Distributed key generation method based on SM2 algorithm

Abstract

The invention discloses a distributed key generation method and device based on an SM2 algorithm, a medium and equipment. The method comprises the following steps: determining a class group encryption key, a class group decryption key and a corresponding first zero knowledge proof through public parameters generated based on the SM2 distributed key; each participant shares respective secret share based on the class group encryption key, the class group decryption key and the first zero-knowledge proof, and creates a second zero-knowledge proof indicating that sharing is correct; each parameter party collects honest distribution shares and decryption shares based on the second zero knowledge proof, calculates a part of private keys and a part of public keys according to the decrypted secret shares, and creates a third zero knowledge proof indicating correct decryption; according to the third zero knowledge proof, partial public keys of participants correctly executing decryption operation are determined to reconstruct a global public key, the secret is shared by using a polynomial, each participant can contribute a part of shares, and a distributed secret key is generated without any credible setting.

Description

Technical Field

[0001] The present application relates to the technical field of distributed key generation, and in particular to a distributed key generation method, apparatus, medium and device based on the SM2 algorithm. Background Art

[0002] Distributed key generation is a crucial component of threshold cryptography. Distributed key generation allows multiple parties to jointly negotiate and generate a public key in an untrusted network environment, with each party receiving a share of a private key. By distributing the key generation process across multiple parties, distributed key generation protocols address the single point of failure and central security risks inherent in traditional centralized key distribution. Distributed key generation has found widespread application in emerging fields such as blockchain, random beacons, cryptocurrencies, and secure multi-party computation. Numerous distributed key generation schemes based on various cryptographic frameworks have been proposed. Zhang Rui et al. proposed a distributed key generation framework for threshold cryptography based on the discrete logarithm problem. Xie Yongming et al. proposed a distributed private key generation scheme with self-authenticated identities. Wang Hong et al. proposed a distributed key generation algorithm with multiple key privacy centers based on identity-based encryption. Zhang Jie et al. proposed a secure distributed key generation protocol in bilinear groups based on vector space access structures. Zhang Haibin et al. proposed an asynchronous distributed key generation method and system with optimal time complexity, supporting domain elements as private keys and a high threshold. Xu Bo et al. introduced a distributed key generation protocol in hierarchical identity-based cryptography to address potential risks from malicious private keys or upper-layer entities. Weng Yijing proposed a distributed key generation method using hash tables and polling queues. Peng Changgen et al. proposed a one-round verifiable distributed key generation protocol using attribute encryption with ciphertext strategy. Liu Yizhong et al. proposed a batch-efficient distributed key generation method in an asynchronous environment using super-reversible matrix technology.

[0003] However, there are few distributed key generation schemes for elliptic curve cryptography. To address this, Zhang Rui et al. designed a distributed key generation scheme based on SM9. However, this scheme is inefficient, and identity-based encryption systems cannot be directly applied to traditional public key cryptography. Therefore, there is currently a lack of efficient distributed key generation methods for elliptic curve public key cryptography.

[0004] The SM2 elliptic curve public key cryptography algorithm is a standard public key cryptography algorithm in my country. It offers high security and small key and signature lengths, and has been widely used in emerging fields such as blockchain smart contracts, electronic voting, and IoT communications. However, there is currently no distributed key generation method designed for the SM2 algorithm. Summary of the Invention

[0005] The main purpose of this application is to provide a distributed key generation method, device, medium and equipment based on the SM2 algorithm, aiming to provide SM2 with a more secure and reliable key management infrastructure in the fields of digital identity authentication, secure communication, blockchain, etc.

[0006] To achieve the above objectives, this application provides a distributed key generation method based on the SM2 algorithm, comprising: determining a group encryption key and a group decryption key, as well as a corresponding first zero-knowledge proof, based on the public parameters of the SM2 distributed key generation; each participant sharing their respective secret shares based on the group encryption key, group decryption key, and the first zero-knowledge proof, and creating a second zero-knowledge proof indicating that the sharing was correct; each participant collecting the honestly distributed encrypted shares based on the second zero-knowledge proof, decrypting the shares, calculating partial private keys and partial public keys based on the decrypted shares, and creating a third zero-knowledge proof indicating that the decryption was correct; and reconstructing the global public key based on the partial public keys of the participants who correctly performed the decryption operation based on the third zero-knowledge proof.

