CN110113165B - SM2 digital signature collaborative generation method and system supporting mixed secret sharing - Google Patents

Abstract

The invention relates to an SM2 digital signature method: m devices each having a secret c₁,…,c_m(ii) a From t at initialization₁＝c₁Through with c₂,...,c_mModulo n addition or multiplication progressive calculation of t₂,...,t_mCalculate G_B＝[1+d_A]G，b＝(t_m+t_md_A)^‑1(mod n)，d_AIs a private key; when required d_AWhen signing the message M, the M devices respectively choose k_iBy taking and calculating t₂,...,t_mCorresponding progressive calculation from Q₁＝[k₁]G_BTo obtain Q₂,…,Q_m(ii) a Calculating r ═ e + x₁) mod n, where (x)₁,y₁)＝Q_mE is the hash value of message M; m devices adopt and calculate Q₂,…,Q_mCorresponding progressive calculation from s₁＝(k₁+c₁br) mod n to s₂,…,s_m，s＝(s_m-r) mod n; and (r, s) is a digital signature.

Description

Method and system for collaborative generation of SM2 digital signature supporting hybrid secret sharing

technical field

The invention belongs to the technical field of information security, in particular to a method and system for collaboratively generating SM2 digital signatures supporting mixed secret sharing.

Background technique

SM2 is an elliptic curve public key cryptography algorithm promulgated by the State Cryptography Administration (see "SM2 Elliptic Curve Public Key Cryptography Algorithm" specification, State Cryptography Administration, December 2010). Key exchange and data encryption. However, due to the unique digital signature operation method of the SM2 algorithm, the common secret sharing (splitting) method and the corresponding common secret sharing-based cryptographic operation method cannot be suitable for the situation of using the SM2 private key for digital signature. In response to this problem, the inventor of this patent application has proposed a corresponding digital signature generation scheme based on secret sharing, but the relevant scheme only supports summation secret sharing (the sum of the secret shares constitutes a secret) or product secret sharing (the secret share The product constitutes a secret), and the secret sharing method (mixed secret sharing) in which summation and product are mixed is not supported, which is the problem to be solved by the invention of this patent application.

SUMMARY OF THE INVENTION

The purpose of the present invention is to propose a SM2 digital signature collaborative generation method and system that supports the secret sharing of summation and product mixing.

For the purpose of the present invention, the technical solutions proposed by the present invention include a method and system for collaboratively generating SM2 digital signatures that support hybrid secret sharing.

In the following description of the technical solutions of the present invention, if P and Q are elements (points) in the elliptic curve point group, then P+Q represents the point addition of P and Q, and [k]P represents the sum of k elliptic curve points P. Point addition, that is, P+P+...+P (there are k P, that is, the number multiplication of point P and integer k, if k is a negative number, it means the inverse of the points after adding |k| P points); The ellipsis "..." indicates multiple identical (type) data items or multiple identical operations ([k]P is the multiplication representation of the points agreed in "SM2 Elliptic Curve Public Key Cryptographic Algorithm");

c ^-1 represents the modulo n multiplicative inverse of the integer c (ie, cc ^-1 mod n=1). Unless otherwise specified, the integer inverse of this patent application refers to the modulo n multiplicative inverse; the multiplication of multiple integers (including integers) Multiplication of symbols, multiplication of constants and integer symbols), in the case of no ambiguity, omit the multiplication sign "·", such as k ₁ ·k ₂ is simplified to k ₁ k ₂ , 3·c, simplified bit 3c ;

mod n represents the modulo operation, which corresponds to modn in the specification of "SM2 Elliptic Curve Public Key Cryptography Algorithm"; also, the operator mod n of the modulo n operation has the lowest priority, such as a+b mod n is equivalent to (a+b) mod n, a-b mod n is equivalent to (a-b) mod n, and ab mod n is equivalent to (ab) mod n.

The SM2 digital signature collaborative generation method supporting hybrid secret sharing of the present invention is specifically as follows.

