CN116155490A - A Signature Key Generation Method Based on SM9 Cryptographic Algorithm - Google Patents

Abstract

The invention discloses a signature key generation method based on the SM9 cryptographic algorithm. The signature key generation method includes the following steps: M1: generate a random number ks∈[1, N‑1] through KGC as the signature master private key, where N is the order of the SM9 elliptic curve; M2: calculate the elements in _G2 Ppub=[ks]P2 is used as the signature master public key, where the group G ₂ represents an additive cyclic group whose order is a prime number N, and P2 is the generator of the group G ₂ . The signature key generation method provided by the present invention uses the randomized ks' to replace the signature master private key ks for calculation; uses the randomized ds' to replace the signature private key ds for calculation. Using this double random protection mechanism further improves the security.

Description

A Signature Key Generation Method Based on SM9 Cryptographic Algorithm

technical field

The invention relates to a method for generating a signature key based on an SM9 cryptographic algorithm, and belongs to the technical field of information security.

Background technique

At present, digital signature and encryption and decryption technologies based on public key cryptography have been widely used in e-commerce, identity authentication and other applications, providing a set of mature and secure technologies and specifications for online transactions and communications. The security of the private key is one of the basic conditions to ensure the security of these applications.

The SM9 identity encryption algorithm is a commercial encryption algorithm based on the identity encryption system independently designed in my country. It is an identity-based encryption algorithm constructed using bilinear pairings on elliptic curves in a finite field. In the SM9 cryptographic algorithm, the user's private key is calculated by the key generation center based on the master key and the user ID, and the user's public key is uniquely determined by the user ID and the authenticity of the ID is guaranteed by the user equipment manager. SM9 cryptographic algorithms include signature/signature verification algorithms, encryption/decryption algorithms, encapsulation/decapsulation algorithms and key exchange algorithms. Compared with the traditional encryption system using public key infrastructure (PKI), the biggest advantage of the SM9 encryption algorithm is that it does not require data certificates, has low total cost of ownership, and is easy to manage and use.

According to the Chinese National Standard GB/T 38635.2-2020 "Information Security Technology SM9 Cryptographic Algorithm Part 2: Algorithm" Section 3.8, the user private key of the SM9 cryptographic algorithm is generated by the Key Generation Center (KGC) according to the master private key and user ID Generated, and the master private key is generally generated by KGC through a random number generator. The master private key and the user private key are directly related to the security of the SM9 cryptographic algorithm, so it is necessary to develop a method to protect the user private key during the signature key generation algorithm to prevent information leakage of the master private key and the user private key.

Contents of the invention

The technical problem to be solved by the present invention is to provide a signature key generation method based on the SM9 cryptographic algorithm.

For realizing above-mentioned technical purpose, the present invention adopts following technical scheme:

A method for generating a signature key based on the SM9 cryptographic algorithm, comprising the following steps:

M1: Generate a random number ks∈[1, N-1] through KGC as the signature master private key, where N is the order of the SM9 elliptic curve;

M2: Calculate the element Ppub=[ks]P2 in G ₂ as the signature master public key, where the group G ₂ represents the additive cyclic group whose order is a prime number N, and P2 is the generator of the group G ₂ .

Wherein preferably, the signature key generation method also includes the following steps:

M3: Obtain the user ID and one byte signature private key generation function identifier hi d spliced into Z=ID||hi d;

M4: Calculate t1=H1(Z, N)+ks in the finite field FN, wherein, H1 is a cryptographic function;

M5: Calculate t2=ks*t 1^-1modN;

M6: Calculate the signature private key ds=[t 2]P 1, where P 1 is the generator of the group G ₁ , and the group G ₁ represents the additive cyclic group whose order is a prime number N.

Wherein preferably, the step M2 includes the following sub-steps:

S 1: Obtain random number R1 through a secure random number generator;

S2: Calculate R1'=R 1^-1modN by the modular inverse operation unit;

S3: Calculate Q=[R1']P2 by using the extended domain point multiplication operation unit;

S4: Calculate ks'=ks*R1modN by the modular multiplication unit;

S5: Calculate Ppub'=[ks']Q by using the extended domain point multiplication unit;

Preferably, the random number R1 is between [1, N-1], and R1 is smaller than N.

Wherein preferably, Q is calculated as a random number by using an extended field point multiplication operation unit.

Preferably, the random number R2 is obtained through a secure random number generator.

