xgcl/tpc/sm2/doc/两方KGC下SM9协同签名.md

两方KGC下SM9协同签名

协同密钥关系

• 服务端密钥 k_s \in [1,N-1]
• 客户端密钥 K_c=[k_s^{-1}]ds_A
• 用户签名密钥ds_A = [k_s]K_c

签名密钥生成

sequenceDiagram
    participant Client
    participant Server
    participant KGC1
    participant KGC2
    Note right of Server: ks <- [1,N-1]
    Note right of Server: P'1 = [ks^{-1}]P1
    Server->>Client: P'1
    Note left of Client: ra <- [1, N-1]
    Note left of Client: R = [ra]P'1
    Note right of Server: 以下同[1]中A.3流程（P1替换为P'1)   
    Client->>KGC1: R
    KGC1->>Client: t1, T1
    Client->>KGC2: T1
    KGC2->>Client: T2
    Note left of Client: 计算Kc(= A.3中的ds_A)和Ppub-sA

[1] 《SM9标识密码用户私钥分布式生成指南》

签名

sequenceDiagram
    participant Client
    participant Server
    Note left of Client: g=e(P1, Ppub-sA)
    Note left of Client: r1 <- [1,N-1]
    Note left of Client: u = g^{r1}
    Client->>Server:u,M(=SM3(plaintext)), ID
    Note right of Server: g=e(P1, Ppub-sA)
    Note right of Server: r2,r3 <- [1, N-1]
    Note right of Server: w = u^{r2}·g^{r3}
    Note right of Server: h = H2(M||w,N)
    Note right of Server: k1 = r2·ks
    Note right of Server: k2 = (r3-h)·ks
    Server->>Client:h,k1,k2
    Note left of Client: S=[r1·k1+k2]Kc
    Note left of Client: 输出签名(h,S)