CN104393996A - Certificateless-based signcryption method and certificateless-based signcryption system - Google Patents

Abstract

The invention discloses a certificateless-based signcryption method and a certificateless-based signcryption system, belonging to the field of signcryption technologies. The certificateless-based signcryption method and the certificateless-based signcryption system comprise a third-party KGC (Key Generation Center partial private key generation center) and a user module, wherein the third-party module comprises an online task distributor, a partial private key generator and an Hash arithmetic unit which are connected through a secure channel; the user module comprises a user secret value generator, a user full private key generator, an offline signcryption machine, an online signcryption machine and a decipher, and the signcryption operation is carried out on a user through the steps of generating system parameters, generating a user secret value, generating a user partial private key, generating a user full private key, carrying out offline signcryption, carrying out online signcryption and decoding in sequence. According to the certificateless-based signcryption method and the certificateless-based signcryption system, signcryption effectively replaces a simple method of combining encryption and a signature through a logic unit, so that the online/offline signcryption can be implemented under the certificateless environment safely and effectively, and determination of identity of a receiver is not needed in an offline stage, and the certificateless-based signcryption method and the certificateless-based signcryption system have the advantages of high efficiency, good safety, large flexibility and strong applicability.

Description

A kind of based on without the label decryption method of certificate and system

Technical field

The present invention relates to and a kind of sign close technical field, especially design a kind of based on without the label decryption method of certificate and system.

Background technology

In ecommerce, authentication property and confidentiality are substantially the most also important requirements.Ecommerce relates to mobile device and smart card unavoidably, but their physical layer is vulnerable to attack, and therefore, some effective cryptography protections are necessary.But because these equipment itself exist the essence of power limited, cause and design the low algorithm of cost and seem particularly important.

Zheng first time proposes to sign close primitive, and it has unforgeable and confidentiality simultaneously, relative to the simple combination of signature with encryption, has less computation complexity and lower communication cost.The label that Malone-Lee proposes identity-based are first close, and the stopover sites of some identity-based is suggested in succession, efficiency to obtain corresponding improvement in fail safe.

The label that the people such as An propose on-line/off-line are close.The principle of on-line/off-line primitive is that the calculation cost of on-line stage is as far as possible little, and in other words, the operation that major part is complicated, as index, Bilinear map operation, should complete in off-line phase.For improving the flexibility of system, wait that the identity information signing close message and recipient should be unknown in off-line phase.But 2002, the people such as An only proposed the close security model of on-line/off-line label, and the analysis of general construction, but do not provide the close concrete scheme of on-line/off-line label.2005, the people such as Zhang gave the stopover sites of concrete on-line/off-line, but the program needs extra symmetric key encryption scheme could obtain the confidentiality of overall plan.

For overcoming the inherent key escrow of ID-based cryptosystem, the people such as Al-Riyami proposed without cryptographic certificate system in 2003.First the concept close without certificate label proposed in 2008 by Barbosa.At present, most dangerous without certificate stopover sites, 2010, the people such as Selvi indicate the safety issue that pertinent literature exists.

2010, the on-line/off-line label that Luo proposes without certificate were close, but were known in the identity of its off-line phase recipient, and such condition decreases the flexibility of scheme, causes the degeneration of its practicality.Further, in 2014, Shi points out that the scheme of Luo exists safety issue, and assailant can obtain the private key of user by eavesdropping message, fail safe is not enough.

Summary of the invention

1. the technical problem that will solve

For current most of be all realize under the environment of identity-based without certificate stopover sites, there is minority scheme based on without certificate, efficiency is low, the problem of poor stability, the invention provides a kind of based on without the label decryption method of certificate and system, it can realize one, and without under certificate environment, on-line/off-line label are close safely, efficiently, and realize off-line phase without the need to determining the identity of recipient, efficiency is high, fail safe good, flexibility is large, application is strong.

