Anti-quantum security-oriented identity-based multivariable ring signature method and system

Abstract

The invention provides an anti-quantum security-oriented identity-based multivariable ring signature method and system. The system comprises a key distribution module, a signature end module and a verification end module, completing identity mapping according to the user identity information, and generating a private key pair of the user; the signature user constructs a signature ring, generates an anonymous signature and outputs a signature vector; and the verifier verifies the signature and judges whether the signature is valid or not. According to the method, an identity-based signature mechanism and a UOV structure are fused, the signature efficiency and deployment flexibility of the system in a post-quantum environment are improved, the capability of resisting quantum computing threats is achieved, currently known multivariate algebraic attacks can be effectively prevented, and high security guarantee is achieved; according to the method, a ring signature mechanism is introduced, any members in the ring are supported to generate verifiable signatures, identity information of the members is effectively hidden, the method is particularly suitable for application scenes with high requirements for signer privacy, and the method has the advantages of being untraceable for signers, lightweight in public keys, resistant to quantum attacks and the like.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an identity-based multivariate ring signature method and system for quantum security. Background Art

[0002] With the rapid development of quantum computing technology, traditional public-key cryptography based on large integer factorization and discrete logarithms is facing unprecedented security threats. Mainstream signature schemes, including RSA and ECC, are no longer secure against quantum algorithms like Shor's. To address this challenge, academia and industry are conducting extensive research on post-quantum cryptography (PQC), with multivariate public-key cryptography (MPKC) being considered one of the most promising candidates.

[0003] The multivariate public key cryptography (MPKC) scheme focuses on solving multivariate quadratic equations. It has good security and signature efficiency in quantum environments and is particularly suitable for scenarios with limited computing resources. However, in practical applications, it still faces problems such as lengthy public keys and difficult key distribution.

[0004] Furthermore, forward-secure ring signatures are a special type of ring signature that, in addition to the unforgeability and anonymity of standard ring signatures, also provide forward security for the user's private key. This means that even if a user's private key is leaked at a certain point in time, the security of the user's signatures prior to that point remains intact. Therefore, they can be used for anonymous authentication in ad hoc networks. Furthermore, identity-based forward-secure ring signatures eliminate the additional storage and computational overhead associated with public key certificates, resulting in improved efficiency. However, current forward-secure ring signature schemes are based on traditional hard problems, making them vulnerable to quantum computer attacks and lacking high security. Summary of the Invention

[0005] In response to the shortcomings of the existing technology, the present invention provides a quantum-resistant identity-based multivariable ring signature method and system to solve the problems of insufficient security in the signature system, complex public key management, and inability to achieve anonymity of the signing user in the existing technology.

[0006] The technical solution of the present invention is: an identity-based multivariate ring signature method for quantum security, comprising the following steps:

[0007] S1) According to the user identity information ID i Complete identity mapping and generate the user's private key pair sk i ;

[0008] S2) The signing user constructs a signature ring and generates an anonymous signature, and outputs a signature vector;

[0009] S3) The verifier verifies the signature to determine whether it is valid.

[0010] As a preferred method, in step S1), according to the user identity information ID i Complete identity mapping and generate keys, including the following steps:

[0011] S11), initialize a finite field F q As the basic calculation space, the structural parameters of the unbalanced oil-vinegar structure UOV for multivariate signature are determined;

[0012] S12), according to each user ID i , and convert the user identity into a vector identity parameter U through a hash function or linear transformation i ; and use the user's identity parameters to generate the user-specific affine transformation T i ;

[0013] S13) Constructing the central polynomial Q based on the unbalanced oil-vinegar structure UOV structure i ;

[0014] S14), combined with the user's affine transformation T i Central polynomial Q i Form a private key pair sk i =(Q i ,T i ), and further combined to obtain the public key function p for signing and verification i ,Right now:

[0015]

[0016] In the formula, the symbol Represents function composition, that is, public key function P i By the central polynomial Q i With the affine transformation T i Composite to form a complete public key function for signing and verification process;

[0017] Preferably, in step S2), the signing user constructs a signature ring and generates an anonymous signature, and outputs a signature vector; specifically, the steps include:

[0018] S21), the signing user from a set of user identity information {ID1, ID2, ..., ID n} builds a signature ring, arbitrarily selects itself as the sth ring member; and calculates the hash summary w of the message to be signed m as the final target of the signature mapping, that is:

[0019] w=H(m);

[0020] Where H represents the hash function. The hash digest obtained by hashing the message m is used to construct the target value of the signature mapping to ensure the tamper-resistance and collision-resistance of the signature.

