A decentralized identity-based key generation method and system
By generating private keys locally and binding identity identifiers using hash functions and elliptic curve groups, the issues of key escrow and user autonomy are resolved, achieving decentralized, low-overhead identity-based key generation, suitable for high-frequency, low-latency cryptographic operations.
Patent Information
- Application Number
- CN202611123548.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-28
- Publication Date
- 2026-08-25
AI Technical Summary
Existing identity-based public-key cryptography relies on trusted third-party private key generation centers, which poses risks of key escrow and insufficient user autonomy. Furthermore, existing improvement schemes suffer from high interaction overhead and verification costs.
Users generate their own private keys locally, map their identity identifiers onto an elliptic curve group using a hash function, perform scalar multiplication with a random secret value to generate a public key, and store it on the terminal. By using public bulletin board notarization auxiliary parameters, the inherent binding between the private key and the identity is achieved, avoiding centralized dependence.
It enables zero-interaction key generation without the need for third-party involvement, reducing deployment costs and communication overhead, ensuring a unique binding between the private key and the identity, and is suitable for resource-constrained terminals, meeting the needs of high-frequency, low-latency real-time cryptographic operations.
Smart Images
Figure CN122640129A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of information security and cryptography, and in particular to a decentralized identity-based key generation method and system. Background Technology
[0002] Identity-Based Cryptography (IBC) is an important public-key cryptography technology. In this system, users can directly use their identity identifiers (such as email addresses, mobile phone numbers, ID card numbers, etc.) as public keys, thus eliminating the complex management processes involved in the issuance, storage, verification, and revocation of digital certificates in traditional public key infrastructures.
[0003] Existing identity-based public-key cryptosystems typically rely on a trusted third party called a Key Generation Center (KGC). This KGC holds the system's master key and is responsible for calculating and distributing corresponding user private keys based on the user's submitted identity. However, this approach has the following inherent drawbacks in engineering applications:
[0004] First, there is the risk of key escrow. In existing IBC schemes, because the KGC has the right to generate all users' private keys, any entity possessing the system master key (including the KGC itself) can decrypt any user's ciphertext or forge any user's digital signature. Even with a distributed or multi-node KGC architecture, the single point of trust is merely distributed to multiple semi-trusted entities, without fundamentally eliminating the possibility of unauthorized access or misuse of private keys.
[0005] Secondly, there is a contradiction between user autonomy and identity binding. In existing IBC schemes, user private keys are generated and distributed to users by the KGC, making users passive recipients of private keys rather than autonomous generators. If users bypass the KGC and generate their own private keys locally, an intrinsic, publicly verifiable mathematical binding relationship cannot be established between the private key and the user's identity. In this situation, any third party can claim any identity and generate a corresponding private key, leading to identity impersonation and public key substitution attacks.
[0006] Third, existing improvement schemes all have limitations to varying degrees. To overcome these shortcomings, researchers have proposed several improvement approaches. Among them, certificateless public-key cryptography alleviates the key escrow problem but undermines the convenience of identity as public key and introduces additional verification overhead. Schemes that replace private key generation centers with public key generation centers still rely on centralized entities. Distributed key generation, blockchain-based identity management, and threshold secret sharing schemes, while attempting to solve the centralization problem to varying degrees, each suffer from shortcomings such as multi-node interaction overhead, on-chain storage costs, or collaboration dependencies.
[0007] In summary, the urgent technical problem to be solved under the current technological conditions is: how to enable users to generate private keys locally using only their identity identifier and public parameters without the need for a trusted third party, while ensuring the verifiable binding of the private key to the identity identifier and retaining the technical advantage that identity is the public key. Summary of the Invention
[0008] (a) Purpose of the invention
[0009] This invention aims to provide a decentralized identity-based key generation method and system to solve the aforementioned problems in the prior art. Specifically, the objectives of this invention include:
[0010] First, a decentralized key generation method is provided, enabling users to independently and autonomously generate private keys locally based solely on their identity and publicly available system parameters without the need for KGC or any third-party involvement. This eliminates the risk of key escrow from a mechanism perspective and enables users to exercise autonomous control over their keys.
