Detailed Explanation of the SM2 Encryption Algorithm

Security Background

In the digital age, we deal with various “secrets”: our bank passwords, payment information, private chats… How can we ensure that this information is not intercepted or tampered with during network transmission? This relies heavily on powerful encryption algorithms.

Today, we will delve into our country’s independent cryptographic standard —SM2 encryption algorithm. As an important component of our commercial cryptographic algorithms, the SM2 algorithm plays an indispensable role in many commercial cryptographic protocols and applications in our country.

What is the SM2 Algorithm?

SM2 is a domestically developed elliptic curve public key cryptographic algorithm released by the National Cryptography Administration on December 17, 2010. It is based on ECC (Elliptic Curve Cryptography) and is an asymmetric encryption algorithm that ensures data security and unbreakability through the elliptic curve discrete logarithm problem. It is mainly used to replace the RSA encryption algorithm and includes the SM2-1 elliptic curve digital signature algorithm, SM2-2 elliptic curve key exchange protocol, and SM2-3 elliptic curve public key encryption algorithm, which are used for digital signatures, key agreement, and data encryption, respectively. It has wide applications in e-commerce, internet finance, and the Internet of Things, achieving user identity authentication, communication, and transaction security, ensuring reliable data transmission.

Functions and Advantages of the SM2 Algorithm

High Security:The SM2 algorithm is based on the elliptic curve discrete logarithm problem, and its security is widely recognized.Compared to the traditional RSA algorithm, SM2 requires a shorter key length at the same security level, has higher computational efficiency, and can effectively resist various hacker attacks.
Efficiency: In resource-constrained environments, the computational load of the SM2 algorithm is relatively small, meeting the needs for large-scale data encryption, decryption, and digital signatures, providing an efficient data protection solution for commercial fields.

Flexibility: The SM2 algorithm supports multiple key lengths, allowing for flexible selection based on actual application scenarios, suitable for the needs of different industries.

Independent Innovation: As a cryptographic algorithm independently innovated in our country, the SM2 algorithm has independent intellectual property rights, which is of great significance for ensuring the information security of the country’s critical information systems.

SM2 Encryption

SM2 is a public key encryption algorithm based on elliptic curve cryptography (ECC). This means it does not rely on the difficulty of factoring large integers like traditional cryptography, but instead utilizes mathematical problems on elliptic curves.

Imagine this:

There is a special elliptic curve filled with countless “points”, and there is a peculiar “addition” rule between these points: the sum of any two points on the curve is still a point on the curve.

The most critical problem is: given a point P and a very distant point Q obtained by multiple “additions” of point P, it is very difficult to deduce how many times P was added to get Q.

This “number of additions” is the private key, and that “distant point Q” is the public key. This is the core secret of elliptic curve cryptography: the public key can be disclosed, but deriving the private key is extremely difficult.

Detailed Explanation of the SM2 Encryption Process

Now, suppose A wants to send a top-secret message to B, but is concerned that the information may be intercepted along the way.A can use B’s SM2 public key to encrypt this information.

Step 1: Obtain the Receiver’s Public Key

A first needs to obtain B’s SM2 public key. This public key is public, like B’s announced “exclusive address for receiving secret information”.

Step 2: Generate Random Number and Temporary Public Key

A locally generates a random number k (temporary private key), and then uses this random number k to calculate a temporary public key C1.

It’s like: A has created a “one-time password lock” for this communication,k is the key to open this lock, and C1 is the model of this lock.

Step 3: Calculate Shared Point

A uses B’s public key, combined with the randomly generated number k, to calculate a shared point S.

This point S is key to encryption and decryption! Its uniqueness lies in the fact that B can also use their private key and C1 to calculate the same S.

Step 4: Generate Key Stream

Using the coordinates (X, Y) of the shared point S, through a key derivation function (KDF), A generates a key stream t that is the same length as the plaintext.

It’s like: the shared point S is a magical “key stream generator” that can produce “one-time ink” matching the length of the original information.

Step 5: Encrypt Plaintext

A performs an XOR operation between the plaintext M and the generated key stream t to obtain the ciphertext C2.

XOR operation means: the same bits become 0, and different bits become 1. The plaintext “covered” with the key stream becomes incomprehensible garbled text.

Step 6: Generate Ciphertext Hash Value

A calculates the hash value of the plaintext M and the coordinates of the shared point S. This hash value is used to verify data integrity during subsequent decryption.

Hash value is like: the “fingerprint” of the plaintext and the shared point, used to ensure that the information obtained after decryption has not been tampered with.

Step 7: Send Ciphertext

A packages and sends the following three parts to B:temporary public key C1, ciphertext data C2, and hash value C3.

Sent content:C1 | C2 | C3 (| indicates connection).

Detailed Explanation of the SM2 Encryption Algorithm

Detailed Explanation of the SM2 Decryption Process

B receives the ciphertext sent by A, C1 | C2 | C3, and now she needs to use her SM2 private key to decrypt.

Step 1: Verify Temporary Public Key

B first needs to verify the validity of C1 using the SM2 algorithm.

Step 2: Calculate Shared Point

B uses the received temporary public key C1 and her private key to calculate the same shared point S as the sender.

This is the wonderful part! Although B does not know the random number k that A used, due to the mathematical properties of elliptic curves, she and A can arrive at the same shared point S.

Step 3: Generate Key Stream

B also uses the coordinates of the shared point S to generate a key stream t that is the same length as the ciphertext C2.

Same “key stream generator”: B also obtains that “one-time ink”.

Step 4: Decrypt Ciphertext

B performs an XOR operation between the ciphertext C2 and the generated key stream t to restore the plaintext M'.

Inverse XOR operation: the ciphertext “once again covered” with the key stream can revert to the original information.

Step 5: Verify Data Integrity

B uses the decrypted plaintext M' and the coordinates of the shared point S to calculate a new hash value C3'. Then, she compares C3' with the received C3.

“Fingerprint” comparison: If C3' and C3 are exactly the same, it indicates that the information has not been tampered with during transmission. If they are different, it means the information may have been altered, or decryption failed.

Step 6: Obtain Final Plaintext

If the verification passes, B successfully obtains the plaintext M' sent by A.

Detailed Explanation of the SM2 Encryption Algorithm

Summary

Overall, the SM2 algorithm utilizes the mathematical properties of elliptic curves to achieve asymmetric encryption and digital signature functions, ensuring data security and integrity. Its principles are clear and straightforward, and it possesses high efficiency and security, making it suitable for various information security application scenarios.

Leave a Comment Cancel reply