Binary field lattice-based linear homomorphic signature method and system

Abstract

The invention discloses a binary field lattice-based linear homomorphic signature method and a binary field lattice-based linear homomorphic signature system. The method comprises the following steps: generating system parameters required by the signature method; generating a public key and a private key of a signer by using the generated system parameters, generating a signature by using the private key, and verifying the signature by using the public key; the message is signed by using system parameters, a public key and a private key, and the signature can ensure the integrity and authenticity of the message; verifying the generated signature; and combining a plurality of verified messages into one message, and combining a plurality of signatures corresponding to the messages into one signature. The system comprises a system parameter generation module, a key generation module, a signature module, a verification module and a signature combination module. Compared with an existing lattice-based linear homomorphic signature method, the lattice-based linear homomorphic signature method has the advantages in the aspects of efficiency and safety.

Description

Technical Field

[0001] The present invention belongs to the field of information security and data security, and specifically relates to a binary domain lattice baseline linear homomorphic signature method and system. Background Art

[0002] Linear homomorphic signature is a special digital signature technology, which is essentially a signature on a subspace. In this signature scheme, the signer only needs to sign a set of basis vectors of the subspace, which is equivalent to completing the signature of all vectors in the subspace. In addition to meeting the definition of the usual signature scheme, the linear homomorphic signature also has the homomorphism between the message and the signature, that is, the verification process of the signature is consistent with the linear combination of the message. By signing the basis vectors of the subspace, the linear homomorphic signature can achieve effective signatures for all vectors in the subspace, thereby improving the efficiency of the signature; at the same time, it satisfies the homomorphic property, that is, for any two vectors in the subspace and their corresponding signatures, their linear combination can still be verified, which ensures the flexibility and scalability of the signature.

[0003] Linear homomorphic signatures can solve the problem of contamination attacks in the network coding process [1]. In network coding, intermediate nodes can encode received data packets to generate new data packets. Through linear homomorphic signatures, the receiving node can verify whether the received data packet has been maliciously tampered with or injected with forged messages, thereby ensuring the authenticity of the data. It can also detect whether the data packet has been intentionally contaminated or damaged by malicious nodes during transmission, thereby ensuring the integrity of the data. In addition, due to the unforgeability of linear homomorphic signatures, the sending node cannot deny the data packet it sent, which helps prevent repudiation after the data is sent.

[0004] With the development of quantum computing, traditional digital signature schemes based on large integer factorization and discrete logarithm solution are facing security threats[2]. Lattice-based signature schemes are considered to be safe alternative signature schemes that can resist quantum attacks. In addition, lattice cryptography belongs to linear cryptography, and its special geometric structure has inherent advantages in the design of homomorphic cryptography. Therefore, it is of great significance to study linear homomorphic signature schemes on lattices.

[0005] In 2011, Boneh and Freeman[3] used GPV signature[4] to propose a lattice-based linear homomorphic signature scheme for binary domains based on the Chinese remainder theorem. The scheme uses the lattice delegation algorithm proposed by Cash et al.[5] to bind dataset labels, and the lattice matrix is ​​increased from m columns to 2m columns. In the same year, Boneh and Freeman[6] proposed a method of intersecting two integer lattices to implement lattice-based linear homomorphic signature. The scheme no longer needs to use the lattice delegation algorithm to bind dataset labels, avoiding the expansion of the lattice matrix size, and is more efficient than reference[3]. Wang et al.[7] constructed a lattice-based linear homomorphic signature scheme for binary domains based on the secure hash function of reference[8]. The scheme uses a homomorphic secure hash function to bind dataset labels. The signature length and public key length are the same as those of the GPV signature, so it has an advantage in efficiency compared to reference[3].

[0006] The standard model does not rely on any hypothetical random oracle. Its security is based on widely accepted assumptions, which is closer to practical application scenarios and more trustworthy. Chen et al. [9] proposed the first lattice-based linear homomorphic signature under the standard model. The scheme used the two-integer lattice intersection method in reference [6] to achieve secure signature. In order to achieve provable security under the standard model, the scheme used the bonsai tree lattice delegation algorithm in reference [5] to bind the dataset labels, but this binding method expanded the lattice matrix size by r times (r is the length of the dataset label), which also led to the problem of excessive signature length. The LHS1 scheme constructed by Lin et al.