[0007] Optionally, the public parameters generated by the distributed key based on SM2 determine the group encryption key, the group decryption key and the corresponding first zero-knowledge proof, including: the participants generate public parameters based on the distributed key of SM2, wherein the public parameters include elliptic curve related parameters and group parameters; based on the first parameter in the group parameters, a group decryption key of each participant is determined, the group decryption key is a random integer, and based on the second parameter in the group parameters as the base and the random integer as the exponent, the group encryption key of each participant is determined, and the first zero-knowledge verification of each participant is generated based on the second parameter, the group encryption key and the group decryption key.

[0008] Optionally, each participant shares their respective secret shares based on the group encryption key, the group decryption key and the first zero-knowledge proof, and creates a second zero-knowledge proof indicating that the sharing is correct, including: constructing a secret sharing polynomial, wherein the zero value of the secret sharing polynomial is the secret to be shared; calculating each share to be sent to the participant according to the secret sharing polynomial, and constructing a commitment to be published based on the second parameter as the base and the random number as the exponent, constructing a first exponential term with the third parameter of the group parameter as the base and the share as the exponent, and constructing a second exponential term with the encryption key as the base and the random number as the exponent, and constructing multiple encrypted shares based on the first exponential term and the second exponential term; and constructing a second zero-knowledge verification of each participant based on the third parameter, the second parameter, the encryption key, the commitment, the encrypted share, the random number and the secret sharing polynomial.

[0009] Optionally, each party collects the honestly distributed encrypted shares based on the second zero-knowledge proof, decrypts the shares, calculates a partial private key and a partial public key based on the decrypted secret shares, and creates a third zero-knowledge proof indicating correct decryption, including:

[0010] Each participant determines each first participant based on the second zero-knowledge verification and calculates the product of the commitments sent by each participant and the product of the encrypted shares, where the first participant is the one whose encryption is successful. A third exponential term is constructed using the product of the commitments and the encrypted shares as the base and the decoding key as the exponent. The third exponential term and the product of the commitments are used to construct the third parameter of each second participant. The third parameter is processed using the Solve algorithm for solving discrete logarithms carried by the fourth parameter in the group parameter to obtain a distributed private key. The distributed public key is obtained by multiplying the distributed private key and the parameters of the elliptic curve. A third zero-knowledge verification is then constructed based on the second zero-knowledge verification, the product of the encrypted shares, and the product of the commitments.

[0011] Optionally, reconstructing the global public key using partial public keys of the party that correctly performed the decryption operation based on the third zero-knowledge proof includes: each party determining a second party based on the third zero-knowledge proof, and each party constructing the global public key based on the distributed public keys of all second parties, wherein the second party is the party that correctly performed the decryption operation.

[0012] In addition, to achieve the above-mentioned purpose, the present application also provides a distributed key generation device based on the SM2 algorithm, including: a key generation module, used to determine the group encryption key and the group decryption key and the corresponding first zero-knowledge proof based on the public parameters of the distributed key generation of SM2; a share distribution module, used for each participant to share their respective secret shares based on the group encryption key, the group decryption key and the first zero-knowledge proof, and create a second zero-knowledge proof indicating that the sharing is correct; a decryption module, used for each participant to collect the honestly distributed encrypted shares based on the second zero-knowledge proof, decrypt the shares, calculate partial private keys and partial public keys based on the decrypted secret shares, and create a third zero-knowledge proof indicating correct decryption; a reconstruction module, used to determine the partial public keys of the participants who correctly perform the decryption operation based on the third zero-knowledge proof to reconstruct the global public key.

[0013] To achieve the above objectives, the present application also provides a computer-readable storage medium, which includes instructions. When the instructions are run on a computer, the computer executes the distributed key generation method based on the SM2 algorithm provided in the above embodiment.

[0014] To achieve the above-mentioned purpose, the present application also provides an electronic device, which includes: at least one processor, a memory and an input and output unit; wherein the memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute the distributed key generation method based on the SM2 algorithm provided in any of the aforementioned embodiments.

