CN110299998B - SM9 digital signature collaborative generation method and system by means of intermediate parameters - Google Patents

Abstract

SM9 digital signature generation method: the devices numbered from number 1 to m have [1, n-1 ] respectively]Secret c of medium integer_iN is the order of SM9 group, i is 1, …, m is more than or equal to 2; p_A＝[(c₁c₂…c_m)^‑1]d_A，P_U＝[u]d_A，d_AIs a private key of a user, u is [1, n-1 ]]An integer secret within; p_BIs a group G₁A medium non-zero element; when signing a message, calculating w-g_U^(r₁r₂…r_m)，h＝H₂(M||w,n)，T＝[r₁r₂…r_m]P_U+[‑F(z₁,...,z_m)]P_B，V＝[F(z₁,...,z_m)]P_B+[‑hc₁c₂…c_m]P_A，F(z₁,z₂,…,z_m) And z₁a₂a₃…a_m+z₂a₃…a_m+…+z_mThe modulus n is congruent, and S is T + V; then (h, S) is d_AA digital signature of the message M.

Description

SM9 digital signature collaborative generation method and system by means of intermediate parameters

Technical Field

The invention belongs to the technical field of information security, and particularly relates to a collaborative generation method and system of SM9 digital signatures by means of intermediate parameters.

Background

SM9 is an identification cryptographic algorithm issued by the national crypto authority based on bilinear mapping (pairing operation), wherein the bilinear mapping (pairing operation) is:

e：G₁×G₂→G_Tin which G is₁、G₂Is an additive cyclic group, G_TIs a multiplication loop group, G₁、G₂、G_TIs a prime number n (note: in the SM9 specification, G₁、G₂、G_TThe order of (A) is given by the capital letter N, and the present application uses the lower case N), i.e. if P, Q, R are each G₁、G₂In (b), e (P, Q) is G_TAnd:

e(P+R,Q)＝e(P,Q)e(R,Q)，

e(P,Q+R)＝e(P,Q)e(P,R)，

e(aP,bQ)＝e(P,Q)^ab。

the SM 9-based cryptographic algorithm can realize digital signature based on identification, key exchange and data encryption. In the SM9 cryptographic algorithm, the user's SM9 private key d is used_AThe process of generating a digital signature for message M is as follows:

is calculated toTo w ═ g ^ r, where the symbol ^ represents the power operation (the r-th power of g), r is at [1, n-1]Randomly selected integer within the interval, n being the group G of the SM9 cryptographic algorithm₁、G₂、G_TG ═ e (P)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification; note that here the primary private key or key, the primary public key, the sign used by the user identification private key is slightly different from the SM9 specification);

then, H is calculated as H₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_T(iii) order (see SM9 specification);

if r ≠ h, calculate S [ [ r-h ≠ h]d_AThen (h, S) is the generated digital signature; and if r is equal to h, reselecting r, and recalculating w and h until r is not equal to h.

For special requirements, for example, to ensure the security of the use of the private key of the user in a non-hardware environment, some methods for generating the SM9 digital signature based on secret sharing (sharing) have been proposed. In these methods, a plurality of devices each hold a secret share of the private key of the user SM9, or each hold a secret share of a secret related to the private key; when a digital signature needs to be generated for one message M by using a user private key, each device interacts and cooperates with other devices by using the secret share of the device, and the digital signature for the message is generated.

The existing SM9 digital signature collaborative generation scheme based on secret sharing usually calculates w ═ g ^ (a) in the process of cryptographic operation₁r₁+…+a_mr_m) Wherein r is_iIs the ith device in [1, n-1 ]]Of a randomly selected integer, and a_iIs a constant, i ═ 1, …, m (assuming m devices); then H is calculated₂(M | | w, n), and the last M devices obtain S ═ a [ (a) through cooperative calculation₁r₁+…+a_mr_m)-h]d_A. This solution is generally unproblematicHowever, it is also possible that a situation occurs in which (a) happens to occur₁r₁+…+a_mr_m) mod n is 0 and this happens to be observed by exactly one of the devices (e.g. by checking if w is a unit bit) but not reported, it is possible for that device to derive the user' S SM9 private key from the resulting digital signature (h, S). The probability of this occurring, although extremely small, is still likely to occur, particularly at r_iIn the case of a truly random selection, which is difficult to achieve.

The scheme adopted if the secret sharing-based digital signature collaborative generation scheme can achieve is w ═ g ^ (ar)₁…r_m)，S＝[(ar₁…r_m)-h]d_AI.e. r herein₁,…,r_mAnd a constant a is present in the form of a product, then it is not present (ar)₁…r_m) In the case of mod n being 0, such a scheme has higher security. We here handle r₁,…,r_mAnd the case where the constant a occurs in the form of a product is referred to as the case of the product r parameter, and r in the process of generating the digital signature is referred to as the case of the product r parameter₁,…,r_mAnd an SM9 digital signature cooperative generation method in which the constant a appears in the form of a product, referred to as an SM9 digital signature cooperative generation method with a product r parameter.

Disclosure of Invention

The invention aims to provide an SM9 digital signature generation technical scheme with product r parameter enhanced safety so as to enhance the safety of a secret sharing-based SM9 digital signature cooperative generation technical scheme.

Aiming at the purpose of the invention, the technical scheme provided by the invention comprises a collaborative generation method of SM9 digital signature by means of intermediate parameters and a corresponding system.

In the following description of the present invention, if P, Q is addition group G₁、G₂Where P + Q represents the addition of P, Q to the addition group, P-Q represents the inverse of P plus Q (addition inverse), and k]P represents the addition of k P's to the addition group, i.e., P + P +. + P (k total P) (if k is a negative number, the inverse of the result of the addition of | k | P's, where [, ]]Use of symbols andSM9 specification is consistent);

an ellipsis ". -" represents a plurality of identical (types of) data items or a plurality of identical operations;

if a, b are multiplicative groups G_TWhere ab or a.b represents a, b in the multiplicative group G_TMultiplication of (a, ". may be omitted, as long as it does not produce ambiguity), a^-1Indicates that a is an inverse of a (multiplicative inverse) in a multiplicative group, a^tIndicates t a are in multiplicative group G_TUp-multiplication (t is a negative number, and is the inverse of | t | the multiplication result of a), i.e. exponentiation, a^tIs a ^ t;

if c is an integer, then c^-1Representing the modulo n inverse of integer c (i.e., cc)^-1mod n ═ 1); unless otherwise specified, the multiplicative inverse of the integer in the invention of this patent is for group G₁、G₂、G_TThe modulo n multiplication inverse of order n;

multiple integer multiplications (including integer-symbol multiplications, constant-integer-symbol multiplications), omitting the multiplication "·" as k, without ambiguity₁·k₂Simplified as k₁k₂3 · c, reduced to 3 c;

mod n denotes the modulo n operation (modulo operation), corresponding to modN in the SM9 specification; also, the operator mod n of the modulo n operation is of lowest priority, e.g., a + b mod n equals (a + b) mod n, a-b mod n equals (a-b) mod n, ab mod n equals (ab) mod n.

The method for cooperatively generating the SM9 digital signature by means of the intermediate parameter provided by the invention is concretely as follows.

The method involves m devices numbered 1, 2, …, respectively, up to m, where m is greater than or equal to 2;

device No. i holds [1, n-1 ]]Integer secret c within interval_iI is 1, …, m, where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TThe order of (is a prime number);

(initialization phase) pre-calculated are:

P_A＝[c^-1]d_Awherein d is_AIdentify the private key for the user's SM9, c^-1Modulo n multiplication inverse of c, c ═ c₁c₂…c_m) modn is an integer secret that is not held by any of the m devices;

P_U＝[u]d_Awhere u is [1, n-1 ] where none of the m devices is stored]Integer secrets within the interval;

u and c^-1Need not be different (different or the same);

g_Ug ^ u, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ u)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

in group G₁Optionally a user private key d_AOther non-zero elements P_B(stationary election, e.g. stationary election P_B＝P₁Either subjectively chosen arbitrarily or randomly chosen, e.g. at [1, n-1 ]]Randomly selecting an integer b, and calculating P_B＝[b]P₁Or P_B＝[b]d_A)；

None of the m devices store d_A；

When it is desired to use the user's SM9 to identify the private key d_AWhen digitally signing a message M, M devices generate digital signatures as follows (the user's SM9 identification private key d needs to be used_AThe body that digitally signs for message M may be a cryptographic application, system or cryptographic module that invokes the M devices, or a cryptographic application, system in one of the M devices):

firstly, m devices obtain w ═ g through interactive calculation_U^(r₁r₂…r_m) Wherein r is_iThe device No. i is in [1, n-1 ] in the calculation process]Randomly selected integer in the interval, i ═ 1, …, m;

then, H ═ H is calculated (by one of the m devices or the other device)₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w denotes M and wMerging strings of (n is G)₁、G₂、G_TThe order of (1);

(h free transfer as required without privacy)

Checking whether w is equal to g ^ h or not (one or other of the m devices), and if w is equal to g ^ h, the m devices perform calculation of w again until w is not equal to g ^ h;

then, m devices cooperatively calculate T ═ r₁r₂…r_m]P_U+[-F(z₁,z₂,…,z_m)]P_B，V＝[F(z₁,z₂,…,z_m)]P_B+[-c₁c₂…c_mh]P_AWherein r is₁,r₂,…,r_mRespectively, No. 1, No. 2, …, No. m device in the process of calculating w is in [1, n-1 ]]Is an integer selected from₁,z₂,…,z_mRespectively No. 1, No. 2, No. …, No. m device is in [1, n-1 ] during calculation of T, V]Of a randomly selected integer, F (z)₁,z₂,…,z_m) Is directed to z₁,z₂,…,z_mThe following calculation formula:

F(z₁,z₂,…,z_m)≡z₁a₂a₃…a_m+z₂a₃…a_m+…+z_m-1a_m+z_m(mod n) (modulo n congruence);

wherein, a_iFor the calculation of T, V, device number i is at [1, n-1 ]]Wherein i is 2, …, m;

finally, S ═ T + V is calculated (by one or other of the M devices), then (h, S) is the digital signature for message M.