The method involves m devices, where m≧2;

The m devices are respectively labeled No. 1 to No. m devices; the _m devices respectively store integer secrets c ₁ , c ₂ ,..., cm selected randomly in the interval [1,n-1], where n is The order of the SM2 elliptic curve point group is also the order of the base point G of the SM2 elliptic curve point group, c _i is the secret kept by the i-th device, i=1,...,m;

The secret c is calculated in the initialization phase as follows (before or after _allocating c ₁ , c ₂ , . device completes the initialization operation):

Step 1: set t ₁ =c ₁ , enter step 2;

Step i: i=2,...m, calculate t _i =(t _i-1 +c _i )mod n, or t _i =(c _i t _i-1 )mod n;

If i=m, then let c= _tm , complete the calculation of c, otherwise go to the i+1th step, until the mth step calculates _tm ;

In the above process of calculating c, the calculation formula is independently selected for each step; the selection of the calculation formula of each step does not depend on the selection of the formulas of other steps, and is selected randomly or subjectively or according to design requirements;

Then, take GB = [(1+d _A )]G, _b =(c ^-1 (1+d _A ) ^-1 ) mod n, w=1, h=1,

Or, take GB =[(1+d _A )]G, _b =(-c ^-1 d _A (1+d _A ) ^-1 )mod n, w=1, h=0,

Or, taking GB = [c ^-1 ]G, _b =1, w=(c ^-1 (1+d _A ) ^-1 ) mod n, h=1,

Or, take GB = [-c ^-1 d _A ]G, _b =1, w=(-c ^-1 d _A (1+d _A ) ^-1 ) mod n, h=0,

where c ^-1 is the modulo n multiplicative inverse of c, (1+d _A ) ^-1 is the modulo n multiplicative inverse of (1+d _A ), and d _A is the user's SM2 private key;

After completing the initialization, distribute GB , _b , w, h to m devices, and m devices do not save d _A , c;

When the user's SM2 private key d _A needs to be used to digitally sign the message M, the m devices perform the collaborative generation of the digital signature as follows (the subject that needs to use the user's SM2 private key d _A to digitally sign the message M can be is the cryptographic application, system or cryptographic module that invokes the m devices, or the cryptographic application, system in one of the m devices):

Device No. 1 randomly selects an integer k ₁ in [1,n-1], calculates Q ₁ =[k ₁ ] _GB , and then transmits Q ₁ to Device No. 2;

The ith device, i=2,...,m, randomly selects an integer k _i in [1,n-1] and computes Q _i as follows:

If the formula used in calculating t _i is t _i =(t _i-1 +c _i )mod n, then Q _i =Q _i-1 +[k _i ]G _B ;

If the formula used in calculating t _i is t _i =(ci t _{i -1} )mod n, then Q _i =[ci ]Q _{i -1} +[ _ki ] _GB ;

If i= _m , then make Q=Qm, and transfer to subsequent processing, otherwise, the i-th device transmits Q _i to the i+1-th device until the _m -th device completes the Qm calculation;

One of the m devices computes r=(e+x ₁ ) mod n, where x ₁ is taken from (x ₁ , y ₁ )=Q, and e is the hash value (i.e. the hash value) derived from the subscriber identity and the message M value) (according to the SM2 algorithm, e is the hash value of the data obtained by combining the hash value Z _A and the message M derived from parameters such as the user identification ID _A , see the SM2 specification);

(here r is non-confidential data that can be passed between the two devices as needed)

After that, the No. 1 device calculates s ₁ =(k ₁ +c ₁ br)mod n, where k ₁ is the same as k ₁ when calculating Q ₁ ;

Device No. 1 transmits s ₁ to Device No. 2;

Device i, i=2,...,m, computes s _i as follows:

If the formula used to calculate Q _i is Q _i =Q _i-1 +[ _ki ] _GB , then s _i =(s _i-1 + _ki +c _i br)mod n;

If the formula used to calculate Q _i is Q _i =[ _ci ]Q _i-1 +[ _ki ] _GB , then s _i =(ci s _{i -1} + _ki )mod n, where _ki is the same as calculating The _ki when Q _i is the same;

If i=m, after calculating and obtaining s _m , transfer to follow-up calculation, otherwise, the i-th device transmits s _i to the i+1-th device, until the m-th device calculates and obtains s _m ;

One of the m devices computes s=(ws _m -hr) mod n, where (r, s) is the digital signature for the message M .

