculate the second hash value λ = H 256 (x WA ||y WA ||H A )modn; Step S43: the signature verification party verifies the public key W according to the declared public key W. A , the second hash value λ, the system master public key P pub Calculate the actual public key P of the signer A =W A +[λ]P pub ; Step S44: the signature verification party executes the standard signature verification algorithm VERIFY (param, H A ,x WA ||y WA ||M',P A ,(r',s')) and output the result, where VERIFY() is the verification function, param is the elliptic curve parameter, M' is the message received by the verifier, and (r',s') is the digital signature received by the verifier.

Images