CN110299998A - Generation method and system are cooperateed with by the SM9 digital signature of intermediate parameters - Google Patents

Abstract

SM9 digital signature generation method: devices labeled No. 1 to m respectively have integer secrets c _i in [1,n-1], n is the order of SM9 group, i=1,...,m, m≥2; P _A ＝[(c ₁ c ₂ …c _m ) ^‑1 ]d _A , P _U ＝[u]d _A , d _A is the user's private key, and u is an integer secret in [1,n‑1]; P _B is a non-zero element in group G ₁ ; when signing a message, calculate w=g _U ^(r ₁ r ₂ …r _m ), h=H ₂ (M||w,n), T=[r ₁ r ₂ …r _m ]P _U +[‑F(z ₁ ,...,z _m )]P _B ，V＝[F(z ₁ ,...,z _m )]P _B +[‑hc ₁ c ₂ …c _m ]P _A , F(z ₁ ,z ₂ ,…,z _m ) is congruent with z ₁ a ₂ a ₃ …a _m +z ₂ a ₃ …a _m +…+z _m modulo n, S=T+V; then (h, S) is the digital signature of d _A on message M.

Description

SM9 digital signature collaborative generation method and system with intermediate parameters

technical field

The invention belongs to the technical field of information security, in particular to a SM9 digital signature collaborative generation method and system by means of intermediate parameters.

Background technique

SM9 is an identification cryptographic algorithm based on bilinear mapping (pairing operation) promulgated by the State Cryptography Administration, where the bilinear mapping (pairing operation) is:

e: G ₁ ×G ₂ →G _T , where G ₁ and G ₂ are additive cyclic groups, G _T is a multiplicative cyclic group, and the order of G ₁ , G ₂ , and G _T is a prime number n (note: in the SM9 specification Among them, the order of G ₁ , G ₂ , G _T is capital letter N, and this patent application uses lower case n), that is, if P, Q, R are elements in G ₁ , G ₂ respectively, then e(P, Q) is an element in G _T , and:

e(P+R,Q)=e(P,Q)e(R,Q),

e(P,Q+R)=e(P,Q)e(P,R),

e(aP,bQ)=e(P,Q) ^ab .

Based on the SM9 cryptographic algorithm, digital signature, key exchange and data encryption based on identification can be realized. In the SM9 cryptographic algorithm, the process of using the user's SM9 private key d _A to generate a digital signature for a message M is as follows:

Calculated to get w=g^r, where the symbol ^ means exponentiation (g to the power of r), r is an integer randomly selected in the interval [1,n-1], and n is the group G ₁ and G of the SM9 cryptographic algorithm _2. The order of G _T , g=e(P ₁ , P _pub ), P ₁ is the generator in G ₁ , P _pub is the main public key (that is, P _pub =[s]P ₂ , s is the main private key or the master key, P ₂ is the generator in G ₂ , see the SM9 specification; note that the symbols used here for the master private key or master key, master public key, and user identification private key are slightly different from the SM9 specification);

Then, calculate h=H ₂ (M||w,n), where H ₂ is the hash function specified in SM9, M||w represents the combination of M and w, and n is G ₁ , G ₂ , G order of _T (see SM9 specification);

If r≠h, calculate S=[rh]d _A , then (h, S) is the generated digital signature; if r=h, reselect r, recalculate w, h until r≠h.

For some special requirements, for example, in order to ensure the security of the user's private key in a non-hardware environment, some SM9 digital signature generation methods based on secret sharing (sharing) have been proposed. In these methods, multiple devices respectively store the secret share of the private key of the user SM9, or respectively store the secret share of the secret related to the private key; when it is necessary to use the user's private key to generate a digital signature for a message M, each The device uses its own secret share to interact with other devices and perform collaborative operations to generate digital signatures for messages.

The existing SM9 digital signature collaborative generation scheme based on secret sharing usually calculates w=g^(a ₁ r ₁ +…+a _m r _m ) in the process of cryptographic operations, where r _i is the i-th device in [ 1,n-1] randomly selected integers, and a _i is a constant, i=1,...,m (assuming there are m devices); then calculate h=H ₂ (M||w,n), and finally m The devices obtain S=[(a ₁ r ₁ +...+ _{am r m )} -h]d _A through collaborative calculation. This scheme is usually not problematic, but there may also be a situation where (a ₁ r ₁ +...+a _m r _m ) mod n=0 happens to happen, and this happens to be observed by one of the devices ( For example, by checking whether w is a unit unit), but not reporting, the device may obtain the user's SM9 private key from the finally obtained digital signature (h, S). Although the probability of this situation is extremely small, it may still happen, especially in the case that r _i is difficult to be truly randomly selected.

If the digital signature collaborative generation scheme based on secret sharing can achieve the adopted scheme is w=g^(ar ₁ …r _m ), S=[(ar ₁ …r _m )-h]d _A , that is, r ₁ ,...,r _m and a constant a appear in the form of a product, so the situation of (ar ₁ ...r _m ) mod n=0 will not occur, and such a scheme has higher security. Here we call r ₁ ,...,r _m and the constant a in the form of a product as the product r parameter, and we call r ₁ ,...,r _m and the constant a in the form of a product in the process of generating a digital signature SM9 digital signature collaborative generation method, called SM9 digital signature collaborative generation method with product r parameter.

Contents of the invention

The purpose of the present invention is to propose a SM9 digital signature generation technical scheme with product r parameter enhanced security, so as to enhance the security of the SM9 digital signature collaborative generation technical scheme based on secret sharing.

Aiming at the purpose of the present invention, the technical solution proposed by the present invention includes a SM9 digital signature collaborative generation method and a corresponding system by means of intermediate parameters.

In the following description of the technical solution of the present invention, if P and Q are elements in the additive groups G ₁ and G ₂ , then P+Q means the addition of P and Q on the additive group, and PQ means the inverse of P plus Q (additive inverse element), [k]P means the addition of k Ps on the additive group, that is, P+P+...+P (a total of k Ps) (if k is a negative number, it is |k| P phase The additive inverse of the result of addition; here the use of the [] symbol is consistent with the SM9 specification);

The ellipsis "..." means multiple data items of the same (type) or multiple same operations;

If a and b are elements in the multiplicative group G _T , then ab or a b means the multiplication of a and b on the multiplicative group G _T (as long as there is no ambiguity, "·" can be omitted), a ^-1 Indicates the inverse of a in the multiplicative group (multiplicative inverse), a ^t represents the multiplication of t a's on the multiplicative group G _T (t is a negative number, it is the multiplicative inverse of the result of multiplying |t| a's), That is, exponentiation, another expression of a ^t is a^t;

If c is an integer, then c ^-1 represents the modulo n multiplicative inverse of integer c (that is, cc ^-1 mod n=1); unless otherwise specified, the multiplicative inverse of integers in this patent invention is for groups G ₁ and G ₂ , the modulo n multiplicative inverse of the order n of _GT ;

Multiplication of multiple integers (including multiplication of integer symbols, multiplication of constants and integer symbols), in the case of no ambiguity, omit the multiplication sign "·", such as k ₁ k ₂ simplified to k ₁ k ₂ , 3·c, simplified to 3c;

mod n means modulo operation (modulo operation), corresponding to modN in the SM9 specification; also, the operator mod n of modulo n operation has the lowest priority, such as a+b mod n is equivalent to (a+b) mod n, a-b mod n is equivalent to (a-b) mod n, ab mod n is equivalent to (ab) mod n.

The SM9 digital signature collaborative generation method proposed by the present invention with the help of intermediate parameters is specifically as follows.

The method involves m devices respectively labeled No. 1, No. 2, ..., to No. m, m≥2;

The i-th device saves the integer secret c _i in the interval [1,n-1], i=1,...,m, where _n is the order of the groups G ₁ , G ₂ , GT in the SM9 encryption algorithm (which is a prime number );

(initialization phase) precomputed with:

P _A =[c ^-1 ]d _A , where d _A is the user's SM9 identification private key, c ^-1 is the modulo n multiplicative inverse of c, c=(c ₁ c ₂ ...c _m )modn is the number of m devices no integer secrets saved;

P _U =[u]d _A , where u is an integer secret in the interval [1,n-1] that is not saved by m devices;

u and c ^-1 do not have to be different from each other (they are different or the same);

g _U ＝g ^ u, wherein ^ is exponentiation (exponentiation is carried out to the element in front of ^, and the number of times of exponentiation is behind ^), g=e(P ₁ , P _pub ), P ₁ is the generation in G ₁ element, P _pub is the main public key (that is, P _pub =[s]P ₂ , s is the main private key or master key, and P ₂ is the generating element in G ₂ , see SM9 specification);

Select a non-zero element P _B other than the user private key d _A in the group G ₁ (fixed selection, such as fixed selection P _B = P ₁ , or subjective arbitrary selection, or random selection, for example, in [1,n -1] randomly select an integer b, calculate P _B =[b]P ₁ or P _B =[b]d _A );

m devices do not save d _A ;

When it is necessary to use the user's SM9 identification private key d _A to digitally sign a message M, m devices generate digital signatures in the following manner (subjects who need to use the user's SM9 identification private key d _A to digitally sign message M It can be a cryptographic application, system or cryptographic module that invokes these m devices, or a cryptographic application, system in one of the m devices):

First, m devices obtain w=g _U ^(r ₁ r ₂ …r _m ) through interactive calculation, where r _i is an integer randomly selected by the i-th device in the interval [1,n-1] during the calculation process, i=1,...,m;

Then, (one of the m devices or other devices) calculates h = H ₂ (M||w,n), where H ₂ is the hash function specified in SM9 and M||w represents the word M and w String merge, n is the order of G ₁ , G ₂ , G _T ;

(h does not need to be kept secret, it can be freely transmitted as needed)

(one of the m devices or other devices) check whether w is equal to g^h, if w=g^h, then m devices recalculate w until w≠g^h;

Afterwards, m devices cooperate to calculate T=[r ₁ r ₂ ...r _m ]P _U +[-F(z ₁ ,z ₂ ,...,z _m )]P _B , V=[F(z ₁ ,z ₂ ,…,z _m )]P _B +[-c ₁ c ₂ …c _m h]PA , where r ₁ ,r ₂ ,…,r _m are No. 1 and No. ₂ in the process of calculating w respectively ,..., the integers selected by the m-th device in [1,n-1], z ₁ , z ₂ ,...,z _m are the 1st, 2nd,..., An integer randomly selected by the m-th device in [1,n-1], F(z ₁ ,z ₂ ,…,z _m ) is the following calculation formula for z ₁ ,z ₂ ,…,z _m :

F(z ₁ ,z ₂ ,…,z _m )≡z ₁ a ₂ a ₃ …a _m +z ₂ a ₃ …a _m +…+z _m-1 a _m +z _m (mod n)(mod n congruent);

Wherein, a _i is an integer randomly selected by the i-th device in [1,n-1] in the process of calculating T and V, i=2,...,m;

Finally, (one of the m devices or others) calculates S=T+V, then (h, S) is the digital signature for the message M.

