CN115865356B - A secure and controllable use method and system of ECDSA signature private key - Google Patents

Abstract

A safe and controllable using method of ECDSA signature private keys comprises the steps that a user terminal has an ECDSA private key with Q_U＝d_UG,S_B＝E(b),d_B＝(bd_U)mod n,d_U as a user, G as a base point, G as an order n, Q_U as a public key corresponding to d_U, b as a secret in [1, n-1], G_b＝b^‑1 G and E (·) as homomorphic encryption operation, a signature auxiliary device or system has or can obtain a secret key of homomorphic encryption decryption operation, when d_U is needed for signing a message M, the user terminal, the signature auxiliary device or system firstly calculates a hash value E of the message M, the user terminal, the signature auxiliary device or system randomly selects an integer k₁、k₂ in [1, n-1], the cooperative calculation R=k₁k₂G_b, the calculation r=x_R mod n,(x_R,y_R) =R, the user terminal calculates s₁＝E((k₁)^‑1(eb+rd_B), or the signature auxiliary device or system transmits c₂＝E((k₂)^‑1) to the user terminal, the user terminal calculates s₁＝E((k₁k₂)^‑1(eb+rd_B), the signature auxiliary device or system decrypts s₁ to obtain s₁₂, and calculates s= ((k₂)^‑1s₁₂) mod n or s=s₁₂, and R is a digital signature of the message M.

Description

Safe and controllable use method and system of ECDSA signature private key

Technical Field

The invention belongs to the technical field of passwords, and particularly relates to a safe and controllable use method and system of an ECDSA signature private key.

Background

For a user terminal computing environment (such as a personal computer, a mobile phone, a tablet computer and the like) without a signature private key stored by password hardware and performing password operation by using the signature private key, a digital signature collaborative generation scheme based on secret sharing is often adopted to ensure the security of the signature private key and a generated digital signature. ECDSA (Elliptic Curve Digital Signature Algorithm) is a digital signature algorithm based on elliptic curve point groups, which is widely adopted internationally at present, and is briefly described as follows (see "4.1Elliptic Curve Digital Signature Algorithm" in "Standards for Efficient Cryptography,SEC 1:Elliptic Curve Cryptography",Certicom Research,May 21,2009Version 2.0 for details):

The order of elliptic curve point group (subgroup) of ECDSA or the order of base point G is prime number n, user's signature private key d_U is an integer randomly selected in [1, n-1], public key is Q_U＝d_U G, hash value e of message M is calculated by hash function when signing message M (actually, e is an integer converted and derived from hash value H=H (M) of message M, but usually, e is a hash value of message M, the invention is described), an integer k is randomly selected in [1, n-1], R=kG is calculated, r=x_R mod n is calculated, wherein x_R is taken from (x_R,y_R) =R (the actual calculation is that the integer is converted in a prescribed way, then the n remainder is taken as a mode), k is reselected if r=0, and is recalculated R, R until R is not 0, s=k^-1(e+rd_U is calculated if s=0, and s is not s signed for message M.

It should be noted that there are a plurality of digital signature algorithms based on elliptic curve point groups, and they belong to different digital signature algorithms, and the ECDSA of the present invention refers to a specific elliptic curve digital signature algorithm widely adopted internationally at present, and the name of the specific elliptic curve digital signature algorithm is ECDSA (internationally accepted name, see the above literature).

One problem with the current ECDSA-based secret sharing digital signature is that, in cooperation with other digital signatures except for the user to generate a party, a signature private key of the user, that is, a secret share (SECRET SHARE) of the user signature private key is shared, which is not completely in accordance with the "people's republic electronic signature law", signature making data when the electronic signature is required to be generated by the signer, and for the digital signature, the signature making data, that is, the signature private key, is special and controlled, so how to store and use the generated digital signature private key safely at the user terminal without sharing the ECDSA signature private key, that is, how to cooperatively generate other digital signatures except for the user without the secret share of the signature private key at the party, ensures validity and security of the generated digital signature by using the ECDSA signature private key of the user terminal, and how to ensure safe storage and use of the signature private key (signature making data) stored in the user terminal without adopting signature private key secret sharing is particularly important because signature making private key (signature making private key) will be lost or signature stealing data will result in theft.

Also, because some special requirements, such as to meet some technical specifications, may need to adopt a scheme based on signature private key secret sharing (some technical specifications are formulated based on signature private key secret sharing), if an ECDSA digital signature technical scheme can implement an application scenario for signature private key non-secret sharing, and also can implement an application scenario for signature private key secret sharing, the requirements of clients and users can be better met.

Disclosure of Invention

The invention aims to solve the problems of the existing technical scheme of the ECDSA digital signature collaborative generation based on secret sharing, and provides a corresponding technical scheme to overcome the defects of the prior art, and the proposed technical scheme can be used for implementing the application scene of the signature private key non-secret sharing and the application scene of the signature private key secret sharing.

Aiming at the purpose of the invention, the technical scheme provided by the invention comprises a safe and controllable use method and a corresponding system of the ECDSA signature private key.

In the following description of the technical solution of the present invention, if P, Q is an element (point) in the elliptic curve point group, p+q represents a point addition of P, Q, P-Q represents an inverse of P plus Q, kP represents a point addition of k elliptic curve points P, that is, p+p+ & P (k is a negative number, kP is an addition inverse of a result of the point addition of |k| elliptic curve points P), c^-1 represents a modular n multiplication inverse (i.e., cc^-1 mod n=1) of an integer c, if not specifically described, the multiplication inverses in the present patent application are all modular n multiplication inverses for the order n of the ECDSA elliptic curve point group (i.e., the order n of the base point G), a plurality of integer multiplications (including integer symbol parameter, variable multiplication, constant and integer symbol parameter, variable multiplication), under the condition that ambiguity does not occur, if k₁·k₂ is simplified to k₁k₂, 3·c is simplified to 3 mod n represents a modular n (i.e., 3·c mod n is equal to modular n-ab) and equal to modular n+b (a+mod n) is equal to modular n+ab.

The safe and controllable use method of the ECDSA signature private key provided by the invention is specifically as follows.

The user terminal has Q_U＝d_U G, a secret d_B＝(bd_U) mod n, S_B = E (b) can be obtained, wherein d_U is an ECDSA signature private key of the user, G is a base point of an ECDSA elliptic curve point group (subgroup), Q_U is a public key corresponding to the ECDSA signature private key d_U of the user, b is an integer secret in [1, n-1], n is a rank of the base point G (also a rank of the ECDSA elliptic curve point group (subgroup), n is a prime number, and E (·) is encryption operation adopting homomorphic encryption algorithm;

The signature auxiliary device or system has a private key SK₁ of decryption operation corresponding to a public key adopted by an encryption operation E (-) of the homomorphic encryption algorithm (private key of the homomorphic encryption algorithm), or a private key SK₁ of decryption operation corresponding to a public key adopted by the encryption operation E (-) of the homomorphic encryption algorithm is encrypted into a ciphertext T_sk1 by adopting a key of the signature auxiliary device or system, wherein the key of the signature auxiliary device or system adopted by encrypting the private key SK₁ comprises a symmetric key or a public key (wherein the public key comprises a public key of a common public key cryptographic algorithm such as RSA, SM2 and the like or a group public key of a group-oriented encryption algorithm), and a ciphertext T_sk1(T_sk1 of a ciphertext SK₁ of decryption operation corresponding to the public key adopted by the encryption operation E (-) is not secret to the signature auxiliary device or system but can be used as a secret to a computing device or system outside the signature auxiliary device or system;

The signature auxiliary device or system does not have b and cannot obtain b, or the signature auxiliary device or system has or can obtain b;

the case where the user terminal can obtain S_B =e (b) includes that the signature assistance device or system submits S_B to the user terminal at the time of digital signature (the signature assistance device or system holds S_B in advance, or temporarily encrypts b to obtain S_B and then submits it to the user terminal) (where S_B can be obtained means "there is a case other than S_B");

The case where b is available to the signature assistance device or system includes that the user terminal submits S_B to the signature assistance device or system, and b is obtained by decrypting S_B by the signature assistance device or system (using private key SK₁) (where b is available means a case other than "b");

The user terminal and the signature auxiliary device or the device and the system outside the system have no b;

if the signature assistance device or system does not have b and b cannot be obtained, S_B is stored as a secret in the user terminal and is protected (in other cases, if the user terminal stores S_B, it is also preferable to store and protect as a secret);

If the signature assistance device or system does not have b and b cannot be obtained, taking G_b＝b^-1 G (when the corresponding program or device or system calculates that G_b),b^-1 is the modulo-n multiplication inverse of b during initialization, and at least one of the user terminal and the signature assistance device or system has G_b,G_b as a non-secret between the two (which may or may not be the secret in addition to the two);

The user terminal is a computing device (such as a personal computer, a mobile phone, a tablet computer) of a user; the signature auxiliary device or system is a computing device or system for assisting and assisting the user terminal to complete digital signature generation and computation;

When it is desired to digitally sign the message M using the user's ECDSA signature private key d_U, the user terminal and the signature assistance device or system generate a digital signature for the message M as follows (the body that requires digital signing for the message M using the user's ECDSA signature private key d_U may be an application, system within or outside the user terminal that requires invoking a digital signature function in the user terminal):

The user terminal calculates a hash value e of the message M for digital signature calculation by using the message M and a hash function (hash function), sends e to a signature auxiliary device or system, or calculates a hash value e of the message M for digital signature calculation by using the message M and the hash function (hash function), and sends e to the user terminal;

The user terminal randomly selects an integer k₁ in the [1, n-1] interval, wherein n is the order of the base point G;

The signature assistance device or system randomly selects an integer k₂ within the [1, n-1] interval;

the user terminal and the signature assistance device or system do the following without exposing the respective secret k₁、k₂:

under the condition that the user terminal ensures that the signature auxiliary device or system does not reselect k₂, R=k₁k₂G_b is obtained by interaction calculation with the signature auxiliary device or system;

The signature auxiliary device or system obtains R_f＝k₁k₂G_b through interactive calculation with the user terminal under the condition that the user terminal is ensured not to reselect k₁;

Or alternatively

Under the condition that the user terminal ensures that the signature auxiliary device or system does not reselect k₂, calculating R= (k₁+k₂)G_b;

The signature auxiliary device or system obtains R_f＝(k₁+k₂)G_b through interactive calculation with the user terminal under the condition that the user terminal is ensured not to reselect k₁;

If R and/or R_f is zero (infinity point), then the user terminal, signature assistance device or system reselects k₁、k₂, recalculates R, R_f until R and R_f are not zero;

The user terminal calculates r=x_R mod n, where x_R is taken from (x_R,y_R) =r;

The signature assistance device or system computes r_f＝x_Rf mod n, where x_Rf is taken from (x_Rf,y_Rf)＝R_f;

The user terminal and the signature assistance device or system check whether r and/or r_f is 0 (integer 0), if yes, the user terminal and the signature assistance device or system reselect k₁、k₂, recalculate R, R_f, recalculate r, r_f until neither r nor r_f is 0;

The user terminal and the signature assistance device or system check whether (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0, respectively, will occur, i.e. whether s=0 will occur, where s is the parameter s in the digital signature (r, s) to be generated by calculation;

If yes, the user terminal and the signature assistance device or system reselect k₁、k₂, recalculate R, R_f, recalculate r, r_f until no (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0 occurs, or go to error processing;

If the situation that (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0 does not occur, performing subsequent calculation processing;

The user terminal calculates s₁ as one of the following:

s₁ calculation mode one:

R, R_f adopts a calculation formula of R=k₁k₂G_b、R_f＝k₁k₂G_b;

The user terminal randomly selects an integer q in [1, n-1], and the integer q is calculated by q, e, r, S_B、d_B、k₁ through homomorphic encryption algorithm:

s₁₀＝E(((k₁)^-1eb+q)(mod n)),s₁₁＝((k₁)^-1rd_B-q)mod n,

Or alternatively s₁₀＝E(((k₁)^-1(eb+q))(mod n)),s₁₁＝((k₁)^-1(rd_B-q))mod n,

Or s₁₀＝E(((k₁)^-1e(b+q))(mod n)),s₁₁＝((k₁)^-1(rd_B-eq))mod n, wherein (k₁)^-1 is the modulo n multiplication inverse of k₁ (eq is e x q);

The s₁₀、s₁₁ value pair (s₁₀,s₁₁) forms s₁;

s₁ second calculation mode:

R, R_f adopts a calculation formula of R=k₁k₂G_b、R_f＝k₁k₂G_b;

The user terminal is calculated by using e, r and S_B、d_B、k₁ through homomorphic encryption algorithm:

s₁＝E(((k₁)^-1(eb+rd_B))(mod n));

s₁ calculation mode three:

R, R_f adopts a calculation formula of R=k₁k₂G_b、R_f＝k₁k₂G_b;

the homomorphic encryption algorithm corresponding to E (-) is the homomorphic encryption algorithm;

The signature assistance device or system computes c₂＝E((k₂)^-1), where (k₂)^-1 is the modulo-n multiplicative inverse of k₂, sending c₂ to the user terminal;

The user terminal is calculated by using e, r and S_B、d_B、k₁、c₂ through homomorphic encryption algorithm:

s₁＝E(((k₁k₂)^-1(eb+rd_B)) (mod n)), where (k₁k₂)^-1) is the modulo-n multiplicative inverse of k₁k₂ (or (k₁k₂) mod n);

s₁ calculation mode four:

r, R_f adopts a calculation formula of R= (k₁+k₂)G_b、R_f＝(k₁+k₂)G_b;

Signature assistance device or system calculates c₂＝E(k₂), sends c₂ to the user terminal;

