Distributed anonymous communication method and system based on threshold ECDSA signature

Abstract

The invention discloses a distributed anonymous communication method and system based on a threshold ECDSA signature. The method comprises the following steps that: a committee member performs security verification on a user according to a commitment value and attribute information sent by the user; based on a threshold ECDSA signature algorithm, an anonymous pass of the secure user is generated; and the electronic service provider performs identity verification on the user according to the verification information so as to provide service for the user. A committee generates an anonymous communication certificate of a user based on a threshold ECDSA signature algorithm, and the algorithm stores a first private key used when the anonymous communication certificate is generated in a plurality of members of the committee in a distributed manner, so that even if a certain member has a single-point fault, an attacker cannot speculate the anonymous communication certificate only through a single fault member; as the electronic service provider verifies the identity of the user through zero-knowledge proof, the electronic service provider cannot obtain the identity information of the user from the verification information; therefore, the method provided by the invention can protect the privacy of the user from being leaked.

Description

Technical Field

[0001] The present invention belongs to the technical field of data encryption, and in particular relates to a distributed anonymous communication method and system based on threshold ECDSA signature. Background Art

[0002] In the authentication system for electronic services, when anonymous credentials are used, the information leaked by users is minimized, which can solve the problem of excessive disclosure of information in the current information flow process. However, anonymous credentials are usually issued and managed by central authorities, which may lead to single point failures, resulting in problems such as leakage of user privacy data. On the other hand, before providing electronic services, the user's certificate needs to be verified, but once the plaintext certificate is stolen or lost in the transaction, it will cause huge losses to the user and the service provider. Therefore, the problem of privacy protection of authenticated user identities in electronic services is difficult to solve. Summary of the invention

[0003] The embodiment of the present invention provides a distributed anonymous communication method and system based on threshold ECDSA signature, which can solve the problem of user privacy leakage caused by single point failure and certificate loss in the current authentication system.

[0004] In a first aspect, an embodiment of the present invention provides a distributed anonymous communication method based on threshold ECDSA signature, the method is applied to a distributed anonymous communication system based on threshold ECDSA signature, the system includes a committee and an electronic service provider, the committee includes multiple committee members, and the method includes:

[0005] Committee members conduct security verification on users based on the commitment value sent by the user and the user's attribute information;

[0006] The committee members generate an anonymous pass for the secure user based on the attribute information of the secure user based on the threshold ECDSA signature algorithm, wherein the threshold ECDSA signature algorithm stores the first private key in a distributed manner among the committee members, the first private key is used to generate the anonymous pass, and the secure user is a user who has passed the security verification;

[0007] The electronic service provider authenticates the user based on the verification information sent by the user to provide services to the user who has passed the identity authentication, wherein the verification information is a zero-knowledge proof generated by the user based on the anonymous pass.

[0008] In a second aspect, an embodiment of the present invention provides a distributed anonymous communication system based on threshold ECDSA signature, including:

[0009] The committee includes multiple committee members, and the committee members are used to perform security verification on the user based on the commitment value sent by the user and the user's attribute information;

[0010] The committee members are also used to generate an anonymous pass of the secure user based on the threshold ECDSA signature algorithm according to the attribute information of the secure user, wherein the threshold ECDSA signature algorithm stores the first private key in a distributed manner among the committee members, the first private key is used to generate the anonymous pass, and the secure user is a user who has passed the security verification;

[0011] The electronic service provider is used to authenticate the user based on the verification information sent by the user so as to provide services to the user who has passed the identity authentication, wherein the verification information is a zero-knowledge proof generated by the user based on the anonymous pass.

