CN114978549A

CN114978549A - SM2 digital signature generation method and system for signer to control signature making data

Info

Publication number: CN114978549A
Application number: CN202210577362.1A
Authority: CN
Inventors: 龙毅宏
Original assignee: Wuhan University of Technology WUT
Current assignee: Itruschina Co ltd
Priority date: 2022-05-25
Filing date: 2022-05-25
Publication date: 2022-08-30
Anticipated expiration: 2042-05-25
Also published as: CN114978549B

Abstract

The invention relates to an SM2 digital signature generation method, which comprises the following steps: the signature device has P _A ＝[d _A ]G, with secret c _A ＝E((1+d _A ) ^‑1 ) In which d is _A Signing a private key for SM2, wherein E (-) is homomorphic encryption operation, and a signature auxiliary system has a private key for decryption operation; when signing the message M, the signing device and the signing auxiliary system are in [1, n-1 ]]Internal random selection of integer k ₁ 、k ₂ Calculating Q ═ b ₁ k ₁ +b ₂ k ₂ ]G or Q ═ bk ₁ k ₂ ]G, wherein b ₁ 、b ₂ B is 1 or 1+ d _A N is the order of the base point G; calculating r ═ e + x using messages M and Q ₁ ) mod n; calculating by using homomorphic encryption operation to obtain s ═ k [ ((k) ] ₁ b ₁ +k ₂ b ₂ +r)(1+d _A ) ^‑1 -r) mod n or s ═ bk ₁ k ₂ +r)(1+d _A ) ^‑1 R) mod n, then (r, s) is the generated digital signature.

Description

SM2 digital signature generation method and system for signer to control signature making data

Technical Field

The invention belongs to the technical field of information security, and particularly relates to an SM2 digital signature generation method and system for controlling signature making data by a signer.

Background

SM2 is a class of elliptic curve public key cryptographic algorithms established and promulgated by the national crypto-administration, and is now the national standard (see GB/T32918.2-2016 (information Security technology SM2 elliptic curve public key cryptographic algorithm part 2: digital signature Algorithm)). Based on the algorithm, the digital signature, the key exchange and the data encryption can be realized, wherein the digital signature is briefly described as follows:

using the user's SM2 private key d _A When a digital signature is performed on a message M, r and s need to be calculated, where r ═ e + x ₁ ) mod n, where n is the order of the base point G of the SM2 elliptic curve point group, e is the hash value (i.e. hash value, hash value) derived from the subscriber identity and the message M (e is the hash value from the subscriber identity ID according to the SM2 algorithm _A Isoparametric derived hash value Z _A Hash value of data merged with message M, see SM2 specification), x ₁ Is taken from (x) ₁ ,y ₁ ) Q ═ k]G, wherein G is the base point of the SM2 elliptic curve point group; calculating s ═ 1+ d _A ) ^-1 k-r(1+d _A ) ^-1 d _A ) mod n, where k is [1, n-1 ]]An integer randomly selected within the interval, then (r, s) is the digital signature for message M (note that the notation used for mod n in the SM2 specification is mod n).

The security of the private signature key of a user is of utmost importance in digital signatures, and therefore, the private key should be generated, stored and used in specialized cryptographic hardware, usually for security reasons. However, for various reasons, it is often necessary or common to implement the SM2 digital signature algorithm in a pure software manner, where the private key of the user is not generated, stored and used in a special cryptographic hardware, but is stored in a permanent storage medium of a personal computing device (e.g., a personal computer, a mobile phone), and the private key is generated and used in an internal memory of the computing device, so that there is a risk that the private key is stolen or stolen. Aiming at the risk of stealing and stealing the signature private key existing in the implementation of the SM2 digital signature algorithm in a pure software mode, a series of SM2 digital signature collaborative generation methods based on secret sharing are proposed, in which the SM2 signature private key of a user or the secret of the signature private key is divided into two or more shares, namely secret shares, which are respectively stored and used in two or more computing devices, wherein one secret share is stored and used in the user computing device, and the other secret share or shares are stored and used in the computing device with high security protection level (such as a password server); when the message M needs to be digitally signed by using the private key of the SM2 of the user, two or more computing devices obtain the digital signature for the message M by using respective secret shares through secure cooperative computing, namely, the respective secret shares of each device cannot be leaked and cracked in the computing process.

The electronic signature method of the people's republic of China requires that electronic signature making data is only controlled by a signer when an electronic signature is generated, a private key or the secret of the private key is divided into a plurality of parts which are respectively stored by a plurality of computing devices and used when the digital signature is generated, and the secret is not completely in accordance with the requirement because other entities except a user master partial secret of the private key of the user, namely partial signature making data, namely the signature making data is not only controlled by the signer when the digital signature is generated, therefore, for implementing SM2 digital signature by adopting a non-hardware mode (such as pure software), the digital signature making data is only controlled by the signer when the digital signature is generated, the safety of the digital signature generating process is ensured, and the problem that the private key of the user signature is prevented from being leaked and cracked is solved.

Disclosure of Invention

The invention aims to solve the problem of implementation of an SM2 digital signature algorithm in a non-password hardware environment at a user side, and provides a safe SM2 digital signature generation technical scheme for effectively controlling signature making data by a signer so as to overcome the defects of the prior art.

Aiming at the purpose of the invention, the technical scheme provided by the invention comprises an SM2 digital signature generation method and a corresponding system for controlling signature making data by a signer.

In the following description of the present invention, when P, Q is an element (point) in an elliptic curve point group, P + Q represents a point addition of P, Q, and P-Q represents an inverse element of P plus Q, [ k ]]P represents the sum of k elliptic curve points P, i.e. P + P +. + P (total of k P, if k is negative, [ k ] k]Is the additive inverse of the result of the point addition of | k | elliptic curve points P); an ellipsis ". -" represents a plurality of identical (types of) data items or a plurality of identical operations; c. C ^-1 Representing the modulo n inverse of integer c (i.e., cc) ^-1 mod n ═ 1); unless otherwise specified, the multiplicative inverse in this patent application is the order for the SM2 elliptic curve point groupThe modulo n multiplication inverse of n (i.e., the order n of base point G); multiple integer multiplication (including integer symbol parameter, variable multiplication, constant and integer symbol parameter, variable multiplication), omitting multiplication sign ". cndot." such as k, without ambiguity ₁ ·k ₂ Simplified as k ₁ k ₂ 3 · c reduces to 3 c; mod n denotes the modulo n operation (modulo operation), corresponding to GB/T32918.2-2016 section 2 of the information Security technology SM2 elliptic curve public Key Cryptographic Algorithm: modn in digital signature Algorithm >; also, the operator mod n of the modulo n operation is of lowest priority, e.g., a + b mod n equals (a + b) mod n, a-b mod n equals (a-b) mod n, ab mod n equals (ab) mod n.

In an embodiment of the invention, s ═ will be calculated ((1+ d) _A ) ^-1 k-r(1+d _A ) ^-1 d _A ) mod n, converted to calculate s ═ 1+ d _A ) ^-1 (k+r)-r)mod n。

The SM2 digital signature generation method for controlling signature creation data by a signer of the present invention is specifically as follows.

The signature device has P _A ＝[d _A ]G, with secret c _A ＝E((1+d _A ) ^-1 ) In which d is _A Signing the private key for the user's SM2, G being the base point of the SM2 elliptic curve point group, P _A Signing the private key d for the user's SM2 _A Corresponding public key, (1+ d) _A ) ^-1 Is (1+ d) _A ) Modulo n multiplication inverse of (i.e., (1+ d) _A )(1+d _A ) ^-1 ) mod n is 1), n is the order of the base point G (i.e., the order of the SM2 elliptic curve point group), n is a prime number, and E (·) is an encryption operation using a homomorphic encryption algorithm;

the signing device is a signer, namely SM2 private signature key d _A The computing device of the owner of (1); the homomorphic encryption algorithm is an addition homomorphic encryption algorithm or a full homomorphic encryption algorithm; the signature assistance system has a private key of the decryption operation (private key of the homomorphic encryption algorithm) corresponding to the public key employed by the encryption operation E (-) of the homomorphic encryption algorithm, or the private key of the decryption operation corresponding to the public key employed by the encryption operation E (-) of the homomorphic encryption algorithm is encrypted by the secret key of the signature assistance system, wherein the secret key of the signature assistance system comprises a secret key of the signature assistance systemA secret key or a public key (wherein the public key includes a public key of a common public key cryptographic algorithm such as RSA, SM2, etc., or a group public key of a group cryptographic algorithm); the signature auxiliary system is a computing device or system for assisting and assisting the signature device to complete digital signature generation;

if the private key of the decryption operation corresponding to the public key adopted in the encryption operation E (-) of the homomorphic encryption algorithm is encrypted by the key of the signature auxiliary system, the signature device also has the ciphertext d of the private key of the decryption operation _E (symmetric or public key encryption with signature assistance system, d _E Not a secret, but may be a secret to a computing device, system other than the signature assistance system);

when it is desired to sign the private key d using the user's SM2 _A When digitally signing the message M, the signing device and the signature assistance system generate a digital signature for the message M as follows (the private key d needs to be signed using the SM2 of the user _A The subject of the digital signature on the message M may be an application, system, inside or outside the signing device, invoking the cryptographic functions of the signing device):

the signature device uses the message M to calculate r ═ e + x ₁ ) mod n hash value e (according to the SM2 algorithm, e is the slave user identification ID) _A Isoparametric derived hash value Z _A Hash value of the data merged with message M, see SM2 specification);

the signature device sends e to the signature auxiliary system;

signature devices in [1, n-1 ]]Randomly selecting an integer k in the interval ₁ ；

Signature assistance systems in [1, n-1 ]]Randomly selecting an integer k in the interval ₂ ；

Signature device and signature assistance system without exposing respective secret k ₁ 、k ₂ The following calculation is done in the case of (1):

signature device ensuring signature auxiliary system not reselect k ₂ In the case of (a), Q ═ b is obtained by mutual calculation with the signature assistance system ₁ k ₁ +b ₂ k ₂ ]G, wherein b ₁ 1 or (1+ d) _A )，b ₂ 1 or (1+ d) _A ) Wherein b is ₂ 1 only applies if the homomorphic encryption algorithm corresponding to E (·) is a fully homomorphic encryption algorithm (otherwise, s is calculated later ₁ The signature device cannot complete E (k) ₂ (1+d _A ) ^-1 ) An operation or calculation);

signature assistance system in ensuring that a signing device does not reselect k ₁ In the case of (2), Q is obtained by mutual calculation with a signature device _f ＝[b ₁ k ₁ +b ₂ k ₂ ]G；

