A SM2 collaborative signature method based on additive key splitting and homomorphic encryption

Abstract

The present invention discloses an SM2 collaborative signature method based on additive key splitting and homomorphic encryption. The method first performs key splitting and generates two private key components through additive splitting. Secondly, based on the length of the user identifier, a hash value is obtained through a hash algorithm, and the hash value and the plaintext are combined through an encryption algorithm to obtain a signature result. Then, the user and the server calculate their respective signatures in the encryption domain based on the private key component, the hash value and the signature result. Finally, the users merge their respective signatures, and then decrypt and verify them to complete the SM2 collaborative signature. The present invention can greatly reduce resource consumption and computing time in resource-constrained situations, ensure data integrity in the collaborative computing process, and effectively hide the privacy information of the participants.

Description

Technical Field

[0001] The present invention relates to the field of cryptography and information security technology, and in particular to a digital signature method based on homomorphic encryption. Background Art

[0002] In modern information security systems, digital signature technology is a key means of ensuring data integrity, authenticity, and non-repudiation. The SM2 algorithm is a public-key cryptography algorithm based on elliptic curve cryptography (ECC). Compared to the traditional RSA algorithm, SM2 offers shorter key lengths and higher computational efficiency while providing the same security strength. Therefore, it is widely used in electronic authentication, financial transactions, and data security. The SM2 algorithm supports key exchange, data encryption, and digital signatures. The SM2 signature algorithm, with its high security and computational efficiency, has become a widely used digital signature method in China.

[0003] However, during the multi-party signature calculation process, a single signatory may expose their private key or partial key information, posing a potential security risk. During the collaborative signature calculation process involving two or more parties, the intermediate data used in the signature calculation inevitably contains some private key information, which poses a risk of capture and decryption during transmission. Furthermore, with increasingly stringent data privacy regulations (such as GDPR), achieving effective digital signature calculation while ensuring data privacy has become a pressing issue. Therefore, this paper proposes an SM2 collaborative signature method based on additive key splitting and homomorphic encryption. This method performs the calculation in ciphertext, allowing specific operations to be performed without decrypting the data. The decrypted result is consistent with the result calculated directly on the plaintext. Furthermore, the introduction of random numbers prevents attackers from recovering private key information from the intermediate data, enabling signature calculation to be completed without exposing any private key details. By combining the SM2 signature algorithm with homomorphic encryption, secure collaborative signatures can be achieved by multiple parties, ensuring signature accuracy and consistency while mitigating the risk of private key leakage. Summary of the Invention

[0004] In order to solve the risk of private key leakage that may exist in the existing SM2 collaborative signature process and at the same time ensure the correctness and security of the signature, the present invention proposes an SM2 collaborative signature method based on additive key splitting and homomorphic encryption. Under the premise of ensuring signature consistency, this method can effectively avoid private key leakage and securely complete the generation of SM2 signatures. Unlike other methods based on multiplication-based key splitting, the present invention can more conveniently split the private key into private key components saved by both parties, saving resource overhead to a certain extent and improving computing efficiency. It is particularly suitable for scenarios where data privacy, integrity and verifiability need to be guaranteed at the same time, such as blockchain transactions, medical data sharing, financial payment systems, etc.

[0005] First, the following parameters need to be clarified:

[0006] Related parameters of the sm2 algorithm: , is the elliptic curve system parameter, which defines An elliptic curve E on, n is the modulus, is the private key, d1 and d2 are The private key components are divided, k is a random number, G is a base point on the elliptic curve, , is the base point coordinate; is the public key, , P A coordinate; is the user identifier, which can be customized; r is the parameter used to calculate and verify the signature result s.

[0007] Related parameters of the Paillier algorithm: p and q are two randomly selected large prime numbers as private keys, satisfying , N and g are public keys, , , μ is the pre-calculated modular inverse element used for decryption calculation, satisfying , E(m) operation means to encrypt m with Paillier algorithm, and D(c) operation means to decrypt c with Paillier algorithm. express The modulo n inverse operation, that is .

[0008] The technical method of the present invention is as follows:

[0009] An SM2 collaborative signature method based on additive key splitting and homomorphic encryption includes the following processes:

[0010] Step 1: Split the key by adding it to generate two private key components.

[0011] Step 2: Based on the length of the user ID, a hash value is obtained through a hash algorithm;

[0012] Step 3: Use the hash value and plain text through the encryption algorithm to obtain the signature result;

[0013] Step 4: The user and server each calculate their own signature in the encryption domain based on the private key component, hash value, and signature result.

