Safe and efficient lattice-based multi-signature method

Abstract

The invention discloses a safe and efficient lattice-based multi-signature method, which introduces an ownership proving mechanism for verifying that a signer holds a legal key pair, and effectively prevents a malicious signer from controlling an aggregation public key to generate a forged signature by forging a public key. And signature participants are organized by adopting a homomorphic commitment mechanism and a tree structure, so that the interaction turns and the communication data volume required in the signature process can be effectively reduced. The tree structure localizes communication between participants, so that the overall bandwidth consumption can be reduced, the aggregation efficiency is improved, and good adaptability and expandability are shown in a large-scale distributed system. Compared with a traditional lattice-based multi-signature scheme, the method has the advantages that through structure optimization and process simplification, the communication data volume and the computing resource consumption can be remarkably reduced while the security is maintained, so that the scheme has higher feasibility and efficiency advantages in practical application.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a secure and efficient lattice-based multi-signature method. Background Technology

[0002] Multi-signature schemes allow a group of participants to jointly generate a digital signature representing their consensus on a message. This approach is particularly useful in scenarios requiring joint authorization, such as multi-signature wallets and blockchain-based smart contracts. For n participants P1, P2, ..., P... n Each participant maintains a key pair (sk i ,pk i ), where sk i This represents the private key, pk i This represents the public key. Each participant independently generates a key pair, ensuring the private key sk is secure. i Keep it private, while public key PK i Then it is made public. Once a consensus is reached on a certain message M, each participant P... i A partial signature σ will be generated. i These partial signatures are then aggregated into a multi-signature σ. The verifier uses all public keys pk1, pk2, ..., pk n And the multi-signature σ, to verify the authenticity of message M.

[0003] In recent years, numerous multi-signature schemes have been proposed, most of which rely on traditional number theory problems. For example, one study proposed a tree-based multi-signature method with good practical performance. However, subsequent analysis revealed that this type of structure is vulnerable to k-sum attacks. To address this issue, further research has developed a secure and efficient two-round interactive multi-signature protocol, effectively improving both the security and practicality of the protocol.

[0004] Nevertheless, with the rapid development of quantum computing technology, traditional number theory-based schemes face significant challenges. In particular, certain quantum algorithms can efficiently solve number theory problems such as discrete logarithms and factorization, which greatly weakens the security of these signature schemes in a quantum environment. To address this issue, researchers have gradually shifted their focus to multi-signature schemes built upon lattice-hard problems. These problems, such as the Shortest Vector Problem (SVP) and the Closest Vector Problem (CVP), are generally considered to possess good quantum resistance.

[0005] Initial progress has been made in multi-signature schemes based on latticework, including protocols for a fixed number of signers and interactive schemes based on homomorphic trapdoor commitment mechanisms. While these schemes show promising security prospects, some efficiency issues remain. For example, some protocols require additional interaction rounds during key generation and do not support public key aggregation during signature verification, thus affecting overall verification efficiency. Therefore, there is an urgent need to design a multi-signature scheme that maintains quantum-resistant security and practical performance while possessing low communication overhead, fewer interaction rounds, and efficient verification capabilities to meet the dual security and efficiency requirements of emerging application scenarios.

[0006] The patent application CN119483980A, entitled "A Multi-Signature Method Based on SIS Trapdoor One-Way Function," proposes a novel lattice-based multi-signature scheme. Utilizing the key homomorphism of the SIS trapdoor one-way function, it enables multiple signers to jointly sign the same message. The scheme introduces the TrapGen algorithm to generate public-private key pairs. During the signing process, the SamplePre algorithm generates uniformly random signature vectors, exhibiting unforgeability and collision resistance. In the public key aggregation and verification stages, a probabilistic selection and matching mapping method is employed. Only a subset of row vectors are randomly selected from multiple public key matrices to construct the aggregated public key and combined signature, significantly reducing storage and verification computational overhead. This method ensures efficient signature validity verification while possessing strong resistance to quantum attacks, making it suitable for multi-party collaborative signing, data authentication in high-security scenarios, and blockchain applications.

[0007] The patent (application publication number CN119675852A), entitled "A Multi-Signature Method with Public Key Aggregation and Traceability," proposes a multi-signature method that combines accountability and privacy protection. By establishing a public key aggregation and signer traceability mechanism, it addresses the difficulty in balancing privacy and regulatory oversight in existing blockchain signature technologies. This solution introduces multiple roles, including a private key generator, signer, combiner, and tracker. It supports identity aggregation, unified public key management, and secure key share distribution. The signing process is based on a bilinear mapping to construct and generate zero-knowledge proofs to ensure the integrity and compliance of the signature. The final signature can be verified not only through publicly available parameters but also, when necessary, by the tracker through a decryption mechanism to identify the actual set of signers. This balances privacy protection and accountability, making it suitable for applications with high security and auditing requirements, such as privacy-preserving blockchain transactions and trusted voting systems.

[0008] The patent (application publication number CN119232392A), entitled "Identity-Based Multisignature System and Method Based on SM9 and Key Segregation," proposes a multisignature scheme combining the domestic cryptographic algorithm SM9 with a key segregation mechanism. By constructing a key generation center, an assistant, a signing user terminal, and a blockchain smart contract module, it achieves dynamic updates and time segregation of signing keys, effectively improving the system's resistance to key leakage. This method employs an identity-based key management system. Users generate temporary keys for signing through the key update process, and the smart contract module is responsible for aggregating and verifying signatures, improving the automation and trustworthiness of multisignatures. The scheme eliminates the need for traditional certificate management, simplifies the construction of trust mechanisms, and ensures the legality and integrity of multi-party signing processes in high-security scenarios such as electronic contracts and e-government. It expands the application of the SM9 algorithm in the field of multisignatures, demonstrating good practicality and security.