[0021] S22), the signing user s randomly generates input vectors for all other users And calculate the public key function mapping value P of other users i (z u );

[0022] S23) Map the public key functions of all other users to value P u (z i ) is accumulated to obtain the intermediate mapping result w1; that is:

[0023] w1=∑ i≠s P i (z i );

[0024] S24) Construct the residual value w′ according to the hash summary w and the intermediate mapping result w1, that is:

[0025] w′=w-w1;

[0026] S25), the signing user s uses its private key to sk s =(Q s ,T s ) Calculate the signature user s input vector z s , ensuring that its mapping result accurately matches the target w′;

[0027] S26), the signing user s inputs it into the vector z s With all non-signed user input vectors z i Combine to form a complete signature vector σ=(z1,z2,…,z n ).

[0028] As a preferred step S25), the signing user s uses its private key to sk s =(Q s ,T s ) Calculate the input vector z of the signature user s s , specifically:

[0029] Randomly select vinegar variables v1,…,v v ∈F q , and substitute it into the central polynomial Q s Transform it into a system of linear equations about oil variables;

[0030] Solve the linear equations to get the oil variable vector o1,…,o0, and combine it with the vinegar variable to get

[0031] Through the inverse affine transformation Calculate the signer input vector z s .

[0032] Preferably, in step S3), the verifier verifies the signature to determine whether the signature is valid; specifically, the steps include:

[0033] S31), the verifier receives the message to be signed m and the signature vector σ, and independently calculates the hash digest w=H(m) of the message m through the hash function, and uses it for subsequent verification and comparison;

[0034] S32), according to the identities listed in the signature {ID1, ..., ID n}Reconstruct each user's public key function P i ;

[0035] S33) The verifier takes the input vector z of each signature in turn. i Substitute the corresponding P i , calculate the public key function mapping value P i (z i ); and all users' verification vectors

[0036] S34) The verifier compares the verification vector w″ with the hash digest w in step S31). If the two are equal, the signature is judged to be valid, indicating that the signature is indeed generated by a member of the signature ring and remains intact; if they are inconsistent, the signature is judged to be invalid.

[0037] Preferably, the present invention further provides an identity-based multivariate ring signature system for quantum security, comprising:

[0038] The key distribution module is used to generate a private key pair for each user that is bound to their identity;

[0039] The signature module is used to build a signature ring for the user, initiate anonymous signature requests and perform signature operations in the signature ring;

[0040] The verification module is used by the verification party to verify the signature and determine whether the signature is valid.

[0041] Preferably, the key distribution module includes an identity resolution unit, a public key generation unit, and a key distribution unit connected in sequence;

[0042] The identity resolution unit is based on each user's identity information ID i Generate a uniquely bound affine transformation T i ;

[0043] The public key generation unit is used to construct a central polynomial Q based on the unbalanced oil-vinegar structure UOV structure i , and combined with the affine transformation T i Form a private key pair sk i =(Q i ,T i ), and further combined to obtain the public key function P for signing and verification i ,Right now:

[0044]

[0045] In the formula, the symbol Represents function composition, that is, public key function P i By the central polynomial Q i With the affine transformation T i Composite to form a complete public key function for signing and verification process;

[0046] The key distribution unit generates the central polynomial Q generated by the public key generation unit i and inverse affine transform It is also distributed to the corresponding user as the private key for the signing process.

[0047] As an example, the identity resolution unit converts the user information ID into i The identity parameter U converted to vector form i , and then the identity parameters generate the user's uniquely bound affine transformation T i .

[0048] As a preference, the key distribution module is based on the finite field F q Operation, the constructed central polynomial Q i Satisfy the unbalanced oil-vinegar structure UOV structure, that is:

[0049]

[0050] Where v is the number of vinegar variables; o is the number of oil variables; n is the total number of variables, and n=o+

[0051] v; and the number of oil variables o and the number of vinegar variables v satisfy the imbalance condition: v>o, to ensure the reversibility of the central mapping under the condition of fixed vinegar variables; a jk is the vinegar variable v in the central polynomial j and v k The quadratic cross-term coefficient between j With v k is the vinegar variable; b ij Vinegar variable v j and oil variable o iThe quadratic cross coefficient of ;

[0052] c k is the coefficient of the first-order term and k covers all variables; x k is the total variable vector (i.e. the concatenation of all oil and vinegar variables); d is a constant term.