The user terminal randomly selects an integer q in [1, n-1], and the integer q is calculated by q, e, r, S_B、d_B、k₁、c₂ through homomorphic encryption algorithm:

s₁₀＝E((q(k₁+k₂))(mod n)),s₁₁＝E(q(eb+rd_B)(mod n));

The s₁₀、s₁₁ value pair (s₁₀,s₁₁) forms s₁;

After s₁ is calculated, the user terminal sends s₁ to a signature auxiliary device or system;

If the private key SK₁ of the decryption operation corresponding to the public key adopted by the encryption operation E (-) of the homomorphic encryption algorithm is encrypted into the ciphertext T_sk1 by using the key of the signature auxiliary device or system, the user terminal further sends T_sk1 to the signature auxiliary device or system, and the signature auxiliary device or system decrypts T_sk1 to obtain the private key SK₁ of the decryption operation corresponding to the public key adopted by the encryption operation E (-) of the homomorphic encryption algorithm (the private key SK₁ of the homomorphic encryption algorithm, namely the private key SK₁ of the decryption operation of the homomorphic encryption algorithm);

if the signature assistance device or system does not have b and b is not available, i.e., G_b＝b^-1 G:

for s₁ calculation mode one, the signature assistance device or system decrypts s₁₀ in the value pair s₁ using the private key SK₁ to obtain the plaintext s₁₂ of s₁₀, calculates s= ((k₂)^-1(s₁₁+s₁₂)) mod n;

For the second calculation mode s₁, the signature assistance device or system decrypts s₁ using the private key SK₁ to obtain the plaintext s₁₂ of s₁, and calculates s= ((k₂)^-1s₁₂) mod n;

For s₁ calculation mode three, the signature assistance device or system decrypts s₁ using private key SK₁ to obtain plaintext s₁₂ of s₁, and calculates s=s₁₂ mod n;

For the fourth calculation mode of s₁, the signature assistance device or system decrypts s₁₀、s₁₁ in the value pair s₁ using the private key SK₁, respectively obtains plaintext s₁₃ of plaintext s₁₂,s₁₁ of s₁₀, and calculates s= ((s₁₂)^-1s₁₃) mod n, where (s₁₂)^-1 is the modulo-n multiplicative inverse of s₁₂;

(at this time, s= ((k₁k₂)^-1b(e+rd_U)) mod n for mode one, two, and three, and s= ((k₁+k₂)^-1b(e+rd_U)) mod n for mode four

If the signature assistance device or system has or can obtain b, i.e. G_b =g, then:

For s₁ calculation mode one, the signature assistance device or system decrypts s₁₀ in the value pair s₁ using the private key SK₁ to obtain the plaintext s₁₂ of s₁₀, calculates s= ((bk₂)^-1(s₁₁+s₁₂)) mod n, where (bk₂)^-1 is the modulo n multiplicative inverse of bk₂ (or (bk₂) mod n);

For the second calculation mode s₁, the signature assist device or system decrypts s₁ using the private key SK₁ to obtain the plaintext s₁₂ of s₁, and calculates s= ((bk₂)^-1s₁₂) mod n;

For s₁ calculation mode three, the signature assistance device or system decrypts s₁ using private key SK₁ to obtain plaintext s₁₂ of s₁, and calculates s=b^-1s₁₂ mod n;

For s₁ calculation mode four, the signature assistance device or system decrypts s₁₀、s₁₁ in the value pair s₁ using the private key SK₁, obtains plaintext s₁₃ of plaintext s₁₂,s₁₁ of s₁₀, respectively, calculates s= ((bs₁₂)^-1s₁₃) mod n, where (bs₁₂)^-1) is the modulo-n multiplication inverse of bs₁₂ (or (bs₁₂) mod n);

(at this time, s= ((k₁k₂)^-1(e+rd_U)) mod n for mode one, two, and three, and s= ((k₁+k₂)^-1(e+rd_U)) mod n for mode four

Before returning s to the user terminal, the signature auxiliary device or the system verifies whether s is obtained by calculating a private key d_U corresponding to e, k₁、k₂、r_f and a public key Q_U according to the ECDSA calculation mode, if yes, the process is continued, otherwise, the process is transferred into error processing;

The user terminal verifies whether s is obtained by calculating the ECDSA digital signature in a calculation mode by using e, k₁、k₂, r and a private key d_U corresponding to a public key Q_U, if the verification is passed, the (r, s) is the digital signature of the message M, otherwise, the error processing is carried out;

In the above calculation formula of the encryption operation E (·) using the homomorphic encryption algorithm, a (mod n), where a is an integer representing an integer congruent to a modulo n (two integers a, b modulo n congruent, i.e. a mod n=b mod n, denoted as a≡b (mod n), the (mod n) operator has the lowest priority);

The signature assistance device or system authenticates and confirms that the user using the user terminal, i.e. the signer, is the owner of the public key Q_U before assisting and assisting the user terminal in completing the generation of the digital signature (such as before decrypting s₁ or before calculating s), or relies on a system (such as an application service system) invoking the signature assistance device or system to authenticate and confirm that the user using the user terminal, i.e. the signer, is the owner of the public key Q_U (note that here, not the authentication and confirmation user, i.e. the signer, is the owner of the private key d_U corresponding to the public key Q_U);

The user terminal performs the above-described digital signature calculation and generation steps through a cryptographic program or a cryptographic module or a cryptographic component in which a cryptographic function is implemented, and implements an ECDSA digital signature function.

For the secure and controllable method of using ECDSA signature private keys described above, d_B is in effect the private key ciphertext (ciphertext private key) after d_U is encrypted with a multiplicand (a symmetric key encryption scheme), where b is the symmetric key used for encryption.

For the secure and controllable usage method of ECDSA signature private key described above, one method for obtaining r=k₁k₂G_b、R_f＝k₁k₂G_b by interactive calculation without exposing its own secret k₁、k₂ and ensuring that the counterpart does not reselect k₁、k₂ is as follows:

The user terminal computes R₁＝k₁G_b, computes a hash value h₁ of R₁ (using any suitable hash algorithm), and sends h₁ to the signature assistance device or system;

The signature auxiliary device or system calculates R₂＝k₂G_b, calculates a hash value h₂ of R₂, and sends h₂ to the user terminal;

after receiving h₂ of the signature auxiliary device or system, the user terminal sends R₁ to the signature auxiliary device or system;

After receiving h₁ of the user terminal, the signature auxiliary device or system sends R₂ to the user terminal;

after receiving R₂, the user terminal calculates and checks whether the received hash value of R₂ is h₂, if not, the user terminal shifts to error processing, if so, r=k₁R₂ is calculated;

After receiving R₁, the signature assistance device or system calculates and checks whether the hash value of R₁ is h₁, if not, shifts to error processing, and if yes, calculates R_f＝k₂R₁.

For the secure and controllable usage method of ECDSA signature private key described above, the user terminal and the signature assistance device or system obtain r= (one method of k₁+k₂)G_b、R_f＝(k₁+k₂)G_b is as follows:

The user terminal computes R₁＝k₁G_b, computes a hash value h₁ of R₁ (using any suitable hash algorithm), and sends h₁ to the signature assistance device or system;

The signature auxiliary device or system calculates R₂＝k₂G_b, calculates a hash value h₂ of R₂, and sends h₂ to the user terminal;

after receiving h₂ of the signature auxiliary device or system, the user terminal sends R₁ to the signature auxiliary device or system;

After receiving h₁ of the user terminal, the signature auxiliary device or system sends R₂ to the user terminal;

After receiving R₂, the user terminal calculates and checks whether the received hash value of R₂ is h₂, if not, the user terminal shifts to error processing, if so, r=r₁+R₂ is calculated;

after receiving R₁, the signature assistance device or system calculates and checks whether the hash value of R₁ is h₁, if not, shifts to error processing, and if yes, calculates R_f＝R₁+R₂.

The four s₁ calculation modes, namely, the first mode, the second mode and the fourth mode, have less comprehensive calculation amount (including calculation R, s₁) of the user terminal, and the third mode is the largest. Mode one introduces a randomly selected integer q based on the homonym, which makes it more difficult to directly crack b, d_U from homomorphic encryption operation results.

For the above-described secure and controllable use method of the ECDSA signature private key, one method of the user terminal and the signature assistance device or system checking whether (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0 will occur (i.e. whether s=0 will occur, where s is the parameter s in the digital signature (r, s) to be calculated) is as follows:

The user terminal checks whether eG+rQ_U is zero element (infinity point of elliptic curve point group), if yes, (e+rd_U) mod n=0, otherwise, it will not;

The signature assistance device or system checks whether eG+r_fQ_U is zero (the infinity point of the elliptic curve point group), if so, the case (e+r_fd_U) mod n=0 will occur, otherwise it will not.

For the above method for secure and controllable use of ECDSA signature private key, the method for verifying whether s is calculated by using e, k₁、k₂、r_f and private key d_U corresponding to public key Q_U according to the calculation mode of ECDSA by the signature auxiliary device or system includes:

The signature assistance device or system checks whether the verification (r_f, s) is a digital signature of the message M, if so, the verification passes, otherwise, the verification does not pass;

Or the signature assistance device or system checks to see if the value of sR_f is the same as eg+r_fQ_U, if so, then the verification passes, otherwise, the verification does not pass.

For the above method for secure and controllable use of ECDSA signature private key, the method for verifying whether s is calculated by using e, k₁、k₂, r and private key d_U corresponding to public key Q_U according to the calculation mode of ECDSA by using the user terminal includes:

the user terminal checks whether the verification (r, s) is a digital signature of the message M, if so, the verification is passed, otherwise, the verification fails;

Or the user terminal checks whether the value of the verification sR is the same as the eg+rq_U, if so, the verification passes, otherwise, the verification fails.

The key pair of the homomorphic encryption algorithm for encrypting b can be pre-existing (a signature assistance device or system) or permanent, or can be generated temporarily when encrypting b. If the key pair is generated temporarily, the corresponding private key SK₁ for decrypting S_B is typically encrypted as ciphertext data T_sk1 and stored in the user terminal (of course SK₁ may also be stored encrypted in the user account of the signature assistance device or system).

The encryption algorithm used for encrypting the private key SK₁ can be a symmetric key encryption algorithm or a public key encryption algorithm (asymmetric key encryption algorithm), and if the encryption algorithm used for encrypting the private key SK₁ is a public key encryption algorithm, the encryption algorithm can be a common public key encryption algorithm (non-group-oriented encryption algorithm) or a group-oriented encryption algorithm (short group encryption algorithm). The group-oriented encryption algorithm refers to a public key encryption algorithm, in which a group has a public key, each member in the group has a private key (the private keys of different members are usually different), and data encrypted by using the public key of the group can be decrypted by using the private key of each member of the group.

The key pair of the homomorphic encryption algorithm that is temporarily generated is safer from the viewpoint of security protection of the user signature private key (because leakage of the private key SK₁ that performs the decryption operation may cause leakage of the ECDSA signature private key of one user at most), and therefore the key pair of the homomorphic encryption algorithm that is temporarily generated should preferably be used, but the ciphertext data T_sk1 may be omitted using the key pair of the permanent homomorphic encryption algorithm.

For the above-described secure and controllable usage method of ECDSA private signature key, a secure and controllable usage method of ECDSA private signature key that prevents d_B and/or S_B from being stolen is as follows.

When a user (using a program in a user terminal or other terminals) accesses an application service system and needs to digitally sign a message M by using an ECDSA signature private key of the user, the application service system issues a security token for the user, wherein the security token is an authorization credential for requesting a signature assistance device or system to assist, cooperatively generate or/and calculate a digital signature (the security token indicates to the signature assistance device or system that the digital signature cooperatively generate request is authorized and guaranteed by the application service system, the security token does not need to contain identity information of the user, but at least one of the user identity information and public key information is contained from the security perspective);

The application service system transmits the security token or the acquired information of the security token (such as by a client program or other modes) to a password program or a password module or a password component which implements the ECDSA digital signature function in the user terminal, wherein the acquired information of the security token is information for acquiring the security token issued by the application service system (the security token is stored on the internet at the moment);

The user terminal (a cipher program or a cipher module or a cipher component for implementing the ECDSA digital signature function) submits the security token or the acquired information of the security token to a signature auxiliary device or a signature auxiliary system by T_sk2;

If the acquisition information of the security token is submitted to the signature auxiliary device or the system, the signature auxiliary device or the system uses the acquisition information to acquire the security token issued by the application service system;

The signature assistance device or system verifies the validity of the security token (e.g., verifies the validity of the security token's asymmetric key or symmetric key digital signature, such as HMAC), and thereafter the user terminal (the cryptographic program or module or component in which the ECDSA digital signature function is implemented) and the signature assistance device or system generate a digital signature for the message M using d_B、S_B in accordance with the previously described secure and controllable method of use of the ECDSA private key.

The manner in which the application service system passes the security token or the acquired information of the security token to the cryptographic program or the cryptographic module or the cryptographic component in the user terminal that implements the ECDSA digital signature function includes:

if the client program used by the user access application service system and the password program or the password module or the password component for implementing the ECDSA digital signature function are positioned at the same user terminal, the application service system transmits the security token or the acquisition information of the security token to the password program or the password module or the password component for implementing the ECDSA digital signature function in the user terminal through the client program;

Or if the client program used by the user to access the application service system and the password program or the password module or the password component for implementing the ECDSA digital signature function are located in different user terminals, the application service system displays bar codes (two-dimensional codes and multi-dimensional codes) through the client program used by the user, and then transmits the security token or the acquired information of the security token to the password program or the password module or the password component for implementing the ECDSA digital signature function in the user terminal in a mode that the user uses the user terminal to sweep the bar codes;

Or if the user terminal is a mobile communication terminal (such as a mobile phone), the application service system sends a short message through the mobile communication terminal of the user, starts a cipher program for implementing the ECDSA digital signature function in the mobile communication terminal of the user through information (such as URL Schema) contained in the short message, and transmits the security token or the acquired information of the security token to the cipher program for implementing the ECDSA digital signature function in the mobile communication terminal of the user automatically or by the way of inputting the information in the short message by the user through the start information (such as URL Schema).