[10] also used the two-integer lattice intersection method to implement signatures. Unlike the scheme of Chen et al., Lin et al. used a full-rank differential hash function to bind the dataset labels, and the lattice matrix size was only expanded by 1 times. In addition, Lin et al. proved that the scheme of Chen et al. is only existentially unforgeable under non-adaptive chosen message attacks, and constructed a lattice-based linear homomorphic signature scheme LHS2 under the standard model that is existentially unforgeable under adaptive chosen message attacks using the chameleon hash function.

[0007] References

[0008] [1]D.Boneh,D.Freeman,J.Katz,and B.Waters,“Signing a Linear Subspace:Signature Schemes for Network Coding,”in Public Key Cryptography–PKC 2009,vol.5443,S.Jarecki and G.Tsudik,Eds.,in Lecture Notes in Computer Science,vol.5443.,Berlin,Heidelberg:Springer Berlin Heidelberg,2009,pp.68–87.doi:10.1007 / 978-3-642-00468-1_5.

[0009] [2]P.W.Shor,“Algorithms for quantum computation:discrete logarithmsand factoring,”in Proceedings 35th Annual Symposium on Foundations ofComputer Science,Santa Fe,NM,USA:IEEE Comput.Soc.Press,1994,pp.124–134.doi:10.1109 / SFCS.1994.365700.

[0010] [3]D.Boneh and D.M.Freeman,“Linearly Homomorphic Signatures overBinary Fields and New Tools for Lattice-Based Signatures,”in Public KeyCryptography–PKC 2011,D.Catalano,N.Fazio,R.Gennaro,and A.Nicolosi,Eds.,inLecture Notes in Computer Science.Berlin,Heidelberg:Springer,2011,pp.1–16.doi:10.1007 / 978-3-642-19379-8_1.

[0011] [4]C.Gentry,C.Peikert,and V.Vaikuntanathan,“Trapdoors for hardlattices and new cryptographic constructions,”in Proceedings of the fortiethannual ACM symposium on Theory of computing,Victoria British Columbia Canada:ACM,May 2008,pp.197–206.doi:10.1145 / 1374376.1374407.

[0012] [5]D.Cash,D.Hofheinz,E.Kiltz,and C.Peikert,“Bonsai Trees,or How toDelegate a Lattice Basis,”J Cryptol,vol.25,no.4,pp.601–639,Oct.2012,doi:10.1007 / s00145-011-9105-2.

[0013] [6]D.Boneh and D.M.Freeman,“Homomorphic Signatures for PolynomialFunctions,”in Advances in Cryptology–EUROCRYPT 2011,vol.6632,K.G.Paterson,Ed.,in Lecture Notes in Computer Science,vol.6632.,Berlin,Heidelberg:SpringerBerlin Heidelberg,2011,pp.149–168.doi:10.1007 / 978-3-642-20465-4_10.

[0014] [7]F.Wang,Y.Hu,and B.Wang,“Lattice-based linearly homomorphicsignature scheme over binary field,”Sci.China Inf.Sci.,vol.56,no.11,pp.1–9,Nov.2013,doi:10.1007 / s11432-012-4681-9.

[0015] [8]V. Lyubashevsky and D. Micciancio, “Asymptotically Efficient Lattice-Based Digital Signatures,” J Cryptol, vol. 31, no. 3, pp. 774–797, Jul. 2018, doi: 10.1007 / s00145-017-9270-z.

[0016] [9]W. Chen, H. Lei, and K. Qi, “Lattice-based linearly homomorphic signatures in the standard model,” Theoretical Computer Science, vol. 634, pp. 47–54, Jun. 2016, doi: 10.1016 / j.tcs.2016.04.009.

[10] C.-J. Lin, R. Xue, S.-J. Yang, X. Huang, and S. Li, “Linearly Homomorphic Signatures from Lattices,” The Computer Journal, vol. 63, no. 12, pp. 1871–1885, Dec. 2020, doi: 10.1093 / comjnl / bxaa034.

[0017]

[11] D. Micciancio and O. Regev, “Worst-Case to Average-Case Reductions Based on Gaussian Measures,” in 45th Annual IEEE Symposium on Foundations of Computer Science, Rome, Italy: IEEE, 2004, pp. 372–381. doi: 10.1109 / FOCS.2004.72.