[0015] The embodiments of the present application propose a distributed key generation method, apparatus, medium, and device based on the SM2 algorithm. The method determines a group encryption key and a group decryption key, as well as a corresponding first zero-knowledge proof, using public parameters generated by the distributed key based on SM2. Each participant shares their respective secret shares based on the group encryption key, group decryption key, and the first zero-knowledge proof, and creates a second zero-knowledge proof indicating that the sharing is correct. Each participant collects the honestly distributed encrypted shares based on the second zero-knowledge proof, decrypts the shares, calculates a partial private key and a partial public key based on the decrypted secret shares, and creates a third zero-knowledge proof indicating that the decryption is correct. The global public key is reconstructed using the partial public key of the participant who correctly performed the decryption operation based on the third zero-knowledge proof. The present invention implements a distributed key generation method based on the SM2 algorithm, utilizing polynomials to share secrets. Each participant can contribute a portion of the share, and distributed keys are generated without any trusted setup. At the same time, the group encryption method is introduced into the design. Due to its excellent properties, the present invention can ultimately generate a complete private key share rather than a function of the private key share. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart illustrating an embodiment of a distributed key generation method based on the SM2 algorithm of this application is provided;

[0017] Figure 2 A protocol flow chart of zero-knowledge proof π1 provided in accordance with an embodiment of a distributed key generation method based on the SM2 algorithm of this application;

[0018] Figure 3 A protocol flow chart of zero-knowledge proof π2 provided in accordance with an embodiment of a distributed key generation method based on the SM2 algorithm of this application;

[0019] Figure 4 This is a protocol flow chart of zero-knowledge proof π3 provided in an embodiment of a distributed key generation method based on the SM2 algorithm of this application.

[0020] The realization of the objectives, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0021] It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0022] Reference Figure 1 The first embodiment of the present application provides a distributed key generation method based on the SM2 algorithm, which may include:

[0023] S10, determining the group encryption key and the group decryption key and the corresponding first zero-knowledge proof based on the public parameters of the distributed key generation of SM2;

[0024] In one embodiment of the present application, determining the group encryption key and the group decryption key and the corresponding first zero-knowledge proof based on the public parameters of the distributed key generation of SM2 includes:

[0025] The participants generate public parameters based on the distributed key of SM2, where the public parameters include elliptic curve related parameters and group parameters;

[0026] A group decryption key of each participant is determined based on the first parameter in the group parameters, where the group decryption key is a random integer. The group encryption key of each participant is determined based on the second parameter in the group parameters as the base and the random integer as the exponent, and a first zero-knowledge verification of each participant is generated based on the second parameter, the group encryption key and the group decryption key.

[0027] For example, in the parameter initialization phase, each distributed processor of the present application can generate the public parameters required for the distributed key generation protocol based on SM2; the parameters include elliptic curve related parameters (q, a, b, P) and group parameters

[0028] Among them, q is a large prime number, a and b are elliptic curve parameters, and P is a base point of the elliptic curve. is an order of The group, is unknown, but its upper bound is The first parameter is known. Not necessarily a cyclic group, but there exists a cyclic subgroup G It can be expressed as G=G q ×F,G q is a group containing the elements of G raised to the power of q, with the generator being the second parameter g q , F is a subgroup of cardinality q, with generator f. The key to the group-like framework is that there exists an efficient algorithm Solve for solving discrete logarithms in the subgroup F.

[0029] Then, each distributed processor can generate encryption and decryption keys. Specifically, each participant i randomly selects an element dk i D q As the decryption key, where D q is an integer distribution such that Statistically close to G q The uniform distribution in . Calculate and publish G q As the encryption key. In addition, a first zero-knowledge verification π1,i((g q ,ek i );dk i) to prove the correctness of the key.

[0030] The first zero-knowledge proof π1 is executed during the encryption and decryption key generation phase to verify the correctness of each participant's encryption and decryption keys. The specific process of zero-knowledge proof π1 is as follows:

[0031] The prover randomly selects r←[A] and calculates the commitment

[0032] The prover calculates the challenge c = H1(g q ,ek,t)[0,C], and the response u=r+c·dk;

[0033] The prover outputs (u,c);

[0034] The verifier checks u[-SC,SC+A];

[0035] Validator calculation Check c=H1(g q ,ek,t'), output 1 if all checks pass, otherwise output 0.

[0036] Only parties who have passed the verification will be allowed to proceed to the following steps.

[0037] S20. Each participant shares their secret share based on the group encryption key, the group decryption key, and the first zero-knowledge proof, and creates a second zero-knowledge proof indicating that the sharing is correct.