(where S is [ r ]₁r₂…r_m]P_U+[-c₁c₂…c_mh]P_A＝[(r₁r₂…r_m)u-h]d_A)

For the above-mentioned SM9 digital signature collaborative generation method using intermediate parameters, if it is not checked whether w is equal to g ^ h or not in the above calculation process, after S is obtained by calculation, if (the device calculating S ═ T + V) checks that S is zero-element, m devices perform collaborative calculation again until S is not zero-element.

For the above-described SM9 digital signature collaborative generation method by means of intermediate parameters, m devices calculate w-g_U^(r₁r₂…r_m) The method of (1) comprises (not all possible ways):

device No. 1 calculates g₁＝g_U^r₁G is mixing₁Transmitting device No. 2;

the device No. i receives g_i-1Then i 2, …, m, calculate g_i＝g_i-1^r_i；

If i is m, then w is g_mFinish the calculation, otherwise, the device No. i will g_iTransmitting to the device No. i + 1;

alternatively, the first and second electrodes may be,

device m calculates g_m＝g_U^r_mG is mixing_mTransmitting the m-1 device;

the ith device receives g_i+1Then, i ═ m-1, …,1, calculate g_i＝g_i+1^r_i；

If i is 1, then w is g₁Finish the calculation, otherwise, the device No. i will g_iTo the device No. i-1.

For the above-described SM9 digital signature collaborative generation method by means of intermediate parameters, m devices collaboratively calculate to obtain T ═ r₁r₂…r_m]P_U+[-F(z₁,z₂,…,z_m)]P_B，

V＝[F(z₁,z₂,…,z_m)]P_B+[-c₁c₂…c_mh]P_AOne method of (T, V collaborative computing method one) is as follows:

calculating to obtain Q₁＝[(r₂r₃…r_m)^-1(a₂a₃…a_m)]P_B，Q₂＝[(r₃…r_m)^-1(a₃…a_m)]P_B，…，Q_m-1＝[(r_m)^-1a_m]P_BTaking Q_m＝P_B；

Is calculated to obtain D₁＝[(a₂a₃…a_m)(c₂c₃…c_m)^-1]P_B，D₂＝[(a₃…a_m)(c₃…c_m)^-1]P_B，…，D_m-1＝[a_m(c_m)^-1]P_BTaking D_m＝P_B；

Wherein, a_iFor the calculation process, the device No. i is in [1, n-1 ]]Wherein i is 2, …, m;

get T₀＝P_U，V₀＝[-h]P_A；

Device No. 1 is in [1, n-1 ]]In the random selection of an integer z₁Calculating T₁＝[r₁]T₀+[-z₁]Q₁，V₁＝[z₁]D₁+[c₁]V₀Will T₁、V₁To device No. 2;

device i receives T_i-1、V_i-1When i is 2, …, m, if T is found by examination_i-1If it is zero, error is reported, otherwise, it is in [1, n-1 ]]In the random selection of an integer z_iOr take z_i＝a_iCalculating T_i＝[r_i]T_i-1+[-z_i]Q_i，V_i＝[z_i]D_i+[c_i]V_i-1；

If i is equal to m, then T is equal to T_m，V＝V_mT, V calculation is completed, otherwise, device number i will T_i、V_iTransmitting to the device No. i +1 until T is completed_m、V_mCalculating;

(when T ═ r [ r ]₁r₂…r_m]P_U+[-z₁a₂a₃…a_m-z₂a₃…a_m-…-z_m-1a_m-z_m]P_B，

V＝[z₁a₂a₃…a_m+z₂a₃…a_m+…+z_m-1a_m+z_m]P_B+[-(c₁c₂…c_m)h]P_A)

If S ═ T + V is calculated by the mth device after the T, V calculation is completed, z is_mIs allowed to be 0 or [1, n-1 ]]Is (1, n-1) constant (of course)]Random integers within are not problematic);

if P_AIt is not disclosed that device number 1 holds as a secret (of course if P_U＝P_AThen P is_UAlso not disclosed, is also held as a secret by device No. 1), P_B≠P_AThen c will be₁When it is not secret (its value is 1 or other [1, n-1 ]]Integer) the above-described method of calculating T, V and the SM9 digital signature collaborative generation method by means of intermediate parameters still hold.

For the above-mentioned SM9 digital signature collaborative generation method by means of intermediate parameters, if P_B＝P_AAnd then m devices cooperatively calculate to obtain T ═ r₁r₂…r_m]P_U+[-F(z₁,z₂,…,z_m)]P_B，V＝[F(z₁,z₂,…,z_m)]P_B+[-c₁c₂…c_mh]P_AOne method of (T, V collaborative computing method two) is as follows:

calculating to obtain Q₁＝[(r₂r₃…r_m)^-1(a₂a₃…a_m)]P_B，Q₂＝[(r₃…r_m)^-1(a₃…a_m)]P_B，…，Q_m-1＝[(r_m)^-1a_m]P_BTaking Q_m＝P_B；

Calculated to obtain d₁＝((a₂a₃…a_m)(c₂c₃…c_m)^-1)mod n，d₂＝((a₃…a_m)(c₃…c_m)^-1)modn，…，d_m-1＝(a_m(c_m)^-1) mod n, take d_m＝1；

Wherein, a_iFor the calculation process, the device No. i is in [1, n-1 ]]Wherein i is 2, …, m;

get T₀＝P_U，v₀＝-h；

Device No. 1 is in [1, n-1 ]]In the random selection of an integer z₁Calculating T₁＝[r₁]T₀+[-z₁]Q₁，v₁＝(z₁d₁+c₁v₀) mod n, will T₁、v₁To device No. 2;

device i receives T_i-1、v_i-1When i is 2, …, m, if T is found by examination_i-1If it is zero, error is reported, otherwise, it is in [1, n-1 ]]In the random selection of an integer z_iCalculating T_i＝[r_i]T_i-1+[-z_i]Q_i，v_i＝(z_id_i+c_iv_i-1)mod n；

If i is equal to m, then T is equal to T_m(one or other of the m devices) calculates V ═ V_m]P_AT, V calculation is completed, otherwise, device number i will T_i、v_iTransmitting to the device No. i +1 until T is completed_m、v_mCalculating;

(when T ═ r [ r ]₁r₂…r_m]P_U+[-z₁a₂a₃…a_m-z₂a₃…a_m-…-z_m-1a_m-z_m]P_B，

V＝[z₁a₂a₃…a_m+z₂a₃…a_m+…+z_m-1a_m+z_m]P_B+[-(c₁c₂…c_m)h]P_A)

If V ═ V is calculated by the m-th device_m]P_AAnd completing T, V calculationsThen, the m-th device calculates S as T + V, so z_mIs allowed to be 0 or [1, n-1 ]]Is (1, n-1) constant (of course)]Random integers within are not problematic);

if P_ANot publicly held by the m-th device as a secret (of course P)_BAlso not disclosed), P_U≠P_A(i.e., u and c)^-1Mutually different), and V ═ V is calculated by the m-th device_m]P_AThen c will be_mWhen it is not secret (its value is 1 or other [1, n-1 ]]Integer) the above-described method of calculating T, V and the SM9 digital signature collaborative generation method by means of intermediate parameters still hold.

For the above-mentioned SM9 digital signature collaborative generation method by means of intermediate parameters, if P_B＝P_UAnd then m devices cooperatively calculate to obtain T ═ r₁r₂…r_m]P_U+[-F(z₁,z₂,…,z_m)]P_B，V＝[F(z₁,z₂,…,z_m)]P_B+[-c₁c₂…c_mh]P_AOne method of (T, V collaborative computing method three) is as follows:

q is obtained by calculation₁＝((r₂r₃…r_m)^-1(a₂a₃…a_m))mod n，q₂＝((r₃…r_m)^-1(a₃…a_m))modn，…，q_m-1＝((r_m)^-1a_m) mod n, take q_m＝1；

Is calculated to obtain D₁＝[(a₂a₃…a_m)(c₂c₃…c_m)^-1]P_B，D₂＝[(a₃…a_m)(c₃…c_m)^-1]P_B，…，D_m-1＝[a_m(c_m)^-1]P_BTaking D_m＝P_B；

Wherein, a_iFor the calculation process, the device No. i is in [1, n-1 ]]Wherein i is 2, …, m;

get t₀＝1，V₀＝[-h]P_A；

Device No. 1 is in [1, n-1 ]]In the random selection of an integer z₁Calculating t₁＝(r₁t₀-z₁q₁)mod n，V₁＝[z₁]D₁+[c₁]V₀Will t₁、V₁To device No. 2;

the device No. i receives t_i-1、V_i-1When i is 2, …, m, if t is found by examination_i-1If 0, an error is reported, otherwise, the error is in [1, n-1 ]]In the random selection of an integer z_iCalculating t_i＝(r_it_i-1-z_iq_i)mod n，V_i＝[z_i]D_i+[c_i]V_i-1；

If i is m, T is calculated (one or other of m devices)_m]P_BTaking V as V_mT, V calculation is completed, otherwise, device number i will T_i、V_iTransmitting to the device No. i +1 until T is completed_m、V_mCalculating;

(when T ═ r [ r ]₁r₂…r_m]P_U+[-z₁a₂a₃…a_m-z₂a₃…a_m-…-z_m-1a_m-z_m]P_B，

V＝[z₁a₂a₃…a_m+z₂a₃…a_m+…+z_m-1a_m+z_m]P_B+[-(c₁c₂…c_m)h]P_A)

If T ═ T is calculated by the m-th device_m]P_BAnd S ═ T + V is calculated by the mth device after T, V calculation is completed, then z is_mIs allowed to be 0 or [1, n-1 ]]Is (1, n-1) constant (of course)]Random integers within are not problematic);

if P_ANot publicly held by device No. 1 as a secret, P_B≠P_A(i.e. P)_U≠P_AU and c^-1Different from each other), then c is₁When it is not secret (its value is 1 or other [1, n-1 ]]Integer) the above-described method of calculating T, V and the SM9 digital signature collaborative generation method by means of intermediate parameters still hold.

