CN100440776C - Elliptic curve signature and signature verification method and apparatus - Google Patents

Abstract

The present invention relates to an elliptic curve signing method, wherein a transmitting end discloses system parameters and a public key YA thereof and then generates a random number k, elliptic curve dot multiplication operation is carried out to k and a basic dot G of a curve, a dot kG on the curve is obtained, a function d calculates the dot kG and a plaintext m, and r=d(m, kG) is obtained. The functions of f0, f1, g0 and g1 are all functions of r, the equation of f0(r)+f<1>(r)s=k-x<A>(g<0>(r)+g<1>(r)s) is solved by the functions of f0, f1, g0 and g1 and the random number and a private key xA, and s=(k-x<A>g0(r)-f0(r))(f1(r))-g1(r))<-1> is obtained through solution. The receiving end obtains P=(f0(r)+f<1>(r)s)G+(g<0>(r)+g<1>(r)s)Y<A> by receiving and using the public key YA of the transmitting end, the basic dot G and the functions of f0, f1, g0 and g1, and a function d' is used for calculating m'=d'(r, P). M' obtained through calculation and the received m are compared, wherein the function d and the function d' must have the properties that the shape of the function d is set as D=d(x, y), and y=d'(x, D) is calculated according to the function d. The present invention can shorten the length of signatures with the same safety intensity, and can accelerate the speed of signature.

Description

Ellipse curve signature and certifying signature method and apparatus

Technical field

The present invention relates to data signature and certifying signature, is signature and the certifying signature method of utilizing the elliptic curve discrete logarithm problem.

Background technology

Cryptographic system is divided into symmetric cryptosystem and asymmetric cryptosystem.

Symmetric cryptography also is the conventional cipher algorithm sometimes, is exactly that encryption key can be calculated from separate dense wanting, otherwise also sets up.In most of algorithms, the enciphering/deciphering key is identical.These algorithms also are secret-key algorithm or single key algorithm, and it requires sender and recipient before secure communication, consult a key.The fail safe of symmetric cryptography depends on key, and the key of divulging a secret just means that anyone can both carry out enciphering/deciphering to message.So though the speed of symmetric cryptography is very fast, how secret key safety being distributed to legal user but is a problem.

At patent " encryption device and method " (" CRYPTOGRAPHIC APPARATUS METHOD ", the patent No.: provided US4200770) one can be in overt channel the method and apparatus of interchange key, this method is called the public-key cryptography exchange or is called the Diffie-Hellman key exchange method.This patent makes communicating pair use a mould power function to consult and transmit their secret information.The assailant will seek out the secret information of transmission, must solve discrete logarithm problem.If the parameter of using is enough big, separating discrete logarithm problem is an intractable problem.

Public key cryptography claims asymmetric cryptography again, then can effectively solve the problem of above-mentioned authentication.Public key cryptography is different with the symmetric cryptography that only uses a key, and public key cryptography is asymmetric, and its uses two independences but the key of certain mathematical connection is arranged: PKI and private key.Secret its private key of recipient in the communication discloses its PKI like this.Most important progress in the public key cryptography is exactly a digital signature, realizes that by public key cryptography digital signature can effectively solve the problem of above-mentioned authentication.User A is before B transmission information, use the private key of oneself that this information is carried out digital signature, user B is after the information that receives the A transmission, use the signature of the disclosed public key verifications A of A, because have only A to have its private key, this has just guaranteed that the information that B received comes from A really, and is not distorted, and has also confirmed the identity of A simultaneously.

Patent " cryptographic communication system and method " (" CRYPTOGRAPHIC COMMUNICATIONSSYSTEM AND METHOD ", the patent No.: US4405829) proposed Rivest, a kind of public key cryptography method--the RSA of Shamir and Adleman invention.The fail safe of RSA public key cryptography method is based on the intractability of big integer factor resolution problem.But to the improving constantly of security requirement, also come also high more to the requirement of RSA key length along with at present.

