Key generation method, device, apparatus, storage medium and program product

Abstract

This application discloses a key generation method, apparatus, device, storage medium, and program product, belonging to the field of cryptography technology. The method includes: obtaining an encrypted private key, a first parameter, and a second parameter; the first and second parameters are determined by a target elliptic curve with a self-homomorphic mapping relationship; if the first parameter is not less than the square root of the second parameter, then based on the first and second parameters, the encrypted private key is decomposed into a first private key parameter and a second private key parameter using the Qin Jiushao algorithm; based on the first and second private key parameters, the scalar multiplication result between the encrypted private key and a first target point on the target elliptic curve is determined through the self-homomorphic mapping relationship, and the scalar multiplication result is determined as the encrypted public key corresponding to the encrypted private key. Thus, by decomposing the encrypted private key to accelerate the scalar multiplication operation, the corresponding encrypted public key is generated quickly.

Description

Technical Field

[0001] This application relates to the field of cryptography technology, and in particular to a key generation method, apparatus, device, storage medium, and program product. Background Technology

[0002] In elliptic curve cryptography (ECC), scalar multiplication is a crucial operation, playing a fundamental role in many core ECC operations, such as key generation, encryption, decryption, signing, and verification. Taking key generation as an example, in the ECC key generation process, the encryptor first chooses an elliptic curve and a base point P on that curve. Then, a sufficiently large positive integer k is randomly selected as the private key. The public key is obtained by calculating the scalar multiplication of k and the base point P, i.e., public key Q = kP. This public key Q is a point on the elliptic curve and can be used together with the private key k for subsequent encryption, decryption, signing, and verification operations. Since public key generation relies on scalar multiplication, and calculating kP involves continuously adding P to itself k-1 times (i.e., kP = P + P + ... + P (k Ps added together), this calculation process is relatively complex and time-consuming, thus affecting the overall performance of the ECC algorithm. Therefore, how to quickly generate keys based on elliptic curves becomes a key technical problem. Summary of the Invention

[0003] This application provides a key generation method, apparatus, device, storage medium, and program product. It accelerates the scalar multiplication operation between the encrypted private key and a first target point on the target elliptic curve by decomposing the encrypted private key, thereby quickly generating the encrypted public key corresponding to the encrypted private key. The technical solution is as follows:

[0004] Firstly, a key generation method is provided, the method comprising:

[0005] Obtain the encrypted private key, a first parameter, and a second parameter; wherein the first parameter and the second parameter are determined by a target elliptic curve with a self-homogeneous mapping relationship, the self-homogeneous mapping relationship meaning that a point on the target elliptic curve can be mapped to another point on the target elliptic curve; if the first parameter is not less than the square root of the second parameter, then based on the first parameter and the second parameter, the encrypted private key is decomposed into a first private key parameter and a second private key parameter using the Qin Jiushao algorithm; based on the first private key parameter and the second private key parameter, through the self-homogeneous mapping relationship, the scalar multiplication result between the encrypted private key and a first target point on the target elliptic curve is determined, and the scalar multiplication result is determined as the encrypted public key corresponding to the encrypted private key.

[0006] Since the first and second private key parameters are obtained by decomposing the encrypted private key, they must be smaller than the encrypted private key itself. Based on the first and second private key parameters, the scalar multiplication result between the encrypted private key and the first target point is calculated through the self-homogeneous mapping relationship. Compared with directly calculating the scalar multiplication between the encrypted private key and the first target point, this greatly reduces the number of point addition operations and accelerates the scalar multiplication process, thereby quickly generating the encrypted public key corresponding to the encrypted private key and improving the overall performance of the ECC algorithm to a certain extent.

[0007] In one possible implementation, the step of decomposing the encrypted private key into a first private key parameter and a second private key parameter using the Qin Jiushao algorithm based on the first parameter and the second parameter includes:

[0008] A two-dimensional grid is constructed based on the first parameter and the second parameter. The two-dimensional grid contains multiple vectors, each vector indicating the coordinates of a point in the two-dimensional grid. Based on the first parameter and the second parameter, the shortest non-zero vector among the multiple vectors is determined by the Qin Jiushao algorithm. Based on the two element values ​​of the shortest non-zero vector and the second parameter, the first private key parameter and the second private key parameter are determined.

[0009] This application utilizes the Qin Jiushao algorithm to accelerate the efficiency of finding the shortest non-zero vector in a two-dimensional lattice, thereby quickly decomposing the encrypted private key into a first private key parameter and a second private key parameter.

[0010] In one possible implementation, the first parameter and the second parameter are coprime numbers, and the first parameter is greater than 1 and less than the second parameter;

[0011] The step of determining the shortest non-zero vector among the plurality of vectors based on the first parameter and the second parameter using the Qin Jiushao algorithm includes:

[0012] The initial state matrix of the Qin Jiushao algorithm is constructed based on the first parameter and the second parameter, and the initial state matrix is ​​iteratively updated multiple times until the updated state matrix satisfies the iteration termination condition. If the value of the second element in the first state matrix is ​​1, then the value of the first element in the first state matrix is ​​determined as the inverse of the first parameter. The inverse of the first parameter refers to the inverse of the first parameter with respect to the modulus of the second parameter. The first state matrix is ​​the state matrix obtained from the last update, and the first element and the second element are two elements in the same row. If the inverse of the first parameter is less than the square root of the second parameter, then the inverse of the first parameter and -1 are determined as the two element values ​​of the shortest non-zero vector.

[0013] In one possible implementation, the method further includes:

[0014] If the value of the second element in the first state matrix is ​​not 1, or the inverse of the first parameter is not less than the square root of the second parameter, then the shortest non-zero vector is determined based on the first state matrix and the second state matrix, where the second state matrix is ​​the state matrix obtained from the second-to-last update.

[0015] In one possible implementation, determining the shortest non-zero vector based on the first state matrix and the second state matrix includes:

[0016] The shortest non-zero vector is determined from the row vectors included in the first state matrix and the row vectors included in the second state matrix.

[0017] In one possible implementation, the initial state matrix is:

[0018]

[0019] Where element x 11 Let x be the first element. 12 For the second element, element x 12 The value of is the first parameter, element x 22 The value is the second parameter.

[0020] In one possible implementation, in the element x 11 The value of x is 1 and the element x 21 When the value of x is 0, the iteration termination condition includes: the element x in the updated state matrix. 12 The value is 1, or the inner product of the updated state matrix is ​​greater than or equal to 0, where the inner product is the element x. 11 and element x 21 The product of x and the element x 12 and element x 22 The difference between the products.

[0021] Therefore, when the first parameter is not less than the square root of the second parameter, this application, by running the Qin Jiushao algorithm and observing the changes in the value of the second element in the state matrix and / or the changes in the inner product of the state matrix during the algorithm's execution, quickly determines the shortest non-zero vector based on the values ​​of each element in the state matrix of the Qin Jiushao algorithm after the iteration termination condition is met. In other words, this application improves the efficiency of finding the shortest non-zero vector in a two-dimensional lattice by running the Qin Jiushao algorithm.

[0022] In one possible implementation, the first parameter and the second parameter are coprime numbers, and the first parameter is greater than 1 and less than the second parameter;

[0023] The method further includes:

[0024] If the first parameter is less than the square root of the second parameter, then 1 and the opposite of the first parameter are determined as the two element values ​​of the shortest non-zero vector; based on the two element values ​​of the shortest non-zero vector and the second parameter, the first private key parameter and the second private key parameter are determined.

[0025] It should be noted that the shortest non-zero vector in this application refers to the shortest non-zero vector in the two-dimensional lattice constructed based on the first and second parameters.

[0026] The first parameter is a, the second parameter is m, and In this case, the shortest non-zero vector in the two-dimensional lattice Λ(m,a) is directly determined to be (1, -a).

[0027] In one possible implementation, determining the scalar multiplication result between the encrypted private key and the first target point on the target elliptic curve based on the first private key parameter and the second private key parameter through the automorphic mapping relationship includes:

[0028] Obtain the first operation result between the first private key parameter and the first target point; obtain the second operation result between the second private key parameter and the second target point, wherein the second target point is a point on the target elliptic curve obtained by mapping the first target point through the automorphic mapping relationship; and determine the scalar multiplication operation result between the encrypted private key and the first target point based on the first operation result and the second operation result.