[0011] Second, it provides an inherent binding mechanism between a user-generated private key and an identity identifier, preventing third parties from claiming arbitrary identities and generating valid private keys that match them. This ensures that the public key can still be uniquely and directly determined by the user's identity identifier, preserving the convenience and security of identity as public key.
[0012] Third, it provides a key generation scheme with low computational overhead and zero communication latency, avoiding the introduction of complex multi-party interactions, on-chain storage, or additional public parameter verification processes, ensuring that the system meets the requirements of high-frequency, low-latency real-time cryptographic operations under the premise of decentralization and high security.
[0013] (II) Technical Solution
[0014] To achieve the above-mentioned objectives, this invention provides a decentralized identity base key generation method, comprising the following steps:
[0015] Step S1, System Initialization:
[0016] The initialization node selects security parameters, determines the cryptographic group and public generator, and defines a first hash function and a second hash function. The first hash function is used to map the identity identifier to a point on the group, and the second hash function is used to map the binary string to a finite field of the cryptographic group. The selected parameters are packaged into public system parameters and published, without generating any form of system master key.
[0017] Preferably, the cryptographic group is an elliptic curve group, and the security parameter is 256 bits.
[0018] Preferably, the first hash function uses a "Try-and-Increment" algorithm (a trial-and-increment hashing method) to map an identity string of arbitrary length to a specific point on an elliptic curve group.
[0019] Step S2, Local generation of user private key:
[0020] The user terminal obtains its own identity identifier; locally calls the first hash function to map the identity identifier to a point on the cryptographic group, which serves as the user's identity anchor point; locally generates a random secret value; calculates the scalar multiplication result of the random secret value and the identity anchor point; and stores the random secret value and the scalar multiplication result locally as the user's private key; the generation of the user's private key does not require network communication or interaction with any external entity.
[0021] Preferably, the random secret value is generated by a cryptographically secure random number generator built into the user terminal.
[0022] Preferably, the user's private key is stored in the trusted execution environment or secure hardware of the user terminal.
[0023] Step S3, User public key determination:
[0024] Based on the user's identity, a point on the cryptographic group is directly calculated using the first hash function, and this point is the user's public key. The determination of the public key is a deterministic local computation that does not rely on any user-generated auxiliary public parameters or certificates.
[0025] Step S4, assisting in the public release of parameters:
[0026] The user calculates the scalar multiplication result of the random secret value and the public generator as an auxiliary public parameter; the mapping relationship between the identity identifier and the auxiliary public parameter is sent to a public bulletin board for evidence storage, so that a third party can verify the validity of the user's signature.
[0027] Preferably, the public bulletin board is a blockchain or a distributed hash table.
[0028] Step S5, Encrypt communication:
[0029] The encryptor obtains the recipient's identity identifier, calculates the recipient's public key locally using the first hash function, encrypts the message using the recipient's public key to generate ciphertext, and sends it to the recipient; the recipient decrypts the ciphertext using the user's private key stored locally to recover the original message.
[0030] Preferably, the encryptor encapsulates the symmetric key using the recipient's public key, and then encrypts the message using a symmetric encryption algorithm.
[0031] Step S6, Digital Signature and Verification:
[0032] The signer uses a random secret value from the user's private key to sign the message and generate a digital signature; the verifier calculates the signer's public key based on the signer's identity, obtains the signer's auxiliary public parameters from a public bulletin board, and uses the public key and the auxiliary public parameters to verify the validity of the digital signature.
[0033] Preferably, the digital signature is implemented based on the Schnorr signature scheme.
[0034] This invention also provides a decentralized identity-based key generation system, comprising:
[0035] The system initialization module is used to generate and publish public system parameters that do not contain any master key;
[0036] The user key generation module is located on the user terminal and is used to independently generate user private keys locally based on the user's identity identifier.