2. technical scheme

Based on the label decryption method without certificate, comprise the steps:

A () system parameters generates:

PKG operational system parameter generation algorithm: first system chooses Big prime p, p factorial method cyclic group G ₁and G ₂, bilinear map e:G ₁× G ₁→ G ₂.From G ₁middle selection generator P, Stochastic choice calculate P _pub=sP, g=e (P, P), system parameters generating algorithm generation system parameter, wherein openly parameter is params=(G ₁, G ₂, e, q, P, P _pub), system master key be msk=s;

B () user secret value generates:

Step 1: user's Stochastic choice as secret value, calculate PK=xP as its corresponding PKI;

C () User Part private key generates:

Step 2: online task distributor sender and recipient's identity send to User Part key generator;

Step 3: tuple (ID, PK) sends to Hash arithmetic unit to carry out computing by User Part key generator, calculates hash value q, that is: (H ₁{ 0,1} ^*× G ₁arrive cryptographic Hash function, { 0,1} ^*× G ₁expression is input as uncertain set, and { Ka Dier of 0,1} amasss and G ₁element in group, expression set 1,2 ..., p-2, p-1});

The value q calculated is sent to User Part key generator by step 4:Hash arithmetic unit, and user is sender and recipient;

Step 5: User Part key generator utilizes main private key msk=s to calculate the part private key of user then online task distributor is sent to;

D the complete private key of () user generates:

Step 6: the certain customers' private key obtained is sent to corresponding user by safe lane by online task distributor, and user is by (x, D) the complete private key as oneself;

E () off-line label are close:

Step 7: the complete private key of oneself is all sent to the close maker of off-line label by sender, r selected by the close maker of off-line label ₁, β, calculate c ₁=α ^-1r ₁p, C ₂=r ₁(β+s) P=r ₁(β P+P _pub), T=γ ^-1μ D _a;

Step 8: sender's Stochastic choice r ₂∈ { 0,1} ^*, calculate U=μ P, by tuple (r ₂, ID _a, U, PK _a) send to Hash arithmetic unit, obtain that is: (H ₂{ 0,1} ^*× G ₁× G ₁arrive cryptographic Hash function, { Ka Dier of 0,1} is long-pending with two G to be input as uncertain set ₁element in group, expression set 1,2 ..., p-2, p-1});

Step 9: the close maker of off-line label obtains cryptographic Hash α from Hash arithmetic unit;

Step 10: sender is by σ '=(U, W, C ₁, C ₂, T, μ, α, beta, gamma, r ₂) be stored in internal memory as off-line ciphertext, by the time on-line stage and recipient mutual time be retrieved use;

F () is signed close online:

Step 11: sender retrieves off-line ciphertext σ '=(U, W, C from internal memory ₁, C ₂, T, μ, α, beta, gamma, r ₂);

Step 12: sender will by message m ∈ { 0,1} ^*send to recipient, obtain the cryptographic Hash q of Hash arithmetic unit from online task distributor _b=H ₁(ID _b, PK _b);

Step 13: sender obtains cryptographic Hash q from Hash arithmetic unit _b;

Step 14: sender's calculated value μ PK _b, by tuple (U, W, PK _b, μ PK _b) send to Hash arithmetic unit, obtain k ∈ { 0,1} ^*, that is: H ₃: G ₁× G ₁× G ₁× G ₁→ { 0,1} ^*(H ₃g ₁× G ₁× G ₁× G ₁to { 0,1} ^*cryptographic Hash function, be input as four G ₁element in group, { 0,1} ^*indicate uncertain set the cartesian product of 0,1});

Step 15: sender obtains cryptographic Hash k from Hash arithmetic unit;

Step 16: sender calculates C=k ⊕ (m||r ₂|| ID _a), by tuple (C ₃, C, r ₂, ID _a, ID _b, C ₁, C ₂, PK _a, PK _b) send to Hash arithmetic unit, obtain $h\∈Z_p^{*},$ That is: $H_4:Z_p^{*}\×{\left\{\mathrm{0,1}\right\}}^{*}\×G_1\×G_1\×G_1\×G_1\→Z_p^{*}$ (H ₄be arrive cryptographic Hash function, be input as set 1,2 ..., p-2, p-1} element, uncertain set { cartesian product of 0,1} and four each and every one G ₁group in element, export into set 1,2 ..., p-2, p-1} element);

Step 17: sender obtains cryptographic Hash h from Hash arithmetic unit;

Step 18: sender is by ciphertext σ=(C ₁, C ₂, C ₃, C, U, T, t) and send to recipient by channel;

G () deciphers:

