基于国密SM2算法的证书透明日志系统设计  

Design of Certificate Transparency Log System Based on SM2 Algorithm

作　　者：陈立全 薛雨欣 江英华 朱雅晴 CHEN Liquan;XUE Yuxin;JIANG Yinghua;ZHU Yaqing(School of Cyber Science and Engineering,Southeast University,Nanjing 211189,China;College of Information Engineering,Xizang Minzu University,Xianyang 712082,China)

机构地区：[1]东南大学网络空间安全学院,南京211189 [2]西藏民族大学信息工程学院,咸阳712082

出　　处：《信息网络安全》2023年第11期9-16,共8页Netinfo Security

基　　金：国家自然科学基金[U22B2026]。

摘　　要：证书透明日志系统具有广泛应用前景,但当前的证书透明日志系统多采用存在一定局限性的RSA算法和ECC算法,且无法识别基于国密算法的SSL证书。文章提出了一种基于国密SM2算法的证书透明日志系统设计方法,采用SM2算法生成日志系统签名密钥和数字签名证书透明日志数据,采用SM3算法作为系统的摘要算法来计算日志签名数据的哈希值,实现支持国密SSL证书的证书透明日志系统,用于保障国密SSL证书的安全可信。The certificate transparency log system is an important mechanism for ensuring the security of digital certificates and addressing malicious issuances.The local encryption algorithm,SM2,which is independently developed in our country and has become an international standard,has a wide range of potential applications in the field of digital certificates.However,the current certificate transparency log systems mostly rely on RSA,ECC and they cannot recognize SSL certificates based on the SM2 algorithm.In this paper,a design method for a certificate transparency log system based on the SM2 algorithm is proposed.The system utilized the SM2 algorithm to generate the log system's signature key and to digitally sign the certificate transparency log data and the SM3 algorithm was used as the digest algorithm required by the system to calculate the hash value.This implementation enables the support of SM2 SSL certificates in the certificate transparency log system,thereby ensuring the security and trustworthiness of these SM2 SSL certificates.

关 键 词：证书透明日志系统 国密SSL证书 国密HTTPS加密 SM2算法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]