[0014] Step 5: The users merge their respective signatures, decrypt and verify them, and complete the SM2 collaborative signature.

[0015] Furthermore, the key is split first. A random number d is generated by the key distribution facility, and a private key is generated based on the random number d, sm2 related system parameters and user-defined parameters. , and then generate random numbers again , and through the relation generate , Saved by user A, Saved by server B; user A will be the user ID The length entlenA is converted into two bytes ENTLA; user A generates H, which is composed of ENTLA, , a, b, xG, yG, xA, yA; use the hash algorithm to encrypt H into a hash value ZA; concatenate ZA with the plaintext M to obtain ; Then use the hash algorithm to Encrypt to hash value e; calculate coordinates , for The horizontal axis of the signature is calculated. .

[0016] Paillier's encryption algorithm: , where g and N are the algorithm public keys, m is the plaintext, and r is a random integer.

[0017] Paillier's decryption algorithm: , where N is the algorithm public key, λ and μ are the algorithm private keys, and c is the ciphertext; Calculate for integer division:

[0018]

[0019] The processing flow of the method is as follows:

[0020] User A and server B calculate their respective signatures in the Paillier encryption domain and :

[0021]

[0022]

[0023] The corresponding parameters are described as follows:

[0024] is the signature calculated by user A; is the signature calculated by server B. is the private key component stored by user A. is the private key component stored by server B. k is the random number used for signature calculation. r is the result r generated together with the digital signature for signature verification. is the scrambling parameter generated by a random number generator and saved by user A. Based on The calculated disturbance parameters are saved by server B. is the scrambling parameter generated by a random number generator and saved by user A. Based on The calculated disturbance parameters are saved by server B.

[0025] The combined encryption result by user A is:

[0026]

[0027] Finally, Paillier decryption obtains the signature to be verified :

[0028]

[0029] right Take 256 bits from the right to the left to get the signature s, and user A verifies the signature group ,like or , then the signature is abnormal, and you need to regenerate the random number k and then perform the subsequent calculations. If there is no abnormality, then That is the final valid signature.

[0030] Beneficial effects of the present invention:

[0031] 1. Compared to other multiplication splitting methods, the additive splitting method eliminates one modular multiplication and one modular inverse operation, significantly reducing resource consumption and computation time in resource-constrained scenarios. For example, in FPGA-based computing scenarios, resource consumption (LUTs) is reduced by approximately 70%, FFs by approximately 85%, and computation time by approximately 50%.

[0032] 2. Key splitting prevents a single party from generating a valid signature, ensuring the validity of all participants. Homomorphic encryption safeguards data integrity during collaborative computing, effectively hiding the privacy of all participants. Even if an attacker obtains partial computation results, they cannot directly derive the complete key information. Furthermore, only a single data exchange is required to complete the collaborative signature, reducing communication pressure and the risk of message interception, thereby improving the system's security level.

[0033] 3. By introducing random numbers as disturbance parameters and participating in the calculation process of homomorphic encryption, the attack resistance of the signature process is further guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical methods in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments.

[0035] Figure 1 is a key distribution flow chart provided by an embodiment of the present invention;

[0036] Figure 2 This is a flow chart of decomposing a private key provided by an embodiment of the present invention;

[0037] Figure 3 This is a signature process calculation diagram provided by an embodiment of the present invention;

[0038] Figure 4 This is a simulation diagram of the collaborative signature server provided by an embodiment of the present invention;

[0039] Figure 5 This is a simulation diagram of a collaborative signature client provided by an embodiment of the present invention;

[0040] Figure 6 This is a simulation diagram of additive segmentation (this method) provided by an embodiment of the present invention;

[0041] Figure 7 This is a multiplication split simulation diagram provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The technical method of the present invention is described below in conjunction with the accompanying drawings.

[0043] In order to make the technical problems, technical methods and advantages to be solved by the present invention clearer, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0044] The present invention provides an SM2 digital signature method based on homomorphic encryption, the process is as follows Figure 1 As shown, the processing flow of the method includes the following steps.

[0045] S1. Initialize algorithm parameters.

