CN116094729B - Method and system for offline authorization and online signature generation based on SM9 signature - Google Patents

Abstract

The invention discloses an off-line authorization and on-line signature generation method and system based on SM9 signature, wherein the method comprises a key generation center KGC given parameterSelecting random numbersAs a master private key, and calculate a master public key P _pub＝[α]P₂; the key generation center KGC generates a partial private key of the offline authorizer as d _ID＝[α·(H₁(ID)+α)^‑1]P₁ and sends d _ID to the user; setting an offline authorizer key; setting an online signer key; offline authorization is performed on the message m _i; online signing and verification signing of message m _i. The literature has pointed out an online offline authorization signature system based on SM2 and a certificate-free signature system based on SM9, but an offline authorization and online signature scheme based on SM9 digital signature has not been proposed yet. The method divides the signature into two stages of on-line and off-line, and can be suitable for application scenes with limited resources. The invention enriches the application of SM9 digital signature.

Description

Method and system for offline authorization and online signature generation based on SM9 signature

Technical Field

The invention belongs to the technical field of information security, relates to an offline authorization and online signature generation method and system, and in particular relates to an SM9 signature-based offline authorization and online signature generation method and system.

Background

Digital signatures are an important component of the field of public key cryptography. Digital signatures can be used to replace traditional manual signatures and seals. The signature can realize various security targets such as content confirmation, approval, validation and responsibility, and anti-repudiation, anti-counterfeiting, anti-tampering and the like. The online offline authorization signature is a special digital signature technology, most of the signature is calculated in an offline stage before the signature message arrives, and the calculation results are stored, so that when the message to be signed is received, the online signature of the message can be generated in a short time by utilizing the data stored in the offline stage, and the online authorization signature is generally applied to the scene of the Internet of things with limited resources.

The SM9 algorithm is an identification password algorithm based on elliptic curve bilinear pairs, issued by the national password administration (Standard Table number: GM/T0044-2016 SM9 identification password algorithm) at 28 of 2016, and incorporated into the International standards at 11 of 2018. It mainly comprises three parts: digital signature algorithm, public key encryption algorithm, key exchange protocol. The current SM9 identification password algorithm cannot be flexibly adapted to an application field needing offline authorization and online signature, and in some application scenes needing to adapt to the national password algorithm, the password scheme is lacked as a support.

Disclosure of Invention

In order to solve the technical problems, the invention provides an off-line authorization and on-line signature generation method and system based on SM9 signature.

The technical scheme adopted by the method is as follows: an off-line authorization and on-line signature generation method based on SM9 signature comprises the following steps:

Step 1: key generation center KGC given parameters Wherein, given a safety parameter lambda, a specific curve generating parameter t is selected, and an elliptic curve base domain/>, is constructed by a base domain characteristic equation p (t) =36t ⁴+36t³+24t² +6t+1And determining curve equation parameters as a and b, embedding times as k=12, and constructing/>P-th order cyclic subgroup/>And its generator/>Construction/>P-th order cyclic subgroup/>And its generation elementBilinear pair e: /(I)Selecting a cryptographic hash function H ₁(·),H₂(·),H₃ (): a set of integers consisting of 1, 2..q-1, q being a large prime number;

Step 2: selecting random numbers As a master private key, and calculate a master public key P _pub＝[α]P₂;

Step 3: the key generation center KGC generates a partial private key of the offline authorizer as d _ID＝[α·(H₁(ID)+α)^-1]P₁ and sends d _ID to the user;

Step 4: setting an offline authorizer key;

Step 5: setting an online signer key;

Step 6: offline authorization signing is carried out on the message m _i;

step 7: online signing the message m _i;

Step8: and verifying the signature.

The system of the invention adopts the technical proposal that: an SM9 signature-based offline authorization and online signature generation system, comprising the following modules:

module 1 for key generation center KGC given parameters Wherein, given a safety parameter lambda, a specific curve generating parameter t is selected, and an elliptic curve base domain/>, is constructed by a base domain characteristic equation p (t) =36t ⁴+36t³+24t² +6t+1And determining curve equation parameters as a and b, embedding times as k=12, and constructing/>P-th order cyclic subgroup/>By its generator/>Construction/>P-th order cyclic subgroup/>By its generatorBilinear pair e: /(I)Selecting a cryptographic hash function H ₁(·),H₂(·),H₃ (): a set of integers consisting of 1, 2..q-1, q being a large prime number;

A module 2 for selecting random numbers As a master private key, and calculate a master public key P _pub＝[α]P₂;

The module 3 is used for generating a partial private key d _ID＝[α·(H₁(ID)+α)^-1]P₁ of the offline authorizer by the key generation center KGC and sending d _ID to the user;

a module 4 for offline authorizer key setting;

a module 5 for online signer key setting;

a module 6, configured to perform offline authorization signing on the message m _i;

a module 7 for online signing the message m _i;

module 8 for verifying the signature.

