A lattice-based signcryption method with a delegation test function

Abstract

The application provides a lattice-based signcryption method with a commission test function, which comprises the following steps: a commission server receives a first signcryption text and a first authorization trapdoor sent by a first receiving user, and receives a second signcryption text and a second authorization trapdoor sent by a second receiving user; the commission server judges whether the plaintext corresponding to the first signcryption text and the plaintext corresponding to the second signcryption text are consistent, and sends the judgment result to the first receiving user and the second receiving user. The application can construct an equivalent test framework capable of resisting quantum computer attacks under a standard model, and can be applied to signcryption technology, so that the integrity and traceability of the ciphertext information are ensured, and the security level is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network information security, and in particular to a signature encryption method based on a lattice and having a commissioned testing function. BACKGROUND

[0002] With the rapid development of the Internet in recent years, mobile terminals, smart home appliances and smart cities have gradually entered people's lives, generating a large amount of life and production data, which brings great challenges to local storage devices. Cloud databases have the advantages of charging by quantity, simple operation, convenient data backup and sharing, and effective avoidance of data loss, so more and more individuals and enterprises choose to store data in cloud databases to relieve local storage pressure. However, storing data in the form of plaintext in a cloud database poses a risk of privacy leakage and destruction, for example, the cloud database service provider may illegally sell the data to a third party, or tamper with, delete or damage the data, and the cloud database may be hacked, etc. Once data leakage occurs, data stored in plaintext form will be completely exposed, and the privacy of users will be infringed. An effective way to protect user data security is to encrypt the data before uploading. However, after the data is encrypted, the original characteristics and structure of the data are lost, making the original retrieval and testing algorithms invalid, thereby preventing the cloud server from effectively managing the data and providing data retrieval and sharing services for users.

[0003] To prevent the above-mentioned data security incidents, ciphertext equivalence testing technology has emerged. This technology supports comparing whether two pieces of ciphertext correspond to the same plaintext without decryption, thereby solving the problem of retrieving multi-public key encrypted data to some extent. Currently, this technology field can implement seven kinds of authorization models, including commissioned tester authorization, user level authorization, ciphertext level authorization, ciphertext-user level authorization, ciphertext specified level authorization, ciphertext-user specified level authorization, and can be instantiated in signature encryption technology. However, the difficulty of most implementation frameworks is based on traditional number theory assumptions, such as large prime factorization problem and discrete logarithm problem, which cannot resist attacks from quantum computers. In order to meet the post-quantum security requirements, resist internal attacks, resist offline message recovery attacks, and support equivalence testing, the signature encryption technology should implement the function of commissioned tester testing based on the framework of lattice difficulty problem. SUMMARY

[0004] The purpose of the present application is to provide a signature encryption method based on a lattice and having a commissioned testing function, which can construct an equivalence testing framework that can resist attacks from quantum computers under the standard model, and be applied to signature encryption technology to ensure the integrity and traceability of ciphertext information while improving the security level.

[0005] A signature encryption method based on a lattice and having a commissioned testing function, comprising:

[0006] The commission server receives the first signcrypted text and the first authorization trapdoor sent by the first receiving user, and the second signcrypted text and the second authorization trapdoor sent by the second receiving user;

[0007] The commission server judges whether the plaintext corresponding to the first signcrypted text and the plaintext corresponding to the second signcrypted text are consistent, and sends the judgment result to the first receiving user and the second receiving user.

[0008] Preferably, the commission server judges whether the plaintext corresponding to the first signcrypted text and the plaintext corresponding to the second signcrypted text are consistent, and sends the judgment result to the first receiving user and the second receiving user, comprising:

[0009] The commission server receives the first signcrypted text information ct i , the first authorization trapdoor td i , the second signcrypted text information ct j , and the second authorization trapdoor td j .

[0010] Calculate the intermediate parameter set 1:

[0011] C i，1 = H1(A′ i | A′ is | A′ dt ), C i，2 = H1(A i | A is | A′ dt )

[0012]

[0013]

[0014]

[0015] The second signcrypted text performs the same calculation operation to obtain C j，1 , C j，2 , w j，1 , w j，2 ,

[0016] Calculate the hash value of the plaintext information corresponding to the signcrypted text from the first signcrypted text and the second signcrypted text, and judge whether the plaintext information is consistent:

[0017]

[0018]

[0019]

[0020]

[0021]

[0022]

[0023]

[0024]

[0025]

[0026] Second ciphertext to the same calculation operation H (μ j );

[0027] If H (μ i ) = H (μ j ), the plaintext information in the first receiving user and the second receiving user's sign ciphertext is consistent, otherwise inconsistent;