[0046] The modulus n required for S11 and SM2 is generated according to the National Cryptography Administration's standard "GM / T 0003-2012 SM2 Elliptic Curve Public Key Cryptography Algorithm";

[0047] S12. Select the curve equation recommended in the national secret document ;

[0048] S13. Generate private key : The key distribution facility combines information from both parties to secretly generate a private key ;

[0049] S14. Generate the security parameters required by the Paillier algorithm, modulus , p and q are two large prime numbers, p and q are required to be of equal length and satisfy ;

[0050] S15. Generate key parameters, the public key is .

[0051] S2. Obtain identity parameters and initial parameters and select hash algorithm.

[0052] S21. According to the definition of GMT 0003-2012, Usually comes from unique user information, such as username, email address, mobile phone number, or some system-assigned serial number. The length of the user identifier is defined by the standard specification in bytes or bits. A Need to participate in the calculation to generate the hash value For text information in identifiers, the character encoding needs to be specified as ASCII. In the implementation, It can be pre-processed with a hash function to unify the format and reduce the possibility of information leakage. ;

[0053] S22. Selection of hash function: Based on the application scenario of the hash function required in the SM2 algorithm, select the SM3 hash algorithm. For input of any length, the output is a 256-bit digest value.

[0054] S3, private key component and The key splitting process is as follows: Figure 2 shown.

[0055] S31. Determine the relationship, i.e. , after transformation of equation, we get ;

[0056] S32, using random number generator to generate ,verify If not satisfied, regenerate , where gcd is the Euclidean algorithm;

[0057] S33, calculation , use the extended Euclidean algorithm to optimize, get the modular inverse value and then get it by modular reduction .

[0058] S4. Calculation of hash value.

[0059] S41. Server B calculates H. ,|| is the data splicing symbol;

[0060] S42. Get hash value , , sm3 is the national secret sm3 hash algorithm;

[0061] S43, server B calculates , ;

[0062] S44. Server B calculates the hash value e. .

[0063] S5. Disturbance parameters 、 、 、 Generation.

[0064] S51, user A randomly generates 、 ;

[0065] S52: User A generates 、 .according to and

[0066] ,get and ;

[0067] S53, user A will , Send to server B.

[0068] S6. Calculation of signature r.

[0069] S61. Server B calculates coordinates , generate a random number k, calculate ;

[0070] S62, server B calculates ;

[0071] S63, server B determines or Is it true? If so, regenerate k randomly and recalculate kG and r until it is no longer satisfied. and .

[0072] S7, calculation of signature s, the calculation process is as follows Figure 3 shown.

[0073] S71. Server B calculates:

[0074] ;

[0075] S72, server B will , r, k are sent to user A.

[0076] S73. User A calculates:

[0077] ;

[0078] S74. User A combines the calculations and decrypts:

[0079] ;

[0080] .

[0081] S8. Calculate the final signature s.

[0082] S81, yes Take 256 bits from right to left to get the signature s;

[0083] S82. User A verifies the signature group ,like or , then the signature is abnormal, recalculate from S4, if there is no abnormality, then That is the final valid signature.

[0084] The consistency between the improved signature formula and the original signature formula is simulated and verified below. The relevant public and private key parameters and disturbance parameters are shown in Table 1. The signature result verification is shown in Table 2. The signature simulation is shown in Table 2. Figure 4 and Figure 5 As shown, the server and client complete the collaborative signature through the above process, and by comparing the signature results generated by the signature method in the national secret document, the consistency of the signature results can be strictly verified to ensure that the parameters are synchronized and the encryption operation is correct during the collaborative calculation process. The final signature conforms to the preset mathematical logic, realizing a secure and verifiable distributed signature collaboration. It should be noted that the work of splitting the private key in the simulation verification is completed by client A, and then Send it to server B, simulating the situation where both parties save their own private key components.

[0085] The following is a comparison of two ways to split the private key, namely multiplication splitting and addition splitting. The hardware platform with resources of 218,600 LUTs and 437,200 FFs is used for testing. The relevant optimization algorithms all use conventional optimization algorithms, that is, the modular multiplication algorithm is optimized using the Montgomery algorithm, and the modular inverse algorithm is optimized using the extended Euclidean algorithm. Compared with multiplication splitting, the occupied resources of LUT are optimized by 70%, and the FF is optimized by 85%. The calculation time is optimized by 50% compared with multiplication splitting. Therefore, addition splitting has greater advantages in terms of occupied resources and time consumption. The simulation results of the addition splitting method used in this method are as follows: Figure 6 As shown in the simulation diagram of the additive splitting (this method), the signals are: clock signal, reset signal, splitting start signal, splitting completion signal, private key component signal, other internal state machines, and intermediate variable signals. The simulation results of the multiplication splitting method are as follows: Figure 7 As shown in Tables 1 to 3, the signals in the multiplication split simulation diagram include: clock signal, reset signal, split start signal, split completion signal, private key component signal, other internal state machines, and intermediate variable signals.