[0018]

[12] J. Alwen and C. Peikert, “Generating Shorter Bases for Hard Random Lattices,” Theory Comput Syst, vol. 48, no. 3, pp. 535–553, Apr. 2011, doi: 10.1007 / s00224-010-9278-3. Summary of the Invention

[0019] The object of the present invention is to provide a binary domain lattice-based linear homomorphic signature method and system. In the present invention, a full-rank hash function is used to map a data set label into a full-rank matrix, and a linear homomorphic signature is realized by utilizing the homomorphism of the multiplication of the full-rank matrix and the message vector. In order to achieve an adaptive selected message attack existence unforgeable security level under the standard model, the method uses a chameleon hash function to hash the message vector and the random vector before signing. Compared with the existing lattice-based linear homomorphic signature method, the present invention has advantages in both efficiency and security.

[0020] In order to achieve the above object, the present invention adopts the following technical solution:

[0021] A binary domain lattice baseline linear homomorphic signature method, comprising:

[0022] Step (1) Generate system parameters required for the signature method, including public parameters, maximum number of signatures, and common digital signature algorithms;

[0023] Step (2) Use the system parameters generated in step (1) to generate the signer's public key and private key, use the private key to generate the signature, and use the public key to verify the signature;

[0024] Step (3) Use the system parameters in step (1) and the public key and private key in step (2) to sign the message. The signature can ensure the integrity and authenticity of the message.

[0025] Step (4) Verify the signature generated in step (3) using the system parameters generated in step (1) and the public key generated in step (2) to verify the integrity and authenticity of the message. If the message maintains integrity and authenticity, this step outputs 1, otherwise it outputs 0.

[0026] Step (5) Combine the many messages verified in step (4) into one message, and then combine the many signatures corresponding to these messages into one signature.

[0027] A further improvement of the present invention is that step (1) is specifically implemented as follows:

[0028] Let the security parameter be n, and choose a prime number q≥(ml) 2 ; Let m = 6nlogq, Gaussian parameter In the security proof, β is set to therefore Let l be the maximum number of signatures that can be combined by the Combine algorithm, and the length of the dataset label information is n; define the message space as Linear function f: The coefficients belong to {0,1}, that is, if f(m1,....,m l )=a1m1+…+a l m l , then for i≤l, there is a i ∈{0,1}; let H: is a full-rank hash function; let The message space is {0,1} n A common digital signature on .

[0029] A further improvement of the present invention is that step (2) is specifically implemented as follows:

[0030] The signer uses the TrapGen(q,n,m) algorithm to generate two matrices and as well as Trapdoor and satisfy and Random Selection Matrix run Generate a digital signature Key pair; output public key pk = (A, C0, C1, pk'), private key sk = (T A ,T C ,sk');

[0031] The public key consists of three random uniform matrices (A, C0, C1) and a common digital signature The public key pk', the private key includes two trapdoor bases T A With T C And ordinary digital signature The private key sk'; the matrix A is a lattice matrix, (C0, C1) corresponds to a chameleon hash function, which converts two m-dimensional vectors m ij and r ij Mapped to h ij ,Right now

[0032] A further improvement of the present invention is that step (3) is specifically implemented as follows:

[0033] For the inclusion of m i1 ,...,m il l-dimensional subspace of basis vectors The signer uses the public key pk, private key sk, and message vector Dataset label τ i∈{0,1} n and index j as input, and perform the following operations: (i) Using Algorithm generates τ i Signature (ii) Randomly select vector calculate (iii) Calculate a vector Make A·t ij =H(τ i )·h ij modq; using SamplePre(T A ,s,-t ij ) The algorithm outputs t′ ij , calculate σ ij =t ij +t' ij modq, As message m ij signature; use the full-rank hash function H to bind the dataset label τ i , using H(τ i )·h ij Homomorphism of matrix and vector multiplication implements linear homomorphic signature.

[0034] A further improvement of the present invention is that in step 3, the signer calculates A·t ij =H(τ i )·h ij modq, here is used as a lattice basis matrix.

[0035] A further improvement of the present invention is that step (4) is specifically implemented as follows:

[0036] In order to verify (τ i ,m ij ,j)’s signature vector Whether it is legal, the verifier performs the following operations: (i) Verify (ii) Calculate h ij =(C0m ij +C1r ij )modq; (iii) if and only if (a) A·σ ij =H(τ i )·h ij modq, and (b) If the condition is met, the signature is accepted and output 1, otherwise the signature is rejected by outputting 0.