[0028] Where subscript i represents the first receiving user, subscript j represents the second receiving user, H1, H2 is the anti-collision hash function, H3 is the full rank difference encoding, the output matrix satisfies the full rank and the reversible property, f.(·) represents the lattice anti-collision hash function, Invert(·) is an inverse algorithm, the input public and private key pairs, full rank difference encoding and the corresponding ciphertext, the output is the random vector hidden in the ciphertext and the noise vector, SampleD(·) is a Gaussian sampling algorithm, the second norm of the extracted vector satisfies a certain range, C i，1 , C i，2 represent the relationship between the first receiving user's ciphertext and the sending user's organization, the receiving user's organization, and the designated test user's organization, r i，1 , r i，2 is part of the first receiving user's ciphertext, w i，1 , w i，2 is the sequence number of the first receiving user's ciphertext and the binding relationship of the three parties in the ciphertext, is the public key matrix with a specific trapdoor matrix generated according to the specific ciphertext parameters r i，1 , r i，2 and C i，1 , C i，2 , which ensures that Invert(·) and SampleD(·) algorithms can run in probabilistic polynomial time under the condition of knowing the private key, E i，1 , E i，2 is generated by running SampleD(·), φ i，1 , φ i，2 represents the plaintext information with noise sent to the first receiving user, e iThe first receiving user receives an effective signature of the ciphertext, part of the ciphertext, The first receiving user receives a signature matrix of the ciphertext, h i，1 , h i，2 The first receiving user receives an XOR vector of the plaintext information hash value in the ciphertext, k i is a random vector of the same length as the plaintext hash value, The first receiving user receives a semi-finished product of the ciphertext, H(μ i ), H(μ j ) are the hash values of the plaintext information hidden in the ciphertexts of the first receiving user and the second receiving user, respectively.

[0029] Preferably, before the commission server receives the first signed ciphertext and the first authorization trapdoor sent by the first receiving user, and the second signed ciphertext and the second authorization trapdoor sent by the second receiving user, the sending user also includes generating a signed ciphertext, specifically:

[0030] Obtain the plaintext information μ∈{0,1} l The public key pk dt of the commission server = (A dt , A' dt ), the public key pk r of the receiver = (A r , A' r ), and the public key pk s of the sender = (A s , A' s )

[0031] Select a random vector and a noise vector:

[0032] Equivalent to the serial number of the ciphertext, uniquely identify the ciphertext

[0033] Random integer vector, mapping to a lattice point on the dual lattice

[0034] Noise vector, used to construct the LWE problem in the lattice difficulty problem

[0035] Noise vector, used to construct the LWE problem in the lattice difficulty problem

[0036] Calculate the intermediate parameter set 2 in encryption:

[0037] Take the receiver public key, the commission server public key, and the receiver public key as input, and pass through the collision-resistant hash function

[0038] Generate three pseudo-random matrices C0, C1, C2 with dimensions n x m;

[0039] C0=H1(Ar |A s |A dt ), C1 = H1(A' r |A' s |A' dt ), C2 = H1(A r |A s |A' dt )

[0040] According to the obtained r0, r1, r2, C0, C1, C2, three vectors w0, w1, w2 unique to each ciphertext are obtained by calculation

[0041]

[0042]

[0043]

[0044]

[0045] Three pairs of vector groups are generated by calculation for encrypting plaintext information, for encrypting the hash value of plaintext information;

[0046]

[0047]

[0048]

[0049] A ciphertext semi-finished product is generated

[0050]

[0051] After signing the ciphertext semi-finished product with the sending user's private key, a signed ciphertext is obtained:

[0052]

[0053]

[0054]

[0055]

[0056] ct = (r0, r1, r2, r3, p0, p1, p2, c0, c1, c2, e)

[0057] Wherein, C0, C1, C2 represent the relationship of the sender institution, the receiver institution and the designated tester institution in the ciphertext, r0, r1, r2 represent the serial number of the ciphertext, each ciphertext has a specific serial number, w0, w1, w2 is f.(·) representing the output result of the lattice collision-resistant hash function, binding the serial number of the ciphertext and the relationship of the three institutions in the ciphertext, v0, v1, v2 is a random vector for constructing LWE difficulty problem, x0, x1, x2 and y0, y1, y2 are noise vectors, r3 represents the signature serial number based on the ciphertext, e is the valid signature of the ciphertext, A s，t The signature matrix of the ciphertext, h1, h2 represents the exclusive or vector of the plaintext information hash value in the ciphertext, k is a random vector with the same length as the plaintext hash value, p0, p1, p2 is an auxiliary decryption vector, c0, c1, c2 is a hidden plaintext information matrix, The ciphertext semi-finished product is represented by ct, and the signature ciphertext is represented by ct.

[0058] Preferably, before the first receiving user sends the first signature ciphertext and the first authorization trapdoor, and the second receiving user sends the second signature ciphertext and the second authorization trapdoor, the first receiving user further includes decrypting the signature ciphertext, specifically:

[0059] Obtain the ciphertext information from the proxy server: ct=(r0, r1, r2, r3, p0, p1, p2, c0, c1, c2, e)

[0060] Calculate the intermediate parameter set 3 according to part of the signature ciphertext information:

[0061]

[0062]

[0063]

[0064] According to the first receiver private key, encrypt the plaintext information with noise:

[0065]

[0066]

[0067]

[0068] Restore the plaintext information μ from the plaintext information with noise bit by bit.

[0069] Preferably, after the first receiving user decrypts the signature ciphertext, the first receiving user further includes verifying whether the signature ciphertext is decrypted successfully, specifically:

[0070] Calculate the intermediate parameter set 4 according to part of the signature ciphertext information:

[0071]

[0072]

[0073] Verify that the signature of the encrypted message belongs to the sending user and that the decryption is correct:

[0074]

[0075]

[0076]

[0077]

[0078]

[0079]

[0080] if If the plaintext is decrypted, output the decrypted information μ; otherwise, output invalid decrypted information.