[0086] Table 1 Example parameters

[0087]

[0088] Table 2 Signature results

[0089]

[0090] Table 3 Comparison of consumption indicators

[0091]

Claims

1. A SM2 collaborative signature method based on additive key splitting and homomorphic encryption, characterized in that: The following processes are included: Step 1: Split the key by adding it to generate two private key components. Step 2: Based on the length of the user ID, a hash value is obtained through a hash algorithm; Step 3: Use the hash value and plain text through the encryption algorithm to obtain the signature result; Step 4: The user and the server calculate their respective signatures in the encryption domain based on the private key component, hash value, and signature result. The specific implementation is as follows: User A and server B calculate their respective signatures E(s) in the Paillier encryption domain. A ) and E(s B ): User A calculates their respective signatures E(s) in the Paillier encryption domain A ) is calculated as follows: the private key component d1 stored by user A, the scrambling parameter a1 generated by the random number generator and stored by user A, and the scrambling parameter a2 calculated according to a1 + a2 = 0 mod n stored by server B are all encrypted using the Paillier encryption algorithm, and then the encrypted results are weighted added together, where the weight of the encrypted result of the private key component d1 is the sum of the random number k used for signature calculation and the signature result r; Server B calculates its own signature E(s) in the Paillier encryption field B The calculation process of ) is as follows: encrypt d2 (the private key component stored by server B), b1 (the scrambling parameter generated by the random number generator and stored by user A), and b2 (the scrambling parameter stored by server B) using the Paillier encryption algorithm, and then perform weighted addition on the encrypted results, where the weight of the encrypted result of the private key component d2 is the sum of the random number k used for signature calculation and the signature result r; Step 5: The users merge their respective signatures, decrypt and verify them, and complete the SM2 collaborative signature.

2. The SM2 collaborative signature method based on additive key splitting and homomorphic encryption according to claim 1 is characterized in that: The specific implementation process of the addition split is as follows: a random number d is generated by the key distribution facility, and a private key d is generated based on the random number d, the relevant parameters of the SM2 algorithm and the user-defined parameters. A , and then generate a random number d1 again, and through the relationship (d1+d2=(1+d A ) -1 Generate d2, d1 is saved by user A, and d2 is saved by server B.

3. The SM2 collaborative signature method based on additive key splitting and homomorphic encryption according to claim 2 is characterized in that: The parameters related to the SM2 algorithm include: a, b are elliptic curve system parameters, defining an elliptic curve E on Fq, n is the modulus, d A is the private key, d1 and d2 are A The private key components are divided, k is a random number, G is a base point on the elliptic curve, x G ,y G is the base point coordinate; p A is the public key, x A ,y A is the PA coordinate; ID A is the user identifier; r is the parameter used to calculate and verify the signature result s.

4. The SM2 collaborative signature method based on additive key splitting and homomorphic encryption according to claim 3 is characterized in that: The specific implementation process of obtaining the signature result is as follows: User A enters the user ID A The length entlenA is converted into two bytes ENTLA; user A generates H, which is composed of ENTLA, ID A , a, b, xG, yG, xA, yA; use the hash algorithm to encrypt H into a hash value ZA; concatenate ZA with the plaintext M to obtain Then use the hash algorithm to Encrypted to hash value e; calculated coordinates (x1, x2) = k*G, x1 is the horizontal coordinate of k*G, and calculated signature result r = (e+x1).

5. The SM2 collaborative signature method based on additive key splitting and homomorphic encryption according to claim 4 is characterized in that: The specific implementation process of step 5 is as follows: User A and server B calculate their respective signatures E(s) in the Paillier encryption domain. A ) and E(s B ) are added and combined to obtain an encrypted result; The encrypted result is decrypted through Paillier to obtain the signature to be verified s'. 256 bits of s' are taken from the right to the left to obtain the signature s, and user A verifies the signature group (r, s). If s = 0 mod n or s + r = 0 mod n, the signature is abnormal. A new random number k is generated and the subsequent calculation is performed. If there is no abnormality, (r, s) is the final valid signature, completing the SM2 collaborative signature.

Images