[0053] Preferably, the signature end module includes a hash summary calculation unit, a pseudo-signature construction unit, an intermediate value solution unit, a center mapping solution unit and a signature combination unit;

[0054] The hash summary calculation unit is used to build a signature ring and calculate the hash summary w according to the message m to be signed input by the signing user;

[0055] The pseudo-signature construction unit is used to randomly generate input vector z for all ring members except the actual signing user. i ;

[0056] The intermediate value solving unit is used to calculate the residual value between the hash summary of the message to be signed and the pseudo signature;

[0057] The center mapping solution unit is used to obtain the input vector of the real signature through the inverse process of the center mapping;

[0058] The signature combination unit is used to combine all the user's input vectors (wherein each input vector is obtained by random generation or private key solution, and its elements include the oil variable subvector o i With the vinegar variable vector v i The concatenation forms a signature vector σ as the complete signature result.

[0059] As a preference, the signing user is selected from a set of user identity information {ID1, ID2, ..., ID n} builds a signature ring, arbitrarily selects itself as the sth ring member; and calculates the hash summary w of the message to be signed m as the final target of the signature mapping, that is:

[0060] w=H(m);

[0061] Where H represents the hash function. The hash digest obtained by hashing the message m is used to construct the target value of the signature mapping to ensure the tamper-resistance and collision-resistance of the signature.

[0062] As an example, the intermediate value solving unit first calculates the value of the input vector z of other users except the actual signing user. i Calculate the public key function mapping value P of other users i (z i );

[0063] Then all other users' public key function mapping values P i(z i ) is accumulated to obtain the intermediate mapping result w1; that is:

[0064] w1=∑ i≠s P i (z i );

[0065] Finally, the residual value w′ is constructed based on the hash summary w and the intermediate mapping result w1, that is:

[0066] w′=w-w1.

[0067] As an example, the central mapping solution unit uses the private key of the signature user s to sk s =(Q s ,T s ) Calculate the input vector z of the signature user s s , ensuring that its mapping result exactly matches the target w′.

[0068] Preferably, the verification end module includes a hash calculation unit for performing a hash operation on the message to be signed to generate a hash digest, a public key mapping calculation unit, and a verification judgment unit;

[0069] The hash calculation unit is used to receive the message to be signed m and the signature vector σ, and calculate the hash summary w according to the hash function;

[0070] The public key mapping calculation unit is used to calculate the public key mapping according to the input vector z of each signature vector. i Calculate the public key function mapping value P i (z i ), and calculate the verification vector w″ according to the mapping value;

[0071] The verification judgment unit is used to compare the verification vector w″ and the hash summary w to determine whether the signature is valid and complete the signature verification.

[0072] The beneficial effects of the present invention are:

[0073] 1. This invention is based on a multivariate public-key cryptosystem, has the ability to resist the threat of quantum computing, can effectively prevent currently known multivariate algebraic attacks, and has a high level of security.

[0074] 2. This invention combines the identity-based signature mechanism with the UOV structure, improving the signature efficiency and deployment flexibility of the system in a post-quantum environment. Compared with existing post-quantum signature schemes, the public key of this invention can be directly derived from the user identity, with the advantages of shorter public key length and more convenient key management, and is particularly suitable for the deployment of certificateless signature systems;

[0075] 3. This invention introduces a ring signature mechanism that allows any member in the ring to generate a verifiable signature while effectively hiding their identity information. This is particularly suitable for application scenarios with high requirements for the privacy of the signer. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Figure 1 Schematic diagram of the process of Example 1 of the present invention;

[0077] Figure 2 This is a structural framework diagram of the system of Example 2 of the present invention. DETAILED DESCRIPTION

[0078] The specific embodiments of the present invention will be further described below with reference to the accompanying drawings:

[0079] Example 1

[0080] like Figure 1 As shown, this embodiment provides an identity-based multivariate ring signature method for quantum security, including the following steps:

[0081] S1) According to the user identity information ID i Complete identity mapping and generate the user's private key pair sk i ; Specifically include the following steps:

[0082] S11), initialize a finite field F q As a basic computational space, the structural parameters of the unbalanced oil-vinegar structure UOV for the multivariate signature are determined. In this embodiment, the structural parameters of the UOV include the total number of variables n, the number of vinegar variables v, and the number of oil variables o. The number n = o + v satisfies the unbalanced condition that the number of oil variables o and the number of vinegar variables v satisfy v>o, thereby ensuring the reversibility of the central mapping under the condition of fixed vinegar variables.