(At this time S＝[r ₁ r ₂ …r _m ]P _U +[-c ₁ c ₂ …c _m h]P _A ＝[(r ₁ r ₂ …r _m )uh]d _A )

For the SM9 digital signature collaborative generation method with the help of intermediate parameters described above, if w is not checked whether w and g^h are equal during the above calculation process, after calculating S, if (the device for calculating S=T+V) inspection finds If S is zero, then m devices perform collaborative calculations again until S is not zero.

For the SM9 digital signature collaborative generation method with the help of intermediate parameters described above, the methods for m devices to calculate w=g _U ^(r ₁ r ₂ ...r _m ) include (not all possible ways):

The No. 1 device calculates g ₁ =g _U ^r ₁ , and sends g ₁ to the No. 2 device;

After the i-th device receives g _i-1 , i=2,...,m, calculate g _i =g _i-1 ^r _i ;

If i=m, take w=g _m to complete the calculation, otherwise, the i-th device transmits g _i to the i+1-th device;

or,

The mth device calculates g _m =g _U ^r _m , and sends g _m to the m-1th device;

After the i-th device receives g _i+1 , i=m-1,...,1, calculate g _i =g _i+1 ^r _i ;

If i=1, take w=g ₁ to complete the calculation; otherwise, the i-th device transmits g _i to the i-1-th device.

For the above-mentioned SM9 digital signature collaborative generation method with the help of intermediate parameters, m devices can collaboratively calculate T=[r ₁ r ₂ …r _m ]P _U +[-F(z ₁ ,z ₂ ,…,z _m ) ] P _B ,

_A method of V=[F(z ₁ ,z ₂ ,…,z _m )]P _B +[-c ₁ c ₂ …c _m h]PA is as follows (T, V collaborative calculation method 1):

Calculate Q ₁ =[(r ₂ r ₃ …r _m ) ^-1 (a ₂ a ₃ …a _m )]P _B , Q ₂ =[(r ₃ …r _m ) ^-1 (a ₃ …a _m ) ] P _B ,..., Q _m-1 = [(r _m ) ^-1 a _m ] P _B , get Q _m = P _B ;

Calculate D ₁ =[(a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ]P _B , D ₂ =[(a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ] P _B ,..., D _m-1 = [a _m (c _m ) ^-1 ] P _B , take D _m = P _B ;

Among them, a _i is an integer randomly selected by the i-th device in [1,n-1] during the calculation process, i=2,...,m;

Take T ₀ =P _U , V _{0 =} [-h]PA;

Device No. 1 randomly selects an integer z ₁ in [1,n-1], calculates T ₁ =[r ₁ ]T ₀ +[-z ₁ ]Q ₁ , V ₁ =[z ₁ ]D ₁ +[ c ₁ ]V ₀ , transmit T ₁ and V ₁ to device No. 2;

After the i-th device receives T _i-1 and V _i-1 , i=2,...,m, if it is found that T _i-1 is zero, it will report an error, otherwise, in [1,n-1] Randomly select an integer z _i or take z _i =a _i , calculate T _i =[r _i ]T _i-1 +[-z _i ]Q _i , V _i =[z _i ]D _i +[ _ci ]V _i-1 ;

If i=m, take T=T _m , V=V _m , and complete the calculation of T and V; otherwise, the i-th device will transmit T _i and V _i to the i+1-th device until T _m and V are completed _m calculation;

(At this time T＝[r ₁ r ₂ ...r _m ]P _U +[-z ₁ a ₂ a ₃ ...am -z ₂ a ₃ ...a _m -...-z _{m -1} a _m -z _m ]P _B ,

V＝[z ₁ a ₂ a ₃ ...a _m +z ₂ a ₃ ...a _m +...+z _m-1 a _m +z _m ]P _B +[-(c ₁ c ₂ ...c _m )h]P _A )

If S=T+V is calculated by the m-th device after the calculation of T and V is completed, then the value of z _m is allowed to be an integer constant in 0 or [1, n-1] (certainly [1, n-1] Random integers inside are fine);

If P _A is not disclosed, it is kept as a secret by the No. 1 device (of course, if _PU = PA, then _PU is not disclosed, and it is also kept as a secret by the No. ₁ device), and _{P B ≠} PA, then c ₁ When it is non-secret (its value is 1 or other integers in [1, n-1]), the above-mentioned method for calculating T and V and the method for synergistic generation of SM9 digital signature with the help of intermediate parameters still hold true.

For the SM9 digital signature collaborative generation method with the help of intermediate parameters mentioned above, if P _{B =} PA, then m devices can collaboratively calculate T=[r ₁ r ₂ ...r _m ]P _U +[-F(z ₁ , z ₂ ,…,z _m )]P _B , one way of V=[F(z ₁ ,z ₂ ,…,z _m )]P _B +[-c ₁ c ₂ …c _m h]P _A is as follows (T, V cooperative calculation method 2):

Calculate Q ₁ =[(r ₂ r ₃ …r _m ) ^-1 (a ₂ a ₃ …a _m )]P _B , Q ₂ =[(r ₃ …r _m ) ^-1 (a ₃ …a _m ) ] P _B ,..., Q _m-1 = [(r _m ) ^-1 a _m ] P _B , get Q _m = P _B ;

Calculate d ₁ =((a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 )mod n, d ₂ =((a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ) mod n, ..., d _m-1 = (a _m (c _m ) ^-1 ) mod n, get d _m = 1;

Among them, a _i is an integer randomly selected by the i-th device in [1,n-1] during the calculation process, i=2,...,m;

Take T ₀ =P _U , v ₀ =-h;

Device No. 1 randomly selects an integer z ₁ in [1,n-1], calculates T ₁ =[r ₁ ]T ₀ +[-z ₁ ]Q ₁ , v ₁ =(z ₁ d ₁ +c ₁ v ₀ ) mod n, transmit T ₁ and v ₁ to device No. 2;

After the i-th device receives T _i-1 and v _i-1 , i=2,...,m, if the inspection finds that T _i-1 is zero, it will report an error, otherwise, in [1,n-1] Randomly select an integer z _i , calculate T _i =[r _i ]T _i-1 +[-z _i ]Q _i , v _i =(z _i d _i +c _i v _i-1 )mod n;

If i=m, then take T=T _m , (one of the m devices or other devices) calculate V=[v _m ]PA, and complete the calculation of _T and V; otherwise, the i-th device will T _i , v _i is sent to device i+1 until the calculation of T _m and v _m is completed;

(At this time T＝[r ₁ r ₂ ...r _m ]P _U +[-z ₁ a ₂ a ₃ ...am -z ₂ a ₃ ...a _m -...-z _{m -1} a _m -z _m ]P _B ,

V＝[z ₁ a ₂ a ₃ ...a _m +z ₂ a ₃ ...a _m +...+z _m-1 a _m +z _m ]P _B +[-(c ₁ c ₂ ...c _m )h]P _A )

If V=[v _m ]PA is calculated by the mth device, and S= _T +V is calculated by the mth device after the calculation of T and V is completed, then the value of z _m is allowed to be 0 or [1,n- Integer constants in 1] (of course, random integers in [1,n-1] are fine);

If P _A is not disclosed and kept as a secret by the m-th device (of course, P _B is also not disclosed), P _U ≠ P _A (that is, u and c ^-1 are mutually different), and the m-th device calculates V=[v _m ]P _A , then when c _m is taken as non-secret (its value is 1 or other integers in [1,n-1]), the method for calculating T and V mentioned above and the SM9 number with the help of intermediate parameters The signature cogeneration approach still holds.

For the SM9 digital signature collaborative generation method with the help of intermediate parameters mentioned above, if P _B =P _U , then m devices can cooperatively calculate T=[r ₁ r ₂ ...r _m ]P _U +[-F(z ₁ , z ₂ ,…,z _m )]P _B , one way of V=[F(z ₁ ,z ₂ ,…,z _m )]P _B +[-c ₁ c ₂ …c _m h]P _A is as follows (T, V cooperative calculation method 3):

Calculate q ₁ =((r ₂ r ₃ …r _m ) ^-1 (a ₂ a ₃ …a _m ))mod n, q ₂ =((r ₃ …r _m ) ^-1 (a ₃ …a _m ) ) mod n, ..., q _m-1 = ((r _m ) ^-1 a _m ) mod n, get q _m = 1;

Calculate D ₁ =[(a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ]P _B , D ₂ =[(a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ] P _B ,..., D _m-1 = [a _m (c _m ) ^-1 ] P _B , take D _m = P _B ;

Among them, a _i is an integer randomly selected by the i-th device in [1,n-1] during the calculation process, i=2,...,m;

Take t ₀ =1, V _{0 =} [-h]PA;

Device No. 1 randomly selects an integer z ₁ in [1,n-1], calculates t ₁ =(r ₁ t ₀ -z ₁ q ₁ )mod n, V ₁ =[z ₁ ]D ₁ +[c ₁ ] V ₀ , transmit t ₁ and V ₁ to the No. 2 device;

After the i-th device receives t _i-1 and V _i-1 , i=2,...,m, if it is found that t _i-1 is 0, it will report an error; otherwise, randomly Select an integer z _i , calculate t _i =(r _i t _i-1 -z _i q _i )mod n, V _i =[z _i ]D _i +[c _i ]V _i-1 ;

If i=m, then (one of the m devices or other devices) calculate T=[t _m ]P _B , take V=V _m to complete the calculation of T and V, otherwise, the i-th device will T _i and V _i are sent to device i+1 until the calculation of T _m and V _m is completed;

(At this time T＝[r ₁ r ₂ ...r _m ]P _U +[-z ₁ a ₂ a ₃ ...am -z ₂ a ₃ ...a _m -...-z _{m -1} a _m -z _m ]P _B ,

V＝[z ₁ a ₂ a ₃ ...a _m +z ₂ a ₃ ...a _m +...+z _m-1 a _m +z _m ]P _B +[-(c ₁ c ₂ ...c _m )h]P _A )

If T=[t _m ]P _B is calculated by the m-th device, and S=T+V is calculated by the m-th device after the calculation of T and V is completed, then the value of z _m is allowed to be 0 or [1,n- Integer constants in 1] (of course, random integers in [1,n-1] are fine);

If P _A is not disclosed and kept as a secret by the No. ₁ device, P _B ≠ PA ₍ that is, P _U ≠ PA, u and c ^-1 are different from each other), then when c ₁ is regarded as non-secret (its value is 1 or other integers in [1, n-1]), the above-mentioned method for calculating T and V and the method for synergistic generation of SM9 digital signature with the help of intermediate parameters still hold true.