Step 19: recipient receives ciphertext σ=(C from online task distributor ₁, C ₂, C ₃, C, U, T, t);

Step 20: the ciphertext received sends to decipher to be decrypted and checking by recipient;

Step 21: recipient utilizes the complete private key of oneself to distinguish calculated value W=e (C ₁c ₃+ C ₂, D _b), x _bu, then by tuple (U, W, PK _b, x _bu) send to Hash arithmetic unit, obtain k ∈ { 0,1} ^*, that is: H ₃: G ₁× G ₁× G ₁× G ₁→ { 0,1} ^*(H ₃g ₁× G ₁× G ₁× G ₁to { 0,1} ^*cryptographic Hash function, be input as four G ₁element in group, { 0,1} ^*indicate uncertain set the cartesian product of 0,1});

Step 22: recipient obtains cryptographic Hash k from Hash arithmetic unit;

Step 23: recipient deciphers m||r ₂|| ID _a=C ⊕ k, by tuple (C ₃, C, r ₂, ID _a, ID _b, C ₁, C ₂, PK _a, PK _b) send to Hash arithmetic unit;

Step 24: recipient obtains cryptographic Hash h from Hash arithmetic unit;

Step 25: recipient is by tuple (r ₂, ID _a, U, PK _a) send to Hash arithmetic unit;

Step 26: recipient obtains cryptographic Hash α from Hash arithmetic unit;

Step 27: recipient verifies equation e (P _pub+ q _ap, Tt)=e (U, hP) e (U, PK _a), e (C ₁, P) ^αwhether=W sets up, if all set up, message m is legal, otherwise message is illegal, rejection.

Based on the close system of label without certificate, comprise third party's part private key generating center, line module, wherein third party's part private key generating center comprises online task distributor, part private key generator, Hash arithmetic unit; Line module comprises user's secret value maker, the complete private key generator of user, the close device of off-line label, the close device of online label and decipher, online task distributor, part private key generator and Hash arithmetic unit that third party's part private key generating center is connected by safe lane.

Further, described safe lane, by X.509 certificate, symmetric cryptographic algorithm, IKE or eap-message digest safe practice build.

3. beneficial effect

Compared to prior art, the invention has the advantages that:

(1) Measures compare, the inventive method is compared with former method, in stochastic model, our scheme is provable security under safety supposes q-mBDHI, CDH and q-CAA, by increasing the degree of coupling of scheme signature process and ciphering process, make the ciphertext produced can not be tampered and steal content.Former method security is poor, assailant can eavesdrop the secret value that the ciphertext transmitted in the channel can extract sender, thus can decrypting ciphertext, obtain confidential information, the inventive method is in conjunction with the method for on-line/off-line, complex calculations mechanism is transferred to off-line phase calculate, so its efficiency and former method are more or less the same, high safety;

(2) the present invention be directed to the existing existing deficiency without certificate on-line/off-line stopover sites, propose a kind of completely newly without certificate on-line/off-line label decryption method and system, this programme does not need in the off-line label close stage identity knowing recipient, the flexibility of increase system and practicality, and be provable security in stochastic model, computational efficiency close to existing without certificate stopover sites, high safety, flexibility and practicality high.

Accompanying drawing explanation

Fig. 1 be standard without certificate on-line/off-line stopover sites quick-reading flow sheets;

Fig. 2 is invention system block flow diagram.

Embodiment

Below in conjunction with Figure of description and specific embodiment, the present invention is described in detail.

Embodiment 1

First related notion is described below:

Bilinear map (Bilinear Pairing)

Here the character that the basic definition introducing bilinear map need meet with it.

Make P, Q ∈ G ₁, G ₂be two p rank cyclic groups, wherein p is prime number, and P is G ₁generator.The bilinear map defined on two groups is: e:G ₁× G ₁→ G ₂, and meet character below:

Two mapping .e (aP, bP)=e (P, P) ^ab, to all all set up.

Non-degeneracy. there is P and make e (P, P) ≠ 1.

Computability. there is efficient algorithm to calculate e (P ₁, P ₂), wherein P ₁, P ₂∈ G ₁.

Can notice: Bilinear map computing is tradable, because e (aP, bP)=e (P, P) ^ab=e (bP, aP).