Taher ElGamal has proposed a kind of public key digital signature mechanism based on euler algorithm.In this mechanism, transmit leg A uses the mould power function to hide private key x, calculates y=g ^xMod p, and PKI y is open.Recipient B utilizes private key to sign, and B utilizes the PKI of A to come certifying signature, and specific algorithm is as follows:

1, preprocessing process: obtain the needed parameters of signature

1.1: determine finite field gf (p), promptly determine prime number p;

1.2: determine generator g;

1.3: choose random number x _A, make 1≤x _A≤ p-1 is with x _AAs signature key, i.e. private key;

1.4: calculate $y_A=g^{x_A},$ y _AAs PKI, be used for certifying signature;

1.6: open parameter g, p and PKI y _A

2, signature process:

2.1: transmit leg open parameter g, p and PKI y _A

2.2: generate random number k, wherein 1≤k≤p-1 utilizes the mould power function to calculate r=g ^k

2.3: calculate for plaintext m: s=k ^-1(m-xr) mod p;

2.4: above-mentioned acquisition (r s) is the signature of transmit leg to plaintext m, and transmit leg will (r, s) and expressly m sends to the recipient.

3, proof procedure:

3.1: recipient B receive expressly m with and signature (r, s);

3.2: according to known parameters p, the PKI y of g and A _A, judge y _A ^rr ^sWhether mod p equals g ^mMod p, if then checking is passed through, otherwise, authentication failed

4, finish.

The method is referred to as Digital Signature Algorithm (DSA) subsequently.

The Fundamentals of Mathematics relevant with the ElGamal data signature mechanism are quite complicated, and signature length is quite long.United States Patent (USP) " generates and verifies electronic signature and discern the method for signing " (" Method for Identifying Subscribers and for Generatingand Verifying Electronic Signatures in a Data Exchange System " patent No. US4 in data exchange system, 995,082) in, proposed the method for a kind of safe generation than the short number word signature, its basis is other mathematical method with lower complexity.

In United States Patent (USP) " Digital Signature Algorithm " (" Digital Signature Algorithm " patent No. US5,231,668), under the situation that keeps the same mathematical complexity, shortened the length of ElGamal digital signature.

Subsequently, the Rueppel of Switzerland and Australian Nyberg have obtained patent " digital signature method and key exchange method " (" Digital Signature Method and KeyAgreement Method " patent No. US5 in the U.S., 600,725), the endorsement method in this patent has signature, verifying speed is fast and the function of message recovery.Its concrete signature-verification process is as follows:

1, preprocessing process: obtain the needed parameters of signature

1.1: determine finite field gf (p);

1.2: determine generator g;

1.3: choose random number x _A, make 1≤x _A≤ p-1 is with x _AAs private key for user;

1.4: calculate $y_A=g^{x_A}\mathrm{mod}p,$ y _AAs client public key;

1.6: open g, p and PKI y _A

2, signature process:

2.1: obtain signature information m;

2.2: signer generates random number k, and wherein 1≤k≤p-1 utilizes the mould power function to calculate r=mg ^-kMod p;

2.3: calculate s=k-xr mod p;

2.4: (r s) sends to the recipient to signer with its signature with message m.

3, proof procedure:

3.1: the recipient receive message m and its signature (r, s);

3.2: according to known parameters p, g, y _A, judge g ^sy _A ^rWhether rmod p equals m (modp), if equate, then checking is passed through, otherwise, authentication failed;

4, finish.

Neal Koblitz in 1985 and Victor Miller propose respectively elliptic curve is used for common key cryptosystem, and have realized already present public key algorithm with elliptic curve.Cryptographic algorithm based on elliptic curve discrete logarithm problem intractability is called as elliptic curve cryptography (Elliptic Curve Cryptography is called for short ECC), becomes the public key algorithm of being accepted extensively by international cryptography circle.