[0081] C0 and C1 represent the relationship between the sender, receiver, and designated tester in the ciphertext; r0 and r1 represent a portion of the ciphertext; and w0 and w1 represent the sequence number of the ciphertext and the binding relationship between the three parties in the ciphertext. It is a public key matrix with a specific trapdoor matrix generated based on specific ciphertext parameters r0, r1 and C0, C1.

[0082] Preferably, before the delegation server receives the first signed ciphertext and the first authorization trapdoor sent by the first receiving user, and the second signed ciphertext and the second authorization trapdoor sent by the second receiving user, the process further includes the first receiving user generating the first authorization trapdoor, specifically as follows:

[0083] Enter the private key sk of the first receiving user. i =(T i , T′ i The first authorized trapdoor td is generated by the first receiving user's private key. i =T′ i , will td i Uploaded to the cloud server.

[0084] Before the delegated server receives the first signed ciphertext and the first authorization trapdoor sent by the first receiving user, and the second signed ciphertext and the second authorization trapdoor sent by the second receiving user, it also includes generating a public-private key pair for the sending user based on system global parameters, specifically:

[0085] Choose two dimensions of the Gaussian distribution as... integer matrix

[0086] Generate the private key sk of the sending user s = (T s , T' s ) ;

[0087] Randomly select are two matrices of dimension n x m, generate the public key of the sending user

[0088]

[0089] Generate the public and private key pair (pk s , sk s ) of the sending organization;

[0090] wherein, are two random matrices of dimension n x m, T s , T' s are two integer matrices of dimension n x m extracted from a Gaussian distribution with Gaussian parameter σ1, and are respectively the private keys of the two public key matrices A s , A' s , and G is a specific trapdoor matrix of dimension n x nk. Preferably, before receiving the first signcrypted text and the first authorization trapdoor sent by the first receiving user, and the second signcrypted text and the second authorization trapdoor sent by the second receiving user, the commission server further comprises generating the public and private key pair of the receiving user according to the system global parameter, specifically:

[0091] Select two integer matrices of dimension n x m on a Gaussian distribution

[0092] Generate the private key sk of the receiving user r = (T r , T' r ) ;

[0093] Randomly select are two matrices of dimension n x m, generate the public key of the receiving user

[0094]

[0095] Generate the public and private key pair (pk r , sk r ) of the receiving organization;

[0096] wherein, are two random matrices of dimension n x m, T r , T' r are two integer matrices of dimension n x m extracted from a Gaussian distribution with Gaussian parameter σ1, and are respectively the private keys of the two public key matrices A r , A' r , and G is a specific trapdoor matrix of dimension n x nk. Integer matrices, respectively serving as A r A′ r The private keys of these two public key matrices are G, which is a specific trapdoor matrix of dimension n×nk.

[0098] Preferably, before the delegation server receives the first signed ciphertext and the first authorization trapdoor sent by the first receiving user, and the second signed ciphertext and the second authorization trapdoor sent by the second receiving user, it further includes generating a public-private key pair for the delegation server based on system global parameters, specifically:

[0099] Choose two dimensions of the Gaussian distribution as... integer matrix

[0100] Generate the private key sk of the proxy server dt =(T dt , T′ dt );

[0101] Random selection Given two matrices of dimension n×m, generate the public key for the delegate server:

[0102]

[0103] Generate public and private key pairs (pk) for the delegated server organization. dt ,sk dt );

[0104] in, T are two random matrices of dimension n×m. dt , T′ dt Two dimensions are extracted from a Gaussian distribution with Gaussian parameter σ1. Integer matrices, respectively serving as A dt A′ dt The private keys of these two public key matrices are G, which is a specific trapdoor matrix of dimension n×nk.

[0105] A lattice-based signature system with delegated testing functionality includes:

[0106] The data receiving module is used to entrust the server to receive the first signed ciphertext and the first authorization trap sent by the first receiving user, and the second signed ciphertext and the second authorization trap sent by the second receiving user;

[0107] The data processing module is used to delegate the server to determine whether the plaintext corresponding to the first ciphertext and the plaintext corresponding to the second ciphertext are consistent, and to send the determination result to the first receiving user and the second receiving user.

[0108] The hash function of the application does not embed a difficult problem, and meets the standard model requirements. Through the security specification, the scheme can be reduced to the shortest vector problem (SIS) and the error learning judgment problem (LWE), so it can resist attacks by quantum computers and meet the post-quantum security. The public key information of the commissioned tester is also embedded in the ciphertext generation stage, so the enemy cannot perform equivalent testing on the ciphertext only by knowing the authorized trapdoor, thereby avoiding the potential security threat of trapdoor abuse caused by the trapdoor leakage of the receiver, and resisting offline message recovery attacks on the ciphertext by the enemy. Therefore, the application can improve the security level of the scheme while enriching the authorized choices of users. The application ensures the integrity of the ciphertext information, and the non-falsifiability and authenticity of the ciphertext, thereby resisting internal attacks. BRIEF DESCRIPTION OF DRAWINGS

[0109] The drawings incorporated into the specification and forming a part of the specification, indicate embodiments consistent with the application, and together with the specification, serve to explain the principles of the application.

[0110] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced as follows. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0111] Figure 1 Flowchart of the application;

[0112] Figure 2 Signing and encrypting system schematic diagram of the application. DETAILED DESCRIPTION

[0113] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only a part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the application.

[0114] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the application are only used to explain the relative positional relationship, movement condition, etc. between components in a certain posture (as shown in the drawings), and if the certain posture changes, the directional indications will also change accordingly.