The signature device and the signature support system check Q, Q separately _f Whether it is zero (point of infinity in the elliptic curve point group), if Q and/or Q _f Is zero, k is reselected ₁ 、k ₂ Recalculated Q, Q _f Up to Q and Q _f Is a non-zero element;

alternatively, the first and second liquid crystal display panels may be,

signature device and signature assistance system without exposing respective secrets k ₁ 、k ₂ The following calculation is done in the case of (1):

signature device ensuring signature auxiliary system does not reselect k ₂ In the case of (1), Q ═ bk is obtained by mutual calculation with the signature assistance system ₁ k ₂ ]G, wherein b is 1 or (1+ d) _A )；

Signature assistance system in ensuring that a signing device does not reselect k ₁ In the case of (2), Q is obtained by mutual calculation with a signature device _f ＝[bk ₁ k ₂ ]G；

If b is 1, then according to Q ═ bk ₁ k ₂ ]G、Q _f ＝[bk ₁ k ₂ ]Calculation Q, Q mode G _f Is only applicable when the homomorphic encryption algorithm corresponding to E (-) is a fully homomorphic encryption algorithm (otherwise, s is calculated later ₁ The signature device cannot complete E (k) ₁ k ₂ b(1+d _A ) ^-1 ) An operation or calculation);

the signature device calculates r ═ e + x ₁ ) mod n, where x ₁ Is taken from (x) ₁ ,y ₁ )＝Q；

Signature assistance System computation r _f ＝(e+x _1f )mod n, wherein x _1f Is taken from (x) _1f ,y _1f )＝Q _f ；

The signature device and the signature assistance system check whether (s + r) mod n is 0 and/or (s + r), respectively, present _f ) Case mod n is 0 (i.e. check if (k + r) mod n is 0 and/or (k + r) occurs _f ) mod n is 0), where s is the parameter s in the digital signature (r, s) to be computed, and if so, k is reselected ₁ 、k ₂ Recalculated Q, Q _f Recalculating r, r _f Until (s + r) mod n is not present 0 and/or (s + r) _f ) The case where mod n is 0; if (s + r) mod n is not 0 and/or (s + r) _f ) If mod n is 0, performing subsequent calculation processing;

the signature device calculates s in one of the following ways ₁ ：

s ₁ The first calculation method is as follows:

q is calculated as [ b ] ₁ k ₁ +b ₂ k ₂ ]G is calculated and b ₂ ＝(1+d _A )(s ₁ Calculation method one is only suitable for this case);

signature device using r, c _A 、k ₁ Calculated by homomorphic encryption algorithm

s ₁ ＝E(k ₁ b ₁ (1+d _A ) ^-1 +r(1+d _A ) ^-1 (mod n))；

(Note b) ₁ (1+d _A ) ^-1 Is either 1 or (1+ d) _A ) ^-1 According to b ₁ Calculation type with optimized value

s ₁ And a second calculation method:

q is calculated as [ b ] ₁ k ₁ +b ₂ k ₂ ]G is obtained by calculation;

if b is ₂ If 1, the homomorphic encryption algorithm corresponding to E (-) is a fully homomorphic encryption algorithm;

signature Assist System computation c ₂ ＝E(k ₂ ) C is mixing ₂ Sending the data to a signature device;

signature device using r, c _A 、k ₁ 、c ₂ Calculated by homomorphic encryption algorithm

s ₁ ＝E(k ₁ b ₁ (1+d _A ) ^-1 +k ₂ b ₂ (1+d _A ) ^-1 +r(1+d _A ) ^-1 (mod n))；

(Note b) ₁ (1+d _A ) ^-1 、b ₂ (1+d _A ) ^-1 Is either 1 or (1+ d) _A ) ^-1 According to b ₁ 、b ₂ Calculation type with optimized value

s ₁ And a third calculation mode:

q is calculated as [ bk ] ₁ k ₂ ]G is obtained by calculation;

if b is 1, the homomorphic encryption algorithm corresponding to E (-) is a fully homomorphic encryption algorithm;

s ₁ ＝E(k ₁ k ₂ b(1+d _A ) ^-1 +r(1+d _A ) ^-1 (mod n))；

(Note that b (1+ d) _A ) ^-1 Is either 1 or (1+ d) _A ) ^-1 And the calculation formula can be optimized according to the b value

Is calculated to obtain s ₁ Then, the signature device will s ₁ 、P _A Sending the signature to a signature auxiliary system;

if the private key of the decryption operation corresponding to the public key adopted by the encryption operation E (-) of the homomorphic encryption algorithm is encrypted by the key of the signature auxiliary system, the ciphertext of the private key is d _E Then the signature device will also d _E Sent to the signature assistance system, which decrypts d _E Obtaining a private key of the decryption operation (the private key of the homomorphic encryption algorithm, namely the private key for performing the decryption operation of the homomorphic encryption algorithm) corresponding to the public key adopted by the encryption operation E (-) of the homomorphic encryption algorithm;

for s ₁ Computing methodFirst, the signature assistance system calculates s as follows:

signature assisted system decryption s ₁ To obtain s ₁ Is given ₁₂ Calculating s ₂ ＝(s ₁₂ +k ₂ )mod n，s＝(s ₂ -r _f ) mod n, return s to the signing device; signature-assisted system verification of s before returning it to the signing device ₁₂ Whether or not to use k ₁ 、r _f And a public key P _A Corresponding private key d _A Calculated, or verified s ₂ Whether or not to use k ₁ 、k ₂ 、r _f And a public key P _A Corresponding private key d _A If the verification fails, error processing is carried out;

for s ₁ In the second and third calculation modes, the signature auxiliary system calculates s as follows:

signature assisted system decryption s ₁ To obtain s ₁ Is given ₁₂ Calculating s ₂ ＝s ₁₂ mod n，s＝(s ₂ -r _f ) mod n, return s to the signing device; signature-assisted system verification of s before returning it to the signing device ₂ Whether or not to use k ₁ 、k ₂ 、r _f And a public key P _A Corresponding private key d _A If the verification fails, error processing is carried out;

the signature device verifies whether s is use k ₁ 、k ₂ R and public key P _A Corresponding private key d _A Calculating according to the SM2 digital signature calculation mode, if the verification is passed, (r, s) is the digital signature of the message M, otherwise, switching to error processing;

(s＝((k ₁ b ₁ +k ₂ b ₂ +r)(1+d _A ) ^-1 -r) mod n or s ═ bk ₁ k ₂ +r)(1+d _A ) ^-1 -r)mod n)

In the above formula of the encryption operation E (·) using the homomorphic encryption algorithm, a (mod n), where a is an integer and represents an integer congruent with a modulo n (two integers a and b modulo n are congruent, i.e., a mod n ═ b mod n is represented by a ≡ b (mod n), and the (mod n) operator has the lowest priority);

the signature assistance system assists and assists the signing device in generating the digital signature (such as decrypting s) ₁ Preceding or calculating s ₂ Before), firstly, whether the user using the signature device, namely the signer is the public key P is identified and confirmed _A Is not authenticated here to confirm whether the user, i.e. the signer, is the public key P _A Corresponding private key d _A Owner of (a);

the signing device, namely a computing device owned by a signer, is a device (such as a personal computer, a mobile phone and other mobile terminals) which has computing capability and comprises software and hardware; the signature device implements the digital signature calculation and generation steps through a cryptographic module and a cryptographic program implemented in the signature device, and implements the SM2 digital signature function.

The SM2 digital signature generation method, the signature device and the signature assistance system for controlling signature creation data by the signer as described above do not expose own secret k ₁ 、k ₂ And ensuring that the other party does not reselect k ₁ 、k ₂ In the case of (1), Q ═ b is obtained by mutual calculation ₁ k ₁ +b ₂ k ₂ ]G、Q _f ＝[b ₁ k ₁ +b ₂ k ₂ ]One method of G is as follows:

f (-) is defined as: f (1) ═ G, F (1+ d) _A )＝(G+P _A )；

Signature device calculates Q ₁ ＝[k ₁ ]F(b ₁ ) Wherein b is ₁ 1 or (1+ d) _A ) Calculating Q ₁ Is a hash value of h ₁ (using any suitable hashing algorithm), and (h) is divided into ₁ Sending the signature to a signature auxiliary system;

signature assisted system computation Q ₂ ＝[k ₂ ]F(b ₂ ) Wherein b is ₂ 1 or (1+ d) _A ) Calculating Q ₂ Is a hash value of h ₂ H is to be ₂ Sending the data to a signature device;

h for signature device to receive signature auxiliary system ₂ Then, Q is added ₁ Sending the signature to a signature auxiliary system;

h for signature auxiliary system to receive signature device ₁ Then, Q is added ₂ Sending the data to a signature device;

the signature device receives Q ₂ Thereafter, the received Q is calculated and checked ₂ Whether the hash value of (a) is h ₂ If not, the error processing is carried out, and if so, Q is calculated to be Q ₁ +Q ₂ ；

Signature assisted system receive Q ₁ Thereafter, the received Q is calculated and checked ₁ Is h or not ₁ If not, the error processing is carried out, and if yes, Q is obtained through calculation _f ＝Q ₁ +Q ₂ 。

The above-described SM2 digital signature generation method in which the signer masters the signature creation data, the signature apparatus, and the signature support system do not expose their own secret k ₁ 、k ₂ And ensuring that the other party does not reselect k ₁ 、k ₂ In the case of (1), Q ═ bk is obtained by mutual calculation ₁ k ₂ ]G、Q _f ＝[bk ₁ k ₂ ]One method of G is as follows:

f (-) is defined as: f (1) ═ G, F (1+ d) _A )＝(G+P _A )；

b is 1 or (1+ d) _A )；

Signature device calculates Q ₁ ＝[k ₁ ]F, (b) calculating Q ₁ Is a hash value of h ₁ (using any suitable hashing algorithm), and (h) is divided into ₁ Sending the signature to a signature auxiliary system;

signature assisted system computation Q ₂ ＝[k ₂ ]F (b), calculating Q ₂ Is a hash value of h ₂ H is to be ₂ Sending the data to a signature device;

the signature device receives Q ₂ Thereafter, the received Q is calculated and checked ₂ Whether the hash value of (a) is h ₂ If, instead of the above-mentioned, the content is,then go to error process, if yes, calculate Q ═ k ₁ ]Q ₂ ；

Signature assistance System reception Q ₁ Thereafter, the received Q is calculated and checked ₁ Whether the hash value of (a) is h ₁ If not, the error processing is carried out, and if yes, Q is obtained through calculation _f ＝[k ₂ ]Q ₁ 。

For the above-described SM2 digital signature generation method in which the signer masters the signature creation data, the signature apparatus and the signature assistance system check whether (s + r) mod n ═ 0 and/or (s + r) will occur _f ) mod n equal to 0 (i.e., checking if (k + r) mod n equal to 0 and/or (k + r) would occur _f ) mod n ═ 0) as follows:

the signature device checks whether Q + [ r ] G is a zero element (an infinitely distant point of the SM2 elliptic curve point group), if so, a case where (s + r) mod n is 0 occurs, otherwise, no;

signature assisted system check Q _f +[r _f ]Whether G is zero (infinity point of SM2 elliptic curve point group), if so, (s + r) appears _f ) mod n is 0, otherwise it will not.