Subsequently, DSA signature mechanism mentioned above and NR signature mechanism are transplanted on the elliptic curve successively, become ECDSA signature algorithm and ECNR signature algorithm, make signature mechanism based on a mathematics difficult problem, promote to based on elliptic curve discrete logarithm problem intractability from the discrete logarithm problem intractability.

Summary of the invention

The objective of the invention is to propose a kind of new ellipse curve signature method.This endorsement method is based on the elliptic curve discrete logarithm problem, this problem has higher complexity on mathematics, thereby have higher characteristics of unit security intensity, promptly can shorten the length of digital signature greatly with identical security intensity, accelerate signature speed, thereby more can satisfy the demand of constrained environments such as mobile communication; And this signature algorithm can construct by the selection of parameter than the application ECDSA ECDSA of DSA Digital Signature Algorithm on elliptic curve high-efficient algorithm more, the message that makes the user not transmit to be signed can also make this algorithm have the function of message recovery, even also can be carried out signature verification.

The invention provides a kind of signature and certifying signature method, system at first determines finite field gf (q), chooses elliptic curve equation E; Choose the basic point G of elliptic curve, and calculate elliptic curve point order of a group N on the finite field.Transmit leg A utilizes these system parameterss to generate the private key x of oneself as signer _A, 1≤x wherein _A≤ N-1 utilizes basic point G to calculate dot product then and obtains some Y on the elliptic curve _A=x _AG is as PKI.Below the signature process step of sender A for plaintext m:

At first, open system parameters of transmit leg A and PKI Y thereof _A, generate random number k then, make k drop on the interval [1, N-1], the basic point G of k and curve is carried out the elliptic curve point multiplication operation, obtain the some kG on the curve; Use some kG that function d will obtain and expressly m carry out computing, wherein guarantee from d, to obtain the value of k, obtain r=d (m, kG).Function f ₀, f ₁, g ₀, g ₁Be all the function of r, use function f ₀, f ₁, g ₀, g ₁With random number and private key x _ASolving equation f ₀(r)+f ₁(r) s=k-x _A(g ₀(r)+g ₁(r) s) solve s=(k-x _Ag ₀(r)-f ₀(r)) (f ₁(r)+x _Ag ₁(r)) ^-1, obtain like this (r s) is the signature of A to plaintext m.(r s) sends to B to sender A with its signature with plaintext m.

Recipient B receives plaintext m, and (r, s), Y at first uses public-key with its signature _A, elliptic curve basic point G and function f ₀, f ₁, g ₀, g ₁Calculate P=(f ₀(r)+f ₁(r) G+ (g s) ₀(r)+g ₁(r) Y s) _A, use function d ' and calculating m '=d ' (r, P).M ' that calculates and the m that receives are compared, if identical then sign legally, simultaneously m ' recovers the plaintext that obtains from the signature result, if difference then sign illegal.

Wherein above-mentioned function d and function d ' must have following character: establishing function d shape is D=d (x, y), from function d can push away y=d ' (x, D), the function d that obtains like this can effectively be hidden cleartext information and random number information in above-mentioned signature and proof procedure; Function d ' can in above-mentioned proof procedure, recover the cleartext information that obtains hiding.

According to another aspect of the present invention, provide a kind of signature of described ellipse curve signature and certifying signature method and device of certifying signature of adopting;

Description of drawings

Fig. 1 is the flow chart of signature process of the present invention.

Fig. 2 is the flow chart of certifying signature process of the present invention.

Fig. 3 is the block diagram of signature of the present invention and certifying signature device.

Embodiment

Fig. 1 illustrates the flow chart of signature process of the present invention.