[0037] A further improvement of the present invention is that step (5) is specifically implemented as follows:

[0038] Given a tuple (a ij,σ ij ,r ij ,m ij ), where j = 1, 2, ..., l, the combination is calculated and Will As a message Signature.

[0039] A binary domain lattice baseline linear homomorphic signature system, comprising:

[0040] System parameter generation module, which generates system parameters required by the signature method, including public parameters, maximum number of signatures and common digital signature algorithm;

[0041] The key generation module generates the public key and private key of the signer using the system parameters generated by the system parameter generation module, uses the private key to generate the signature, and uses the public key to verify the signature;

[0042] The signature module uses the system parameters in the system parameter generation module and the public key and private key in the key generation module to sign the message. The signature can ensure the integrity and authenticity of the message.

[0043] Verification module: Verify the signature generated by the signature module, using the system parameters generated by the system parameter generation module and the public key generated by the key generation module to verify the signature. This is a process for verifying the integrity and authenticity of the message. If the message maintains integrity and authenticity, this step outputs 1, otherwise it outputs 0;

[0044] The signature combination module combines many messages verified by the verification module into one message, and then combines many signatures corresponding to these messages into one signature.

[0045] A further improvement of the present invention is that in the system parameter generation module: let the security parameter be n, select a prime number q≥(ml) 2 ; Let m = 6nlogq, Gaussian parameter In the security proof, β is set to therefore Let l be the maximum number of signatures that can be combined by the Combine algorithm, and the length of the dataset label information is n; define the message space as Linear function f: The coefficients belong to {0,1}, that is, if f(m1,...,m l )=a1m1+…+a l m l , then for i≤l, there is a i ∈{0,1}; let H: is a full-rank hash function; let The message space is {0,1} nA common digital signature on .

[0046] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a binary domain lattice baseline linear homomorphic signature method.

[0047] Compared with the prior art, the present invention has at least the following beneficial technical effects:

[0048] In step (1), the security of the signature system is ensured by choosing a large prime number q, and by choosing q ≥ (ml) 2 , where m and l are related to the number of signatures and the size of the message space, which enhances the system's ability to resist attacks. Gaussian parameters It is used for random selection in subsequent signature algorithms to ensure the randomness and unpredictability of signatures. The full-rank hash function H maps the data set label information (length n) to The space ensures the uniqueness and unpredictability of the hash value and enhances the security of the data.

[0049] In step (2), by running the trapdoor generation algorithm TrapGen(q,n,m) algorithm, two matrices A and C1 and their corresponding grid and Trapdoor A and T C This technical approach solves the problem of how to provide the signer with a valid private key for use in the signing process while ensuring security. The generated trapdoor basis enables the signer to perform the signing operation efficiently, while it is difficult for the attacker to recover the private key from the public key, thereby enhancing the security of the signature. The key generation algorithm S.KeyGen(l λ ), an additional key pair (sk', pk') is generated. This technical approach combines the advantages of traditional digital signature schemes to enhance the overall performance of the signature method. By combining the key pair of the traditional signature scheme, the signature method not only maintains the security of lattice-based signatures, but also has the advantages of traditional signature schemes in terms of signature length, verification efficiency, etc.

[0050] In step (3), by using the Chameleon hash function The signature is unforgeable. An important property of the Chameleon hash function is that it is almost impossible to find an input that matches a given hash value without knowing the trapdoor information (unless the hash value is generated in a legitimate way (i.e. using the trapdoor information). This ensures the unforgeability of the signature, i.e. only the signer who holds the private key can generate a valid signature. The Chameleon hash function also ensures the binding of the signature, i.e. the signature is tightly bound to the message. In this step, the signer calculates h ij (This is the message m ij and a random vector r ij Chameleon hash value) and t ij (a vector that satisfies a particular set of linear equations), and then t ij and t generated by trapdoor information i ' j Add together to get the final signature σ ij In this process, any response to message m ij Any modification will result in the inability to find a t that satisfies the original linear equations. ij , making it impossible to generate a valid signature.