[0037] The public key derivation module, located on the user terminal, is used to calculate the user's public key in real time based on the identity identifier.
[0038] The cryptographic operation module, located on the user terminal, is used to perform encryption, decryption, signing, and verification operations based on identity identifiers;
[0039] A public bulletin board is used to store and provide user-generated auxiliary public parameters.
[0040] (III) Beneficial Effects
[0041] Compared with the prior art, the present invention has the following significant advantages:
[0042] 1. Decentralization, avoiding key escrow risks. This invention does not generate any master key during the system initialization phase. No third party (including the system initializer) possesses the system master key that can generate private keys for any user, thus avoiding key escrow risks from a fundamental mechanism.
[0043] 2. Zero-interaction key generation, enabling user self-control. The generation process of the user's private key is completed entirely locally, without the need for network communication with any external entity, achieving zero-interaction key generation and reducing deployment costs and communication overhead.
[0044] 3. The technical advantage of preserving identity as public key. The user's public key is directly determined by the identity identifier through a hash function. Public key derivation can be completed without any auxiliary parameters, and the cost for the encryption party to obtain the recipient's public key is only one local hash operation.
[0045] 4. The inherent mathematical binding between the private key and the identity. The private key contains the scalar multiplication result of the identity anchor determined by the identity identifier and the random secret value. A third party cannot generate a valid private key that matches a specific identity identifier without possessing the random secret value. This binding relationship is based on the computational infeasibility of the elliptic curve discrete logarithm problem.
[0046] 5. High efficiency and lightweight. All cryptographic operations are elliptic curve scalar multiplication and hash operations, eliminating the need for complex bilinear equivalent operations, resulting in low computational overhead and suitability for resource-constrained terminal devices. Attached Figure Description
[0047] Figure 1 This is an overall flowchart of the decentralized identity base key generation method provided in the embodiments of the present invention;
[0048] Figure 2 A flowchart illustrating the system initialization phase provided in an embodiment of the present invention;
[0049] Figure 3 A flowchart illustrating the local generation stage of the user's private key as provided in an embodiment of the present invention;
[0050] Figure 4 This is a schematic diagram of the encrypted communication process provided in an embodiment of the present invention;
[0051] Figure 5 This is a schematic diagram of the digital signature and verification process provided in an embodiment of the present invention;
[0052] Figure 6 This is an architecture diagram of a decentralized identity base key generation system provided in an embodiment of the present invention. Detailed Implementation
[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.
[0054] Example 1: System Initialization
[0055] This embodiment provides an initialization method for a decentralized identity base key generation system.
[0056] The system initialization node performs the following operations based on the preset security parameter λ (λ=256 bits in this embodiment):
[0057] (a) Selection of Elliptic Curve Group. A normalized elliptic curve group G is selected. In this embodiment, the Curve25519 elliptic curve (a Montgomery-type elliptic curve providing 128-bit security) is selected, with a prime order of q. Simultaneously, a public generator g of this group is selected.
[0058] (II) Defining Hash Functions. Define a first hash function H1 and a second hash function H2. H1 maps an identity string of arbitrary length to a specific point on the elliptic curve group G, and H2 maps a binary string of arbitrary length to a field of a non-zero integer modulo q. Specifically, H1 uses the "Try-and-Increment" algorithm (a trial-and-increment hashing method) defined in the FIPS 186-4 standard; H2 uses the SHA-256 hash function, taking its output modulo q. If the modulo result is 0, the SHA-256 is recalculated until the result is non-zero.
[0059] (iii) Publishing public parameters. The initialization node packages the above parameters into public system parameters params=(G,q,g,H1,H2) and writes them to the public bulletin board.
[0060] The fundamental difference between the initialization process of this invention and existing IBC schemes is that it does not generate any form of system master key. The initialization node can be permanently offline after completing the above operations.
[0061] Example 2: Local generation of user private key
[0062] This example uses user A (identified as "alice@example.com") to illustrate the local generation process of the user's private key.