2, difficult problem supposition

Definition 1CDH (Computational Diffie-Hellman)-problem: given p rank cyclic group G ₁, wherein p is prime number, and P is G ₁generator, then group G ₁on CDH-problem be: known aP, bP ∈ G ₁, wherein a, b be from stochastic choice, calculate abP.

Definition 2q-mBDHI (Modified Bilinear Diffie-Hellman Inversion for q-values)-problem: given p rank cyclic group G ₁, wherein p is prime number, and P is G ₁generator, then group G ₁, G ₂on q-mBDHI-problem be: known tuple $(P,\mathrm{\αP},{({\mathrm{\ω}}_1+\mathrm{\α})}^{-1}P,...,{({\mathrm{\ω}}_q+\mathrm{\α})}^{-1}P,{\mathrm{\ω}}_1,...,{\mathrm{\ω}}_q)\∈G_1^{q+2}\×{\left(Z_p^{*}\right)}^q,$ Wherein $\mathrm{\α}\∈Z_p^{*}$ Be unknown, calculate

$e{(P,P)}^{{({\mathrm{\ω}}^{*}+\mathrm{\α})}^{-1}},{\mathrm{\ω}}^{*}\∈Z_p^{*}.$

Definition 3q-CAA (Collusion Attack Algorithm with q-traitors)-problem: given p rank cyclic group G ₁, wherein p is prime number, and P is G ₁generator, then group G ₁on q-CAA-problem be: known $(P,\mathrm{\αP},{({\mathrm{\ω}}_1+\mathrm{\α})}^{-1}P,...,{({\mathrm{\ω}}_q+\mathrm{\α})}^{-1}P,{\mathrm{\ω}}_1,...,{\mathrm{\ω}}_q)\∈G_1^{q+2}\×{\left(Z_p^{*}\right)}^q,$ Wherein $\mathrm{\α}\∈Z_p^{*}$ Be unknown, calculate

${{({\mathrm{\ω}}^{*}+\mathrm{\α})}^{-1}P,\mathrm{\ω}}^{*}\∈Z_p^{*}.$

According to the description that above-mentioned Bilinear Pairing and difficult problem are supposed.

As shown in Figure 1, for an existing standard without certificate on-line/off-line stopover sites quick-reading flow sheets.

System parameter setting module (Setup), user's secret value generation module (SecretValue Extract), User Part private key generation module (Partial Private Key Extract), the close module of off-line label (OfflineSigncrypt), the close module of online label (Online Signcrypt), deciphering module (Decrypt) is comprised without the close system of certificate on-line/off-line label.

1, system parameter setting module (Setup):

Make G ₁, G ₂be rank be respectively p addition cyclic group and multiplication loop group, P is G ₁a generator.KGC Stochastic choice calculate P _pub=sP.Then the open parameter of KGC is params=(G ₁, G ₂, e, q, P, P _pub), main private key is msk=s.

2, user's secret value generation module (Secret Value Extract):

User U selects a random number calculate PK _u=x _up _pub, be the PKI of user U, x _ufor its secret value.

3, User Part private key generation module (Partial Private Key Extract):

KGC is by tuple (ID _u, PK _u) send to Hash arithmetic unit, obtain Q _u, i.e. H ₁: { 0,1} ⁿ× G ₁→ G ₁(H ₁{ 0,1} ⁿ× G ₁to G ₁cryptographic Hash function, { 0,1} ⁿexpression n the cartesian product of 0,1}).KGC calculates D _u=sQ _uas the part private key of user U.

4, the close module of off-line label (Offline Signcrypt):

Sender A determines message to be sent to B, first A Stochastic choice one number calculate static signature R=kP _pub, S=k ^-1(D _a+ (x _a) ^-1q _a), u=e (D _a, Q _b), by tuple (Q _a, Q _b, kPK _b, x _apK _b, u) send to Hash arithmetic unit, obtain k ∈ { 0,1} ⁿ, that is: H ₂: (G ₁) ⁴× G ₂→ { 0,1} ⁿ(H ₂(G ₁) ⁴× G ₂to { 0,1} ⁿcryptographic Hash function, { 0,1} ⁿexpression n the cartesian product of 0,1}).So off-line label close be (R, S).

