QianHeng乾珩 PQC Docs Hub量子文档 ✦ Ask AI✦ 问问文档 ⚐ Scan⚐ 扫一扫
/

SM9 · Identity-Based Crypto

SM9 is China's national identity-based cryptography (IBC) standard, GM/T 0044-2016. Built on bilinear pairings over elliptic curves, it lets a user's own identity — an email address or phone number — serve directly as the public key, with private keys derived by a trusted Key Generation Center (KGC). SM9 provides identity-based signature, encryption, and key exchange. Its pairing-based security is classical, so SM9 is broken by Shor's algorithm just like SM2.

What identity-based cryptography is

In conventional public-key infrastructure (PKI), a public key is a random-looking value that must be bound to its owner through a certificate, requiring certificate issuance, distribution, revocation, and validation. Identity-based cryptography removes that binding step: the public key is the identity string. To send an encrypted message to alice@example.com, the sender simply uses that address as the public key — no certificate lookup needed.

SM9 (GM/T 0044-2016) is China's standardized IBC scheme. It is the ShangMi (商密) member designed for environments where managing certificates is costly or impractical: large device fleets, IoT, email encryption, and internal enterprise messaging.

The Key Generation Center (KGC)

Because anyone can compute a user's public key from their identity, the matching private keys must be issued by a trusted authority called the Key Generation Center (KGC). The KGC holds a master secret, and for each identity it derives the corresponding private key and delivers it securely to the user. This is the defining architecture of IBC — and its central trade-off.

The three mechanisms

  • Identity-based signature — a signer signs under their identity; verifiers check the signature using only the signer's identity and the KGC's public parameters.
  • Identity-based encryption — a sender encrypts to a recipient's identity directly, and only the holder of the KGC-issued private key can decrypt.
  • Key exchange — an identity-based key-agreement protocol establishing a shared session key between two identities.

Pairing basis

SM9's mechanisms are built on bilinear pairings over elliptic curves — a mathematical map that makes identity-based key derivation and verification possible. Pairings give IBC its elegance, but they place SM9's hardness on elliptic-curve and pairing-related discrete-log problems. These are classical hard problems.

Key-escrow trade-off

Because the KGC derives every user's private key, it can in principle compute any user's key — this is inherent key escrow. For some deployments (regulated enterprises, lawful-access regimes) escrow is acceptable or even desired; for others it is a liability, since a compromised KGC exposes every identity at once. Choosing SM9 means choosing this trade-off: you save the cost of PKI certificate management in exchange for a centralized trust point. See signatures.html for how identity-based signatures compare with certificate-based ones.

International standardization

The SM9 identity-based signature is included in ISO/IEC 14888-3:2018 (digital signatures with appendix), placing it alongside SM2 in formal international standards. The SM9 identity-based encryption / key-encapsulation mechanism is included in ISO/IEC 18033-5:2015/Amd 1:2021 (the SM9 mechanism). SM9 key exchange has also been advanced as a related ISO/IEC international standard, but the specific version number should be listed in the references.

Quantum status — pairing means Shor-vulnerable

SM9's security rests on pairing and elliptic-curve hard problems, which reduce to the discrete-log family. A cryptographically relevant quantum computer (CRQC) running Shor's algorithm solves these efficiently, so SM9 is broken in the quantum era — exactly like SM2 and like international pairing-based and ECC schemes. Identity-based convenience does not confer any quantum resistance. For the post-quantum direction of the SM suite see sm-pqc.html.

Standards & references

Warning
SM9 is a classical pairing-based algorithm and is Shor-vulnerable. Beyond the quantum risk, weigh the inherent KGC key-escrow trust point before adopting it. It is not a post-quantum solution; long-lived confidential data protected only by SM9 is exposed to Harvest Now, Decrypt Later (HNDL).

SM9 标识密码

SM9 是中国的国产标识密码 IBC 标准，标准号 GM/T 0044-2016。它构建于椭圆曲线上的双线性对，使用户自身的标识——电子邮箱或手机号——可直接作为公钥，私钥由受信的密钥生成中心 KGC 派生。SM9 提供标识签名、标识加密与密钥交换。其基于双线性对的安全性属经典范畴，因此与 SM2 一样会被 Shor 算法攻破。

标识密码是什么

在传统公钥基础设施 PKI 中，公钥是一串看似随机的值，必须通过证书与其拥有者绑定，因而需要证书签发、分发、吊销与验证。标识密码 去除了这一绑定步骤：公钥本身就是标识串。要向 alice@example.com 发送加密消息，发方直接以该地址作为公钥即可——无需查询证书。

SM9（GM/T 0044-2016）是中国标准化的 IBC 方案，作为商密成员专为证书管理代价高昂或不切实际的场景设计：大规模设备群、物联网、邮件加密以及企业内部通信。

密钥生成中心 KGC

由于任何人都能从标识算出用户的公钥，相应的私钥必须由受信权威机构——密钥生成中心 KGC——签发。KGC 持有主密钥，针对每个标识派生对应私钥并安全交付给用户。这是 IBC 的标志性架构，也是其核心权衡所在。

三种机制

  • 标识签名——签名者以自身标识签名，验证方仅凭签名者标识与 KGC 公共参数即可验签。
  • 标识加密——发方直接面向收方标识加密，唯有持有 KGC 签发私钥者方能解密。
  • 密钥交换——标识化密钥协商协议，在两个标识之间建立共享会话密钥。

双线性对基础

SM9 的各项机制构建于椭圆曲线上的双线性对——一种使标识化密钥派生与验证成为可能的数学映射。双线性对赋予 IBC 优雅性，但也使 SM9 的困难性建立在椭圆曲线与配对相关的离散对数问题之上。这些都是经典困难问题。

密钥托管权衡

由于 KGC 派生每个用户的私钥，它原则上能算出任意用户的密钥——这就是固有的密钥托管。对某些部署（受监管企业、合法接入机制）托管可接受甚至是被需要的；对另一些则是负担，因为一旦 KGC 被攻破，所有标识将同时暴露。选择 SM9 即选择此权衡：以集中信任点为代价，省去 PKI 证书管理的成本。标识签名与基于证书签名的对比参见 signatures.html。

国际标准化

SM9 标识签名被纳入 ISO/IEC 14888-3:2018（带附录的数字签名），与 SM2 一同进入正式国际标准。SM9 标识加密/密钥封装机制被纳入 ISO/IEC 18033-5:2015/Amd 1:2021（SM9 机制）。SM9 密钥交换也已推进为 ISO/IEC 相关国际标准，但参考文献中应列出具体版本号。

量子态势 双线性对意味着易受 Shor 攻击

SM9 的安全性依赖配对与椭圆曲线困难问题，均归约到离散对数家族。具备密码学意义的量子计算机 CRQC 运行 Shor 算法 可高效求解这些问题，因此 SM9 在量子时代被攻破——与 SM2 以及国际上的配对类与 ECC 方案完全一致。标识密码的便利性并不带来任何量子抵抗力。商密套件的后量子方向参见 sm-pqc.html。

标准与参考

警告
SM9 是经典配对类算法，易受 Shor 攻击。除量子风险外，采用前还须权衡固有的 KGC 密钥托管信任点。它并非后量子方案；仅由 SM9 保护的长生命周期机密数据将面临先收集后解密风险。
⚑ Report an error⚑ 纠错与校正