[0038] In one embodiment of the present application, each participant shares their respective secret shares based on the group encryption key, the group decryption key, and the first zero-knowledge proof, and creates a second zero-knowledge proof indicating that the sharing is correct, which may include the following execution process:

[0039] S201. Construct a secret sharing polynomial, where the zero value of the secret sharing polynomial is the secret to be shared;

[0040] S202. Calculate the shares to be sent to the participants based on the secret sharing polynomial, and construct a commitment to be published based on the second parameter as the base and the random number as the exponent. Construct a first exponential term based on the third parameter of the group parameter as the base and the share as the exponent. Construct a second exponential term based on the encryption key as the base and the random number as the exponent. Construct multiple encrypted shares based on the first exponential term and the second exponential term.

[0041] For example, in the key distribution phase, each distributed processor can randomly select s for each participant i. i As the secret to be shared, randomly choose a t-degree secret sharing polynomial p i (x) where p i (0)=s i For j = [n] (n is the total number of participants), calculate σ i,j =p i (j) represents the share sent to participant j.

[0042] Then, each distributed processor can sample a random number r i D q , and publish its commitment

[0043] Subsequently, each distributed processor uses the encryption key of participant j to send the secret share and calculate n encrypted secret shares And according to the third parameter, the second parameter, the encryption key, the commitment, the encryption share, the random number and the secret sharing polynomial, each participant constructs the second zero knowledge π 2,i ((f,g q ,(ek j ) j[n] ,R i ,(S i,j ) j[n] );(p i (x),r i )) to show that you have made the correct distribution.

[0044] The specific process of zero-knowledge proof π2:

[0045] The prover calculates (m(x),c1,c2,…,c n )=H2(ek1,…,ek n ,R,S1,…,S n ), and let

[0046] The prover defines w i =m(i)·v i , and calculate w ' i =w i +c i q;

[0047] Prover calculation and Create and output

[0048] Finally, the output of each participant i in this stage is (R i ,(S i,j ) j[n] ,π 2,i ).

[0049] S30. Each party collects the honest distribution shares based on the second zero-knowledge proof, decrypts the shares, calculates a partial private key and a partial public key based on the decrypted secret shares, and creates a third zero-knowledge proof indicating correct decryption.

[0050] In one embodiment of the present application, the participating parties collect the honest distribution shares based on the second zero-knowledge proof, decrypt the secret shares, calculate the partial private key and the partial public key based on the decrypted secret shares, and create a third zero-knowledge proof indicating correct decryption, including:

[0051] Each participant determines each first participant based on the second zero-knowledge verification, specifically:

[0052] The verifier calculates (m(x),c1,c2,…,c n )=H2(ek1,…,ek n ,R,S1,…,S n );

[0053] The verifier calculates w i =m(i)·v i and w ' i =w i +c i q;

[0054] Validator calculation and

[0055] The verifier performs the verification process of Pf.

[0056] The product of the commitments sent by each participant and the product of the encrypted shares are calculated, and a third zero-knowledge verification is constructed based on the second zero-knowledge verification, the product of the encrypted shares and the product of the commitments, wherein the first participant is the participant whose encryption is successful.

[0057] In one embodiment of the present application, during the decryption phase, each distributed processor orders the 2,i The set of participants to be verified is U. For participant iU, first calculate R U =∏ jU R j and S U,i =∏ jU S j,i .

[0058] Then, calculate After that, you can get the distributed private key tsk i =Solve(f i ) and public key tpk i =[tsk i ]P. Then create a zero-knowledge proof π 3,i((f,R U ,S U,i ,tpk i ,ek i );(tsk i ,dk i )) to prove that you have done the correct decryption operation, specifically:

[0059] Provers are randomly selected and calculate

[0060] The prover calculates the challenge c = H1(g q ,f,R U ,S U,i ,P,tpk i ,ek i ,S * ,P * ,T * );

[0061] The prover computes the response and u2=r2+c·tsk i mod q;

[0062] The prover outputs (c,u1,u2);

[0063] Finally, the output of each participant i in this stage is (tpk i ,π 3,i ).

[0064] S40. Reconstruct the global public key using the partial public key of the party that correctly performs the decryption operation according to the third zero-knowledge proof.