For the SM2 digital signature generation method described above in which the signer masters the signature creation data, the signature assistance system verifies s ₁₂ Whether or not to use k ₁ 、r _f And a public key P _A Corresponding private key d _A Calculated, or verified s ₂ Whether or not to use k ₁ 、k ₂ 、r _f And a public key P _A Corresponding private key d _A One method of calculation is as follows:

signature assisted system check verification Q ₁ +[r _f ]G and [(s) ₁₂ )mod n](G+P _A ) If equal, the verification passes (i.e., s) ₁₂ Is using k ₁ 、r _f And a public key P _A Corresponding private key d _A Calculated), otherwise, the verification fails;

alternatively, the first and second liquid crystal display panels may be,

signature assisted system check verification Q _f +[r _f ]G and [ s ] ₂ ](G+P _A ) Whether or not they are equal to each other, if so,the verification passes (i.e. s) ₂ Is using k ₁ 、k ₂ 、r _f And a public key P _A Corresponding private key d _A Calculated), otherwise, the verification fails.

In the above-described SM2 digital signature generation method in which the signer masters the signature creation data, the signature apparatus verifies whether s uses k ₁ 、k ₂ R and public key P _A Corresponding private key d _A One way to compute the digital signature in SM2 is as follows:

signature device check and verification Q + [ r ]]G and [ (s + r) mod n](G+P _A ) If they are equal, then the verification passes (i.e., s is using k) ₁ 、k ₂ R and public key P _A Corresponding private key d _A Calculated as the SM2 digital signature), otherwise, the verification fails.

For the SM2 digital signature generation method for controlling signature making data by a signer, a signature auxiliary system maintains a public key blacklist, and a public key P appearing on the blacklist _A The signature assistance system does not generate a digital signature for the corresponding private key.

In the SM2 digital signature generation method in which the signer manages the signature creation data, the signature support system authenticates and confirms whether or not the user who uses the signature apparatus, i.e., the signer, is the public key P _A There are many ways for the owner of (e.g. the user's public key P) _A In connection with the user's account binding on the signature assistance system, the user uses the signature assistance system to first complete the login (identity authentication) on the signature assistance system using the account name. In fact, there are other accounts and public keys P that do not require the user to sign the secondary system _A In the binding scheme, a user can log in the signature auxiliary system in an anonymous mode, but related authentication confirmation can still be realized, for example, the following scheme supports the authentication confirmation in the anonymous mode.

In the SM2 digital signature generation method in which the signer manages the signature creation data, the signature support system authenticates and confirms whether or not the user who uses the signature apparatus, i.e., the signer, is the public key P _A One method of owner of (1) is as follows:

at public key P _A Generated and contains the public key P _A The data combination of the identity authentication information of the user (namely the signer) forms the public key authentication information (the user identity authentication information is private data only known or owned by the public key and the private key owner, such as a seed key of a password and a dynamic password, biological characteristic verification information, or a mobile phone number, an e-mail address and the like for authentication, the user identity authentication information is strictly public key authentication information and is not identity authentication information because authentication confirmation does not need the name or account name of the user, and can be in an anonymous mode), the public key authentication information is encrypted by adopting a symmetric key of a signature auxiliary system and a symmetric key cryptographic algorithm to obtain encrypted public key authentication information, or the public key authentication information is encrypted by adopting a public key cryptographic algorithm to obtain signature encrypted public key authentication information, and the signature encryption comprises signature first and then encryption, or firstly encrypting and then signing, wherein the signature uses a private key of a public key registration system (the private key comprises private keys of common RSA, SM2 and the like and a group private key of a group cryptographic algorithm), and the encryption uses a public key of a signature auxiliary system (the public key comprises common RSA, SM2 public keys and a group public key of the group cryptographic algorithm); public key authentication information encrypted by adopting a symmetric key and public key authentication information encrypted by adopting a public key cryptographic algorithm signature are collectively called encrypted public key authentication information (the public key encryption can adopt a random symmetric key to encrypt data, and the public key encrypts a random symmetric key); the encrypted public key authentication information is stored in the signature device; the public key registration system is a system for performing registration management on a user public key;

when the signature auxiliary system needs to identify and confirm whether the user using the signature device, namely the signer, is the public key P _A When the owner of the signature device is in use, the signature device submits the encrypted public key authentication information to the signature auxiliary system;

the signature auxiliary system decrypts the encrypted public key identification information to obtain a plaintext of the public key identification information, wherein for the public key identification information encrypted by the signature, the signature auxiliary system needs to verify the validity of the digital signature, and the verification is continued after the verification is passed;

signature assistantThe auxiliary system checks the public key P contained in the public key authentication information obtained by decryption _A Whether it is the public key P currently used for digital signature generation verification _A (e.g., authentication s) ₁₂ Or s ₂ ) If not, error processing is carried out, and if yes, the operation is continued;

the signature auxiliary system obtains user identity authentication information from the public key authentication information obtained by decryption, then utilizes the user identity authentication information to authenticate the user of the signature device, namely the signer, if the user identity authentication is passed, the user using the signature device, namely the signer, is confirmed to be the public key P _A Otherwise authentication validation fails.

For the SM2 digital signature generation method in which the signer takes charge of signature creation data as described above, one generation method of the symmetric-key-encrypted public key authentication information or the signature-encrypted public key authentication information is as follows:

in the generation of P _A ，c _A Thereafter, the signing device (anonymously) submits P to the public key registry _A Application for registration P _A ；

Public key registration system check P _A Whether registered (for registered P) _A The public key registration system records), if registered, the registration is prompted, if not, the registration is continued;

the signature device proves possession of P to the public key registration system without exposing its own secret _A Corresponding private signature key d _A (i.e. proving that the user of the signing device is the private key d _A The owner of (a), i.e. the certifying and signing apparatus having c calculated in a agreed manner _A I.e. proving that the signing device has c _A Is E ((1+ d) _A ) ^-1 ) And P is _A ＝[d _A ]G, note c _A 、d _A The signature devices are all secret), subsequent operation is carried out after the certification is passed, and otherwise, error processing is carried out;

the signing device submits authentication information (such as private data for user authentication, such as password, dynamic password seed key, biometric verification information) for user authentication to the public key registration system, or for sendingVerifying the electronic communication address of the confirmation message, such as email address, mobile phone number), and then the public key registration system using the symmetric key of the signature assistance system and using the symmetric key cryptographic algorithm to pair the content P _A Encrypting the public key authentication information of the user identity authentication information to form encrypted public key authentication information, or using the private key of the public key registration system to perform the encryption on the public key authentication information containing P _A Signing the public key identification information of the user identity identification information, then encrypting the signed public key identification information by adopting a public key (including common public keys such as RSA, SM2 or group public keys) of a signature auxiliary system to obtain the public key identification information which is signed first and then encrypted, or adopting the public key of the signature auxiliary system to pair the public key containing P by a public key registration system _A And encrypting the public key identification information of the user identity identification information to obtain encrypted public key identification information, and then using a private key of the public key registration system to sign the encrypted public key identification information to obtain the public key identification information which is encrypted firstly and then signed.

For the above method for generating public key authentication information encrypted by a symmetric key or public key authentication information encrypted by a signature, the signature device periodically updates the encrypted public key authentication information.

As for the above method for generating the symmetric-key encrypted public key authentication information or the signature-encrypted public key authentication information, one method for the signature apparatus to update the encrypted public key authentication information is as follows:

the signature device submits the encrypted public key authentication information to the public key registration system (for example, in an anonymous way), and the public key registration system decrypts the encrypted public key authentication information, wherein if the encrypted public key authentication information is the signature encrypted public key authentication information, the public key registration system also verifies the validity of the digital signature contained in the signature encrypted public key authentication information, and continues after the verification is passed;

the public key registration system carries out identity authentication on the user of the signature device by using the user identity authentication information in the public key authentication information obtained by decryption, if the authentication is different, error processing is carried out, and if the authentication is passed, the operation is continued;

signatureDevice certifies possession of P to public key registration system without exposing its own secret _A Corresponding private signature key d _A (e.g. in accordance with public key P) _A The same way or a different way at registration);

signature device certifies possession of P to public key registration system _A Corresponding private signature key d _A Then, the signature device and the public key registration system are registered according to the registration P _A Generating new encrypted public key authentication information (usually updating user authentication information, P) in the same manner as generating encrypted public key authentication information _A Not changed, but the update method here allows updating P _A I.e., actually allows one public key authentication information to be used to generate another new public key authentication information), which includes both public key authentication information encrypted using a symmetric key and public key authentication information encrypted using a public key cryptographic algorithm signature.

If the user identity authentication information in the public key authentication information is a password, the public key registration system encrypts the public key authentication information or signs and encrypts the public key authentication information after confirming that the password meets the security requirement.

If the user identification information in the public key authentication information is a password and the public key authentication information includes a user electronic communication address (e.g., mailbox, mobile phone number, etc.), the public key registration system provides the user with a function of resetting or recovering the password in the public key authentication information through the user electronic communication address included in the public key authentication information (except for sending verification information to the electronic communication address, the password resetting or recovering process is similar to the update process of the public key authentication information).

For the above-described SM2 digital signature generation method in which the signer masters the signature creation data, P _A ＝[d _A ]G，c _A ＝E((1+d _A ) ^-1 ) The generation method comprises the following steps:

P _A 、c _A the generation method is as follows:

(e.g., by signer, initialization operator) signature device generation d _A Calculate P _A ＝[d _A ]G，c _A ＝E((1+d _A ) ^-1 ) Then pinned outD is broken down _A (the method is suitable for the situation that the signature device has a trusted computing or execution environment or has low security requirements);

P _A 、c _A the second generation method is as follows:

(e.g., by the signer, by the initialization operator) a computing device other than the signing device generates d _A Calculating P _A ＝[d _A ]G，c _A ＝E((1+d _A ) ^-1 ) Then destroy d _A A 1 is to P _A 、c _A Export, then (by some secure means) P _A 、c _A Importing the data into a signature device;

P _A 、c _A the third generation mode:

(e.g., used by the signer, the initialization operator) a computing device (in which the private key assists the generator) outside the signing device is at [1, n-1 ]]Randomly selecting an integer d ₂ Calculate G ₂ ＝[(d ₂ ) ^-1 ]G，t ₂ ＝E(d ₂ ) Wherein (d) ₂ ) ^-1 Is d ₂ Modulo n multiplication inverse of (i.e., (d) ₂ ) ^-1 d ₂ ) mod n 1) and then d ₂ Destroy, G ₂ 、t ₂ Deriving, then G ₂ 、t ₂ Importing the data into a signature device;