In step 101, recipient A discloses its PKI Y _AAnd system parameters: the basic point G of curve E, elliptic curve point group, elliptic curve point order of a group N;

In step 102, recipient A generates random number k, 1≤k≤N-1 wherein, and wherein N is the some order of a group of elliptic curve;

In step 103, the point multiplication operation with k and basic point G make elliptic curve obtains the some kG on the curve;

In step 104, obtain expressly m.When the length of real messages was longer than the message-length that can sign, message m can be replaced with the result of Hash function h (m), promptly used private key that the hash value h (m) of message m is signed; When checking, the Hash of message m elder generation that receives is obtained h (m), re-use h (m) certifying signature;

In step 105, use function d that plaintext m and the kG that obtains in the step 104 carried out computing, obtain r=d (m, kG).Wherein function d must have following character: establishing d function shape is D=d (x, y), from function d can push away function d ', y=d ' (x is arranged, D), the d function that obtains like this can effectively be hidden cleartext information and random number information in above-mentioned signature and proof procedure; D ' function can recover the cleartext information that obtains hiding in following validation process steps 204;

In step 106, use function d that plaintext m and the P that obtains in the step 104 carried out computing, obtain r=d (m, P).Use the function f of r ₀, f ₁, g ₀, g ₁With random number and private key x _ASolving equation f ₀(r)+f ₁(r) s=k-x _A(g ₀(r)+g ₁(r) s) solve s=(k-x _Ag ₀(r)-f ₀(r))

(f ₁(r)+x _Ag ₁(r)) ^-1，

In step 107, before sending the signature result, must judge whether the signature r and the s that obtain are zero, if be zero, then must skip to step 102, reselect random number k, again plaintext m are signed;

In step 108, the r and the s that obtain in step 107 are non-vanishing, then obtained A to the signature result of plaintext m (r, s).(r s) sends to B to sender A with its signature with plaintext m.

So far, signature process finishes.

Fig. 2 illustrates the flow chart of certifying signature process of the present invention.

In step 201, recipient B receive plaintext m that A sends and signature (r, s);

In step 202, B obtains the PKI Y of system parameters and A _A

In step 203, the B Y that uses public-key _A, elliptic curve basic point G and function f ₀, f ₁, g ₀, g ₁Calculate P=(f ₀(r)+f ₁(r) G+ (g s) ₀(r)+g ₁(r) Y s) _A

In step 204, B uses function d ' and calculating m '=d ' (r, P);

In step 205, B compares m ' that obtains in the step 204 and the m that receives, if equate, and then to step 206, if unequal, then to step 207;

In step 206, m ' and the m that receives equate that checking is passed through, and it is legal to sign;

In step 206, m ' and the m that receives are unequal, and signature is illegal.

So far, the certifying signature process finishes.

In step 104, when the length of real messages was grown than the message-length that can sign, message m can be replaced with the result of Hash function h (m), and promptly the hash value h (m) to message m signs; In verification step 201, use the Hash function to handle earlier the message m that receives and obtain h (m), again to h (m) certifying signature.

If in the message m of signature, embed (Padding) information of filling, then when sending signature, can not send message m, and only send signature (r, s); When checking, (r s) recovers message m, utilizes the authenticity and integrity of filling (Padding) Information Authentication signature then to utilize signature.

The function d in step 105 and the function d of step 204 ' must have following character: establishing d function shape is D=d (x, y), from function d can push away y=d ' (x, D), the d function that obtains like this can effectively be hidden cleartext information and random number information in above-mentioned signature and proof procedure; D ' function can recover the cleartext information that obtains hiding in above-mentioned proof procedure.D and d ' can comprise following form:

A) d (m kG) can value be: d (m, kG)=m (kG) _x=r, then $d^{,}(r,P)=r{P}_x^{-1}=m,$ Wherein (kG) _XAnd P _XRefer to the abscissa of getting a kG and P respectively;

B) d (m kG) can value be: d (m, kG)=m (kG) _y=r, then $d^{,}(r,P)=r{P}_y^{-1}=m,$ Wherein (kG) _xAnd P _xRefer to the ordinate of getting a kG and P respectively;