For the above-mentioned SM2 digital signature collaborative generation method, when t _i is calculated, _i = ₂ , . ...,ci , reset t ₁ , recalculate t _j , _j =2,..., _i until ti ≠0, i=2,...,m.

For the above-mentioned SM2 digital signature collaborative generation method, if the user's SM2 private key d _A is generated after calculating c, the method of generating the user's SM2 private key d _A includes randomly selecting from [1,n-1] an integer as d _A , or as follows:

If b=(c ^-1 (1+d _A ) ^-1 )mod n, then in [1,n-1] an integer is fixed or arbitrarily selected (subjectively arbitrarily or randomly selected) as b, so as to satisfy b=( c ^-1 (1+d _A ) ^-1 )mod n and d _A with d _A ≠ 0 is used as the user's SM2 private key;

If b=(-c ^-1 d _A (1+d _A ) ^-1 )mod n, then in [1,n-1] an integer is fixed or arbitrarily selected (subjectively arbitrarily or randomly selected) as b to satisfy b=(-c ^-1 d _A (1+d _A ) ^-1 )mod n and d _A where d _A ≠0 is used as the user's SM2 private key;

If w=(c ^-1 (1+d _A ) ^-1 )mod n, then in [1,n-1] an integer is fixed or arbitrarily selected (subjectively arbitrarily or randomly selected) as w, so as to satisfy w=( c ^-1 (1+d _A ) ^-1 )mod n and d _A with d _A ≠ 0 is used as the user's SM2 private key;

If w=(-c ^-1 d _A (1+d _A ) ^-1 )mod n, then in [1,n-1] an integer is fixed or arbitrarily selected (subjectively arbitrarily or randomly selected) as w to satisfy w=(-c ^-1 d _A (1+d _A ) ^-1 )mod n and d _A with d _A ≠0 is used as the user's SM2 private key.

For the above-mentioned SM2 digital signature collaborative generation method, if the _ith device completes the calculation of Qi, _i =1, . Device i reselects k _j and recalculates Q _j , j=1,...,i until Q _i is not zero, i=1,...,m.

For the above-mentioned SM2 digital signature collaborative generation method, if in the process of generating the digital signature for the message M, it is found that r is an integer 0, then m devices recalculate Q _i , i=1,...,m, and recalculate Q , r, until r≠0.

For the above-mentioned SM2 digital signature collaborative generation method, if in the process of generating the digital signature for message M, it is found that [r]G+Q is the zero element (infinity point) of the SM2 elliptic curve point group, then m devices Recalculate Qi, _i =1,...,m, recalculate Q, r, until [r]G+Q is not the zero element of the SM2 elliptic curve point group;

Or, if after generating the digital signature for the message M, it is found that (s+r)mod n=0, then m devices recalculate Qi, _i =1,...,m, recalculate Q, r, and recalculate s _i , i=1,...,m, recalculate s until (s+r)mod≠0.

For the above-mentioned SM2 digital signature collaborative generation method, in the process of digital signature generation for message M, if the i-th device (not necessarily all devices) uses a _{i k i instead} of k in the calculation formula of Qi and s _i at the same time _i , _i =1, . Integer, a _i is kept secret or not (if a _i is a randomly selected integer, then a _i is an integer randomly selected in [1, n-1] each time Q _i is calculated, or is initialized in [1] ,n-1] randomly selected integers).

For the above-mentioned SM2 digital signature collaborative generation method, if w=(c ^-1 (1+d _A ) ^-1 )mod n or w=(-c ^-1 d _A (1+d _A ) ^-1 )mod n, and take cm = 1 and calculate t _m using the formula t _m =( _cm t _{m -1} )mod n, and keep w as a secret by the m-th device (other devices do not have w), and the m-th device If the device calculates s=(ws _m -hr) mod n, the SM2 digital signature collaborative generation method is still established.