(e.g., used by signers, initialization operators) the signature apparatus is in 1, n-1]Randomly selecting an integer d ₁ Calculate P _A ＝[(d ₁ ) ^-1 ]G ₂ -G, using t ₂ Is calculated to obtain c _A ＝E(d ₁ d ₂ ) Wherein (d) ₁ ) ^-1 Is d ₁ Modulo n multiplication inverse of (i.e., (d) ₁ ) ^-1 d ₁ ) mod n 1) and then d ₁ 、G ₂ 、t ₂ Is destroyed, then d ₁ d ₂ ≡(1+d _A ) ^-1 (mod n)(d ₁ d ₂ With a certain d _A Modulo n congruence relation exists), P _A ＝[d _A ]G；

For P as described above _A 、c _A The generation modes I, II and III, the encryption operation E (-) adopts a signature auxiliary systemThe signature auxiliary system has a private key of decryption operation corresponding to the public key adopted by the encryption operation E (-) of the homomorphic encryption algorithm (the public key for homomorphic encryption operation is well known at the moment), or the encryption operation E (-) adopts a public key in a public and private key pair (key pair) of the homomorphic encryption algorithm (an entity performing the encryption operation E (-) first) temporarily generated, and the private key in the temporarily generated public and private key pair (key pair) of the homomorphic encryption algorithm is encrypted by the public key of the signature auxiliary system to form a ciphertext d of the encrypted private key _E (public keys of signature assistance systems include common public keys such as RSA, SM2 public keys, and group public keys of group cryptographic algorithms);

P _A 、c _A the generation mode is four:

the SM2 user (i.e. signer) signing the private key interacts with the key collaborative generation system by using the signing device (for example, in an anonymous mode), and obtains P through collaborative calculation by using a homomorphic encryption algorithm under the condition of not exposing respective secrets _A ＝[d _A ]G，c _A ＝E((1+d _A ) ^-1 ) Then, the used secret in the calculation process is destroyed;

the key collaborative generation system is a system providing SM2 public and private key pair collaborative generation service;

for P mentioned above _A 、c _A And a fourth generation mode is that the encryption operation E (-) adopts a public key of a homomorphic encryption algorithm of the signature auxiliary system, the signature auxiliary system has a private key of a decryption operation corresponding to the public key adopted by the encryption operation E (-), at the moment, the public key of the homomorphic encryption operation is well known, or the encryption operation E (-) adopts a public key of a public and private key pair of the homomorphic encryption algorithm temporarily generated by the key cooperation generation system, and the private key of the public and private key pair of the temporarily generated homomorphic encryption algorithm is encrypted by the secret key of the signature auxiliary system to form a ciphertext d of the encrypted private key _E Wherein the key of the signature assistance system comprises a symmetric key or a public key (public keys include common public keys such as RSA, SM2 public keys, and group public keys of a group cipher algorithm).

For P as described above _A 、c _A Generation mode four, SM2 signatureThe user (i.e. signer) of the private key uses the signing device (for example, in an anonymous mode) to interact with the key collaborative generation system, and the P is obtained by collaborative calculation by using a homomorphic encryption algorithm under the condition of not exposing respective secrets _A ＝[d _A ]G，c _A ＝E((1+d _A ) ^-1 ) One way of doing so (not all possible ways) is as follows:

the user (i.e., signer) of the SM2 signing the private key issues an SM2 key pair cooperative generation request to the key cooperative generation system using the signing device (e.g., in an anonymous manner);

key co-generation system in [1, n-1 ]]Randomly selecting an integer d ₂ Calculate G ₂ ＝[(d ₂ ) ^-1 ]G，t ₂ ＝E(d ₂ ) Wherein (d) ₂ ) ^-1 Is d ₂ Modulo n multiplication inverse (i.e., (d) ₂ ) ^-1 d ₂ ) mod n 1) and then d ₂ Destroying G ₂ 、t ₂ Is sent to a signature device, wherein t ₂ ＝E(d ₂ ) The public key adopted by the encryption operation is the public key of the homomorphic encryption algorithm of the signature auxiliary system (at this moment, the signature auxiliary system has the private key of the decryption operation corresponding to the public key adopted by the encryption operation E), or the public key in the public and private key pair of the homomorphic encryption algorithm temporarily generated by the key cooperation generation system, and for the latter, the key cooperation generation system utilizes the key of the signature auxiliary system to encrypt the private key in the temporarily generated public and private key pair of the homomorphic encryption algorithm to form the ciphertext d of the encrypted private key _E Then d is _E Same G ₂ 、t ₂ Together to the signing device, wherein the key of the signing assistance system comprises a symmetric key and a public key (if the symmetric key of the signing assistance device is used, the key co-generation system can use this key);

signature devices in [1, n-1 ]]Randomly selecting an integer d ₁ Calculate P _A ＝[(d ₁ ) ^-1 ]G ₂ -G, using t ₂ Is calculated to obtain c _A ＝E(d ₁ d ₂ ) Wherein (d) ₁ ) ^-1 Is d ₁ Modulo n multiplication inverse of (i.e., (d) ₁ ) ^-1 d ₁ ) mod n 1) and then d ₁ 、G ₂ 、t ₂ Destroying;

the signature device is not exposed c _A And d _A In the case of (2), the validation c is carried out by interacting with the key co-generation system _A Corresponding plaintext c _Am Has d ₁ d ₂ ≡(1+d _A ) ^-1 (mod n) (i.e., c) _Am That is d ₁ d ₂ With a certain d _A Modulo n congruence relation exists) and P _A Is [ d ] _A ]G, if the verification is passed, d ₁ d ₂ ≡(1+d _A ) ^-1 (mod n)，P _A ＝[d _A ]G, otherwise, turning to error processing.

Above P _A 、c _A The generation mode III and IV generate the SM2 signature private key d of the user through an indirect mode _A 。

Based on the SM2 digital signature generation method for controlling signature making data by a signer, an SM2 digital signature generation system for controlling signature making data by the signer can be constructed, the system comprises the signature device and a signature auxiliary system, and when the SM2 signature private key d of a user needs to be used _A When a message M is digitally signed, the name device and the signature assistance system generate a digital signature for the message M in accordance with the SM2 digital signature generation method in which the signer masters signature creation data.

Based on the method of the present invention, the signer (user) uses the signature making data (1+ d) generated by the SM2 digital signature _A ) ^-1 Completely controlled by the signer, stored in the computing device in the form of a ciphertext and used in the form of the ciphertext in the process of generating the digital signature, so that the signature making data (1+ d) is effectively prevented _A ) ^-1 Is leaked out; meanwhile, from the perspective of entities outside the signing device and the signature auxiliary system, the security and direct use of the generated SM2 digital signature are (1+ d) _A ) ^-1 Or d _A The security of the generated SM2 digital signature is the same; from the perspective of entities other than the signing device and the signature assistance system, whether the signature assistance system uses k ₂ Participating in the calculation and generation of the digital signature does not influence the generated SSecurity of M2 digital signatures; however, from the perspective of SM2 signing the owner of the private key, k is used ₂ Can prevent (1+ d) _A ) ^-1 C.g. of _A After being stolen, the attacker utilizes c _A Cracking SM2 signature private key d _A Therefore, from the perspective of SM2 signing private key owner, the method of the present invention improves the security of using the user SM2 signing private key, and the signature assistant system can enhance the identity authentication of the signing device or the user of the signing device through public key authentication information before s is calculated, for example, by sending verification information to a user computing device other than the signing device, performing identity authentication of the user of the signing device in a face recognition manner, etc., thereby ensuring that the signature making data of the user is not stolen.

Drawings

FIG. 1 is a schematic diagram of the system of the present invention.

FIG. 2 is a schematic diagram of a distributed deployment of the present invention.

Detailed Description

The present invention will be further described with reference to the following examples. The following embodiments and examples are only a few possible embodiments and examples of the present invention, and do not represent all the possible embodiments and examples, and are not intended to limit the present invention.

The implementation of the invention needs to adopt homomorphic encryption algorithms, including addition homomorphic encryption algorithms and fully homomorphic encryption algorithms (i.e. homomorphic encryption algorithms supporting both addition homomorphic and multiplication homomorphic). The invention has no limitation to the specifically adopted addition homomorphic encryption algorithm and the fully homomorphic encryption algorithm, and the invention can be used as long as the homomorphic encryption operation of integers can be supported, for example, for the addition homomorphic encryption algorithm, the Paillier algorithm can be adopted, and for the fully homomorphic encryption algorithm, the Gentry algorithm can be adopted.

In the following description, it is to be understood that,

a ciphertext number representing the multiplication of two homomorphic encrypted ciphertext numbers, the result corresponding to the product of the multiplication of the two corresponding plaintext numbers;

a ciphertext number representing an addition of two ciphertext numbers that are homomorphically encrypted, the result corresponding to an added sum of the two corresponding plaintext numbers; as an example, the number of plaintext numbers multiplied by one ciphertext number in the homomorphic encryption corresponds to a ciphertext number of a product of multiplication of two corresponding plaintext numbers.

In homomorphic encryption operations of the present invention, E (a (mod n)) is often present, where a is an integer and a (mod n) represents a number that is congruent to a modulo n. In the invention, a number which is congruent with a modulo n is used instead of directly using a, so that when a is an operation result (such as a product) of two or more secret numbers (secret numbers), the secret is cracked by directly decomposing a, for example, a is equal to pq, because the number of bits of p and q is small (relatively speaking, not a large number), p and q are easy to decompose from a, and p and q are cracked, but if a remainder which is congruent with a modulo n is adopted, the difficulty of directly cracking p and q is increased or the calculation is impossible.

One approach to implementing E (a (mod n)) is as follows (although not all possibilities):

change the calculation E (a (mod n)) to a calculation

Where z is an integer randomly selected during the computation (e.g., signature device) (not limited to 1, n-1)]n) or an integer calculated from a randomly selected integer (e.g. a signature device) (z may be positive, negative, or zero), and z is selected by the following: so that the encrypted plaintext number, i.e. a + zn, in the operation process does not exceed the range of representation of the encryption operation E (-) of the homomorphic encryption algorithm for the encrypted integer, or the probability of exceeding the range of representation of the encryption operation E (-) of the homomorphic encryption algorithm for the encrypted integer is extremely small (the probability of exceeding is within a specified range) (the encryption operation E (-) of the homomorphic encryption algorithm represents positive, negative and zero by complement, if the modulus of E (-) for the encrypted integer is m, m is divided into two parts, the lower half of which represents positive and zero, and the upper half of which represents negative integer, similarly to the case of the encryption operation E (-) for the encrypted integerThe complement of the binary number).

In a specific implementation, the signature assistance system has a private key of the decryption operation corresponding to the public key used in the encryption operation E (-) of the homomorphic encryption algorithm (in this case, the private key of the decryption operation is usually stored in a dedicated cryptographic device, as shown in fig. 1), or the private key of the decryption operation corresponding to the (temporarily generated) public key used in the encryption operation E (-) of the homomorphic encryption algorithm is encrypted by the secret key of the signature assistance system to form a ciphertext d of the encrypted private key _E Wherein the key of the signature assistance system comprises a symmetric key or a public key, wherein the public key comprises a common public key such as RSA, SM2, or a group public key of a group cipher algorithm, and is used for decrypting d _E The symmetric key or private key of (a) is typically stored in a dedicated cryptographic device (as shown in fig. 1); when a decryption operation D (-) corresponding to the encryption operation E (-) is required, (signature auxiliary system) first decrypts D with the encryption device _E The private key is obtained for the decryption operation D (-) and then the decryption operation is performed with the homomorphic encryption algorithm (the decryption operation is also typically performed in the cryptographic device).