The security enhancement scheme of the security controllable use method of the ECDSA signature private key on the basis of the security enhancement scheme for preventing d_B and/or S_B from being stolen is as follows:

Homomorphic encryption algorithm corresponding to homomorphic encryption operation E ();

The application service system issues the security token to the user (terminal), and randomly selects an integer k₀ in [1, n-1], calculates R₀＝k₀G_b, adopts homomorphic encryption calculation to obtain c₀＝E((k₀)^-1) or c₀＝E(k₀), wherein (k₀)^-1 is the modulo n multiplication inverse of k₀, then transmits R₀ together with the security token to the signature auxiliary device or system through the user terminal, and transmits acquired information of c₀ or c₀ to the user terminal when R₀ is protected by the security token (such as the hash value of R₀ is a part of the security token or R₀ is a part of the security token);

After verifying the validity of the received security token, the signature assistance device or system determines the validity of R₀ by the security token;

If the user terminal receives the acquired information of c₀, the user terminal acquires c₀ by using the acquired information;

After calculating the hash value e of the message M by using the message M, the user terminal randomly selects an integer k₁ in the [1, n-1] interval, and the signature auxiliary device or system randomly selects an integer k₂ in the [1, n-1] interval;

the user terminal and the signature assistance device or system do the following without exposing the respective secret k₁、k₂:

under the condition that the user terminal ensures that the signature auxiliary device or system does not reselect k₂, R=k₁k₂R₀ is obtained by interaction calculation with the signature auxiliary device or system;

The signature auxiliary device or system obtains R_f＝k₁k₂R₀ through interactive calculation with the user terminal under the condition that the user terminal is ensured not to reselect k₁;

Or alternatively

Under the condition that the user terminal ensures that the signature auxiliary device or system does not reselect k₂, calculating R= (k₁+k₂)R₀;

The signature auxiliary device or system obtains R_f＝(k₁+k₂)R₀ through interactive calculation with the user terminal under the condition that the user terminal is ensured not to reselect k₁;

If R and/or R_f is zero (infinity point), then the user terminal, signature assistance device or system reselects k₁、k₂, recalculates R, R_f until R and R_f are not zero;

The user terminal calculates r=x_R mod n, where x_R is taken from (x_R,y_R) =r;

The signature assistance device or system computes r_f＝x_Rf mod n, where x_Rf is taken from (x_Rf,y_Rf)＝R_f;

The user terminal and the signature assistance device or system check whether r and/or r_f is 0 (integer 0), if yes, the user terminal and the signature assistance device or system reselect k₁、k₂, recalculate R, R_f, recalculate r, r_f until neither r nor r_f is 0;

The user terminal and the signature assistance device or system check whether (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0, respectively, will occur, i.e. whether s=0 will occur, where s is the parameter s in the digital signature (r, s) to be generated by calculation;

If yes, the user terminal and the signature assistance device or system reselect k₁、k₂, recalculate R, R_f, recalculate r, r_f until no (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0 occurs, or go to error processing;

If the situation that (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0 does not occur, performing subsequent calculation processing;

The user terminal calculates s₁ as one of the following:

s₁ calculation mode five:

R, R_f adopts the calculation formula of R＝k₁k₂R₀、R_f＝k₁k₂R₀,c₀＝E((k₀)^-1);

The user terminal is calculated by using e, r and S_B、d_B、c₀、k₁ through homomorphic encryption algorithm:

s₁＝E(((k₀k₁)^-1(eb+rd_B)) (mod n)), where (k₀k₁)^-1) is the modulo-n multiplicative inverse of k₀k₁ (or (k₀k₁) mod n);

s₁ calculation mode six:

R, R_f adopts the calculation formula of R＝k₁k₂R₀、R_f＝k₁k₂R₀,c₀＝E((k₀)^-1);

Signature assistance device or system calculates c₂＝E((k₂)^-1), sends c₂ to the user terminal;

The user terminal is calculated by using e, r and S_B、d_B、c₀、k₁、c₂ through homomorphic encryption algorithm:

s₁＝E(((k₀k₁k₂)^-1(eb+rd_B)) (mod n)), where (k₀k₁k₂)^-1) is the modulo-n multiplicative inverse of k₀k₁k₂ (or (k₀k₁k₂) mod n);

s₁ calculation mode seven:

R, R_f adopts the calculation formula of R＝(k₁+k₂)R₀、R_f＝(k₁+k₂)R₀,c₀＝E(k₀);

Signature assistance device or system calculates c₂＝E(k₂), sends c₂ to the user terminal;

The user terminal randomly selects an integer q in [1, n-1], and the integer q is calculated by q, e, r, S_B、d_B、c₀、k₁、c₂ through homomorphic encryption algorithm:

s₁₀＝E((qk₀(k₁+k₂))(mod n)),s₁₁＝E(q(eb+rd_B)(mod n));

The s₁₀、s₁₁ value pair (s₁₀,s₁₁) forms s₁;

After s₁ is calculated, the user terminal sends s₁ to a signature auxiliary device or system;

If the private key SK₁ of the decryption operation corresponding to the public key employed in the encryption operation E (-) of the homomorphic encryption algorithm is encrypted into the ciphertext T_sk1 by using the key of the signature assistance device or system, the user terminal further sends T_sk1 to the signature assistance device or system, and the signature assistance device or system decrypts T_sk1 to obtain the private key SK₁ of the decryption operation corresponding to the public key employed in the encryption operation E (-) of the homomorphic encryption algorithm (i.e., the private key SK₁ of the homomorphic encryption algorithm, i.e., the private key SK₁ of the decryption operation of the homomorphic encryption algorithm);

if the signature assistance device or system does not have b and b is not available, i.e., G_b＝b^-1 G:

For calculation mode five of s₁, the signature assistance device or system decrypts s₁ using private key SK₁ to obtain plaintext s₁₂ of s₁, and calculates s= ((k₂)^-1s₁₂) mod n;

For the sixth calculation mode of s₁, the signature assistance device or system decrypts s₁ using the private key SK₁ to obtain the plaintext s₁₂ of s₁, and calculates s=s₁₂ mod n;

For the seventh calculation mode of s₁, the signature assistance device or system decrypts s₁₀、s₁₁ in the value pair s₁ using the private key SK₁ to obtain plaintext s₁₃ of plaintext s₁₂,s₁₁ of s₁₀, respectively, and calculates s= ((s₁₂)^-1s₁₃) mod n;

(in this case, for s₁, calculation modes five and six, s= ((k₀k₁k₂)^-1b(e+rd_U)) mod n, and for s₁, calculation mode seven, s= ((k₀(k₁+k₂))^-1b(e+rd_U)) mod n)

If the signature assistance device or system has or can obtain b, i.e. G_b =g, then:

For calculation mode five of s₁, the signature assistance device or system decrypts s₁ using private key SK₁ to obtain plaintext s₁₂ of s₁, and calculates s= ((bk₂)^-1s₁₂) mod n;

For the sixth calculation mode of s₁, the signature assistance device or system decrypts s₁ using the private key SK₁ to obtain the plaintext s₁₂ of s₁, and calculates s= (b^-1s₁₂) mod n;

For the seventh calculation mode of s₁, the signature assistance device or system decrypts s₁₀、s₁₁ in the value pair s₁ using the private key SK₁ to obtain plaintext s₁₃ of plaintext s₁₂,s₁₁ of s₁₀, respectively, and calculates s= ((bs₁₂)^-1s₁₃) mod n;

If the signature assistance device or system obtains b by decrypting S_B, the user terminal sends S_B to the signature assistance device or system, and the signature assistance device or system decrypts S_B (using the private key SK₁) to obtain b;

(in this case, for s₁, calculation modes five and six, s= ((k₀k₁k₂)^-1(e+rd_U)) mod n, and for s₁, calculation mode seven, s= ((k₀(k₁+k₂))^-1(e+rd_U)) mod n)

Before returning s to the user terminal, the signature auxiliary device or the system verifies whether s is obtained by calculating a private key d_U corresponding to e, k₀、k₁、k₂、r_f and a public key Q_U according to the ECDSA calculation mode, if yes, the signature auxiliary device or the system continues, and if the verification fails, the signature auxiliary device or the system shifts to error processing;

The user terminal verifies whether s is obtained by calculating the ECDSA digital signature in a calculation mode by using e, k₀、k₁、k₂, r and a private key d_U corresponding to a public key Q_U, if the verification is passed, the (r, s) is the digital signature of the message M, otherwise, the error processing is carried out;

the signature assistance device or system authenticates that the user using the user terminal, i.e. the signer, is the owner of the public key Q_U before assisting, assisting the user terminal in completing the generation of the digital signature, or relies on the system (e.g. an application service system) invoking the signature assistance device or system to authenticate that the user using the user terminal, i.e. the signer, is the owner of the public key Q_U first (although the security token may contain this effect at the same time, but this is not required).

The user terminal and the signature assistance device or system obtain r=k₁k₂R₀、R_f＝k₁k₂R₀ or r= (k₁+k₂)R₀、R_f＝(k₁+k₂)R₀) by interactive calculation while ensuring that the counterpart does not reselect k₂、k₁, and obtain r=k₁k₂G_b、R_f＝k₁k₂G_b or r= (k₁+k₂)G_b、R_f＝(k₁+k₂)G_b may be the same way while ensuring that the counterpart does not reselect k₂、k₁), except that R₀ at this time replaces G_b(R₀ non-secret);

The signature assistance device or system verifies whether s is calculated by using e, k₀、k₁、k₂、r_f and the private key d_U corresponding to the public key Q_U according to the ECDSA calculation method, and the user terminal verifies whether s is calculated by using e, k₀、k₁、k₂, r and the private key d_U corresponding to the public key Q_U according to the ECDSA digital signature calculation method, so that the same verification method as that when k₀ is not used (because the verification method does not use specific k₀、k₁、k₂) can be adopted.

Based on the aforementioned security enhancement scheme, one scheme for preventing theft of security tokens is as follows:

When the application service system issues a security token to a user (terminal), an integer w is randomly selected as a disturbance parameter in [1, n-1], w is encrypted into ciphertext data which can be decrypted only by the signature auxiliary device or system (such as encryption by a public key of the signature auxiliary device or system, or secret is shared between the application service system and the signature auxiliary device or system, thereby secret deriving an encryption key), then the ciphertext data of w is transmitted to the signature auxiliary device or system together with the security token through the user terminal, and the plaintext or ciphertext data of w is protected by the security token (such as a hash value of the ciphertext data of w or w is part of the security token, or the ciphertext data of w is part of the security token);

After verifying the validity of the received security token, the signature auxiliary device or system decrypts the ciphertext of the disturbance parameter w to obtain a plaintext of w, and determines the validity of the plaintext or ciphertext of w through the security token;

After s is calculated, the signature auxiliary device or system calculates s_w = (s+w) mod n or s_w = (sw) mod n to obtain a perturbed digital signature (r, s_w);

(r, s_w) not submitted or returned to the application service system via the user terminal;

The application service system calculates s= (s_w -w) mod n or s= (w^-1s_w) mod n, where w^-1 is the modulo n multiplication inverse of w, recovering the digital signature (r, s) for message M.

The above solution prevents the security token from being stolen, since only the application service system that signed the security token can get the correct digital signature.

The ciphertext d_B and/or S_B may be re-encrypted (double encrypted) to ciphertext T_U (double encrypted) for the various schemes described above (T_U may contain both the results of d_B and S_B encrypted). If d_B and/or S_B are re-encrypted to ciphertext T_U and stored in the user terminal, when generating a digital signature for message M, the user terminal decrypts the re-encrypted ciphertext data T_U of d_B and/or S_B to obtain d_B and/or S_B (note that here d_B is also ciphertext after multiplier encryption, and S_B is ciphertext after homomorphic encryption). The re-encryption of d_B and/or S_B is to solve the storage security of d_B and/or S_B, and prevent d_B and/or S_B from being stolen.

Combining the security token with d_B and/or S_B re-encryption, there is a further security enhancement scheme for the secure controllable use of ECDSA signature private keys as follows:

d_B and/or S_B are encrypted (by a symmetric key or a public key) to form ciphertext data T_U, a key SK₂ (by a symmetric key or a private key) for decrypting ciphertext data T_U is encrypted (by a symmetric key or a public key) to form ciphertext data T_sk2, a signature auxiliary device or system is provided with a key SK₃ (by a symmetric key or a private key) for decrypting ciphertext data T_sk2, and ciphertext data T_U and ciphertext data T_sk2 are stored in a user terminal;

When a user (using a program in a user terminal or other terminal) accesses the application service system and needs to digitally sign a message M by using the ECDSA signature private key of the user, the application service system issues a security token to the user;

The user terminal (a cipher program or a cipher module or a cipher component for implementing the ECDSA digital signature function) submits the security token or the acquired information of the security token to a signature auxiliary device or a signature auxiliary system by T_sk2;

If the acquisition information of the security token is submitted to the signature auxiliary device or the system, the signature auxiliary device or the system uses the acquisition information to acquire the security token issued by the application service system;

After the signature assistance device or system verifies the validity of the security token (e.g., verifies the validity of the asymmetric key or symmetric key digital signature of the security token, where the key digital signature is called HMAC), the cryptograph data T_sk2 is decrypted using the key SK₃ to obtain the key SK₂, and the key SK₂ is returned to the user terminal;

the user terminal (a cipher program or a cipher module or a cipher component for implementing the ECDSA digital signature function) decrypts the ciphertext data T_U by using the key SK₂ to obtain d_B and/or the ciphertext encrypted by using S_B(d_B as a multiplier, and S_B is the homomorphic encrypted ciphertext), and then the user terminal and the signature auxiliary device or system perform generation calculation of the digital signature by using d_B、S_B according to the secure and controllable use method of the ECDSA signature private key.