[0012] Compared with the prior art, the embodiments of the present invention have the following beneficial effects: since the committee generates the user's anonymous communication certificate based on the threshold ECDSA signature algorithm, and the threshold ECDSA signature algorithm stores the first private key used to generate the anonymous pass in a distributed manner among multiple committee members, even if a single point failure occurs in a committee member, an attacker cannot infer the user's anonymous pass only through the failed single committee member; since the electronic service provider verifies the user's identity through zero-knowledge proof, the electronic service provider cannot obtain the user's identity information from the verification information; therefore, the method provided by the present invention can protect the user's privacy from being leaked. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 A schematic diagram of a scenario for communication using a distributed anonymous communication method based on threshold ECDSA signature provided by the present invention;

[0014] Figure 2 A schematic diagram of the structure of a distributed anonymous communication system based on threshold ECDSA signature provided by an embodiment of the present invention;

[0015] Figure 3 A schematic diagram of a distributed anonymous communication method based on threshold ECDSA signature provided in an embodiment of the present invention;

[0016] Figure 4 A schematic diagram of the process of applying for and issuing an anonymous pass provided in an embodiment of the present invention;

[0017] Figure 5 A schematic diagram of a display process of an anonymous pass provided by an embodiment of the present invention;

[0018] Figure 6 A schematic diagram of an anonymity proof process provided by an embodiment of the present invention;

[0019] Figure 7 A schematic diagram of an unforgeability proof process provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0021] Figure 1 What is shown is a schematic diagram of a scenario of communication using a distributed anonymous communication method based on threshold ECDSA signature provided by the present invention.

[0022] Exemplarily, the distributed anonymous communication method based on threshold ECDSA signature provided by the present invention can also be called a distributed anonymous communication protocol based on threshold ECDSA signature, and can be applied to a distributed anonymous communication system based on threshold ECDSA signature.

[0023] For example, see Figure 1 In the overall protocol, there are three parties interacting, namely: User, Service Provider (SP) and Committee. Figure 1 After the system is initialized, the user uploads the relevant identity attribute information to the committee for registration. The committee members perform threshold ECDSA signature on the user's attribute information, generate an anonymous pass and return it to the user. The user generates a zero-knowledge proof (i.e., verification information) based on the anonymous pass and sends it to the electronic service provider. The electronic service provider verifies the verification message provided by the user, and if the identity authentication is successful, it provides services to the user who has passed the identity authentication.

[0024] As an example, the system can complete initialization through the following steps S11-S14, generate the first public-private key pair (i.e., first public key, first private key) used by the committee and the second public-private key pair (i.e., second public key, second private key) used by the user and the system global parameters. Then, the second public key is made public to the electronic service provider and the user for generating verification information in the form of zero-knowledge proof; at the same time, the first private key slice is distributed to each committee member using a private sharing scheme.

[0025] Exemplarily, only when the number of valid committee members participating in recovering the first private key is greater than or equal to the key recovery threshold value t, can the committee members perform the signing function to generate an anonymous pass for the user.

[0026] S11, params←Setup(1 λ ), which represents the generation of the system global parameters (p,F p ,q,G 1 ,G). Among them, E is to satisfy y 2 =x 3 +ax+b(4a 3 +27b2 ≠0), a,b∈F p The elliptic curve G 1 It is a set of all elliptic curve points on E and the point O at infinity, which is a cyclic additive group. p is a large prime number, G is G 1 The generator of G 1 The order, F p is a prime field containing p elements, λ is a security parameter, and the hash function is defined as H().

[0027] S12, (sk, pk)←KeyGen(params), indicates generating the first public-private key pair.

[0028] Exemplarily, the first public-private key pair satisfies: (sk1=x u , pk1=x u G), x u ←Z q . Among them, sk1 is the first private key, pk1 is the first public key, Z q is a residue class ring modulo a prime number q.

[0029] S13, It means calling the decentralized Shamir secret sharing scheme, sharing the first private key sk1 in the committee, dividing it into n sub-keys (i.e. private key shards); and setting the key recovery threshold value t.

[0030] S14, output params, Indicates publishing the first public key and sharding the private key Distributed to each member of the committee. Params is the implicit input of the algorithm.

[0031] Figure 2 The structure diagram of a distributed anonymous communication system based on threshold ECDSA signature provided by an embodiment of the present invention is shown. As an example but not limitation, the system 200 may include a committee 210 and an electronic service provider 220, and the committee 210 may include multiple committee members 211.

[0032] Committee member 211 can be used to perform security verification on the user based on the commitment value sent by the user and the user's attribute information; committee member 211 can also be used to generate an anonymous pass for the secure user based on the secure user's attribute information based on the threshold ECDSA signature algorithm.