5, the close module of online label (Online Signcrypt):

Message m is sent to B by sender A, the basis of off-line label close (R, S) calculates ciphertext y=key ⊕ m, by tuple (y, Q _a, Q _b, R, S) and send to Hash arithmetic unit, obtain that is: H ₃: { 0,1} ⁿ× (G ₁) ⁴→ { 0,1} ⁿ(H ₃{ 0,1} ⁿ× (G ₁) ⁴to { 0,1} ⁿcryptographic Hash function, { 0,1} ⁿexpression n the cartesian product of 0,1}).And calculate σ=khx _a.Finally export and sign close SC=(σ, y, R, S).

6, deciphering module (Decrypt):

The B open parameter p arams=(G of PKG ₁, G ₂, e, q, P, P _pub) and sender A authentication signature (σ, y, R) validity.Checking equation e (S, σ P)=e (Q _a, hPK _a+ hP) whether set up, if set up, then signature is effectively, otherwise invalid.If B, after certifying signature is effective, is decrypted ciphertext y.Calculate u=e (D _b, Q _a), obtain key=H from Hash arithmetic unit ₂(Q _a, Q _b, x _br,x _bpK _a, u), then export expressly m=key ⊕ y (wherein cryptographic Hash Q _a, h sends to Hash arithmetic unit to calculate).

According to above-mentioned <Setup, Secret Value Extract, Partial Private Key Extract, Offline Signcrypt, Online Signcrypt, Decrypt> algorithm, namely achieve without certificate on-line/off-line label decryption method.At this without in certificate on-line/off-line label decryption method, the secret value that user oneself produces and the part private key that KGC produces form whole private keys of user jointly, overcome the key escrow under identity-based environment.

But the program just needs to determine recipient's identity in off-line phase, decrease flexibility and the practicality of system, the program has been noted and has there is safety issue simultaneously, assailant can by eavesdropping the ciphertext of the sender's transmission transmitted in the channel, just can extract the private key of sender, this is fatal concerning system.

Therefore, the present invention provide one brand-new without certificate on-line/off-line label decryption method and system, in off-line phase without the need to determining recipient's identity, improve flexibility and the practicality of system, in stochastic model, fail safe is high.

As Fig. 2, provide a kind of concrete steps based on the label decryption method without certificate of the present invention:

A () system parameters generates (Setup):

PKG operational system parameter generation algorithm: first system chooses Big prime p, p factorial method cyclic group G ₁and G ₂, bilinear map e:G ₁× G ₁→ G ₂.From G ₁middle selection generator P, Stochastic choice calculate P _pub=sP, g=e (P, P).System parameters generating algorithm generation system parameter, wherein openly parameter is params=(G ₁, G ₂, e, q, P, P _pub), system master key be msk=s.

B () user secret value generates (Secret Value Extract):

Step 1: user's Stochastic choice as secret value, calculate PK=xP as its corresponding PKI.

C () User Part private key generates (Partial Private Key Extract):

Step 2: online task distributor sender and recipient's identity send to key generator;

Tuple (ID, PK) sends to Hash arithmetic unit to carry out computing by step 3:KGC, calculates hash value q, that is: (H ₁{ 0,1} ^*× G ₁arrive cryptographic Hash function, { 0,1} ^*× G ₁expression is input as uncertain set, and { Ka Dier of 0,1} amasss and G ₁element in group, expression set 1,2 ..., p-2, p-1}).

The value q calculated is sent to User Part key generator by step 4:Hash arithmetic unit; User Part key generator english abbreviation is KGC;

Step 5:KGC utilizes main private key msk=s to calculate the part private key of user then online task distributor is sent to;

D the complete private key of () user generates (Full Private Key Extract):

Step 6: the certain customers' private key obtained is sent to corresponding user by safe lane by online task distributor, and user is by (x, D) the complete private key as oneself;

(e) off-line label close (Offline Signcrypt):

Step 7: suppose that sender is that the complete private key of oneself is all sent to the close maker of off-line label by Alice, Alice, r selected by the close maker of off-line label ₁, β, calculate c ₁=α ^-1r ₁p, C ₂=r ₁(β+s) P=r ₁(β P+P _pub), T=γ ^-1μ D _a;