C) d (m kG) can value be: $d(m,\mathrm{kG})=m\&CirclePlus;{\left(\mathrm{kG}\right)}_x=r,$ Then $d^{,}(r,P)=m,$ Wherein

Computing also can be used

Computing replaces;

D) d (m kG) can value be: $d(m,\mathrm{kG})=m\&CirclePlus;{\left(\mathrm{kG}\right)}_y=r,$ Then $d^{,}(r,P)=r\&CirclePlus;P_y=m,$ Wherein

Computing also can be used

Computing replaces;

E) d (m kG) can value be: d (m, kG)=(m+ (kG) _x) mod N=r, then d ' (r, P)=(r-P _x) mod N=m, wherein N is that some G is at the elliptic curve point order of a group;

F) d (m, kG) can value for being that expressly kG is the symmetric cryptography function of key with m, and d ' (r, P) can value for being ciphertext accordingly with r, P is the symmetrical decryption function of key;

G) or the like.

Function f in step 106 and the step 203 ₀, f ₁, g ₀, g ₁Be the linear function of r,, can get the simple function of the following r in order to obtain higher computational efficiency:

H) function f ₀, f ₁, g ₀, g ₁Value is f respectively ₀(r)=c ₀* r, f ₁(r)=c ₁, g ₀(r)=c ₂, g ₁(r)=c ₀* r, wherein c ₀, c ₁, c ₂Be constant and function f ₀, f ₁, g ₀, g ₁Can exchange;

I) function f ₀, f ₁, g ₀, g ₁Value is f respectively ₀(r)=c ₁, f ₁(r)=c ₂, g ₀(r)=c ₀* r, g ₁(r)=c ₃, c wherein ₀, c ₁, c ₂, c ₃Be constant and function f ₀, f ₁, g ₀, g ₁Can exchange;

J) or the like.

Fig. 3 illustrates signature of the present invention and certifying signature device.When transmit leg A communicated by letter on a communication channel with recipient B, it is right that transmit leg A uses key generating device 340 to generate key: PKI Y _AWith private key x _A, announce its PKI and system parameters.A uses signature device 320, in conjunction with the signature process of Fig. 1 explanation plaintext m is signed, and expressly m and signature as a result S send to B.

Recipient B receives the expressly m and the S as a result that signs, and obtains the PKI Y of system parameters and A _A, use certifying signature device 350, by in conjunction with the checking of Fig. 2 explanation to the signature of plaintext m S as a result, be verified the result.

Above invention has been described in conjunction with most preferred embodiment of the present invention, and those of ordinary skill in the art can do various modifications and change to it under the situation that does not depart from scope of the present invention.

Claims (32)

1. ellipse curve signature and certifying signature method, it is right that wherein transmit leg has oneself key: private key x _AWith PKI Y _A, and public address system parameter and PKI Y _A, transmit leg uses the private key x of oneself _APlaintext m is realized digital signature, and plaintext m and signature are sent to the recipient, the recipient uses the PKI Y of transmit leg _AVerify that whether transmit leg is legal to the signature of plaintext m, comprises following steps:

Open system parameters of transmit leg and PKI Y thereof _A, generate random number k then, make k drop on the interval [1, N-1], wherein N is the some order of a group of elliptic curve, and the basic point G of k and curve is carried out the elliptic curve point multiplication operation, obtains the some kG on the curve; Use some kG that function d will obtain and expressly m carry out computing, wherein guarantee from d, to obtain the value of k, obtain r=d (m, kG); Function f ₀, f ₁, g ₀, g ₁Be all the function of r, use function f ₀, f ₁, g ₀, g ₁With random number and private key x _ASolving equation f ₀(r)+f ₁(r) s=k-x _A(g ₀(r)+g ₁(r) s) solve s=(k-x _Ag ₀(r)-f ₀(r)) (f ₁(r)+x _Ag ₁(r)) ^-1, obtain like this (r s) is the signature of transmit leg to plaintext m; (r s) sends to the recipient to transmit leg with its signature with plaintext m;