For the SM9 digital signature collaborative generation method by means of the intermediate parameters, Q is obtained through calculation₁＝[(r₂r₃…r_m)^-1(a₂a₃…a_m)]P_B，Q₂＝[(r₃…r_m)^-1(a₃…a_m)]P_B，…，Q_m-1＝[(r_m)^-1a_m]P_B，

And D₁＝[(a₂a₃…a_m)(c₂c₃…c_m)^-1]P_B，D₂＝[(a₃…a_m)(c₃…c_m)^-1]P_B，…，D_m-1＝[a_m(c_m)^-1]P_BThe method of (a) comprises the following (not all possible):

the first scheme is as follows:

device No. m takes Q_m＝P_B，D_m＝P_BIn [1, n-1 ]]In the method, an integer a is randomly selected_mCalculating Q_m-1＝[(r_m)^{- 1}a_m]Q_m，D_m-1＝[a_m(c_m)^-1]D_mIs mixing Q with_m-1、D_m-1Sending the data to the device No. m-1;

device i receives Q_i、D_iThen, if i is m-1, …,1, and if i is 1, the device No. 1 will Q₁、D₁Temporarily reserved, complete Q₁,Q₂,…,Q_m-1And D₁,D₂,…,D_m-1Otherwise, the device No. i is in [1, n-1 ]]In the method, an integer a is randomly selected_iCalculating Q_i-1＝[(r_i)^-1a_i]Q_i，D_i-1＝[a_i(c_i)^-1]D_iIs mixing Q with_i、D_iTemporarily reserve, Q_i-1、D_i-1Transmitting to the device No. i-1;

in calculating Q₁,Q₂,…,Q_m-1And D₁,D₂,…,D_m-1If the device No. i checks and finds the received Q_iOr D_iIf the number is zero, i is m-1, …,1, then an error is reported;

scheme II:

m devices by calculating Q₁,Q₂,…,Q_m-1And D₁,D₂,…,D_m-1Calculating and storing Q in the manner of scheme one₁,Q₂,…,Q_m-1；

Device number m gets d_m1 in [1, n-1 ]]In the method, an integer a is randomly selected_mCalculating d_m-1＝(a_m(c_m)^-1)d_m) mod n, d_m-1Sending the data to the device No. m-1;

device i receives d_iThen, if i is m-1, …,1, and if i is 1, the No. 1 device calculates D₁＝[d₁]P_BD is₁Temporary Retention, complete D₁,D₂,…,D_m-1Otherwise, the device No. i calculates D_i＝[d_i]P_BIn [1, n-1 ]]In the method, an integer a is randomly selected_iCalculating d_i-1＝(a_i(c_i)^-1d_i) mod n, D_iTemporarily retaining d_i-1Transmitting to the device No. i-1;

in calculating Q₁,Q₂,…,Q_m-1And D₁,D₂,…,D_m-1If the device No. i checks and finds the received Q_iIs zero or d_iIf 0, i-m-1, …,1, an error is reported;

the third scheme is as follows:

m devices by calculating Q₁,Q₂,…,Q_m-1And D₁,D₂,…,D_m-1Calculating and storing in the manner of scheme one₁,D₂,…,D_m-1；

Device number m gets q_m1 in [1, n-1 ]]In the method, an integer a is randomly selected_mCalculating q_m-1＝((r_m)^-1a_mq_m) mod n, and q_m-1Sending the data to the device No. m-1;

device i receives q_iThen, if i is m-1, …,1, and if i is 1, the No. 1 device calculates Q₁＝[q₁]P_BIs mixing Q with₁Temporarily reserved, complete Q₁,Q₂,…,Q_m-1Otherwise, the ith device calculates Q_i＝[q_i]P_BIn [1, n-1 ]]In the method, an integer a is randomly selected_iCalculating q_i-1＝((r_i)^-1a_iq_i) mod n, Q_iTemporarily reserving q_i-1Transmitting to the device No. i-1;

in the calculation of q₁,q₂,…,q_m-1And D₁,D₂,…,D_m-1If the device No. i checks and finds the received q_iIs 0 or D_iAnd if the number is zero, i is m-1, …,1, an error is reported.

For the SM9 digital signature collaborative generation method by means of the intermediate parameters, Q is obtained through calculation₁＝[(r₂r₃…r_m)^-1(a₂a₃…a_m)]P_B，Q₂＝[(r₃…r_m)^-1(a₃…a_m)]P_B，…，Q_m-1＝[(r_m)^-1a_m]P_B，

And d₁＝((a₂a₃…a_m)(c₂c₃…c_m)^-1)mod n，d₂＝((a₃…a_m)(c₃…c_m)^-1)mod n，…，d_m-1＝(a_m(c_m)^-1) One method of mod n is as follows:

device No. m takes Q_m＝P_B，d_m1 is at[1,n-1]In the method, an integer a is randomly selected_mCalculating Q_m-1＝[(r_m)^{- 1}a_m]Q_m，d_m-1＝(a_m(c_m)^-1)d_m) mod n, Q_m-1、d_m-1Sending the data to the device No. m-1;

device i receives Q_i、d_iThen, if i is m-1, …,1, and if i is 1, the device No. 1 will Q₁、d₁Temporarily reserved, complete Q₁,Q₂,…,Q_m-1And d₁,d₂,…,d_m-1Otherwise, the device No. i is in [1, n-1 ]]In the method, an integer a is randomly selected_iCalculating Q_i-1＝[(r_i)^-1a_i]Q_i，d_i-1＝(a_i(c_i)^-1d_i) mod n, Q_i、d_iTemporarily reserve, Q_i-1、d_i-1Transmitting to the device No. i-1;

in calculating Q₁,Q₂,…,Q_m-1And d₁,d₂,…,d_m-1If the device No. i checks and finds the received Q_iIs zero or d_iIf 0, i-m-1, …,1, an error is reported.

For the SM9 digital signature collaborative generation method by means of the intermediate parameters, q is obtained through calculation₁＝((r₂r₃…r_m)^-1(a₂a₃…a_m))mod n，q₂＝((r₃…r_m)^-1(a₃…a_m))mod n，…，q_m-1＝((r_m)^-1a_m)mod n，

And D₁＝[(a₂a₃…a_m)(c₂c₃…c_m)^-1]P_B，D₂＝[(a₃…a_m)(c₃…c_m)^-1]P_B，…，D_m-1＝[a_m(c_m)^-1]P_BOne method of (2) is as follows:

device number m gets q_m＝1，D_m＝P_BIn [1, n-1 ]]In the method, an integer a is randomly selected_mCalculating q_m-1＝((r_m)^{- 1}a_mq_m)mod n，D_m-1＝[a_m(c_m)^-1]D_mQ is prepared by_m-1、D_m-1Sending the data to the device No. m-1;

device i receives q_i、D_iThen, if i is m-1, …,1, and if i is 1, the device No. 1 will q₁、D₁Temporary reservation, complete q₁,q₂,…,q_m-1And D₁,D₂,…,D_m-1Otherwise, the device No. i is in [1, n-1 ]]In the method, an integer a is randomly selected_iCalculating q_i-1＝((r_i)^-1a_iq_i)mod n，D_i-1＝[a_i(c_i)^-1]D_iQ is prepared by_i、D_iTemporarily reserving q_i-1、D_i-1Transmitting to the device No. i-1;

in the calculation of q₁,q₂,…,q_m-1And D₁,D₂,…,D_m-1If the device No. i checks and finds the received q_iIs 0 or D_iAnd if the number is zero, i is m-1, …,1, an error is reported.

On the basis of the SM9 digital signature collaborative generation method by means of the intermediate parameters, an SM9 digital signature collaborative generation system can be constructed, wherein the system comprises m devices which are respectively marked as No. 1, No. 2 and No. …, and m is more than or equal to 2; device No. i holds [1, n-1 ]]Integer secret c within interval_iI is 1, …, m; when it is desired to use the user's SM9 to identify the private key d_AWhen the message M is digitally signed, the M devices generate the digital signature of the message M according to the SM9 digital signature collaborative generation method by means of the intermediate parameters.

From the above description, it can be seen that, based on the method and system of the present invention, the user identification private key d is used when needed_AWhen digitally signing a message, multiple devices may collaborate through interactionGenerating a digital signature for a message by introducing an intermediate parameter z in the calculation process₁,…,z_mAnd a₂,…,a_mAnd the digital signature generated cooperatively has a product r parameter, so that the security is higher.

Detailed Description

The present invention will be further described with reference to the following examples. The following examples are merely illustrative of a few possible embodiments of the present invention and are not intended to represent all possible embodiments and are not intended to limit the present invention.