The signing assistance device or system, or the system (such as an application service system) that invokes the signing assistance device or system, how to confirm that the user is the owner of the public key Q_U does not belong to the content of the present invention may be implemented by the signing assistance device or system, or the system that invokes the signing assistance device or system, managing and maintaining a user account, where the public key Q_U of the user is stored, or binding the user account with a digital certificate of the user, where the public key Q_U of the user is stored.

For the secure and controllable usage method of ECDSA signing private keys described above, the generation and distribution manner of the ECDSA signing key pair of the user includes (not all possible manners):

Mode one:

Generating an ECDSA signature key pair Q_U、d_U by a trusted program in the user terminal, wherein the trusted program is a cipher program or a cipher module developer or a program (subjected to security test and evaluation) provided by a cipher service provider, and the ECDSA signature key pair Q_U、d_U is generated by randomly selecting an integer b in [1, n-1], calculating d_B＝(bd_U)mod n,S_B =E (b), discarding d_U and b and then safely storing d_B、S_B (and Q_U);

If the G_b＝b^-1 G needs to be calculated, the trusted program uses b to calculate G_b＝b^-1 G, and stores or submits G_b (safely) in the user terminal to a signature auxiliary device or system;

mode two:

Generating an ECDSA signature key pair Q_U、d_U by a trusted program (such as a script program in a browser) in another terminal, wherein an integer b is randomly selected in [1, n-1], d_B＝(bd_U)mod n,S_B =E (b) is calculated, d_U and b are discarded, and d_B、S_B (and Q_U) are transmitted to the user terminal for storage through bar codes (such as two-dimensional codes and multidimensional codes) scanning codes or other transmission modes (such as mail and file copying);

If the G_b＝b^-1 G needs to be calculated, the trusted program uses the b to calculate G_b＝b^-1 G, and transmits G_b to a user terminal for (safe) storage through bar codes or other transmission modes (such as mail and file copying), or submits G_b to a signature auxiliary device or system for storage;

Mode three:

Generating an ECDSA signature key pair Q_U、d_U by a key generating device or system, randomly selecting an integer b in [1, n-1], calculating d_B＝(bd_U)mod n,S_B =E (b), discarding d_U and b, and transmitting d_B、S_B (and Q_U) to a user terminal in a safe mode for storage;

If the G_b＝b^-1 G needs to be calculated, the key generation device or the system uses the b to calculate G_b＝b^-1 G, then transmits G_b to the user terminal (safety) for storage, or submits G_b to the signature auxiliary device or the system for storage;

Mode four:

Randomly selecting an integer d₁、b₁ from [1, n-1] by a key generating device or system, encrypting b₁ by adopting a homomorphic encryption algorithm to obtain S_B1＝E(b₁), calculating d_B1＝(b₁d₁)mod n,Q_U1＝d₁ G, discarding d₁、b₁, and transmitting S_B1、d_B1、Q_U1 to a user terminal;

The user terminal randomly selects an integer d₂、b₂ in [1, n-1] or randomly selects an integer d₂ in [1, n-1], fixes the value of b₂ in [1, n-1] (such as b₂ =1), calculates S_B＝E(b₁b₂),d_B＝(b₂d₂d_B1) mod n by homomorphic encryption algorithm, S_B1、d_B1 and ciphertext operation, and calculates Q_U＝d₂Q_U1;

The user terminal verifies S_B＝E(b₁b₂),d_B＝(b₁b₂d₁d₂)mod n,d₁d₂ is congruent with an ECDSA signature private key d_U modulo n in [1, n-1], i.e. d₁d₂＝d_U (mod n) and Q_U＝d_U G, i.e. d_U＝(d₁d₂) mod n and Q_U＝d_U G, without exposing d₁d₂, b₁b₂ is congruent with an integer b modulo n in [1, n-1], i.e. b₁b₂ =b (mod n);

The user terminal discards d₂、b₂ and saves S_B、d_B、Q_U;

If the G_b＝b^-1 G needs to be calculated, the key generating device or system uses b₁ to calculate G_b1＝(b₁)^-1 G, then transmits G_b1 to the user terminal, and the user terminal calculates G_b＝(b₂)^-1G_b1, or uses b₂ to calculate G_b2＝(b₂)^-1 G, submits G_b2 to the signature auxiliary device or system, and the key generating device or system calculates G_b＝(b₁)^-1G_b2;

The user terminal and/or the signature auxiliary device or system stores G_b;

For the above-mentioned ECDSA signature private key generation and distribution method, if the homomorphic encryption algorithm public key used for encrypting b is temporarily generated, the device, system or program for generating d_U or d₁ encrypts the private key SK₁ of the corresponding homomorphic encryption algorithm used for decryption operation to obtain the ciphertext T_sk1 of SK₁ by using a symmetric key or a public key, where encryption of SK₁ by using the public key is applicable to all four ECDSA signature key pairs generation and distribution methods, and encryption of SK₁ by using the symmetric key is applicable to only three and four ECDSA signature key pairs generation and distribution methods.

As for the first, second, and third modes of the generation and distribution modes of the ECDSA signing key pair of the user, if (limited in the implementation) the signature assistance device or system does not have b and b cannot be obtained, it is allowable to select b= (the modulo n multiplication inverse of d_U)^-1(d_U), and d_B =1.

For the fourth mode of the generation and distribution modes of the ECDSA signing key pair of the user, b₁、b₂ is allowed as follows:

b₁＝(d₁)^-1,b₂ =1, where (d₁)^-1 is the modulo n multiplication inverse of d₁, where b= (d₁)^-1,d_B＝d₂;

b₁＝(d₁)^-1,b₂＝(d₂)^-1, where (d₂)^-1 is the modulo-n multiplicative inverse of d₂, where b= (d₁d₂)^-1,d_B =1, (defined in the implementation) the signature assistance device or system has no b and cannot get b.

In the fourth aspect of the generation and distribution method of the ECDSA signature key pair of the user, if b₁＝(d₁)^-1,b₂ =1, that is, b= (d₁)^-1,d_B＝d₂, and the signature assistance device or system has or can obtain b, the corresponding implementation is an embodiment based on secret sharing of the signature private key of the secure and controllable usage method of the ECDSA signature private key.

Typically, a program or device or system that generates an ECDSA signature private key will use the generated signature private key to sign information, such as a certificate signature Request (CERTIFICATE SIGNING Request, CSR), that verifies that the user has possession of the corresponding public key, establishing an initial contact between the user and the public key.

The secure and controllable use system of the corresponding ECDSA private key can be constructed on the basis of the secure and controllable use method of the ECDSA private key, and comprises a signature auxiliary device or system and a cipher program or a cipher module or a cipher component in a user terminal, wherein the user terminal stores a cipher text d_B of a user ECDSA private key d_U, stores or can obtain a cipher text S_B of a key b for decrypting d_B, and when the user ECDSA private key is required to be used for carrying out digital signature on a message M, the cipher program or the cipher module or the cipher component in the user terminal and the signature auxiliary device or system cooperatively generate a digital signature for the message M according to the secure and controllable use method of the ECDSA private key, and the cipher program or the cipher module or the cipher component in the user terminal implements operation processing and/or functions of the user terminal in the digital signature generation method. Further, the system may also include a key generation device or system, trusted program for ECDSA signing key pair generation.

As can be seen from the above description, based on the scheme of the present invention, the signature private key d_U of the user for generating the ECDSA digital signature is completely stored and used by the user in the form of the ciphertext d_B after being encrypted, and other entities have no secret share of the signature private key d_U, i.e. the digital signature (electronic signature) making data d_U of the user belongs to the exclusive domain of the user, and is completely controlled by the user (terminal) when generating the digital signature (if b is available or not in the digital signature, i.e. it is not the signature making data), and meanwhile, various schemes are provided to further ensure the secure use and storage of the ciphertext private key, so that the storage and use of the signature making data of the present invention better accords with the electronic signature method of the people's republic and the storage and use thereof are strictly secured, and in the implementation of the present invention, if b₁＝(d₁)^-1,b₂ =1, i.e. b=₁＝(d₁)^-1, and the signature auxiliary device or system has or can obtain b, the corresponding implementation is a secret based on the secret, i.e. the shared secret of the private signature, i.e. the present invention can be used in the shared digital signature-based embodiment.

Drawings

Fig. 1 is a basic structure and application diagram of the system of the present invention.

Fig. 2 is a schematic diagram of a signature assistance device or system centric deployment scenario of the present invention.

Fig. 3 is a schematic diagram of a signature assistance device or system distribution deployment scenario of the present invention.

Fig. 4 is a schematic diagram of a signature assistance device or system independent deployment scenario of the present invention.

Detailed Description

The following describes specific embodiments of the present invention. The following is merely illustrative of possible embodiments of the present invention and is not intended to limit the scope of the invention.

The implementation of the invention adopts homomorphic encryption algorithm, which can be addition homomorphic encryption algorithm (such as Paillier algorithm) and homomorphic encryption algorithm (such as BGV, BFV, CKKS), precise homomorphic encryption algorithm (such as Paillier, BGV, BFV) and approximate homomorphic encryption algorithm (such as CKKS). And (3) corresponding to an approximately homomorphic encryption algorithm, and after decryption to obtain data, rounding the absolute value of the data, wherein the sign bit is unchanged.

In the following description of the present invention,The result of the multiplication of two ciphertext numbers representing homomorphic encryption corresponds to the ciphertext number of the product of the multiplication of two corresponding plaintext numbers; The result corresponds to the ciphertext number of the sum of the addition of two corresponding plaintext numbers, and the result corresponds to the ciphertext number of the product of the multiplication of one plaintext number and one ciphertext number in homomorphic encryption.

E (a (mod n)) often occurs in homomorphic encryption operations of the present invention, where a is an integer and a (mod n) represents a number congruent with a modulo n. Instead of using a directly, instead of using a, the invention uses a congruence number with a modulo n, in order to avoid that when a is the result of an operation (e.g. a product) of two or more secret numbers (secret numbers), the secret is broken by directly decomposing a, e.g. a=pq, since p, q are relatively small (relatively not very large numbers), it is easier to decompose p, q from a, which would result in p, q being broken, but if a congruence number with a modulo n is used, this would increase the difficulty or be computationally impossible to directly decompose p, q.

One solution to implement E (a (mod n)) is as follows (of course not all possible):

Changing the calculation E (a (mod n)) into a calculationWhere z is an integer randomly selected during the calculation (such as a signature device) (not limited to an integer selected within [1, n-1 ]), or an integer calculated from an integer randomly selected (such as a signature device) (z may be positive, negative, or zero), the selection principle of z is such that the number of plaintext encrypted during the calculation, i.e., a+zn, does not exceed the representation range of the encryption operation E (-) of the homomorphic encryption algorithm for the encrypted integer, or the probability of exceeding the representation range of the encryption operation E (-) of the homomorphic encryption algorithm for the encrypted integer is extremely small (the probability of exceeding is within a prescribed range) (the encryption operation E (-) of the homomorphic encryption algorithm represents positive, negative, zero with the complement, and if E (-) is m, the m is divided into two parts, wherein the lower half represents a positive integer and zero, and the upper half represents a negative integer, similar to the complement in a binary number).

When generating a digital signature for a message M, the invention has seven s₁ computing modes, the first four of which are basic computing modes, the second three of which are enhanced computing modes, and the s₁ computing modes when an application service system participates in the generation of the digital signature, and how these computing modes are implemented is specifically described below with respect to how the homomorphic encryption algorithm adopted by E (·) is an addition homomorphic encryption algorithm or a full homomorphic encryption algorithm.

For s₁ calculation mode one, the user terminal may calculate s₁₀＝E(((k₁)^-1 eb+q (mod n)) or s₁₀＝E(((k₁)^-1 (eb+q)) (mod n)) or s₁₀＝E(((k₁)^-1 e (b+q)) (mod n)) by homomorphic encryption using q, e, r, S_B、d_B、k₁:

For the first s₁₀ calculation, s₀₁＝((k₁)^-1 e) mod n,

For the second s₁₀ equation, s₀₁＝((k₁)^-1e)mod n,s₀₂＝((k₁)^-1 q) mod n is calculated,

For the third s₁₀ equation, s₀₁＝((k₁)^-1e)mod n,s₀₂＝((k₁)^-1 qe) mod n is calculated,

Or if E (·) is the encryption operation of the homomorphic encryption algorithm:

For the first s₁₀ calculation, s₀₁＝((k₁)^-1 e) mod n,

For the second s₁₀ equation, s₀₁＝((k₁)^-1e)mod n,s₀₂＝((k₁)^-1 q) mod n is calculated,

For the third s₁₀ equation, s₀₁＝((k₁)^-1e)mod n,s₀₂＝((k₁)^-1 qe) mod n is calculated,

S₁₁ is directly calculated, and s₁₀、s₁₁ value pair (s₁₀,s₁₁) forms s₁.