The private key of the decryption operation corresponding to the public key used in the encryption operation E (-) of the homomorphic encryption algorithm is specifically the one which is used, and the SM2 private key d _A The generation method of (c) is related to the deployment method of the inventive system (e.g. centralized or distributed deployment), see the following description.

In generating a digital signature for message M Q, Q _f With different ways of calculation, different Q, Q _f The calculation method not only affects the calculation method (embodiment) used for calculating the digital signature later, but also is related to the selected homomorphic encryption algorithm, and a specific implementation description is given below.

Q、Q _f Examples 1,

Q、Q _f The calculation adopts Q ═ b ₁ k ₁ +b ₂ k ₂ ]G、Q _f ＝[b ₁ k ₁ +b ₂ k ₂ ]G，b ₁ ＝1，b ₂ 1, the method is only applicable to the homomorphic encryption algorithm corresponding to the E (-) at this time; at this time, s ₁ Can only adopt s ₁ In the second calculation mode, the signature device can calculate s as follows ₁ ：

Wherein c is _A ＝E((1+d _A ) ^-1 )，c ₂ ＝E(k ₂ )；

At this time correspond to s ₁ ＝E((k ₁ +r)(1+d _A ) ^-1 +k ₂ (1+d _A ) ^-1 (mod n))，s＝((k ₁ +k ₂ +r)(1+d _A ) ^-1 -r)mod n。

Q、Q _f Examples 2,

Q、Q _f The calculation adopts Q ═ b ₁ k ₁ +b ₂ k ₂ ]G、Q _f ＝[b ₁ k ₁ +b ₂ k ₂ ]G，b ₁ ＝(1+d _A )，b ₂ 1, the method is only applicable to the homomorphic encryption algorithm corresponding to the E (-) at this time; at this time, s ₁ Can only adopt s ₁ The second calculation mode, at this time b ₁ (1+d _A ) ^-1 Taking the value 1, the signature device can calculate s in the following way ₁ ：

Wherein c is _A ＝E((1+d _A ) ^-1 )，c ₂ ＝E(k ₂ )；

At this time corresponds to s ₁ ＝E(k ₁ +k ₂ (1+d _A ) ^-1 +r(1+d _A ) ^-1 (mod n))，

s＝((k ₁ (1+d _A )+k ₂ +r)(1+d _A ) ^-1 -r)mod n。

Q、Q _f Examples 3,

Q、Q _f The calculation adopts Q ═ b ₁ k ₁ +b ₂ k ₂ ]G、Q _f ＝[b ₁ k ₁ +b ₂ k ₂ ]G，b ₁ ＝1，b ₂ ＝(1+d _A ) At this time, the homomorphic encryption algorithm corresponding to E (-) can be either an addition homomorphic encryption algorithm or a fully homomorphic encryption algorithm; at this time, s ₁ Can be calculated using s ₁ The calculation is one or two, when b ₂ (1+d _A ) ^-1 Taking a value of 1;

if s ₁ Is calculated using s ₁ In the first calculation mode, the signature device can calculate s as follows ₁ ：

Wherein c is _A ＝E((1+d _A ) ^-1 )；

At this time corresponds to s ₁ ＝E((k ₁ +r)(1+d _A ) ^-1 (mod n)),s＝((k ₁ +k ₂ (1+d _A )+r)(1+d _A ) ^-1 -r)mod n。

If s ₁ Is calculated using s ₁ In the second calculation method, the signature device can calculate s as follows ₁ ：

Wherein c is _A ＝E((1+d _A ) ^-1 )，c ₂ ＝E(k ₂ )；

At this time corresponds to s ₁ ＝E((k ₁ +r)(1+d _A ) ^-1 +k ₂ (mod n)),

s＝((k ₁ +k ₂ (1+d _A )+r)(1+d _A ) ^-1 -r)mod n。

Q、Q _f Examples 4,

Q、Q _f The calculation adopts Q ═ b ₁ k ₁ +b ₂ k ₂ ]G、Q _f ＝[b ₁ k ₁ +b ₂ k ₂ ]G，b ₁ ＝(1+d _A )，b ₂ ＝(1+d _A ) In this case, the homomorphic encryption algorithm corresponding to E (-) may be additionThe homomorphic encryption algorithm can also be a fully homomorphic encryption algorithm; at this time, s ₁ Can only adopt s ₁ The calculation is one or two, when b ₁ (1+d _A ) ^-1 Values 1, b ₂ (1+d _A ) ^-1 Taking a value of 1;

Wherein c is _A ＝E((1+d _A ) ^-1 )；

At this time corresponds to s ₁ ＝E(k ₁ +r(1+d _A ) ^-1 (mod n)),

s＝((k ₁ (1+d _A )+k ₂ (1+d _A )+r)(1+d _A ) ^-1 -r)mod n。

Wherein c is _A ＝E((1+d _A ) ^-1 )，c ₂ ＝E(k ₂ )；

At this time corresponds to s ₁ ＝E(k ₁ +k ₂ +r(1+d _A ) ^-1 (mod n)),

s＝((k ₁ (1+d _A )+k ₂ (1+d _A )+r)(1+d _A ) ^-1 -r)mod n。

Q、Q _f Examples 5,

Q、Q _f The calculation adopts Q ═ bk ₁ k ₂ ]G、Q _f ＝[bk ₁ k ₂ ]G, b ═ 1, which is only applicable when the homomorphic encryption algorithm corresponding to E (·) is a fully homomorphic encryption algorithm; at this time, s ₁ Can only adopt s ₁ In the third calculation mode, the signature device can be calculated in the following modeCalculated to obtain s ₁ ：

Alternatively, the first and second electrodes may be,

alternatively, the first and second electrodes may be,

wherein c is _A ＝E((1+d _A ) ^-1 )，c ₂ ＝E(k ₂ )；

At this time corresponds to s ₁ ＝E(k ₁ k ₂ (1+d _A ) ^-1 +r(1+d _A ) ^-1 (mod n)),s＝((k ₁ k ₂ +r)(1+d _A ) ^-1 -r))mod n。

Q、Q _f Examples 6,

Q、Q _f The calculation adopts Q ═ bk ₁ k ₂ ]G、Q _f ＝[bk ₁ k ₂ ]G，b＝(1+d _A ) At this time, the homomorphic encryption algorithm corresponding to E (-) can be an addition homomorphic encryption algorithm, and can also be applicable to a fully homomorphic encryption algorithm; at this time, b (1+ d) _A ) ^-1 Value 1, s ₁ Can only adopt s ₁ The calculation method is carried out in a third mode,

if the homomorphic encryption algorithm corresponding to E (-) is an addition homomorphic encryption algorithm, the signature device can calculate s in the following way ₁ ：

Wherein c is _A ＝E((1+d _A ) ^-1 )，c ₂ ＝E(k ₂ )；

If the homomorphic encryption algorithm corresponding to E (-) is a fully homomorphic encryption algorithm, the signature device can also calculate s in the following way ₁ ：

Wherein c is _A ＝E((1+d _A ) ^-1 )，c ₂ ＝E(k ₂ )；

At this time corresponds to s ₁ ＝E(k ₁ k ₂ +r(1+d _A ) ^-1 (mod n))，s＝(((1+d _A )k ₁ k ₂ +r)(1+d _A ) ^-1 -r))。

In particular implementations, Q, Q may be selected _f One of the calculation modes, and corresponding s ₁ The calculation mode, and the corresponding calculation mode of s (using s) ₁ Calculation method one, then s calculation method, and using s ₁ Calculation methods two and three, and the subsequent s calculation methods are different).

In the present invention, when a digital signature is generated for a message M, a signature assistance system discriminates and confirms whether or not a user who uses a signature device, i.e., a signer, is a public key P _A Is necessary (note that it is not authentication verification here whether the user, i.e. the signer, is the public key P _A Corresponding private key d _A Owner of (c) to prevent signature creation data, i.e., secret c _A Is stolen. In the embodiment, the user who uses the signature device, i.e. the signer, is authenticated and confirmed whether the public key P is used _A There are many ways for the owner of (e.g. the user's public key P) _A With user's public key P in account information in a signature-assisted system's account binding, e.g. in a database of user's accounts in a signature-assisted system _A When the user uses the signature auxiliary system, the user firstly uses the account name to complete login (identity authentication) in the signature auxiliary system, for example, the user performs secure login through face recognition, a secure token and the like, and the signature auxiliary system obtains the public key P of the user from the user account database after completing the identity authentication of the user _A Or the screening name of the public key digital certificate provided by the user has a corresponding relation with the user account, but the method is not suitable for the anonymity requirement on privacy protection, wherein the anonymity requirement is that the real identity of the user of the signature device is not exposed in the generation process of the digital signature and is not suitable for distributionA distributed deployment environment, where the invention is implemented (because of the need to centrally maintain user account information), refers to multiple signature-assisted systems being deployed at different locations, respectively.

The public key authentication information and the registration and use modes thereof introduced by the invention do not require that the user must provide real identity information, and the user privacy can be protected in an anonymous mode (in order to protect the user privacy, the biological characteristic verification information can be converted information) (note that the support of the anonymous mode does not mean that the generation and use of the public key authentication information must adopt the anonymous mode).

For the invention, in the registration and generation process of the public key authentication information, the signature device needs to prove the possession P to the public key registration system under the condition of not exposing the secret of the signature device _A Corresponding private signature key d _A For this, there are many possible methods and embodiments, for example, the signature device may sign a random string submitted by the public key registration system through the SM2 digital signature generation method in which the signer controls the signature generation data (when signing, the public key registration system or the signature assistance system does not verify P _A Whether owned by the user of the signing device, since P is now being performed _A Registering and generating public key authentication information, but no public key authentication information exists), at this time, the public key registration system is used as a signature auxiliary system or assists and assists the signature device to complete digital signature generation by means of the signature auxiliary system, or the signature device proves to possess P to the public key registration system in other ways _A Corresponding private signature key d _A The following is one possible method, embodiment:

signature devices in [1, n-1 ]]Randomly selecting an integer b, using c _A S is obtained by homomorphic encryption operation calculation _b1 ＝E(b(1+d _A ) ^-1 (mod n)), and converting s _b1 Sending the public key to a public key registration system; public key registration system in [1, n-1 ]]Randomly selecting an integer t, and decrypting s by using a public key registration system as a signature auxiliary system or by using the signature auxiliary system _b1 Calculating to obtain T ₂ ＝[(D(s _b1 )t)mod n](G+P _A ) Wherein D (-) is homomorphic addition corresponding to E (-)Decryption operation of the cipher algorithm, and converting T into ₂ Sending the data to a signature device; signature device calculates T ₁ ＝[b ^-1 ]T ₂ Wherein b is ^-1 For the inverse of the modulo n multiplication of b, the signature device will convert T ₁ Sending the public key to a public key registration system; public key registration system test T ₁ Whether or not to [ t ]]G is the same, if the G is the same, the certificate passes, otherwise, the certificate fails.