[0029] Assume the target elliptic curve has the self-isomorphic mapping relationship shown in formula (1):

[0030] φ(P)=aP (1)

[0031] Where P is a point on the target elliptic curve, φ(P) is the point mapped from P, and a satisfies (1+a+a) / ( ... 2 The relationship is given by ) = 0 mod m. Here, m is a parameter related to the target elliptic curve and the automorphism. In this embodiment, the first parameter is a, and the second parameter is m.

[0032] Furthermore, based on the above self-homomorphic mapping relationship, the scalar multiplication operation kP (1≤k≤m) can be decomposed as follows:

[0033] kP=k1P+k2φ(P)mod m (2)

[0034] Among them, both |k1| and |k2| are close to (i.e., approximately equal to) Thus, a scalar multiplication that originally required k point addition operations can now be reduced to approximately [number missing]. The addition operation (because k1P and k2φ(P) need to be calculated separately) significantly improves computational efficiency.

[0035] In one possible implementation, the method is applied to a first device, wherein the encrypted private key and the encrypted public key are encryption keys for the first device to communicate with other devices; the method further includes:

[0036] The system receives an encrypted message sent by a second device, the encrypted message being obtained by encrypting the message using the encryption public key of the first device; based on the first private key parameter and the second private key parameter, the encrypted message is decrypted to obtain the corresponding plaintext message.

[0037] In other words, after the first device decomposes its own encrypted private key into a first private key parameter and a second private key parameter according to the above key generation method, if it subsequently receives a message sent by another device that is encrypted using the first device's encrypted public key, it can reuse the previous decomposition result to reduce the amount of computation when directly decrypting the message using the encrypted private key, thereby improving the decryption efficiency.

[0038] Secondly, a key generation apparatus is provided, which has the function of implementing the key generation method described in the first aspect. The key generation apparatus includes at least one module for implementing the key generation method provided in the first aspect.

[0039] Thirdly, a computer device is provided, comprising a processor and a memory, the memory being used to store a computer program for executing the key generation method provided in the first aspect. The processor is configured to execute the computer program stored in the memory to implement the key generation method described in the first aspect.

[0040] Optionally, the computer device may further include a communication bus for establishing a connection between the processor and the memory.

[0041] Fourthly, a computer-readable storage medium is provided, wherein the storage medium stores instructions that, when executed on a computer, cause the computer to perform the key generation method described in the first aspect.

[0042] Fifthly, a computer program product containing instructions is provided, which, when executed on a computer, cause the computer to perform the key generation method described in the first aspect. Alternatively, a computer program is provided that, when executed on a computer, causes the computer to perform the key generation method described in the first aspect.

[0043] The technical effects achieved by the second, third, fourth, and fifth aspects mentioned above are similar to those achieved by the corresponding technical means in the first aspect, and will not be repeated here. Attached Figure Description

[0044] Figure 1 This is a schematic diagram illustrating an application scenario of elliptic curve cryptography provided in an embodiment of this application;

[0045] Figure 2 This is a schematic diagram illustrating a scenario of scalar multiplication provided in an embodiment of this application;

[0046] Figure 3 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application;

[0047] Figure 4 This is a flowchart illustrating a key generation method provided in an embodiment of this application;

[0048] Figure 5 This is a flowchart illustrating a prime number factorization method provided in an embodiment of this application;

[0049] Figure 6 This is a schematic diagram of a key generation device provided in an embodiment of this application. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0051] To facilitate understanding, before explaining the key generation method provided in this application, the application scenarios and implementation environment of the embodiments of this application will be introduced first.

[0052] First, the application scenarios of the embodiments of this application will be introduced.

[0053] Elliptic curve cryptography (ECC) is a public-key encryption algorithm based on elliptic curve mathematics. Essentially, it uses the discrete logarithm problem to achieve encryption, and has the advantage of providing high security with a small key size.

[0054] Currently, common elliptic curves include, but are not limited to, the following:

[0055] (1) The curve defined by the SM2 national cryptographic standard.

[0056] SM2 is a public-key cryptography algorithm standard issued by the State Cryptography Administration of China. The elliptic curve defined in it is based on a finite field Fp (where p is a large prime number). SM2 curves typically have specific parameters, including the curve coefficients a and b, and the base point P (also called the generator). These parameters are predefined to ensure the security and interoperability of the algorithm. Because SM2 curves are designed with security and efficiency in mind, they are widely used in encrypted communication, digital signatures, and other fields in China.

[0057] (2) Elliptic curve as defined by the National Institute of Standards and Technology (NIST).

[0058] NIST defines a series of elliptic curves, among which P-256 (also known as secp256r1) is a widely used one. This elliptic curve is defined over the prime field Fp (where p is a large prime number), and its equation is y 2 =x 3 +ax+b, where a and b are specific constants. The P-256 curve is widely used in various cryptographic applications due to its security and efficiency, including Transport Layer Security (TLS) protocol, Secure Sockets Layer (SSL) protocol, and blockchain technology.

[0059] (3) Elliptic curves used by blockchain platforms.

[0060] Blockchain platforms may use a variety of different elliptic curves, such as y 2 =x 3 +7, the curve can also be defined over a prime number field.

[0061] An endomorphism is a mapping on an elliptic curve that maps a point on the curve to another point on the same curve while preserving the properties of addition. Efficient endomorphisms exist on certain types of elliptic curves (such as hypersingular elliptic curves), which can be used to accelerate scalar multiplication.

[0062] See Figure 1 ECC has been widely used in many fields due to its superior security and low computing cost, such as blockchain systems, transport layer security (TLS) protocols, and other scenarios that directly apply ECC.

[0063] In blockchain technology, ECC supports public-key encryption, digital signatures, and key exchange protocols, ensuring the security and privacy of on-chain transactions. For example, blockchain platforms utilize ECC for secure communication and transaction verification, effectively preventing data tampering and unauthorized access. TLS, as the cornerstone of encrypted communication on the internet, also relies heavily on ECC support. The application of ECC in TLS enables more efficient key exchange and encryption / decryption operations, significantly improving communication security and efficiency. Both TLS 1.2 and TLS 1.3 versions support key exchange using elliptic curve algorithms, providing users with more reliable encrypted communication services. Beyond these areas, ECC is also directly applied to key exchange, signatures, and public-key encryption. For instance, the elliptic curve Diffie-Hellman key exchange (ECDH) protocol enables secure key exchange between communicating parties; while the elliptic curve digital signature algorithm (ECDSA) generates digital signatures to verify the authenticity and integrity of messages.

[0064] Elliptic curve scalar multiplication is the most core and common operation in the ECC algorithm. It is defined as: given a point P on an elliptic curve and a positive integer k, calculate kP, which is the result of adding itself to the elliptic curve k-1 times. Scalar multiplication plays a fundamental role in many core ECC operations, such as key generation, encryption, decryption, signing, and verification.

[0065] The encryption principle of ECC is primarily based on the discrete logarithm problem on elliptic curves. In elliptic curve cryptography, an elliptic curve is typically chosen, and a finite field (e.g., the set of integers modulo p, where p is a prime number) is defined on this curve. Then, a point P on the curve is selected as the base point (generator), and the order n of P is calculated (i.e., the smallest positive integer among the multiples of P that first returns to P). The private key k is an integer less than n, and the public key Q is kP (i.e., the base point P is incremented k times along the elliptic curve). During encryption, the plaintext is encoded as a point M on the curve, and a random number r is chosen. Ciphertexts C1 and C2 are calculated, where C1 is the sum of M and rQ, and C2 is rP. During decryption, using the private key k and the ciphertexts C1 and C2, M is obtained by subtracting k multiplied by C2 from C1, thus recovering the plaintext.

[0066] See Figure 2 When generating the public key Q, scalar multiplication operation kP is involved; during encryption, scalar multiplication operations rQ and rP are also involved; during decryption, scalar multiplication operation kC2 is involved.