[0051] In step (5), the property of linear homomorphism is utilized, which is an inherent property of lattice-based signature schemes. Linear homomorphism allows signatures of multiple messages to be combined into a single signature in a linear manner while maintaining the validity and security of the signature. In scenarios where a large number of messages need to be signed, traditional signature methods generate a separate signature for each message. This results in an excessive number of signatures, increasing the burden of storage and transmission. The linear homomorphism property allows multiple signatures to be aggregated into one signature, significantly reducing the required storage space and transmission bandwidth. In addition, when multiple signatures need to be verified, it is inefficient to verify each signature one by one. Through linear homomorphism, the verification process of multiple signatures can be merged into a single verification process, thereby improving the verification efficiency.

[0052] In summary, the present invention solves the problems of signature aggregation and verification efficiency by adopting linear homomorphic technical means, and achieves the expected effects of reducing storage and transmission overhead, improving verification efficiency and maintaining security. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a flow chart of a binary domain lattice baseline linear homomorphic signature method of the present invention;

[0054] Figure 2 It is a structural block diagram of a binary domain lattice baseline linear homomorphic signature system of the present invention. DETAILED DESCRIPTION

[0055] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0056] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0057] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0058] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0059] Various structural schematic diagrams of the embodiments disclosed in the present invention are shown in the accompanying drawings. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0060] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0061] Example 1

[0062] like Figure 1 As shown, the invention provides a binary domain lattice baseline linear homomorphic signature method, the innovation of which is that it uses a homomorphic hash function to construct a binary domain lattice baseline linear homomorphic signature method, which has higher efficiency than the existing similar lattice baseline linear homomorphic signature method; it uses a chameleon hash function to achieve the method's unforgeability in the adaptive selected message attack under the standard model. It includes the following steps:

[0063] Step (1) Generate system parameters required for the signature method, including public parameters, maximum number of signatures, and common digital signature algorithms;

[0064] Step (2) Use the system parameters generated in step (1) to generate the signer's public key and private key, use the private key to generate the signature, and use the public key to verify the signature;

[0065] Step (3) Use the system parameters in step (1) and the public key and private key in step (2) to sign the message. The signature can ensure the integrity and authenticity of the message.

[0066] Step (4) Verify the signature generated in step (3) using the system parameters generated in step (1) and the public key generated in step (2) to verify the integrity and authenticity of the message. If the message maintains integrity and authenticity, this step outputs 1, otherwise it outputs 0.

[0067] Step (5) Combine the many messages verified in step (4) into one message, and then combine the many signatures corresponding to these messages into one signature.

[0068] In this embodiment, step (1) is specifically implemented as follows:

[0069] Let the security parameter be n, and choose a prime number q≥(ml) 2 ; Let m = 6nlogq, Gaussian parameter In the security proof, β is set to therefore Let l be the maximum number of signatures that can be combined by the Combine algorithm, and the length of the dataset label information is n; define the message space as Linear function f: The coefficients belong to {0,1}, that is, if f(m1,...,m l )=a1m1+…+a l m l , then for i≤l, there is a i ∪{0,1}; let H: is a full-rank hash function; let The message space is {0,1} n A common digital signature on .

[0070] In this embodiment, step (2) is specifically implemented as follows:

[0071] The signer uses the TrapGen(q,n,m) algorithm to generate two matrices and as well as Trapdoor and satisfy and Random Selection Matrix run Generate a digital signature Key pair; output public key pk = (A, C0, C1, pk'), private key sk = (T A ,T C ,sk');

[0072] The public key consists of three random uniform matrices (A, C0, C1) and a common digital signature The public key pk', the private key includes two trapdoor bases T A With T C And ordinary digital signature The private key sk'; the matrix A is a lattice matrix, (C0, C1) corresponds to a chameleon hash function, which converts two m-dimensional vectors m ij and r ij Mapped to h ij ,Right now

[0073] In this embodiment, step (3) is specifically implemented as follows:

[0074] For the inclusion of m i1 ,....,m il l-dimensional subspace of basis vectors The signer uses the public key pk, private key sk, and message vector Dataset label τ i ∈{0,1} n and index j as input, and perform the following operations: (i) Using Algorithm generates τ i Signature (ii) Randomly select vector calculate (iii) Calculate a vector Make A·t ij =H(τ i )·h ij modq; using SamplePre(T A ,s,-t ij ) The algorithm outputs t′ ij , calculate σ ij =t ij +t' ij modq, As message m ij signature; use the full-rank hash function H to bind the dataset label τ i , using H(τ i )·h ijHomomorphism of matrix and vector multiplication implements linear homomorphic signature.