For the SM2 digital signature generation method for controlling signature making data by a signer, the invention provides four kinds of P _A ＝[d _A ]G，c _A ＝E((1+d _A ) ^-1 ) Depending on the particular implementation conditions and safety requirements, which of these four ways is chosen in the particular implementation (although not all possible ways of generation are implied).

P of the invention _A 、c _A The first generation mode is suitable for a trusted computing or execution environment of the signature device, for example, a signature device (such as a mobile terminal) has a tee (trusted Executive environment) or an occasion with low security requirements. At this time, the signature device implements a program component for generating a secret key (public key or private key).

P of the invention _A 、c _A The second generation method is suitable for the situation that the signature device has no trusted computing or execution environment, and a computing device other than the signature device does not belong to an environment with higher security risk (such as a computer of the self, which is provided with security protection software), and the security requirement is not very high. At this time, a program component for generating a secret key (public key, private key) is executed in a computing device other than the signing device.

P of the invention _A 、c _A The third generation mode is also suitable for the situation that the signature device has no trusted computing or execution environment, and a computing device except the signature device does not belong to an environment with higher security risk (such as a computer of the third generation mode which is provided with security protection software), and the security requirement is relatively high. In this case, the signature device and a computing device other than the signature device implement a program component having a function of generating a corresponding key (public key or private key).

For P of the invention _A 、c _A The generation modes I, II and III are that the encryption operation E (DEG) adopts a public key of a homomorphic encryption algorithm of the signature auxiliary system, the signature auxiliary system has a private key of a decryption operation corresponding to the public key adopted by the encryption operation E (DEG) of the homomorphic encryption algorithm (at this time, the public key for performing homomorphic encryption operation is well known), or the encryption operation E (DEG) adopts a public key in a public-private key pair (key pair) of the homomorphic encryption algorithm (an entity performing the encryption operation E (DEG)) temporarily generated, and the private key in the temporarily generated private key pair (key pair) of the homomorphic encryption algorithm is encrypted by the public key of the signature auxiliary system to form a ciphertext d of the encrypted private key _E (public keys of signature assistance systems include common public keys such as RSA, SM2 public keys, and group public keys of group cryptography algorithms).

P of the invention _A 、c _A The generation method is suitable for occasions with high security requirements when the signature device has no trusted computing or execution environment. At this time, a key cooperation generation system for cooperatively generating the signature private key of the SM2 and a program component for implementing key generation in the signature device are required to be implemented.

P of the invention _A 、c _A Generation modes three and four, signature device uses t ₂ Calculation of c _A ＝E(d ₁ d ₂ ) The method comprises the following steps:

c _A ＝d ₁ ⊙t ₂ or is or

The latter applies only when E (-) is an encryption operation of a fully homomorphic encryption algorithm.

For P of the invention _A 、c _A The generation mode is four, the encryption operation E (-) adopts the public key of the homomorphic encryption algorithm of the signature auxiliary system, the signature auxiliary system has the private key of the decryption operation corresponding to the public key adopted by the encryption operation E (-), at the moment, the public key of the homomorphic encryption operation is well known, or the encryption operation E (-) adopts the public key of the public and private key pair of the homomorphic encryption algorithm temporarily generated by the key cooperation generation system, and the private key of the public and private key pair of the temporarily generated homomorphic encryption algorithm is signed by the public and private key pair of the signature auxiliary systemEncrypting the secret key to form a ciphertext d of the encrypted private key _E Wherein the key of the signature assistance system comprises a symmetric key or a public key (public keys include common public keys such as RSA, SM2 public keys, and group public keys of a group cipher algorithm).

For P of the invention _A 、c _A Generation mode four, the signature device is not exposed c _A And d _A In the case of (2), the validation c is carried out by interacting with the key co-generation system _A Corresponding plaintext c _Am Has d ₁ d ₂ ≡(1+d _A ) ^-1 (mod n) (i.e., c) _Am With a certain d _A (1+ d) of _A ) ^-1 Modulo n congruence) and P _A Is [ d ] _A ]G, the signature device itself generates a random string, and then signs and verifies the random string according to the SM2 digital signature generation method described above in which the signer controls the signature generation data (however, b) ₁ ＝1，b ₂ Except for the case of 1, or b 1, in which case the key agreement generation system may cheat) (when the key agreement system acts as a signature assistance system, or with the aid of a signature assistance system), or by other means, such as:

signature devices in [1, n-1 ]]Randomly selecting an integer b, q and t, and using b, q and c _A T calculating s _b1 ＝E(qc _Am +b(mod n))，T ₁ ＝[t](G+P _A ) Wherein c is _Am Is c _A Corresponding plaintext i.e. d ₁ d ₂ (ii) a Signature device will s _b1 、T ₁ Sending the key to a key collaborative generation system; the key co-generation system itself acting as a signature aid system, or with the aid of a signature aid system, decrypting s _b1 Obtain the plaintext s _b2 ＝D(s _b1 ) mod n, calculate T ₂ ＝[s _b2 ]T ₁ Will T ₂ Returning to the signature device; signature device calculates T ₃ ＝[t ^-1 ]T ₂ ，t ^-1 Checking T for the modulo n multiplication inverse of T ₃ And [ q ]]G+[b](G+P _A ) If they are the same, then d is confirmed ₁ d ₂ ≡(1+d _A ) ^-1 (mod n) and P _A Is [ d ] _A ]G；

Alternatively, the first and second electrodes may be,

signature devices in [1, n-1 ]]Randomly selecting an integer b and q, using b, q and c _A Calculating s _b1 ＝E(qc _Am + b (mod n)), wherein c _Am Is c _A Corresponding plaintext i.e. d ₁ d ₂ (ii) a Signature device will s _b1 Sending the key to a key collaborative generation system; the key co-generation system itself acting as a signature aid system or with the aid of a signature aid system, decrypts s _b1 Obtain the plaintext s _b2 ＝D(s _b1 ) mod n, calculate T ₂ ＝[s _b2 ](G+P _A ) Will T ₂ Returning to the signature device; signature device check T ₂ And [ q ]]G+[b](G+P _A ) If they are the same, then d is confirmed ₁ d ₂ ≡(1+d _A ) ^-1 (mod n) and P _A Is [ d ] _A ]G。

Four kinds of P given by the invention _A 、c _A In any generation mode, a public and private key pair (key pair) of the encryption and decryption operations of the homomorphic encryption algorithm is either fixed or generated temporarily; for a temporarily generated public-private key pair, where the private key is encrypted by the other public key of the signature assistance device (suitable P) _A 、c _A Generation manner one, two, three, four), or the private key is encrypted by the symmetric key of the signature assistance device (only for P) _A 、c _A Generation method four), the ciphertext d of the private key of the decryption operation corresponding to the encryption operation E (-) of the homomorphic encryption algorithm is obtained _E The other public keys of the signature assistant device include public keys of common public key cryptographic algorithms such as RSA, SM2, SM9, etc., and may also be public keys of group cryptographic algorithms.

Whether the public and private key pair (key pair) of the encryption and decryption operation of the homomorphic encryption algorithm is fixed or temporarily generated, and whether the encryption of the temporarily generated private key is the symmetric key or the public key of the signature auxiliary device, from the perspective of obtaining the digital signature result and the security thereof, the public and private key pair (public key pair) is equivalent and has no great difference, but the public and private key pair and the public and private key pair are suitable for different deployment and implementation requirements, for example, the public and private key pair (public key pair) for encryption and decryption of the homomorphic encryption algorithm is fixed or temporarily generated, the way that the private key in the temporarily generated key pair is encrypted by the symmetric key of the signature auxiliary device is suitable for the case that the signature auxiliary system, the key cooperation generation system and the public key registration system are centrally deployed, the public and private key pair (public key pair) for encryption and decryption of the homomorphic encryption algorithm is temporarily generated, and the way that the private key in the temporarily generated key pair is encrypted by the public key of the signature auxiliary device is suitable for the situation that the signature auxiliary device is centrally deployed The system is in a distributed deployment situation, that is, the signature assistant system is distributed and deployed in different places (as shown in fig. 2), and it is better that the public key of the signature assistant device, which encrypts the private key of the temporarily generated key pair, is the group public key, so that the signature assistant devices deployed in different locations can assist and assist in generating the digital signature. Using group public key encryption involves a group (set) encryption algorithm, so-called group (set) encryption, i.e. data encrypted using a group (set) public key, a group (set) member can decrypt the encrypted data using its own private key.

In the case of distributed deployment of the signature-assisted systems, the public key authentication information is preferably encrypted by signature, and in this case, the public key for encrypting the public key authentication information may be a common public key such as RSA, SM2, SM9, or a group public key, and preferably (but not necessarily) the public key is used by a group public key, and in this case, each signature-assisted system belonging to a member of the group may perform assisted generation of a digital signature (note that being suitable for distributed deployment does not mean that it is necessary for distributed deployment).

Based on the SM2 digital signature generation method for controlling signature making data by a signer, an SM2 digital signature generation system for controlling signature making data by the signer can be constructed, and the system comprises the signature device and a signature auxiliary system, wherein the signature device can be a device which comprises software and hardware and has computing power, such as a personal computer, a mobile phone mobile terminal and the like, and the signature auxiliary system is a special system with high safety and strong computing power; if the generation and use scheme of the public key authentication information of the invention is also implemented, the constructed SM2 digital signature generation system for controlling the signature making data by the signer also comprises a public key registration system; if the invention is to be carried outP _A 、c _A The generation mode is four, the constructed SM2 digital signature generation system for the signer to control the signature making data also comprises a key cooperation generation system; the signature device is used as a client in the interaction process with the signature auxiliary system, the key collaborative generation system and the public key registration system; the signature auxiliary system, the key collaborative generation system and the public key registration system are systems for providing corresponding service functions, and serve as service ends in the interaction process with the signature device; when a message M needs to be digitally signed using the SM2 signature private key dA of the user, the name device and the signature assistance system generate a digital signature for the message M in an SM2 digital signature generation method in which the signer masters signature making data.

Other specific technical implementations not described are well known to those skilled in the relevant art and will be apparent to those skilled in the relevant art.