For the second calculation mode S₁, the user terminal may calculate S₁＝E(((k₁)^-1(eb+rd_B (mod n) by homomorphic encryption using e, r, S_B、d_B、k₁:

s₁₀＝((k₁)^-1e)mod n,s₁₁＝((k₁)^-1rd_B)mod n,

or if E (·) is the encryption operation of the homomorphic encryption algorithm:

For the third calculation mode S₁, the ue may calculate S₁＝E(((k₁k₂)^-1(eb+rd_B) by homomorphic encryption using E, r, and S_B、d_B、k₁、c₂ (mod n)), where the homomorphic encryption algorithm corresponding to c₂＝E((k₂)^-1), E (·) is the homomorphic encryption algorithm:

s₁₀＝((k₁)^-1e)mod n,s₁₁＝((k₁)^-1rd_B)mod n,

Or alternatively

For the fourth calculation mode s₁, the ue randomly selects an integer q in [1, n-1], and uses q, e, r, S_B、d_B、k₁、c₂, where c₂＝E(k₂), calculates s₁₀＝E((q(k₁+k₂))(mod n)),s₁₁＝E(q(eb+rd_B (mod n) by homomorphic encryption algorithm):

s₀₁＝(qk₁)mod n,s₀₂＝(qe)mod n,s₀₃＝(qrd_B)mod n;

or if the homomorphic encryption algorithm corresponding to E (-) is the homomorphic encryption algorithm:

The s₁₀、s₁₁ value pair (s₁₀,s₁₁) forms s₁.

For the fifth calculation mode S₁, the ue may calculate S₁＝E((k₀k₁)^-1(eb+rd_B (mod n)) by homomorphic encryption using E, r, and S_B、d_B、c₀、k₁, where the encryption algorithm corresponding to c₀＝E((k₀)^-1), E (·) is the homomorphic encryption algorithm:

s₁₀＝((k₁)^-1e)mod n,s₁₁＝((k₁)^-1rd_B)mod n,

Or alternatively

Or alternatively

For the sixth calculation mode of S₁, the ue may calculate S₁＝E((k₀k₁k₂)^-1(eb+rd_B (mod n)) by homomorphic encryption using E, r, and S_B、d_B、c₀、k₁、c₂, where the encryption algorithm corresponding to c₀＝E((k₀)^-1),c₂＝E((k₂)^-1), E (·) is the homomorphic encryption algorithm:

s₁₀＝((k₁)^-1e)mod n,s₁₁＝((k₁)^-1rd_B)mod n,

Or alternatively

For the calculation mode seven of s₁, the user terminal can calculate s₁₀＝E((qk₀(k₁+k₂))(mod n)),s₁₁＝E(q(eb+rd_B (mod n)) by using q, E, r, S_B、d_B、c₀、k₁、c₂ through homomorphic encryption in the following manner, wherein the encryption algorithm corresponding to c₀＝E(k₀),c₂＝E(k₂), E (·) is the homomorphic encryption algorithm:

s₀₁＝(qk₁)mod n,s₀₂＝(qe)mod n,s₀₃＝(qrd_B)mod n;

or if the homomorphic encryption algorithm corresponding to E (-) is the homomorphic encryption algorithm:

The s₁₀、s₁₁ value pair (s₁₀,s₁₁) forms s₁.

In the implementation of the present invention, the manner of b encryption and decryption with respect to ciphertext S_B is related to the deployment manner of the signature assistance device or system, and to the manner of generation and distribution of the ECDSA signing key pair of the user.

The signature assistance device or system may include several deployment approaches as follows:

(1) The central deployment is intensively deployed by a professional password service mechanism, for example, is intensively deployed in a cloud service mode, and provides digital signature service for different clients, users and applications;

(2) Distributed deployment, which is distributed deployment by a professional password service mechanism and provides digital signature service for clients, users and applications in different places and regions;

(3) Each enterprise, organization or application system is deployed with a signature auxiliary device or system, and provides digital signature service for clients, users and applications.

The generation and distribution of the four ECDSA signing key pairs described above may be implemented no matter what deployment method the signature assistance device or system adopts, and of course, other generation and distribution methods of ECDSA signing key pairs may be implemented, which is not limited in the present invention, as long as the present invention meets the relevant security requirements.

In the specific implementation, if the ECDSA signature private Key d_U (or the ECDSA signature Key pair) of the user is generated or participates in the generation by the Key generating device or system, the Key generating device or system is typically implemented as a device or system of the server, but a device such as a USB Key as the user may also be used. The key generating device or system of the server may be embodied as plug-and-play cryptographic hardware (such as a cryptographic card) or a device or system combining software and hardware (such as a cryptographic machine and a cryptographic server).

If the method is implemented, the ECDSA signature key pair is generated and distributed (including independent generation and collaborative generation) by the key generating device or the system of the server, the key generating device or the system can also adopt a central deployment, a distributed deployment or an independent deployment mode, wherein the independent deployment is mainly used for special key service provided by an organization and an enterprise, and the user of the ECDSA signature key pair is usually only the client and the user of the organization and the enterprise.

If the ECDSA signing key pair is generated by a trusted program in the user terminal, the corresponding program may be provided by a cryptographic program or a cryptographic module developer, or a cryptographic service provider, and executed in a secure user terminal environment, such as ensuring that there is no Trojan in the user terminal, or in a Trusted Execution Environment (TEE).

If implemented, the ECDSA signing key pair may be generated by a program in another terminal, a corresponding program may be provided by a cryptographic program or a developer of a cryptographic module, or a cryptographic service provider, for generating the ECDSA signing key pair, and the ciphertext d_B of the signing private key d_U, the ciphertext S_B of b, and other parameters, data (e.g., public key Q_U) may be transmitted to the user terminal by means of a barcode (e.g., two-dimensional code, multi-dimensional code) scanning, or they may be transmitted to the user terminal by other means such as mail, file copy, or the user may access a special trusted website using a browser in another terminal, and the script program returned by the trusted website generates the ECDSA signing key pair in the browser, and then transmits the ciphertext d_B of the signing private key d_U, the ciphertext S_B of b, and other parameters, data to the user terminal by means of a barcode (e.g., two-dimensional code, multi-dimensional code) scanning, or transmitting them to the user terminal by other means such as mail, file copy.

The following describes embodiments related to encryption of b and decryption of ciphertext S_B in connection with embodiments of a signature assistance device or system and embodiments of generation and distribution of ECDSA signing key pairs.

Regardless of the deployment and implementation of the signature assistance device or system, the key pair of the homomorphic encryption algorithm that encrypts b and decrypts ciphertext S_B may be either pre-existing or temporarily generated (by the key pair generation program or device or system) during b encryption, regardless of the implementation and deployment of the ECDSA signing key pair.

If the key pair of the homomorphic encryption algorithm that encrypts b and decrypts S_B is pre-existing to the signature assistance device or system, then the following are some possible implementations:

The key pair of the homomorphic encryption algorithm for encrypting b and decrypting S_B is a signature auxiliary device or system in advance, and the signature auxiliary device or system adopts an implementation manner of central deployment, so that the encryption of b is usually a public key of a public key pair of one homomorphic encryption algorithm using the signature auxiliary device or system (the public key pair, i.e. a plurality of signature auxiliary devices or systems share one key pair), and the private key SK₁ of the homomorphic encryption algorithm for decrypting b ciphertext S_B is a private key of the public key pair of the homomorphic encryption algorithm, and at this time, the generation and distribution of the ECDSA signature key pair can be performed in any implementation manner and in any deployment manner;

The key pair of the homomorphic encryption algorithm for b encryption and S_B decryption is pre-existing in the signature auxiliary device or system, and the signature auxiliary device or system adopts a distributed deployment implementation mode, the public key pair b of the public key pair of one homomorphic encryption algorithm of the signature auxiliary device or system can be used for encryption (namely, a plurality of the signature auxiliary devices or systems distributed deployment share one key pair), the private key SK₁ of the homomorphic encryption algorithm for decrypting b ciphertext S_B is the private key of the public key pair of the homomorphic encryption algorithm, and at the moment, the ECDSA signature key pair can be generated and distributed in any implementation mode and deployment mode;

The key pair of the homomorphic encryption algorithm for encrypting b and decrypting S_B is pre-existing to the signature auxiliary device or system, and the independently deployed implementation mode adopted by the signature auxiliary device or system is that the public key pair b of the key pair of one homomorphic encryption algorithm of the independently deployed signature auxiliary device or system is generally used for encrypting S_B, and in this case, the generation and distribution of the ECDSA signature key pair can be performed in any implementation mode or deployment mode, but the program and system for generating and distributing the ECDSA signature key pair need to be configured or customized to use the public key of the corresponding homomorphic encryption algorithm for the independently deployed signature auxiliary device or system.

The key pair of the homomorphic encryption algorithm for b encryption and S_B decryption is pre-existing for the signature assistance device or system, and is specifically described for the following implementation case:

The signature assistance devices or systems are deployed independently at different institutions and enterprises, they belong to different institutions and enterprises, but the ECDSA signature private key (and corresponding digital certificate) of the user may need to be used at the application systems of different institutions and enterprises, for example, the ECDSA signature private key corresponds to a digital certificate trusted at each institution and enterprise, the certificate and the private key are used at the application systems of different institutions, that is, the signature assistance devices or systems independently deployed by different institutions and enterprises may need to decrypt s₁ generated by the user terminal of the same user in the process of generating the digital signature, for this, the following manner is a possible (but not the only possible manner):

The d_B、S_B of the user is only bound with one organization, the signature assistance device of the enterprise or the system, and when the user needs to use d_B、S_B to generate a digital signature, no matter which organization, the system of the enterprise the user (terminal) is interacting with, the user terminal only interacts with the bound signature assistance device or system to generate a digital signature.

If the key pair for the homomorphic encryption algorithm that encrypts b and decrypts S_B is generated temporarily, then the following are some possible implementations:

The key pair of the homomorphic encryption algorithm for b encryption and S_B decryption is temporarily generated, the encryption of the private key SK₁ adopts a public key encryption algorithm, and the signature auxiliary device or system adopts a centrally deployed implementation mode, the public key pair of one public key pair of the signature auxiliary device or system is generally used for encrypting SK₁ (the public key pair, namely, a plurality of signature auxiliary devices or systems share one key pair), and at this time, the generation and distribution of the ECDSA signature key pair can be carried out in any implementation mode and deployment mode;

The key pair of the homomorphic encryption algorithm for b encryption and S_B decryption is temporarily generated, the encryption of the private key SK₁ adopts a public key encryption algorithm, and the signature assistance device or system adopts a distributed deployment implementation mode, so that the public key in one public key pair of the signature assistance device or system can be used for encrypting SK₁ (i.e. a plurality of signature assistance devices or systems distributed to be deployed share one key pair), or one group public key is used for encrypting SK₁ (i.e. a plurality of signature assistance devices or systems distributed to be deployed belong to one group, and group members can have own private keys), and at this time, the ECDSA signature key pair can be generated and distributed in any implementation mode and deployment mode.

The key pair of the homomorphic encryption algorithm for b encryption and S_B decryption is temporarily generated, the encryption of the private key SK₁ adopts a public key encryption algorithm, and the independently deployed implementation mode adopted by the signature assistance device or system is generally that the public key in one key pair of the independently deployed signature assistance device or system is used for encrypting SK₁, and at this time, the generation and distribution of the ECDSA signature key pair can be performed in any implementation mode and deployment mode, but the program and system for generating and distributing the ECDSA signature key pair need to be configured or customized to use the public key of the corresponding independently deployed signature assistance device or system;

The key pair of the homomorphic encryption algorithm for b encryption and S_B decryption is temporarily generated, and the encryption of the private key SK₁ adopts a symmetric key encryption algorithm, so that the generation and distribution of the ECDSA signature key pair needs to adopt an embodiment (including an embodiment of separate or cooperative generation and distribution) of generating and distributing by a key generating device or system of a server, and the key generating device or system needs to share a symmetric key with a corresponding signature auxiliary device or system needing to decrypt T_sk1.

If the key pair of the homomorphic encryption algorithm for b encryption and S_B decryption is generated temporarily, the following description is given specifically for the following implementation case:

The signature assistance devices or systems are deployed independently at different institutions and enterprises, they belong to different institutions and enterprises, but the ECDSA signature private key (and corresponding digital certificate) of the user may need to be used at the application systems of different institutions and enterprises, for example, the ECDSA signature private key corresponds to a digital certificate trusted at each institution and enterprise, the certificate and the private key are used at the application systems of different institutions, that is, the signature assistance devices or systems deployed independently by different institutions and enterprises may face the problem of decrypting s₁、T_sk1 generated by the user terminal of the same user in the process of generating the digital signature, for which the following two modes are possible (but not all possible modes):

(1) The d_B、S_B、T_sk1 of the user is only bound with a signing auxiliary device or system of an organization or an enterprise, and when the user needs to use d_B、S_B、T_sk1 to generate a digital signature, no matter which organization or system of the enterprise the user (terminal) is interacting with, the user terminal only interacts with the bound signing auxiliary device or system to generate the digital signature;

(2) The public key of the homomorphic encryption algorithm for encrypting b is temporarily generated, the private key SK₁ of the homomorphic encryption algorithm which is temporarily generated is encrypted in a group-oriented encryption mode, signature auxiliary devices or systems which are independently deployed by different institutions and enterprises are members of a group, and the private key of a group member is used.

If the implementation employs a group-oriented encryption scheme, the lifecycle management (generation, updating, revocation) of the group keys (public, private) is provided by the key service system of the specialized cryptographic service organization.

Description of the implementation case where the user terminal, signature assistance device or system owns E (b) or b.