[0115] In addition, the description related to "first", "second" and the like in the present application is only for the purpose of description, and cannot be understood as indicating or implying the relative importance or user implicitly indicating the number of indicated technical features. Therefore, the features defined as "first", "second" can be explicitly or implicitly included at least one of the features. In addition, the technical solutions between various embodiments can be combined with each other, but it must be based on the realization of ordinary skilled in the art, when the combination of technical solutions appears contradictory or unachievable, it should be considered that the combination of such technical solutions does not exist, also not within the protection scope required by the present application.

[0116] An effective way to protect user data security is to encrypt the data before uploading. However, after the data is encrypted, the original characteristics and structure of the data are lost, and the original retrieval and test algorithm is invalid, so that the cloud server cannot effectively manage the data and provide data retrieval and sharing services for users. The ciphertext equivalence test technology emerges as the times require. This technology supports comparing whether the plaintext corresponding to two pieces of ciphertext is the same without decryption, thereby solving the problem of retrieving multi-public key encrypted data to a certain extent. However, the difficulty of most implementation frameworks is based on traditional number theory assumptions, such as large prime factorization problem and discrete logarithm problem, which cannot resist attacks from quantum computers. In order to meet the post-quantum security requirements, resist internal attacks, resist offline message recovery attacks, and support the test function of the delegated tester based on the framework of the lattice difficulty problem.

[0117] Embodiment 1

[0118] A lattice-based signature encryption method with a delegated testing function, referring to Figure 1 , comprising:

[0119] S100 The delegated server receives the first signature ciphertext sent by the first receiving user and the first authorization trapdoor, and the second signature ciphertext sent by the second receiving user and the second authorization trapdoor;

[0120] S200 The delegated server judges whether the plaintext corresponding to the first signature ciphertext and the plaintext corresponding to the second signature ciphertext are consistent, and sends the judgment result to the first receiving user and the second receiving user.

[0121] Preferably, S200 The delegated server judges whether the plaintext corresponding to the first signature ciphertext and the plaintext corresponding to the second signature ciphertext are consistent, and sends the judgment result to the first receiving user and the second receiving user, comprising:

[0122] The delegated server receives the first signature ciphertext information ct i , the first authorization trapdoor td i , and the second signature ciphertext information ct j , the second authorization trapdoor td j ;

[0123] Compute the intermediate parameter set 1:

[0124] C i，1 = H1(A i | A is | A dt ), C i，2 = H1(A i | A is | A dt )

[0125]

[0126]

[0127]

[0128] Second ciphertext performs the same calculation operation to obtain C j，1 , C j，2 , w j，1 , w j，2 ,

[0129] Compute the hash value of the plaintext information corresponding to the ciphertext from the first ciphertext and the second ciphertext, and determine whether the plaintext information is consistent:

[0130]

[0131]

[0132]

[0133]

[0134]

[0135]

[0136]

[0137]

[0138]

[0139] Second ciphertext performs the same calculation operation to obtain H(μ j );

[0140] If H(μ i ) = H(μ j ), then the plaintext information in the ciphertext of the first receiving user and the second receiving user is consistent, otherwise it is inconsistent;

[0141] where subscript i represents the first receiving user, subscript j represents the second receiving user, H1, H2 are anti-collision hash functions, H3 is full rank difference encoding, the output matrix satisfies the full rank and the reversible property, f.(·) represents the lattice anti-collision hash function, Invert(·) is an inverse algorithm, the input is a public-private key pair, full rank difference encoding and the corresponding ciphertext, the output is a random vector hidden in the ciphertext and a noise vector, SampleD(·) is a Gaussian sampling algorithm, the second norm of the extracted vector satisfies a certain range, C i，1 i，2 represents the relationship among the first receiving user's ciphertext, the sending user's organization, the receiving user's organization and the designated test user's organization, r i，1 i，2 is a part of the first receiving user's ciphertext, w i，1 i，2 is the sequence number of the first receiving user's ciphertext and the binding relationship of the three organizations in the ciphertext, is the public key matrix with a specific trapdoor matrix generated according to the specific ciphertext parameters r i，1 i，2 and C i，1 i，2 ensures that the Invert(·) and SampleD(·) algorithms can be run in probabilistic polynomial time under the knowledge of the private key, E i，1 i，2 is generated by running SampleD(·), φ i，1 i，2 represents the plaintext information with noise sent to the first receiving user, e i is the valid signature of the first receiving user's ciphertext, a part of the ciphertext, is the signature matrix of the first receiving user's ciphertext, h i，1 i，2 represents the XOR vector of the plaintext information hash value in the first receiving user's ciphertext, k i is a random vector with the same length as the plaintext hash value, represents the first receiving user's ciphertext semi-finished product, H(μ i ), H(μ j ) are the plaintext information hash values hidden in the first receiving user's and the second receiving user's ciphertexts, respectively.