Examples 1,

This embodiment has two devices numbered 1 and 2, device number 1 holding [1, n-1 [ ]]Integer secret c within interval₁Device No. 2 stores [1, n-1 ]]Integer secret c within interval₂Where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TThe order of (is a prime number);

(initialization phase) pre-calculated are:

P_A＝[c^-1]d_Awherein d is_AIdentify the private key for the user's SM9, c^-1Modulo n multiplication inverse of c, c ═ c₁c₂) mod n is an integer secret that neither device holds;

P_U＝[u]d_Awhere u is [1, n-1 ] which neither device holds]Integer secrets within the interval;

u and c^-1Need not be different (different or the same);

g_Ug ^ u, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ u)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

in group G₁Optionally a user private key d_AOther non-zero elements P_B(stationary election, e.g. stationary election P_B＝P₁Or is orSubjectively chosen arbitrarily, or randomly chosen, e.g. at [1, n-1 ]]Randomly selecting an integer b, and calculating P_B＝[b]P₁Or P_B＝[b]d_A)；

Neither device stores d_A；

When it is desired to use the user's SM9 to identify the private key d_AWhen the message M is digitally signed, the two devices obtain w-g through interactive calculation_U^(r₁r₂) Wherein r is₁The No. 1 device is in [1, n-1 ] in the calculation process]Randomly selected integer within the interval, r₂The No. 2 device is in [1, n-1 ] in the calculation process]Randomly selected integers within the interval;

then, H ═ H is calculated (by one of the two devices or the other device)₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not (one or other of the two devices), and if w is equal to g ^ h, the two devices perform calculation of w again until w is not equal to g ^ h;

then, the two devices are calculated according to the T, V collaborative calculation method I

T＝[r₁r₂]P_U+[-F(z₁,z₂)]P_B，V＝[F(z₁,z₂)]P_B+[-c₁c₂h]P_ANamely:

calculating to obtain Q₁＝[(r₂)^-1a₂]P_BTaking Q₂＝P_B；

Is calculated to obtain D₁＝[a₂(c₂)^-1]P_BTaking D₂＝P_B；

Wherein, a₂For the calculation process, the number 2 device is in [1, n-1 ]]Randomly selected integers in the sequence (1);

get T₀＝P_U，V₀＝[-h]P_A；

Device No. 1 is in [1, n-1 ]]In which one is randomly selectedInteger z₁Calculating T₁＝[r₁]T₀+[-z₁]Q₁，V₁＝[z₁]D₁+[c₁]V₀Will T₁、V₁To device No. 2;

device number 2 receives T₁、V₁Then, if T is found by inspection₁If it is zero, error is reported, otherwise, it is in [1, n-1 ]]In the random selection of an integer z₂Or take z₂＝a₂Calculating T₂＝[r₂]T₁+[-z₂]Q₂，V₂＝[z₂]D₂+[c₂]V₁；

Taking T as T₂，V＝V₂；

(when T ═ r [ r ]₁r₂]P_U+[-z₁a₂-z₂]P_B，V＝[z₁a₂+z₂]P_B+[-(c₁c₂)h]P_A)

Finally, S ═ T + V is calculated (by one of the two devices or the other device), then (h, S) is the digital signature for message M.

(where S is [ r ]₁r₂]P_U+[-c₁c₂h]P_A＝[(r₁r₂)u-h]d_A)

If after T, V calculation S is calculated by device No. 2, T + V, then z is calculated T, V₂Is allowed to be 0 or [1, n-1 ]]Is (1, n-1) constant (of course)]Random integers within are not problematic).

Examples 2,

Example 2 differs from example 1 in that c₁Is non-secret and takes the value of 1 or other [1, n-1 ]]Of (1) and (others in [1, n-1 ]]Of a subjectively arbitrary or randomly selected integer), P_AIt is not disclosed that device number 1 holds as a secret (of course if P_U＝P_AThen P is_UAlso not disclosed, is also held as a secret by device No. 1), and P_B≠P_AAnd others are unchanged.

Examples 3,

This example has m devices numbered 1, 2, …, respectively, through m ≧ 2, where device # i holds [1, n-1]Integer secret c within interval_iI is 1, …, m, where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TThe order of (is a prime number);

(initialization phase) pre-calculated are:

P_A＝[c^-1]d_Awherein d is_AIdentify the private key for the user's SM9, c^-1Modulo n multiplication inverse of c, c ═ c₁c₂…c_m) modn is an integer secret that is not held by any of the m devices;

P_U＝[u]d_Awhere u is [1, n-1 ] where none of the m devices is stored]Integer secrets within the interval;

u and c^-1Need not be different (different or the same);

g_Ug ^ u, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ u)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

in group G₁Optionally a user private key d_AOther non-zero elements P_B(stationary election, e.g. stationary election P_B＝P₁Either subjectively chosen arbitrarily or randomly chosen, e.g. at [1, n-1 ]]Randomly selecting an integer b, and calculating P_B＝[b]P₁Or P_B＝[b]d_A)；

None of the m devices store d_A；

When it is desired to use the user's SM9 to identify the private key d_AWhen a digital signature is performed on a message M, M devices firstly obtain w ═ g through interactive calculation_U^(r₁r₂…r_m) Wherein r is_iThe device No. i is in [1, n-1 ] in the calculation process]An integer randomly selected within the interval of the interval,i＝1,…,m；

then, H ═ H is calculated (by one of the m devices or the other device)₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not (one or other of the m devices), and if w is equal to g ^ h, the m devices perform calculation of w again until w is not equal to g ^ h;

then, the m devices are obtained by calculation according to the T, V collaborative calculation method I

T＝[r₁r₂…r_m]P_U+[-F(z₁,z₂,…,z_m)]P_B，

V＝[F(z₁,z₂,…,z_m)]P_B+[-c₁c₂…c_mh]P_ANamely:

calculating to obtain Q₁＝[(r₂r₃…r_m)^-1(a₂a₃…a_m)]P_B，Q₂＝[(r₃…r_m)^-1(a₃…a_m)]P_B，…，Q_m-1＝[(r_m)^-1a_m]P_BTaking Q_m＝P_B；

Is calculated to obtain D₁＝[(a₂a₃…a_m)(c₂c₃…c_m)^-1]P_B，D₂＝[(a₃…a_m)(c₃…c_m)^-1]P_B，…，D_m-1＝[a_m(c_m)^-1]P_BTaking D_m＝P_B；

Wherein, a_iFor the calculation process, the device No. i is in [1, n-1 ]]Wherein i is 2, …, m;

get T₀＝P_U，V₀＝[-h]P_A；

Device No. 1 is in [1, n-1 ]]In the random selection of an integerz₁Calculating T₁＝[r₁]T₀+[-z₁]Q₁，V₁＝[z₁]D₁+[c₁]V₀Will T₁、V₁To device No. 2;

device i receives T_i-1、V_i-1When i is 2, …, m, if T is found by examination_i-1If it is zero, error is reported, otherwise, it is in [1, n-1 ]]In the random selection of an integer z_iOr take z_i＝a_iCalculating T_i＝[r_i]T_i-1+[-z_i]Q_i，V_i＝[z_i]D_i+[c_i]V_i-1；

If i is equal to m, then T is equal to T_m，V＝V_mT, V calculation is completed, otherwise, device number i will T_i、V_iTransmitting to the device No. i +1 until T is completed_m、V_mCalculating;

(when T ═ r [ r ]₁r₂…r_m]P_U+[-z₁a₂a₃…a_m-z₂a₃…a_m-…-z_m-1a_m-z_m]P_B，

V＝[z₁a₂a₃…a_m+z₂a₃…a_m+…+z_m-1a_m+z_m]P_B+[-(c₁c₂…c_m)h]P_A)

Finally, S ═ T + V is calculated (by one of the M devices or by the other devices), then (h, S) is the digital signature for message M.

(where S is [ r ]₁r₂…r_m]P_U+[-c₁c₂…c_mh]P_A＝[(r₁r₂…r_m)u-h]d_A)

If the m-th device calculates S ═ T + V after T, V calculation is completed, then z is calculated in T, V_mIs allowed to be 0 or [1, n-1 ]]The integer constant in (of course, random integer is not a problem).

Examples 4,

Example 4 differs from example 3 in that c₁Is non-secret and takes the value of 1 or other [1, n-1 ]]Of (1) and (others in [1, n-1 ]]Of a subjectively arbitrary or randomly selected integer), P_AIt is not disclosed that device number 1 holds as a secret (of course if P_U＝P_AThen P is_UAlso not disclosed, is also held as a secret by device No. 1), and P_B≠P_AAnd others are unchanged.

Examples 5,

This embodiment has two devices numbered 1 and 2, device number 1 holding [1, n-1 [ ]]Integer secret c within interval₁Device No. 2 stores [1, n-1 ]]Integer secret c within interval₂Where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TThe order of (is a prime number);

(initialization phase) pre-calculated are:

P_A＝[c^-1]d_Awherein d is_AIdentify the private key for the user's SM9, c^-1Modulo n multiplication inverse of c, c ═ c₁c₂) mod n is an integer secret that neither device holds;

P_U＝[u]d_Awhere u is [1, n-1 ] which neither device holds]Integer secrets within the interval;

u and c^-1Need not be different (different or the same);

g_Ug ^ u, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ u)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

get P_B＝P_A；

Neither device stores d_A；

When it is desired to use the user's SM9 to identify the private key d_ANumbering for messages MWhen signing, two devices obtain w-g through interactive calculation_U^(r₁r₂) Wherein r is₁The No. 1 device is in [1, n-1 ] in the calculation process]Randomly selected integer within the interval, r₂The No. 2 device is in [1, n-1 ] in the calculation process]Randomly selected integers within the interval;

then, H ═ H is calculated (by one of the two devices or the other device)₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not (one or other of the two devices), and if w is equal to g ^ h, the two devices perform calculation of w again until w is not equal to g ^ h;

then, the two devices are calculated according to the T, V collaborative calculation method II

T＝[r₁r₂]P_U+[-F(z₁,z₂)]P_B，V＝[F(z₁,z₂)]P_B+[-c₁c₂h]P_ANamely:

calculating to obtain Q₁＝[(r₂)^-1a₂]P_BTaking Q₂＝P_B；

Calculated to obtain d₁＝(a₂(c₂)^-1) mod n, take d₂＝1；

Wherein, a₂For the calculation process, the number 2 device is in [1, n-1 ]]Randomly selected integers in the sequence (1);

get T₀＝P_U，v₀＝-h；

Device No. 1 is in [1, n-1 ]]In the random selection of an integer z₁Calculating T₁＝[r₁]T₀+[-z₁]Q₁，v₁＝(z₁d₁+c₁v₀) mod n, will T₁、v₁To device No. 2;

device number 2 receives T₁、v₁Then, if T is found by inspection₁If it is zero, error is reported, otherwiseIn [1, n-1 ]]In the random selection of an integer z₂Calculating T₂＝[r₂]T₁+[-z₂]Q₂，v₂＝(z₂d₂+c₂v₁)mod n；

Taking T as T₂(one of the two devices or the other) calculates V ═ V₂]P_ACompleting T, V calculation;

(when T ═ r [ r ]₁r₂]P_U+[-z₁a₂-z₂]P_B，V＝[z₁a₂+z₂]P_B+[-(c₁c₂)h]P_A)

Finally, S ═ T + V is calculated (by one of the two devices or the other device), then (h, S) is the digital signature for message M.