For the above-mentioned SM2 digital signature collaborative generation method, if w=(c ^-1 (1+d _A ) ^-1 )mod n or w=(-c ^-1 d _A (1+d _A ) ^-1 )mod n, and take cm = 1 and calculate t _m using the formula t _m =( _cm t _{m -1} )mod n, and keep w as a secret by the m-th device (other devices do not have w), and the m-th device If the device calculates s=(ws _m -hr) mod n, and the user's SM2 private key d _A is generated after calculating c, the method of generating the user's SM2 private key d _A is included in [1,n-1] Randomly choose an integer as d _A in , or as follows:

If w=(c ^-1 (1+d _A ) ^-1 )mod n, then randomly select an integer as w in [1,n-1] to satisfy w=(c ^-1 (1+d _A ) ^-1 ) d _A with mod n and d _A ≠ 0 is used as the user's SM2 private key;

If w=(-c ^-1 d _A (1+d _A ) ^-1 )mod n, then randomly select an integer as w in [1,n-1] to satisfy w=(-c ^-1 d _A (1+d _A ) ^-1 ) mod n and d _A with d _A ≠ 0 is used as the user's SM2 private key.

Based on the above-mentioned SM2 digital signature collaborative generation method, an SM2 digital signature collaborative generation system can be constructed. The system includes m devices, where m is greater than or equal to 2, and the m devices can collaboratively generate the SM2 digital signature according to the SM2 digital signature generation method. Digital signature of message M using user's SM2 private key d _A.

It can be seen from the above description that the SM2 digital signature collaborative generation method and system of the present invention supports hybrid secret sharing, that is, the process of calculating the shared secret c includes both the modulo n sum with the elements in c ₁ ,...,cm _m , and the The modulo _n product of the elements in c ₁ ,...,cm.

Detailed ways

The present invention will be further described below in conjunction with the examples. The following embodiments are only a few possible embodiments exemplified by the present invention, and do not represent all possible embodiments, and are not intended to limit the present invention.

Embodiment 1,

This embodiment includes m devices numbered No. 1 to No. m respectively, where m≥2; in the initialization phase, one of the m devices or one device other than the m devices is in [1, n-1 ] randomly select _m integers c ₁ ,...,cm in the interval, and then calculate c according to the aforementioned progressive calculation method of secret c; take GB =[(1+d _A )]G, _b =(c ^-1 (1+d _A ) ⁻¹ ) mod n, w=1, h=1, where c ⁻¹ is the modulo n multiplicative inverse of c and (1+d _A ) ⁻¹ is the modulo n of (1+d _A ) Multiplicative inverse, d _A is the user's SM2 private key; distribute c ₁ ,...,cm to No. 1 to No. _m devices respectively, distribute GB and _b to the required devices (w, h do not need to be distributed, only The calculation formula corresponding to w=1, h=1 needs to be adopted), and c, d _A are destroyed; when the user’s SM2 private key d _A needs to be used to generate a digital signature for the message M, m devices support mixed secrets according to the aforementioned The shared SM2 digital signature collaborative generation method generates a digital signature for message M. In this embodiment, the user's SM2 private key d _A is generated by randomly selecting an integer in [1,n-1].

Embodiment 2,

The difference between this embodiment and Embodiment 1 is that the user's SM2 private key d _A is generated after c is calculated, and satisfies b=(c ^-1 (1+d _A ) ^-1 )mod n and d _A d _A of ≠ 0 is used as the user's SM2 private key, where b is an integer selected fixedly or arbitrarily (subjectively or randomly) in [1,n-1].

Embodiment 3,

This embodiment includes m devices numbered No. 1 to No. m respectively, where m≥2; in the initialization phase, one of the m devices or one device other than the m devices is in [1, n-1 ] randomly select _m integers c ₁ ,...,cm in the interval, and then calculate c according to the above-mentioned progressive calculation method of secret c; GB =[(1+d _A )]G, _b =(-c ^-1 d _A (1+d _A ) ⁻¹ ) mod n, w=1, h=0, where c ⁻¹ is the modulo n multiplicative inverse of c and ( ₁ +d _A ) ⁻¹ is the Modulo n multiplicative inverse, d _A is the user's SM2 private key; distribute c ₁ ,...,cm to No. 1 to No. _m devices respectively, distribute GB and _b to the required devices (w, h do not need to be distributed , only need to adopt the calculation formula corresponding to w=1, h=0), destroy c and d _A ; when it is necessary to use the user's SM2 private key d _A to generate a digital signature for message M, m devices support the aforementioned The SM2 digital signature collaborative generation method of hybrid secret sharing generates a digital signature for message M. In this embodiment, the user's SM2 private key d _A is generated by randomly selecting an integer in [1,n-1].