[0033] The electronic service provider 220 may be configured to authenticate the user based on the verification information sent by the user, so as to provide services to the user whose identity is authenticated.

[0034] Exemplarily, the threshold ECDSA signature algorithm stores the first private key in a distributed manner among the committee members. The first private key is used to generate an anonymous pass, and the secure user is a user who has passed the security verification.

[0035] Exemplarily, the verification information is a zero-knowledge proof generated by the user based on the anonymous pass.

[0036] Since the committee generates the user's anonymous communication certificate based on the threshold ECDSA signature algorithm, and the threshold ECDSA signature algorithm stores the first private key used to generate the anonymous pass in a distributed manner among multiple committee members, even if a single point failure occurs in a committee member, an attacker cannot infer the user's anonymous pass only through the failed single committee member; since the electronic service provider verifies the user's identity through zero-knowledge proof, the electronic service provider cannot obtain the user's identity information from the verification information; therefore, the system provided by the present invention can protect the user's privacy from being leaked.

[0037] Figure 3 The flowchart of a distributed anonymous communication method based on threshold ECDSA signature provided by an embodiment of the present invention is shown. As an example but not a limitation, the method 300 may include steps S301-S307, and the method 300 may be applied to the above system 200. Each step is described below.

[0038] S301, the user commits to the attribute information to register.

[0039] In one example, a user may commit to attribute information related to his or her identity according to the Pedersen commitment algorithm and generate a commitment value for registration.

[0040] Specifically, see Figure 4 , the user can run the U.Request(·) algorithm to send a certificate request to the committee along with his / her commitment value, and the committee receives the commitment value and verifies it.

[0041] S302, the user sends the commitment value to the committee.

[0042] Accordingly, the committee receives the committed value.

[0043] S303, the committee performs security verification on the user based on the commitment value sent by the user and the user's attribute information.

[0044] In one example, if the user passes the security verification, the user may be determined as a safe user and step S304 may be performed.

[0045] Specifically, see Figure 4, the committee can call the verification algorithm (0,1)←C.Verify(v,C) to verify the committed value to ensure that the information has not been tampered with.

[0046] For example, when the user's commitment value satisfies the following formula, it can be considered that the user has passed the security verification:

[0047] C=r 1 ·G+v·H

[0048] Among them, C is the commitment value, r 1 is the first random number, v is the attribute information of the user, H is a point on the elliptic curve, and G is the generator of the cyclic additive group.

[0049] In another example, if the user fails the security verification, the protocol may be terminated and an error message may be returned to the user.

[0050] S304, the committee members generate an anonymous pass for the security user based on the threshold ECDSA signature algorithm and the attribute information of the security user.

[0051] In one possible implementation, the i-th committee member can recover the i-th private key shard he holds, and then generate the i-th first pass parameter and the i-th second pass parameter based on the generator G, the key recovery threshold value t, the order q of the cyclic additive group, the message hash value and the second random number. Any committee member can generate the third pass parameter based on the message hash value, the order q of the cyclic additive group, the second random number selected by each committee member, and the third random number. Then any committee member can generate an anonymous pass based on the order of the cyclic additive group, the third pass parameter and the third random number of each committee member, the private key shard, the first pass parameter, and the second pass parameter.

[0052] Specifically, see Figure 4 , the committee can run the C.Authenticate(·) algorithm to generate anonymous passes for secure users.

[0053] In one example, an anonymous pass may satisfy the following formula:

[0054]

[0055] Among them, cred is an anonymous pass. is the third pass parameter, b i is the ith third random number, e i is the i-th first pass parameter, sk i For the i-th private key shard, c iis the i-th second pass parameter, r is the first element of the anonymous pass determined according to the second random number, and q is the order of the cyclic additive group.

[0056] Exemplarily, cred=(r,s), where s is the second element constituting the anonymous pass.

[0057] S305, the user generates verification information according to the anonymous pass.

[0058] For example, see Figure 5 , the user can call the algorithm U.Prove(·) to generate a non-interactive zero-knowledge proof, i.e., verification information.

[0059] In one example, the verification information may include a first verification parameter and a second verification parameter.