(where S is [ r ]₁r₂]P_U+[-c₁c₂h]P_A＝[(r₁r₂)u-h]d_A)

If V ═ V is calculated by device No. 2₂]P_AAnd S ═ T + V is calculated by device No. 2 after T, V calculation is complete, then z is calculated in T, V calculation process₂Is allowed to be 0 or [1, n-1 ]]Is (1, n-1) constant (of course)]Random integers within are not problematic).

Examples 6,

Example 6 differs from example 5 in that c₂Is non-secret and takes the value of 1 or other [1, n-1 ]]Of (1) and (others in [1, n-1 ]]Of a subjectively arbitrary or randomly selected integer), P_U≠P_A(i.e., u and c)^-1Different from each other), P_ANot publicly held by device No. 2 as a secret (of course P)_BAlso not disclosed), V ═ V is calculated by the device No. 2₂]P_AAnd others are unchanged.

Example 7,

This example has m devices numbered 1, 2, …, respectively, through m ≧ 2, where device # i holds [1, n-1]Integer secret c within interval_iI is 1, …, m, where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TThe order of (is a prime number);

(initialization phase) pre-calculated are:

P_A＝[c^-1]d_Awherein d is_AIdentify the private key for the user's SM9, c^-1Modulo n multiplication inverse of c, c ═ c₁c₂…c_m) modn is an integer secret that is not held by any of the m devices;

P_U＝[u]d_Awhere u is [1, n-1 ] where none of the m devices is stored]Integer secrets within the interval;

u and c^-1Need not be different (different or the same);

g_Ug ^ u, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ u)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

get P_B＝P_A；

None of the m devices store d_A；

When it is desired to use the user's SM9 to identify the private key d_AWhen a digital signature is performed on a message M, M devices firstly obtain w ═ g through interactive calculation_U^(r₁r₂…r_m) Wherein r is_iThe device No. i is in [1, n-1 ] in the calculation process]Randomly selected integer in the interval, i ═ 1, …, m;

then, H ═ H is calculated (by one of the m devices or the other device)₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not (one or other of the m devices), and if w is equal to g ^ h, the m devices perform calculation of w again until w is not equal to g ^ h;

then, the m devices are obtained by calculation according to the T, V collaborative calculation method II

T＝[r₁r₂…r_m]P_U+[-F(z₁,z₂,…,z_m)]P_B，

V＝[F(z₁,z₂,…,z_m)]P_B+[-c₁c₂…c_mh]P_ANamely:

calculating to obtain Q₁＝[(r₂r₃…r_m)^-1(a₂a₃…a_m)]P_B，Q₂＝[(r₃…r_m)^-1(a₃…a_m)]P_B，…，Q_m-1＝[(r_m)^-1a_m]P_BTaking Q_m＝P_B；

Calculated to obtain d₁＝((a₂a₃…a_m)(c₂c₃…c_m)^-1)mod n，d₂＝((a₃…a_m)(c₃…c_m)^-1)modn，…，d_m-1＝(a_m(c_m)^-1) mod n, take d_m＝1；

Wherein, a_iFor the calculation process, the device No. i is in [1, n-1 ]]Wherein i is 2, …, m;

get T₀＝P_U，v₀＝-h；

Device No. 1 is in [1, n-1 ]]In the random selection of an integer z₁Calculating T₁＝[r₁]T₀+[-z₁]Q₁，v₁＝(z₁d₁+c₁v₀) mod n, will T₁、v₁To device No. 2;

device i receives T_i-1、v_i-1When i is 2, …, m, if T is found by examination_i-1If it is zero, error is reported, otherwise, it is in [1, n-1 ]]In the random selection of an integer z_iCalculating T_i＝[r_i]T_i-1+[-z_i]Q_i，v_i＝(z_id_i+c_iv_i-1)mod n；

If i is equal to m, then T is equal to T_m(one or other of the m devices) calculates V ═ V_m]P_AT, V calculation is completed, otherwise, device number i will T_i、v_iTransmitting to the device No. i +1 until T is completed_m、v_mCalculating;

(when T ═ r [ r ]₁r₂…r_m]P_U+[-z₁a₂a₃…a_m-z₂a₃…a_m-…-z_m-1a_m-z_m]P_B，

V＝[z₁a₂a₃…a_m+z₂a₃…a_m+…+z_m-1a_m+z_m]P_B+[-(c₁c₂…c_m)h]P_A)

Finally, S ═ T + V is calculated (by one of the M devices or by the other devices), then (h, S) is the digital signature for message M.

(where S is [ r ]₁r₂…r_m]P_U+[-c₁c₂…c_mh]P_A＝[(r₁r₂…r_m)u-h]d_A)

If V ═ V is calculated by the m-th device_m]P_AAnd S ═ T + V is calculated by device m after T, V calculation is complete, then z is calculated T, V in the process of calculation_mIs allowed to be 0 or [1, n-1 ]]Is (1, n-1) constant (of course)]Random integers within are not problematic).

Example 8,

Example 8 differs from example 7 in that c_mIs non-secret and takes the value of 1 or other [1, n-1 ]]Of (1) and (others in [1, n-1 ]]Of a subjectively arbitrary or randomly selected integer), P_U≠P_A(i.e., u and c)^-1Different from each other), P_ANot publicly held by the m-th device as a secret (of course P)_BAlso not disclosed), V ═ V is calculated by the m-th device_m]P_AAnd others are unchanged.

Examples 9,

This embodiment has two devices numbered 1 and 2, device number 1 holding [1, n-1 [ ]]Integer secret c within interval₁Device No. 2 stores [1, n-1 ]]Integer secret c within interval₂Where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TThe order of (is a prime number);

(initialization phase) pre-calculated are:

P_A＝[c^-1]d_Awherein d is_AIdentify the private key for the user's SM9, c^-1Modulo n multiplication inverse of c, c ═ c₁c₂) mod n is an integer secret that neither device holds;

P_U＝[u]d_Awhere u is [1, n-1 ] which neither device holds]Integer secrets within the interval;

u and c^-1Need not be different (different or the same);

g_Ug ^ u, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ u)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

get P_B＝P_U；

Neither device stores d_A；

When it is desired to use the user's SM9 to identify the private key d_AWhen the message M is digitally signed, the two devices obtain w-g through interactive calculation_U^(r₁r₂) Wherein r is₁The No. 1 device is in [1, n-1 ] in the calculation process]Randomly selected integer within the interval, r₂The No. 2 device is in [1, n-1 ] in the calculation process]Randomly selected integers within the interval;

then, H ═ H is calculated (by one of the two devices or the other device)₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not (one or other of the two devices), and if w is equal to g ^ h, the two devices perform calculation of w again until w is not equal to g ^ h;

then, the two devices are obtained by calculating according to the T, V collaborative calculation method

T＝[r₁r₂]P_U+[-F(z₁,z₂)]P_B，V＝[F(z₁,z₂)]P_B+[-c₁c₂h]P_ANamely:

q is obtained by calculation₁＝((r₂)^-1a₂) mod n, take q₂＝1；

Is calculated to obtain D₁＝[a₂(c₂)^-1]P_BTaking D₂＝P_B；

Wherein, a₂For the calculation process, the number 2 device is in [1, n-1 ]]Wherein i is 2, …, m;

get t₀＝1，V₀＝[-h]P_A；

Device No. 1 is in [1, n-1 ]]In the random selection of an integer z₁Calculating t₁＝(r₁t₀-z₁q₁)mod n，V₁＝[z₁]D₁+[c₁]V₀Will t₁、V₁To device No. 2;

device number 2 receives t₁、V₁Then, if t is found by inspection₁If 0, an error is reported, otherwise, the error is in [1, n-1 ]]In the random selection of an integer z₂Calculating t₂＝(r₂t₁-z₂q₂)mod n，V₂＝[z₂]D₂+[c₂]V₁；

(one or other of the two devices) calculates T ═ T₂]P_BTaking V as V₂；

(when T ═ r [ r ]₁r₂]P_U+[-z₁a₂-z₂]P_B，V＝[z₁a₂+z₂]P_B+[-(c₁c₂)h]P_A)

Finally, S ═ T + V is calculated (by one of the two devices or the other device), then (h, S) is the digital signature for message M.

(where S is [ r ]₁r₂]P_U+[-c₁c₂h]P_A＝[(r₁r₂)u-h]d_A)

If T ═ T is calculated by device No. 2₂]P_BAnd S ═ T + V is calculated by device No. 2 after T, V calculation is complete, then z is calculated in T, V calculation process₂Is allowed to be 0 or [1, n-1 ]]Is (1, n-1) constant (of course)]Random integers within are not problematic).

Examples 10,

Example 10 differs from example 9 in that c₁Is non-secret and takes the value of 1 or other [1, n-1 ]]Of (1) and (others in [1, n-1 ]]Of a subjectively arbitrary or randomly selected integer), P_B≠P_A(i.e. P)_U≠P_AU and c^-1Different from each other), P_AThe secret is not disclosed to be held by the device No. 1, and the others are not changed.