Wherein preferably, in the step M2, the following sub-steps are also included:

S7: Calculate t 1'=t 1*R2modN by the modular multiplication operation unit;

S8: Calculate t 1''=t 1'^-1modN by the modular inverse operation unit;

S9: Calculate t 2'=ks*t 1''modN by the modular multiplication unit;

S 10: Calculate D=[R2]P 1 by using the base field point multiplication unit;

S 11: Calculate ds'=[t 2']D by using the base field point multiplication operation unit.

Preferably, the random number R2 is between [1, N-1], and R2 is smaller than N.

Compared with the prior art, the signature key generation method provided by the present invention uses the randomized ks' instead of the signature master private key ks for calculation. In this way, the use of the signature master private key ks can be reduced, and the risk of leakage of the signature master private key ks can be reduced; the intermediate variable t2 is replaced by the randomized t2', and the signature private key ds is replaced by the randomized ds'. In this way, the use of the intermediate variable t2 can be reduced, and the private signature key ds can be prevented from being leaked because P1 is a public parameter and t2 is leaked. Using this double random protection mechanism further improves the security.

Description of drawings

Fig. 1 is in the embodiment of the present invention, the generation flowchart of signature master public key;

Fig. 2 is a flow chart of generating a signature private key in an embodiment of the present invention.

Detailed ways

The technical content of the present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments.

In order to enable those skilled in the art to better understand the present invention, the relevant background of the present invention will be further described below. The SM9 signature key generation algorithm is described in Section 6.1 of the Chinese national standard GB/T 38635.2-2020 "Information Security Technology SM9 Cryptographic Algorithm Part 2: Algorithm", including the system signature master key and user signature key. The generated The process is organized as follows:

A1: Generate a random number ks∈[1, N-1] through KGC as the signature master private key;

A2: Calculate the element Ppu=[ks]P2 in G2 as the signature master public key;

A3: Obtain the user ID and a one-byte signature private key generation function identifier hid and concatenate it into Z=ID||hid;

A4: Calculate t1=H1(Z, N)+ks in the finite field FN, and H1 is a cryptographic function;

A5: Calculate t2=ks*t 1^-1modN;

A6: Calculate the signature private key ds=[t2]P1.

The embodiment of the invention discloses a signature key generation method based on the SM9 encryption algorithm. Referring to the flow chart of generating the signature master public key shown in Figure 1 and the generation flow chart of the signature private key shown in Figure 2, the signature key generation method replaces the domain extension point product calculation in which the signature master private key ks participates, That is to replace the operation Ppub=[ks]P2 in step A2 of the SM9 signature key generation algorithm.

Therefore, the signature key generation method provided by the embodiment of the present invention at least includes the following steps.

M1: Generate a random number ks∈[1, N-1] through KGC as the signature master private key;

M2: Calculate the element Ppub'=[ks']Q in G2 as the signature master public key;

As shown in Figure 1, the M2 step specifically includes the following sub-steps:

S 1: Obtain random number R1 through a secure random number generator;

Specifically, the random number R1 needs to be between [1, N-1]. If the generated random number R1 is greater than or equal to N, a new random number R1 is generated until R1 is smaller than N. Among them, N is the order of the SM9 elliptic curve, specifically, N represents the order of the cyclic group G ₁ , G ₂ , G _T , N is a prime number greater than 2 ¹⁹¹ , and the group G ₁ , G ₂ represents the addition cycle whose order is a prime number N The group, the group G _T represents the multiplicative cyclic group whose order is a prime number N.

S2: Calculate R1'=R 1^-1modN by the modular inverse operation unit;

Wherein, mod represents a modulo operation, and it can be seen from this formula that R1*R1'=1.

S3: Calculate Q=[R1']P2 by using the extended domain point multiplication operation unit;

Among them, P2 is the generator of group G2, and [R 1']P2 represents the R1' times of P2. Since R1 is a random number, it can be known from step S2 that R1' is also a random number. Therefore, Q is also a random number, and the obtained random number Q is used to replace P2 in the original extended domain point multiplication operation Ppub=[ks]P2.

S4: Calculate ks'=ks*R1modN by the modular multiplication unit;

Wherein, this formula means ks'=ks*R 1, and the obtained ks' replaces ks in the original dot multiplication operation Ppub=[ks]P2.

S5: Calculate Ppub'=[ks']Q by using the extended domain point multiplication unit;

It can be seen that, through the above-mentioned sub-flow, the present invention makes the signature master private key ks not participate in the domain expansion point multiplication operation in the SM9 standard flow, but uses the randomized name master private key ks' to participate in the operation. This can reduce the number of times the signature master private key ks is used in operations, thereby reducing the risk of leakage of the signature master private key ks.