In the first case, the user terminal stores E (b), the signature auxiliary device or system does not have E (b) and E (b), and the user terminal does not send E (b) to the signature auxiliary device or system during signature;

Secondly, the user terminal stores E (b), the signature auxiliary device or system does not have E (b) and B, and the user terminal sends E (b) to the signature auxiliary device or system during signature;

In the third case, the user terminal does not store E (b), the signature auxiliary device or system stores b and/or E (b), and the signature auxiliary device or system transmits E (b) to the user terminal during signature;

In the fourth case, the ue stores E (b), the signature assistance device or system stores b and/or E (b), and the signature assistance device or system does not send E (b) to the ue during signing;

In case five, the ue holds E (b), the signature assistance device or system holds b and/or E (b), and the signature assistance device or system sends E (b) to the ue (although this is not necessary, but a possible implementation).

As long as b is available or available to the signature assistance device or system, the generation of the digital signature is performed at G_b =g (b will not be included in the generated signature data).

In the implementation of the present invention, although d_B and/or S_B are stored in the user terminal in the form of ciphertext of d_U and b, in order to prevent theft, security protection measures, such as fingerprint protection, PIN code protection, and even re-encryption, may be further taken on d_B and/or S_B stored in the user terminal.

In the implementation of the present invention, in order to prevent d_B and/or S_B from being stolen, the signature assistance device or system needs to complete the authentication of the user by strict and secure authentication, such as by sms, biometric-based authentication, or by invoking a system of the signature assistance device or system, such as an application service system, before the digital signature generation is assisted for the user terminal, ensuring that the user is the owner of the public key Q_U.

The generation and distribution modes of the ECDSA signature key pair are four, the user terminal verifies S_B＝E(b₁b₂),d_B＝(b₁b₂d₁d₂)mod n,d₁d₂ to be congruent with d₁d₂＝d_U (mod n) which is d_U modulo n of one ECDSA signature private key in [1, n-1] without exposing d₁d₂, and Q_U＝d_U G is verified to be d_U＝(d₁d₂) mod n and Q_U＝d_U G, and the following modes are various modes which can be adopted.

The user terminal randomly selects an integer t and w in [1, n-1], and obtains S_w＝E((wb₁b₂(d_B)^-1 +t) (mod n) by d_B、S_B and homomorphic encryption operation calculation, wherein (d_B)^-1 is the modulo n multiplication inverse of d_B, and S_w、Q_U is sent to a key generation device or system;

The key generating means or system calculates Q_w＝(D(S_w)mod n)Q_U, where D (·) is a decryption operation of the private key using a homomorphic encryption algorithm (assuming the key generating means or system has the ability to do this, e.g. share a cryptographic device with or by means of a signature assistance means or system);

The user terminal checks whether w^-1(Q_w-tQ_U) is the same as G, wherein w^-1 is the modulo n multiplication inverse of w, if so, the verification is passed, otherwise the verification fails;

Or the user terminal randomly selects an integer t and w in [1, n-1], calculates to obtain S_w＝E((wb₁b₂ +t (mod n) by using b₁、S_B and homomorphic encryption operation), and sends S_w、Q_U to a key generation device or system;

The key generating means or system calculates Q_w＝(D(S_w)mod n)Q_U, where D (·) is a decryption operation of the private key using a homomorphic encryption algorithm (assuming the key generating means or system has the ability to do this, e.g. share a cryptographic device with or by means of a signature assistance means or system);

The user terminal checks whether w^-1(Q_w-tQ_U) and d_B G are the same, wherein w^-1 is the modulo n multiplication inverse of w, if so, the verification passes, otherwise the verification fails.

The Security Token issued by the application service system is a temporary authorization credential, and can be either a standard Security Token (such as WS-Security Security Token, SAML assertion, security ticket Token, json Web Token, i.e. JWT, etc.), or a Security Token in a custom format, or an asymmetric key (such as SM2, SM9, RSA, ECDSA) signature, or a symmetric key signature (such as HMAC).

In the practice of the present invention, if after re-encrypting d_B and/or S_B to ciphertext T_U, T_U is stored in the user terminal, this encryption is (typically) not performed in the signature assistance device or system, but is (typically) performed in the user terminal, otherwise the signature assistance device or system can obtain the user terminal' S secret d_B and/or S_B, which obviously does not meet the security requirements of the scheme, A security target. the current question is who generated key SK₂ to decrypt T_U, What does encryption of SK₂ be accomplished by is a simple fact noted that SK₂ does not belong to a secret between the user terminal and the signature assistance device or system, so SK₂ and its corresponding encryption key for encrypting d_B and/or S_B (corresponding encryption key is the corresponding public key if SK₂ is a private key, corresponding encryption key is also a symmetric key if SK₂ is a symmetric key) can be generated either by the user terminal (upon user signature key initialization) or by the signature assistance device or system (upon user signature key initialization) and then passed to the user terminal, SK₂ can be encrypted using the corresponding public key if key SK₃ of ciphertext T_sk2 of decryption SK₂ is a private key, can be accomplished either at the user terminal or at the signature assistance device or system, and SK 3735 can be encrypted using SK₃ pair₂ by the signature assistance device or system if key SK_sk2 of decryption of ciphertext₂ is a symmetric key, and then the result of encryption of ciphertext T_sk2 is returned to the user terminal or system for the secret key of no encryption of SK_sk2. The remaining problem is that for different deployment modes of the signature assistance device or system, a simple principle is that when performing digital signature, the user terminal interacts with which signature assistance device or system to encrypt SK₂ with the encryption key corresponding to SK₃ of which signature assistance device or system, where the encryption key corresponding to SK₃ includes a symmetric key or public key, and if the public key includes a common public key and a group public key, the encryption key is similar to the encryption of SK₁ of the temporarily generated homomorphic encryption algorithm when the key pair of the homomorphic encryption algorithm for S_B is temporarily generated.

The invention relates to more keys which are not confused in specific implementation, wherein SK₁ is a private key for decrypting b homomorphically encrypted ciphertext S_B (b is a key for decrypting d_B), SK₂ is a key for decrypting d_B and/or ciphertext T_U after S_B is encrypted again and is not a key for decrypting ciphertext T_sk1 of SK₁, a key (not specially named) for decrypting T_sk1 belongs to a signature auxiliary device or system, SK₂ does not belong to a key of the signature auxiliary device or system, SK₃ is a key for decrypting ciphertext T_sk2 of SK₂, SK₃ is a key belonging to the signature auxiliary device or system, and no direct or indirect association exists between SK₁ and SK₂、SK₃.

The secure controllable use system of the ECDSA private key can be implemented on the basis of the secure controllable use method of the ECDSA private key, and comprises a signature auxiliary device or system, a cipher program or a cipher module or a cipher component in a user terminal, wherein the user terminal stores a cipher text d_B of a user ECDSA private key d_U, stores or can obtain a cipher text S_B for decrypting a cipher text b of d_B, when the user' S ECDSA private key is required to be used for carrying out digital signature on a message M, the cipher program or the cipher module or the cipher component in the user terminal and the signature auxiliary device or system cooperate to generate a digital signature for the message M according to the secure controllable use method of the ECDSA private key, and the cipher program or the cipher module or the cipher component in the user terminal implements operation processing and/or functions executed by the user terminal in the secure controllable use method of the ECDSA private key. Further, the implemented system may also include a key generation device or system, trusted program for ECDSA signing key pair generation.

In the implementation of the present invention, the signature assistance device or system may be a software device or system, or may be a device or system combining software and hardware, where the software device may be a program or a cryptographic module that runs independently, and the device combining software and hardware may be plug and play cryptographic hardware, such as a cryptographic card, or may be a cryptographic machine/cryptographic server.

In the implementation of the present invention, the user terminal is various computing devices used by the user, such as a computer, a mobile phone, a tablet computer, etc., and the user terminal implements the digital signature generation function in the user terminal of the present invention through a cryptographic program or a cryptographic module or a cryptographic component running therein, that is, the program implementing the cryptographic function such as the digital signature in the user terminal may be a separately running cryptographic program, such as a program formed by an app or a WeChat applet, or may be a cryptographic module or a cryptographic component implementing the cryptographic function such as a cryptographic API, an SDK, a WeChat applet plug-in, a browser plug-in or a control, etc. If the program implementing the digital signature and other cryptographic functions is a separately running cryptographic program, the program in the same user terminal transmits data to the cryptographic program, and can utilize the mechanism provided by the user terminal and the program development technology for transmitting data between programs in the same computing device, if the program implementing the digital signature and other cryptographic functions is a cryptographic module and a cryptographic component, the program calling the cryptographic module and the cryptographic component directly transmits data to the called cryptographic module and the cryptographic component, if another terminal except the user terminal implementing the digital signature function needs to use the digital signature function in the user terminal, the program in the other terminal, such as the client program of the application service system, can transmit the calling information and data to the cryptographic program or the cryptographic module or the cryptographic component implementing the digital signature function in the user terminal by displaying a bar code and a user code scanning mode, and if the user terminal is a mobile communication terminal (such as a mobile phone), the application service system can send a short message through the mobile communication terminal of the user, and can start the cryptographic program implementing the ECDSA word signature function in the user mobile communication terminal through the information contained in the short message, such as URL (uniform resource locator) and automatically acquire the secure digital signature token or secure digital signature function of the mobile communication token through the user token.

Fig. 1 is a basic structure and an application schematic of a system according to the present invention, fig. 2 is a schematic diagram of a signature assistance device or a system center deployment scenario according to the present invention, fig. 3 is a schematic diagram of a signature assistance device or a system distribution deployment scenario according to the present invention, and fig. 4 is a schematic diagram of a signature assistance device or a system independent deployment scenario according to the present invention.

Other specific technical implementations not described are well known to those skilled in the relevant arts and are self-evident.

Claims (12)

1. A safe and controllable using method of an ECDSA signature private key is characterized by comprising the following steps of:

The user terminal has Q_U＝d_U G, a secret d_B＝(bd_U) mod n, and S_B = E (b) can be obtained, wherein d_U is an ECDSA signature private key of the user, G is a base point of an ECDSA elliptic curve point group, Q_U is a public key corresponding to the ECDSA signature private key d_U of the user, b is an integer secret in [1, n-1], n is the order of the base point G, n is prime number, and E (·) is encryption operation adopting a homomorphic encryption algorithm;

The signature auxiliary device or system has a private key SK₁ of decryption operation corresponding to a public key adopted by encryption operation E (-) of the homomorphic encryption algorithm or a private key SK₁ of decryption operation corresponding to a public key adopted by encryption operation E (-) of the homomorphic encryption algorithm, the private key SK₁ of decryption operation is encrypted into a ciphertext T_sk1 by a key of the signature auxiliary device or system, wherein the key of the signature auxiliary device or system adopted by encrypting the private key SK₁ comprises a symmetric key or a public key, and the user terminal also stores a ciphertext T_sk1 of the private key SK₁ of decryption operation corresponding to the public key adopted by encryption operation E (-);

The signature auxiliary device or system does not have b and cannot obtain b, or the signature auxiliary device or system has or can obtain b;

the case where the user terminal is available with S_B =e (b) includes that the signature assistance device or system submits S_B to the user terminal at the time of digital signature;

The situation that the signature auxiliary device or system can obtain b comprises that when the digital signature is obtained, the user terminal submits S_B to the signature auxiliary device or system, and the signature auxiliary device or system decrypts S_B to obtain b;

The user terminal and the signature auxiliary device or the device and the system outside the system have no b;

if the signature auxiliary device or system has no b and cannot obtain b, S_B is used as a secret to be stored in the user terminal safely and protected safely;

If the signature auxiliary device or system does not have b and b cannot be obtained, taking G_b＝b^-1G,b^-1 as the modulo n multiplication inverse of b, and at least one of the user terminal and the signature auxiliary device or system has G_b,G_b as the non-secret between the user terminal and the signature auxiliary device or system;

the signature auxiliary device or system is a computing device or system for assisting the user terminal to finish digital signature generation and computation;

When it is desired to digitally sign the message M using the ECDSA signature private key d_U of the user, the user terminal and the signature assistance device or system generate a digital signature for the message M as follows:

the user terminal calculates a hash value e of the message M for digital signature calculation by using the message M and a hash function, and sends the e to a signature auxiliary device or system, or the signature auxiliary device or system calculates a hash value e of the message M for digital signature calculation by using the message M and the hash function, and sends the e to the user terminal;

The user terminal randomly selects an integer k₁ in the [1, n-1] interval, wherein n is the order of the base point G;

The signature assistance device or system randomly selects an integer k₂ within the [1, n-1] interval;

the user terminal and the signature assistance device or system do the following without exposing the respective secret k₁、k₂:

under the condition that the user terminal ensures that the signature auxiliary device or system does not reselect k₂, R=k₁k₂G_b is obtained by interaction calculation with the signature auxiliary device or system;

The signature auxiliary device or system obtains R_f＝k₁k₂G_b through interactive calculation with the user terminal under the condition that the user terminal is ensured not to reselect k₁;

Or alternatively

Under the condition that the user terminal ensures that the signature auxiliary device or system does not reselect k₂, calculating R= (k₁+k₂)G_b;

The signature auxiliary device or system obtains R_f＝(k₁+k₂)G_b through interactive calculation with the user terminal under the condition that the user terminal is ensured not to reselect k₁;

If R and/or R_f are zero elements, the user terminal, signature assistance device or system reselects k₁、k₂, recalculates R, R_f until R and R_f are not zero elements;

The user terminal calculates r=x_R mod n, where x_R is taken from (x_R,y_R) =r;

The signature assistance device or system computes r_f＝x_Rf mod n, where x_Rf is taken from (x_Rf,y_Rf)＝R_f;

The user terminal and the signature assistance device or system check whether r and/or r_f are 0, if yes, the user terminal and the signature assistance device or system reselect k₁、k₂, recalculate R, R_f, recalculate r, r_f until neither r nor r_f is 0;

The user terminal and the signature assistance device or system check whether (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0, respectively, will occur, i.e. whether s=0 will occur, where s is the parameter s in the digital signature (r, s) to be generated by calculation;