[0063] User A performs the following steps on their terminal device, the entire process is completed locally without any network communication:
[0064] Step S1: Obtain identity identifier. User A enters their own identity identifier ID on their terminal device. A ="alice@example.com".
[0065] Step S2: Calculate the identity anchor. The user terminal calls the first hash function H1 to hash the ID. A Let Q be a point mapped onto the elliptic curve group G. A =H1("alice@example.com").
[0066] Step S3: Generate a random secret value. The user terminal calls the built-in cryptographically secure random number generator, in Z... q Generate a random number r in the domain A .
[0067] Step S4, calculate the private key. User A's private key consists of two parts:
[0068] SK A1 =r A (Secret value);
[0069] SK A2 =r A ∙Q A (Perform scalar multiplication on the elliptic curve group G).
[0070] Final private key SK A =(r A SK A2 ).
[0071] Step S5, securely store the private key. The user terminal stores the private key SK. A It is securely stored in a trusted execution environment or secure hardware.
[0072] Step S6: Publish auxiliary public parameters. The user terminal calculates the auxiliary public parameter PK. Apub =r A ∙g, and will (ID) A PK Apub The mapping relationship is sent to a public bulletin board for verification. This step is only performed when the user needs to perform a digital signature.
[0073] Example 3: Encrypted Communication
[0074] This embodiment uses the example of user A sending an encrypted message to user B (identified as "bob@company.com") to illustrate the encrypted communication process of the present invention.
[0075] Step S1: Obtain the recipient's public key. User A enters the recipient's identity ID. B =“bob@company.com”. User A's terminal executes: PK B =Q B =H1(“bob@company.com”).
[0076] Step S2: Perform encryption. User A's terminal uses the receiver's public key PK. B Encrypt message m. Use an identity-based encryption scheme: employ PK. B Encapsulate the symmetric key, then encrypt the message m using the AES-GCM algorithm to generate ciphertext c.
[0077] Step S3: Send ciphertext. User A sends ciphertext c to User B.
[0078] Step S4: Perform the decryption operation. After receiving the ciphertext c, User B uses the locally stored private key SK. B =(r B SK B2 Decrypt c. Because PK B =Q B =H1(ID B And SK B2 =r B ·Q B =r B ·PK B Private key SK B2 PK with public key B The key correspondence is satisfied with the identity-based encryption scheme, so the decryption algorithm can recover the original message m.
[0079] Example 4: Digital Signatures and Verification
[0080] This embodiment uses the example of user A digitally signing message m and user B verifying the signature to illustrate the digital signature and verification process of the present invention.
[0081] Step S1, signature generation. User A uses the random secret value r from their private key. A Sign message m:
[0082] Select random numbers k∈Z q Calculate R = k∙g;
[0083] Calculate h = H2(R||m);
[0084] Calculate s=k+r A ∙h mod q;
[0085] Output signature σ=(R,s).
[0086] Step S2: Send the signature message. User A sends message m and signature σ to user B.
[0087] Step S3, obtain verification information. User B obtains the verification information based on the ID. A Calculate user A's public key PK A =H1(“alice@example.com”); User B queries the public bulletin board for the ID. A The corresponding auxiliary public parameters are used to obtain PK. Apub .
[0088] Step S4: Perform the verification operation. User B verifies whether the following equation is true:
[0089] s∙g=R+h∙PK Apub
[0090] Where h = H2(R||m).
[0091] If the equation holds true, it proves that the signature was created by the owner of the ID. A User A generated the valid private key, and the message was not tampered with.
[0092] Example 5: Key Generation System
[0093] This invention also provides a decentralized identity-based key generation system, comprising:
[0094] The system initialization module is used to generate and publish public system parameters params=(G,q,g,H1,H2) that do not contain any master key;
[0095] The user key generation module is located on the user terminal and includes an identity anchor calculation submodule (used to calculate the identity anchor based on the user's identity identifier using a first hash function), a random number generation submodule (used to generate cryptographically secure random numbers locally), a private key calculation submodule (used to calculate the scalar multiplication result of the random number and the identity anchor as a component of the private key), and a private key storage submodule (used to securely store the private key locally).