Embodiment 4,

The difference between this embodiment and Embodiment 1 is that the user's SM2 private key d _A is generated after c is calculated, and satisfies b=(-c ^-1 d _A (1+d _A ) ^-1 )mod n And d _A with d _A ≠ 0 is used as the user's SM2 private key, where b is an integer selected fixedly or arbitrarily (subjectively or randomly) in [1,n-1].

Embodiment 5,

This embodiment includes m devices numbered No. 1 to No. m respectively, where m≥2; in the initialization phase, one of the m devices or one device other than the m devices is in [1, n-1 ] randomly select _m integers c ₁ ,...,cm in the interval, and then calculate c according to the aforementioned progressive calculation method of secret c; take GB = [c ^-1 ]G, _b = 1, w = (c ^{- 1} (1+d _A ) ^-1 ) mod n, h=1, where c ^-1 is the modulo n multiplicative inverse of c , and _{d A} is the user's SM2 private key; distribute c ₁ ,...,cm to the No. 1 to No. m devices, distribute _GB and w to the required devices (b, h do not need to be distributed, just use the calculation formula corresponding to b=1, h=1), and destroy c and d _A ; When the user's SM2 private key d _A needs to generate a digital signature for the message M, m devices generate a digital signature for the message M according to the aforementioned SM2 digital signature collaborative generation method supporting hybrid secret sharing. In this embodiment, the user's SM2 private key d _A is generated by randomly selecting an integer in [1,n-1].

Embodiment 6,

The difference between this embodiment and Embodiment 3 is that the user's SM2 private key d _A is generated after calculating c, and satisfies w=(c ^-1 (1+d _A ) ^-1 )mod n and d _A d _A of ≠ 0 is used as the user's SM2 private key, where w is an integer selected fixedly or arbitrarily (subjectively or randomly) in [1,n-1].

Embodiment 7,

This embodiment includes m devices numbered No. 1 to No. m respectively, where m≥2; in the initialization phase, one of the m devices or one device other than the m devices is in [1, n-1 ] randomly select _m integers c ₁ ,...,cm in the interval, and then calculate c according to the above-mentioned progressive calculation method of secret c; take GB =[-c ^-1 d _A ]G, _b =1, w= (-c ^-1 d _A (1+d _A ) ^-1 ) modn, h=0, where c ^-1 is the modulo n multiplicative inverse of _c , and d _A is the user's SM2 private key; _m is distributed to No. 1 to No. m devices respectively, and _GB and w are distributed to the required devices (b, h do not need to be distributed, just use the calculation formula corresponding to b=1, h=0), and c , d _A is destroyed; when the user's SM2 private key d _A needs to generate a digital signature for message M, m devices generate a digital signature for message M according to the aforementioned SM2 digital signature collaborative generation method supporting mixed secret sharing. In this embodiment, the user's SM2 private key d _A is generated by randomly selecting an integer in [1,n-1].

Embodiment 8,

The difference between this embodiment and Embodiment 3 is that the user's SM2 private key d _A is generated after calculating c, and w=(-c ^-1 d _A (1+d _A ) ^-1 )mod n and d _A with d _A ≠ 0 is used as the user's SM2 private key, where w is an integer selected fixedly or arbitrarily (subjectively or randomly) in [1,n-1].

Embodiment 9,

This embodiment includes m devices numbered No. 1 to No. m respectively, where m≥2; in the initialization phase, one of the m devices or one device other than the m devices is in [1, n-1 ] Randomly select m-1 integers c ₁ ,...,c _m-1 in the interval, take c _m =1, and then calculate c according to the above-mentioned progressive calculation method of secret c, where t _m is calculated using the calculation formula t _m = (c _m t _m-1 ) mod n; take GB = [c ^-1 ]G, _b =1, w=(c ^-1 (1+d _A ) ^-1 ) mod n, h=1, where c ^-1 is the modulo n multiplicative inverse of c, ( ₁ + _{d A} ) ^-1 is the modulo n multiplicative inverse of (1+d _A ), d _A is the user's SM2 private key; Distribute to No. 1 to No. m-1 devices respectively, distribute w to No. m device as a secret (other devices do not have w), distribute GB to required devices ( _b , h do not need to be distributed, just use b = 1, h = 1 corresponding calculation formula), destroy c and d _A ; when it is necessary to use the user's SM2 private key d _A to generate a digital signature for the message M, the m devices support mixed secret sharing as described above. In the SM2 digital signature collaborative generation method, a digital signature for message M is generated, wherein s=(ws _m -hr) mod n is calculated by the mth device. In this embodiment, the user's SM2 private key d _A is generated by randomly selecting an integer in [1,n-1].

