基于国密SM2 和SM9 的加法同态加密方案  

Additive Homomorphic Encryption Schemes Based on SM2 and SM9

作　　者：唐飞[1,2] 凌国玮 单进勇 TANG Fei;LING Guo-Wei;SHAN Jin-Yong(College of Computer Science and Technology,Chongqing University of Posts and Telecommunications,Chongqing 400065,China;School of Cyber Security and Information Law,Chongqing University of Posts and Telecommunications,Chongqing 400065,China;Beijing Sudo Technology Co.Ltd.,Beijing 100083,China)

机构地区：[1]重庆邮电大学计算机科学与技术学院,重庆400065 [2]重庆邮电大学网络空间安全与信息法学院,重庆400065 [3]北京数牍科技有限公司,北京100083

出　　处：《密码学报》2022年第3期535-549,共15页Journal of Cryptologic Research

基　　金：国家自然科学基金(61702067);重庆市自然科学基金(cstc2020jcyj-msxmX0343)。

摘　　要：加法同态加密是一种可对密文进行加法同态操作的加密方案,即对若干密文计算后再解密可以得到对应原始数据相加后的结果,加法同态已广泛应用于数据聚合、安全多方计算、联邦学习等领域.然而,现有的加法同态加密方案以国外设计为主,不符合网络空间安全自主可控的要求.针对这一问题,以DDH困难问题为基础,结合国密SM2和SM9设计了新的加法同态加密方案,并证明了它们具有INDCPA安全性.实验结果表明,在相同安全等级下,所提SM2加法同态加密方案的解密耗时大约仅为经典加法同态加密Exp-ElGamal方案的3/5,Paillier方案的1/8;SM9加法同态加密方案的解密耗时大约仅为Exp-ElGamal方案的3/4,Paillier方案的1/6.An additive homomorphic encryption is such an encryption scheme that can perform additive homomorphic operations on the ciphertexts.After several ciphertexts are calculated using a homomorphic operation and then decrypted,the result corresponds to the addition of the corresponding original data.Additive homomorphic encryption has been widely used in data aggregation,secure multi-party computation,and federated learning.This paper designs two additive homomorphic encryption schemes by combining the SM2 and SM9 algorithms and based on the DDH problem.The designed schemes are proved to have IND-CPA security.The experimental results show that under the same security level,the decryption time of the proposed SM2 additive homomorphic encryption scheme is only about 3/5 of Exp-ElGamal scheme and 1/8 of the Paillier scheme,and the decryption time of the proposed SM9 additive homomorphic encryption scheme is only about 3/4 of the Exp-ElGamal scheme and 1/6 of the Paillier scheme.

关 键 词：加法同态加密 SM2 SM9 门限密码 隐私保护 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]