[0060] Exemplarily, the first verification parameter may satisfy the following formula:

[0061] R=r 2 G

[0062] Among them, R is the first verification parameter, r 2 is the fourth random number, and G is the generator.

[0063] Exemplarily, the second verification parameter may satisfy the following formula:

[0064] z=r 2 +c·sk2

[0065] Among them, z is the second verification parameter, sk2 is the second private key, and c is the third verification parameter.

[0066] S306, the user sends verification information to the electronic service provider.

[0067] For example, when a user receives an anonymous pass from the committee, it means that the user is a legitimate user. When the user wants to obtain electronic services, he can provide the corresponding electronic service provider with verification information in the form of zero-knowledge proof generated based on the anonymous pass.

[0068] Accordingly, the electronic service provider receives verification information.

[0069] S307, the electronic service provider authenticates the user according to the verification information sent by the user, so as to provide services to the user who has passed the identity authentication.

[0070] In one example, the electronic service provider can calculate the third verification parameter based on the second public key and the first verification parameter. Then determine whether the calculated third verification parameter and the received first verification parameter and second verification parameter meet the verification model. If the verification model is met, the user's identity authentication is passed and the corresponding service is provided to the user. If not, an error message is returned.

[0071] Exemplarily, the verification model may satisfy the following formula:

[0072] z·G=R+c·pk2

[0073] Among them, pk2 is the second public key.

[0074] Specifically, see Figure 5 , the electronic service provider can run the S.Verify(·) algorithm to complete the user's identity authentication.

[0075] Since the committee generates the user's anonymous communication certificate based on the threshold ECDSA signature algorithm, and the threshold ECDSA signature algorithm stores the first private key used to generate the anonymous pass in a distributed manner among multiple committee members, even if a single point failure occurs in a committee member, an attacker cannot infer the user's anonymous pass only through the failed single committee member; since the electronic service provider verifies the user's identity through zero-knowledge proof, the electronic service provider cannot obtain the user's identity information from the verification information; therefore, the method provided by the present invention can protect the user's privacy from being leaked.

[0076] Figure 4 The figure shows a schematic diagram of the process of applying for and issuing an anonymous pass provided by an embodiment of the present invention.

[0077] Specifically, see Figure 4 , the U.Request(·) algorithm may include the following steps:

[0078] S411, (G,H,r 1 )←C.Setup(1 λ ), which represents the necessary parameters required to generate commitments. Where G is the cyclic addition group G 1 The generator of , H is another point on the elliptic curve E, r 1 is the first random number.

[0079] S412, (C)←Committment(r,G,H,v), means inputting the generated parameters and the user's attribute information v, and outputting the commitment value.

[0080] Specifically, see Figure 4 , C.Authenticate(·) algorithm may include the following steps:

[0081] S421, ({a i0 , a i1 , ..., a i(t-1)},ID i )←Setup(1 λ ), indicating the i-th committee member M i Generate your own ID i , and then select t polynomial coefficients {a i0 , a i1 , ..., a i(t-1) Finally, the jth key share is generated based on the t polynomial coefficients, the order of the cyclic additive group, and the identity of the jth committee member.

[0082] Exemplarily, the j-th key share generated by the i-th committee satisfies the following formula:

[0083] sk ij =f i (ID j )(j=1,2,……,n,j≠i)

[0084] Among them, sk ij The jth key share generated by the i-th committee. i (x) = a i0 +a i1 x+……+a i(t-1) x n- 1 mod q.

[0085] S422, It means that after each committee member calculates his own n-1 key shares, he sends his generated j-th key share to the j-th committee member. j Receive n-1 other valid key shares sk ij After that, the j-th private key shard can be recovered based on the j-th key share generated by the remaining committee members.

[0086] Exemplarily, the j-th private key shard may satisfy the following formula:

[0087]

[0088] Among them, sk j Shard the jth private key.

[0089] S423, Indicates that committee members generate preliminary preparation parameters for subsequent signatures.

