GB/T 32918.2-2016Information security technology—Public key cryptographic algorithm SM2 based on elliptic curves—Part 2: Digital signature algorithm (English PDF)

3.1 Message

A bit string of any finite length.

3.2 Signed message

A set of data elements consisting of a message and a signed portion of the message.

3.3 Signature key

A secret data element that is unique to the signer during the digital signature generation process, i.e., signer's private key.

3.4 Signature generation process

A process of entering a message, a signature key and elliptic curve's system parameters, and outputting a digital signature.

3.5 Distinguishing identifier

Information that makes it possible to identify an entity's identity without ambiguity.

5.2 Elliptic curve's system parameters

Elliptic curve's system parameters include the size q of the finite field Fq (when q = 2m, it also includes the identification of the element representation and the reduction polynomial); the two elements a, b in Fq of the equation defining the elliptic curve E(Fq); the base point G = (xG, yG) (G != O) on E(Fq), where xG and yG are two elements in Fq; the order n of G and other alternatives (such as the cofactor h of n).

Elliptic curve's system parameters and their verification shall comply with the specifications of Clause 5 of GB/T 32918.1-2016.

5.3 User key pairing

User A's key pairing includes its private key dA and public key PA = [dA ] G = (xA, yA).

The generation algorithm of the user key pairing and the public key verification algorithm shall comply with the specifications of Clause 6 of GB/T 32918.1-2016.

5.4 Auxiliary function

5.4.1 General

In the elliptic curve's digital signature algorithm specified in this Part, two types of auxiliary functions are involved. the cryptographic hash algorithm and the random number generator.

5.4.2 Cryptographic hash algorithm

This Part specifies the use of cryptographic hash algorithms approved by State Cryptography Administration, such as SM3 cryptographic hash algorithm.

5.4.3 Random number generator

This Part specifies the use of random number generators approved by State Cryptography Administration.

5.5 Other user information

User A as the signer has a distinguishing identifier IDA with a length of entlenA bits. ENTLA is denoted as a two-byte converted by the integer entlenA. In the signature generation process, the cryptographic hash algorithm is used to compress M (including ZA and the message to be signed M); before the verification process, the cryptographic hash algorithm is used to compress M ' (including ZA and message to be verified M'). […]

7.1 Digital signature verification algorithm

In order to verify the received message M' and its digital signature (r', s'), User B as the verifier shall implement the following operation steps.

B1. Verify if r' in [1, n - 1] is true, if not, the verification fails;

B2. Verify if s' in [1, n - 1] is true, if not, the verification fails;

B3. Set M ' = ZA || M';

B4. Calculate e' = Hv (M '); convert the data type of e' to an integer according to the methods given in 4.2.4 and 4.2.3 of GB/T 32918.1-2016;

B5. Convert the data types of r' and s' to integers according to the method given in 4.2.3 of GB/T 32918.1-2016; calculate t = (r' + s') mod n, if t = 0, the verification fails;

B6. Calculate the elliptic curve point (x'1, y'1) = [s'] G + [t] PA;

B7. Convert the data type of x'1 to an integer according to the method given in 4.2.8 of GB/T 32918.1-2016; calculate R = (e' + x1') mod n; verify if R = r' is true, if yes, the verification is passed, otherwise the verification fails.

NOTE: If ZA is not the hash value corresponding to User A, the verification will fail. See Annex A for an example of digital signature verification process.

7.2 Digital signature verification algorithm flow

The digital signature verification algorithm flow is shown in Figure 2.

A.1 General

This annex uses the cryptographic hash algorithm given in GB/T 32905-2016.

The input is a message bit string with a length less than 264, and the output is a hash value of 256 bits in length, denoted as H256 ( ).

In this annex, all numbers in hexadecimal are high on the left and low on the right.

In this annex, the message uses the code given in GB/T 1988.

Let User A's identity be. ALICE123@YAHOO.COM. Use the code given in GB/T 1988 IDA. 414C 49434531 32334059 41484F4F 2E434F4D. ENTLA = 0090.

A.2 Elliptic curve's digital signature on Fp

The elliptic curve equation is. y2 = x3 + ax + b

Example 1. Fp-256

Prime number p.

Coefficient a.

Coefficient b.

Base point G = (xG, yG), of which the order is n.

Coordinate xG.

Coordinate yG.

Order n.

Message to be signed M. message digest […]