[0142] Preferably, before the commissioning server receives the first signing ciphertext and the first authorization trapdoor sent by the first receiving user and the second signing ciphertext and the second authorization trapdoor sent by the second receiving user, the sending user generates the signing ciphertext, specifically:

[0143] obtain plaintext information μ∈{0,1}​​​​​​​​l , the server, the public key pk dt = (A dt , A' dt ), the receiver public key pk r = (A r , A' r ), the sender public key pk s = (A s , A' s )

[0144] Select a random vector and a noise vector:

[0145] Equivalent to the ciphertext sequence number, the ciphertext is uniquely identified

[0146] Random integer vector, mapping to a certain lattice point on the dual lattice

[0147] Noise vector, used to construct LWE problem in lattice difficulty problem

[0148] Noise vector, used to construct LWE problem in lattice difficulty problem

[0149] Calculate the intermediate parameter set 2 in encryption:

[0150] With the receiver public key, the public key of the server, the receiver public key as input, through the anti-collision hash function

[0151] Generate three pseudo-random matrices C0, C1, C2 with dimension n x m;

[0152] C0 = H1(A r |A s |A dt ), C1 = H1(A' r |A' s |A' dt ), C2 = H1(A r |A s |A' dt )

[0153] According to the obtained r0, r1, r2, C0, C1, C2, three vectors w0, w1, w2 unique to each ciphertext, three matrices are obtained by calculation

[0154]

[0155]

[0156]

[0157]

[0158] Generating three pairs of vector groups by calculation For encrypting plaintext information, Hash value for encrypting plaintext information;

[0159]

[0160]

[0161]

[0162] Generating ciphertext semi-finished product

[0163]

[0164] After signing the ciphertext semi-finished product with the sending user private key, the signed ciphertext is obtained:

[0165]

[0166]

[0167]

[0168]

[0169] ct = (r0, r1, r2, r3, p0, p1, p2, c0, c1, c2, e)

[0170] Wherein, C0, C1, C2 represent the relationship between the sender institution, the receiver institution and the designated tester institution in the ciphertext, r0, r1, r2 represent the serial number of the ciphertext, each ciphertext has a specific serial number, w0, w1, w2 is f.(·) representing the output result of the lattice collision-resistant hash function, which binds the serial number of the ciphertext and the relationship between the three institutions in the ciphertext, v0, v1, v2 are random vectors used to construct LWE difficulty problem, x0, x1, x2 and y0, y1, y2 are noise vectors, r3 represents the signature serial number based on the ciphertext, e is the valid signature of the ciphertext, A s，t represent the signature matrix of the ciphertext, h1, h2 represent the exclusive or vector of the plaintext information hash value in the ciphertext, k is a random vector with the same length as the plaintext hash value, p0, p1, p2 are auxiliary decryption vectors, c0, c1, c2 are hidden plaintext information matrices, represent the ciphertext semi-finished product, and ct is the signed ciphertext.

[0171] The sender calculates the first ciphertext information according to the public key and the private key of the sender, the public key of the first receiver, the public key of the commissioned server, the system global parameter and the corresponding plaintext information. Similarly, the sender calculates the second ciphertext information according to the public key and the private key of the sender, the public key of the second receiver, the public key of the commissioned server, the system global parameter and the corresponding plaintext information.

[0172] Preferably, before the commissioned server receives the first signed ciphertext and the first authorization trapdoor sent by the first receiving user and the second signed ciphertext and the second authorization trapdoor sent by the second receiving user, the method further comprises decrypting the signed ciphertext by the first receiving user, specifically:

[0173] Obtaining the ciphertext information from the commissioned server: ct=(r0, r1, r2, r3, p0, p1, p2, c0, c1, c2, e)

[0174] Calculating the intermediate parameter set 3 according to part of the signed ciphertext information:

[0175]

[0176]

[0177]

[0178] Encrypting the plaintext information with noise according to the private key of the first receiver:

[0179]

[0180]

[0181]

[0182] Restoring the plaintext information μ from the plaintext information with noise bit by bit.

[0183] Sending the first ciphertext information to the first receiver and the second ciphertext information to the second receiver. The receiver can use the private key to decrypt the plaintext information from the ciphertext information, and verify whether the plaintext information is decrypted successfully according to the public key of the sender, the public key of the commissioned server and part of the ciphertext information, whether the integrity and the authenticity of the information are maintained.

[0184] Preferably, after the first receiving user decrypts the signed ciphertext, the method further comprises verifying whether the signed ciphertext is decrypted successfully by the first receiving user, specifically:

[0185] Calculating the intermediate parameter set 4 according to part of the signed ciphertext information:

[0186]

[0187]

[0188] Verify that the signature of the encrypted message belongs to the sending user and that the decryption is correct:

[0189]

[0190]

[0191]

[0192]

[0193]

[0194]

[0195] if If the plaintext is decrypted, output the decrypted information μ; otherwise, output invalid decrypted information.

[0196] C0 and C1 represent the relationship between the sender, receiver, and designated tester in the ciphertext; r0 and r1 represent a portion of the ciphertext; and w0 and w1 represent the sequence number of the ciphertext and the binding relationship between the three parties in the ciphertext. It is a public key matrix with a specific trapdoor matrix generated based on specific ciphertext parameters r0, r1 and C0, C1.

[0197] Preferably, before the delegation server receives the first signed ciphertext and the first authorization trapdoor sent by the first receiving user, and the second signed ciphertext and the second authorization trapdoor sent by the second receiving user, the process further includes the first receiving user generating the first authorization trapdoor, specifically as follows:

[0198] Enter the private key sk of the first receiving user. i =(T i , T′ i The first authorized trapdoor td is generated by the first receiving user's private key. i =T′ i , will td i Uploaded to the cloud server.