[0096] The public key derivation module, located on the user terminal, is used to directly calculate the public key PK of any user based on their identity using the first hash function H1. ID =H1(ID);
[0097] The cryptographic operation module, located on the user terminal, includes an encryption submodule, a decryption submodule, a signature submodule, and a verification submodule;
[0098] A public bulletin board is used to store and provide user-generated auxiliary public parameters PK. IDpub =r∙g can be implemented using blockchain or distributed hash table.
Claims
1. A decentralized identity-based key generation method, characterized in that, Includes the following steps: System initialization: Select a cryptographic group and a public generator, define a first hash function and a second hash function. The first hash function is used to map the identity identifier to a point on the group, and the second hash function is used to map the binary string to a finite field of the cryptographic group. The selected parameters are published as public system parameters, and no system master key is generated. The user terminal obtains its own identity identifier, calls the first hash function locally to map the identity identifier to the identity anchor point on the cryptographic group, generates a random secret value locally, calculates the scalar multiplication result of the random secret value and the identity anchor point, and stores the random secret value and the scalar multiplication result locally as the user's private key; the generation of the user's private key does not require network communication with any external entity. Based on the user's identity identifier, a point on the cryptographic group is directly calculated using the first hash function and used as the user's public key.
2. The method according to claim 1, characterized in that, The process of generating the user's private key is performed entirely on the user's local device, and the only inputs required to generate the private key are the user's identity identifier and the public system parameters.
3. The method according to claim 1, characterized in that, The cryptographic group is an elliptic curve group. The first hash function maps an identity string of arbitrary length to a specific point on the elliptic curve group, and the second hash function maps a binary string of arbitrary length to a non-zero integer in a finite field of the elliptic curve group.
4. The method according to claim 1, characterized in that, It also includes an auxiliary public parameter publishing step: the user calculates the scalar multiplication result of the random secret value and the public generator as an auxiliary public parameter, and sends the mapping relationship between the identity identifier and the auxiliary public parameter to the public bulletin board for evidence storage.
5. The method according to claim 4, characterized in that, The public bulletin board is a blockchain or a distributed hash table.
6. The method according to claim 1, characterized in that, It also includes encrypted communication steps: the encryptor obtains the receiver's identity identifier, calculates the receiver's public key locally using the first hash function, encrypts the message using the receiver's public key, generates ciphertext, and sends it to the receiver; the receiver decrypts the ciphertext using the user's private key stored locally to recover the original message.
7. The method according to claim 4, characterized in that, It also includes digital signature and verification steps: the signer signs the message using a random secret value in the user's private key to generate a digital signature; the verifier calculates the signer's public key based on the signer's identity identifier, obtains the signer's auxiliary public parameters from the public bulletin board, and verifies the validity of the digital signature using the public key and the auxiliary public parameters.
8. A decentralized identity-based key generation system, characterized in that, include: The system initialization module is used to generate and publish public system parameters that do not contain any master key; The user key generation module is located on the user terminal and is used to independently generate user private keys locally based on the user's identity identifier. The public key derivation module, located on the user terminal, is used to calculate the user's public key in real time based on the identity identifier; The cryptographic operation module, located on the user terminal, is used to perform encryption, decryption, signing, and verification operations based on identity.
9. The system according to claim 8, characterized in that, The user key generation module includes: The identity anchor calculation submodule is used to calculate the identity anchor based on the user's identity identifier using a first hash function. The random number generation submodule is used to generate cryptographically secure random numbers locally; The private key calculation submodule is used to calculate the scalar multiplication result of the random number and the identity anchor as a component of the private key; The private key storage submodule is used to securely store private keys locally.
10. The system according to claim 8, characterized in that, It also includes a public bulletin board for storing and providing user-generated auxiliary public parameters, which are the scalar multiplication results of a user-random secret value and a public generator.