[0067] Taking the key generation stage as an example, since the generation of the public key Q depends on scalar multiplication, and the calculation of kP is obtained by continuously adding itself k-1 times to P, that is, kP = P + P + ... + P (k Ps added together), the calculation process is relatively complex and time-consuming, thus affecting the overall performance of the ECC algorithm.

[0068] Based on this, this application provides a key generation method. When calculating the encrypted public key using scalar multiplication based on a first target point on a target elliptic curve and an encrypted private key, if the target elliptic curve has an automorphic mapping relationship, the encrypted private key can be decomposed using the Qin Jiushao algorithm based on the first and second parameters determined by the automorphic mapping relationship to obtain first and second private key parameters. Then, the encrypted public key is calculated using these first and second private key parameters through the automorphic mapping relationship. Since the first and second private key parameters are obtained by decomposing the encrypted private key, they are necessarily smaller than the encrypted private key itself. Calculating the scalar multiplication result between the encrypted private key and the first target point based on the first and second private key parameters through the automorphic mapping relationship significantly reduces the number of point addition operations compared to directly calculating the scalar multiplication between the encrypted private key and the first target point, accelerating the scalar multiplication process and quickly generating the encrypted public key corresponding to the encrypted private key. This improves the overall performance of the ECC algorithm to a certain extent.

[0069] Secondly, the implementation environment involved in the embodiments of this application will be introduced.

[0070] Figure 3 This is a schematic diagram illustrating the structure of a computer device according to an embodiment of this application. In some embodiments, the computer device can be any device that requires encryption and decryption using elliptic curve cryptography in any application scenario, such as a browser, security chip, smart card, mobile device, etc. The mobile device can be a server (e.g., a standalone server, server cluster, cloud server, etc.). Please refer to... Figure 3 The computer device includes at least one processor 301, a communication bus 302, a memory 303, and at least one communication interface 304.

[0071] Processor 301 can be a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, or one or more integrated circuits for implementing the solutions of this application, such as application-specific integrated circuits (ASICs), programmable logic devices (PLDs), or combinations thereof. The aforementioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0072] The communication bus 302 is used to transmit information between the aforementioned components. The communication bus 302 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0073] The memory 303 may be a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), an optical disc (including a compact disc read-only memory (CD-ROM), a compressed optical disc, a laser disc, a digital versatile optical disc, a Blu-ray disc, etc.), a magnetic disk storage medium, or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but not limited thereto. The memory 303 may exist independently and be connected to the processor 301 via a communication bus 302. The memory 303 may also be integrated with the processor 301.

[0074] Communication interface 304 uses any transceiver-like device for communicating with other devices or communication networks. Communication interface 304 includes a wired communication interface and may also include a wireless communication interface. The wired communication interface may be, for example, an Ethernet interface. The Ethernet interface may be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface may be a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof.

[0075] As an example, processor 301 may include one or more CPUs, such as Figure 3 CPU0 and CPU1 are shown in the diagram.

[0076] As an example, a computer device may include multiple processors, such as Figure 3 The processors 301 and 305 are shown. Each of these processors may be a single-core processor or a multi-core processor. A processor here may refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0077] In some embodiments, the computer device may further include output devices and input devices. The output device communicates with the processor 301 and can display information in various ways. For example, the output device may be a liquid crystal display (LCD), a light-emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device communicates with the processor 301 and can receive user input in various ways. For example, the input device may be a mouse, keyboard, touchscreen device, or sensing device, etc.

[0078] In some embodiments, memory 303 is used to store program code 310 for executing the scheme of this application, and processor 301 can execute the program code 310 stored in memory 303. The program code 310 may include one or more software modules, and the computer device can implement the following by using processor 301 and the program code 310 in memory 303. Figure 4 The key generation method provided in the method embodiment.

[0079] It should be understood that the application scenarios and hardware architectures described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the emergence of new application scenarios or the evolution of implementation architecture, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0080] Next, the key generation method provided in the embodiments of this application will be explained in detail.

[0081] Figure 4 This is a flowchart illustrating a key generation method provided in an embodiment of this application. This method can be applied to the above-mentioned... Figure 2 The key generator shown is specifically applied to the device used by this key generator. It should be understood that the implementation logic of this key generation method is applicable to any elliptic curve key generation, encryption / decryption related scenarios and devices. Please refer to... Figure 4 The method includes the following steps.

[0082] Step 401: Obtain the encrypted private key, the first parameter, and the second parameter; wherein the first parameter and the second parameter are determined by a target elliptic curve with a self-homogeneous mapping relationship, which means that a point on the target elliptic curve can be mapped to another point on the target elliptic curve.

[0083] An endomorphism is a mapping on an elliptic curve that maps a point on the elliptic curve to another point on the same curve while preserving the properties of addition. Efficient endomorphisms exist on certain types of elliptic curves (such as hypersingular elliptic curves), and these endomorphisms can be used to accelerate scalar multiplication.

[0084] As an example, suppose an elliptic curve has an automorphic mapping as shown in the following formula (1):

[0085] φ(P)=aP (1)

[0086] In this formula, P is a point on the elliptic curve, φ(P) is the point mapped from P, and a satisfies (1+a+a) / a. 2 The relationship is given by ) = 0 mod m. Here, m is a parameter related to elliptic curves and automorphisms. Its specific value depends on the choice of the elliptic curve and the properties of the automorphism; that is, given the mapping relationship between the elliptic curve and the automorphism, the value of m can be determined.

[0087] In some cases, m can be the order of the elliptic curve (i.e., the number of points on the curve); but in other cases, it may be a specific value associated with an automorphism.

[0088] Furthermore, based on the above self-homogeneous mapping relationship, the scalar multiplication operation kP (1≤k≤m) on the elliptic curve with respect to point P can be decomposed into the form of the following formula (2).

[0089] kP=k1P+k2φ(P)mod m (2)

[0090] Among them, both |k1| and |k2| are close to (i.e., approximately equal to) Thus, a scalar multiplication that originally required k point addition operations can now be reduced to approximately [number missing]. The addition operation (because k1P and k2φ(P) need to be calculated separately) significantly improves computational efficiency.

[0091] Therefore, it is evident that the key to accelerating the kP scalar multiplication operation based on elliptic curves with self-homomorphic mappings lies in determining the decomposition values ​​k1 and k2 of k. Thus, based on k1 and k2, the properties of self-homomorphic mappings can be used to reduce the amount of data involved in the kP scalar multiplication operation, thereby improving computational efficiency.

[0092] It should be noted that the key generation method provided in this application embodiment determines the public key Q = kP based on the above formula (2) when the private key is k.

[0093] Where P is the first target point on the target elliptic curve, such as the base point. The first parameter in step 401 above can be a, and the second parameter can be m, and both the first and second parameters are determined based on the target elliptic curve and the automorphic mapping relationship.

[0094] For ease of understanding, in the subsequent method embodiments, when illustrating the implementation process of the relevant steps, the first parameter is a, the second parameter is m, the encryption private key is k, and the first private key parameter and the second private key parameter are k1 and k2, and the symbol meaning of the relevant parameters will not be repeated.

[0095] Step 402: If the first parameter is not less than the square root of the second parameter, then based on the first parameter and the second parameter, the encrypted private key is decomposed into the first private key parameter and the second private key parameter using the Qin Jiushao algorithm.

[0096] Before explaining the implementation of step 402, the calculation logic involved in decomposing the encrypted private key into the first private key parameter and the second private key parameter in the embodiments of this application will be derived and explained.

[0097] Based on the above formula (2), it can be seen that since both |k1| and |k2| are close to (i.e. approximately equal to) Therefore, one way to quickly calculate k1 and k2 is to first calculate the decomposition of m.

[0098] As an example, suppose m can be expressed by the following formula (3):

[0099] m = c 2 -cd+d 2 (3)

[0100] Here, c and d are the decomposition results of m. In other words, after determining c and d, k1 and k2 are determined based on c and d. With the encryption private key k, k1 and k2 are the first and second private key parameters that need to be solved.