Step 8:Alice Stochastic choice r ₂∈ { 0,1} ^*, calculate U=μ P, by tuple (r ₂, ID _a, U, PK _a) send to Hash arithmetic unit, obtain that is: (H ₂{ 0,1} ^*× G ₁× G ₁arrive cryptographic Hash function, { Ka Dier of 0,1} is long-pending with two G to be input as uncertain set ₁element in group, expression set 1,2 ..., p-2, p-1});

Step 9: the close maker of off-line label obtains cryptographic Hash α from Hash arithmetic unit;

Step 10:Alice is by σ '=(U, W, C ₁, C ₂, T, μ, α, beta, gamma, r ₂) be stored in internal memory as off-line ciphertext, by the time on-line stage and recipient mutual time be retrieved use; This off-line phase without the need to determining recipient's identity, efficiency improve, eliminate off-line confirm restriction, flexibility and practicality higher, in stochastic model, fail safe is good.

F () signs close (Online Signcrypt) online:

Step 11:Alice retrieves off-line ciphertext σ '=(U, W, C from internal memory ₁, C ₂, T, μ, α, beta, gamma, r ₂);

Step 12:Alice will by message m ∈ { 0,1} ^*send to Bob, obtain the cryptographic Hash q of Hash arithmetic unit from online task distributor _b=H ₁(ID _b, PK _b);

Step 13:Alice obtains cryptographic Hash q from Hash arithmetic unit _b;

Step 14:Alice calculated value μ PK _b, by tuple (U, W, PK _b, μ PK _b) send to Hash arithmetic unit, obtain k ∈ { 0,1} ^*, that is: H ₃: G ₁× G ₁× G ₁× G ₁→ { 0,1} ^*(H ₃g ₁× G ₁× G ₁× G ₁to { 0,1} ^*cryptographic Hash function, be input as four G ₁element in group, { 0,1} ^*indicate uncertain set the cartesian product of 0,1});

Step 15:Alice obtains cryptographic Hash k from Hash arithmetic unit;

Step 16:Alice calculates C=k ⊕ (m||r ₂|| ID _a), by tuple (C ₃, C, r ₂, ID _a, ID _b, C ₁, C ₂, PK _a, PK _b) send to Hash arithmetic unit, obtain $h\&Element;Z_p^{*},$ That is: $H_4:Z_p^{*}\&times;{\left\{\mathrm{0,1}\right\}}^{*}\&times;G_1\&times;G_1\&times;G_1\&times;G_1\&RightArrow;Z_p^{*}$ (H ₄be arrive cryptographic Hash function, be input as set 1,2 ..., p-2, p-1} element, uncertain set { cartesian product of 0,1} and four each and every one G ₁group in element, export into set 1,2 ..., p-2, p-1} element);

Step 17:Alice obtains cryptographic Hash h from Hash arithmetic unit;

Step 18:Alice is by ciphertext σ=(C ₁, C ₂, C ₃, C, U, T, t) and send to Bob by channel;

(g) deciphering (Decrypt):

Step 19:Bob receives σ=(C from online task distributor ₁, C ₂, C ₃, C, U, T, t);

The ciphertext received sends to decipher to be decrypted and checking by step 20:Bob;

Step 21: the complete private key calculated value W=e (C respectively utilizing oneself ₁c ₃+ C ₂, D _b), x _bu, then by tuple (U, W, PK _b, x _bu) send to Hash arithmetic unit, obtain k ∈ { 0,1} ^*, that is: H ₃: G ₁× G ₁× G ₁× G ₁→ { 0,1} ^*(H ₃g ₁× G ₁× G ₁× G ₁to { 0,1} ^*cryptographic Hash function, be input as four G ₁element in group, { 0,1} ^*indicate uncertain set the cartesian product of 0,1});

Step 22:Bob obtains cryptographic Hash k from Hash arithmetic unit;

Step 23:Bob deciphers m||r ₂|| ID _a=C ⊕ k, by tuple (C ₃, C, r ₂, ID _a, ID _b, C ₁, C ₂, PK _a, PK _b) send to Hash arithmetic unit;

Step 24:Bob obtains cryptographic Hash h from Hash arithmetic unit;

Step 25:Bob is by tuple (r ₂, ID _a, U, PK _a) send to Hash arithmetic unit;

Step 26:Bob obtains cryptographic Hash α from Hash arithmetic unit;

Step 27:Bob verifies equation e (P _pub+ q _ap, Tt)=e (U, hP) e (U, PK _a), e (C ₁, P) ^α=W sets up, and all set up, message m is legal, receives.