For the SM9 digital signature collaborative generation method described above with the help of intermediate parameters, it is calculated that Q ₁ =[(r ₂ r ₃ ...r _m ) ^-1 (a ₂ a ₃ ... _am )]P _B , Q ₂ =[( r ₃ ... r _m ) ^-1 (a ₃ ... a _m )] P _B , ..., Q _m-1 = [(r _m ) ^-1 a _m ] P _B ,

and D ₁ =[(a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ] P _B , D ₂ =[(a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ] P _B ,..., D _m-1 = [a _m (c _m ) ^-1 ] The method of P _B includes the following schemes (not all possible schemes):

Option One:

The m-th device takes Q _m =P _B , D _m =P _B , randomly selects an integer a _m in [1,n-1], and calculates Q _m-1 =[(r _m ) ^{- 1} a _m ]Q _m , D _m-1 =[a _m (c _m ) ^-1 ]D _m , send Q _m-1 and D _m-1 to device m-1;

After device i receives Q _i and D _i , i=m-1,...,1, if i=1, device No. 1 temporarily reserves Q ₁ and D ₁ to complete Q ₁ , Q ₂ ,... , Q _m-1 and the calculation of D ₁ , D ₂ ,...,D _m-1 , otherwise, the i-th device randomly selects an integer a _i in [1,n-1], and calculates Q _i-1 = [ (r _i ) ^-1 a _i ]Q _i , D _i-1 ＝[a _i ( _ci ) ^-1 ]D _i , keep Q _i and D _i temporarily, and send Q _i-1 and D _i-1 For device i-1;

In the process of calculating Q ₁ , Q ₂ ,…,Q _m-1 and D ₁ , D ₂ ,…,D _m-1 , if the i-th device checks and finds that the received Q _i or D _i is zero, i=m-1,...,1, then report an error;

Option II:

m devices calculate and store Q ₁ , Q ₂ ,...,Q m-1 according to the method of scheme 1 for calculating Q ₁ , Q ₂ ,...,Q _m-1 and D ₁ , D ₂ ,...,D _{m -1} ;

The m-th device takes d _m =1, randomly selects an integer a _m in [1,n-1], calculates d _m-1 =(a _m (c _m ) ^-1 )d _m )mod n, and takes d _m-1 is sent to device m-1;

After the i-th device receives d _i , i=m-1,...,1, if i=1, then the first device calculates D ₁ =[d ₁ ]P _B , temporarily reserves D ₁ and completes D ₁ , D ₂ ,..., the calculation of D _m-1 , otherwise, the i-th device calculates D _i =[d _i ]P _B , randomly selects an integer a _i in [1,n-1], and calculates d _{i- 1} = (a _i (c _i ) ^-1 d _i ) mod n, temporarily retaining D _i , and sending d _i-1 to the i-1th device;

In the process of calculating Q ₁ , Q ₂ ,…,Q _m-1 and D ₁ , D ₂ ,…,D _m-1 , if the i-th device checks and finds that the received Q _i is zero or d _i is 0, i=m-1,...,1, then report an error;

third solution:

m devices calculate and save D ₁ , D ₂ ,..., D m _-1 according to the method of scheme 1 for calculating Q ₁ , Q ₂ ,...,Q _m-1 and D ₁ , D ₂ ,...,D _m-1 ;

The m-th device takes q _m =1, randomly selects an integer a _m in [1,n-1], calculates q _m-1 =((r _m ) ^-1 a _m q _m )modn, and converts q _{m- 1} sent to device m-1;

After the i-th device receives q _i , i=m-1,...,1, if i=1, then the No. 1 device calculates Q ₁ =[q ₁ ]P _B , reserves Q ₁ temporarily, and completes Q ₁ , Q ₂ ,..., the calculation of Q _m-1 , otherwise, the i-th device calculates Q _i =[q _i ]P _B , randomly selects an integer a _i in [1,n-1], and calculates q _{i- 1} = ((r _i ) ^-1 a _i q _i )mod n, temporarily reserve Q _i , and send q _i-1 to the i-1th device;

In the process of calculating q ₁ , q ₂ ,…,q _m-1 and D ₁ , D ₂ ,…,D _m-1 , if the i-th device checks and finds that the received q _i is 0 or D _i is zero element, i=m-1,...,1, an error will be reported.

For the SM9 digital signature collaborative generation method described above with the help of intermediate parameters, it is calculated that Q ₁ =[(r ₂ r ₃ ...r _m ) ^-1 (a ₂ a ₃ ... _am )]P _B , Q ₂ =[( r ₃ ... r _m ) ^-1 (a ₃ ... a _m )] P _B , ..., Q _m-1 = [(r _m ) ^-1 a _m ] P _B ,

and d ₁ =((a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ) mod n, d ₂ =((a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ) One way mod n,...,d _m-1 = (a _m (c _m ) ^-1 ) mod n is as follows:

The mth device takes Q _m =P _B , d _m =1, randomly selects an integer a _m in [1,n-1], and calculates Q _m-1 =[(r _m ) ^{- 1} a _m ]Q _m , d _m-1 ＝(a _m (c _m ) ^-1 )d _m )mod n, send Q _m-1 and d _m-1 to device m-1;

After the i-th device receives Q _i and d _i , i=m-1,...,1, if i=1, then the No. 1 device temporarily reserves Q ₁ and d ₁ to complete Q ₁ , Q ₂ ,... , the calculation of Q _m-1 and d ₁ , d ₂ ,...,d _m-1 , otherwise, the i-th device randomly selects an integer a _i in [1,n-1], and calculates Q _i-1 = [ (r _i ) ^-1 a _i ]Q _i , d _i-1 = (a _i ( _ci ) ^-1 d _i )mod n, keep Q _i and d _i temporarily, set Q _i-1 , d _{i- 1} is transmitted to the i-1th device;

In the process of calculating Q ₁ , Q ₂ ,…,Q _m-1 and d ₁ ,d ₂ ,…,d _m-1 , if the i-th device checks and finds that the received Q _i is zero or d _i is 0, i=m-1,...,1, then an error will be reported.

For the SM9 digital signature collaborative generation method described above with the help of intermediate parameters, the calculated q ₁ =((r ₂ r ₃ ...r _m ) ^-1 (a ₂ a ₃ ...a _m ))mod n, q ₂ =(( r ₃ ... r _m ) ^-1 (a ₃ ... a _m )) mod n, ..., q _{m - 1} = ((r _m ) ^-1 a _m ) mod n,

and D ₁ =[(a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ] P _B , D ₂ =[(a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ] One method of P _B ,...,D _m-1 =[a _m (c _m ) ^-1 ]P _B is as follows:

The m-th device takes q _m =1, D _m =P _B , randomly selects an integer a _m in [1,n-1], and calculates q _m-1 =((r _m ) ^{- 1} a _m q _m ) mod n, D _m-1 =[a _m (c _m ) ^-1 ]D _m , send q _m-1 and D _m-1 to device m-1;

After the i-th device receives q _i , D _i , i=m-1,...,1, if i=1, then the No. 1 device temporarily reserves q ₁ and D ₁ to complete q ₁ , q ₂ ,... , q _m-1 and the calculation of D ₁ , D ₂ ,...,D _m-1 , otherwise, the i-th device randomly selects an integer a _i in [1,n-1], and calculates q _i-1 =( (r _i ) ^-1 a _i q _i )mod n, D _i-1 = [a _i ( _ci ) ^-1 ]D _i , keep q _i and D _i temporarily, and set q _i-1 , D _{i- 1} is transmitted to the i-1th device;

In the process of calculating q ₁ , q ₂ ,…,q _m-1 and D ₁ , D ₂ ,…,D _m-1 , if the i-th device checks and finds that the received q _i is 0 or D _i is zero element, i=m-1,...,1, an error will be reported.

On the basis of the above-mentioned SM9 digital signature collaborative generation method with the help of intermediate parameters, an SM9 digital signature collaborative generation system can be constructed, and the system includes m devices that are respectively labeled No. 1, No. 2, ..., to No. m, m≥2; the i-th device saves the integer secret c _i in the interval [1,n-1], i=1,...,m; when it is necessary to use the user's SM9 identification private key d _A to digitally sign the message M When , m devices generate a digital signature for message M according to the SM9 digital signature collaborative generation method using intermediate parameters.

As can be seen from the above description, based on the method and system of the present invention, when it is necessary to use the user identification private key d _A to digitally sign a message, multiple devices can generate a digital signature for the message through interaction and collaboration. The intermediate parameters z ₁ ,..., z _m and a ₂ ,..., a _m are introduced, so that the collaboratively generated digital signature has a product r parameter, thus having higher security.

Detailed ways

The present invention will be further described below in conjunction with embodiment. The following embodiments are only several possible embodiments of the present invention, and do not represent all possible embodiments, and are not intended to limit the present invention.

Embodiment 1,

In this embodiment, there are two devices labeled No. 1 and No. 2. The No. 1 device saves the integer secret c ₁ in the interval [1,n-1], and the No. 2 device saves the integer secret c 1 in the interval [1,n- 1] Integer secret c ₂ in the interval, where n is the order of groups G ₁ , G ₂ , G _T in the SM9 cryptographic algorithm (a prime number);

(initialization phase) precomputed with:

P _A =[c ^-1 ]d _A , where d _A is the user's SM9 identification private key, c ^-1 is the modulo n multiplicative inverse of c, c=(c ₁ c ₂ )mod n is that neither device has saved the integer secret of

PU = [ _u ]d _A , where u is an integer secret in the interval [1,n-1] that is not kept by either device;

u and c ^-1 do not have to be different from each other (they are different or the same);

g _U ＝g ^ u, wherein ^ is exponentiation (exponentiation is carried out to the element in front of ^, and the number of times of exponentiation is behind ^), g=e(P ₁ , P _pub ), P ₁ is the generation in G ₁ element, P _pub is the main public key (that is, P _pub =[s]P ₂ , s is the main private key or master key, and P ₂ is the generating element in G ₂ , see SM9 specification);

Select a non-zero element P _B other than the user private key d _A in the group G ₁ (fixed selection, such as fixed selection P _B = P ₁ , or subjective arbitrary selection, or random selection, for example, in [1,n -1] randomly select an integer b, calculate P _B =[b]P ₁ or P _B =[b]d _A );

Neither device saves d _A ;

When it is necessary to use the user's SM9 identification private key d _A to digitally sign the message M, the two devices obtain w=g _U ^(r ₁ r ₂ ) through interactive calculation, where r ₁ is the number 1 device in the calculation process. An integer randomly selected in the interval [1, n-1], r ₂ is an integer randomly selected by the No. 2 device in the interval [1, n-1] during the calculation process;