[0090] Specifically, the i-th committee member can select the i-th second random number k between [1,q-1] i , (i=1,2,……,t); then select the i-th third random number b i Any committee member can calculate based on all the second random numbers: in It is x i The result is rounded, r is the first element of the anonymous pass and is part of the anonymous pass. Any committee member generates the third pass parameter based on all the second random numbers, the third random numbers, the message hash value and the order of the cyclic addition group. The user's attribute information is hashed to obtain the message hash value.

[0091] Exemplarily, the third pass parameter may satisfy the following formula:

[0092]

[0093] in, is the third pass parameter.

[0094] S424, It indicates that the i-th committee member generates the i-th first pass parameter and the i-th second pass parameter according to the generator, the key recovery threshold value, the order of the cyclic additive group, the message hash value and the second random number.

[0095] In one example, the i-th committee member may generate the i-th first pass parameter based on the message hash value, the order of the cyclic addition group, and the key recovery threshold value.

[0096] Exemplarily, the i-th first pass parameter may satisfy the following formula:

[0097] e i =(et -1 ),od q

[0098] Among them, e i is the i-th first pass parameter, and e=H(v) is the message hash value.

[0099] In one example, the i-th committee member may generate the i-th second pass parameter based on the second random number, the order of the cyclic additive group, and the key recovery threshold value.

[0100] Exemplarily, the i-th second pass parameter may satisfy the following formula:

[0101]

[0102] Among them, c i The i-th second pass parameters.

[0103] S425, It means that based on the threshold ECDSA signature function, an anonymous pass is calculated and generated according to the third random number, the private key shard, the order of the cyclic addition group, the first pass parameter, the second pass parameter and the third pass parameter.

[0104] Exemplarily, the anonymous pass may satisfy the following formula:

[0105]

[0106] Among them, cred is an anonymous pass. is the third pass parameter, b i is the ith third random number, e i is the i-th first pass parameter, sk i For the i-th private key shard, c i is the i-th second pass parameter, r is the first element of the anonymous pass determined according to the second random number, and q is the order of the cyclic additive group.

[0107] Optionally, by q i =(e i +sk i ·c i ·r) mod q can be further simplified to obtain

[0108] Finally, the committee can send the anonymous pass cred=(r,s) to the user.

[0109] Figure 5 Shown is a schematic diagram of the display process of the anonymous pass provided by an embodiment of the present invention.

[0110] Specifically, see Figure 5 , the U.Prove(·) algorithm may include the following steps:

[0111] S511, (a, pk, r)←U.Keygen(1 λ ), indicating that the user generates a second public-private key pair. The second private key a can be the user's anonymous pass cred, and the second public key pk2 = aG. At the same time, a fourth random number r can also be selected 2 .

[0112] S512, (R, c, z)←U.Show(r), indicates that the user calculates the first verification parameter, the third verification parameter, and the second verification parameter in sequence, and sends the first verification parameter and the second verification parameter to the electronic service provider.

[0113] Exemplarily, the third verification parameter may satisfy the following formula:

[0114] c=Hash(pk2,R)

[0115] Among them, Hash() represents a hash function.

[0116] Specifically, see Figure 5 , the S.Verify(·) algorithm can perform the following steps:

[0117] S521, (c)←S.Counter(pk2,R), indicates that the electronic service provider calculates the third verification parameter based on the second public key and the first verification parameter.

[0118] S522, (0,1)←S.Verify(c,z,R), indicates that the electronic service provider verifies whether the calculated third verification parameter and the received first verification parameter and second verification parameter satisfy the verification model, and returns the verification result.

[0119] Since the committee generates the user's anonymous communication certificate based on the threshold ECDSA signature algorithm, and the threshold ECDSA signature algorithm stores the first private key used to generate the anonymous pass in a distributed manner among multiple committee members, even if a single point failure occurs in a committee member, an attacker cannot infer the user's anonymous pass only through the failed single committee member; since the electronic service provider verifies the user's identity through zero-knowledge proof, the electronic service provider cannot obtain the user's identity information from the verification information; therefore, the method provided by the present invention can protect the user's privacy from being leaked.

[0120] Therefore, in one or more of the following scenarios, the protocol provided by the present invention is anonymous, unforgeable and unlinkable: committee members may be bribed, but members with malicious behavior do not exceed the key recovery threshold t; there are malicious electronic service providers trying to guess the user's identity, and there is collusion among multiple malicious electronic service providers; there are dishonest users who try to deceive electronic service providers to obtain services without anonymous passes, but cannot collude with other users.