[0065] The reconstructing the global public key by determining the partial public key of the party that correctly performs the decryption operation according to the third zero-knowledge proof includes:

[0066] Each distributed processor orders through π 3,i The set of participants in the verification is Q, and the specific verification process is as follows:

[0067] Validator calculation

[0068] The verifier checks c = H3 (g q ,f,R U ,S U,i ,P,tpk i ,ek i ,S * ,P * ,T * ), if the check passes, output 1, otherwise output 0.

[0069] Any t+1 participants in Q are set T. Each participant can reconstruct the global public key tpk=∑ iT [λ i ]tpk i ,in

[0070] In order to clearly understand the purpose, technical solutions and advantages of the present invention, the following Figure 2-4 It should be understood that the present invention can be implemented in many different forms and is not limited to the embodiments set forth herein. The purpose of the embodiments of the present invention is to make the disclosure of the present invention more thorough and comprehensive for easy understanding.

[0071] Symbol definitions and descriptions:

[0072] n is the total number of participants, t is the system threshold, and q is a large prime number;

[0073] Defined as the ring of integers modulo q;

[0074] a,b are The elements in are used to define an elliptic curve, and P is defined as the base point of the elliptic curve;

[0075] Defined as an order The group, among which is unknown, but its upper bound is is known;

[0076] G is defined as A cyclic subgroup of can be expressed as G = G q ×F,G q is a group containing the elements of G raised to the power of q, with the generator being g q ; F is a subgroup of cardinality q, and its generator is f;

[0077] D q Defined as a distribution over integers such that Statistically close to G q Uniform distribution in

[0078] π 1,i ,π 2,i ,π 3,i They are defined as the zero-knowledge proof of participant i in the key generation phase, distribution phase, and decryption phase respectively;

[0079] A, K, and C are all integers and are the range parameters required in zero-knowledge proofs;

[0080] Define two random oracles H1:{0,1} *→[C] and

[0081] tpk i and tsk i is defined as the partial public key and partial private key of participant i, and tpk is defined as the global public key generated by this method.

[0082] The specific embodiments of the present invention are described as follows:

[0083] (1) Parameter initialization: Generate all public parameters pp required for this method. The parameters pp include the total number of participants n, the threshold parameter t, the elliptic curve parameters (q, a, b, P) and the group parameters

[0084] (2) Generate encryption and decryption keys: For each participant i[n], input the system parameter pp and execute the following steps:

[0085] (2a) Random sampling dk i ←D q as the decryption key, and then calculate G q as encryption keys;

[0086] (2b) Create a non-interactive zero-knowledge proof π1,i((g q ,ek i );dk i ) to prove the validity of the key;

[0087] (2c) Output the encryption key and the corresponding certificate (ek i ,π 1,i ).

[0088] Each participant can verify the correctness of the keys of all other participants, and only participants who pass the verification can enter the next stage.

[0089] (3) Distribution phase: For each participant i, input the system parameters pp and the encryption key (ek i ) i[n] , follow these steps:

[0090] (3a) Randomly sample a secret value and a random polynomial of order t where p i (0)=s i ;

[0091] (3b) For j = 1, 2, ..., n, let σ i,j =p i (j), represents the share sent by participant i to participant j;

[0092] (3c) Random sampling r i ←D q , and publish its commitment

[0093] (3d) Encrypt n secret shares and calculate Then create a zero-knowledge proof π 2,i ((f,g q ,(ek j ) j[n] ,R i ,(S i,j ) j[n] );(p i (x),r i )) to show that they have made the correct distribution;

[0094] (3e) Output commitment, encrypted share and corresponding proof (R i ,(S i,j ) j[n] ,π 2,i ).

[0095] (4) Decryption phase: Input system parameters pp, commitment, encryption share and corresponding proof ((R i ) i[n] ,(S i,j ) i,j[n] ,(π 2,i ) i[n] ), let π 2,i The set of participants to be verified is U. For participant iU, the following steps are performed:

[0096] (4a) Aggregate the secrets of the honest participants in the set U and calculate R U =∏ jU R j and S U,i =∏ jU S j,i ;

[0097] (4b) Calculation Using the characteristics of subgroup F, the private key share tsk is calculated i =Solve(f i );

[0098] (4c) Calculate the partial public key tpk i =[tsk i ]P, and then create a zero-knowledge proof π3,i((g q ,f,R U ,S U,i ,P,tpk i ,ek i);(tsk i ,dk i )) to prove that you have done the correct decryption operation;

[0099] (4d) Output the partial public key and the corresponding zero-knowledge proof (tpk i ,π 3,i ).