[0101] Furthermore, based on the relation satisfied by a and the representation of m, the decomposition of m is expressed by the following formula (4).

[0102] (c+d*a)(c+d*a 2 )=0 mod m (4)

[0103] Based on formula (4), it can be seen that the polynomial (c+d*a)(c+d*a) 2 When the value of ) is divided by the integer m, the remainder is 0, that is, (c+d*a) and / or (c+d*a) 2 It is divisible by the integer m.

[0104] Taking (c+d*a) as an example, the process of calculating m decomposition can be converted into calculating c and d that satisfy the following formula (5).

[0105] (c+d*a)=0 mod m (5)

[0106] Furthermore, in actual calculations, the process of solving c and d in the above formula (5) can be converted into finding the short vector in the two-dimensional lattice Λ(m,a) shown in the following step (6).

[0107] Λ(m,a)={(x,y)∈Z×Z:ax+y≡0(mod m)} (6)

[0108] The two-dimensional grid Λ(m,a) contains all vectors (x, y) that satisfy a specific congruence relation (i.e., ax + y ≡ 0 (mod m)). The coordinates of the vector with the shortest modulus (or the closest to the shortest) among the multiple vectors are c and d.

[0109] Based on the above discussion, after obtaining the decomposition results c and d of m, the decomposition results k1 and k2 of k can be determined by the following formula (7).

[0110]

[0111] Among them, q1 and q2 can be solved by the following formula (8).

[0112]

[0113] in, The floor operator is q1 and q2, where q1 and q2 are integers.

[0114] Based on the above technical concept, the implementation process of decomposing the encrypted private key into a first private key parameter and a second private key parameter in the embodiments of this application will be explained below. According to the relationship between the square roots of the first parameter and the second parameter, the implementation schemes for determining the first private key parameter and the second private key parameter include the following two.

[0115] The first implementation scheme, assuming the first parameter is not less than the square root of the second parameter, uses the Qin Jiushao algorithm to decompose the encrypted private key into a first private key parameter and a second private key parameter based on the first and second parameters. That is, assuming the first parameter is not less than the square root of the second parameter, step 402 above is performed to determine the first and second private key parameters.

[0116] In one possible implementation, the process of implementing step 402 above may include the following steps 11-13.

[0117] Step 11: Construct a two-dimensional grid based on the first and second parameters. The two-dimensional grid contains multiple vectors, each vector indicating the coordinates of a point in the two-dimensional grid.

[0118] In the case where the first parameter is a and the second parameter is m, the constructed two-dimensional grid Λ(m,a) is referred to the above formula (6). The multiple vectors are the vectors in the two-dimensional grid that satisfy the relationship ax+y≡0 (mod m), and each vector includes two element values, x and y.

[0119] It should be noted that the method of constructing a two-dimensional grid can refer to relevant technologies. The implementation method of this application is not limited and will not be illustrated here.

[0120] Step 12: Based on the first and second parameters, determine the shortest non-zero vector among multiple vectors using the Qin Jiushao algorithm.

[0121] The first parameter and the second parameter are coprime numbers, and the first parameter is greater than 1 and less than the second parameter.

[0122] In one possible implementation, the process of determining the shortest non-zero vector using the Qin Jiushao algorithm may include the following steps (1)-(3).

[0123] (1) Construct the initial state matrix of Qin Jiushao algorithm based on the first and second parameters, and perform multiple iterations to update the initial state matrix until the updated state matrix satisfies the iteration termination condition.

[0124] The initial state matrix is: Element x 11 Let x be the first element. 12 For the second element, element x 12 The value of is the first parameter, element x 22 The value is the second parameter.

[0125] As an example, with the first parameter being a and the second parameter being m, the initial state matrix can be represented by the following formula (9):

[0126]

[0127] As an example, in element x 11 The value of x is 1 and the element x 21 When the value of x is 0, the iteration termination conditions include: the element x in the updated state matrix. 12 The value is 1, or the inner product of the updated state matrix is ​​greater than or equal to 0, and the inner product is the sum of the elements x. 11 and element x 21 The product of x and the element x 12 and element x 22 The difference between the products.

[0128] Based on the initial state matrix shown in formula (9) above, the process of iteratively updating the initial state matrix can be as follows: determine the element x in the initial state matrix. 22 With element x 12 The size relationship, if element x 22 The value is greater than element x 12 If the value of x is obtained, the initial state matrix is ​​updated according to the following formula (10); if element x 22 The value is less than or equal to element x 12 If the value of is obtained, the initial state matrix is ​​updated according to the following formula (11) until the iteration termination condition is met.

[0129]

[0130]

[0131] The value of variable q is based on element x. 22 With element x 12 The size relationship is calculated each time the state matrix is ​​updated.

[0132] For the i-th state matrix It can be expressed by the following formula (12), where the inner product I of the state matrix is... i It can be expressed by the following formula (13).

[0133]

[0134] Based on the above update iteration logic, it can be seen that during the iterative update process, adjacent update rounds contain the same row vectors in their corresponding state matrices. Furthermore, the state matrix... With the state matrix The position of the repeating row vector is related to the parity of i.

[0135] (2) If the value of the second element in the first state matrix is ​​1, then the value of the first element in the first state matrix is ​​determined as the inverse of the first parameter; if the inverse of the first parameter is less than the square root of the second parameter, then the inverse of the first parameter and -1 (negative 1) are determined as the two element values ​​of the shortest non-zero vector.

[0136] The first state matrix is ​​the state matrix obtained from the last update, and the first and second elements are two elements in the same row.

[0137] It should be noted that, in the embodiments of this application, the inverse of the first parameter refers to the inverse of the first parameter modulo the second parameter. When the first parameter is a and the second parameter is m, the inverse of the first parameter is a... -1 Satisfy aa -1 =1 mod m.

[0138] That is, if the value of the second element in the first state matrix is ​​1, and the value of the first element is less than the square root of the second parameter, then the shortest non-zero vector is determined to be (x11, -1), which means that the two elements of the shortest non-zero vector are the value of x11 in the first state matrix and -1.

[0139] As an example, assuming the first parameter a = 696224979 and the second parameter m = 1111333457, then through calculation, we can know... Then the Qin Jiushao algorithm Qin(1111333457, 696224979) needs to be run, as shown in Table 1 below. The Qin Jiushao algorithm stops when the iteration number i = 10.

[0140] Table 1

[0141]

[0142]

[0143] Based on Table 1 above, when iteration number i = 10, the element x in the state matrix is...12 If the value is 1, then a is determined. -1 For element x 11 The value is 16671. Then, check a. -1 and The size relationship, since 16671 is less than Then, the shortest non-zero vector in the two-dimensional grid Λ(1111333457, 696224979) is (16671, -1).

[0144] (3) If the value of the second element in the first state matrix is ​​not 1, or the inverse of the first parameter is not less than the square root of the second parameter, then the shortest non-zero vector is determined based on the first state matrix and the second state matrix.

[0145] The second state matrix is ​​the state matrix obtained from the penultimate update. The first state matrix is ​​the state matrix obtained from the last update, and the first and second state matrices are adjacent matrices.

[0146] In one possible implementation, the process of determining the shortest non-zero vector based on the first state matrix and the second state matrix is ​​as follows: the shortest row vector among the row vectors included in the first state matrix and the row vectors included in the second state matrix is ​​determined as the shortest non-zero vector.

[0147] As explained above, since there will be a common row vector in adjacent state matrices during the state matrix update process of Qin Jiushao's algorithm, when determining the shortest non-zero vector from the two row vectors included in the first state matrix and the row vectors included in the second state matrix, it is essentially only necessary to calculate the three distinct row vectors in these two state matrices and then determine the shortest non-zero vector from them.

[0148] As an example, assuming the first parameter a = 13587 and the second parameter m = 23557, then calculation shows that... Then the Qin Jiushao algorithm Qin(23557, 13587) needs to be run, as shown in Table 2 below. The Qin Jiushao algorithm stops when the iteration number i = 6.