Compared with the prior art, the invention has the following advantages and beneficial effects:

1. The literature has pointed out an online offline authorization signature system based on SM2 and a certificate-free signature system based on SM9, but an offline authorization and online signature scheme based on SM9 digital signature has not been proposed yet.

2. The scheme divides the signature into two stages of online and offline, and can be suitable for application scenes with limited resources.

3. Enriches the application of SM9 digital signatures.

Drawings

FIG. 1 is a flow chart of a method according to an embodiment of the present invention;

FIG. 2 is a flow chart of an offline authorizer key generation phase in accordance with an embodiment of the present invention;

FIG. 3 is a flow chart of an online signer key generation and offline authorization signing authorization phase of an embodiment of the present invention;

fig. 4 is a flow chart of an online signature and verification phase of an embodiment of the present invention.

Detailed Description

In order to facilitate the understanding and practice of the invention, those of ordinary skill in the art will now make further details with reference to the drawings and examples, it being understood that the examples described herein are for the purpose of illustration and explanation only and are not intended to limit the invention thereto.

In order to ensure the universality, the parameter selection of the embodiment is consistent with the standard parameter of the SM9 digital signature algorithm. Specific symbols are described as follows:

q: a large prime number.

An integer set consisting of 1, 2.

The addition loop group with order p.

The multiplication loop group with the order p.

P ₁,P₂: respectively as groupsAnd/>Is a generator of (1).

G ^u: the u-th power of element G in multiplicative group G _T.

[K] P: the k times point of point P on the elliptic curve, k being a positive integer.

E: bilinear pair mapping from G ₁×G₂ to G _T.

H ₁(·),H₂(·),H₃ (.): the cryptographic functions derived from the cryptographic hash function are all{0,1} ^* Represents a binary string of length.

F (.): cryptographic function derived from cryptographic hash function

KGC: key generation center

Alpha: a system master private key held by KGC secrets.

P _pub: the system main public key disclosed by KGC has a calculation formula of P _pub＝[α]P₂.

ID: a discernable identification of the user.

D _ID: a partial private key of the offline authorizer.

X: secret value of the offline authorizer.

Usk: private key of the offline authorizer.

Y _i,z_i: private key of the online signer.

X, Y _i,Z_i: the public key of the user.

M _i: a message to be signed.

H, V: offline authorization signature value.

T _i,r_i: online signature value.

Mod q: and (5) performing modular q operation. For example, 31mod 5≡1.

X||y: x and y, where x and y may be a bit string or a byte string.

Referring to fig. 1, the method for offline authorization and online signature generation based on SM9 signature provided by the invention comprises the following steps:

Step 1: key generation center KGC given parameters Wherein a security parameter lambda is given; 256-bit BN curve is adopted to realize bilinear pairing operation, specifically, a specific curve generation parameter t is selected, and an elliptic curve base domain/> is constructed through a base domain characteristic equation p (t) =36t ⁴+36t³+24t² +6t+1And determining curve equation parameters as a and b, embedding times as k=12, and constructing/>P-th order cyclic subgroup/>And its generation elementConstruction/>P-th order cyclic subgroup/>And its generator/>Bilinear pair e: selecting a cryptographic hash function H ₁(·),H₂(·),H₃ (): /(I) A set of integers consisting of 1, 2..q-1, q being a large prime number;

Step 2: selecting random numbers As a master private key, and calculate a master public key P _pub＝[α]P₂;

Step 3: the key generation center KGC generates a partial private key of the offline authorizer as d _ID＝[α·(H₁(ID)+α)^-1]P₁ and sends d _ID to the user;

Step 4: setting an offline authorizer key;

Please refer to fig. 2, in this embodiment, the offline authorizer randomly selects As secret values, q= [ H ₁(ID)]P₂+P_pub, x= [ X ] Q, and s=h ₃ (X); the private key usk= [ (x+s) ^-1]d_ID, the public key X of the offline authorizer is set.

Step 5: setting an online signer key;

please refer to fig. 3, in this embodiment, the online signer i randomly selects Calculating Y _i＝[y_i]P₁,Z_i＝[z_i]P₁; the private key of the online signer is set to (Y _i,z_i) and the public key (Y _i,Z_i).