As shown in Figure 2, the base field point multiplication operation involving the signature private key ds is replaced, that is, the operation t 2 = ks*t 1^-1modN in step A5 of the SM9 signature key generation algorithm and the operation ds = [t 2] P 1 for replacement.

Therefore, the signature key generation method provided by the embodiment of the present invention further includes the following steps:

M3: Obtain the user ID and one byte signature private key generation function identifier hi d spliced into Z=ID||hi d;

M4: Calculate t1=H1(Z, N)+ks in the finite field FN, H1 is a cryptographic function;

M5: Calculate t2'=ks*t 1''mod N;

M6: Calculate signature private key ds'=[t 2']D;

As shown in Figure 2, M5-M6 specifically includes the following sub-steps:

S6: Obtain random number R2 through a secure random number generator;

Same as S1, the random number R2 needs to be located between [1, N-1], which will not be repeated here.

S7: Calculate t 1'=t 1*R2 mod N by the modular multiplication operation unit;

S8: Calculate t 1''=t 1'^-1mod N by the modular inverse operation unit;

S9: Calculate t 2'=ks*t 1'' mod N by the modular multiplication unit;

Through S7-S9, the obtained t2' is randomized by R2, and will replace t2 in the original base field point multiplication operation ds=[t 2]P 1 .

S 10: Calculate D=[R2]P 1 by using the base field point multiplication unit;

Among them, P 1 is the generator of group G1, and [R2]P 1 means R2 times of P1. Because R2 is a random number, D is also a random number, and the obtained D will replace P1 in the original field point multiplication operation ds=[t2]P 1 .

S 11: Calculate ds'=[t2']D by using the base field point multiplication operation unit.

It can be seen from the above sub-flow that the intermediate variable t2 does not participate in the modular inverse operation and the base field point multiplication operation in the SM9 standard, and the randomized t2' is used in the present invention to participate in the operation. This can reduce the number of times the intermediate variable t 2 is used in operations, thereby reducing the risk of leakage of the intermediate variable t 2 , thereby reducing the risk of leakage during the generation of the signature private key ds, and enhancing the security of the key generation process.

In order to illustrate the feasibility of the signature key generation method provided by the embodiment of the present invention, further demonstration is as follows.

1) Replace ks' in step M2 of the private key protection method of the SM9 signature key generation algorithm to obtain Ppub'=[ks*R1]Q;

2) Replace Q in the previous step to get Ppub'=[ks*R1]*[R1']P2

3) That is, Ppub'=[ks*R1*R1']P2=[ks]P2, the result is consistent with the description of Ppub=[ks]P2 in the SM9 standard process;

4) Replace D in step M6 of the private key protection method of the SM9 signature key generation algorithm to obtain ds'=[t2'*R2]P1;

5) Replace t 2' in the previous step to get ds'=[ks*t 1''*R2]P 1;

6) Replace t 1'' in the previous step to get ds'=[ks*t 1'^-1*R2]P 1;

7) Replace t 1' in the previous step to get ds'=[ks*(t 1*R2)^-1*R2]P 1;

8) Get ds'=[ks*t 1^-1*R2^-1*R2]P 1=[ks*t 1^-1]P 1 from the previous step, because t2=ks*t1^-1mod N , so the obtained result is consistent with the description of ds=[t2]P 1 in step 6 of the original process.

From this, it can be explained that the generation steps of the signature master public key and the signature private key in Section 6.1 of GB/T 38635.2-2020 "Information Security Technology SM9 Cryptographic Algorithm Part 2: Algorithm" use the signature encryption key provided by the embodiment of the present invention The replacement of the key generation method will not affect the final calculation result of the signature private key, that is, the replacement method of the private key protection method provided by the present invention is feasible in principle.

To sum up, the signature key generation method provided by the embodiment of the present invention includes protection of the signature master private key and protection of the signature private key.

The protection of the signature master private key is to obtain a random number R1 between [1, N-1] through a secure random number generator, and then use the modular inverse operation unit to calculate R1'=R 1^-1mod N, Then calculate Q=[R1']P2 by the extended domain point multiplication operation unit, then calculate ks'=ks*R1 mod N through the modular multiplication operation unit, and finally calculate Ppub'=[ks']Q by the extended domain point multiplication operation unit , through the above steps, the operation Ppub=[ks]P2 in the SM9 standard process can be replaced by Ppub'=[ks']Q, so that the randomized ks' can be used instead of the signature master private key ks for operation. In this way, the use of the signature master private key ks can be reduced, and the risk of leakage of the signature master private key ks can be reduced.