[0083] S12), according to each user ID i , and through the identity hash function H ID Convert the user identity into a vector of identity parameters U i , and using the user's identity parameter U i Generate user-specific affine transformation T i ;

[0084] S13) Constructing the central polynomial Q based on the unbalanced oil-vinegar structure UOV structure i ;

[0085] S14), combined with the user's affine transformation T i Central polynomial Q i Form a private key pair sk i =(Q i ,T i), and further combined to obtain the public key function P for signing and verification i ,Right now:

[0086] P i =Q i °T i ;

[0087] In the formula, the symbol ° represents function composition, that is, the public key function P i By the central polynomial Q i With the affine transformation T i Composite to form a complete public key function for signing and verification process;

[0088] The specific algorithm can be expressed as follows:

[0089]

[0090]

[0091] S2) The signing user constructs a signature ring and generates an anonymous signature, and outputs a signature vector; specifically, the steps include:

[0092] S21), the signing user from a set of user identity information {ID1, ID2, ..., ID n} builds a signature ring, arbitrarily selects itself as the sth ring member; and calculates the hash summary w of the message to be signed m as the final target of the signature mapping, that is:

[0093] w=H(m);

[0094] Where H represents the hash function. The hash digest obtained by hashing the message m is used to construct the target value of the signature mapping to ensure the tamper-resistance and collision-resistance of the signature.

[0095] S22), the signing user s randomly generates input vectors for all other users in, Represents a finite field F q n-dimensional vector space; and calculate the public key function mapping value P of other users i (z i );

[0096] S23) Map the public key functions of all other users to value P i (z i ) is accumulated to obtain the intermediate mapping result w1; that is:

[0097] w1=∑ i≠s P i (z i );

[0098] S24) Construct the residual value w′ according to the hash summary w and the intermediate mapping result w1, that is:

[0099] w′=w-w1;

[0100] S25), the signing user s uses its private key to sk s =(Q s ,T s ) Calculate the signature user s input vector z s , ensuring that its mapping result accurately matches the target w′; specifically:

[0101] Randomly select vinegar variables v1,…,v v ∈F q , and substitute it into the central polynomial Q s Transform it into a system of linear equations about oil variables;

[0102] Solve the linear equations to get the oil variable vector o1,…,o0, and combine it with the vinegar variable to get

[0103] Through the inverse affine transformation Calculate the signer input vector z s .

[0104] S26), the signing user s inputs it into the vector z s With all non-signed user input vectors z i Combine to form a complete signature vector σ=(z1,z2,…,z n ).

[0105] The specific algorithm can be expressed as follows:

[0106]

[0107]

[0108] S3) The verifier verifies the signature to determine whether it is valid, specifically including the following steps:

[0109] S31) The verifier receives the message m and the signature vector σ, and then calculates the hash summary w = H(m) through the hash function;

[0110] S32), according to the identities listed in the signature {ID1, ..., ID n}Reconstruct each user's public key function P i ;

[0111] S33) The verifier takes the input vector z of each signature in turn. i Substitute the corresponding P i, calculate the public key function mapping value P i (z i ); and all users' verification vectors

[0112] S34) The verifier compares the verification vector w″ with the hash digest w in step S31). If the two are equal, the signature is judged to be valid, indicating that the signature is indeed generated by a member of the signature ring and remains intact; if they are inconsistent, the signature is judged to be invalid.

[0113] The specific algorithm can be expressed as follows:

[0114]

[0115] Example 2

[0116] like Figure 2 As shown, this embodiment provides an identity-based multivariable ring signature system for quantum security, including:

[0117] The key distribution module is used to generate a private key pair for each user that is bound to their identity;

[0118] The signature module is used to build a signature ring for the user, initiate anonymous signature requests and perform signature operations in the signature ring;

[0119] The verification module is used by the verification party to verify the signature and determine whether the signature is valid.