If yes, the user terminal and the signature assistance device or system reselect k₁、k₂, recalculate R, R_f, recalculate r, r_f until no (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0 occurs, or go to error processing;

If the situation that (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0 does not occur, performing subsequent calculation processing;

The user terminal calculates s₁ as one of the following:

s₁ calculation mode one:

R, R_f adopts a calculation formula of R=k₁k₂G_b、R_f＝k₁k₂G_b;

The user terminal randomly selects an integer q in [1, n-1], and the integer q is calculated by q, e, r, S_B、d_B、k₁ through homomorphic encryption algorithm:

s₁₀＝E(((k₁)^-1eb+q)(mod n)),s₁₁＝((k₁)^-1rd_B-q)mod n,

Or alternatively s₁₀＝E(((k₁)^-1(eb+q))(mod n)),s₁₁＝((k₁)^-1(rd_B-q))mod n,

Or s₁₀＝E(((k₁)^-1e(b+q))(mod n)),s₁₁＝((k₁)^-1(rd_B-eq))mod n, where (k₁)^-1 is the modulo n multiplicative inverse of k₁;

The s₁₀、s₁₁ value pair (s₁₀,s₁₁) forms s₁;

s₁ second calculation mode:

R, R_f adopts a calculation formula of R=k₁k₂G_b、R_f＝k₁k₂G_b;

The user terminal is calculated by using e, r and S_B、d_B、k₁ through homomorphic encryption algorithm:

s₁＝E(((k₁)^-1(eb+rd_B))(mod n));

s₁ calculation mode three:

R, R_f adopts a calculation formula of R=k₁k₂G_b、R_f＝k₁k₂G_b;

the homomorphic encryption algorithm corresponding to E (-) is the homomorphic encryption algorithm;

The signature assistance device or system computes c₂＝E((k₂)^-1), where (k₂)^-1 is the modulo-n multiplicative inverse of k₂, sending c₂ to the user terminal;

The user terminal is calculated by using e, r and S_B、d_B、k₁、c₂ through homomorphic encryption algorithm:

s₁＝E(((k₁k₂)^-1(eb+rd_B)) (mod n)), where (k₁k₂)^-1 is the modulo-n multiplicative inverse of k₁k₂;

s₁ calculation mode four:

r, R_f adopts a calculation formula of R= (k₁+k₂)G_b、R_f＝(k₁+k₂)G_b;

Signature assistance device or system calculates c₂＝E(k₂), sends c₂ to the user terminal;

The user terminal randomly selects an integer q in [1, n-1], and the integer q is calculated by q, e, r, S_B、d_B、k₁、c₂ through homomorphic encryption algorithm:

s₁₀＝E((q(k₁+k₂))(mod n)),s₁₁＝E(q(eb+rd_B)(mod n));

The s₁₀、s₁₁ value pair (s₁₀,s₁₁) forms s₁;

After s₁ is calculated, the user terminal sends s₁ to a signature auxiliary device or system;

If the private key SK₁ of the decryption operation corresponding to the public key used in the encryption operation E (-) of the homomorphic encryption algorithm is encrypted into the ciphertext T_sk1 by using the key of the signature auxiliary device or system, and stored in the user terminal, the user terminal further sends T_sk1 to the signature auxiliary device or system, and the signature auxiliary device or system decrypts T_sk1 to obtain the private key SK₁ of the decryption operation corresponding to the public key used in the encryption operation E (-) of the homomorphic encryption algorithm;

if the signature assistance device or system does not have b and b is not available, i.e., G_b＝b^-1 G:

for s₁ calculation mode one, the signature assistance device or system decrypts s₁₀ in the value pair s₁ using the private key SK₁ to obtain the plaintext s₁₂ of s₁₀, calculates s= ((k₂)^-1(s₁₁+s₁₂)) mod n;

For the second calculation mode s₁, the signature assistance device or system decrypts s₁ using the private key SK₁ to obtain the plaintext s₁₂ of s₁, and calculates s= ((k₂)^-1s₁₂) mod n;

For s₁ calculation mode three, the signature assistance device or system decrypts s₁ using private key SK₁ to obtain plaintext s₁₂ of s₁, and calculates s=s₁₂ mod n;

For the fourth calculation mode of s₁, the signature assistance device or system decrypts s₁₀、s₁₁ in the value pair s₁ using the private key SK₁, respectively obtains plaintext s₁₃ of plaintext s₁₂,s₁₁ of s₁₀, and calculates s= ((s₁₂)^-1s₁₃) mod n, where (s₁₂)^-1 is the modulo-n multiplicative inverse of s₁₂;

If the signature assistance device or system has or can obtain b, i.e. G_b =g, then:

For s₁ calculation mode one, the signature assistance device or system decrypts s₁₀ in the value pair s₁ using the private key SK₁ to obtain the plaintext s₁₂ of s₁₀, calculates s= ((bk₂)^-1(s₁₁+s₁₂)) mod n, where (bk₂)^-1 is the modulo-n multiplicative inverse of bk₂;

For the second calculation mode s₁, the signature assist device or system decrypts s₁ using the private key SK₁ to obtain the plaintext s₁₂ of s₁, and calculates s= ((bk₂)^-1s₁₂) mod n;

For s₁ calculation mode three, the signature assistance device or system decrypts s₁ using private key SK₁ to obtain plaintext s₁₂ of s₁, and calculates s=b^-1s₁₂ mod n;

For s₁, the signature assistance device or system decrypts s₁₀、s₁₁ in the value pair s₁ using the private key SK₁ to obtain plaintext s₁₃ of plaintext s₁₂,s₁₁ of s₁₀, respectively, and calculates s= ((bs₁₂)^-1s₁₃) mod n, where (bs₁₂)^-1 is the modulo n multiplicative inverse of bs₁₂;

Before returning s to the user terminal, the signature auxiliary device or the system verifies whether s is obtained by calculating a private key d_U corresponding to e, k₁、k₂、r_f and a public key Q_U according to the ECDSA calculation mode, if yes, the process is continued, otherwise, the process is transferred into error processing;

The user terminal verifies whether s is obtained by calculating the ECDSA digital signature in a calculation mode by using e, k₁、k₂, r and a private key d_U corresponding to a public key Q_U, if the verification is passed, the (r, s) is the digital signature of the message M, otherwise, the error processing is carried out;

in the above calculation formula of the encryption operation E (-) adopting the homomorphic encryption algorithm, a (mod n), wherein a is an integer, and represents an integer congruent with a modulo n;

the signature assisting device or system authenticates and confirms that the user using the user terminal, namely the signer, is the owner of the public key Q_U before assisting the user terminal to finish the generation of the digital signature, or relies on the system invoking the signature assisting device or system to authenticate and confirms that the user using the user terminal, namely the signer, is the owner of the public key Q_U;

The user terminal performs the above-described digital signature calculation and generation steps through a cryptographic program or a cryptographic module or a cryptographic component in which a cryptographic function is implemented, and implements an ECDSA digital signature function.

2. The secure and controllable method of using ECDSA signature private key of claim 1, characterized by:

One way for the user terminal and the signature assistance device or system to check if (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0, respectively, would be as follows:

the user terminal checks whether eG+rQ_U is zero element, if so, (e+rd_U) mod n=0 will occur, otherwise it will not;

The signature assistance device or system checks whether eG+r_fQ_U is zero, if so, (e+r_fd_U) mod n=0 will occur, otherwise it will not.

3. The secure and controllable method of using ECDSA signature private key of claim 1, characterized by:

The method for verifying whether s is calculated by using e, k₁、k₂、r_f and a private key d_U corresponding to a public key Q_U according to the ECDSA calculation mode by the signature auxiliary device or the system comprises the following steps:

The signature assistance device or system checks whether the verification (r_f, s) is a digital signature of the message M, if so, the verification passes, otherwise, the verification does not pass;

Or the signature auxiliary device or the system checks whether the value of the verification sR_f is the same as eG+r_fQ_U, if so, the verification is passed, otherwise, the verification is not passed;

The method for verifying whether s is calculated by using the private key d_U corresponding to the e, k₁、k₂, r and the public key Q_U according to the ECDSA calculation mode by the user terminal comprises the following steps:

the user terminal checks whether the verification (r, s) is a digital signature of the message M, if so, the verification is passed, otherwise, the verification fails;

Or the user terminal checks whether the value of the verification sR is the same as the eg+rq_U, if so, the verification passes, otherwise, the verification fails.

4. The secure and controllable method of using ECDSA signature private key of claim 1, characterized by:

The safe and controllable use method of the ECDSA signature private key for preventing d_B and/or S_B from being stolen is as follows:

When a user accesses an application service system and needs to use an ECDSA signature private key of the user to carry out digital signature on a message M, the application service system issues a security token for the user, wherein the security token is an authorization credential for requesting a signature auxiliary device or system to assist, cooperatively generate or/and calculate the digital signature;

The application service system transmits the security token or the acquired information of the security token to a password program or a password module or a password component which implements the ECDSA digital signature function in the user terminal, wherein the acquired information of the security token is information for acquiring the security token issued by the application service system;

The user terminal submits the security token or the acquired information of the security token to a signature auxiliary device or a signature auxiliary system through T_sk2;

If the acquisition information of the security token is submitted to the signature auxiliary device or the system, the signature auxiliary device or the system uses the acquisition information to acquire the security token issued by the application service system;

The signature assistance device or system verifies the validity of the security token, after which the user terminal and the signature assistance device or system generate a digital signature for the message M using d_B、S_B in accordance with the secure controllable use of the ECDSA signature private key as described above.

5. The secure and controllable method of using ECDSA signature private key of claim 4, further comprising:

The manner in which the application service system passes the security token or the acquired information of the security token to the cryptographic program or the cryptographic module or the cryptographic component in the user terminal that implements the ECDSA digital signature function includes:

if the client program used by the user access application service system and the password program or the password module or the password component for implementing the ECDSA digital signature function are positioned at the same user terminal, the application service system transmits the security token or the acquisition information of the security token to the password program or the password module or the password component for implementing the ECDSA digital signature function in the user terminal through the client program;

Or if the client program used by the user for accessing the application service system and the password program or the password module or the password component for implementing the ECDSA digital signature function are positioned at different user terminals, the application service system displays the bar code through the client program used by the user, and then transmits the security token or the acquired information of the security token to the password program or the password module or the password component for implementing the ECDSA digital signature function in the user terminal in a mode of scanning the bar code by the user by using the user terminal;

Or if the user terminal is a mobile communication terminal, the application service system sends a short message through the mobile communication terminal of the user, starts a password program for implementing the ECDSA digital signature function in the mobile communication terminal of the user through information contained in the short message, and transmits the security token or the acquired information of the security token to the password program for implementing the ECDSA digital signature function in the mobile communication terminal of the user automatically through starting the information or through the mode that the user inputs the information in the short message.

6. The secure and controllable method of using ECDSA signing private key of claim 5, further comprising:

one security enhancement scheme based on the above-described secure controllable usage of ECDSA signature private keys to prevent theft of d_B and/or S_B is as follows:

Homomorphic encryption algorithm corresponding to homomorphic encryption operation E ();

The application service system issues a security token to a user, randomly selects an integer k₀ in [1, n-1], calculates R₀＝k₀G_b, adopts homomorphic encryption calculation to obtain c₀＝E((k₀)^-1) or c₀＝E(k₀), wherein (k₀)^-1 is the modulo n multiplication inverse of k₀, then transmits R₀ and the security token to a signature auxiliary device or system through a user terminal, R₀ is protected by the security token, and transmits acquired information of c₀ or c₀ to the user terminal;

After verifying the validity of the received security token, the signature assistance device or system determines the validity of R₀ by the security token;

If the user terminal receives the acquired information of c₀, the user terminal acquires c₀ by using the acquired information;

After calculating the hash value e of the message M by using the message M, the user terminal randomly selects an integer k₁ in the [1, n-1] interval, and the signature auxiliary device or system randomly selects an integer k₂ in the [1, n-1] interval;

the user terminal and the signature assistance device or system do the following without exposing the respective secret k₁、k₂:

under the condition that the user terminal ensures that the signature auxiliary device or system does not reselect k₂, R=k₁k₂R₀ is obtained by interaction calculation with the signature auxiliary device or system;

The signature auxiliary device or system obtains R_f＝k₁k₂R₀ through interactive calculation with the user terminal under the condition that the user terminal is ensured not to reselect k₁;

Or alternatively

Under the condition that the user terminal ensures that the signature auxiliary device or system does not reselect k₂, calculating R= (k₁+k₂)R₀;

The signature auxiliary device or system obtains R_f＝(k₁+k₂)R₀ through interactive calculation with the user terminal under the condition that the user terminal is ensured not to reselect k₁;

If R and/or R_f are zero elements, the user terminal, signature assistance device or system reselects k₁、k₂, recalculates R, R_f until R and R_f are not zero elements;

The user terminal calculates r=x_R mod n, where x_R is taken from (x_R,y_R) =r;

The signature assistance device or system computes r_f＝x_Rf mod n, where x_Rf is taken from (x_Rf,y_Rf)＝R_f;

The user terminal and the signature assistance device or system check whether r and/or r_f are 0, if yes, the user terminal and the signature assistance device or system reselect k₁、k₂, recalculate R, R_f, recalculate r, r_f until neither r nor r_f is 0;

The user terminal and the signature assistance device or system check whether (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0, respectively, will occur, i.e. whether s=0 will occur, where s is the parameter s in the digital signature (r, s) to be generated by calculation;

If yes, the user terminal and the signature assistance device or system reselect k₁、k₂, recalculate R, R_f, recalculate r, r_f until no (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0 occurs, or go to error processing;