[0075] In this embodiment, in step 3, the signer calculates A·t ij =H(τ i )·h ij modq, here is used As a lattice basis matrix, the expansion of the lattice basis matrix size is avoided, thereby reducing the signature size and reducing the computational overhead during signing and verification.

[0076] In this embodiment, step (4) is specifically implemented as follows:

[0077] In order to verify (τ i ,m ij ,j)’s signature vector Whether it is legal, the verifier performs the following operations: (i) Verify (ii) Calculate h ij =(C0m ij +C1r ij )modq; (iii) if and only if (a) A·σ ij =H(τ i )·h ij modq, and (b) If the condition is met, the signature is accepted and output 1, otherwise the signature is rejected by outputting 0.

[0078] In this embodiment, step (5) is specifically implemented as follows:

[0079] Given a tuple (a ij ,σ ij ,r ij ,m ij ), where j = 1, 2, ..., l, the combination is calculated and Will As a message Signature.

[0080] Example 2

[0081] Correctness analysis of the method of the present invention:

[0082] (1) The correctness of. For all τ i and Given Then we have:

[0083] (i) Based on digital signature The correctness of

[0084] (ii) Due to Therefore Aσ ij =A·t ij modq=H(τ i )·h ij modq

[0085] (iii) Due to the Gaussian parameters and According to Lemma 2.5, except for negligible probability, ||σ ij ||Almost always satisfied

[0086] (2) Correctness: To satisfy All τ i and tuple collections If m=f(m i1 ,...,m il )and Then we have:

[0087] (i) and

[0088] (ii) Based on digital signature The correctness of

[0089] (iii) For all j, since |a ij |≤1, so ||σ|| is almost always satisfied except with negligible probability.

[0090]

[0091] (iv)

[0092] Safety analysis of the method:

[0093] Theorem: If is an unforgeable digital signature, and SIS n,m,q,β The problem is difficult, then The scheme is EUF-CMA secure in the standard model.

[0094] set up is a polynomial-time adversary that can attack the challenger in at most After issuing Q different signature queries, output a valid forged satisfy If the opponent It is possible to generate type I forgeries with probability ε1, that is, for any i∈{1,...,Q}, there is τ* ≠τ i , and m * ≠0, then the challenger We can construct a polynomial time algorithm Successfully forged with probability ε1 The signature in It is possible to generate type II forgeries with probability ε2, that is, there exists i∈{1,...,Q} such that τ * =τ i ,and Then the challenger Another polynomial time algorithm can be constructed Solve a random SIS with probability ∈2 n,m,q,β Question. In the following game, the challenger For the enemy Simulate public keys and signatures and pass them to the adversary The forgery capability is used as a subroutine to build the algorithm or To forge Signature or solution of SIS n,m,q,β question.

[0095] (1) Initialization phase: Challenger run The algorithm generates public parameters and receives random SIS n,m,q,β Examples

[0096] (2) Public key query phase: In this phase, the adversary To the challenger Ask for the public key, the challenger For the enemy Simulating the public key requires The signer uses the TrapGen(q,n,m) algorithm to generate the matrix Trapdoor Random Selection Matrix Run(sk',pk')←KeyGen(1 λ ) Generate a digital signature scheme Output and return the public key pk = (A, C0, C1, pk') to the adversary

[0097] After the public key query, the adversary Receive pk = (A, C0, C1). The matrices A, C0, and C1 are all randomly and uniformly distributed. Therefore, the adversary Indistinguishable from the real public key and the challenger The public key that is simulated during the game.

[0098] (3) Signature query phase: In this phase, the adversary Adapt to challengers Ask for signature Q times, challenger For the enemy Simulating signatures requires The real signature and the simulated signature cannot be distinguished from each other under the visual angle, that is, the simulated signature must meet Verify the correctness of the algorithm.