Examples 11,

This example has m devices numbered 1, 2, …, respectively, through m ≧ 2, where device # i holds [1, n-1]Integer secret c within interval_iI is 1, …, m, where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TThe order of (is a prime number);

(initialization phase) pre-calculated are:

P_A＝[c^-1]d_Awherein d is_AIdentify the private key for the user's SM9, c^-1Modulo n multiplication inverse of c, c ═ c₁c₂…c_m) modn is an integer secret that is not held by any of the m devices;

P_U＝[u]d_Awhere u is [1, n-1 ] where none of the m devices is stored]Integer secrets within the interval;

u and c^-1Need not be different (different or the same);

g_Ug ^ u, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ u)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

get P_B＝P_U；

None of the m devices store d_A；

When it is desired to use the user's SM9 to identify the private key d_AWhen a digital signature is performed on a message M, M devices firstly obtain w ═ g through interactive calculation_U^(r₁r₂…r_m) Wherein r is_iThe device No. i is in [1, n-1 ] in the calculation process]Randomly selected integer in the interval, i ═ 1, …, m;

then, H ═ H is calculated (by one of the m devices or the other device)₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not (one or other of the m devices), and if w is equal to g ^ h, the m devices perform calculation of w again until w is not equal to g ^ h;

then, the m devices are obtained by calculation according to the T, V collaborative calculation method III

T＝[r₁r₂…r_m]P_U+[-F(z₁,z₂,…,z_m)]P_B，

V＝[F(z₁,z₂,…,z_m)]P_B+[-c₁c₂…c_mh]P_ANamely:

q is obtained by calculation₁＝((r₂r₃…r_m)^-1(a₂a₃…a_m))mod n，q₂＝((r₃…r_m)^-1(a₃…a_m))modn，…，q_m-1＝((r_m)^-1a_m) mod n, take q_m＝1；

Is calculated to obtain D₁＝[(a₂a₃…a_m)(c₂c₃…c_m)^-1]P_B，D₂＝[(a₃…a_m)(c₃…c_m)^-1]P_B，…，D_m-1＝[a_m(c_m)^-1]P_BTaking D_m＝P_B；

Wherein, a_iFor the calculation process, the device No. i is in [1, n-1 ]]Wherein i is 2, …, m;

get t₀＝1，V₀＝[-h]P_A；

Device No. 1 is in [1, n-1 ]]In the random selection of an integer z₁Calculating t₁＝(r₁t₀-z₁q₁)mod n，V₁＝[z₁]D₁+[c₁]V₀Will t₁、V₁To device No. 2;

the device No. i receives t_i-1、V_i-1When i is 2, …, m, if t is found by examination_i-1If 0, an error is reported, otherwise, the error is in [1, n-1 ]]In the random selection of an integer z_iCalculating t_i＝(r_it_i-1-z_iq_i)mod n，V_i＝[z_i]D_i+[c_i]V_i-1；

If i is m, T is calculated (one or other of m devices)_m]P_BTaking V as V_mT, V calculation is completed, otherwise, device number i will T_i、V_iTransmitting to the device No. i +1 until T is completed_m、V_mCalculating;

(when T ═ r [ r ]₁r₂…r_m]P_U+[-z₁a₂a₃…a_m-z₂a₃…a_m-…-z_m-1a_m-z_m]P_B，

V＝[z₁a₂a₃…a_m+z₂a₃…a_m+…+z_m-1a_m+z_m]P_B+[-(c₁c₂…c_m)h]P_A)

Finally, S ═ T + V is calculated (by one of the M devices or by the other devices), then (h, S) is the digital signature for message M.

(where S is [ r ]₁r₂…r_m]P_U+[-c₁c₂…c_mh]P_A＝[(r₁r₂…r_m)u-h]d_A)

If T ═ T is calculated by the m-th device_m]P_BAnd S ═ T + V is calculated by device m after T, V calculation is complete, then z is calculated T, V in the process of calculation_mIs allowed to be 0 or [1, n-1 ]]Is (1, n-1) constant (of course)]Random integers within are not problematic).

Examples 12,

Example 12 differs from example 11 in that c₁Is non-secret and takes the value of 1 or other [1, n-1 ]]Of (1) and (others in [1, n-1 ]]Of a subjectively arbitrary or randomly selected integer), P_B≠P_A(i.e. P)_U≠P_AU and c^-1Different from each other), P_AThe secret is not disclosed to be held by the device No. 1, and the others are not changed.

In each of the above embodiments 1-12, if it is not checked whether w is equal to g ^ h or not during the calculation, after S is obtained by calculation, if S is found to be zero by checking, m devices perform the cooperative calculation again until S is not zero.

In the above examples 1-12, m devices calculated w ═ g_U^(r₁r₂…r_m) The method of (1) comprises (not all possible ways):

device No. 1 calculates g₁＝g_U^r₁G is mixing₁Transmitting device No. 2;

the device No. i receives g_i-1Then i is 2, …, m, and calculatedg_i＝g_i-1^r_i；

If i is m, then w is g_mFinish the calculation, otherwise, the device No. i will g_iTransmitting to the device No. i + 1;

alternatively, the first and second electrodes may be,

device m calculates g_m＝g_U^r_mG is mixing_mTransmitting the m-1 device;

the ith device receives g_i+1Then, i ═ m-1, …,1, calculate g_i＝g_i+1^r_i；

If i is 1, then w is g₁Finish the calculation, otherwise, the device No. i will g_iTo the device No. i-1.

For the above examples 1-4, m devices were calculated as described above

Q₁＝[(r₂r₃…r_m)^-1(a₂a₃…a_m)]P_B，Q₂＝[(r₃…r_m)^-1(a₃…a_m)]P_B，…，Q_m-1＝[(r_m)^-1a_m]P_B，

And D₁＝[(a₂a₃…a_m)(c₂c₃…c_m)^-1]P_B，D₂＝[(a₃…a_m)(c₃…c_m)^-1]P_B，…，D_m-1＝[a_m(c_m)^-1]P_BOne of the three schemes of (1) calculates Q₁，Q₂，…，Q_m-1And D₁，D₂，…，D_m-1。

For the above examples 5-8, m devices were calculated as described above

Q₁＝[(r₂r₃…r_m)^-1(a₂a₃…a_m)]P_B，Q₂＝[(r₃…r_m)^-1(a₃…a_m)]P_B，…，Q_m-1＝[(r_m)^-1a_m]P_B，

And d₁＝((a₂a₃…a_m)(c₂c₃…c_m)^-1)mod n，d₂＝((a₃…a_m)(c₃…c_m)^-1)mod n，…，d_m-1＝(a_m(c_m)^-1) mod n method calculates Q₁，Q₂，…，Q_m-1And d and₁，d₂，…，d_m-1。

for the above examples 1-12, m devices were calculated as described above

q₁＝((r₂r₃…r_m)^-1(a₂a₃…a_m))mod n，q₂＝((r₃…r_m)^-1(a₃…a_m))mod n，…，q_m-1＝((r_m)^-1a_m)mod n

And D₁＝[(a₂a₃…a_m)(c₂c₃…c_m)^-1]P_B，D₂＝[(a₃…a_m)(c₃…c_m)^-1]P_B，…，D_m-1＝[a_m(c_m)^-1]P_BIs calculated to obtain q₁，q₂，…，q_m-1And D₁，D₂，…，D_m-1。

In the above embodiment, if there are m devices [1, n-1 ] respectively]Integer secret c within interval₁，c₂,…,c_mThen, an initialization method in the initialization stage is as follows:

knowing d_AIn [1, n-1 ]]Randomly selecting m integers as c in the interval₁，c₂,…,c_mDelivering the data to m devices for secret storage;

calculating P_A＝[c^-1]d_AWherein c is^-1Is of cInverse modulo n multiplication, c ═ c₁c₂…c_m) mod n is an integer secret that is not held by all m devices;

calculating P_U＝[u]d_AWhere u is known to be d_AIn [1, n-1 ]]Randomly selected integers within the interval;

calculate g_UG ^ u, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ u)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

in group G₁Optionally a user private key d_AOther non-zero elements P_B(stationary election, e.g. stationary election P_B＝P₁Either subjectively chosen arbitrarily or randomly chosen, e.g. at [1, n-1 ]]Randomly selecting an integer b, and calculating P_B＝[b]P₁Or P_B＝[b]d_A)；

Then, P is added_U、P_B、P_A、g_UAnd (4) turning to a device needing to be used, and destroying c and u.

In the above embodiment, if P_B＝P_AThen d is known in the initialization phase_AMeans for selecting P_B＝P_A。

In the above embodiment, if P_U＝P_BThen d is known in the initialization phase_AMeans for selecting P_U＝P_B。

In the above examples, if c₁Is taken to be 1 or other [1, n-1 ]]Is not secret, then in an initialization phase c₂,…,c_mIs selected as [1, n-1 ]]And delivered to No. 2, …, device No. m for storage.

In the above examples, if c_mIs taken to be 1 or other [1, n-1 ]]Is not secret, then in an initialization phase c₁,…,c_m-1Is selected as [1, n-1 ]]Of random selectionIntegers are delivered to the No. 1, …, and the m-1 device for storage.