[0120] Preferably, the key distribution module includes an identity resolution unit, a public key generation unit, and a key distribution unit connected in sequence;

[0121] The identity resolution unit is based on each user's identity information ID i Generate a uniquely bound affine transformation T i ;

[0122] The public key generation unit is used to construct a central polynomial Q based on the unbalanced oil-vinegar structure UOV structure i , and combined with the affine transformation T i Form a private key pair sk i =(Q i ,T i ), and further combined to obtain the public key function P for signing and verification i ,Right now:

[0123] P i =Q i °T i ;

[0124] In the formula, the symbol ° represents function composition, that is, the public key function P i By the central polynomial Qi With the affine transformation T i Composite to form a complete public key function for signing and verification process;

[0125] The key distribution unit generates the central polynomial Q generated by the public key generation unit i and inverse affine transform

[0126] It is also distributed to the corresponding user as the private key for the signing process.

[0127] As a preferred embodiment of this invention, the identity resolution unit uses the identity hash function H ID User information ID i The identity parameter U converted to vector form i , and then the identity parameter U i Generate user-unique binding affine transformation T i .

[0128] As a preferred embodiment of this invention, the key distribution module is based on the finite field F q Operation, the constructed central polynomial Q i Satisfy the unbalanced oil-vinegar structure UOV structure, that is:

[0129]

[0130] Where v is the number of vinegar variables; o is the number of oil variables; n is the total number of variables, and satisfies n = o + v; and the number of oil variables o and the number of vinegar variables v meet the imbalance condition: v>o, to ensure the reversibility of the central mapping under the condition of fixed vinegar variables; a jk is the vinegar variable v in the central polynomial j and v k The quadratic cross-term coefficient between j With v k is the vinegar variable; b ij Vinegar variable v j and oil variable o i The quadratic cross coefficient of ;

[0131] c k is the coefficient of the first-order term and k covers all variables; x k is the total variable vector (i.e. the concatenation of all oil and vinegar variables); d is a constant term.

[0132] As a preferred embodiment of the present invention, the signature end module includes a hash summary calculation unit, a pseudo-signature construction unit, an intermediate value solving unit, a central mapping solving unit and a signature combination unit;

[0133] The hash summary calculation unit is used to build a signature ring and calculate the hash summary w according to the message m to be signed input by the signing user;

[0134] The pseudo-signature construction unit is used to randomly generate input vector z for all ring members except the actual signing user. i ;

[0135] The intermediate value solving unit is used to calculate the residual value between the hash summary of the message to be signed and the pseudo signature;

[0136] The center mapping solution unit is used to obtain the input vector of the real signature through the inverse process of the center mapping;

[0137] The signature combination unit is used to combine all the user's input vectors (wherein each input vector is obtained by random generation or private key solution, and its elements include the oil variable subvector o i With the vinegar variable vector v i The concatenation forms a signature vector σ as the complete signature result.

[0138] As a preferred embodiment of this invention, the signing user is from a set of user identity information

[0139] {ID1,ID2,…,ID n} builds a signature ring, arbitrarily selects itself as the sth ring member; and calculates the hash summary w of the message to be signed m as the final target of the signature mapping, that is:

[0140] w=H(m);

[0141] Where H represents the hash function. The hash digest obtained by hashing the message m is used to construct the target value of the signature mapping to ensure the tamper-resistance and collision-resistance of the signature.

[0142] As a preferred embodiment of the present invention, the intermediate value solving unit first calculates the intermediate value based on the input vector z of other users except the actual signing user. i Calculate the public key function mapping value P of other users i (z i );

[0143] Then all other users' public key function mapping values P i (z i ) is accumulated to obtain the intermediate mapping result w1; that is:

[0144] w1=∑ i≠s P i (z i );

[0145] Finally, the residual value w′ is constructed based on the hash summary w and the intermediate mapping result w1, that is:

[0146] w′=w-w1.

[0147] As preferred in this embodiment, the central mapping solution unit uses the private key of the signature user s to sk s =(Q s ,T s ) Calculate the input vector z of the signature user s s , ensuring that its mapping result exactly matches the target w′.

[0148] As a preferred embodiment of the present invention, the verification end module includes a hash calculation unit for performing a hash operation on the message to be signed to generate a hash digest, a public key mapping calculation unit, and a verification judgment unit;

[0149] The hash calculation unit is used to receive the message to be signed m and the signature vector σ, and calculate the hash summary w according to the hash function;

[0150] The public key mapping calculation unit is used to calculate the public key mapping according to the input vector z of each signature vector. i Calculate the public key function mapping value P i (z i ), and calculate the verification vector w″ according to the mapping value;

[0151] The verification judgment unit is used to compare the verification vector w″ and the hash summary w to determine whether the signature is valid and complete the signature verification.