Then, (one of the two devices or the other) computes h=H ₂ (M||w,n), where H ₂ is the hash function specified in SM9 and M||w represents the word M and w String merge, n is the order of G ₁ , G ₂ , G _T ;

(one of the two devices or other devices) check whether w is equal to g^h, if w=g^h, then the two devices recalculate w until w≠g^h;

Afterwards, the two devices are calculated according to the aforementioned T and V cooperative calculation method 1

T＝[r ₁ r ₂ ]P _U +[-F(z ₁ ,z ₂ )]P _B ，V＝[F(z ₁ ,z ₂ )]P _B +[-c ₁ c ₂ h]P _A ,which is:

Calculate Q ₁ =[(r ₂ ) ^-1 a ₂ ]P _B , take Q ₂ =P _B ;

Calculate D ₁ =[a ₂ (c ₂ ) ^-1 ]P _B , take D ₂ =P _B ;

Among them, a ₂ is an integer randomly selected by the No. 2 device in [1,n-1] during the calculation process;

Take T ₀ =P _U , V _{0 =} [-h]PA;

Device No. 1 randomly selects an integer z ₁ in [1,n-1], calculates T ₁ =[r ₁ ]T ₀ +[-z ₁ ]Q ₁ , V ₁ =[z ₁ ]D ₁ +[ c ₁ ]V ₀ , transmit T ₁ and V ₁ to device No. 2;

After the No. 2 device receives T ₁ and V ₁ , if it finds that T ₁ is zero, it reports an error; otherwise, randomly selects an integer z ₂ in [1,n-1] or takes z ₂ =a ₂ , Calculate T ₂ =[r ₂ ]T ₁ +[-z ₂ ]Q ₂ , V ₂ =[z ₂ ]D ₂ +[c ₂ ]V ₁ ;

Take T=T ₂ , V=V ₂ ;

(At this time T=[r ₁ r ₂ ]P _U +[-z ₁ a ₂ -z ₂ ]P _B , V=[z ₁ a ₂ +z ₂ ]P _B +[-(c ₁ c ₂ )h ]P _A )

Finally, (one of the two devices or the other) computes S=T+V, then (h, S) is the digital signature for message M.

(At this time S=[r ₁ r ₂ ]P _U +[-c ₁ c ₂ h]P _A ＝[(r ₁ r ₂ )uh]d _A )

If S=T+V is calculated by No. ₂ device after completing T and V calculation, then the value of z2 in the T and V calculation process is allowed to be 0 or an integer constant in [1, n-1] (certainly [ 1,n-1] is also fine).

Embodiment 2,

The difference between embodiment 2 and embodiment 1 is that c ₁ is non-secret, and its value is 1 or other integers in [1, n-1] (other subjectively or randomly selected in [1, n-1] Integer), P _A is not disclosed and stored as a secret by the No. 1 device (of course, if _PU = PA, then _PU is not disclosed, and is also kept as a secret by the No. ₁ device), and _{P B ≠} PA, other constant.

Embodiment 3,

In this embodiment, there are m devices respectively labeled No. 1, No. 2, ..., to No. m devices, m≥2, and the device No. i stores an integer secret c in the interval [1, n-1] _i , i=1,...,m, where n is the order of groups G ₁ , G ₂ , G _T in the SM9 cryptographic algorithm (it is a prime number);

(initialization phase) precomputed with:

P _A =[c ^-1 ]d _A , where d _A is the user's SM9 identification private key, c ^-1 is the modulo n multiplicative inverse of c, c=(c ₁ c ₂ ...c _m )modn is the number of m devices no integer secrets saved;

P _U =[u]d _A , where u is an integer secret in the interval [1,n-1] that is not saved by m devices;

u and c ^-1 do not have to be different from each other (they are different or the same);

g _U ＝g ^ u, wherein ^ is exponentiation (exponentiation is carried out to the element in front of ^, and the number of times of exponentiation is behind ^), g=e(P ₁ , P _pub ), P ₁ is the generation in G ₁ element, P _pub is the main public key (that is, P _pub =[s]P ₂ , s is the main private key or master key, and P ₂ is the generating element in G ₂ , see SM9 specification);

Select a non-zero element P _B other than the user private key d _A in the group G ₁ (fixed selection, such as fixed selection P _B = P ₁ , or subjective arbitrary selection, or random selection, for example, in [1,n -1] randomly select an integer b, calculate P _B =[b]P ₁ or P _B =[b]d _A );

m devices do not save d _A ;

When it is necessary to use the user's SM9 identification private key d _A to digitally sign a message M, m devices first obtain w=g _U ^(r ₁ r ₂ …r _m ) through interactive calculations, where r _i is the first An integer randomly selected by device i in the interval [1,n-1], i=1,...,m;

Then, (one of the m devices or other devices) calculates h = H ₂ (M||w,n), where H ₂ is the hash function specified in SM9 and M||w represents the word M and w String merge, n is the order of G ₁ , G ₂ , G _T ;

(one of the m devices or other devices) check whether w is equal to g^h, if w=g^h, then m devices recalculate w until w≠g^h;

Afterwards, the m devices are calculated according to the aforementioned T and V cooperative calculation method 1

T＝[r ₁ r ₂ …r _m ]P _U +[-F(z ₁ ,z ₂ ,…,z _m )]P _B ，

V=[F(z ₁ ,z ₂ ,…,z _m )]P _B +[-c ₁ c ₂ …c _m h]P _A , that is:

Calculate Q ₁ =[(r ₂ r ₃ …r _m ) ^-1 (a ₂ a ₃ …a _m )]P _B , Q ₂ =[(r ₃ …r _m ) ^-1 (a ₃ …a _m ) ] P _B ,..., Q _m-1 = [(r _m ) ^-1 a _m ] P _B , get Q _m = P _B ;

Calculate D ₁ =[(a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ]P _B , D ₂ =[(a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ] P _B ,..., D _m-1 = [a _m (c _m ) ^-1 ] P _B , take D _m = P _B ;

Among them, a _i is an integer randomly selected by the i-th device in [1,n-1] during the calculation process, i=2,...,m;

Take T ₀ =P _U , V _{0 =} [-h]PA;

Device No. 1 randomly selects an integer z ₁ in [1,n-1], calculates T ₁ =[r ₁ ]T ₀ +[-z ₁ ]Q ₁ , V ₁ =[z ₁ ]D ₁ +[ c ₁ ]V ₀ , transmit T ₁ and V ₁ to device No. 2;

After the i-th device receives T _i-1 and V _i-1 , i=2,...,m, if it is found that T _i-1 is zero, it will report an error, otherwise, in [1,n-1] Randomly select an integer z _i or take z _i =a _i , calculate T _i =[r _i ]T _i-1 +[-z _i ]Q _i , V _i =[z _i ]D _i +[ _ci ]V _i-1 ;

If i=m, take T=T _m , V=V _m , and complete the calculation of T and V; otherwise, the i-th device will transmit T _i and V _i to the i+1-th device until T _m and V are completed _m calculation;

(At this time T＝[r ₁ r ₂ ...r _m ]P _U +[-z ₁ a ₂ a ₃ ...am -z ₂ a ₃ ...a _m -...-z _{m -1} a _m -z _m ]P _B ,

V＝[z ₁ a ₂ a ₃ ...a _m +z ₂ a ₃ ...a _m +...+z _m-1 a _m +z _m ]P _B +[-(c ₁ c ₂ ...c _m )h]P _A )

Finally, (one of the m devices or other devices) calculates S=T+V, then (h, S) is the digital signature for the message M.

(At this time S＝[r ₁ r ₂ …r _m ]P _U +[-c ₁ c ₂ …c _m h]P _A ＝[(r ₁ r ₂ …r _m )uh]d _A )

If S=T+V is calculated by the mth device after the calculation of T and V is completed, the value of z _m during the calculation of T and V is allowed to be 0 or an integer constant in [1, n-1] (of course, it is random Integers are fine too).

Embodiment 4,

The difference between embodiment 4 and embodiment 3 is that c ₁ is non-secret, and its value is 1 or other integers in [1, n-1] (other subjectively or randomly selected in [1, n-1] Integer), P _A is not disclosed and stored as a secret by the No. 1 device (of course, if _PU = PA, then _PU is not disclosed, and is also kept as a secret by the No. ₁ device), and _{P B ≠} PA, other constant.

Embodiment 5,

In this embodiment, there are two devices labeled No. 1 and No. 2. The No. 1 device saves the integer secret c ₁ in the interval [1,n-1], and the No. 2 device saves the integer secret c 1 in the interval [1,n- 1] Integer secret c ₂ in the interval, where n is the order of groups G ₁ , G ₂ , G _T in the SM9 cryptographic algorithm (a prime number);

(initialization phase) precomputed with:

P _A =[c ^-1 ]d _A , where d _A is the user's SM9 identification private key, c ^-1 is the modulo n multiplicative inverse of c, c=(c ₁ c ₂ )mod n is that neither device has saved the integer secret of

PU = [ _u ]d _A , where u is an integer secret in the interval [1,n-1] that is not kept by either device;

u and c ^-1 do not have to be different from each other (they are different or the same);

g _U ＝g ^ u, wherein ^ is exponentiation (exponentiation is carried out to the element in front of ^, and the number of times of exponentiation is behind ^), g=e(P ₁ , P _pub ), P ₁ is the generation in G ₁ element, P _pub is the main public key (that is, P _pub =[s]P ₂ , s is the main private key or master key, and P ₂ is the generating element in G ₂ , see SM9 specification);

Take P _B = P _A ;

Neither device saves d _A ;

When it is necessary to use the user's SM9 identification private key d _A to digitally sign the message M, the two devices obtain w=g _U ^(r ₁ r ₂ ) through interactive calculation, where r ₁ is the number 1 device in the calculation process. An integer randomly selected in the interval [1, n-1], r ₂ is an integer randomly selected by the No. 2 device in the interval [1, n-1] during the calculation process;

Then, (one of the two devices or the other) computes h=H ₂ (M||w,n), where H ₂ is the hash function specified in SM9 and M||w represents the word M and w String merge, n is the order of G ₁ , G ₂ , G _T ;

(one of the two devices or other devices) check whether w is equal to g^h, if w=g^h, then the two devices recalculate w until w≠g^h;

Afterwards, the two devices are calculated according to the aforementioned T and V cooperative calculation method 2

T＝[r ₁ r ₂ ]P _U +[-F(z ₁ ,z ₂ )]P _B ，V＝[F(z ₁ ,z ₂ )]P _B +[-c ₁ c ₂ h]P _A ,which is:

Calculate Q ₁ =[(r ₂ ) ^-1 a ₂ ]P _B , take Q ₂ =P _B ;

Calculate d ₁ =(a ₂ (c ₂ ) ^-1 )mod n, take d ₂ =1;

Among them, a ₂ is an integer randomly selected by the No. 2 device in [1,n-1] during the calculation process;

Take T ₀ =P _U , v ₀ =-h;

Device No. 1 randomly selects an integer z ₁ in [1,n-1], calculates T ₁ =[r ₁ ]T ₀ +[-z ₁ ]Q ₁ , v ₁ =(z ₁ d ₁ +c ₁ v ₀ ) mod n, transmit T ₁ and v ₁ to device No. 2;

After the No. 2 device receives T ₁ and v ₁ , if it finds that T ₁ is zero, it reports an error; otherwise, randomly selects an integer z ₂ in [1,n-1], and calculates T ₂ =[r ₂ ]T ₁ +[-z ₂ ]Q ₂ , v ₂ =(z ₂ d ₂ +c ₂ v ₁ ) mod n;

Take T=T ₂ , (one of the two devices or other devices) calculate V=[v ₂ ]PA to complete the calculation of _T and V;

(At this time T=[r ₁ r ₂ ]P _U +[-z ₁ a ₂ -z ₂ ]P _B , V=[z ₁ a ₂ +z ₂ ]P _B +[-(c ₁ c ₂ )h ]P _A )

Finally, (one of the two devices or the other) computes S=T+V, then (h, S) is the digital signature for message M.