[0100] (5) Reconstruction phase: Input all partial public keys and corresponding certificates (tpk i ) iU ,(π3,i) iU ), let the set of participants that have passed π3,i verification be Q. For participant iQ, perform the following operations:

[0101] Select any t+1 participants in Q, denoted as T; then the global public key tpk=∑ iT [λ i ]tpk i ,in

[0102] This paper implements a distributed key generation method based on the SM2 algorithm, utilizing polynomials to share secrets. Each participant can contribute a portion of the secret, and distributed keys are generated without requiring any trusted setup. Furthermore, the design incorporates group encryption, which, due to its advantageous properties, ensures that each participant ultimately holds a complete share of the private key, rather than a function of it.

[0103] In addition, the method of the present invention combines zero-knowledge proof technology to achieve the goal of public verification at each stage, thereby avoiding complicated complaints; at the same time, the existence of zero-knowledge proof can ensure that the system detects the operations of malicious participants; and, even when facing a malicious adversary who can corrupt t participants, the system will not disclose any information about the complete private key or the partial private key held by other participants.

[0104] Based on the above embodiments, the present application also provides a distributed key generation device based on the SM2 algorithm, including a key generation module, which is used to determine the group encryption key and the group decryption key and the corresponding first zero-knowledge proof based on the public parameters of the distributed key generation of SM2; a share distribution module, which is used for each participant to share their respective secret shares based on the group encryption key, the group decryption key and the first zero-knowledge proof, and create a second zero-knowledge proof indicating that the sharing is correct; a decryption module, which is used for each participant to collect the honestly distributed encrypted shares based on the second zero-knowledge proof, decrypt the shares, calculate partial private keys and partial public keys based on the decrypted secret shares, and create a third zero-knowledge proof indicating correct decryption; a reconstruction module, which is used to determine the partial public keys of the participants who correctly perform the decryption operation based on the third zero-knowledge proof to reconstruct the global public key.

[0105] It is not difficult to find that this embodiment is a system embodiment corresponding to the above-mentioned method embodiment, and this embodiment can be implemented in conjunction with the above-mentioned method embodiment. The relevant technical details and technical effects mentioned in the above-mentioned embodiments are still valid in this embodiment, and to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above-mentioned embodiments.

[0106] It is worth mentioning that all modules involved in this embodiment are logical modules. In actual applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, to highlight the innovation of this application, this embodiment does not introduce units that are not closely related to solving the technical problems proposed by this application. However, this does not mean that other units do not exist in this embodiment.

[0107] Another embodiment of the present application proposes an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the distributed key generation method based on the SM2 algorithm in the above-mentioned method embodiments.

[0108] The memory and processor are connected using a bus, which can include any number of interconnected buses and bridges. The bus connects various circuits of one or more processors and memories. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits. These are all well known in the art and therefore will not be described further in this article. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. Data processed by the processor is transmitted on a wireless medium via an antenna. Furthermore, the antenna also receives data and transmits it to the processor.

[0109] The processor is responsible for managing the bus and general processing, and may also provide various functions, including timing, peripheral interfacing, voltage regulation, power management, and other control functions. Magnetic memory can be used to store data used by the processor while performing operations.

[0110] Another embodiment of the present application relates to a computer-readable storage medium storing a computer program, which implements the above method embodiment when executed by a processor.

[0111] That is, those skilled in the art will understand that all or part of the steps in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a program, which is stored in a storage medium and includes a number of instructions for causing a device (which may be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: a USB flash drive, a mobile hard drive, a ROM (Read-Only Memory), a RAM (Random Access Memory), a magnetic disk, or an optical disk, etc., various media that can store program code.

[0112] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A distributed key generation method based on the SM2 algorithm, characterized in that: include: Determine the group encryption key and the group decryption key and the corresponding first zero-knowledge proof based on the public parameters of the distributed key generation of SM2; Each participant shares their secret share based on the group encryption key, group decryption key, and the first zero-knowledge proof, and creates a second zero-knowledge proof indicating that the sharing is correct; Each party collects the honestly distributed encrypted shares based on the second zero-knowledge proof, decrypts the shares, calculates a partial private key and a partial public key based on the decrypted secret shares, and creates a third zero-knowledge proof indicating correct decryption; The global public key is reconstructed based on the partial public key of the party that correctly performs the decryption operation.

