基于国密算法的小型CA系统设计与实现

发布时间：2018-04-19 00:07

本文选题：认证系统 + 公钥基础设施　；参考：《西安电子科技大学》2014年硕士论文

【摘要】：随着互联网时代的到来和电子商务的普及,中国的网络交易额与日俱增。网络真真切切的改变了中国人的生活。在工作之余,只需要一个良好的网络环境,就能完成购物、炒股、转账等日常事务。真正实现了,任何时间、任何地点、任何人的电子交易。而这一切应用之基础,是要确保数据信息的保密性、完整性和不可抵赖性等安全性质。基于数字证书,PKI(Public Key Infrastructure),又称公钥基础设施,就成为这个虚拟网络世界,实体相互认证的灵魂。CA(Certificate Authority),又称证书认证授权中心,是PKI的重中之重,它负责个每个网络中的实体颁发数字证书。数字证书为网络中通信双方,提供了安全的数据通信。证书拥有其标准的格式,除标准的证书信息以外,尾部为一个签名值。证书信息由杂凑算法得到的杂凑值,在此基础上,证书颁发机构的对此签名,得到此签名值。而常用的签名密码算法为非对称密码算法RSA算法和常用于消息摘要的杂凑算法MD5算法。然而RSA算法和MD5算法在近些年的应用中越来越暴露其缺陷,因此,为了保证国内电子商务的安全,为了我国安全技术的自主化,国密局颁布了相对应的SM2、SM3算法。ECC算法相对RSA算法,无论在安全性还是在加解密速度、存储要求,都具有显著的优势。密钥为160比特的ECC算法,其安全强度相当于密钥为1024比特的RSA算法,而且节省了864比特的存储空间。而对于密钥长度为210比特的ECC算法,安全强度,则与2048比特RSA的算法一致,其节省的存储空间达到了1838比特。随着国内公钥基础设施和密钥管理系统的逐渐升级,SM2算法的普遍采用,成为一个必然的趋势。然而目前没有一套可用的基于SM2、SM3的CA系统。因此对于基于国密算法的CA系统的实现,具有重要的意义。本文研究了CA的相关理论和技术,阅读了国密局SM2、SM3相关标准。为了实现支持国密算法的双证书体系。密码算法方面,基于开源的OpenSSL,改造了开源安全编程软件OpenSSL,加入了国密算法。证书算法方面,以开源安全编程软件OpenSSL为基础,在其基础上加入国密证书和OCSP等国密证书接口,实现了加密证书。并且基于硬件,使用USB KEY,编程实现了基于USB Key生成公私钥对,签名证书请求,其他流程就与加密证书一致了。基于软硬件算法,实现了数字证书的相关接口、OCSP服务的相关接口。以VC为开发工具,实现了一个小型CA,可扩展之后用于各种用途。在改造完OpenSSL后,搭建CA,进行功能测试。加解密算法方面,进行SM2和SM3算法的测试。证书方面,进行了双证书,包括加密证书和签名证书接口的测试、证书吊销查询等。该CA系统具有完备的功能。可以用于其他系统的扩展。
[Abstract]:With the advent of the Internet era and the popularity of electronic commerce, China's network transactions are increasing.The Internet has really changed the lives of Chinese people.After work, only a good network environment, can complete shopping, stock speculation, transfer and other daily business.The real realization of any time, any place, anyone's electronic transactions.The basis of all these applications is to ensure the confidentiality, integrity and non-repudiation of data information.Based on the digital certificate, public Key infrastructure, also known as public key infrastructure, has become the virtual network world. The soul of entity mutual authentication, called certificate authentication authorization center, is the most important part of PKI.It is responsible for the issuance of digital certificates by entities in each network.Digital certificate provides secure data communication for both parties in the network.A certificate has its standard format, with a signature value at the end, in addition to the standard certificate information.The hash value of the certificate information is obtained by the hash algorithm. On this basis, the certificate authority signs this signature and obtains the signature value.The common signature cryptographic algorithms are asymmetric cryptographic algorithm (RSA) and hash algorithm (MD5) which is often used for message digest.However, in recent years, the RSA algorithm and MD5 algorithm are more and more exposed its shortcomings. Therefore, in order to ensure the security of domestic electronic commerce, for the independence of security technology in China,Compared with the RSA algorithm, the corresponding SM2OSM3 algorithm. ECC algorithm has significant advantages in security, encryption and decryption speed and storage requirements.The security strength of the 160-bit ECC algorithm is equal to that of the 1024 bit key RSA algorithm, and the storage space of 864 bits is saved.For the ECC algorithm with 210-bit key length, the security intensity is the same as that of the 2048 bit RSA algorithm, and the saved storage space is up to 1838 bits.With the gradual upgrading of public key infrastructure and key management system in China, SM2 algorithm has become an inevitable trend.However, there is no available CA system based on SM2 / SM3.Therefore, it is of great significance to implement CA system based on national secret algorithm.In this paper, the relevant theory and technology of CA are studied, and the relevant standards of SM2 / SM3 are read.In order to realize the double certificate system supporting the national secret algorithm.Cryptography algorithm, based on open source OpenSSL, the open source security programming software OpenSSL, joined the national secret algorithm.In the aspect of certificate algorithm, based on open source security programming software OpenSSL, the encryption certificate is realized by adding the national secret certificate, OCSP and other national secret certificate interfaces.And based on hardware, using USB key, programming to generate public and private key pairs based on USB Key, signing certificate request, other processes are consistent with encryption certificate.Based on the algorithm of software and hardware, the related interface of digital certificate and OCSP service is realized.With VC as a development tool, a small CAA can be extended for a variety of purposes.After revamping OpenSSL, build CAA and test function.Encryption and decryption algorithm, SM2 and SM3 algorithm testing.Certificate, double certificate, including encryption certificate and signature certificate interface test, certificate revocation query and so on.The CA system has complete function.Can be used for extension of other systems.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TN918.4

【相似文献】