[0121] Exemplarily, anonymity means that an adversary should be unable to distinguish between two verification information generated by the same anonymous pass used by the same user. The present invention not only has anonymity but also ensures the unlinkability of the anonymous pass.

[0122] Unforgeability means that the electronic service provider can only generate valid proof of identity verification if and only if the user has a valid anonymous pass and the information contained in the pass complies with the security policy. For potential attackers, it is impossible to forge a legitimate anonymous pass and pass the identity verification.

[0123] Unlinkability includes the unlinkability presented by anonymous passes and the unlinkability between anonymous passes.

[0124] Unlinkability of credential presentation means that when the same user uses the same anonymous pass for multiple presentations, the verifier (electronic service provider) and the issuer (committee) cannot infer the association between these presentation processes from the multiple presentations.

[0125] The unlinkability between credentials means that if the same user uses the same attribute information to issue multiple credentials and obtain multiple anonymous passes, the electronic service provider and the committee cannot determine whether these display processes are derived from the same attribute information through the display of these credentials.

[0126] Optionally, unlinkability can ensure that the use of different credentials cannot be easily associated, thereby providing better privacy protection, usually to prevent electronic service providers from associating user access records. However, in some scenarios where association is required, such as user points systems, in order to provide more services, you can choose whether to implement this property according to the requirements of the specific scenario.

[0127] In order to better illustrate the beneficial effects of the protocol provided by the present invention, the following security analysis is performed:

[0128] For example, in the process of security analysis and proof, the system may also include the following oracles and lists:

[0129] Honest user list H_U: uses the variable id to identify the user.

[0130] Corrupted user list C_U: Use the variable id to identify the user and record the user ID corrupted by the adversary.

[0131] Credential query list Q_Show: records the adversary's queries and responses to the Show algorithm.

[0132] Registration record list reg: records user registration information.

[0133] Certificate Oracle O.List_ssk(): The adversary queries the certificate of the user with ID, the oracle performs a table lookup and response, and adds ID to C_U.

[0134] Request certificate oracle O.Request(): The oracle executes the honest Request protocol. The adversary acts as a corrupted certificate authority, and the challenger interacts with the adversary as an honest user. The protocol ends and returns the user's certificate ssk[id].

[0135] Certificate Distribution Oracle O.Issue(): The oracle executes the honest Issue protocol. The adversary acts as a corrupted user id, and the challenger acts as an honest certificate authority to interact with the adversary. The protocol ends, the id is added to C_U, and the user's registration information reg[id] is returned.

[0136] Credential query oracle O.Show(): The adversary calls the Show oracle to query the valid display proof of the honest user id. If the id does not belong to H_U, return ⊥; otherwise, the oracle executes the Show algorithm with the adversary as a malicious verifier. The oracle adds the id to the list Q_Show.

[0137] Figure 6 The diagram shown is a schematic diagram of an anonymity certification process provided by an embodiment of the present invention.

[0138] Specifically, see Figure 6 , the anonymity of the protocol provided by the present invention can be proved through the following process.

[0139] Simulator S interacts with adversary A and executes a distributed anonymous pass protocol based on threshold ECDSA signature. Simulator S initializes the system and generates all system parameters. Adversary A, as a corrupt committee member, calls the key generation algorithm to generate the first public-private key pair (sk1, pk1). Adversary A can make the following oracle inquiries.

[0140] O.Request(k): Simulator S interacts with adversary A and executes<Request,Issue> Protocol, add k to the H_U list, the simulator acts as an honest user k, generates an anonymous pass cred. Adversary A holds sk for interaction and returns ssk[k] = (r, s).

[0141] O.Show(k): Adversary A queries the anonymous pass of user i. If k∈H_U, the simulator executes the U.Show algorithm and generates θ=(c,z,R) in response, adding (k,θ) to Q_Show.

[0142] O.List_ssk(k): The adversary asks for the credential of identity k, the simulator retrieves the query list and answers, and finally adds k to C_U.