Claims

1. A SM2 digital signature generation method for controlling signature making data by a signer is characterized in that:

the signature device has P _A ＝[d _A ]G, with secret c _A ＝E((1+d _A ) ^-1 ) Wherein d is _A Signing the private key for the user's SM2, G being the base point of the SM2 elliptic curve point group, P _A Signing the private key d for the user's SM2 _A Corresponding public key, (1+ d) _A ) ^-1 Is (1+ d) _A ) The modulo n inverse of (a), n being the order of the base point G, n being a prime number, E (-) being an encryption operation using a homomorphic encryption algorithm;

the signing device is a signer, namely SM2 private signature key d _A The computing device of the owner of (1); the homomorphic encryption algorithm is an addition homomorphic encryption algorithm or a full homomorphic encryption algorithm; the signature auxiliary system has a private key of decryption operation corresponding to a public key adopted by the encryption operation E (-) of the homomorphic encryption algorithm, or the private key of decryption operation corresponding to the public key adopted by the encryption operation E (-) of the homomorphic encryption algorithm is encrypted by a secret key of the signature auxiliary system, wherein the secret key of the signature auxiliary system comprises a symmetric secret key or a public key; the signature auxiliary system is a computing device for assisting and assisting the signature device to complete the generation of the digital signatureA device or system;

if the private key of the decryption operation corresponding to the public key adopted in the encryption operation E (-) of the homomorphic encryption algorithm is encrypted by the key of the signature auxiliary system, the signature device also has the ciphertext d of the private key of the decryption operation _E ；

When it is desired to sign the private key d using the user's SM2 _A When the digital signature is carried out on the message M, the signature device and the signature auxiliary system generate the digital signature for the message M as follows:

the signature device uses the message M to calculate r ═ e + x ₁ ) mod n, where r is a component of the digital signature, x ₁ The abscissa of the elliptic curve point Q obtained by subsequent calculation;

the signature device sends e to the signature auxiliary system;

signature device ensuring signature auxiliary system does not reselect k ₂ In the case of (2), Q ═ b is obtained by interactive calculation with the signature assistance system ₁ k ₁ +b ₂ k ₂ ]G, wherein b ₁ 1 or (1+ d) _A )，b ₂ 1 or (1+ d) _A ) Wherein b is ₂ 1 is only applicable when the homomorphic encryption algorithm corresponding to E (·) is a fully homomorphic encryption algorithm, b _1、 b ₂ The value of (a) is used for selecting a calculation formula of Q;

signature assistance system in ensuring that a signing device does not reselect k ₁ In the case of (2), Q is obtained by mutual calculation with the signature device _f ＝[b ₁ k ₁ +b ₂ k ₂ ]G；

The signature device and the signature support system check Q, Q separately _f Whether or not it is a zero element, if Q and/or Q _f Is zero, k is reselected ₁ 、k ₂ To recalculateCalculation Q, Q _f Up to Q and Q _f Is a non-zero element;

alternatively, the first and second electrodes may be,

signature device ensuring signature auxiliary system not reselect k ₂ In the case of (1), Q ═ bk is obtained by mutual calculation with the signature assistance system ₁ k ₂ ]G, wherein b is 1 or (1+ d) _A )；

If b is 1, then according to Q ═ bk ₁ k ₂ ]G、Q _f ＝[bk ₁ k ₂ ]Calculation Q, Q mode G _f Is applicable only when the homomorphic encryption algorithm corresponding to E (-) is a fully homomorphic encryption algorithm;

Signature assistance System computation r _f ＝(e+x _1f ) mod n, where x _1f Is taken from (x) _1f ,y _1f )＝Q _f ；

The signature device and the signature assistance system check whether (s + r) mod n is 0 and/or (s + r), respectively, present _f ) The case where mod n is 0, where s is the parameter s in the digital signature (r, s) to be computed, and if so, k is reselected ₁ 、k ₂ Recalculated Q, Q _f Recalculate r, r _f Until (s + r) mod n 0 and/or (s + r) do not occur _f ) The case where mod n is 0; if (s + r) mod n is not 0 and/or (s + r) _f ) If mod n is 0, performing subsequent calculation processing;

the signature device calculates s in one of the following ways ₁ ：

s ₁ The first calculation method is as follows:

q is calculated as [ b ] ₁ k ₁ +b ₂ k ₂ ]G is calculated and b ₂ ＝(1+d _A )；

Signature device using r, c _A 、k ₁ S is obtained by calculation of homomorphic encryption algorithm ₁ ＝E(k ₁ b ₁ (1+d _A ) ^-1 +r(1+d _A ) ^-1 (mod n))；

s ₁ And a second calculation method:

q is calculated as [ b ] ₁ k ₁ +b ₂ k ₂ ]G is obtained by calculation;

if b is ₂ If the encryption algorithm is 1, the homomorphic encryption algorithm corresponding to the E (-) is a fully homomorphic encryption algorithm;

signature device using r, c _A 、k ₁ 、c ₂ S is obtained by calculation of homomorphic encryption algorithm ₁ ＝E(k ₁ b ₁ (1+d _A ) ^-1 +k ₂ b ₂ (1+d _A ) ^-1 +r(1+d _A ) ^-1 (mod n))；

s ₁ And a third calculation mode:

q is calculated as [ bk ] ₁ k ₂ ]G is obtained by calculation;

signature device using r, c _A 、k ₁ 、c ₂ S is obtained by calculation of homomorphic encryption algorithm ₁ ＝E(k ₁ k ₂ b(1+d _A ) ^-1 +r(1+d _A ) ^-1 (mod n))；

if the private key of the decryption operation corresponding to the public key adopted by the encryption operation E (-) of the homomorphic encryption algorithm is encrypted by the key of the signature auxiliary system, the ciphertext of the private key is d _E The signature device will also d _E Send to and signName-assisted system and signature-assisted system decryption d _E Obtaining a private key of a decryption operation corresponding to a public key adopted by an encryption operation E (-) of the homomorphic encryption algorithm;

for s ₁ In a first calculation mode, the signature assistance system calculates s as follows:

the signature device verifies whether s is use k ₁ 、k ₂ R and public key P _A Corresponding private key d _A Calculating according to the SM2 digital signature calculation mode, if the verification is passed, (r, s) is the digital signature of the message M, otherwise, carrying out error processing;

in the above formula of the encryption operation E (-) using the homomorphic encryption algorithm, a (mod n), where a is an integer representing an integer congruent with a modulo n;

the signature assistance system is assistingBefore the signature device is assisted and assisted to complete the generation of the digital signature, firstly, the user using the signature device, namely the signer, is identified and confirmed whether the public key P is used or not _A The owner of (2);

the signing device, namely a computing device owned by a signer, is a device with computing capability and comprising software and hardware; the signature device implements the digital signature calculation and generation steps through a cryptographic module and a cryptographic program implemented in the signature device, and implements the SM2 digital signature function.

2. The SM2 digital signature generation method for signer-controlled signature creation data according to claim 1, wherein:

signature device and signature auxiliary system without exposing own secret k ₁ 、k ₂ And ensuring that the other party does not reselect k ₁ 、k ₂ In the case of (1), Q ═ b is obtained by mutual calculation ₁ k ₁ +b ₂ k ₂ ]G、Q _f ＝[b ₁ k ₁ +b ₂ k ₂ ]One method of G is as follows:

f (-) is defined as: f (1) ═ G, F (1+ d) _A )＝(G+P _A )；

Signature device calculates Q ₁ ＝[k ₁ ]F(b ₁ ) Wherein b is ₁ 1 or (1+ d) _A ) Calculating Q ₁ Is a hash value of h ₁ H is to be ₁ Sending the signature to a signature auxiliary system;

signature assisted system computation Q ₂ ＝[k ₂ ]F(b ₂ ) Wherein b is ₂ 1 or (1+ d) _A ) Calculating Q ₂ Of the hash value h ₂ H is to be ₂ Sending the data to a signature device;

the signature device receives Q ₂ Then, the received Q is calculated and checked ₂ Whether the hash value of (a) is h ₂ If not, then go toAnd (4) error processing, if so, calculating to obtain Q-Q ₁ +Q ₂ ；

Signature assisted system receive Q ₁ Thereafter, the received Q is calculated and checked ₁ Whether the hash value of (a) is h ₁ If not, the error processing is carried out, and if yes, Q is obtained through calculation _f ＝Q ₁ +Q ₂ 。

3. The SM2 digital signature generation method for signer-controlled signature creation data according to claim 1, wherein:

signature device and signature auxiliary system without exposing own secret k ₁ 、k ₂ And ensuring that the other party does not reselect k ₁ 、k ₂ In the case of (1), Q ═ bk is obtained by mutual calculation ₁ k ₂ ]G、Q _f ＝[bk ₁ k ₂ ]One method of G is as follows:

f (-) is defined as: f (1) ═ G, F (1+ d) _A )＝(G+P _A )；

b is 1 or (1+ d) _A )；

Signature device calculates Q ₁ ＝[k ₁ ]F (b), calculating Q ₁ Is a hash value of h ₁ H is to be ₁ Sending the signature to a signature auxiliary system;

signature assisted system computation Q ₂ ＝[k ₂ ]F (b), calculating Q ₂ Of the hash value h ₂ H is to be ₂ Sending the data to a signature device;

the signature device receives Q ₂ Thereafter, the received Q is calculated and checked ₂ Whether the hash value of (a) is h ₂ If not, the process goes to error processing, if yes, Q ═ k is calculated ₁ ]Q ₂ ；

Signature assisted system receive Q ₁ Thereafter, the received Q is calculated and checked ₁ Whether the hash value of (a) is h ₁ If not, the error processing is carried out, and if yes, Q is obtained through calculation _f ＝[k ₂ ]Q ₁ 。

4. The SM2 digital signature generation method for controlling signature creation data by a signer as set forth in claim 1, wherein:

the signature device and the signature assistance system check whether (s + r) mod n is 0 and/or (s + r) occurs _f ) One method for the case where mod n is 0 is as follows:

the signature device checks whether Q + [ r ] G is a zero element, if so, a case where (s + r) mod n is 0 occurs, otherwise, no;

signature assisted system check Q _f +[r _f ]If G is a zero element, then (s + r) will appear _f ) mod n is 0, otherwise it will not.

5. The SM2 digital signature generation method for signer-controlled signature creation data according to claim 1, wherein:

signature assisted system verification s ₁₂ Whether or not to use k ₁ 、r _f And a public key P _A Corresponding private key d _A Calculated, or verified s ₂ Whether or not to use k ₁ 、k ₂ 、r _f And a public key P _A Corresponding private key d _A One method of calculation is as follows:

signature assisted system check verification Q ₁ +[r _f ]G and [(s) ₁₂ )mod n](G+P _A ) Whether the two are equal or not is judged, if so, the verification is passed, otherwise, the verification fails;

alternatively, the first and second electrodes may be,

signature assisted system check verification Q _f +[r _f ]G and s ₂ ](G+P _A ) And if so, passing the verification, otherwise, failing the verification.