The recipient receives expressly m and transmit leg, and (r s), at first uses the PKI Y of transmit leg to the signature of m _A, elliptic curve basic point G and function f ₀, f ₁, g ₀, g ₁Calculate P=(f ₀(r)+f ₁(r) G+ (g s) ₀(r)+g ₁(r) Y s) _A, use function d ' and calculating m '=d ' (r, P); M ' that calculates and the m that receives are compared, if identical then sign legally, simultaneously m ' recovers the plaintext that obtains from the signature result, if difference then sign illegal;

Wherein above-mentioned function d and function d ' must have following character: establish function d shape and be D=d (x, y), from function d push away y=d ' (x, D).

2. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein when the length of real messages m was longer than the message-length that can sign, message m was replaced with the result of Hash function h (m), promptly used private key that the hash value h (m) of message m is signed; When checking, the Hash of message m elder generation that receives is obtained h (m), re-use h (m) certifying signature.

3. ellipse curve signature as claimed in claim 1 and certifying signature method wherein, if embed filling information in the message m of signature, then do not send message m when sending signature, and only send signature (r, s); When checking, (r s) recovers message m, utilizes the authenticity and integrity of filling information certifying signature then to utilize signature.

4. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function d and function d ' must have following character: establishing d function shape is D=d (x, y), from function d push away y=d ' (x, D), the d function that obtains is so effectively hidden cleartext information and random number information in above-mentioned signature and proof procedure; D ' function recovers the cleartext information that obtains hiding in above-mentioned proof procedure.

5. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function d and function d ' be taken as: when d (m, kG) value be d (m, kG)=m (kG) _xDuring=r, then $d^{,}(r,P)=r{P}_x^{-1}=m,$ Wherein (kG) _xAnd P _xRefer to the abscissa of getting a kG and P respectively.

6. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function d and function d ' be taken as: when d (m, kG) value be d (m, kG)=m (kG) _yDuring=r, then $d^{,}(r,P)=r{P}_y^{-1}=m,$ Wherein (kG) _xAnd P _xRefer to the ordinate of getting a kG and P respectively.

7. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function d and function d ' be taken as: (m, kG) value is as d $d(m,\mathrm{kG})=m\&CirclePlus;{\left(\mathrm{kG}\right)}_x=r$ The time, then $d^{,}(r,P)=r\&CirclePlus;P_x=m.$

8. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function d and function d ' be taken as: (m, kG) value is as d $d(m,\mathrm{kG})=m{\&CircleTimes;\left(\mathrm{kG}\right)}_x=r$ The time, then $d^{,}(r,P)=r\&CircleTimes;P_x=m.$

9. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function d and function d ' be taken as: (m, kG) value is as d $d(m,\mathrm{kG})=m\&CirclePlus;{\left(\mathrm{kG}\right)}_y=r$ The time, then $d^{,}(r,P)=r\&CirclePlus;P_v=m.$

10. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function d and function d ' be taken as: (m, kG) value is as d $d(m,\mathrm{kG})=m{\&CircleTimes;\left(\mathrm{kG}\right)}_y=r$ The time, then $d^{,}(r,P)=r\&CircleTimes;P_y=m.$

11. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function d and function d ' be taken as: when d (m, kG) value is for being expressly with m, when kG is the symmetric cryptography function of key, d ' (r, P) value is for being ciphertext accordingly with r, P is the symmetrical decryption function of key.

12. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function f ₀, f ₁, g ₀, g ₁Be the linear function of r.

13. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function f ₀, f ₁, g ₀, g ₁Be taken as: f ₀(r)=c ₀* r, f ₁(r)=c ₁, g ₀(r)=c ₂, g ₁(r)=c ₀* r, wherein c ₀, c ₁, c ₂Be constant.

14. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function f ₀, f ₁, g ₀, g ₁Be taken as: f ₁(r)=c ₀* r, f ₀(r)=c ₁, g ₁(r)=c ₂, g ₀(r)=c ₀* r, wherein c ₀, c ₁, c ₂Be constant.

15. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function f ₀, f ₁, g ₀, g ₁Value is f respectively ₀(r)=c ₁, f ₁(r)=c ₂, g ₀(r)=c ₀* r, g ₁(r)=c ₃, c wherein ₀, c ₁, c ₂, c ₃Be constant.

16. ellipse curve signature as claimed in claim 1 and certifying signature method, wherein function f ₀, f ₁, g ₀, g ₁Value is f respectively ₁(r)=c ₁, f ₀(r)=c ₂, g ₁(r)=c ₀* r, g ₀(r)=c ₃, c wherein ₀, c ₁, c ₂, c ₃Be constant.

17. ellipse curve signature and certifying signature system comprise key generating device (340), signature device (320) and certifying signature device (350), and it is right that wherein the transmit leg of this system uses described key generating device (340) generation key: private key x _AWith PKI Y _A, and public address system parameter and PKI Y _A, and use described signature device (320) to utilize the private key x of oneself _APlaintext m is realized digital signature, and wherein said signature device (320) is carried out:

Open system parameters and PKI Y thereof _A, generate random number k then, make k drop on the interval [1, N-1], wherein N is the some order of a group of elliptic curve, and the basic point G of k and curve is carried out the elliptic curve point multiplication operation, obtains the some kG on the curve; Use some kG that function d will obtain and expressly m carry out computing, wherein guarantee from d, to obtain the value of k, obtain r=d (m, kG); Function f ₀, f ₁, g ₀, g ₁Be all the function of r, use function f ₀, f ₁, g ₀, g ₁With random number and private key x _ASolving equation f ₀(r)+f ₁(r) s=k-x _A(g ₀(r)+g ₁(r) s) solve s=(k-x _Ag ₀(r)-f ₀(r)) (f ₁(r)+x _Ag ₁(r)) ^-1, obtain like this (r s) is the signature of transmit leg to plaintext m; (r s) sends to the recipient to transmit leg with its signature with plaintext m;

Described certifying signature device (350) is carried out:

(r s), at first uses the PKI Y of transmit leg to the signature of m to receive expressly m and transmit leg _A, elliptic curve basic point G and function f ₀, f ₁, g ₀, g ₁Calculate P=(f ₀(r)+f ₁(r) G+ (g s) ₀(r)+g ₁(r) Y s) _A, use function d ' and calculating m '=d ' (r, P); M ' that calculates and the m that receives are compared, if identical then sign legally, simultaneously m ' recovers the plaintext that obtains from the signature result, if difference then sign illegal;

Wherein above-mentioned function d and function d ' must have following character: establish function d shape and be D=d (x, y), from function d push away y=d ' (x, D).

18. ellipse curve signature and certifying signature system as claim 17, wherein when the length of real messages m is grown than the message-length that can sign, the signature device replaces with the result of Hash function h (m) with message m, promptly uses private key that the hash value h (m) of message m is signed; When checking, the certifying signature device obtains h (m) with the Hash of message m elder generation that receives, and re-uses h (m) certifying signature.

19. as the ellipse curve signature and the certifying signature system of claim 17, wherein,, then when sending signature, do not send message m if in the message m of signature, embed filling information, and only send signature (r, s); When checking, (r s) recovers message m, utilizes the authenticity and integrity of filling information certifying signature then to utilize signature.

20. ellipse curve signature and certifying signature system as claim 17, wherein function d and function d ' must have following character: establishing d function shape is D=d (x, y), from function d push away y=d ' (x, D), the d function that obtains is so effectively hidden cleartext information and random number information in above-mentioned signature and proof procedure; D ' function recovers the cleartext information that obtains hiding in above-mentioned proof procedure.