[0143] According to the above oracle query process, adversary A outputs user k 0 , user k 1 Identification, if k 0 ,k 1 ∈H_U, Then the simulator S selects one of the users to generate his anonymous pass and sends the simulated display credential θ *=(c,z,R) is returned to the adversary A, who guesses which user the credential comes from and outputs his guess result b′. Due to the zero-knowledge property of zero-knowledge proof, it is guaranteed that no information about the user's identity will be leaked to the adversary during the credential display phase, so the adversary cannot distinguish. So far, it can be proved that the distributed anonymous pass protocol based on threshold ECDSA signature is anonymous.

[0144] Figure 7 The figure shows a schematic diagram of the unforgeability certification process provided by an embodiment of the present invention.

[0145] Specifically, see Figure 7 , the unforgeability of the protocol provided by the present invention can be proved through the following process.

[0146] Simulator S interacts with adversary A and executes a distributed anonymous pass protocol based on threshold ECDSA signature. During the whole process, simulator S receives the public key instance y=xG of threshold ECDSA signature. The specific proof of the protocol is as follows: simulator S first initializes the system and generates all system parameters, then calls the key generation algorithm and sends the first public key y as pk1 to adversary A. The adversary interacts with simulator S as an incubated user and performs oracle query as follows:

[0147] OH(·): Hash oracle query. Adversary A selects a specific string {0,1} during this process * As input, simulator S then calculates Q H If the same value exists in the list, the simulator S will return the corresponding element. Otherwise, if it does not exist, the simulator S will simulate and select a random number c∈Z q Make a response.

[0148] O.Issue(k): Simulator S interacts with adversary A and executes<Request,Issue> The protocol adds k to the C_U list, and the adversary starts to inquire. The simulator interacts with the adversary as a member of the honest committee. When receiving the adversary's inquiry information, the simulator S calls the verification link of the zero-knowledge proof. If the verification is valid, the simulator S replays this process, calls the Extract() algorithm, and then extracts the query message H(v). S internally queries the threshold ECDSA signature of the message H(v), and the challenger sends the feedback threshold ECDSA signature to the simulator S, and S sends the signature to the adversary A.

[0149] O.Show(k): Adversary A queries the anonymous pass of identifier k. If k∈H_U, the simulator executes the Show algorithm and generates θ=(c,z,R) in response, adding (k,θ) to Q_Show.

[0150] O.List_ssk(k): Adversary A asks for the credential of k, the simulator retrieves the query list and answers, and finally adds k to C_U.

[0151] According to the above oracle query process, adversary A forges θ * If the verification algorithm fails, the interaction with the adversary will be interrupted. If the adversary's forged credentials pass the verification, the identifier k is asked to perform the kth hash query and the output is (k, θ * ). Then, according to the fork lemma, two forged certificates can be generated by replaying the operation: θ * =(c,z,R) and By expanding, the simulator extracts (r,s) as the threshold ECDSA signature and sends it to the challenger, thus winning the experiment.

[0152] In summary, if there is an adversary A who can forge an anonymous pass based on a threshold ECDSA signature with a non-negligible probability ε(λ), then there must be an imitator who can forge a threshold ECDSA signature, thereby breaking the discrete logarithm problem on the elliptic curve. Therefore, the protocol provided by the present invention has an unforgeable proof.

[0153] In the above embodiments, the description of each embodiment has its own emphasis. For the part that is not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

Claims

1. A distributed anonymous communication method based on threshold ECDSA signature, characterized in that: The method is applied to a distributed anonymous communication system based on threshold ECDSA signature, the system includes a committee and an electronic service provider, the committee includes multiple committee members, and the method includes: The committee members perform security verification on the user based on the commitment value sent by the user and the user's attribute information; The committee member generates an anonymous pass of the security user based on the threshold ECDSA signature algorithm and attribute information of the security user, wherein the threshold ECDSA signature algorithm stores a first private key in a distributed manner among the committee members, the first private key is used to generate the anonymous pass, and the security user is a user who has passed the security verification; The electronic service provider authenticates the user according to the verification information sent by the user to provide services to the user who has passed the identity authentication, wherein the verification information is a zero-knowledge proof generated by the user according to the anonymous pass.