[0199] Before the delegated server receives the first signed ciphertext and the first authorization trapdoor sent by the first receiving user, and the second signed ciphertext and the second authorization trapdoor sent by the second receiving user, it also includes generating a public-private key pair for the sending user based on system global parameters, specifically:

[0200] Choose two dimensions of the Gaussian distribution as... integer matrix

[0201] Generate the private key sk for the sending user. s =(T s, T′ s );

[0202] Random selection It consists of two n×m matrices, used to generate the public key for the sending user.

[0203] pk s =(A s A′ s );

[0204] Generate the public-private key pair (pk) of the sender's organization. s ,sk s );

[0205] in, T are two random matrices of dimension n×m. s , T′ s Two dimensions are extracted from a Gaussian distribution with Gaussian parameter σ1. Integer matrices, respectively serving as A s A′ s The private keys of these two public key matrices are G, which is a specific trapdoor matrix of dimension n×nk.

[0206] Preferably, before the delegation server receives the first signed ciphertext and the first authorization trapdoor sent by the first receiving user, and the second signed ciphertext and the second authorization trapdoor sent by the second receiving user, it further includes generating a public-private key pair for the receiving user based on system global parameters, specifically:

[0207] Choose two dimensions of the Gaussian distribution as... integer matrix

[0208] Generate the private key sk of the receiving user. r =(T r , T′ r );

[0209] Random selection It consists of two n×m matrices, used to generate the public key for receiving users.

[0210] pk r =(A r A′ r );

[0211] Generate public-private key pairs (pk) for the recipient organization. r ,sk r );

[0212] in, T are two random matrices of dimension n×m. r , T′r Two dimensions are extracted from a Gaussian distribution with Gaussian parameter σ1. Integer matrices, respectively serving as A r A′ r The private keys of these two public key matrices are G, which is a specific trapdoor matrix of dimension n×nk.

[0213] Preferably, before the delegation server receives the first signed ciphertext and the first authorization trapdoor sent by the first receiving user, and the second signed ciphertext and the second authorization trapdoor sent by the second receiving user, it further includes generating a public-private key pair for the delegation server based on system global parameters, specifically:

[0214] Choose two dimensions of the Gaussian distribution as... integer matrix

[0215] Generate the private key sk of the proxy server dt =(T dt , T′ dt );

[0216] Random selection Given two matrices of dimension n×m, generate the public key for the delegate server:

[0217] pk dt =(A dt A′ dt );

[0218] Generate public and private key pairs (pk) for the delegated server organization. dt ,sk dt );

[0219] in, T are two random matrices of dimension n×m. dt , T′ dt Two dimensions are extracted from a Gaussian distribution with Gaussian parameter σ1. Integer matrices, respectively serving as A dt A′ dt The private keys of these two public key matrices are G, which is a specific trapdoor matrix of dimension n×nk.

[0220] Example 2

[0221] A lattice-based signature system with delegated testing functionality includes:

[0222] The data receiving module is used to entrust the server to receive the first signed ciphertext and the first authorization trap sent by the first receiving user, and the second signed ciphertext and the second authorization trap sent by the second receiving user;

[0223] The data processing module is used for judging, by the server, whether the plaintext corresponding to the first signcrypted text and the plaintext corresponding to the second signcrypted text are consistent, and sending the judging result to the first receiving user and the second receiving user.

[0224] The hash function of the application does not embed a difficult problem, and meets the standard model requirement. Through the security specification, the scheme can be reduced to the shortest vector problem (SIS) and the error learning judgment problem (LWE), so that it can resist the attack of a quantum computer and meet the post-quantum security. The public key information of the entrusting tester is embedded in the ciphertext generation stage, so that the enemy cannot perform equivalent testing on the ciphertext only by knowing the authorized trapdoor, thereby avoiding the potential security threat of trapdoor abuse caused by the trapdoor leakage of the receiver, and resisting the offline message recovery attack of the enemy on the ciphertext. Therefore, the application can improve the security level of the scheme while enriching the authorized selection of users. The application ensures the integrity of the ciphertext information, and the non-forgery and authentication of the ciphertext, thereby resisting internal attacks, while ensuring the one-wayness and the non-distinguishability of the selected ciphertext.

[0225] The application uses the sender, the receiver and the server to independently perform mutually disjoint communication, and avoids the trapdoor abuse problem caused by the eavesdropping of the dishonest server or external enemy on the trapdoor through the entrusting test authorization mechanism, and the signcryption technology ensures the integrity and authentication of the ciphertext data. The design method without any interaction between the receiver and the server also avoids the problem of collusion between the two parties. The security is improved, and the flexibility is also improved.

[0226] The above is only a specific embodiment of the application, so that those skilled in the art can understand or implement the application. Various modifications of these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the application. Therefore, the application will not be limited to these embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features applied herein.