The protection of the signature private key is to first obtain the random number R2 through a secure random number generator, and then use the modular multiplication unit to calculate t 1'=t 1*R2 mod N, and the modular inversion unit to calculate t 1''=t 1 '^-1mod N, and the modular multiplication operation unit calculates t2'=ks*t 1''mod N, then uses the base domain point multiplication operation unit to calculate D=[R2]P 1, and finally uses the base domain point multiplication operation unit to calculate ds'=[t 2']D, through the above steps, the operation t2=ks*t 1^-1mod N and ds=[t 2]P 1 in the SM9 standard process can be replaced by t2'=ks*t 1 ''mod N and ds'=[t 2']D, use the randomized t2' to replace the intermediate variable t2, and use the randomized ds' to replace the signature private key ds for calculation, which can reduce the cost of the intermediate variable t2 Use to prevent the private signature key ds from leaking because P1 is a public parameter and t2 is leaked. Therefore, the present invention further improves security by utilizing this double random protection mechanism.

The method for generating a signature key based on the SM9 cryptographic algorithm provided by the present invention has been described in detail above. For those skilled in the art, any obvious changes made to it without departing from the essence of the present invention will constitute an infringement of the patent right of the present invention and will bear corresponding legal responsibilities.

Claims (8)

1. The signature key generation method based on the SM9 cryptographic algorithm is characterized by comprising the following steps of:

m1: generating a random number ks epsilon [1, N-1] as a signature main private key through KGC, wherein N is the order of an SM9 elliptic curve;

m2: calculation G ₂ The element ppub= [ ks ]]P2 is used as a signature master public key, wherein, the group G ₂ The addition cycle group representing the order as prime number N, P2 as group G ₂ Is a generator of (1).

2. The signing key generation method based on SM9 cryptographic algorithm as recited in claim 1, further comprising the steps of:

m3: acquiring a user identification ID and a signature private key generation function identifier hid of one byte, and splicing the user identification ID and the signature private key generation function identifier hid into Z=ID||hid;

m4: calculating t1=h1 (Z, N) +ks in the finite field FN, wherein H1 is a cryptographic function;

m5: calculating t2=kst1-1 mod n;

m6: calculate signature private key ds= [ t2]]P1, wherein P1 is group G ₁ Generating element, group G ₁ Representing the additive cyclic group with order prime number N.

3. The signing key generating method based on SM9 cryptographic algorithm as recited in claim 1, wherein said step M2 comprises the sub-steps of:

s1: acquiring a random number R1 through a safe random number generator;

s2: calculating R1' =R1-1 mod N by a modulo inverse operation unit;

s3: calculating Q= [ R1' ] P2 by using a spread domain point multiplication operation unit;

s4: calculating ks' =ks R1mod n by a modular multiplication operation unit;

s5: and (3) calculating Ppub '= [ ks' Q by using a spread domain point multiplication operation unit.

4. The signing key generation method based on SM9 cryptographic algorithm as claimed in claim 3, wherein:

the random number R1 is located between [1, N-1], and R1 is less than N.

5. The signing key generation method based on SM9 cryptographic algorithm as claimed in claim 3, wherein:

and calculating Q as a random number by using a spread domain point multiplication operation unit.

6. The signing key generating method based on SM9 cryptographic algorithm as recited in claim 3, wherein said step M2 comprises the sub-steps of:

s6: the random number R2 is obtained by a secure random number generator.

7. The signing key generating method based on SM9 cryptographic algorithm as recited in claim 6, wherein said step M2 further comprises the sub-steps of:

s7: calculating t 1' =t1×r2mod n by a modular multiplication operation unit;

s8: calculating t 1 '= t 1' -1mod N by a modulo inverse operation unit;

s9: calculating t2 '=kst1' ″ mod n by a modular multiplication unit;

s10: calculating D= [ R2] P1 by using a base domain point multiplication operation unit;

s11: and calculating ds '= [ t 2' ] D by using a basic domain point multiplication operation unit.

8. The SM9 cryptographic algorithm-based signature key generation method as recited in claim 7, wherein:

the random number R2 is located between [1, N-1], and R2 is less than N.

Images