In the above embodiments, taking P if it occurs_B≠P_AIn the case of (1), then in the initialization phase at [1, n-1 ]]Randomly selecting an integer b other than 1, and calculating P_B＝[b]d_A。

In the above embodiments, taking P if it occurs_U≠P_A(i.e., u and c)^-1Different) then in the initialization phase at [1, n-1 ]]Internally randomly selecting a non-c^-1U, then P is calculated_U＝[u]d_A。

According to the SM9 digital signature collaborative generation method by means of the intermediate parameters, an SM9 digital signature collaborative generation system can be constructed, wherein the system comprises m devices which are respectively marked as No. 1, No. 2 and No. …, and m is more than or equal to 2; device No. i holds [1, n-1 ]]Integer secret c within interval_iI is 1, …, m; when it is desired to use the user's SM9 to identify the private key d_AWhen the message M is digitally signed, the M devices generate the digital signature for the message M by implementing the SM9 digital signature collaborative generation method by means of the intermediate parameter, including implementing the foregoing embodiments 1 to 12.

Other specific technical implementations not described are well known to those skilled in the relevant art and will be apparent to those skilled in the relevant art.

Claims (10)

1. An SM9 digital signature collaborative generation method by means of intermediate parameters is characterized in that:

the method involves m devices numbered 1, 2, …, respectively, up to m, where m is greater than or equal to 2;

device No. i holds [1, n-1 ]]Integer secret c within interval_iI is 1, …, m, where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TThe order of (1);

the method comprises the following steps:

P_A＝[c^-1]d_Awherein d is_AIdentify the private key for the user's SM9, c^-1Modulo n multiplication inverse of c, c ═ c₁c₂…c_m)mod n is an integer secret that is not held by all m devices;

P_U＝[u]d_Awhere u is [1, n-1 ] where none of the m devices is stored]Integer secrets within the interval;

u and c^-1Do not have to be different;

g_Ug ^ u, where ^ is an exponentiation, g ^ e (P)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs a master public key;

in group G₁Optionally a user private key d_AOther non-zero elements P_B；

None of the m devices store d_A；

When it is desired to use the user's SM9 to identify the private key d_AWhen a digital signature is performed on a message M, M devices generate digital signatures as follows:

firstly, m devices obtain w ═ g through interactive calculation_U^(r₁r₂…r_m) Wherein r is_iThe device No. i is in [1, n-1 ] in the calculation process]Randomly selected integer in the interval, i ═ 1, …, m;

then, H is calculated as H₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not, if w is equal to g ^ h, the m devices carry out calculation of w again until w is not equal to g ^ h;

then, m devices cooperatively calculate T ═ r₁r₂…r_m]P_U+[-F(z₁,z₂,…,z_m)]P_B，V＝[F(z₁,z₂,…,z_m)]P_B+[-c₁c₂…c_mh]P_AWherein r is₁,r₂,…,r_mRespectively, No. 1, No. 2, …, No. m device in the process of calculating w is in [1, n-1 ]]Is an integer selected from₁,z₂,…,z_mRespectively No. 1, No. 2, No. …, No. m device is in [1, n-1 ] during calculation of T, V]In the random selectionIs an integer of (a), (b) is (c), F (z)₁,z₂,…,z_m) Is directed to z₁,z₂,…,z_mThe following calculation formula:

F(z₁,z₂,…,z_m)≡z₁a₂a₃…a_m+z₂a₃…a_m+…+z_m-1a_m+z_m(mod n)；

wherein, a_iFor the calculation of T, V, device number i is at [1, n-1 ]]Wherein i is 2, …, m;

finally, calculating S ═ T + V, (h, S) is a digital signature for message M.

2. The method of claim 1 for collaborative generation of a SM9 digital signature with the aid of intermediate parameters, wherein:

if not checking whether w is equal to g ^ h or not in the calculation process, after S is obtained through calculation, if S is found to be zero element through checking, the m devices carry out cooperative calculation again until S is not zero element.

3. The method of claim 1 for collaborative generation of a SM9 digital signature with the aid of intermediate parameters, wherein:

m devices calculate w ═ g_U^(r₁r₂…r_m) The method comprises the following steps:

device No. 1 calculates g₁＝g_U^r₁G is mixing₁Transmitting device No. 2;

the device No. i receives g_i-1Then i 2, …, m, calculate g_i＝g_i-1^r_i；

If i is m, then w is g_mFinish the calculation, otherwise, the device No. i will g_iTransmitting to the device No. i + 1;

alternatively, the first and second electrodes may be,

device m calculates g_m＝g_U^r_mG is mixing_mTransmitting the m-1 device;

the ith device receives g_i+1To the end, i ═ m-1, …,1, countCalculating g_i＝g_i+1^r_i；

If i is 1, then w is g₁Finish the calculation, otherwise, the device No. i will g_iTo the device No. i-1.

4. The method of claim 1 for collaborative generation of a SM9 digital signature with the aid of intermediate parameters, wherein:

the m devices cooperatively calculate to obtain T ═ r₁r₂…r_m]P_U+[-F(z₁,z₂,…,z_m)]P_B，V＝[F(z₁,z₂,…,z_m)]P_B+[-c₁c₂…c_mh]P_AOne method of (2) is as follows:

calculating to obtain Q₁＝[(r₂r₃…r_m)^-1(a₂a₃…a_m)]P_B，Q₂＝[(r₃…r_m)^-1(a₃…a_m)]P_B，…，Q_m-1＝[(r_m)^{- 1}a_m]P_BTaking Q_m＝P_B；

Is calculated to obtain D₁＝[(a₂a₃…a_m)(c₂c₃…c_m)^-1]P_B，D₂＝[(a₃…a_m)(c₃…c_m)^-1]P_B，…，D_m-1＝[a_m(c_m)^-1]P_BTaking D_m＝P_B；

Wherein, a_iFor the calculation process, the device No. i is in [1, n-1 ]]Wherein i is 2, …, m;

get T₀＝P_U，V₀＝[-h]P_A；

Device No. 1 is in [1, n-1 ]]In the random selection of an integer z₁Calculating T₁＝[r₁]T₀+[-z₁]Q₁，V₁＝[z₁]D₁+[c₁]V₀Will T₁、V₁To device No. 2;

device i receives T_i-1、V_i-1When i is 2, …, m, if T is found by examination_i-1If it is zero, error is reported, otherwise, it is in [1, n-1 ]]In the random selection of an integer z_iOr take z_i＝a_iCalculating T_i＝[r_i]T_i-1+[-z_i]Q_i，V_i＝[z_i]D_i+[c_i]V_i-1；

If i is equal to m, then T is equal to T_m，V＝V_mT, V calculation is completed, otherwise, device number i will T_i、V_iTransmitting to the device No. i +1 until T is completed_m、V_mCalculating;

if S ═ T + V is calculated by the mth device after the T, V calculation is completed, z is_mIs allowed to be 0 or [1, n-1 ]]An integer constant of (1);

if P_ANot publicly held by device No. 1 as a secret, P_B≠P_AThen c will be₁As non-secret, the above-described method of computing T, V and the above-described method of cooperative generation of SM9 digital signatures with intermediate parameters still hold.

5. The method of claim 1 for collaborative generation of a SM9 digital signature with the aid of intermediate parameters, wherein:

if P_B＝P_AAnd then m devices cooperatively calculate to obtain T ═ r₁r₂…r_m]P_U+[-F(z₁,z₂,…,z_m)]P_B，V＝[F(z₁,z₂,…,z_m)]P_B+[-c₁c₂…c_mh]P_AOne method of (2) is as follows:

calculating to obtain Q₁＝[(r₂r₃…r_m)^-1(a₂a₃…a_m)]P_B，Q₂＝[(r₃…r_m)^-1(a₃…a_m)]P_B，…，Q_m-1＝[(r_m)^{- 1}a_m]P_BTaking Q_m＝P_B；

Calculated to obtain d₁＝((a₂a₃…a_m)(c₂c₃…c_m)^-1)mod n，d₂＝((a₃…a_m)(c₃…c_m)^-1)mod n，…，d_m-1＝(a_m(c_m)^-1) mod n, take d_m＝1；

Wherein, a_iFor the calculation process, the device No. i is in [1, n-1 ]]Wherein i is 2, …, m;

get T₀＝P_U，v₀＝-h；

Device No. 1 is in [1, n-1 ]]In the random selection of an integer z₁Calculating T₁＝[r₁]T₀+[-z₁]Q₁，v₁＝(z₁d₁+c₁v₀) mod n, will T₁、v₁To device No. 2;

device i receives T_i-1、v_i-1When i is 2, …, m, if T is found by examination_i-1If it is zero, error is reported, otherwise, it is in [1, n-1 ]]In the random selection of an integer z_iCalculating T_i＝[r_i]T_i-1+[-z_i]Q_i，v_i＝(z_id_i+c_iv_i-1)mod n；

If i is equal to m, then T is equal to T_mCalculating V ═ V_m]P_AT, V calculation is completed, otherwise, device number i will T_i、v_iTransmitting to the device No. i +1 until T is completed_m、v_mCalculating;

if V ═ V is calculated by the m-th device_m]P_AAnd S ═ T + V is calculated by the mth device after T, V calculation is completed, then z is_mIs allowed to be 0 or [1, n-1 ]]An integer constant of (1);

if P_ANot publicly held by device m as a secret, P_U≠P_AAnd is packaged by No. mSet calculation V ═ V_m]P_AThen c will be_mAs non-secret, the above-described method of computing T, V and the above-described method of cooperative generation of SM9 digital signatures with intermediate parameters still hold.