[0149] Table 2

[0150]

[0151] Based on Table 2 above, when iteration number i = 6, the element x in the state matrix is... 12If the value is 44≠1, then we need to determine the shortest non-zero vector in the two-dimensional grid Λ(23557,13587) based on the row vectors (7,881) and (26,93) included in the state matrix when i=5, and the row vectors (241,44) and (26,93) included in the state matrix when i=6.

[0152] In one possible implementation, when determining the shortest non-zero vector based on the first and second state matrices, the parity of the state cycle corresponding to the first state matrix and the variable q can be considered. i The value of is used to quickly determine the length of the row vectors in the second state matrix that are different from those in the first state matrix.

[0153] When the iteration number of the first state matrix is ​​odd, the row vectors in the second state matrix that are different from those in the first state matrix can be represented as (x 21 -qx 11 x 22 +qx 12 At this point, the lengths L1, L2 and L3 of the three row vectors that actually need to be calculated in the first state matrix and the second state matrix are determined by the following formulas (14)-(16).

[0154]

[0155] L3 = L2 + q 2 L1-2qI (16)

[0156] When the iteration number of the first state matrix is ​​even, the row vectors in the second state matrix that are different from those in the first state matrix can be represented as (x 11 -qx 21 -x 12 -qx 22 At this point, the lengths L1, L2 and L3 of the three row vectors that actually need to be calculated in the first state matrix and the second state matrix are determined by formulas (14), (15) and (17) below.

[0157] L3 = L1 + q 2 L2-2qI (17)

[0158] In the above formulas (14)-(17), x 11 x 12 x 21 and x 22 Let q be the value of the corresponding element in the first state matrix, and I be the inner product of the first state matrices.

[0159] Therefore, given the iteration number of the first state matrix and the variable q, the length L3 of the row vector in the second state matrix that is different from that in the first state matrix can be derived and calculated based on the value of the variable q and the lengths L1 and L2 of the two row vectors in the first state matrix.

[0160] As an example, see Table 2 above, the state matrix when iteration i=6. The iteration ends when the termination condition is met. At this point, we first calculate L1 = ||(241, -44)|| 2 =60017 and L2=||(26, 93)|| 2 =9325, then, combining the variable q=9 corresponding to the first state matrix, and I i =2174, and L3 =776210 is derived and calculated. Finally, the shortest non-zero vector in the two-dimensional lattice Λ(23557, 13587) is determined to be (26, 93).

[0161] It should be noted that steps (2) and (3) above are parallel schemes. Which scheme to execute depends on the value of the second element in the first state matrix when the Qin Jiushao algorithm reaches the iteration termination condition, as well as the relationship between the inverse of the first parameter and the square root of the second parameter.

[0162] Step 13: Determine the first private key parameter and the second private key parameter based on the two element values ​​of the shortest non-zero vector and the second parameter.

[0163] As explained above, the elements of the shortest non-zero vector are the decomposition results of the second parameter (i.e., m). Therefore, after determining the two element values ​​of the shortest non-zero vector, the first private key parameter and the second private key parameter can be determined based on these two element values ​​and the second parameter itself, using the above formulas (7) and (8).

[0164] It should be noted that when the encryption private key is k, the first private key parameter can be k1 and the second private key parameter can be k2; or, the first private key parameter is k2 and the second private key parameter is k1. This application's embodiments only emphasize the decomposition result of the encryption private key, but do not impose limitations on each of the two decomposition results.

[0165] In summary, when the first parameter is not less than the square root of the second parameter, this embodiment of the application, by running the Qin Jiushao algorithm and observing the changes in the value of the second element in the state matrix and / or the changes in the inner product of the state matrix during the algorithm's execution, can quickly determine the shortest non-zero vector based on the values ​​of each element in the first state matrix after the Qin Jiushao algorithm reaches the iteration termination condition. Thus, this embodiment of the application improves the efficiency of finding the shortest non-zero vector in a two-dimensional lattice by running the Qin Jiushao algorithm.

[0166] The second implementation scheme determines the first private key parameter and the second private key parameter based on the first parameter and the second parameter, provided that the first parameter is less than the square root of the second parameter.

[0167] Wherein, the first parameter and the second parameter are coprime numbers, and the first parameter is greater than 1 and less than the second parameter. When the first parameter is less than the square root of the second parameter, step 402 above can be replaced entirely with steps 21-22.

[0168] Step 21: If the first parameter is less than the square root of the second parameter, then 1 and the opposite of the first parameter are determined as the two element values ​​of the shortest non-zero vector.

[0169] It should be noted that the shortest non-zero vector in the embodiments of this application refers to the shortest non-zero vector in the two-dimensional grid Λ(m,a) constructed based on the first parameter (i.e., a) and the second parameter (i.e., m). That is, the shortest non-zero vector in step 21 and step 12 above refers to the same two-dimensional grid, the only difference being that the two element values ​​in the shortest non-zero vector are different.

[0170] As an example, if the first parameter is a, the second parameter is m, and... In this case, the shortest non-zero vector in the two-dimensional lattice Λ(m,a) is directly determined to be (1, -a).

[0171] Step 22: Determine the first private key parameter and the second private key parameter based on the two element values ​​of the shortest non-zero vector and the second parameter.

[0172] It should be noted that the implementation method of step 22 is the same as that of step 13 above. For the specific implementation process, please refer to the explanation of step 13 above, which will not be repeated here.

[0173] Step 403: Based on the first private key parameter and the second private key parameter, determine the scalar multiplication result between the encrypted private key and the first target point on the target elliptic curve through the self-homogeneous mapping relationship, and determine the scalar multiplication result as the encrypted public key corresponding to the encrypted private key.

[0174] In one possible implementation, step 403 can be implemented as follows: obtaining the first operation result between the first private key parameter and the first target point; obtaining the second operation result between the second private key parameter and the second target point; and determining the scalar multiplication result between the encrypted private key and the first target point based on the first operation result and the second operation result.

[0175] The second target point is the point obtained by mapping the first target point onto the target elliptic curve through an automorphic mapping relationship.

[0176] As an example, suppose the first target point is P, the second target point is φ(P), the first private key parameter is k1, and the second private key parameter is k2. Then the first operation result is k1P, the second operation result is k2φ(P), and the scalar multiplication result between the encrypted private key and the first target point is kP.

[0177] It should be noted that after determining the decomposition result of the encrypted private key, the specific implementation logic for determining the scalar multiplication result between the encrypted private key and the first target point is based on the first private key parameter and the second private key parameter. For details, please refer to the relevant explanations of formulas (1) and (2) above, which will not be repeated here.

[0178] In some embodiments, the above-described key generation method can be applied to a first device, whereby the encryption private key and encryption public key are encryption keys used by the first device to communicate with other devices. In this case, the key generation method provided in this application embodiment further includes the following steps: receiving an encrypted message sent by a second device, wherein the encrypted message is obtained by encrypting the first device using its encryption public key; and decrypting the encrypted message based on a first private key parameter and a second private key parameter to obtain the corresponding plaintext message.

[0179] That is, after the first device decomposes its own encrypted private key into a first private key parameter and a second private key parameter according to the key generation method in steps 401-403 above, if it subsequently receives a message sent by another device that is encrypted using the first device's encrypted public key, it can reuse the previous decomposition result to reduce the amount of computation when directly decrypting the message using the encrypted private key, thereby improving the decryption efficiency.

[0180] In summary, the key generation method provided in this application, when calculating the encrypted public key using scalar multiplication based on a first target point on the target elliptic curve and the encrypted private key, can, if the target elliptic curve has an automorphic mapping relationship, decompose the encrypted private key using the Qin Jiushao algorithm based on the first and second parameters determined by the automorphic mapping relationship to obtain the first private key parameters and the second private key parameters. Then, the encrypted public key is calculated using these first and second private key parameters through the automorphic mapping relationship. Since the first and second private key parameters are obtained by decomposing the encrypted private key, they are necessarily smaller than the encrypted private key itself. Calculating the scalar multiplication result between the encrypted private key and the first target point based on the first and second private key parameters through the automorphic mapping relationship significantly reduces the number of point addition operations compared to directly calculating the scalar multiplication between the encrypted private key and the first target point, accelerating the scalar multiplication process and thus quickly generating the encrypted public key corresponding to the encrypted private key. This improves the overall performance of the ECC algorithm to a certain extent.

