Reasons for Chinese SM2 Digital Signature Algorithm

Question

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify what the advantages of this scheme are over ECDSA. It seems that SM2 is the preferred EC signature format in China.

So the two related questions are:

1. Why was SM2 defined?
2. What are the (operational) differences compared to ECDSA?

Note that there seems to be a set of SM2 Elliptic Curve domain parameters defined as well.

---

According to [SM2 Algorithms Parameters] linked in the draft (and found on Wayback machine), here are the domain parameters:

y^2 = x^3 + ax + b

p =FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 00000000 FFFFFFFF FFFFFFFF
a =FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 00000000 FFFFFFFF FFFFFFFC
b = 28E9FA9E 9D9F5E34 4D5A9E4B CF6509A7 F39789F5 15AB8F92 DDBCBD41 4D940E93
n = FFFFFFFE FFFFFFFF FFFFFFFF FFFFFFFF 7203DF6B 21C6052B 53BBF409 39D54123
Gx = 32C4AE2C 1F198119 5F990446 6A39C994 8FE30BBF F2660BE1 715A4589 334C74C7
Gy = BC3736A2 F4F6779C 59BDCEE3 6B692153 D0A9877C C62A4740 02DF32E5 2139F0A0

Answer 1

The SM2 digital signature algorithm. Fix a curve $E/k$ over a field $\mathbb F_p$. Fix a standard base point $G$ of prime order $n$ on $E/\mathbb F_p$. Fix a hash function $H\colon \{0,1\}^* \to \mathbb Z/n\mathbb Z$.

• A public key is the encoding of a point $P \in E/\mathbb F_p$ together with an string $Z$ identifying a principal.

• A signature on a message $m$ under the public key $P$ with identifier $Z$ is is a pair of integers $(r, s)$ in $[1, n - 1]$ such that $r + s \ne 0$ and $$r \equiv (H(Z \mathbin\| m) + x([s]G + [r + s]P)) \pmod n.$$

• The signer knows the secret scalar $d$, the private key, such that $P = [d]G$. To make a signature, the signer picks a scalar $k$ uniformly at random, and computes

  \begin{align} r &\equiv (H(Z \mathbin\| m) + x([k]G)) \pmod n, \\ s &\equiv (k - r d)/(1 + d) \pmod n, \end{align}

  rejecting and starting over if $r \equiv 0$, $r + k \equiv 0$, or $s \equiv 0 \pmod n$.

  This is a valid signature because

  \begin{align} [s]G + [r + s]P &= [s]G + [(r + s) d]G \\ &= [s + s d + r d] G \\ &= [(1 + d) s + r d] G \\ &= [(1 + d)(k - r d)/(1 + d) + r d]G \\ &= [k - r d + r d]G \\ &= [k]G. \end{align}

Why? There has been relatively little analysis of the SM2 signature scheme that I can find in the anglophone cryptography literature beyond some side channel attacks. The most salient aspect of it to my eyes is that it is just different from various other national pride digital signature schemes.

The SM2 signature scheme has a small advantage over ECDSA (US) and ECGDSA (Germany) for verifiers: the verifier need not compute any inverses modulo $n$. Otherwise the signer's costs are similar to the others. Security analysis of ECDSA is extraordinarily complicated and unsatisfying, in contrast to Schnorr; I expect the same is true of the others.

My guess about why SM2 was chosen is precisely to be different from all the others, for the sake of nationalism—they are all worse in performance and confidence than the much simpler inversion-free Schnorr-based EdDSA.