[0099] Receive from the adversary The vector subspace of Challenger for Randomly select a τ i ,use Algorithm generates τ i Signature For message m ij , randomly selected Calculate t ij =H(τ i ) -1 A.σ ij -C0m ij modq, using SamplePre(T C ,s,-t ij ) The algorithm outputs t′ ij , calculate r ij =t ij +t′ ij modq, As a vector subspace The signature is returned to the adversary

[0100] After the signature query, the adversary From the perspective of C1r ij =H(τ i ) -1 A.σ ij -C0m ij modq, then A·σ ij =H(τ i )(C0m ij +C1r ij )modq. Therefore Challenger For the enemy The simulated signature (σ ij ,r ij ) can be verified and is indistinguishable from a genuine signature.

[0101] (4) Forgery stage: Adversary Output satisfy

[0102] (5) Extraction phase: In this phase, the challenger Taking advantage of the enemy Forgery-breaking signature scheme Unforgeability or solving SIS n,m,q,β Problem example.

[0103] Assume the adversary Output type I forgery with probability ∈ 1, that is, for any i∈{1,...,Q}, there is τ * ≠τ i , and m * ≠ 0. In this case, Never been defeated Therefore, the challenger You can directly As The forged signature means that the challenger Can break the signature scheme with probability ∈ 1 unforgeability.

[0104] Assume that the adversary Output type II forgery with probability ∈2, that is, for some i∈{1,...,Q}, satisfying τ * =τ i ,and In this case, let (m i1 ,...,m il )for The basis vectors in The correctness of is established, so there is because Therefore because and The length is less than Therefore This position challenger Can be calculated with probability ∈2 The SIS with matrix A as an example is n,m,q,β Solution to the problem

[0105] Method property comparison:

[0106]

[0107]

[0108] Example 3

[0109] like Figure 2 As shown, the present invention provides a binary domain lattice baseline linear homomorphic signature system, comprising:

[0110] System parameter generation module, which generates system parameters required by the signature method, including public parameters, maximum number of signatures and common digital signature algorithm;

[0111] The key generation module generates the public key and private key of the signer using the system parameters generated by the system parameter generation module, uses the private key to generate the signature, and uses the public key to verify the signature;

[0112] The signature module uses the system parameters in the system parameter generation module and the public key and private key in the key generation module to sign the message. The signature can ensure the integrity and authenticity of the message.

[0113] Verification module: Verify the signature generated by the signature module, using the system parameters generated by the system parameter generation module and the public key generated by the key generation module to verify the signature. This is a process for verifying the integrity and authenticity of the message. If the message maintains integrity and authenticity, this step outputs 1, otherwise it outputs 0;

[0114] The signature combination module combines many messages verified by the verification module into one message, and then combines many signatures corresponding to these messages into one signature.

[0115] Example 4

[0116] The present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the binary domain lattice baseline linear homomorphic signature method are implemented.

[0117] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0118] The present application is described with reference to the flowcharts and / or block diagrams of the methods, systems and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0119] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0120] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0121] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the attached claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any figure mark in the claims should not be regarded as limiting the claims involved.

[0122] In addition, it should be understood that although this specification is described in accordance with the implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation modes that can be understood by those skilled in the art. The above content is only to illustrate the technical idea of ​​the present invention, and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution according to the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A binary domain lattice baseline linear homomorphic signature method, characterized in that: include: Step (1) Generate system parameters required for the signature method, including public parameters, maximum number of signatures, and common digital signature algorithms; Step (2) Use the system parameters generated in step (1) to generate the signer's public key and private key, use the private key to generate the signature, and use the public key to verify the signature; Step (3) Use the system parameters in step (1) and the public key and private key in step (2) to sign the message. The signature can ensure the integrity and authenticity of the message. Step (4) Verify the signature generated in step (3) using the system parameters generated in step (1) and the public key generated in step (2) to verify the integrity and authenticity of the message. If the message maintains integrity and authenticity, this step outputs 1, otherwise it outputs 0. Step (5) Combine the many messages verified in step (4) into one message, and then combine the many signatures corresponding to these messages into one signature.

2. A binary domain lattice baseline linear homomorphic signature method according to claim 1, characterized in that: Step (1) is specifically implemented as follows: Let the security parameter be n, and choose a prime number q≥(ml) 2 ; Let m = 6nlogq, Gaussian parameter In the security proof, β is set to therefore Let l be the maximum number of signatures that can be combined by the Combine algorithm, and the length of the dataset label information is n; define the message space as Linear Function The coefficients belong to {0,1}, that is, if f(m1,...,m l )=a1m1+…+a l m l , then for i≤l, there is a i ∈{0,1}; let is a full-rank hash function; let The message space is {0,1} n A common digital signature on .