Embodiment 10,

The difference between this embodiment and Embodiment 6 is that the user's SM2 private key d _A is generated after c is calculated, and satisfies w=(c ^-1 (1+d _A ) ^-1 )mod n and d _A d _A of ≠ 0 is used as the user's SM2 private key, where w is an integer randomly selected in [1,n-1].

Embodiment 11,

This embodiment includes m devices numbered No. 1 to No. m respectively, where m≥2; in the initialization phase, one of the m devices or one device other than the m devices is in [1, n-1 ] Randomly select m-1 integers c ₁ ,...,c _m-1 in the interval, take c _m =1, and then calculate c according to the above-mentioned progressive calculation method of secret c, where t _m is calculated using the calculation formula t _m = (c _m t _m-1 ) mod n; take GB = [-c ^-1 d _A ]G, _b =1, w=(-c ^-1 d _A (1+d _A ) ^-1 )mod n, h=0, where c ^-1 is the modulo n multiplicative inverse of c, (1+d _A ) ^-1 is the modulo n multiplicative inverse of ( ₁ +d _A ), and d _A is the user's SM2 private key; ...,c _m-1 are distributed to devices No. 1 to m-1 respectively, w is distributed to No. m device as a secret (other devices do not have w), and _GB is distributed to required devices (b, h There is no need to distribute, just use the calculation formula corresponding to b=1, h=0) to destroy c and d _A ; when it is necessary to use the user's SM2 private key d _A to generate a digital signature for message M, m devices press In the aforementioned SM2 digital signature collaborative generation method supporting hybrid secret sharing, a digital signature for message M is generated, wherein s=(ws _m -hr) mod n (ie, s=(ws _m ) mod n) is calculated by the mth device. In this embodiment, the user's SM2 private key d _A is generated by randomly selecting an integer in [1,n-1].

Embodiment 12,

The difference between this embodiment and Embodiment 6 is that the user's SM2 private key d _A is generated after calculating c , and satisfies w=(-c ^-1 d _A (1+d _A ) ^-1 )mod n And d _A with d _A ≠ 0 is used as the user's SM2 private key, where w is an integer randomly selected in [1,n-1].

A corresponding SM2 digital signature collaborative generation system is constructed based on the aforementioned SM2 digital signature collaborative generation method supporting hybrid secret sharing. The system includes m devices, where m is greater than or equal to 2; each of the m devices is a cryptographic server Or a user computing device; the m devices cooperate to generate a digital signature for message M using the user's SM2 private key d _A according to the SM2 digital signature generation method.

Other unexplained specific technical implementations are well known and self-evident to those skilled in the relevant art.

Claims (10)