[0152] The above embodiments and descriptions are only for explaining the principles and best embodiments of the present invention. Without departing from the spirit and scope of the present invention, the present invention may be subject to various changes and improvements, which shall fall within the scope of the invention to be protected.

Claims

1. A quantum-resistant identity-based multivariate ring signature method, characterized in that: The steps include: S1) According to the user identity information ID i Complete identity mapping and generate the user's private key pair sk i ; Specifically include the following steps: S11), initialize a finite field F q As the basic calculation space, the structural parameters of the unbalanced oil-vinegar structure UOV for multivariate signature are determined; S12), according to the identity ID of each user i Generate user-specific affine transformation T i ; S13) Constructing the central polynomial Q based on the unbalanced oil-vinegar structure UOV structure i ; S14), combined with the user's affine transformation T i Central polynomial Q i Form a private key pair sk i =(Q i ,T i ), and further combined to obtain the public key function P for signing and verification i ,Right now: In the formula, the symbol ° represents function composition, that is, the public key function P i By the central polynomial Q i With the affine transformation T i Composite to form a complete public key function for signing and verification process; S2) The signing user constructs a signature ring and generates an anonymous signature, and outputs a signature vector; specifically, the steps include: S21), the signing user from a set of user identity information {ID1, ID2, ..., ID n } builds a signature ring, arbitrarily selects itself as the sth ring member; and calculates the hash summary w of the message to be signed m as the final target of the signature mapping, that is: w=H(m); Where H represents the hash function. The hash digest obtained by hashing the message m is used to construct the target value of the signature mapping to ensure the tamper-resistance and collision-resistance of the signature. S22), the signing user s randomly generates input vectors for all other users And calculate the public key function mapping value P of other users i (z i ); S23) Map the public key functions of all other users to value P i (z i ) is accumulated to obtain the intermediate mapping result w1; that is: w1=∑ i≠s P i (z i ); S24) Construct the residual value w′ according to the hash summary w and the intermediate mapping result w1, that is: w′=w-w1; S25), the signing user s uses its private key to sk s =(Q s ,T s ) Calculate the signature user s input vector z s , ensuring that its mapping result accurately matches the target w′; S26), the signing user s inputs it into the vector z s With all non-signed user input vectors z i Combine to form a complete signature vector σ=(z1,z2,…,z n ); S3) The verifier verifies the signature to determine whether it is valid.

2. The quantum-resistant identity-based multivariable ring signature method according to claim 1, characterized in that: In step S12), the user's identity ID is converted to i The identity parameter U converted to vector form i ; and use the user's identity parameters to generate the user-specific affine transformation T i .

3. The quantum-resistant identity-based multivariable ring signature method according to claim 1, characterized in that: In step S25), the signing user s uses its private key to s =(Q s ,T s ) Calculate the input vector z of the signature user s s , specifically: Randomly select vinegar variables v1,…,v v ∈F q , and substitute it into the central polynomial Q s Transform it into a system of linear equations about oil variables; Solve the linear equations to get the oil variable vector o1,…,o0, and combine it with the vinegar variable to get Through the inverse affine transformation Calculate the signer input vector z s .

4. The quantum-resistant identity-based multivariable ring signature method according to claim 1, characterized in that: In step S3), the verifier verifies the signature to determine whether the signature is valid. The steps include: S31) The verifier receives the message m and the signature vector σ, and then calculates the hash summary w = H(m) through the hash function; S32), according to the identities listed in the signature {ID1, ..., ID n }Reconstruct each user's public key function p i ; S33) The verifier takes the input vector z of each signature in turn. i Substitute the corresponding p i , calculate the public key function mapping value p i (z i ); and all users' verification vectors S34) The verifier compares the verification vector w″ with the hash digest w in step S31). If the two are equal, the signature is judged to be valid, indicating that the signature is indeed generated by a member of the signature ring and remains intact; if they are inconsistent, the signature is judged to be invalid.