Therefore, the present invention provide one brand-new without certificate label decryption method, in off-line phase without the need to determining recipient's identity, improve flexibility and the practicality of system, in stochastic model, fail safe is high.

A kind of based on the close system of label without certificate, comprise: third party KGC (Key Generation Center part private key generating center), line module, wherein third party's module comprises the online task distributor, part private key generator, the Hash arithmetic unit that are connected by safe lane; Safe lane, is built by X.509 certificate technique.Line module comprises user's secret value maker, the complete private key generator of user, the close device of off-line label, the close device of online label and decipher.

Sign and closely in a logic, achieve signature to message and encryption, message can secret ground, send to recipient to certification while, system also can be operably quite efficient.Meanwhile, we realize under without the environment of certificate, overcome the problem of the key escrow of ID-based cryptosystem.Moreover, use the primitive of on-line/off-line, more improve the efficiency of system, electronic cash payment, email authentication and encryption key distribution etc. can be made to be applied on the limited equipment of intelligent machine constant power efficiently, use quite general today at intelligent machine, have very important meaning.

Embodiment 2

Embodiment 2 is substantially the same manner as Example 1, and difference is, safe lane is built by symmetric cryptographic algorithm, step 27, and Bob verifies equation e (P _pub+ q _ap, Tt)=e (U, hP) e (U, PK _a), e (C ₁, P) ^α=W is false, and message m is illegal, rejection.

Embodiment 3

Embodiment 3 is substantially the same manner as Example 1, and difference is, safe lane is built by IKE.

Embodiment 4

Embodiment 4 is substantially the same manner as Example 1, and difference is, safe lane is built by eap-message digest safe practice.

Claims (3)

1., based on the label decryption method without certificate, comprise the steps:

A () system parameters generates:

PKG operational system parameter generation algorithm: first system chooses Big prime p, p factorial method cyclic group G ₁and G ₂, bilinear map e:G ₁× G ₁→ G ₂.From G ₁middle selection generator P, Stochastic choice calculate P _pub=sP, g=e (P, P), system parameters generating algorithm generation system parameter, wherein openly parameter is params=(G ₁, G ₂, e, q, P, P _pub), system master key be msk=s;

B () user secret value generates:

Step 1: user's Stochastic choice as secret value, calculate PK=xP as its corresponding PKI;

C () User Part private key generates:

Step 2: online task distributor sender and recipient's identity send to User Part key generator;

Step 3: tuple (ID, PK) sends to Hash arithmetic unit to carry out computing by User Part key generator, calculates hash value q, that is: (H ₁{ 0,1} ^*× G ₁arrive cryptographic Hash function, { 0,1} ^*× G ₁expression is input as uncertain set, and { Ka Dier of 0,1} amasss and G ₁element in group, expression set 1,2 ..., p-2, p-1});

The value q calculated is sent to User Part key generator by step 4:Hash arithmetic unit, and user is sender and recipient;

Step 5: User Part key generator utilizes main private key msk=s to calculate the part private key of user then online task distributor is sent to;

D the complete private key of () user generates:

Step 6: the certain customers' private key obtained is sent to corresponding user by safe lane by online task distributor, and user is by (x, D) the complete private key as oneself;

E () off-line label are close:

Step 7: the complete private key of oneself is all sent to the close maker of off-line label by sender, r selected by the close maker of off-line label ₁, β, calculate c ₁=α ^-1r ₁p, C ₂=r ₁(β+s) P=r ₁(β P+P _pub), T=γ ^-1μ D _a;

Step 8: sender's Stochastic choice ₂∈ { 0,1} ^*, calculate U=μ P, by tuple (r ₂, ID _a, U, PK _a) send to Hash arithmetic unit, obtain that is: (H ₂{ 0,1} ^*× G ₁× G ₁arrive cryptographic Hash function, { Ka Dier of 0,1} is long-pending with two G to be input as uncertain set ₁element in group, expression set 1,2 ..., p-2, p-1});

Step 9: the close maker of off-line label obtains cryptographic Hash α from Hash arithmetic unit;