6. The method of claim 1 for collaborative generation of a SM9 digital signature with the aid of intermediate parameters, wherein:

if P_B＝P_UAnd then m devices cooperatively calculate to obtain T ═ r₁r₂…r_m]P_U+[-F(z₁,z₂,…,z_m)]P_B，V＝[F(z₁,z₂,…,z_m)]P_B+[-c₁c₂…c_mh]P_AOne method of (2) is as follows:

q is obtained by calculation₁＝((r₂r₃…r_m)^-1(a₂a₃…a_m))mod n，q₂＝((r₃…r_m)^-1(a₃…a_m))mod n，…，q_m-1＝((r_m)^-1a_m) mod n, take q_m＝1；

Is calculated to obtain D₁＝[(a₂a₃…a_m)(c₂c₃…c_m)^-1]P_B，D₂＝[(a₃…a_m)(c₃…c_m)^-1]P_B，…，D_m-1＝[a_m(c_m)^-1]P_BTaking D_m＝P_B；

Wherein, a_iFor the calculation process, the device No. i is in [1, n-1 ]]Wherein i is 2, …, m;

get t₀＝1，V₀＝[-h]P_A；

Device No. 1 is in [1, n-1 ]]In the random selection of an integer z₁Calculating t₁＝(r₁t₀-z₁q₁)mod n，V₁＝[z₁]D₁+[c₁]V₀Will t₁、V₁To device No. 2;

the device No. i receives t_i-1、V_i-1When i is 2, …, m, if t is found by examination_i-1If 0, an error is reported, otherwise, the error is in [1, n-1 ]]In the random selection of an integer z_iCalculating t_i＝(r_it_i-1-z_iq_i)mod n，V_i＝[z_i]D_i+[c_i]V_i-1；

If i equals m, then T equals T_m]P_BTaking V as V_mT, V calculation is completed, otherwise, device number i will T_i、V_iTransmitting to the device No. i +1 until T is completed_m、V_mCalculating;

if T ═ T is calculated by the m-th device_m]P_BAnd S ═ T + V is calculated by the mth device after T, V calculation is completed, then z is_mIs allowed to be 0 or [1, n-1 ]]An integer constant of (1);

if P_ANot publicly held by device No. 1 as a secret, P_B≠P_AThen c will be₁As non-secret, the above-described method of computing T, V and the above-described method of cooperative generation of SM9 digital signatures with intermediate parameters still hold.

7. The method of claim 4 for collaborative generation of SM9 digital signatures with the aid of intermediate parameters, wherein:

calculating to obtain Q₁＝[(r₂r₃…r_m)^-1(a₂a₃…a_m)]P_B，Q₂＝[(r₃…r_m)^-1(a₃…a_m)]P_B，…，Q_m-1＝[(r_m)^{- 1}a_m]P_B，

And D₁＝[(a₂a₃…a_m)(c₂c₃…c_m)^-1]P_B，D₂＝[(a₃…a_m)(c₃…c_m)^-1]P_B，…，D_m-1＝[a_m(c_m)^-1]P_BThe method comprises the following scheme:

the first scheme is as follows:

device No. m takes Q_m＝P_B，D_m＝P_BIn [1, n-1 ]]In the method, an integer a is randomly selected_mCalculating Q_m-1＝[(r_m)^-1a_m]Q_m，D_m-1＝[a_m(c_m)^-1]D_mIs mixing Q with_m-1、D_m-1Sending the data to the device No. m-1;

device i receives Q_i、D_iThen, if i is m-1, …,1, and if i is 1, the device No. 1 will Q₁、D₁Temporarily reserved, complete Q₁,Q₂,…,Q_m-1And D₁,D₂,…,D_m-1Otherwise, the device No. i is in [1, n-1 ]]In the method, an integer a is randomly selected_iCalculating Q_i-1＝[(r_i)^-1a_i]Q_i，D_i-1＝[a_i(c_i)^-1]D_iIs mixing Q with_i、D_iTemporarily reserve, Q_i-1、D_i-1Transmitting to the device No. i-1;

in calculating Q₁,Q₂,…,Q_m-1And D₁,D₂,…,D_m-1If the device No. i checks and finds the received Q_iOr D_iIf the number is zero, i is m-1, …,1, then an error is reported;

scheme II:

m devices by calculating Q₁,Q₂,…,Q_m-1And D₁,D₂,…,D_m-1Calculating and storing Q in the manner of scheme one₁,Q₂,…,Q_m-1；

Device number m gets d_m1 in [1, n-1 ]]In the method, an integer a is randomly selected_mCalculating d_m-1＝(a_m(c_m)^-1)d_m) mod n, d_m-1Sending the data to the device No. m-1;

no. i deviceReceive d_iThen, if i is m-1, …,1, and if i is 1, the No. 1 device calculates D₁＝[d₁]P_BD is₁Temporary Retention, complete D₁,D₂,…,D_m-1Otherwise, the device No. i calculates D_i＝[d_i]P_BIn [1, n-1 ]]In the method, an integer a is randomly selected_iCalculating d_i-1＝(a_i(c_i)^-1d_i) mod n, D_iTemporarily retaining d_i-1Transmitting to the device No. i-1;

in calculating Q₁,Q₂,…,Q_m-1And D₁,D₂,…,D_m-1If the device No. i checks and finds the received Q_iIs zero or d_iIf 0, i-m-1, …,1, an error is reported;

the third scheme is as follows:

m devices by calculating Q₁,Q₂,…,Q_m-1And D₁,D₂,…,D_m-1Calculating and storing in the manner of scheme one₁,D₂,…,D_m-1；

Device number m gets q_m1 in [1, n-1 ]]In the method, an integer a is randomly selected_mCalculating q_m-1＝((r_m)^-1a_mq_m) mod n, q_m-1Sending the data to the device No. m-1;

device i receives q_iThen, if i is m-1, …,1, and if i is 1, the No. 1 device calculates Q₁＝[q₁]P_BIs mixing Q with₁Temporarily reserved, complete Q₁,Q₂,…,Q_m-1Otherwise, the ith device calculates Q_i＝[q_i]P_BIn [1, n-1 ]]In the method, an integer a is randomly selected_iCalculating q_i-1＝((r_i)^-1a_iq_i) mod n, Q_iTemporarily reserving q_i-1Transmitting to the device No. i-1;

in the calculation of q₁,q₂,…,q_m-1And D₁,D₂,…,D_m-1In the process of (1), if the number i isThe device checks to find the received q_iIs 0 or D_iAnd if the number is zero, i is m-1, …,1, an error is reported.

8. The method of claim 5 for collaborative generation of SM9 digital signatures with the aid of intermediate parameters, wherein:

calculating to obtain Q₁＝[(r₂r₃…r_m)^-1(a₂a₃…a_m)]P_B，Q₂＝[(r₃…r_m)^-1(a₃…a_m)]P_B，…，Q_m-1＝[(r_m)^{- 1}a_m]P_B，

And d₁＝((a₂a₃…a_m)(c₂c₃…c_m)^-1)mod n，d₂＝((a₃…a_m)(c₃…c_m)^-1)mod n，…，d_m-1＝(a_m(c_m)^-1) One method of mod n is as follows:

device No. m takes Q_m＝P_B，d_m1 in [1, n-1 ]]In the method, an integer a is randomly selected_mCalculating Q_m-1＝[(r_m)^-1a_m]Q_m，d_m-1＝(a_m(c_m)^-1)d_m) mod n, Q_m-1、d_m-1Sending the data to the device No. m-1;

device i receives Q_i、d_iThen, if i is m-1, …,1, and if i is 1, the device No. 1 will Q₁、d₁Temporarily reserved, complete Q₁,Q₂,…,Q_m-1And d₁,d₂,…,d_m-1Otherwise, the device No. i is in [1, n-1 ]]In the method, an integer a is randomly selected_iCalculating Q_i-1＝[(r_i)^-1a_i]Q_i，d_i-1＝(a_i(c_i)^-1d_i) mod n, Q_i、d_iTemporarily reserve, Q_i-1、d_i-1Transmitting to the device No. i-1;

in calculating Q₁,Q₂,…,Q_m-1And d₁,d₂,…,d_m-1If the device No. i checks and finds the received Q_iIs zero or d_iIf 0, i-m-1, …,1, an error is reported.

9. The method of claim 6 wherein the SM9 digital signature collaborative generation with intermediate parameters comprises:

q is obtained by calculation₁＝((r₂r₃…r_m)^-1(a₂a₃…a_m))mod n，q₂＝((r₃…r_m)^-1(a₃…a_m))mod n，…，q_m-1＝((r_m)^-1a_m)mod n，

And D₁＝[(a₂a₃…a_m)(c₂c₃…c_m)^-1]P_B，D₂＝[(a₃…a_m)(c₃…c_m)^-1]P_B，…，D_m-1＝[a_m(c_m)^-1]P_BOne method of (2) is as follows:

device number m gets q_m＝1，D_m＝P_BIn [1, n-1 ]]In the method, an integer a is randomly selected_mCalculating q_m-1＝((r_m)^-1a_mq_m)mod n，D_m-1＝[a_m(c_m)^-1]D_mQ is prepared by_m-1、D_m-1Sending the data to the device No. m-1;

device i receives q_i、D_iThen, if i is m-1, …,1, and if i is 1, the device No. 1 will q₁、D₁Temporary reservation, complete q₁,q₂,…,q_m-1And D₁,D₂,…,D_m-1Otherwise, the device No. i is in [1, n-1 ]]In the method, an integer a is randomly selected_iCalculating q_i-1＝((r_i)^-1a_iq_i)mod n，D_i-1＝[a_i(c_i)^-1]D_iQ is prepared by_i、D_iTemporarily reserving q_i-1、D_i-1Transmitting to the device No. i-1;

in the calculation of q₁,q₂,…,q_m-1And D₁,D₂,…,D_m-1If the device No. i checks and finds the received q_iIs 0 or D_iAnd if the number is zero, i is m-1, …,1, an error is reported.

10. An SM9 digital signature cooperative generation system based on the SM9 digital signature cooperative generation method by means of intermediate parameters described in any one of claims 1 to 9, characterized in that:

the system comprises m devices respectively numbered from No. 1, No. 2 and No. …, wherein m is more than or equal to 2; device No. i holds [1, n-1 ]]Integer secret c within interval_iI is 1, …, m; when it is desired to use the user's SM9 to identify the private key d_AWhen the message M is digitally signed, the M devices generate the digital signature of the message M according to the SM9 digital signature collaborative generation method by means of the intermediate parameters.