(At this time S=[r ₁ r ₂ ]P _U +[-c ₁ c ₂ h]P _A ＝[(r ₁ r ₂ )uh]d _A )

If V=[v ₂ ]PA is calculated by the No. 2 device, and S= _T +V is calculated by the No. 2 device after the calculation of T and V is completed, then the value of z ₂ during the calculation of T and V is allowed to be 0 Or an integer constant in [1,n-1] (of course a random integer in [1,n-1] is also fine).

Embodiment 6,

The difference between Example 6 and Example 5 is that c ₂ is non-secret, and its value is 1 or other integers in [1, n-1] (other subjective arbitrary or randomly selected integers in [1, n-1] ), P _U ≠ P _A (i.e. u and c ^-1 are mutually different), P _A is not disclosed and kept as a secret by No. 2 device (of course P _B is not disclosed), and V=[v ₂ ]P _A , the others remain unchanged.

Embodiment 7,

In this embodiment, there are m devices respectively labeled No. 1, No. 2, ..., to No. m devices, m≥2, and the device No. i stores an integer secret c in the interval [1, n-1] _i , i=1,...,m, where n is the order of groups G ₁ , G ₂ , G _T in the SM9 cryptographic algorithm (it is a prime number);

(initialization phase) precomputed with:

P _A =[c ^-1 ]d _A , where d _A is the user's SM9 identification private key, c ^-1 is the modulo n multiplicative inverse of c, c=(c ₁ c ₂ ...c _m )modn is the number of m devices no integer secrets saved;

P _U =[u]d _A , where u is an integer secret in the interval [1,n-1] that is not saved by m devices;

u and c ^-1 do not have to be different from each other (they are different or the same);

g _U ＝g ^ u, wherein ^ is exponentiation (exponentiation is carried out to the element in front of ^, and the number of times of exponentiation is behind ^), g=e(P ₁ , P _pub ), P ₁ is the generation in G ₁ element, P _pub is the main public key (that is, P _pub =[s]P ₂ , s is the main private key or master key, and P ₂ is the generating element in G ₂ , see SM9 specification);

Take P _B = P _A ;

m devices do not save d _A ;

When it is necessary to use the user's SM9 identification private key d _A to digitally sign a message M, m devices first obtain w=g _U ^(r ₁ r ₂ …r _m ) through interactive calculations, where r _i is the first An integer randomly selected by device i in the interval [1,n-1], i=1,...,m;

Then, (one of the m devices or other devices) calculates h = H ₂ (M||w,n), where H ₂ is the hash function specified in SM9 and M||w represents the word M and w String merge, n is the order of G ₁ , G ₂ , G _T ;

(one of the m devices or other devices) check whether w is equal to g^h, if w=g^h, then m devices recalculate w until w≠g^h;

Afterwards, the m devices are calculated according to the aforementioned T and V cooperative calculation method 2

T＝[r ₁ r ₂ …r _m ]P _U +[-F(z ₁ ,z ₂ ,…,z _m )]P _B ，

V=[F(z ₁ ,z ₂ ,…,z _m )]P _B +[-c ₁ c ₂ …c _m h]P _A , that is:

Calculate Q ₁ =[(r ₂ r ₃ …r _m ) ^-1 (a ₂ a ₃ …a _m )]P _B , Q ₂ =[(r ₃ …r _m ) ^-1 (a ₃ …a _m ) ] P _B ,..., Q _m-1 = [(r _m ) ^-1 a _m ] P _B , get Q _m = P _B ;

Calculate d ₁ =((a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 )mod n, d ₂ =((a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ) mod n, ..., d _m-1 = (a _m (c _m ) ^-1 ) mod n, get d _m = 1;

Among them, a _i is an integer randomly selected by the i-th device in [1,n-1] during the calculation process, i=2,...,m;

Take T ₀ =P _U , v ₀ =-h;

Device No. 1 randomly selects an integer z ₁ in [1,n-1], calculates T ₁ =[r ₁ ]T ₀ +[-z ₁ ]Q ₁ , v ₁ =(z ₁ d ₁ +c ₁ v ₀ ) mod n, transmit T ₁ and v ₁ to device No. 2;

After the i-th device receives T _i-1 and v _i-1 , i=2,...,m, if the inspection finds that T _i-1 is zero, it will report an error, otherwise, in [1,n-1] Randomly select an integer z _i , calculate T _i =[r _i ]T _i-1 +[-z _i ]Q _i , v _i =(z _i d _i +c _i v _i-1 )mod n;

If i=m, then take T=T _m , (one of the m devices or other devices) calculate V=[v _m ]PA, and complete the calculation of _T and V; otherwise, the i-th device will T _i , v _i is sent to device i+1 until the calculation of T _m and v _m is completed;

(At this time T＝[r ₁ r ₂ ...r _m ]P _U +[-z ₁ a ₂ a ₃ ...am -z ₂ a ₃ ...a _m -...-z _{m -1} a _m -z _m ]P _B ,

V＝[z ₁ a ₂ a ₃ ...a _m +z ₂ a ₃ ...a _m +...+z _m-1 a _m +z _m ]P _B +[-(c ₁ c ₂ ...c _m )h]P _A )

Finally, (one of the m devices or other devices) calculates S=T+V, then (h, S) is the digital signature for the message M.

(At this time S＝[r ₁ r ₂ …r _m ]P _U +[-c ₁ c ₂ …c _m h]P _A ＝[(r ₁ r ₂ …r _m )uh]d _A )

If V=[v _m ]PA is calculated by the mth device, and S= _T +V is calculated by the mth device after the calculation of T and V is completed, then the value of z _m during the calculation of T and V is allowed to be 0 Or an integer constant in [1,n-1] (of course a random integer in [1,n-1] is also fine).

Embodiment 8,

The difference between Example 8 and Example 7 is that c _m is non-secret, and its value is 1 or other integers in [1, n-1] (other subjective arbitrary or randomly selected integers in [1, n-1] ), P _U ≠ P _A (i.e. u and c ^-1 are different), P _A is not disclosed and kept as a secret by the m-th device (of course P _B is not disclosed), and the m-th device calculates V=[v _m ]P _A , the others remain unchanged.

Embodiment 9,

In this embodiment, there are two devices labeled No. 1 and No. 2. The No. 1 device saves the integer secret c ₁ in the interval [1,n-1], and the No. 2 device saves the integer secret c 1 in the interval [1,n- 1] Integer secret c ₂ in the interval, where n is the order of groups G ₁ , G ₂ , G _T in the SM9 cryptographic algorithm (a prime number);

(initialization phase) precomputed with:

P _A =[c ^-1 ]d _A , where d _A is the user's SM9 identification private key, c ^-1 is the modulo n multiplicative inverse of c, c=(c ₁ c ₂ )mod n is that neither device has saved the integer secret of

PU = [ _u ]d _A , where u is an integer secret in the interval [1,n-1] that is not kept by either device;

u and c ^-1 do not have to be different from each other (they are different or the same);

g _U ＝g ^ u, wherein ^ is exponentiation (exponentiation is carried out to the element in front of ^, and the number of times of exponentiation is behind ^), g=e(P ₁ , P _pub ), P ₁ is the generation in G ₁ element, P _pub is the main public key (that is, P _pub =[s]P ₂ , s is the main private key or master key, and P ₂ is the generating element in G ₂ , see SM9 specification);

Take P _B =P _U ;

Neither device saves d _A ;

When it is necessary to use the user's SM9 identification private key d _A to digitally sign the message M, the two devices obtain w=g _U ^(r ₁ r ₂ ) through interactive calculation, where r ₁ is the number 1 device in the calculation process. An integer randomly selected in the interval [1, n-1], r ₂ is an integer randomly selected by the No. 2 device in the interval [1, n-1] during the calculation process;

Then, (one of the two devices or the other) computes h=H ₂ (M||w,n), where H ₂ is the hash function specified in SM9 and M||w represents the word M and w String merge, n is the order of G ₁ , G ₂ , G _T ;

(one of the two devices or other devices) check whether w is equal to g^h, if w=g^h, then the two devices recalculate w until w≠g^h;

Afterwards, the two devices are calculated according to the aforementioned T and V cooperative calculation method 3

T＝[r ₁ r ₂ ]P _U +[-F(z ₁ ,z ₂ )]P _B ，V＝[F(z ₁ ,z ₂ )]P _B +[-c ₁ c ₂ h]P _A ,which is:

Calculate q ₁ =((r ₂ ) ^-1 a ₂ )mod n, take q ₂ =1;

Calculate D ₁ =[a ₂ (c ₂ ) ^-1 ]P _B , take D ₂ =P _B ;

Among them, a ₂ is an integer randomly selected by the No. 2 device in [1,n-1] during the calculation process, i=2,...,m;

Take t ₀ =1, V _{0 =} [-h]PA;

Device No. 1 randomly selects an integer z ₁ in [1,n-1], calculates t ₁ =(r ₁ t ₀ -z ₁ q ₁ )mod n, V ₁ =[z ₁ ]D ₁ +[c ₁ ] V ₀ , transmit t ₁ and V ₁ to the No. 2 device;

After the No. 2 device receives t ₁ and V ₁ , if it finds that t ₁ is 0, it reports an error; otherwise, randomly selects an integer z ₂ in [1,n-1], and calculates t ₂ =(r ₂ t ₁ -z ₂ q ₂ ) mod n, V ₂ =[z ₂ ]D ₂ +[c ₂ ]V ₁ ;

(one of the two devices or other devices) calculate T=[t ₂ ]P _B , take V=V ₂ ;

(At this time T=[r ₁ r ₂ ]P _U +[-z ₁ a ₂ -z ₂ ]P _B , V=[z ₁ a ₂ +z ₂ ]P _B +[-(c ₁ c ₂ )h ]P _A )

Finally, (one of the two devices or the other) computes S=T+V, then (h, S) is the digital signature for message M.