21. as the ellipse curve signature and the certifying signature system of claim 17, wherein function d and function d ' be taken as: when d (m, kG) value be d (m, kG)=m (kG) _xDuring=r, then $d^{,}(r,P)=r{P}_x^{-1}=m,$ Wherein (kG) _xAnd P _xRefer to the abscissa of getting a kG and P respectively.

22. as the ellipse curve signature and the certifying signature system of claim 17, wherein function d and function d ' be taken as: when d (m, kG) value be d (m, kG)=m (kG) _yDuring=r, then $d^{,}(r,P)=r{P}_y^{-1}=m,$ Wherein (kG) _xAnd P _xRefer to the ordinate of getting a kG and P respectively.

23. as the ellipse curve signature and the certifying signature system of claim 17, wherein function d and function d ' be taken as: (m, kG) value is as d $d(m,\mathrm{kG})=m\&CirclePlus;{\left(\mathrm{kG}\right)}_x=r$ The time, then $d^{,}(r,P)=r\&CirclePlus;P_x=m.$

24. as the ellipse curve signature and the certifying signature system of claim 17, wherein function d and function d ' be taken as: (m, kG) value is as d $d(m,\mathrm{kG})=m\&CircleTimes;{\left(\mathrm{kG}\right)}_x=r$ The time, then $d^{,}(r,P)=r\&CircleTimes;P_x=m.$

25. as the ellipse curve signature and the certifying signature system of claim 17, wherein function d and function d ' be taken as: (m, kG) value is as d $d(m,\mathrm{kG})=m\&CirclePlus;{\left(\mathrm{kG}\right)}_y=r$ The time, then $d^{,}(r,P)=r\&CirclePlus;P_y=m.$

26. as the ellipse curve signature and the certifying signature system of claim 17, wherein function d and function d ' be taken as: (m, kG) value is as d $d(m,\mathrm{kG})=m\&CircleTimes;{\left(\mathrm{kG}\right)}_y=r$ The time, then $d^{,}(r,P)=r\&CircleTimes;P_y=m.$

27. as the ellipse curve signature and the certifying signature system of claim 17, wherein function d and function d ' be taken as: when d (m, kG) value is for being expressly with m, when kG is the symmetric cryptography function of key, d ' (r, P) value is for being ciphertext accordingly with r, P is the symmetrical decryption function of key.

28. ellipse curve signature and certifying signature system, wherein function f as claim 17 ₀, f ₁, g ₀, g ₁Be the linear function of r.

29. ellipse curve signature and certifying signature system, wherein function f as claim 17 ₀, f ₁, g ₀, g ₁Be taken as: f ₀(r)=c ₀* r, f ₁(r)=c ₁, g ₀(r)=c ₂, g ₁(r)=c ₀* r, wherein c ₀, c ₁, c ₂Be constant.

30. ellipse curve signature and certifying signature system, wherein function f as claim 17 ₀, f ₁, g ₀, g ₁Be taken as: f ₁(r)=c ₀* r, f ₀(r)=c ₁, g ₁(r)=c ₂, g ₀(r)=c ₀* r, wherein c ₀, c ₁, c ₂Be constant.

31. ellipse curve signature and certifying signature system, wherein function f as claim 17 ₀, f ₁, g ₀, g ₁Value is f respectively ₀(r)=c ₁, f ₁(r)=c ₂, g ₀(r)=c ₀* r, g ₁(r)=c ₃, c wherein ₀, c ₁, c ₂, c ₃Be constant.

32. ellipse curve signature and certifying signature system, wherein function f as claim 17 ₀, f ₁, g ₀, g ₁Value is f respectively ₁(r)=c ₁, f ₀(r)=c ₂, g ₁(r)=c ₀* r, g ₀(r)=c ₃, c wherein ₀, c ₁, c ₂, c ₃Be constant.

Images