Step 6: offline authorization signing is carried out on the message m _i;

Please refer to fig. 3, in the present embodiment, the offline authorizer authorizes the plurality of online signers to generate a plurality of offline authorization signatures, and calculates an element g=e in G _T (P ₁,P_pub); randomly select Calculation/>H _i＝H₂(X||Y_i||Z_i||W_i), calculating l _i＝w_i-h_i mod q and V _i＝[l_i ] usk; generating an offline authorization signature value (h _i,V_i); wherein mod q is a modulo q operation and usk is the private key of the offline authorizer.

Step 7: online signing the message m _i;

please refer to fig. 4, in this embodiment, the online signer randomly selects Calculate T _i＝[t_i]P₁ and r _i＝z_i-F(m_i,T_i)(t_i+y_i) mod q; generating an online signature value (T _i,r_i);

Step8: verifying the signature;

Please refer to fig. 4, the specific implementation of step 8 in this embodiment includes the following sub-steps:

Step 8.1: the verifier computes from the given message m _i, the offline authorizer's public key X, the online signer's public key (Y _i,Z_i), the identity ID, the offline authorization signature value (h _i,V_i) and the online signature value (T _i,r_i):

Z_i′＝[r_i]P₁+[F(m_i,T_i)](T_i+Y_i)；

Q＝[H₁(ID)]P₂+P_pub；

s＝H₃(X)；

u_i＝e(V_i，X+[s]Q)；

g＝e(P₁,P_pub)；

W′_i＝u_i·gⁱ；

step 8.2: judging whether h _i＝H₂(X||Y_i||Z_i′||W_i') is true or not, if so, the signature is legal; otherwise, the signature is invalid;

Correctness:

Z_i′＝[r_i]P₁+[F(m_i,T_i)](T_i+Y_i)

＝[z_i-F(m_i,T_i)(t_i+y_i)]P₁+[F(m,T_i)]([t_i]P₁+[y_i]P₁)

＝[z_i]P₁-[F(m_i,T_i)(t_i+y_i)]P₁+[F(m,T_i)]([t_i]P₁+[y_i]P₁)

＝[z_i]P₁-[F(m_i,T_i)(t_i+y_i)]P₁+[F(m_i,T_i)(t_i+y_i)]P₁

＝[z_i]P₁；

u＝e(V，X+[s]Q)

＝e([l]usk_i，[x]Q+[s]Q)

＝e([l·(x+s)^-1]d_ID，[x]Q+[s]Q)

＝e([l·α·(x+s)^-1·(H₁(ID)+α)^-1]P₁,[(x+s)·(H₁(ID)+α)]P₂)

＝e(P₁,P_pub)^l

＝g^l；

W′＝u·g^h

＝g^l·g^h

＝g^w-h·g^h

＝g^w；

h＝H₂(X||Y_i||Z_i||W′)

＝H₂(X||[y_i]P₁||[z_i]P₁||g^w)。

The invention is based on the signature structure of SM9 algorithm, is divided into two stages of offline authorization and online signature, and is suitable for low-end computing equipment with weaker computing capacity.

It should be understood that the foregoing description of the preferred embodiments is not intended to limit the scope of the invention, but rather to limit the scope of the claims, and that those skilled in the art can make substitutions or modifications without departing from the scope of the invention as set forth in the appended claims.

Claims (2)

1. An offline authorization and online signature generation method based on SM9 signature is characterized by comprising the following steps:

Step 1: key generation center KGC given parameters Wherein, given a safety parameter lambda, a specific curve generating parameter t is selected, and an elliptic curve base domain/>, is constructed by a base domain characteristic equation p (t) =36t ⁴+36t³+24t² +6t+1And determining curve equation parameters as a and b, embedding times as k=12, and constructing/>P-th order cyclic subgroup/>And its generator/>Construction/>P-th order cyclic subgroup/>And its generation elementBilinear pair/>Selecting a cryptographic hash function H ₁(·),H₂(·),H₃ (): a set of integers consisting of 1, 2..q-1, q being a large prime number;

Step 2: selecting random numbers As a master private key, and calculate a master public key P _pub＝[α]P₂;

Step 3: the key generation center KGC generates a partial private key of the offline authorizer as d _ID＝[α·(H₁(ID)+α)^-1]P₁ and sends d _ID to the user;