1. a SM2 digital signature collaborative generation method supporting hybrid secret sharing, characterized in that: The method involves m devices, where m≧2; The m devices are respectively labeled No. 1 to No. m devices; the _m devices respectively store integer secrets c ₁ , c ₂ ,..., cm selected randomly in the interval [1,n-1], where n is The order of the SM2 elliptic curve point group is also the order of the base point G of the SM2 elliptic curve point group, c _i is the secret kept by the i-th device, i=1,...,m; The secret c is calculated in the initialization phase as follows: Step 1: set t ₁ =c ₁ , enter step 2; Step i: i=2,...m, calculate t _i =(t _i-1 +c _i )mod n, or t _i =(c _i t _i-1 )mod n; If i=m, then let c=t _m , complete the calculation of the secret c, otherwise enter the i+1th step until the mth step calculates t _m ; In the above process of calculating c, the calculation formula is independently selected for each step; Then, take GB = [(1+d _A )]G, _b =(c ^-1 (1+d _A ) ^-1 ) mod n, w=1, h=1, Or, take GB =[(1+d _A )]G, _b =(-c ^-1 d _A (1+d _A ) ^-1 )mod n, w=1, h=0, Or, taking GB = [c ^-1 ]G, _b =1, w=(c ^-1 (1+d _A ) ^-1 ) mod n, h=1, Or, take GB = [-c ^-1 d _A ]G, _b =1, w=(-c ^-1 d _A (1+d _A ) ^-1 ) mod n, h=0, where c ^-1 is the modulo n multiplicative inverse of c, (1+d _A ) ^-1 is the modulo n multiplicative inverse of (1+d _A ), and d _A is the user's SM2 private key; After completing the initialization, distribute GB, _b , w, h to m devices, and none of m devices save the user's SM2 private key d _A and secret c; When the user's SM2 private key d _A needs to be used to digitally sign the message M, the m devices perform the collaborative generation of the digital signature as follows: Device No. 1 randomly selects an integer k ₁ in [1,n-1], calculates Q ₁ =[k ₁ ] _GB , and then transmits Q ₁ to Device No. 2; The ith device, i=2,...,m, randomly selects an integer k _i in [1,n-1] and computes Q _i as follows: If the formula used in calculating t _i is t _i =(t _i-1 +c _i )mod n, then Q _i =Q _i-1 +[k _i ]G _B ; If the formula used in calculating t _i is t _i =(ci t _{i -1} )mod n, then Q _i =[ci ]Q _{i -1} +[ _ki ] _GB ; If i= _m , then make Q=Qm, and transfer to subsequent processing, otherwise, the i-th device transmits Q _i to the i+1-th device until the _m -th device completes the Qm calculation; One of the m devices computes r=(e+x ₁ ) mod n, where x ₁ is taken from (x ₁ , y ₁ )=Q, and e is the hash value derived from the subscriber identity and message M; After that, the No. 1 device calculates s ₁ =(k ₁ +c ₁ br)mod n, where k ₁ is the same as k ₁ when calculating Q ₁ ; Device No. 1 transmits s ₁ to Device No. 2; Device i, i=2,...,m, computes s _i as follows: If the formula used to calculate Q _i is Q _i =Q _i-1 +[ _ki ] _GB , then s _i =(s _i-1 + _ki +c _i br)mod n; If the formula used to calculate Q _i is Q _i =[ _ci ]Q _i-1 +[ _ki ] _GB , then s _i =(ci s _{i -1} + _ki )mod n, where _ki is the same as calculating The _ki when Q _i is the same; If i=m, after calculating and obtaining s _m , transfer to follow-up calculation, otherwise, the i-th device transmits s _i to the i+1-th device, until the m-th device calculates and obtains s _m ; One of the m devices calculates s=(ws _m -hr) mod n, where (r, s) is the digital signature for the message M. 2. the SM2 digital signature collaborative generation method supporting hybrid secret sharing according to claim 1, is characterized in that: When t _i is calculated, i=2,..., or m, if t _i =0 occurs, select the integer secret c ₁ ,...,c _i in [1,n-1] again, reset t ₁ , Calculate t _j , j=2,...,i until t _i ≠0,i=2,...,m. 3. the SM2 digital signature collaborative generation method that supports mixed secret sharing according to claim 1, is characterized in that: If the user's SM2 private key d _A is generated after calculating c, the method of generating the user's SM2 private key d _A includes randomly selecting an integer in [1,n-1] as d _A , or as follows: If b=(c ^-1 (1+d _A ) ^-1 )mod n, then fix or arbitrarily select an integer as b in [1,n-1] to satisfy b=(c ^-1 (1+d _A ) ^-1 ) mod n and d _A with d _A ≠ 0 is used as the user's SM2 private key; If b=(-c ^-1 d _A (1+d _A ) ^-1 )mod n, then fix or arbitrarily select an integer as b in [1,n-1] to satisfy