[0181] Referring to the above method embodiments, which utilize the Qin Jiushao algorithm to quickly find the shortest non-zero vector in a two-dimensional lattice, this application also provides a prime number factorization method. The method will now be explained in detail.

[0182] See Figure 5 The prime number factorization method provided in this application embodiment can be applied to the above. Figure 3 In the computer device shown, the method includes the following steps:

[0183] Step 501: Obtain the target prime number to be decomposed and the prime number decomposition formula. The prime number decomposition formula indicates the operational relationship between the decomposition result of the target prime number and the target prime number. The decomposition result includes the first decomposition value and the second decomposition value.

[0184] As an example, the target prime number S can be a prime number of type 4n+1, and the corresponding prime factorization can be S = x 2 +y 2 .

[0185] As another example, the target prime number S can be a prime number of the type 3n+1, and the corresponding prime factorization can be S = 3x 2 +y 2 .

[0186] Here, x and y are the prime factorization results, which are also the factorization values ​​that need to be solved through the following steps 502 and 503.

[0187] Step 502: Determine the decomposition parameters based on the target prime number and the prime factorization formula.

[0188] In one possible implementation, step 502 can be implemented as follows: based on the target prime number and prime factorization, determine the modular equation, solve the smallest positive integer solution of the modular equation, and obtain the decomposition parameters.

[0189] As an example, if the target prime number S = 546341, and the prime factorization formula is S = x 2 +y 2 Then it is necessary to calculate the modular equation x. 2 The smallest positive integer solution of =-1 mod S is obtained by decomposing the parameter b=139231.

[0190] As another example, if the target prime number S = 5819269, and the prime factorization is S = 3x 2 +y 2 Then it is necessary to calculate the modular equation x. 2 The smallest positive integer solution of =3 mod S is obtained by decomposing the parameter b=2150547.

[0191] Step 503: Based on the decomposition parameters and the target prime number, determine the first decomposition value and the second decomposition value using the Qin Jiushao algorithm.

[0192] In one possible implementation, the process of implementing step 503 may include the following steps (1)-(3).

[0193] (1) Construct a two-dimensional lattice based on the decomposition parameters and the target prime number. The two-dimensional lattice contains multiple vectors, each of which indicates the coordinates of a point in the two-dimensional lattice. As an example, when the target prime number is S and the decomposition parameter is b, the constructed two-dimensional lattice can be represented by the following formula (18).

[0194] Λ(S, b)={(x, y)∈Z×Z:bx+y≡0 mod S} (18)

[0195] It should be noted that the method for constructing a two-dimensional grid can be referred to the above. Figure 4 The only difference between the two methods is the input parameters.

[0196] (2) Based on the decomposition parameters and the target prime number, the shortest non-zero vector among multiple vectors is determined by the Qin Jiushao algorithm.

[0197] In one possible implementation, the initial state matrix of the Qin Jiushao algorithm is constructed based on the first and second parameters, and the initial state matrix is ​​iteratively updated multiple times until the updated state matrix satisfies the iteration termination condition; the shortest non-zero vector is determined based on the first and second state matrices.

[0198] The first state matrix is ​​the state matrix obtained from the last update, and the second state matrix is ​​the state matrix obtained from the penultimate update. The first state matrix and the second state matrix are adjacent matrices.

[0199] (3) If the operation relationship between the two element values ​​of the shortest non-zero vector and the target prime number satisfies the prime number decomposition formula, then the two element values ​​of the shortest non-zero vector are determined as the first decomposition value and the second decomposition value.

[0200] As an example, suppose the target prime number to be decomposed is S = 546341, the decomposition parameter is b = 139231, and the prime factorization formula is S = x 2 +y 2 Then, the Qin Jiushao algorithm Qin(546341, 139231) is run, as shown in Table 3 below. The Qin Jiushao algorithm Qin(546341, 139231) stops when the iteration round i = 5.

[0201] Table 3

[0202]

[0203] Based on Table 3 above, calculate the row vectors (310, 671) and (671, 310) included in the state matrix when i=5, and the row vectors (310, 671) and (51, 1652) included in the state matrix when i=4, and determine the shortest non-zero vector (310, 671) in the two-dimensional grid Λ(546341, 139231).

[0204] Furthermore, substituting the shortest non-zero vector and the target prime number into the prime factorization formula S = x 2 +y 2 It is easy to verify that S = 310 2 +671 2 Therefore, 310 and 671 are determined as the decomposition results of the target prime number S = 546341.

[0205] (4) If the operational relationship between the two element values ​​of the shortest non-zero vector and the target prime number does not satisfy the prime number decomposition formula, then the first decomposition value and the second decomposition value are determined based on multiple candidate row vectors.

[0206] Among them, multiple candidate row vectors are the row vectors included in the first state matrix and the row vectors included in the second state matrix, excluding the shortest non-zero row vector.

[0207] As an example, suppose the target prime number to be factored is S = 5819269, the factorization parameter is b = 2150547, and the prime factorization formula is S = 3x 2 +y 2 Then, the Qin Jiushao algorithm Qin(5819269, 2150547) is run, as shown in Table 4 below. The Qin Jiushao algorithm Qin(5819269, 2150547) stops at iteration number i = 7.

[0208] Table 4

[0209]

[0210]

[0211] Based on Table 4 above, first check the row vectors (2411, 138) and (41033, 65) included in the state matrix when i = 7, but S ≠ 3 × 2411 2 +138 2 And S≠3×41033 2 +65 2 Therefore, it is necessary to further verify the row vector (46, 2411) included in the state matrix when i = 6. It is easy to verify that S = 3 × 46 2 +2411 2Based on this, the shortest non-zero vector (46, 2411) in the two-dimensional lattice Λ(5819269, 2150547) can be determined.

[0212] Furthermore, the two element values ​​46 and 2411 in the shortest non-zero vector (46, 2411) are determined as the decomposition result of the target prime number S = 5819269.

[0213] Regarding steps (3) and (4) above, it should be noted that since the prime factorization formula in the prime factorization scenario is known, when the Qin Jiushao algorithm stops, the two element values ​​of the row vector in the first state matrix can be directly substituted for verification to determine whether the prime factorization formula is satisfied. If satisfied, these are determined as the first and second decomposition values.

[0214] In summary, the embodiments of this application utilize the Qin Jiushao algorithm to accelerate the efficiency of finding the shortest non-zero vector in a two-dimensional lattice, thereby quickly determining the decomposition result of the target prime number.

[0215] Figure 6 This is a schematic diagram of a key generation device provided in an embodiment of this application. The key generation device can be implemented using software, hardware, or a combination of both. Figure 3 Part or all of the computer equipment shown. See also Figure 6 The key generation device 600 includes: a parameter acquisition module 601, a private key decomposition module 602, and a key generation module 603.

[0216] The parameter acquisition module 601 is used to acquire the encrypted private key, the first parameter, and the second parameter; wherein the first parameter and the second parameter are determined by a target elliptic curve with a self-homogeneous mapping relationship, which means that a point on the target elliptic curve can be mapped to another point on the target elliptic curve.

[0217] The private key decomposition module 602 is used to decompose the encrypted private key into a first private key parameter and a second private key parameter based on the first parameter and the second parameter, using the Qin Jiushao algorithm, if the first parameter is not less than the square root of the second parameter.

[0218] The public key generation module 603 is used to determine the scalar multiplication result between the encrypted private key and the first target point on the target elliptic curve based on the first private key parameters and the second private key parameters through the self-homogeneous mapping relationship, and to determine the scalar multiplication result as the encrypted public key corresponding to the encrypted private key.

[0219] In one possible implementation, the private key decomposition module 602 includes:

[0220] A two-dimensional grid construction unit is used to construct a two-dimensional grid based on a first parameter and a second parameter. The two-dimensional grid contains multiple vectors, each vector indicating the coordinates of a point in the two-dimensional grid.