2. The distributed key generation method based on the SM2 algorithm according to claim 1, characterized in that: The public parameters of the distributed key generation based on SM2 determine the group encryption key and the group decryption key and the corresponding first zero-knowledge proof, including: Generate public parameters based on SM2 distributed key, where public parameters include elliptic curve related parameters and group parameters; A group decryption key of each participant is determined based on the first parameter in the group parameters, where the group decryption key is a random integer. The group encryption key of each participant is determined based on the second parameter in the group parameters as the base and the random integer as the exponent, and a first zero-knowledge verification of each participant is generated based on the second parameter, the group encryption key and the group decryption key.

3. The distributed key generation method based on the SM2 algorithm according to claim 2, characterized in that: Each participant shares their respective secret shares based on the group encryption key, the group decryption key, and the first zero-knowledge proof, and creates a second zero-knowledge proof indicating that the sharing is correct, including: Constructing a secret sharing polynomial, wherein the zero value of the secret sharing polynomial is the secret to be shared; Calculate the shares to be sent to the participants based on the secret shared polynomial, and construct the commitment to be published based on the second parameter as the base and the random number as the exponent. Construct the first exponential term based on the third parameter of the group parameter as the base and the share as the exponent, and construct the second exponential term based on the encryption key as the base and the random number as the exponent. Construct multiple encrypted shares based on the first exponential term and the second exponential term; And construct a second zero-knowledge verification based on the third parameter, the second parameter, the encryption key, the commitment, the encryption share, the random number and the secret sharing polynomial of each participant.

4. The distributed key generation method based on the SM2 algorithm according to claim 3, characterized in that: Each party collects the honestly distributed encrypted shares based on the second zero-knowledge proof, decrypts the shares, calculates a partial private key and a partial public key based on the decrypted secret shares, and creates a third zero-knowledge proof indicating correct decryption, including: Each participant determines each first participant based on the second zero-knowledge verification and calculates the product of the commitments sent by each participant and the product of the encrypted shares, where the first participant is the honest encryption participant. A third exponential term is constructed using the product of the commitments and the encrypted shares as the base and the decoding key as the exponent. The third exponential term and the product of the commitments are used to construct the third parameter of each second participant. The third parameter is processed using the Solve algorithm for solving discrete logarithms carried by the fourth parameter in the group parameter to obtain a distributed private key. The distributed public key is obtained by multiplying the distributed private key and the parameters of the elliptic curve. A third zero-knowledge verification is then constructed based on the product of the encrypted shares and the product of the commitments.

5. The distributed key generation method based on the SM2 algorithm according to claim 1, characterized in that: The reconstructing the global public key by determining the partial public key of the party that correctly performs the decryption operation according to the third zero-knowledge proof includes: Each participant determines the second participant based on the third zero-knowledge verification, and constructs a global public key based on the distributed common key of the second participant, wherein the second participant is the participant who correctly performs the decryption operation.

6. A distributed key generation device based on the SM2 algorithm, characterized in that: include: A key generation module, configured to determine a group encryption key and a group decryption key and a corresponding first zero-knowledge proof based on the public parameters of the distributed key generation of SM2; A share distribution module is used for each participant to share their respective secret shares based on the group encryption key, the group decryption key and the first zero-knowledge proof, and to create a second zero-knowledge proof indicating that the sharing is correct; a decryption module for each party to collect the honestly distributed encrypted shares based on the second zero-knowledge proof, decrypt the shares, calculate a partial private key and a partial public key based on the decrypted secret shares, and create a third zero-knowledge proof indicating correct decryption; The reconstruction module is used to reconstruct the global public key based on the partial public key of the participant who correctly performs the decryption operation according to the third zero-knowledge proof.

7. A computer-readable storage medium, characterized in that The invention includes instructions, which, when executed on a computer, enable the computer to execute the distributed key generation method based on the SM2 algorithm as claimed in any one of claims 1 to 6.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor, memory, and input-output unit; The memory is used to store a computer program, and the processor is used to call the computer program stored in the memory to execute the distributed key generation method based on the SM2 algorithm according to any one of claims 1 to 5.

Images