b=(-c ^-1 d _A (1+d _A ) ^-1 )mod n and d _A with d _A ≠ 0 is used as the user's SM2 private key; If w=(c ^-1 (1+d _A ) ^-1 )mod n, then fix or arbitrarily select an integer as w in [1,n-1] to satisfy w=(c ^-1 (1+d _A ) ^-1 ) mod n and d _A with d _A ≠ 0 is used as the user's SM2 private key; If w=(-c ^-1 d _A (1+d _A ) ^-1 )mod n, then fix or arbitrarily select an integer as w in [1,n-1] to satisfy w=(-c ^-1 d _A (1+d _A ) ^-1 ) mod n and d _A with d _A ≠ 0 is used as the user's SM2 private key. 4. the SM2 digital signature collaborative generation method supporting hybrid secret sharing according to claim 1, is characterized in that: If the _ith device completes the calculation of _Qi , _{i =} 1, . ,...,i until Q _i is not zero, i=1,...,m. 5. the SM2 digital signature collaborative generation method supporting hybrid secret sharing according to claim 1, is characterized in that: If in the process of generating the digital signature for the message M, it is found that r is an integer 0, then m devices recalculate Q _i , i=1,...,m, and recalculate Q and r until r≠0. 6. The SM2 digital signature collaborative generation method supporting hybrid secret sharing according to claim 1, is characterized in that: If in the process of generating the digital signature for the message M, it is found that [r]G+Q is the zero element of the SM2 elliptic curve point group, then m devices recalculate Q _i , i=1,...,m, and recalculate Q , r, until [r]G+Q is not a zero element of the SM2 elliptic curve point group; Or, if after generating the digital signature for the message M, it is found that (s+r)mod n=0, then m devices recalculate Qi, _i =1,...,m, recalculate Q, r, and recalculate s _i , i=1,...,m, recalculate s until (s+r)mod≠0. 7. The SM2 digital signature collaborative generation method supporting hybrid secret sharing according to claim 1, is characterized in that: In the process of generating the digital signature for the message M, if the ith device replaces k _i with a _i k _i in the calculation formulas of Q _i and s _i at the same time, i=1, . . . , or m, then the SM2 digital The signature co-generation method still holds, where a _i is an integer chosen fixedly or arbitrarily in [1,n-1], and a _i is kept secret or not. 8. The SM2 digital signature collaborative generation method supporting hybrid secret sharing according to claim 1, is characterized in that: If w = (c ^-1 (1+d _A ) ^-1 ) mod n or w = (-c ^-1 d _A (1+d _A ) ^-1 ) mod n, and take cm = 1 and calculate _{t m} adopts the formula t _m =(cm t _{m -1} )mod n, and holds w as a secret by the mth device, and calculates s=(ws _m -hr)modn by the mth device, then the SM2 The digital signature co-generation method still holds. 9. The SM2 digital signature collaborative generation method supporting hybrid secret sharing according to claim 8, is characterized in that: If w = (c ^-1 (1+d _A ) ^-1 ) mod n or w = (-c ^-1 d _A (1+d _A ) ^-1 ) mod n, and take cm = 1 and calculate _{t m} adopts the formula t _m =(cm t _{m -1} ) mod n, and keeps w as a secret by the m-th device, and calculates s=(ws _m -hr) mod n by the m-th device, and the user's SM2 The private key d _A is generated after calculating c, and the way to generate the user's SM2 private key d _A includes randomly selecting an integer in [1,n-1] as d _A , or as follows: If w=(c ^-1 (1+d _A ) ^-1 )mod n, then randomly select an integer as w in [1,n-1] to satisfy w=(c ^-1 (1+d _A ) ^-1 ) d _A with mod n and d _A ≠ 0 is used as the user's SM2 private key; If w=(-c ^-1 d _A (1+d _A ) ^-1 )mod n, then randomly select an integer as w in [1,n-1] to satisfy w=(-c ^{- 1} d _A (1+d _A ) ^-1 ) mod n and d _A with d _A ≠ 0 is used as the user's SM2 private key. 10. A SM2 digital signature collaborative generation system based on the SM2 digital signature collaborative generation method supporting hybrid secret sharing according to any one of claims 1-9, wherein: The SM2 digital signature collaborative generation system includes m devices, wherein m is greater than or equal to 2; each device in the m devices is a password server or a user computing device; the m devices are based on the SM2 digital The signature collaborative generation method is to collaboratively generate a digital signature for the message M using the user's SM2 private key d _A.