If the situation that (e+rd_U) mod n=0 and/or (e+r_fd_U) mod n=0 does not occur, performing subsequent calculation processing;

The user terminal calculates s₁ as one of the following:

s₁ calculation mode five:

R, R_f adopts the calculation formula of R＝k₁k₂R₀、R_f＝k₁k₂R₀,c₀＝E((k₀)^-1);

The user terminal is calculated by using e, r and S_B、d_B、c₀、k₁ through homomorphic encryption algorithm:

s₁＝E(((k₀k₁)^-1(eb+rd_B)) (mod n)), where (k₀k₁)^-1 is the modulo-n multiplicative inverse of k₀k₁;

s₁ calculation mode six:

R, R_f adopts the calculation formula of R＝k₁k₂R₀、R_f＝k₁k₂R₀,c₀＝E((k₀)^-1);

Signature assistance device or system calculates c₂＝E((k₂)^-1), sends c₂ to the user terminal;

The user terminal is calculated by using e, r and S_B、d_B、c₀、k₁、c₂ through homomorphic encryption algorithm:

s₁＝E(((k₀k₁k₂)^-1(eb+rd_B)) (mod n)), where (k₀k₁k₂)^-1 is the modulo-n multiplicative inverse of k₀k₁k₂;

s₁ calculation mode seven:

R, R_f adopts the calculation formula of R＝(k₁+k₂)R₀、R_f＝(k₁+k₂)R₀,c₀＝E(k₀);

Signature assistance device or system calculates c₂＝E(k₂), sends c₂ to the user terminal;

The user terminal randomly selects an integer q in [1, n-1], and the integer q is calculated by q, e, r, S_B、d_B、c₀、k₁、c₂ through homomorphic encryption algorithm:

s₁₀＝E((qk₀(k₁+k₂))(mod n)),s₁₁＝E(q(eb+rd_B)(mod n));

The s₁₀、s₁₁ value pair (s₁₀,s₁₁) forms s₁;

After s₁ is calculated, the user terminal sends s₁ to a signature auxiliary device or system;

If the private key SK₁ of the decryption operation corresponding to the public key employed in the encryption operation E (-) of the homomorphic encryption algorithm is encrypted into the ciphertext T_sk1 by using the key of the signature assistance device or system, the user terminal further sends T_sk1 to the signature assistance device or system, and the signature assistance device or system decrypts T_sk1 to obtain the private key SK₁ of the decryption operation corresponding to the public key employed in the encryption operation E (-) of the homomorphic encryption algorithm;

if the signature assistance device or system does not have b and b is not available, i.e., G_b＝b^-1 G:

For calculation mode five of s₁, the signature assistance device or system decrypts s₁ using private key SK₁ to obtain plaintext s₁₂ of s₁, and calculates s= ((k₂)^-1s₁₂) mod n;

For the sixth calculation mode of s₁, the signature assistance device or system decrypts s₁ using the private key SK₁ to obtain the plaintext s₁₂ of s₁, and calculates s=s₁₂ mod n;

For the seventh calculation mode of s₁, the signature assistance device or system decrypts s₁₀、s₁₁ in the value pair s₁ using the private key SK₁ to obtain plaintext s₁₃ of plaintext s₁₂,s₁₁ of s₁₀, respectively, and calculates s= ((s₁₂)^-1s₁₃) mod n;

If the signature assistance device or system has or can obtain b, i.e. G_b =g, then:

For calculation mode five of s₁, the signature assistance device or system decrypts s₁ using private key SK₁ to obtain plaintext s₁₂ of s₁, and calculates s= ((bk₂)^-1s₁₂) mod n;

For the sixth calculation mode of s₁, the signature assistance device or system decrypts s₁ using the private key SK₁ to obtain the plaintext s₁₂ of s₁, and calculates s= (b^-1s₁₂) mod n;

For the seventh calculation mode of s₁, the signature assistance device or system decrypts s₁₀、s₁₁ in the value pair s₁ using the private key SK₁ to obtain plaintext s₁₃ of plaintext s₁₂,s₁₁ of s₁₀, respectively, and calculates s= ((bs₁₂)^-1s₁₃) mod n;

if the signature auxiliary device or system obtains b through decryption S_B, the user terminal sends S_B to the signature auxiliary device or system, and the signature auxiliary device or system decrypts S_B to obtain b;

before returning s to the user terminal, the signature auxiliary device or the system verifies whether s is obtained by calculating a private key d_U corresponding to e, k₀、k₁、k₂、r_f and a public key Q_U according to the ECDSA calculation mode, if yes, the signature auxiliary device or the system continues, and if the verification fails, the signature auxiliary device or the system shifts to error processing;

The user terminal verifies whether s is obtained by calculating the ECDSA digital signature in a calculation mode by using e, k₀、k₁、k₂, r and a private key d_U corresponding to a public key Q_U, if the verification is passed, the (r, s) is the digital signature of the message M, otherwise, the error processing is carried out;

The signature assistance device or system authenticates and confirms that the user using the user terminal, i.e., the signer, is the owner of the public key Q_U before assisting, assisting the user terminal in completing the generation of the digital signature, or relies on the system invoking the signature assistance device or system to authenticate and confirm that the user using the user terminal, i.e., the signer, is the owner of the public key Q_U.

7. The secure and controllable method of using ECDSA signing private key of claim 5, further comprising:

The scheme for preventing the theft of the security token based on the secure controllable use method of the ECDSA signature private key for preventing the theft of d_B and/or S_B is as follows:

When the application service system issues a security token to a user, randomly selecting an integer w as a disturbance parameter in [1, n-1], encrypting w into ciphertext data which can be decrypted only by a signature auxiliary device or system, and then transmitting the ciphertext data of w together with the security token to the signature auxiliary device or system through a user terminal, wherein the plaintext or ciphertext data of w is protected by the security token;

After verifying the validity of the received security token, the signature auxiliary device or system decrypts the ciphertext of the disturbance parameter w to obtain a plaintext of w, and determines the validity of the plaintext or ciphertext of w through the security token;

After s is calculated, the signature auxiliary device or system calculates s_w = (s+w) mod n or s_w = (sw) mod n to obtain a perturbed digital signature (r, s_w);

(r, s_w) not submitted or returned to the application service system via the user terminal;

The application service system calculates s= (s_w -w) mod n or s= (w^-1s_w) mod n, where w^-1 is the modulo n multiplication inverse of w, recovering the digital signature (r, s) for message M.

8. The secure and controllable method of using ECDSA signature private key according to any one of claims 1-7, characterized by:

the security enhancement scheme for the encryption protection of d_B and/or S_B on the basis of the secure and controllable use method of the ECDSA signature private key is as follows:

d_B and/or S_B are/is encrypted to be ciphertext data T_U, a key SK₂ used for decrypting ciphertext data T_U is encrypted to be ciphertext data T_sk2, a signature auxiliary device or system is provided with a key SK₃ used for decrypting ciphertext data T_sk2, and ciphertext data T_U and ciphertext data T_sk2 are stored in a user terminal;

When a user accesses an application service system and needs to use an ECDSA signature private key of the user to carry out digital signature on a message M, the application service system issues a security token for the user;

The user terminal submits the security token or the acquired information of the security token to a signature auxiliary device or a signature auxiliary system through T_sk2;

If the acquisition information of the security token is submitted to the signature auxiliary device or the system, the signature auxiliary device or the system uses the acquisition information to acquire the security token issued by the application service system;

After the signature auxiliary device or system verifies the validity of the security token, the cipher text data T_sk2 is decrypted by using the key SK₃ to obtain a key SK₂, and the key SK₂ is returned to the user terminal;

The user terminal decrypts the ciphertext data T_U using the key SK₂ to obtain d_B and/or S_B, and then the user terminal and the signature assistance device or system perform the generation calculation of the digital signature using d_B、S_B according to the secure and controllable usage method of the ECDSA signature private key described above.

9. The secure and controllable method of using ECDSA signature private key according to any one of claims 1-7, characterized by:

The generation and distribution modes of the ECDSA signature key pair of the user comprise:

Mode one:

Generating an ECDSA signature key pair Q_U、d_U by a trusted program in the user terminal, wherein an integer b is randomly selected in [1, n-1], d_B＝(bd_U)mod n,S_B =E (b) is calculated, d_U and b are discarded, and d_B、S_B is safely stored;

If the G_b＝b^-1 G needs to be calculated, the trusted program uses b to calculate G_b＝b^-1 G, and stores or submits G_b in the user terminal to a signature auxiliary device or system;

mode two:

Generating an ECDSA signature key pair Q_U、d_U by a trusted program in another terminal, randomly selecting an integer b in [1, n-1], calculating d_B＝(bd_U)mod n,S_B =E (b), discarding d_U and b, and then transmitting d_B、S_B to a user terminal for storage by bar code scanning or other transmission modes, wherein the other terminal refers to a computing device outside the user terminal for storing and using d_B、S_B;

if G_b＝b^-1 G needs to be calculated, the trusted program uses b to calculate G_b＝b^-1 G, and transmits G_b to a user terminal for storage through a bar code or other transmission modes, or submits G_b to a signature auxiliary device or a system for storage;

Mode three:

Generating an ECDSA signature key pair Q_U、d_U by a key generating device or system, randomly selecting an integer b in [1, n-1], calculating d_B＝(bd_U)mod n,S_B =E (b), discarding d_U and b, and then transmitting d_B、S_B to a user terminal in a safe mode for storage;

If G_b＝b^-1 G needs to be calculated, the key generation device or system uses b to calculate G_b＝b^-1 G, then transmits G_b to the user terminal for storage, or submits G_b to the signature auxiliary device or system for storage;

Mode four:

Randomly selecting an integer d₁、b₁ from [1, n-1] by a key generating device or system, encrypting b₁ by adopting a homomorphic encryption algorithm to obtain S_B1＝E(b₁), calculating d_B1＝(b₁d₁)mod n,Q_U1＝d₁ G, discarding d₁、b₁, and transmitting S_B1、d_B1、Q_U1 to a user terminal;

The user terminal randomly selects an integer d₂、b₂ in [1, n-1] or randomly selects an integer d₂ in [1, n-1], fixes the value of b₂ in [1, n-1], calculates S_B＝E(b₁b₂),d_B＝(b₂d₂d_B1) mod n by homomorphic encryption algorithm, S_B1、d_B1 and ciphertext operation, and calculates Q_U＝d₂Q_U1;

The user terminal verifies S_B＝E(b₁b₂),d_B＝(b₁b₂d₁d₂)mod n,d₁d₂ is congruent with an ECDSA signature private key d_U modulo n in [1, n-1], i.e. d₁d₂＝d_U (mod n) and Q_U＝d_U G, i.e. d_U＝(d₁d₂) mod n and Q_U＝d_U G, without exposing d₁d₂, b₁b₂ is congruent with an integer b modulo n in [1, n-1], i.e. b₁b₂ =b (mod n);

The user terminal discards d₂、b₂ and saves S_B、d_B、Q_U;

If the G_b＝b^-1 G needs to be calculated, the key generating device or system uses b₁ to calculate G_b1＝(b₁)^-1 G, then transmits G_b1 to the user terminal, and the user terminal calculates G_b＝(b₂)^-1G_b1, or uses b₂ to calculate G_b2＝(b₂)^-1 G, submits G_b2 to the signature auxiliary device or system, and the key generating device or system calculates G_b＝(b₁)^-1G_b2;

The user terminal and/or the signature auxiliary device or system stores G_b;

For the above-mentioned ECDSA signature private key generation and distribution method, if the homomorphic encryption algorithm public key used for encrypting b is temporarily generated, the device, system or program for generating d_U or d₁ encrypts the private key SK₁ of the corresponding homomorphic encryption algorithm used for decryption operation to obtain the ciphertext T_sk1 of SK₁ by using a symmetric key or a public key, where encryption of SK₁ by using the public key is applicable to all four ECDSA signature key pairs generation and distribution methods, and encryption of SK₁ by using the symmetric key is applicable to only three and four ECDSA signature key pairs generation and distribution methods.

10. The secure and controllable method of using ECDSA signing private key of claim 9, characterized by:

For the first, second, and third modes of the generation and distribution modes of the ECDSA signing key pair of the user, if the signature assistance device or system does not have b and cannot obtain b, b= (d_U)^-1 is allowed, at this time, d_B =1) is selected.

11. The secure and controllable method of using ECDSA signing private key of claim 9, characterized by:

For the fourth mode of the generation and distribution modes of the ECDSA signing key pair of the user, b₁、b₂ is allowed as follows:

b₁＝(d₁)^-1,b₂ =1, where (d₁)^-1 is the modulo n multiplication inverse of d₁, where b= (d₁)^-1,d_B＝d₂;

b₁＝(d₁)^-1,b₂＝(d₂)^-1, where (d₂)^-1 is the modulo-n multiplication inverse of d₂, where b= (d₁d₂)^-1,d_B =1), the signature assistance device or system has no b and cannot get b.

12. A secure controllable use system of ECDSA signature private key based on the secure controllable use method of ECDSA signature private key as set forth in any one of claims 1 to 7, characterized in that:

The system comprises a signature auxiliary device or system, a cipher program or a cipher module or a cipher component in a user terminal, a ciphertext d_B of a user ECDSA signature private key d_U stored in the user terminal or capable of obtaining a cipher text S_B of a key b for decrypting d_B, the cipher program or the cipher module or the cipher component in the user terminal when the user ECDSA signature private key is required to be used for carrying out digital signature on a message M, and the signature auxiliary device or system cooperatively generates the digital signature on the message M according to the safe and controllable using method of the ECDSA signature private key, wherein the cipher program or the cipher module or the cipher component in the user terminal implements the operation processing and/or the function of the user terminal in the digital signature generating method.