(At this time S=[r ₁ r ₂ ]P _U +[-c ₁ c ₂ h]P _A ＝[(r ₁ r ₂ )uh]d _A )

If T=[t ₂ ]P _B is calculated by the No. 2 device, and S=T+V is calculated by the No. 2 device after the calculation of T and V is completed, then the value of z ₂ is allowed to be 0 during the calculation of T and V Or an integer constant in [1,n-1] (of course a random integer in [1,n-1] is also fine).

Embodiment 10,

The difference between Example 10 and Example 9 is that c ₁ is non-secret, and its value is 1 or other integers in [1, n-1] (other subjective arbitrary or randomly selected integers in [1, n-1] ), P _B ≠ PA ₍ that is, _PU ≠ PA, _u and c ^-1 are different from each other), PA is not disclosed and kept as _a secret by No. 1 device, and the others remain unchanged.

Embodiment 11,

In this embodiment, there are m devices respectively labeled No. 1, No. 2, ..., to No. m devices, m≥2, and the device No. i stores an integer secret c in the interval [1, n-1] _i , i=1,...,m, where n is the order of groups G ₁ , G ₂ , G _T in the SM9 cryptographic algorithm (it is a prime number);

(initialization phase) precomputed with:

P _A =[c ^-1 ]d _A , where d _A is the user's SM9 identification private key, c ^-1 is the modulo n multiplicative inverse of c, c=(c ₁ c ₂ ...c _m )modn is the number of m devices no integer secrets saved;

P _U =[u]d _A , where u is an integer secret in the interval [1,n-1] that is not saved by m devices;

u and c ^-1 do not have to be different from each other (they are different or the same);

g _U ＝g ^ u, wherein ^ is exponentiation (exponentiation is carried out to the element in front of ^, and the number of times of exponentiation is behind ^), g=e(P ₁ , P _pub ), P ₁ is the generation in G ₁ element, P _pub is the main public key (that is, P _pub =[s]P ₂ , s is the main private key or master key, and P ₂ is the generating element in G ₂ , see SM9 specification);

Take P _B =P _U ;

m devices do not save d _A ;

When it is necessary to use the user's SM9 identification private key d _A to digitally sign a message M, m devices first obtain w=g _U ^(r ₁ r ₂ …r _m ) through interactive calculations, where r _i is the first An integer randomly selected by device i in the interval [1,n-1], i=1,...,m;

Then, (one of the m devices or other devices) calculates h = H ₂ (M||w,n), where H ₂ is the hash function specified in SM9 and M||w represents the word M and w String merge, n is the order of G ₁ , G ₂ , G _T ;

(one of the m devices or other devices) check whether w is equal to g^h, if w=g^h, then m devices recalculate w until w≠g^h;

Afterwards, the m devices are calculated according to the aforementioned T and V cooperative calculation method 3

T＝[r ₁ r ₂ …r _m ]P _U +[-F(z ₁ ,z ₂ ,…,z _m )]P _B ，

V=[F(z ₁ ,z ₂ ,…,z _m )]P _B +[-c ₁ c ₂ …c _m h]P _A , that is:

Calculate q ₁ =((r ₂ r ₃ …r _m ) ^-1 (a ₂ a ₃ …a _m ))mod n, q ₂ =((r ₃ …r _m ) ^-1 (a ₃ …a _m ) ) mod n, ..., q _m-1 = ((r _m ) ^-1 a _m ) mod n, get q _m = 1;

Calculate D ₁ =[(a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ]P _B , D ₂ =[(a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ] P _B ,..., D _m-1 = [a _m (c _m ) ^-1 ] P _B , take D _m = P _B ;

Among them, a _i is an integer randomly selected by the i-th device in [1,n-1] during the calculation process, i=2,...,m;

Take t ₀ =1, V _{0 =} [-h]PA;

Device No. 1 randomly selects an integer z ₁ in [1,n-1], calculates t ₁ =(r ₁ t ₀ -z ₁ q ₁ )mod n, V ₁ =[z ₁ ]D ₁ +[c ₁ ] V ₀ , transmit t ₁ and V ₁ to the No. 2 device;

After the i-th device receives t _i-1 and V _i-1 , i=2,...,m, if it is found that t _i-1 is 0, it will report an error; otherwise, randomly Select an integer z _i , calculate t _i =(r _i t _i-1 -z _i q _i )mod n, V _i =[z _i ]D _i +[c _i ]V _i-1 ;

If i=m, then (one of the m devices or other devices) calculate T=[t _m ]P _B , take V=V _m to complete the calculation of T and V, otherwise, the i-th device will T _i and V _i are sent to device i+1 until the calculation of T _m and V _m is completed;

(At this time T＝[r ₁ r ₂ ...r _m ]P _U +[-z ₁ a ₂ a ₃ ...am -z ₂ a ₃ ...a _m -...-z _{m -1} a _m -z _m ]P _B ,

V＝[z ₁ a ₂ a ₃ ...a _m +z ₂ a ₃ ...a _m +...+z _m-1 a _m +z _m ]P _B +[-(c ₁ c ₂ ...c _m )h]P _A )

Finally, (one of the m devices or other devices) calculates S=T+V, then (h, S) is the digital signature for the message M.

(At this time S＝[r ₁ r ₂ …r _m ]P _U +[-c ₁ c ₂ …c _m h]P _A ＝[(r ₁ r ₂ …r _m )uh]d _A )

If T=[t _m ]P _B is calculated by the m-th device, and S=T+V is calculated by the m-th device after the calculation of T and V is completed, then the value of z _m during the calculation of T and V is allowed to be 0 Or an integer constant in [1,n-1] (of course a random integer in [1,n-1] is also fine).

Embodiment 12,

The difference between Example 12 and Example 11 is that c ₁ is non-secret, and its value is 1 or other integers in [1, n-1] (other subjectively or randomly selected integers in [1, n-1] ), P _B ≠ PA ₍ that is, _PU ≠ PA, _u and c ^-1 are different from each other), PA is not disclosed and kept as _a secret by No. 1 device, and the others remain unchanged.

In each of the above embodiments 1-12, if it is not checked whether w and g^h are equal during the calculation process, after the calculation of S, if the check finds that S is zero, then the m devices perform collaborative calculations again until S is not zero.

In the above embodiments 1-12, the methods for m devices to calculate w=g _U ^(r ₁ r ₂ ...r _m ) include (not all possible ways):

The No. 1 device calculates g ₁ =g _U ^r ₁ , and sends g ₁ to the No. 2 device;

After the i-th device receives g _i-1 , i=2,...,m, calculate g _i =g _i-1 ^r _i ;

If i=m, take w=g _m to complete the calculation, otherwise, the i-th device transmits g _i to the i+1-th device;

or,

The mth device calculates g _m =g _U ^r _m , and sends g _m to the m-1th device;

After the i-th device receives g _i+1 , i=m-1,...,1, calculate g _i =g _i+1 ^r _i ;

If i=1, take w=g ₁ to complete the calculation; otherwise, the i-th device transmits g _i to the i-1-th device.

For the above embodiments 1-4, the m devices can be calculated according to the foregoing

Q ₁ =[(r ₂ r ₃ ...r _m ) ^-1 (a ₂ a ₃ ...a _m )]P _B , Q ₂ =[(r ₃ ...r _m ) ^-1 (a ₃ ...a _m )]P _B , ..., Q _m-1 = [(r _m ) ^-1 a _m ] P _B ,

and D ₁ =[(a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ] P _B , D ₂ =[(a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ] P _B , ..., D _m-1 = [a _m (c _m ) ^-1 ] One of the three schemes of P _B calculates Q ₁ , Q ₂ , ..., Q _m-1 , and D ₁ , D ₂ , ..., D _m-1 .

For the above embodiments 5-8, the m devices can be calculated according to the foregoing

Q ₁ =[(r ₂ r ₃ ...r _m ) ^-1 (a ₂ a ₃ ...a _m )]P _B , Q ₂ =[(r ₃ ...r _m ) ^-1 (a ₃ ...a _m )]P _B , ..., Q _m-1 = [(r _m ) ^-1 a _m ] P _B ,

and d ₁ =((a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ) mod n, d ₂ =((a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ) Mod n,...,d _m-1 = ( _{am (c m )} ^-1 ) mod n method to calculate Q ₁ , Q ₂ ,..., Q _m-1 , and d ₁ , d ₂ ,..., d _{m -1} .

For the above embodiments 1-12, the m devices can be calculated according to the foregoing

q ₁ =((r ₂ r ₃ ...r _m ) ^-1 (a ₂ a ₃ ...a _m ))mod n, q ₂ =((r ₃ ...r _m ) ^-1 (a ₃ ...a _m ))mod n, ..., q _m-1 = ((r _m ) ^-1 a _m ) mod n

and D ₁ =[(a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ] P _B , D ₂ =[(a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ] P _B ,..., D _m-1 = [a _m (c _m ) ^-1 ]P _B method to calculate q ₁ , q ₂ ,..., q _m-1 and D ₁ , D ₂ ,..., D _{m- 1} .

In the above embodiment, if m devices respectively have integer secrets c ₁ , c ₂ ,...,c _m in the interval [1,n-1], then an initialization method in the initialization phase is as follows:

The device that knows d _A randomly selects m integers in the interval [1,n-1] as c ₁ , c ₂ ,...,c _m , and hand them over to m devices for secret storage;

Calculate P _A =[c ^-1 ]d _A , where c ^-1 is the modulo n multiplicative inverse of c, and c=(c ₁ c ₂ ...c _m ) mod n is an integer secret that is not kept by m devices;

Calculate P _U =[u]d _A , where u is an integer randomly selected in the interval [1,n-1] by the device that knows d _A ;

Calculate g _U =g ^ u, wherein ^ is an exponentiation (exponentiation is performed on the element in front of the ^, and the number of times of the exponentiation is behind the ^), g=e(P ₁ , P _pub ), and P ₁ is in G ₁ Generator, P _pub is the main public key (that is, P _pub =[s]P ₂ , s is the main private key or master key, and P ₂ is the generator in G ₂ , see SM9 specification);

Select a non-zero element P _B other than the user private key d _A in the group G ₁ (fixed selection, such as fixed selection P _B = P ₁ , or subjective arbitrary selection, or random selection, for example, in [1,n -1] randomly select an integer b, calculate P _B =[b]P ₁ or P _B =[b]d _A );

After that, hand over _PU , P _B , PA, and g _U to the devices that need to be used, and destroy c, _u .