[0221] The shortest vector determination unit is used to determine the shortest non-zero vector among multiple vectors based on the first and second parameters using the Qin Jiushao algorithm.

[0222] The parameter determination unit is used to determine the first private key parameter and the second private key parameter based on the two element values ​​of the shortest non-zero vector and the second parameter.

[0223] In one possible implementation, the first parameter and the second parameter are coprime numbers, the first parameter is greater than 1 and less than the second parameter; the shortest vector determination unit includes:

[0224] The matrix update subunit is used to construct the initial state matrix of Qin Jiushao algorithm based on the first and second parameters, and to update the initial state matrix iteratively multiple times until the updated state matrix satisfies the iteration termination condition.

[0225] The inverse element determination subunit is used to determine the value of the first element in the first state matrix as the inverse of the first parameter if the value of the second element in the first state matrix is ​​1; where the inverse of the first parameter refers to the inverse of the first parameter with respect to the modulus of the second parameter, the first state matrix is ​​the state matrix obtained in the last update, and the first element and the second element are two elements in the same row;

[0226] The first vector determines the sub-unit, which is used to determine the two element values ​​of the shortest non-zero vector if the inverse of the first parameter is less than the square root of the second parameter.

[0227] In one possible implementation, the shortest vector determination unit also includes:

[0228] The second vector determines the sub-unit. If the value of the second element in the first state matrix is ​​not 1, or the inverse of the first parameter is not less than the square root of the second parameter, then the shortest non-zero vector is determined based on the first state matrix and the second state matrix. The second state matrix is ​​the state matrix obtained from the second-to-last update.

[0229] In one possible implementation, the second vector determines the sub-unit specifically for:

[0230] The shortest row vector among the row vectors included in the first state matrix and the row vectors included in the second state matrix is ​​determined as the shortest non-zero vector.

[0231] In one possible implementation, the initial state matrix is:

[0232]

[0233] Where element x 11 As the first element, element x 12 As the second element, element x 12 The value of is the first parameter, element x 22 The value is the second parameter.

[0234] In one possible implementation, in element x 11 The value of x is 1 and the element x 21 When the value of x is 0, the iteration termination conditions include: the element x in the updated state matrix. 12 The value is 1, or the inner product of the updated state matrix is ​​greater than or equal to 0, and the inner product is the sum of the elements x. 11 and element x 21 The product of x and the element x 12 and element x 22 The difference between the products.

[0235] In one possible implementation, the first parameter and the second parameter are coprime numbers, with the first parameter being greater than 1 and less than the second parameter; the private key decomposition module 602 is also used for:

[0236] If the first parameter is less than the square root of the second parameter, then 1 and the opposite of the first parameter are determined as the two element values ​​of the shortest non-zero vector.

[0237] The first private key parameter and the second private key parameter are determined based on the two element values ​​of the shortest non-zero vector and the second parameter.

[0238] In one possible implementation, the public key generation module 603 is specifically used for:

[0239] Obtain the first calculation result between the first private key parameter and the first target point;

[0240] Obtain the second operation result between the second private key parameter and the second target point. The second target point is a point on the target elliptic curve obtained by mapping the first target point through an automorphic mapping relationship.

[0241] Based on the first and second operation results, determine the scalar multiplication result between the encrypted private key and the first target point.

[0242] In one possible implementation, the apparatus is included in the first device, and the encryption private key and encryption public key are encryption keys for the first device to communicate with other devices; the key generation apparatus 600 further includes:

[0243] The receiving module is used to receive encrypted messages sent by the second device. The encrypted messages are obtained by encrypting the first device's public key.

[0244] The decryption module is used to decrypt encrypted messages based on the first private key parameter and the second private key parameter to obtain the corresponding plaintext message.

[0245] In summary, the key generation device provided in this application, when calculating the encrypted public key using scalar multiplication based on a first target point on the target elliptic curve and the encrypted private key, can, if the target elliptic curve has an automorphic mapping relationship, decompose the encrypted private key using the Qin Jiushao algorithm based on the first and second parameters determined by the automorphic mapping relationship to obtain the first private key parameters and the second private key parameters. Then, the encrypted public key is calculated using these first and second private key parameters through the automorphic mapping relationship. Since the first and second private key parameters are obtained by decomposing the encrypted private key, they are necessarily smaller than the encrypted private key itself. Calculating the scalar multiplication result between the encrypted private key and the first target point based on the first and second private key parameters through the automorphic mapping relationship significantly reduces the number of point addition operations compared to directly calculating the scalar multiplication between the encrypted private key and the first target point, accelerating the scalar multiplication process and thus quickly generating the encrypted public key corresponding to the encrypted private key. This improves the overall performance of the ECC algorithm to a certain extent.

[0246] It should be noted that the key generation device provided in the above embodiments, when generating an encrypted public key based on a target elliptic curve and an encrypted private key, is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. Furthermore, the key generation device and the key generation method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0247] This application also provides a computer-readable storage medium storing instructions that, when executed on a processor, cause the processor to perform the steps of the key generation method shown in the above embodiments, or to perform the steps of the prime number factorization method shown in the above embodiments.

[0248] This application also provides a computer program product containing instructions that, when executed on a processor, cause the processor to perform the method for determining the output result of a model as described in the above embodiments. Alternatively, a computer program is provided that, when executed on a processor, causes the processor to perform the steps of the key generation method or the prime number factorization method as described in the above embodiments.

[0249] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., digital versatile disc (DVD)), or a semiconductor medium (e.g., solid state disk (SSD)). It is worth noting that the computer-readable storage medium mentioned in the embodiments of this application can be a non-volatile storage medium; in other words, it can be a non-transient storage medium.

[0250] It should be understood that "multiple" as mentioned herein refers to two or more. In the description of the embodiments of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B; "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. In addition, to facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first," "second," etc., are used in the embodiments of this application to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first," "second," etc., do not limit the quantity or execution order, and the terms "first," "second," etc., do not necessarily imply that they are different.

[0251] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, data stored, data displayed, etc.) and signals involved in the embodiments of this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0252] The above descriptions are embodiments provided in this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A key generation method, characterized in that, The method includes: Obtain the encrypted private key, a first parameter, and a second parameter; wherein the first parameter and the second parameter are determined by a target elliptic curve having a self-homogeneous mapping relationship, the self-homogeneous mapping relationship being that a point on the target elliptic curve can be mapped to another point on the target elliptic curve; If the first parameter is not less than the square root of the second parameter, then based on the first parameter and the second parameter, the encrypted private key is decomposed into a first private key parameter and a second private key parameter using the Qin Jiushao algorithm; Based on the first private key parameter and the second private key parameter, the scalar multiplication result between the encrypted private key and the first target point on the target elliptic curve is determined through the automorphic mapping relationship, and the scalar multiplication result is determined as the encrypted public key corresponding to the encrypted private key.

2. The method as described in claim 1, characterized in that, The step of decomposing the encrypted private key into first private key parameters and second private key parameters using the Qin Jiushao algorithm based on the first parameter and the second parameter includes: A two-dimensional grid is constructed based on the first parameter and the second parameter. The two-dimensional grid contains multiple vectors, each vector indicating the coordinates of a point in the two-dimensional grid. Based on the first parameter and the second parameter, the shortest non-zero vector among the plurality of vectors is determined by the Qin Jiushao algorithm; Based on the two element values ​​of the shortest non-zero vector and the second parameter, the first private key parameter and the second private key parameter are determined.

3. The method as described in claim 2, characterized in that, The first parameter and the second parameter are coprime numbers, and the first parameter is greater than 1 and less than the second parameter; The step of determining the shortest non-zero vector among the plurality of vectors based on the first parameter and the second parameter using the Qin Jiushao algorithm includes: The initial state matrix of the Qin Jiushao algorithm is constructed based on the first parameter and the second parameter, and the initial state matrix is ​​iteratively updated multiple times until the updated state matrix satisfies the iteration termination condition. If the value of the second element in the first state matrix is ​​1, then the value of the first element in the first state matrix is ​​determined as the inverse of the first parameter; wherein, the inverse of the first parameter refers to the inverse of the first parameter with respect to the modulus of the second parameter, the first state matrix is ​​the state matrix obtained in the last update, and the first element and the second element are two elements in the same row; If the inverse of the first parameter is less than the square root of the second parameter, then the inverse of the first parameter and -1 are determined as the two element values ​​of the shortest non-zero vector.