2. The method according to claim 1, characterized in that The commitment value of the security user satisfies the following formula: C=r1·G+v·H Among them, C is the commitment value, r1 is the first random number, v is the attribute information of the user, H is a point on the elliptic curve, and G is the generator of the cyclic additive group.

3. The method according to claim 2, characterized in that The committee member generates an anonymous pass for the security user based on the threshold ECDSA signature algorithm and attribute information of the security user, including: The i-th committee member recovers the i-th private key shard, wherein all the private key shards constitute the first private key; The i-th committee member generates the i-th first pass parameter and the i-th second pass parameter according to the generator, the key recovery threshold value, the order of the cyclic addition group, the message hash value and the second random number, wherein the message hash value is obtained by performing a hash operation on the attribute information of the security user; The committee member generates a third pass parameter according to the message hash value, the order of the cyclic addition group, the second random number and the third random number; The committee member generates the anonymous pass based on the third random number, the private key shard, the order of the cyclic additive group, the first pass parameter, the second pass parameter and the third pass parameter.

4. The method according to claim 3, characterized in that The i-th committee member recovers the i-th private key shard, including: The i-th committee member selects t polynomial coefficients, where t is the key recovery threshold value; The i-th committee member generates the j-th key share according to the polynomial coefficients, the order of the cyclic additive group and the identity of the j-th committee member, where i and j are both integers greater than or equal to 1 and less than or equal to n, and n is the total number of the committee members; The i-th committee member generates the i-th private key shard according to the i-th key share generated by each of the committee members.

5. The method according to claim 3, characterized in that: The i-th committee member generates the i-th first pass parameter and the i-th second pass parameter according to the generator, the key recovery threshold value, the order of the cyclic addition group, the message hash value and the second random number, including: The i-th committee member generates the i-th first pass parameter according to the message hash value, the order of the cyclic addition group and the key recovery threshold value; The i-th committee member generates the i-th second pass parameter according to the second random number, the order of the cyclic additive group and the key recovery threshold value.

6. The method according to claim 3, characterized in that The anonymous pass satisfies the following formula: Among them, cred is the anonymous pass, is the third pass parameter, b i is the ith third random number, e i is the i-th first pass parameter, sk i For the i-th private key shard, c i is the i-th second pass parameter, r is the first element of the anonymous pass determined according to the second random number, and q is the order of the cyclic additive group.

7. The method according to claim 2, characterized in that The verification information includes a first verification parameter and a second verification parameter; The first verification parameter satisfies the following formula: R=r2G Wherein, R is the first verification parameter, r2 is the fourth random number, and G is the generator; The second verification parameter satisfies the following formula: z=r2+c·sk2 Among them, z is the second verification parameter, sk2 is the second private key, and c is the third verification parameter.

8. The method according to claim 7, characterized in that The electronic service provider verifies the user's identity according to the verification information sent by the user, including: The electronic service provider calculates the third verification parameter based on the second public key and the first verification parameter; The electronic service provider determines whether the first verification parameter, the second verification parameter, and the third verification parameter satisfy a verification model; If the first verification parameter, the second verification parameter and the third verification parameter satisfy the verification model, the user's identity authentication is passed.

9. The method according to claim 8, characterized in that The verification model satisfies the following formula: z·G=R+c·pk2 Among them, pk2 is the second public key.

10. A distributed anonymous communication system based on threshold ECDSA signature, characterized in that: include: A committee, the committee comprising a plurality of committee members, the committee members being used to perform security verification on the user according to the commitment value sent by the user and the attribute information of the user; The committee members are further used to generate an anonymous pass of the security user based on the threshold ECDSA signature algorithm according to the attribute information of the security user, wherein the threshold ECDSA signature algorithm stores a first private key in the committee members in a distributed manner, the first private key is used to generate the anonymous pass, and the security user is a user who has passed the security verification; An electronic service provider, the electronic service provider is used to authenticate the user according to the verification information sent by the user, so as to provide services to the user who has passed the identity authentication, wherein the verification information is a zero-knowledge proof generated by the user according to the anonymous pass.

Images