Step 10: sender is by σ '=(U, W, C ₁, C ₂, T, μ, α, beta, gamma, r ₂) be stored in internal memory as off-line ciphertext;

F () is signed close online:

Step 11: sender retrieves off-line ciphertext σ '=(U, W, C from internal memory ₁, C ₂, T, μ, α, beta, gamma, r ₂);

Step 12: sender will by message m ∈ { 0,1} ^*send to recipient, obtain the cryptographic Hash q of Hash arithmetic unit from online task distributor _b=H ₁(ID _b, PK _b);

Step 13: sender obtains cryptographic Hash q from Hash arithmetic unit _b;

Step 14: sender's calculated value μ PK _b, by tuple (U, W, PK _b, μ PK _b) send to Hash arithmetic unit, obtain k ∈ { 0,1} ^*, that is: H ₃: G ₁× G ₁× G ₁× G ₁→ { 0,1} ^*(H ₃g ₁× G ₁× G ₁× G ₁to { 0,1} ^*cryptographic Hash function, be input as four G ₁element in group, { 0,1} ^*indicate uncertain set the cartesian product of 0,1});

Step 15: sender obtains cryptographic Hash k from Hash arithmetic unit;

Step 16: sender calculates by tuple (C ₃, C, r ₂, ID _a, ID _b, C ₁, C ₂, PK _a, PK _b) send to Hash arithmetic unit, obtain that is: $H_4:Z_p^{*}\&times;{\left\{\mathrm{0,1}\right\}}^{*}\&times;G_1\&times;G_1\&times;G_1\&times;G_1\&RightArrow;Z_p^{*}$ (H ₄be arrive cryptographic Hash function, be input as set 1,2 ..., p-2, p-1} element, uncertain set { cartesian product of 0,1} and four each and every one G ₁group in element, export into set 1,2 ..., p-2, p-1} element);

Step 17: sender obtains cryptographic Hash h from Hash arithmetic unit;

Step 18: sender is by ciphertext σ=(C ₁, C ₂, C ₃, C, U, T, t) and send to recipient by channel;

G () deciphers:

Step 19: recipient receives ciphertext σ=(C from online task distributor ₁, C ₂, C ₃, C, U, T, t);

Step 20: the ciphertext received sends to decipher to be decrypted and checking by recipient;

Step 21: recipient utilizes the complete private key of oneself to distinguish calculated value W=e (C ₁c ₃+ C ₂, D _b), x _bu, then by tuple (U, W, PK _b, x _bu) send to Hash arithmetic unit, obtain k ∈ { 0,1} ^*, that is: H ₃: G ₁× G ₁× G ₁× G ₁→ { 0,1} ^*(H ₃g ₁× G ₁× G ₁× G ₁to { 0,1} ^*cryptographic Hash function, be input as four G ₁element in group, { 0,1} ^*indicate uncertain set the cartesian product of 0,1});

Step 22: recipient obtains cryptographic Hash k from Hash arithmetic unit;

Step 23: recipient deciphers by tuple (C ₃, C, r ₂, ID _a, ID _b, C ₁, C ₂, PK _a, PK _b) send to Hash arithmetic unit;

Step 24: recipient obtains cryptographic Hash h from Hash arithmetic unit;

Step 25: recipient is by tuple (r ₂, ID _a, U, PK _a) send to Hash arithmetic unit;

Step 26: recipient obtains cryptographic Hash α from Hash arithmetic unit;

Step 27: recipient verifies equation e (P _pub+ q _ap, Tt)=e (U, hP) e (U, PK _a), e (C ₁, P) ^αwhether=W sets up, if all set up, message m is legal, otherwise message is illegal, rejection.

2. based on the close system of label without certificate, it is characterized in that: comprise third party's part private key generating center, line module, wherein third party's part private key generating center comprises online task distributor, part private key generator, Hash arithmetic unit; Line module comprises user's secret value maker, the complete private key generator of user, the close device of off-line label, the close device of online label and decipher, online task distributor, part private key generator and Hash arithmetic unit that third party's part private key generating center is connected by safe lane.

3. according to claim 2ly a kind ofly to it is characterized in that: described safe lane based on the close system of label without certificate, by X.509 certificate, symmetric cryptographic algorithm, IKE or eap-message digest safe practice build.