4. The method as described in claim 3, characterized in that, The method further includes: If the value of the second element in the first state matrix is ​​not 1, or the inverse of the first parameter is not less than the square root of the second parameter, then the shortest non-zero vector is determined based on the first state matrix and the second state matrix, where the second state matrix is ​​the state matrix obtained from the second-to-last update.

5. The method as described in claim 4, characterized in that, The step of determining the shortest non-zero vector based on the first state matrix and the second state matrix includes: The shortest non-zero vector is determined from the row vectors included in the first state matrix and the row vectors included in the second state matrix.

6. The method according to any one of claims 3-5, characterized in that, The initial state matrix is: Where element x 11 Let x be the first element. 12 For the second element, element x 12 The value of is the first parameter, element x 22 The value is the second parameter.

7. The method as described in claim 6, characterized in that, In the element x 11 The value of x is 1 and the element x 21 When the value of x is 0, the iteration termination condition includes: the element x in the updated state matrix. 12 The value is 1, or the inner product of the updated state matrix is ​​greater than or equal to 0, where the inner product is the element x. 11 and element x 21 The product of x and the element x 12 and element x 22 The difference between the products.

8. The method as described in claim 1, characterized in that, The first parameter and the second parameter are coprime numbers, and the first parameter is greater than 1 and less than the second parameter; The method further includes: If the first parameter is less than the square root of the second parameter, then 1 and the opposite of the first parameter are determined as the two element values ​​of the shortest non-zero vector. Based on the two element values ​​of the shortest non-zero vector and the second parameter, the first private key parameter and the second private key parameter are determined.

9. The method according to any one of claims 1-8, characterized in that, The step of determining the scalar multiplication result between the encrypted private key and the first target point on the target elliptic curve based on the first private key parameters and the second private key parameters, through the automorphic mapping relationship, includes: Obtain the first calculation result between the first private key parameter and the first target point; Obtain the second operation result between the second private key parameter and the second target point, wherein the second target point is a point on the target elliptic curve obtained by mapping the first target point through the automorphic mapping relationship; Based on the first calculation result and the second calculation result, the scalar multiplication result between the encrypted private key and the first target point is determined.

10. The method according to any one of claims 1-9, characterized in that, The method is applied to a first device, wherein the encrypted private key and the encrypted public key are encryption keys for the first device to communicate with other devices; the method further includes: Receive an encrypted message sent by a second device, wherein the encrypted message is obtained by encrypting the message using the encryption public key of the first device; Based on the first private key parameter and the second private key parameter, the encrypted message is decrypted to obtain the corresponding plaintext message.

11. A key generation device, characterized in that, The device includes: The parameter acquisition module is used to acquire the encrypted private key, a first parameter, and a second parameter; wherein the first parameter and the second parameter are determined by a target elliptic curve with a self-homogeneous mapping relationship, wherein the self-homogeneous mapping relationship means that a point on the target elliptic curve can be mapped to another point on the target elliptic curve; The private key decomposition module is used to decompose the encrypted private key into a first private key parameter and a second private key parameter based on the first parameter and the second parameter, using the Qin Jiushao algorithm, if the first parameter is not less than the square root of the second parameter. The public key generation module is used to determine the scalar multiplication result between the encrypted private key and the first target point on the target elliptic curve based on the first private key parameters and the second private key parameters through the automorphic mapping relationship, and to determine the scalar multiplication result as the encrypted public key corresponding to the encrypted private key.

12. The apparatus as claimed in claim 11, characterized in that, The private key decomposition module includes: A two-dimensional grid construction unit is used to construct a two-dimensional grid based on the first parameter and the second parameter. The two-dimensional grid contains multiple vectors, each vector indicating the coordinates of a point in the two-dimensional grid. The shortest vector determination unit is used to determine the shortest non-zero vector among the plurality of vectors based on the first parameter and the second parameter using the Qin Jiushao algorithm; The parameter determination unit is used to determine the first private key parameter and the second private key parameter based on the two element values ​​of the shortest non-zero vector and the second parameter.

13. The apparatus as claimed in claim 12, characterized in that, The first parameter and the second parameter are coprime numbers, and the first parameter is greater than 1 and less than the second parameter; The shortest vector determination unit includes: The matrix update subunit is used to construct the initial state matrix of the Qin Jiushao algorithm based on the first parameter and the second parameter, and to perform multiple iterations to update the initial state matrix until the updated state matrix satisfies the iteration termination condition. The inverse element determination subunit is used to determine the value of the first element in the first state matrix as the inverse of the first parameter if the value of the second element in the first state matrix is ​​1; wherein, the inverse of the first parameter refers to the inverse of the first parameter with respect to the modulus of the second parameter, the first state matrix is ​​the state matrix obtained in the last update, and the first element and the second element are two elements in the same row; The first vector determining subunit is used to determine the inverse of the first parameter and -1 as the two element values ​​of the shortest non-zero vector if the inverse of the first parameter is less than the square root of the second parameter.

14. The apparatus as claimed in claim 13, characterized in that, The shortest vector determination unit further includes: The second vector determination subunit is used to determine the shortest non-zero vector based on the first state matrix and the second state matrix if the value of the second element in the first state matrix is ​​not 1, or the inverse of the first parameter is not less than the square root of the second parameter. The second state matrix is ​​the state matrix obtained from the second-to-last update.

15. The apparatus as claimed in claim 14, characterized in that, The second vector determines the sub-unit, specifically for: The shortest non-zero vector is determined from the row vectors included in the first state matrix and the row vectors included in the second state matrix.

16. The apparatus according to any one of claims 13-15, characterized in that, The initial state matrix is: Where element x 11 Let x be the first element. 12 For the second element, element x 12 The value of is the first parameter, element x 22 The value is the second parameter.

17. The apparatus as claimed in claim 16, characterized in that, In the element x 11 The value of x is 1 and the element x 21 When the value of x is 0, the iteration termination condition includes: the element x in the updated state matrix. 12 The value is 1, or the inner product of the updated state matrix is ​​greater than or equal to 0, where the inner product is the element x. 11 and element x 21 The product of x and the element x 12 and element x 22 The difference between the products.

18. The apparatus as claimed in claim 11, characterized in that, The first parameter and the second parameter are coprime numbers, and the first parameter is greater than 1 and less than the second parameter; The private key decomposition module is also used for: If the first parameter is less than the square root of the second parameter, then 1 and the opposite of the first parameter are determined as the two element values ​​of the shortest non-zero vector. Based on the two element values ​​of the shortest non-zero vector and the second parameter, the first private key parameter and the second private key parameter are determined.

19. The apparatus according to any one of claims 11-18, characterized in that, The public key generation module is specifically used for: Obtain the first calculation result between the first private key parameter and the first target point; Obtain the second operation result between the second private key parameter and the second target point, wherein the second target point is a point on the target elliptic curve obtained by mapping the first target point through the automorphic mapping relationship; Based on the first calculation result and the second calculation result, the scalar multiplication result between the encrypted private key and the first target point is determined.

20. The apparatus according to any one of claims 11-19, characterized in that, The device is included in a first device, wherein the encryption private key and the encryption public key are encryption keys for the first device to communicate with other devices; the device further includes: The receiving module is used to receive encrypted messages sent by the second device, wherein the encrypted messages are obtained by encrypting the first device using its public key. The decryption module is used to decrypt the encrypted message based on the first private key parameter and the second private key parameter to obtain the corresponding plaintext message.

21. A computer device, characterized in that, The computer device includes a processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program to implement the method according to any one of claims 1-10.

22. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method described in any one of claims 1-10.

23. A computer program product, characterized in that, The computer program product stores computer instructions, which, when executed by a processor, implement the method described in any one of claims 1-10.

Images