3. A binary domain lattice baseline linear homomorphic signature method according to claim 1, characterized in that: Step (2) is specifically implemented as follows: The signer uses the TrapGen(q,n,m) algorithm to generate two matrices and as well as Trapdoor and satisfy and Random Selection Matrix run Generate a digital signature Key pair; output public key pk = (A, C0, C1, pk'), private key sk = (T A ,T C ,sk'); The public key consists of three random uniform matrices (A, C0, C1) and a common digital signature The public key pk', the private key includes two trapdoor bases T A With T C And ordinary digital signature The private key sk'; the matrix A is a lattice matrix, (C0, C1) corresponds to a chameleon hash function, which converts two m-dimensional vectors m ij and r ij Mapped to h ij ,Right now 4. A binary domain lattice baseline linear homomorphic signature method according to claim 1, characterized in that: Step (3) is specifically implemented as follows: For the inclusion of m i1 ,...,m il l-dimensional subspace of basis vectors The signer uses the public key pk, private key sk, and message vector Dataset label τ i ∈{0,1} n and index j as input, and perform the following operations: (i) Using Algorithm generates τ i Signature (ii) Randomly select vector calculate (iii) Calculate a vector Make A·t ij =H(τ i )·h ij modq; using SamplePre(T A ,s,-t ij ) The algorithm outputs t′ ij , calculate σ ij =t ij +t' ij modq, As message m ij signature; use the full-rank hash function H to bind the dataset label τ i , using H(τ i )·h ij Homomorphism of matrix and vector multiplication implements linear homomorphic signature.

5. A binary domain lattice baseline linear homomorphic signature method according to claim 4, characterized in that: In step 3, the signer calculates A·t ij =H(τ i )·h ij modq, here is used as a lattice basis matrix.

6. A binary domain lattice baseline linear homomorphic signature method according to claim 1, characterized in that: Step (4) is specifically implemented as follows: In order to verify (τ i ,m ij ,j)’s signature vector Whether it is legal, the verifier performs the following operations: (i) Verify (ii) Calculate h ij =(C0m ij +C1r ij )modq; (iii) if and only if (a) A·σ ij =H(τ i )·h ij modq, and (b) If the condition is met, the signature is accepted and output 1, otherwise the signature is rejected by outputting 0.

7. A binary domain lattice baseline linear homomorphic signature method according to claim 1, characterized in that: Step (5) is specifically implemented as follows: Given a tuple (a ij ,σ ij ,r ij ,m ij ), where j = 1, 2, ..., l, the combination is calculated and Will As a message Signature.

8. A binary domain lattice baseline linear homomorphic signature system, characterized in that: include: System parameter generation module, which generates system parameters required by the signature method, including public parameters, maximum number of signatures and common digital signature algorithm; The key generation module generates the public key and private key of the signer using the system parameters generated by the system parameter generation module, uses the private key to generate the signature, and uses the public key to verify the signature; The signature module uses the system parameters in the system parameter generation module and the public key and private key in the key generation module to sign the message. The signature can ensure the integrity and authenticity of the message. Verification module: Verify the signature generated by the signature module, using the system parameters generated by the system parameter generation module and the public key generated by the key generation module to verify the signature. This is a process for verifying the integrity and authenticity of the message. If the message maintains integrity and authenticity, this step outputs 1, otherwise it outputs 0; The signature combination module combines many messages verified by the verification module into one message, and then combines many signatures corresponding to these messages into one signature.

9. A binary domain lattice baseline linear homomorphic signature system according to claim 8, characterized in that: In the system parameter generation module: Set the security parameter to n, and select a prime number q≥(ml) 2 ; Let m = 6nlogq, Gaussian parameter In the security proof, β is set to therefore Let l be the maximum number of signatures that can be combined by the Combine algorithm, and the length of the dataset label information is n; define the message space as Linear Function The coefficients belong to {0,1}, that is, if f(m1,....,m l )=a1m1+…+a l m l , then for i≤l, there is a i ∈{0,1}; let is a full-rank hash function; let The message space is {0,1} n A common digital signature on .

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program implements the steps of a binary domain lattice baseline linear homomorphic signature method according to any one of claims 1 to 7.

Images