Step 4: setting an offline authorizer key;

wherein, the offline authorizer randomly selects As secret values, q= [ H ₁(ID)]P₂+P_pub, x= [ X ] Q, and s=h ₃ (X); setting a private key usk= [ (x+s) ^-1]d_ID and a public key X of the offline authorizer;

Step 5: setting an online signer key;

Wherein, the online signer i randomly selects Calculating Y _i＝[y_i]P₁,Z_i＝[z_i]P₁; setting the private key of the online signer to be (Y _i,z_i) and the public key (Y _i,Z_i);

Step 6: offline authorization signing is carried out on the message m _i;

Wherein the offline authorizer authorizes the plurality of online signers to generate a plurality of offline authorization signatures, and calculates an element g=e in G _T (P ₁,P_pub); randomly select Calculation/>H _i＝H₂(X||Y_i||Z_i||W_i), calculating l _i＝w_i-h_i mod q and V _i＝[l_i ] usk; generating an offline authorization signature value (h _i,T_i); wherein mod q is modulo q operation, usk is the private key of the offline authorizer;

step 7: online signing the message m _i;

Wherein the online signer randomly selects Calculate T _i＝[t_i]P₁ and r _i＝z_i-F(m_i,T_i)(t_i+y_i) mod q; generating an online signature value (T _i,r_i); wherein F (.): cryptographic function derived from cryptographic hash function/>

Step8: verifying the signature;

the specific implementation comprises the following substeps:

Step 8.1: the verifier computes from the given message m _i, the offline authorizer's public key X, the online signer's public key (Y _i,Z_i), the identity ID, the offline authorization signature value (h _i,V_i) and the online signature value (T _i,r_i):

Z_i′＝[r_i]P₁+[F(m_i,T_i)](T_i+Y_i)；

Q＝[H₁(ID)]P₂+P_pub；

s＝H₃(X)；

u_i＝e(V_i，X+[s]Q)；

g＝e(P₁,P_pub)；

step 8.2: judging whether h _i＝H₂(X||Y_i||Z_i′||W_i') is true or not, if so, the signature is legal; otherwise, the signature is invalid;

Correctness:

Z_i′＝[r_i]P₁+[F(m_i,T_i)](T_i+Y_i)

＝[z_i-F(m_i,T_i)(t_i+y_i)]P₁+[F(m,T_i)]([t_i]P₁+[y_i]P₁)

＝[z_i]P₁-[F(m_i,T_i)(t_i+y_i)]P₁+[F(m,T_i)]([t_i]P₁+[y_i]P₁)

＝[z_i]P₁-[F(m_i,T_i)(t_i+y_i)]P₁+[F(m_i,T_i)(t_i+y_i)]P₁

＝[z_i]P₁；

u＝e(V，X+[s]Q)

＝e([l]usk_i，[x]Q+[s]Q)

＝e([l·(x+s)^-1]d_ID，[x]Q+[s]Q)

＝e([l·α·(x+s)^-1·(H₁(ID)+α)^-1]P₁,[(x+s)·(H₁(ID)+α)]P₂)

＝e(P₁,P_pub)^l

＝g^l；

W′＝u·g^h

＝g^l·g^h

＝g^w-h·g^h

＝g^w；

h＝H₂(X||Y_i′||Z′_i||W′)

＝H₂(X||[y_i]P₁||[z_i]P₁||g^w)。

2. an SM9 signature-based offline authorization and online signature generation system employing the method of claim 1; the device is characterized by comprising the following modules:

module 1 for key generation center KGC given parameters Wherein, given a safety parameter lambda, a specific curve generating parameter t is selected, and an elliptic curve base domain/>, is constructed by a base domain characteristic equation p (t) =36t ⁴+36t³+24t² +6t+1And determining curve equation parameters as a and b, embedding times as k=12, and constructing/>P-th order cyclic subgroup/>And its generator/>Construction/>P-th order cyclic subgroup/>And its generation elementBilinear pair/>Selecting a cryptographic hash function H ₁(·),H₂(·),H₃ (): a set of integers consisting of 1, 2..q-1, q being a large prime number;

A module 2 for selecting random numbers As a master private key, and calculate a master public key P _pub＝[α]P₂;

The module 3 is used for generating a partial private key d _ID＝[α·(H₁(ID)+α)^-1]P₁ of the offline authorizer by the key generation center KGC and sending d _ID to the user;

a module 4 for offline authorizer key setting;

a module 5 for online signer key setting;

a module 6, configured to perform offline authorization signing on the message m _i;

a module 7 for online signing the message m _i;

module 8 for verifying the signature.