5. A quantum-resistant identity-based multivariate ring signature system, characterized by: The system implements signature using the method according to any one of claims 1 to 4, and the system comprises: The key distribution module is used to generate a private key pair for each user that is bound to their identity; The signature module is used to build a signature ring for the user, initiate anonymous signature requests and perform signature operations in the signature ring; The verification module is used by the verification party to verify the signature and determine whether the signature is valid; The key distribution module includes an identity resolution unit, a public key generation unit, and a key distribution unit connected in sequence; The identity resolution unit is based on each user's identity information ID i Generate a uniquely bound affine transformation T i ; The public key generation unit is used to construct a central polynomial Q based on the unbalanced oil-vinegar structure UOV structure i , and combined with the affine transformation T i Form a private key pair sk i =(Q i ,T i ), and further combined to obtain the public key function P for signing and verification i ,Right now: In the formula, the symbol ° represents function composition, that is, the public key function P i By the central polynomial Q i With the affine transformation T i Composite to form a complete public key function for signing and verification process; The key distribution unit generates the central polynomial Q generated by the public key generation unit i and inverse affine transform It is also distributed to the corresponding user as part of the private key for the signing process; The signature end module includes a hash summary calculation unit, a pseudo-signature construction unit, an intermediate value solution unit, a central mapping solution unit and a signature combination unit; The hash summary calculation unit is used to build a signature ring and calculate the hash summary w according to the message m to be signed input by the signing user; The pseudo-signature construction unit is used to randomly generate input vector z for all ring members except the actual signing user. i ; The intermediate value solving unit is used to calculate the residual value between the hash summary of the message to be signed and the pseudo signature; The center mapping solution unit is used to obtain the input vector of the real signature through the inverse process of the center mapping; The signature combination unit is used to combine all the user's input vectors (i.e., the variable input value used by each user in the signature mapping, denoted as z i , where each input vector is obtained by random generation or private key solution, and its elements include the oil variable subvector o i With the vinegar variable vector v i The concatenation forms a signature vector σ as the complete signature result.

6. The quantum-resistant identity-based multivariable ring signature system according to claim 5, characterized in that: The key distribution module is based on the finite field F q Operation, the constructed central polynomial Q i Satisfy the unbalanced oil-vinegar structure UOV structure, that is: Where v is the number of vinegar variables; o is the number of oil variables; n is the total number of variables, and satisfies n = o + v; and the number of oil variables o and the number of vinegar variables v meet the imbalance condition: v>o, to ensure the reversibility of the central mapping under the condition of fixed vinegar variables; a jk is the vinegar variable v in the central polynomial j and v k The quadratic cross term coefficient between j With v k is the vinegar variable; b ij Vinegar variable v j and oil variable o i The quadratic cross coefficient of c k is the coefficient of the first-order term and k covers all variables; x k is the total variable vector (i.e. the concatenation of all oil and vinegar variables); d is a constant term.

7. The quantum-resistant identity-based multivariable ring signature system according to claim 5, characterized in that: The signing user is from a set of user identity information {ID1, ID2, ..., ID n } builds a signature ring, arbitrarily selects itself as the sth ring member; and calculates the hash summary w of the message to be signed m as the final target of the signature mapping, that is: w=H(m); Where H represents the hash function. The message m is hashed to obtain the hash digest, which is used to construct the target value of the signature mapping to ensure the tamper-resistance and collision-resistance of the signature.

8. The quantum-resistant identity-based multivariable ring signature system according to claim 5, characterized in that: The intermediate value solving unit first calculates the value of the input vector z of other users except the actual signing user. i Calculate the public key function mapping value P of other users i (z i ); Then all other users' public key function mapping values P i (z i ) is accumulated to obtain the intermediate mapping result w1; that is: w1=∑ i≠s P i (z i ); Finally, the residual value w′ is constructed based on the hash summary w and the intermediate mapping result w1, that is: w′=w-w1.

9. The quantum-resistant identity-based multivariable ring signature system according to claim 8, characterized in that: The central mapping solution unit uses the private key of the signature user s to sk s =(Q s ,T s ) Calculate the input vector z of the signature user s s , ensuring that its mapping result exactly matches the target w′.

10. The quantum-resistant identity-based multivariable ring signature system according to claim 5, characterized in that: The verification end module includes a hash calculation unit for performing a hash operation on the message to be signed to generate a hash summary, a public key mapping calculation unit and a verification judgment unit; The hash calculation unit is used to receive the message to be signed m and the signature vector σ, and calculate the hash summary w according to the hash function; The public key mapping calculation unit is used to calculate the public key mapping according to the input vector z of each signature vector. i Calculate the public key function mapping value P i (z i ), and calculate the verification vector w″ according to the mapping value; The verification judgment unit is used to compare the verification vector w″ and the hash summary w to determine whether the signature is valid and complete the signature verification.

Images