Claims

1. A lattice-based signcryption method with a delegation testing function, characterized in that, The method comprises the following steps: The server receives the first signcrypted text and the first authorization trapdoor sent by the first receiving user, and receives the second signcrypted text and the second authorization trapdoor sent by the second receiving user; The server judges whether the plaintext corresponding to the first signcrypted text and the plaintext corresponding to the second signcrypted text are consistent, and sends the judgment result to the first receiving user and the second receiving user; The server judges whether the plaintext corresponding to the first signcrypted text and the plaintext corresponding to the second signcrypted text are consistent, and sends the judgment result to the first receiving user and the second receiving user, which comprises the following steps: The server receives the first signcrypted information , the first authorization trapdoor , and the second signcrypted information , the second authorization trapdoor ; Calculate the intermediate parameter set 1: ； ； ； ； The second signcryption text performs the same calculation operation to obtain , , , , ; Calculate the hash value of the plaintext information corresponding to the signcrypted text from the first signcrypted text and the second signcrypted text, and judge whether the plaintext information is consistent: ； ； ； ； ； ； ； ； ； The second ciphertext is subjected to the same calculation operation to obtain ; If then the plaintext information in the signcrypted text of the first receiving user and the second receiving user is consistent, otherwise inconsistent; where subscript represents the first receiving user, subscript represents the second receiving user, is an anti-collision hash function, is a full-rank difference encoding, the output matrix satisfies the full-rank and the reversible properties, represents the lattice-based anti-collision hash function, is an inverse algorithm, the input is a public-private key pair, a full-rank difference encoding and a corresponding ciphertext, the output is a random vector hidden in the ciphertext and a noise vector, is a Gaussian sampling algorithm, the second norm of the extracted vector satisfies a certain range, represents the relationship between the sending user mechanism, the receiving user mechanism and the designated test user mechanism in the first receiving user ciphertext, is a part of the first receiving user ciphertext, is the sequence number of the first receiving user ciphertext and the binding relationship of the three parties in the ciphertext, is the public key matrix with the corresponding trapdoor matrix generated according to the corresponding ciphertext parameters and ensure that the algorithm can run in probabilistic polynomial time under the condition of knowing the private key and , is generated by running , represents the plaintext information with noise sent to the first receiving user, is the valid signature of the first receiving user ciphertext, a part of the ciphertext, is the signature matrix of the first receiving user ciphertext, represents the XOR vector of the plaintext information hash value in the first receiving user ciphertext, is a random vector with the same length as the plaintext hash value, represents the first receiving user ciphertext semi-finished product, respectively, the plaintext information hash value hidden in the first receiving user and the second receiving user ciphertext.

2. The lattice-based signcryption method with delegation testing function according to claim 1, characterized in that, Before the server receives the first signcrypted text and the first authorization trapdoor sent by the first receiving user, and receives the second signcrypted text and the second authorization trapdoor sent by the second receiving user, the sending user generates the signcrypted text, specifically comprising the following steps: Obtaining plaintext information , a server public key , a receiver public key , a sender public key ; Select a random vector and a noise vector: : corresponds to the ciphertext serial number, uniquely identifies the ciphertext : random integer vector, mapping a certain lattice point on the dual lattice : Noise vector, used to construct LWE problem in lattice difficulty problem : Noise vector, used to construct LWE problem in lattice difficulty problem Calculate the intermediate parameter set 2 for encryption: With the receiver public key, the delegate server public key, the receiver public key as input, three pseudo-random matrices of dimension are generated by an anti-collision hash function ; ； According to the acquired three vectors unique to each ciphertext , , three matrices are calculated , , : ； ； ； ； By calculating three pairs of vector groups , , , for encrypting the plaintext information, , a hash value for encrypting the plaintext information; ； ； ； Generating a ciphertext half-product : ； After signing the ciphertext semi-product with the private key of the sending user, the signcrypted text is obtained: ； ； ； ； ； wherein, represents the relationship among the sender agency, the receiver agency and the designated tester agency in the ciphertext, represents the serial number of the ciphertext, each ciphertext has a corresponding serial number, is represents the output result of the lattice anti-collision hash function, which binds the serial number of the ciphertext and the relationship among the three agencies in the ciphertext, is a random vector for constructing the LWE difficulty problem, and is a noise vector ， represents the signature serial number based on the ciphertext, is the valid signature of the ciphertext, represents the signature matrix of the ciphertext, represents the XOR vector of the plaintext information hash value in the ciphertext, is a random vector with the same length as the plaintext hash value, is an auxiliary decryption vector, is a hidden plaintext information matrix, represents the semi-finished product of the ciphertext, is the signature ciphertext.

3. The signcryption method with delegation testing function based on lattice according to claim 1, characterized in that, Before the server receives the first signcrypted text and the first authorization trapdoor sent by the first receiving user, and receives the second signcrypted text and the second authorization trapdoor sent by the second receiving user, the first receiving user decrypts the signcrypted text, specifically comprising the following steps: Obtaining the cipher information from the server: ; Calculate the intermediate parameter set 3 according to part of the signcrypted text information: ； ； ； Encrypt the plaintext information with noise according to the private key of the first receiver: ； ； ； Bitwise restoration of plaintext information from noisy plaintext information .

4. The signcryption method with delegation testing function based on lattice according to claim 3, characterized in that, After the first receiving user decrypts the signcrypted text, the first receiving user verifies whether the signcrypted text is decrypted successfully, specifically comprising the following steps: Calculate the intermediate parameter set 4 according to part of the signcrypted text information: ； ； Verify whether the signature of the signcrypted text belongs to the sending user and the correctness of the decryption: . ； ； ； ； ； ； If then output decrypted plaintext information else output invalid decrypted information; representing the relationship among the sender agency, the receiver agency and the designated tester agency in the ciphertext, is a part of the ciphertext, is the serial number of the ciphertext and the binding relationship among the three agencies in the ciphertext, is generated according to the corresponding ciphertext parameters and the public key matrix with the corresponding trapdoor matrix generated.