In the above embodiments, if P _B =PA, then the device knowing d _A in the initialization stage selects _{P B = PA} .

In the above embodiments, if _PU =P _B , then the device knowing d _A in the initialization stage selects _PU =P _B .

In the above embodiment, if c ₁ is a non-secret value of 1 or other integers in [1,n-1], then in the initialization phase c ₂ ,...,c _m is selected as [1,n-1] An integer randomly selected from , and delivered to the No. 2, ..., m-th devices for storage.

In the above embodiment, if c _m is a non-secret value of 1 or other integers in [1,n-1], then in the initialization phase c ₁ ,...,c _m-1 is selected as [1,n- 1] randomly selected integers, and be saved by No. 1, ..., m-1 devices.

In the above embodiments, if P _B ≠ PA, a non-1 integer b is randomly selected within [1,n-1] at the initialization stage, and then P _B =[b]d _A is calculated _.

In the above embodiment, if there is a situation where P _U ≠ P _A (that is, u and c ^-1 are different), then in the initialization stage, an integer u other than c ^-1 is randomly selected in [1, n-1] , and then calculate P _U =[u]d _A .

According to the SM9 digital signature collaborative generation method with the help of intermediate parameters of the present invention, an SM9 digital signature collaborative generation system can be constructed. The system includes m devices respectively labeled No. 1, No. 2, ..., to No. m, m≥2 ;The i-th device saves the integer secret c _i in the interval [1,n-1], i=1,...,m; when it is necessary to use the user's SM9 identification private key d _A to digitally sign the message M, m A device generates a digital signature for a message M by implementing the SM9 digital signature collaborative generation method using intermediate parameters, including implementing the aforementioned embodiments 1-12.

Other unspecified specific technical implementations are well known and self-evident to those skilled in the relevant fields.

Claims (10)