6. The SM2 digital signature generation method for signer-controlled signature creation data according to claim 1, wherein:

signature device verificationWhether s is use k ₁ 、k ₂ R and public key P _A Corresponding private key d _A One way to compute the digital signature in SM2 is as follows:

signature device check and verification Q + [ r ]]G and [ (s + r) mod n](G+P _A ) And if so, passing the verification, otherwise, failing the verification.

7. The SM2 digital signature generation method for signer-controlled signature creation data according to claim 1, wherein:

the signature auxiliary system maintains a blacklist of public keys, and a public key P appearing on the blacklist _A The signature assistance system does not generate a digital signature for the corresponding private key.

8. The SM2 digital signature generation method for signer-controlled signature creation data according to claim 1, wherein:

the signature assistance system discriminates and confirms whether or not the user who uses the signature device, i.e., the signer, is the public key P _A One method of owner of (1) is as follows:

at public key P _A After generation, the public key P is contained _A The public key identification information is formed by combining data of the identity identification information of the user, the public key identification information is encrypted by adopting a symmetric key of a signature auxiliary system and a symmetric key cryptographic algorithm to obtain encrypted public key identification information, or the public key identification information is encrypted by adopting a public key cryptographic algorithm to obtain public key identification information encrypted by signature, the signature encryption comprises first signature and then encryption, or first encryption and then signature, wherein the signature uses a private key of a public key registration system, and the encryption uses a public key of the signature auxiliary system; public key authentication information encrypted by adopting a symmetric key and public key authentication information encrypted by adopting a public key cryptographic algorithm signature are collectively referred to as encrypted public key authentication information; the encrypted public key authentication information is stored in the signature device; the public key registration system is a system for performing registration management on a user public key;

when the signature auxiliary system needs to identify and confirm the user using the signature device, namely the signerWhether or not it is a public key P _A When the owner of the signature device is in use, the signature device submits the encrypted public key authentication information to the signature auxiliary system;

signature auxiliary system checks public key P contained in public key identification information obtained by decryption _A Whether it is the public key P currently used for digital signature generation verification _A If not, error processing is carried out, and if yes, the operation is continued;

9. The SM2 digital signature generation method for signer-controlled signature creation data according to claim 8, wherein:

one method for generating the public key authentication information encrypted by the symmetric key or the public key authentication information encrypted by the signature is as follows:

in the generation of P _A ，c _A The signing device then submits P to the public key registration system _A Application for registration P _A ；

Public key registration system check P _A Whether the registration is carried out or not, if the registration is carried out, the registration is prompted, and if the registration is not carried out, the registration is continued;

the signature device proves possession of P to the public key registration system without exposing its own secret _A Corresponding private signature key d _A If the operation is successful, the subsequent operation is carried out, otherwise, the error processing is carried out;

the signature device submits identity authentication information for user identity authentication to the public key registration system, and then the public key registration system uses the symmetry of the signature auxiliary systemKey, containing P using symmetric key cryptographic algorithm _A Encrypting the public key authentication information of the user identity authentication information to form encrypted public key authentication information, or using the private key of the public key registration system to perform the encryption on the public key authentication information containing P _A Signing the public key identification information of the user identity identification information, encrypting the signed public key identification information by adopting a public key of a signature auxiliary system to obtain the public key identification information which is signed first and then encrypted, or adopting a public key of the signature auxiliary system to pair the public key containing P by a public key registration system _A And encrypting the public key identification information of the user identity identification information to obtain encrypted public key identification information, and then using a private key of the public key registration system to sign the encrypted public key identification information to obtain the public key identification information which is encrypted firstly and then signed.

10. The SM2 digital signature generation method for signer-controlled signature creation data according to claim 9, wherein:

one method for updating the encrypted public key authentication information by the signature device is as follows:

the signature device submits the encrypted public key authentication information to a public key registration system, and the public key registration system decrypts the encrypted public key authentication information, wherein if the encrypted public key authentication information is the signature encrypted public key authentication information, the public key registration system also verifies the validity of a digital signature contained in the signature encrypted public key authentication information, and continues after the verification is passed;

the signature device proves possession of P to the public key registration system without exposing its own secret _A Corresponding private signature key d _A ；

Signature device certifies possession of P to public key registration system _A Corresponding private signature key d _A Then, the signature device and the public key registration system are registered according to the registration P _A Time-generated encrypted public key authenticationAnd generating new encrypted public key authentication information in the same way as other information, wherein the new encrypted public key authentication information comprises the public key authentication information encrypted by adopting a symmetric key and the public key authentication information encrypted by adopting a public key cryptographic algorithm signature.

11. The SM2 digital signature generation method for signer-controlled signature creation data according to claim 9, wherein:

12. The SM2 digital signature generation method for signer-controlled signature creation data according to claim 9, wherein:

if the user identity authentication information in the public key authentication information is a password and the public key authentication information contains the user electronic communication address, the public key registration system provides the user with the function of resetting or recovering the password in the public key authentication information through the user electronic communication address contained in the public key authentication information.

13. The SM2 digital signature generation method for signer-controlled signature generation data according to any one of claims 1 to 12, wherein:

P _A ＝[d _A ]G，c _A ＝E((1+d _A ) ^-1 ) The generation mode of (2) comprises:

P _A 、c _A the generation method is as follows:

signature device generation d _A Calculate P _A ＝[d _A ]G，c _A ＝E((1+d _A ) ^-1 ) Then destroy d _A ；

P _A 、c _A The second generation mode:

a computing device other than the signature device generating d _A Calculate P _A ＝[d _A ]G，c _A ＝E((1+d _A ) ^-1 ) Then destroy d _A A 1 is to P _A 、c _A Deriving, then, adding P _A 、c _A Importing the data into a signature device;

P _A 、c _A the third generation mode:

one computing device other than the signature device is in [1, n-1 ]]Randomly selecting an integer d ₂ Calculate G ₂ ＝[(d ₂ ) ^-1 ]G，t ₂ ＝E(d ₂ ) Wherein (d) ₂ ) ^-1 Is d ₂ Is inverted modulo n, then d is multiplied ₂ Destroying G ₂ 、t ₂ Deriving, then G ₂ 、t ₂ Importing the data into a signature device;

signature devices in [1, n-1 ]]Randomly selecting an integer d ₁ Calculate P _A ＝[(d ₁ ) ^-1 ]G ₂ -G, using t ₂ Is calculated to obtain c _A ＝E(d ₁ d ₂ ) Wherein (d) ₁ ) ^-1 Is d ₁ Is inverted modulo n, then d is multiplied ₁ 、G ₂ 、t ₂ Is destroyed, then d ₁ d ₂ ≡(1+d _A ) ^-1 (mod n)，P _A ＝[d _A ]G；

For P as described above _A 、c _A The generation modes I, II and III are that the encryption operation E (-) adopts a public key of a homomorphic encryption algorithm of the signature auxiliary system, the signature auxiliary system has a private key of a decryption operation corresponding to the public key adopted by the encryption operation E (-) of the homomorphic encryption algorithm, or the encryption operation E (-) adopts a public key in a public and private key pair of a temporarily generated homomorphic encryption algorithm, and the private key in the public and private key pair of the temporarily generated homomorphic encryption algorithm is encrypted by the public key of the signature auxiliary system to form a ciphertext d of the encrypted private key _E ；

P _A 、c _A The generation mode is four:

the SM2 user of the signature private key uses the signature device to interact with the key collaborative generation system, and utilizes the homomorphic encryption algorithm to collaboratively calculate to obtain P without exposing respective secrets _A ＝[d _A ]G，c _A ＝E((1+d _A ) ^-1 ) Then destroying the usage in the calculation processSecret;

for P as described above _A 、c _A The generation mode is four, the encryption operation E (-) adopts a public key of a homomorphic encryption algorithm of the signature auxiliary system, the signature auxiliary system has a private key of decryption operation corresponding to the public key adopted by the encryption operation E (-), or the encryption operation E (-) adopts a public key in a public and private key pair of the homomorphic encryption algorithm temporarily generated by a key cooperation generation system, the private key in the public and private key pair of the temporarily generated homomorphic encryption algorithm is encrypted by the key of the signature auxiliary system to form a ciphertext d of the encrypted private key _E Wherein the key of the signature assistance system comprises a symmetric key or a public key.

14. The SM2 digital signature generation method for signer-controlled signature creation data according to claim 13, wherein:

for P as described above _A 、c _A In the fourth generation mode, users of SM2 signature private key use the signature device to interact with the key collaborative generation system, and obtain P through collaborative calculation by using homomorphic encryption algorithm under the condition of not exposing respective secrets _A ＝[d _A ]G，c _A ＝E((1+d _A ) ^-1 ) One way of (2) is as follows:

the SM2 user signing the private key sends an SM2 key pair cooperation generation request to the key cooperation generation system by using the signing device;

key co-generation system in [1, n-1 ]]Randomly selecting an integer d ₂ Calculate G ₂ ＝[(d ₂ ) ^-1 ]G，t ₂ ＝E(d ₂ ) Wherein (d) ₂ ) ^-1 Is d ₂ Is inverted modulo n, and d is then multiplied ₂ Destroying G ₂ 、t ₂ Is sent to a signature device, wherein t ₂ ＝E(d ₂ ) The public key adopted by the encryption operation is the public key of the homomorphic encryption algorithm of the signature auxiliary system or the public key in the public and private key pair of the homomorphic encryption algorithm temporarily generated by the key cooperative generation system, and for the latter, the key cooperative generation systemThe private key in the temporarily generated public and private key pair of the homomorphic encryption algorithm is encrypted by using the key of the signature auxiliary system to form an encrypted private key ciphertext d _E Then d is _E Same G ₂ 、t ₂ Sending the information to a signing device together, wherein the key of the signature auxiliary system comprises a symmetric key and a public key;

signature apparatus in [1, n-1 ]]Randomly selecting an integer d ₁ Calculate P _A ＝[(d ₁ ) ^-1 ]G ₂ -G, using t ₂ Is calculated to obtain c _A ＝E(d ₁ d ₂ ) Wherein (d) ₁ ) ^-1 Is d ₁ Is inverted modulo n, then d is multiplied ₁ 、G ₂ 、t ₂ Destroying;

the signature device is not exposed c _A And d _A In the case of (2), the validation c is carried out by interacting with the key co-generation system _A Corresponding plaintext c _Am Has a d ₁ d ₂ ≡(1+d _A ) ^-1 (mod n) and P _A Is [ d ] _A ]G, if the verification is passed, d ₁ d ₂ ≡(1+d _A ) ^-1 (mod n)，P _A ＝[d _A ]G, otherwise, turning to error processing.

15. A signer-controlled SM2 digital signature generation system of the SM2 digital signature generation method for signer-controlled signature generation data of any one of claims 1 to 12, wherein:

the system comprises the signing device and a signature auxiliary system, and when the signature of the private key d needs to be signed by using the SM2 of the user _A When a message M is digitally signed, the name device and the signature assistance system generate a digital signature for the message M in accordance with the SM2 digital signature generation method in which the signer masters signature creation data.