5. The signcryption method with delegation testing function based on lattice according to claim 3, characterized in that, Before the server receives the first signcrypted text and the first authorization trapdoor sent by the first receiving user, and receives the second signcrypted text and the second authorization trapdoor sent by the second receiving user, the first receiving user generates the first authorization trapdoor, specifically comprising the following steps: Enter the private key of the first receiving user The first authorization trapdoor is generated by the first receiving user's private key. ,Will Uploaded to the cloud server.

6. The lattice-based signcryption method with delegation testing function according to claim 1, wherein, Before the server receives the first signcrypted text and the first authorization trapdoor sent by the first receiving user, and receives the second signcrypted text and the second authorization trapdoor sent by the second receiving user, the sending user public and private key pair is generated according to the system global parameter, specifically comprising the following steps: The two dimensions on the Gaussian distribution are chosen to be an integer matrix , Generating a private key of a sending user ​ Randomly selected are two matrices of dimensions , generating a sending user public key ， ； Generating a public-private key pair for a sender institution ; wherein, is a random matrix of two dimensions , is an integer matrix of two dimensions drawn from a Gaussian distribution with Gaussian parameters , respectively as the private keys of the two public key matrices , are the corresponding trapdoor matrices of dimensions .

7. The signcryption method with delegation testing function based on lattice according to claim 1, characterized in that, Before the server receives the first signcrypted text and the first authorization trapdoor sent by the first receiving user, and receives the second signcrypted text and the second authorization trapdoor sent by the second receiving user, the receiving user public and private key pair is generated according to the system global parameter, specifically comprising the following steps: Two dimensions on the Gaussian distribution are chosen as an integer matrix of the form Generating a private key of a receiving user ​ Randomly selected are two matrices of dimensions , generating a receiving user public key ， ； Generating a public-private key pair for a recipient organization ; in, It has two dimensions. random matrix, From Gaussian parameters The two dimensions extracted from the Gaussian distribution are Integer matrices, respectively used as The private keys of these two public key matrices, For dimension The corresponding trapdoor matrix.

8. The signcryption method with delegation testing function based on lattice according to claim 1, characterized in that, Before the server receives the first signcrypted text and the first authorization trapdoor sent by the first receiving user, and receives the second signcrypted text and the second authorization trapdoor sent by the second receiving user, the server public and private key pair is generated according to the system global parameter, specifically comprising the following steps: The two dimensions on the Gaussian distribution are chosen to be an integer matrix of the form Generating a private key for a server ​ Randomly selected are two matrices of dimensions , generate a server public key: ， ； Generating a public-private key pair for a server authority ; wherein, is a random matrix of two dimensions , is an integer matrix of two dimensions drawn from a Gaussian distribution with Gaussian parameters , these two public key matrices, are the corresponding trapdoor matrices of dimension .

9. A lattice-based signcryption system with a delegation testing function, characterized in that, The method comprises the following steps: The data receiving module is used for the server to receive the first signcrypted text and the first authorization trapdoor sent by the first receiving user, and to receive the second signcrypted text and the second authorization trapdoor sent by the second receiving user; The data processing module is used for the server to judge whether the plaintext corresponding to the first signcrypted text and the plaintext corresponding to the second signcrypted text are consistent, and to send the judgment result to the first receiving user and the second receiving user; The commission server judges whether the plaintext corresponding to the first signcrypted text and the plaintext corresponding to the second signcrypted text are consistent, and sends the judgment result to the first receiving user and the second receiving user, comprising: The server receives the first signcrypted message information , the first authorization trapdoor , and the second signcrypted message information , the second authorization trapdoor ; Calculating an intermediate parameter set 1: ； ； ； ； The second signcryption text performs the same calculation operation to obtain , , , , ; Calculating the hash value of the plaintext information corresponding to the signcrypted text from the first signcrypted text and the second signcrypted text, and judging whether the plaintext information is consistent: ； ； ； ； ； ； ； ； ； The second ciphertext is subjected to the same calculation operation to obtain ; If then the plaintext information in the signcrypted text of the first receiving user and the second receiving user is consistent, otherwise inconsistent; where subscript represents the first receiving user, subscript represents the second receiving user, is an anti-collision hash function, is a full-rank difference encoding, the output matrix satisfies the full-rank and the reversible properties, represents a lattice anti-collision hash function, is an inversion algorithm, the input is a public-private key pair, a full-rank difference encoding and a corresponding ciphertext, the output is a random vector hidden in the ciphertext and a noise vector, is a Gaussian sampling algorithm, the second norm of the extracted vector satisfies a certain range, represents the relationship between the first receiving user's ciphertext, the sending user's organization, the receiving user's organization and the designated test user's organization, is a part of the first receiving user's ciphertext, is the sequence number of the first receiving user's ciphertext and the binding relationship of the three organizations in the ciphertext, is a public key matrix with a corresponding trapdoor matrix generated according to the corresponding ciphertext parameters and ensure that the algorithm can run in probabilistic polynomial time under the condition of knowing the private key and , is generated by running , represents the plaintext information with noise sent to the first receiving user, is a valid signature of the first receiving user's ciphertext, a part of the ciphertext, is the signature matrix of the first receiving user's ciphertext, represents the XOR vector of the plaintext information hash value in the first receiving user's ciphertext, is a random vector with the same length as the plaintext hash value, represents the first receiving user's ciphertext semi-finished product, respectively represent the plaintext information hash value hidden in the first receiving user's and the second receiving user's ciphertexts.

Images