1. A kind of SM9 digital signature collaborative generation method by means of intermediate parameters, it is characterized in that: The method involves m devices respectively labeled No. 1, No. 2, ..., to No. m, m≥2; The i-th device stores the integer secret c _i in the interval [1,n-1], i=1,...,m, where _n is the order of the groups G ₁ , G ₂ , GT in the SM9 cryptographic algorithm; Precomputed with: P _A =[c ^-1 ]d _A , where d _A is the user's SM9 identification private key, c ^-1 is the modulo n multiplicative inverse of c, c=(c ₁ c ₂ ...c _m )mod n is m devices Neither has an integer secret kept; P _U =[u]d _A , where u is an integer secret in the interval [1,n-1] that is not saved by m devices; u and c ^-1 need not be different from each other; g _U =g^u, where ^ is a power operation, g=e(P ₁ ,P _pub ), P ₁ is the generator in G ₁ , and P _pub is the main public key; Choose a non-zero element P _B other than the user's private key d _A in the group _G1 ; m devices do not save d _A ; When it is necessary to use the user's SM9 identification private key d _A to digitally sign a message M, m devices generate digital signatures as follows: First, m devices obtain w=g _U ^(r ₁ r ₂ …r _m ) through interactive calculation, where r _i is an integer randomly selected by the i-th device in the interval [1,n-1] during the calculation process, i=1,...,m; Then, calculate h=H ₂ (M||w,n), where H ₂ is the hash function specified in SM9, M||w represents the combination of M and w, and n is G ₁ , G ₂ , G order of _T ; Check whether w is equal to g^h, if w=g^h, m devices recalculate w until w≠g^h; Afterwards, m devices cooperate to calculate T=[r ₁ r ₂ ...r _m ]P _U +[-F(z ₁ ,z ₂ ,...,z _m )]P _B , V=[F(z ₁ ,z ₂ ,…,z _m )]P _B +[-c ₁ c ₂ …c _m h]PA , where r ₁ ,r ₂ ,…,r _m are No. 1 and No. ₂ in the process of calculating w respectively ,..., the integers selected by the m-th device in [1,n-1], z ₁ , z ₂ ,...,z _m are the 1st, 2nd,..., An integer randomly selected by the m-th device in [1,n-1], F(z ₁ ,z ₂ ,…,z _m ) is the following calculation formula for z ₁ ,z ₂ ,…,z _m : F(z ₁ ,z ₂ ,…,z _m )≡z ₁ a ₂ a ₃ …a _m +z ₂ a ₃ …a _m +…+z _m-1 a _m +z _m (mod n); Wherein, a _i is an integer randomly selected by the i-th device in [1,n-1] in the process of calculating T and V, i=2,...,m; Finally, calculate S=T+V, then (h, S) is the digital signature for message M. 2. according to claim 1 by means of the SM9 digital signature collaborative generation method of intermediate parameter, it is characterized in that: If you do not check whether w and g^h are equal during the above calculation process, after calculating S, if it is found that S is zero, then m devices will perform collaborative calculations again until S is not zero. 3. the SM9 digital signature collaborative generation method by means of intermediate parameters according to claim 1, is characterized in that: The methods for m devices to calculate w=g _U ^(r ₁ r ₂ ...r _m ) include: The No. 1 device calculates g ₁ =g _U ^r ₁ , and sends g ₁ to the No. 2 device; After the i-th device receives g _i-1 , i=2,...,m, calculate g _i =g _i-1 ^r _i ; If i=m, take w=g _m to complete the calculation, otherwise, the i-th device transmits g _i to the i+1-th device; or, The mth device calculates g _m =g _U ^r _m , and sends g _m to the m-1th device; After the i-th device receives g _i+1 , i=m-1,...,1, calculate g _i =g _i+1 ^r _i ; If i=1, take w=g ₁ to complete the calculation; otherwise, the i-th device transmits g _i to the i-1-th device. 4. the SM9 digital signature collaborative generation method by means of intermediate parameters according to claim 1, is characterized in that: m devices collaboratively calculate T=[r ₁ r ₂ ...r _m ]P _U +[-F(z ₁ ,z ₂ ,...,z _m )]P _B , V=[F(z ₁ ,z ₂ , …,z _m )]P _B +[-c ₁ c ₂ …c _m h]P _A is as follows: Calculate Q ₁ =[(r ₂ r ₃ …r _m ) ^-1 (a ₂ a ₃ …a _m )]P _B , Q ₂ =[(r ₃ …r _m ) ^-1 (a ₃ …a _m ) ] P _B ,..., Q _m-1 = [(r _m ) ^{- 1} a _m ] P _B , get Q _m = P _B ; Calculate D ₁ =[(a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ]P _B , D ₂ =[(a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ] P _B ,..., D _m-1 = [a _m (c _m ) ^-1 ] P _B , take D _m = P _B ; Among them, a _i is an integer randomly selected by the i-th device in [1,n-1] during the calculation process, i=2,...,m; Take T ₀ =P _U , V _{0 =} [-h]PA; Device No. 1 randomly selects an integer z ₁ in [1,n-1], calculates T ₁ =[r ₁ ]T ₀ +[-z ₁ ]Q ₁ , V ₁ =[z ₁ ]D ₁ +[ c ₁ ]V ₀ , transmit T ₁ and V ₁ to device No. 2; After the i-th device receives T _i-1 and V _i-1 , i=2,...,m, if it is found that T _i-1 is zero, it will report an error, otherwise, in [1,n-1] Randomly select an integer z _i or take z _i =a _i , calculate T _i =[r _i ]T _i-1 +[-z _i ]Q _i , V _i =[z _i ]D _i +[ _ci ]V _i-1 ; If i=m, take T=T _m , V=V _m , and complete the calculation of T and V; otherwise, the i-th device will transmit T _i and V _i to the i+1-th device until T _m and V are completed _m calculation; If S=T+V is calculated by the mth device after the calculation of T and V is completed, the value of z _m is allowed to be 0 or an integer constant in [1, n-1]; If P _A is not disclosed and kept as a secret by the No. ₁ device, and P _B ≠ PA, then when c ₁ is taken as non-secret, the method for calculating T and V described above and the SM9 digital signature with the help of intermediate parameters are collaboratively generated method still holds. 5. the SM9 digital signature collaborative generation method by means of intermediate parameters according to claim 1, is characterized in that: If P _{B ＝} PA, then m devices cooperate to calculate T=[r ₁ r ₂ …r _m ]P _U +[-F(z ₁ ,z ₂ ,…,z _m )]P _B , V=[ One method of F(z ₁ ,z ₂ ,…,z _m )]P _B +[-c ₁ c ₂ …c _m h]P _A is as follows: Calculate Q ₁ =[(r ₂ r ₃ …r _m ) ^-1 (a ₂ a ₃ …a _m )]P _B , Q ₂ =[(r ₃ …r _m ) ^-1 (a ₃ …a _m ) ] P _B ,..., Q _m-1 = [(r _m ) ^{- 1} a _m ] P _B , get Q _m = P _B ; Calculate d ₁ =((a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 )mod n, d ₂ =((a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ) mod n, ..., d _m-1 = (a _m (c _m ) ^-1 ) mod n, get d _m = 1; Among them, a _i is an integer randomly selected by the i-th device in [1,n-1] during the calculation process, i=2,...,m; Take T ₀ =P _U , v ₀ =-h; Device No. 1 randomly selects an integer z ₁ in [1,n-1], calculates T ₁ =[r ₁ ]T ₀ +[-z ₁ ]Q ₁ , v ₁ =(z ₁ d ₁ +c ₁ v ₀ ) mod n, transmit T ₁ and v ₁ to device No. 2; After the i-th device receives T _i-1 and v _i-1 , i=2,...,m, if the inspection finds that T _i-1 is zero, it will report an error, otherwise, in [1,n-1] Randomly select an integer z _i , calculate T _i =[r _i ]T _i-1 +[-z _i ]Q _i , v _i =(z _i d _i +c _i v _i-1 )mod n; If i=m, take T=T _m , calculate V=[v _m ]PA, and complete the calculation of _T and V; otherwise, the i-th device transmits T _i and v _i to the i+1-th device until Complete the calculation of T _m and v _m ; If V=[v _m ]PA is calculated by the mth device, and S= _T +V is calculated by the mth device after the calculation of T and V is completed, then the value of z _m is allowed to be 0 or [1,n- 1] Integer constants; If P _A is not disclosed and kept as a secret by the m-th device, P _U ≠ PA , and V ₌ [v _m ]PA is calculated by the m _- th device, then when c _m is taken as non-secret, the above calculation of T , the method of V and the SM9 digital signature collaborative generation method with the help of intermediate parameters still hold true. 6. the SM9 digital signature collaborative generation method by means of intermediate parameters according to claim 1, is characterized in that: If P _B ＝P _U , then m devices cooperate to calculate T=[r ₁ r ₂ …r _m ]P _U +[-F(z ₁ ,z ₂ ,…,z _m )]P _B , V=[ One method of F(z ₁ ,z ₂ ,…,z _m )]P _B +[-c ₁ c ₂ …c _m h]P _A is as follows: Calculate q ₁ =((r ₂ r ₃ …r _m ) ^-1 (a ₂ a ₃ …a _m ))mod n, q ₂ =((r ₃ …r _m ) ^-1 (a ₃ …a _m ) ) mod n, ..., q _m-1 = ((r _m ) ^-1 a _m ) mod n, get q _m = 1; Calculate D ₁ =[(a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ]P _B , D ₂ =[(a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ] P _B ,..., D _m-1 = [a _m (c _m ) ^-1 ] P _B , take D _m = P _B ; Among them, a _i is an integer randomly selected by the i-th device in [1,n-1] during the calculation process, i=2,...,m; Take t ₀ =1, V _{0 =} [-h]PA; Device No. 1 randomly selects an integer z ₁ in [1,n-1], calculates t ₁ =(r ₁ t ₀ -z ₁ q ₁ )mod n, V ₁ =[z ₁ ]D ₁ +[c ₁ ] V ₀ , transmit t ₁ and V ₁ to the No. 2 device; After the i-th device receives t _i-1 and V _i-1 , i=2,...,m, if it is found that t _i-1 is 0, it will report an error; otherwise, randomly Select an integer z _i , calculate t _i =(r _i t _i-1 -z _i q _i )mod n, V _i =[z _i ]D _i +[c _i ]V _i-1 ; If i=m, then calculate T=[t _m ]P _B , take V=V _m , and complete the calculation of T and V; otherwise, the i-th device transmits T _i and V _i to the i+1-th device until Complete the calculation of T _m and V _m ; If T=[t _m ]P _B is calculated by the m-th device, and S=T+V is calculated by the m-th device after the calculation of T and V is completed, then the value of z _m is allowed to be 0 or [1,n- 1] Integer constants; If P _A is not disclosed and kept as a secret by the No. ₁ device, and P _B ≠ PA, then when c ₁ is taken as non-secret, the method for calculating T and V described above and the SM9 digital signature with the help of intermediate parameters are collaboratively generated method still holds. 7. according to claim 4 by means of the SM9 digital signature collaborative generation method of intermediate parameter, it is characterized in that: Calculate Q ₁ =[(r ₂ r ₃ …r _m ) ^-1 (a ₂ a ₃ …a _m )]P _B , Q ₂ =[(r ₃ …r _m ) ^-1 (a ₃ …a _m ) ]P _B , ..., Q _m-1 = [(r _m ) ^{- 1} a _m ]P _B , and D ₁ =[(a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ] P _B , D ₂ =[(a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ] P _B ,..., D _m-1 = [a _m (c _m ) ^-1 ] The method of P _B includes the following schemes: Option One: The mth device takes Q _m =P _B , D _m =P _B , randomly selects an integer a _m in [1,n-1], and calculates Q _m-1 =[(r _m ) ^-1 a _m ]Q _m , D _m-1 =[a _m (c _m ) ^-1 ]D _m , send Q _m-1 and D _m-1 to device m-1; After device i receives Q _i and D _i , i=m-1,...,1, if i=1, device No. 1 temporarily reserves Q ₁ and D ₁ to complete Q ₁ , Q ₂ ,... , Q _m-1 and the calculation of D ₁ , D ₂ ,...,D _m-1 , otherwise, the i-th device randomly selects an integer a _i in [1,n-1], and calculates Q _i-1 = [ (r _i ) ^-1 a _i ]Q _i , D _i-1 ＝[a _i ( _ci ) ^-1 ]D _i , keep Q _i and D _i temporarily, and send Q _i-1 and D _i-1 For device i-1; In the process of calculating Q ₁ , Q ₂ ,…,Q _m-1 and D ₁ , D ₂ ,…,D _m-1 , if the i-th device checks and finds that the received Q _i or D _i is zero, i=m-1,...,1, then report an error; Option II: m devices calculate and store Q ₁ , Q ₂ ,...,Q m-1 according to the method of scheme 1 for calculating Q ₁ , Q ₂ ,...,Q _m-1 and D ₁ , D ₂ ,...,D _{m -1} ; The m-th device takes d _m =1, randomly selects an integer a _m in [1,n-1], calculates d _m-1 =(a _m (c _m ) ^-1 )d _m )mod n, and takes d _m-1 is sent to device m-1; After the i-th device receives d _i , i=m-1,...,1, if i=1, then the first device calculates D ₁ =[d ₁ ]P _B , temporarily reserves D ₁ and completes D ₁ , D ₂ ,..., the calculation of D _m-1 , otherwise, the i-th device calculates D _i =[d _i ]P _B , randomly selects an integer a _i in [1,n-1], and calculates d _{i- 1} = (a _i (c _i ) ^-1 d _i ) mod n, temporarily retaining D _i , and sending d _i-1 to the i-1th device; In the process of calculating Q ₁ , Q ₂ ,…,Q _m-1 and D ₁ , D ₂ ,…,D _m-1 , if the i-th device checks and finds that the received Q _i is zero or d _i is 0, i=m-1,...,1, then report an error; third solution: m devices calculate and save D ₁ , D ₂ ,..., D m _-1 according to the method of scheme 1 for calculating Q ₁ , Q ₂ ,...,Q _m-1 and D ₁ , D ₂ ,...,D _m-1 ; The m-th device takes q _m =1, randomly selects an integer a _m in [1,n-1], calculates q _m-1 =((r _m ) ^-1 a _m q _m )mod n, and converts q _{m -1} is sent to device m-1; After the i-th device receives q _i , i=m-1,...,1, if i=1, then the No. 1 device calculates Q ₁ =[q ₁ ]P _B , reserves Q ₁ temporarily, and completes Q ₁ , Q ₂ ,..., the calculation of Q _m-1 , otherwise, the i-th device calculates Q _i =[q _i ]P _B , randomly selects an integer a _i in [1,n-1], and calculates q _{i- 1} = ((r _i ) ^-1 a _i q _i )mod n, temporarily reserve Q _i , and send q _i-1 to the i-1th device; In the process of calculating q ₁ , q ₂ ,…,q _m-1 and D ₁ , D ₂ ,…,D _m-1 , if the i-th device checks and finds that the received q _i is 0 or D _i is zero element, i=m-1,...,1, an error will be reported. 8. according to claim 5 by means of the SM9 digital signature collaborative generation method of intermediate parameter, it is characterized in that: Calculate Q ₁ =[(r ₂ r ₃ …r _m ) ^-1 (a ₂ a ₃ …a _m )]P _B , Q ₂ =[(r ₃ …r _m ) ^-1 (a ₃ …a _m ) ]P _B , ..., Q _m-1 = [(r _m ) ^{- 1} a _m ]P _B , and d ₁ =((a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ) mod n, d ₂ =((a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ) One way mod n,...,d _m-1 = (a _m (c _m ) ^-1 ) mod n is as follows: The mth device takes Q _m =P _B , d _m =1, randomly selects an integer a _m in [1,n-1], and calculates Q _m-1 =[(r _m ) ^-1 a _m ]Q _m , d _m-1 ＝(a _m (c _m ) ^-1 )d _m )mod n, send Q _m-1 and d _m-1 to device m-1; After the i-th device receives Q _i and d _i , i=m-1,...,1, if i=1, then the No. 1 device temporarily reserves Q ₁ and d ₁ to complete Q ₁ , Q ₂ ,... , the calculation of Q _m-1 and d ₁ , d ₂ ,...,d _m-1 , otherwise, the i-th device randomly selects an integer a _i in [1,n-1], and calculates Q _i-1 = [ (r _i ) ^-1 a _i ]Q _i , d _i-1 = (a _i ( _ci ) ^-1 d _i )mod n, keep Q _i and d _i temporarily, set Q _i-1 , d _{i- 1} is transmitted to the i-1th device; In the process of calculating Q ₁ , Q ₂ ,…,Q _m-1 and d ₁ ,d ₂ ,…,d _m-1 , if the i-th device checks and finds that the received Q _i is zero or d _i is 0, i=m-1,...,1, then an error will be reported. 9. according to claim 6 by means of the SM9 digital signature collaborative generation method of intermediate parameter, it is characterized in that: Calculate q ₁ =((r ₂ r ₃ …r _m ) ^-1 (a ₂ a ₃ …a _m ))mod n, q ₂ =((r ₃ …r _m ) ^-1 (a ₃ …a _m ) ) mod n, ..., q _m-1 = ((r _m ) ^-1 a _m ) mod n, and D ₁ =[(a ₂ a ₃ ...a _m )(c ₂ c ₃ ...c _m ) ^-1 ] P _B , D ₂ =[(a ₃ ...a _m )(c ₃ ...c _m ) ^-1 ] One method of P _B ,...,D _m-1 =[a _m (c _m ) ^-1 ]P _B is as follows: The m-th device takes q _m =1, D _m =P _B , randomly selects an integer a _m in [1,n-1], and calculates q _m-1 =((r _m ) ^-1 a _m q _m ) mod n, D _m-1 =[a _m (c _m ) ^-1 ]D _m , send q _m-1 and D _m-1 to device m-1; After the i-th device receives q _i , D _i , i=m-1,...,1, if i=1, then the No. 1 device temporarily reserves q ₁ and D ₁ to complete q ₁ , q ₂ ,... , q _m-1 and the calculation of D ₁ , D ₂ ,...,D _m-1 , otherwise, the i-th device randomly selects an integer a _i in [1,n-1], and calculates q _i-1 =( (r _i ) ^-1 a _i q _i )mod n, D _i-1 = [a _i ( _ci ) ^-1 ]D _i , keep q _i and D _i temporarily, and set q _i-1 , D _{i- 1} is transmitted to the i-1th device; In the process of calculating q ₁ , q ₂ ,…,q _m-1 and D ₁ , D ₂ ,…,D _m-1 , if the i-th device checks and finds that the received q _i is 0 or D _i is zero element, i=m-1,...,1, an error will be reported. 10. A SM9 digital signature collaborative generation system based on the SM9 digital signature collaborative generation method of intermediate parameters based on any one of claims 1-9, is characterized in that: The system includes m devices respectively labeled No. 1, No. 2, ..., to No. m devices, m≥2; No. i device stores the integer secret c _i in the interval [1, n-1] , i=1,...,m; when the user's SM9 identification private key d _A needs to be used to digitally sign the message M, m devices generate the digital signature for the message M according to the SM9 digital signature collaborative generation method with the help of intermediate parameters sign.