[0009] The patent (application publication number CN118573376A), entitled "A Lattice-Based Single-Signature Two-Round Online Multi-Signature Method and System," proposes a novel and efficient lattice-based multi-signature scheme. It overcomes the problem of traditional Fiat-Shamir with Abort schemes requiring multiple rounds of repeated signing to succeed. By constructing a single-signature two-round online interaction process, it significantly reduces the number of repeated signatures and communication overhead. This method introduces an aggregation commitment negotiation mechanism and a rejection sampling result broadcast mechanism based on the DualMS scheme, significantly improving the success rate of signatures without sacrificing security. In the signature process, participants negotiate to select an aggregation commitment from which all signers can pass rejection sampling, achieving the generation of a valid multi-signature in a single protocol. This is suitable for multi-signature scenarios with high concurrency and high security requirements, such as blockchain and electronic contracts, effectively improving the practicality and efficiency of lattice-based cryptography in real-world applications.

[0010] The patent (application publication number CN118573375A), entitled "A Certificateless Key Isolation Proxy Multi-Signature Method," proposes a certificateless proxy multi-signature scheme to achieve key security protection in scenarios where malicious trusted centers exist. It supports one proxy signer representing multiple original signers to complete signing operations. This method combines a key isolation mechanism with time evolution technology, introducing an helper key and private key update mechanism to dynamically evolve the signing key over time, effectively reducing the risk of key leakage. Simultaneously, the scheme abandons the traditional certificate management structure, simplifying the system architecture and key management complexity through certificateless identity authentication and proxy authorization mechanisms. This method balances authoritativeness, security, and efficiency, making it suitable for high-security application scenarios such as multi-signature delegation, distributed collaboration, and blockchain.

[0011] The patent application CN115941205A, entitled "A Multi-Signature Method Based on SM2," proposes an efficient SM2 multi-signature scheme that supports multiple signers jointly signing the same message. This scheme is suitable for security-sensitive applications such as blockchain and finance. The scheme introduces a trusted institution to generate system parameters. During the signing process, each participant generates a temporary key using a random factor and broadcasts their commitment. Multiple rounds of interaction are used to construct the joint signature result. While maintaining the original security of the SM2 algorithm, the scheme enhances the credibility of the data source through zero-knowledge proofs and optimizes the signature structure, making the final signature result more compact than directly concatenating all signatures. This reduces storage and communication overhead, improving the efficiency and practicality of multi-party signing.

[0012] The above methods have all achieved good results, but they also have some shortcomings, mainly:

[0013] 1) Some multi-signature schemes are based on the bilinear pairing or discrete logarithm assumptions, but have been shown to be vulnerable to quantum algorithm attacks and cannot provide sufficient security, thus failing to meet the requirements of post-quantum security.

[0014] 2) In the Gekki multi-signature scheme, there is a need to combat malicious key attacks. Malicious signers might control the aggregated public key by specially selecting their own public key, thereby generating forged multi-signatures. Therefore, in this case, honest signers would treat the forged aggregated signature as a valid multi-signature, thus compromising security.

[0015] 3) The lattice-based multi-signature algorithm uses matrices and vectors to generate signatures. Although it avoids the risk of being broken by quantum algorithms, it is usually accompanied by large storage, communication and computational overhead. Summary of the Invention

[0016] The purpose of this invention is to overcome the shortcomings of the prior art and provide a secure and efficient lattice-based multi-signature method.

[0017] To achieve the above objectives, the technical solution provided by this invention is as follows:

[0018] A secure and efficient lattice-based multi-signature method includes:

[0019] System initialization:

[0020] The system's common parameters pp = (q, n, m, σ, H0, H1, H2) are generated based on the safety parameters; q is a prime number used to divide an infinitely large spatial region into multiple smaller regions with the same pattern; m is a positive integer representing the number of rows in the matrix; n is a positive integer representing the number of columns in the matrix; σ is the Gaussian parameter used in the Gaussian sampling algorithm.

[0021] H0, H1, and H2 are all hash functions;

[0022] Generate signer key:

[0023] Each signer independently generates a pair of public and private keys, where the private key is a matrix sampled from a lattice-discrete Gaussian distribution, and the public key is a pair of matrices that satisfy the MSIS / MLWE problem constructed using the TrapGen algorithm;

[0024] Proof of ownership of the generated key:

[0025] Each signer generates a corresponding proof of ownership for the public and private keys to prevent malicious key attacks;

[0026] Verify the validity of the key pair:

[0027] The ownership proof generated by each signer is used to verify the validity of each signer's public and private keys. If valid, proceed to the next step; otherwise, terminate the multi-signature algorithm.

[0028] Generate multi-signatures:

[0029] The signers are organized using a tree structure, and the signing process is divided into the following stages:

[0030] Declaration phase: The root node signer broadcasts the message to be signed;

[0031] Commitment phase: Each signer generates a random vector locally and calculates a partial commitment value, which is then aggregated upwards level by level;

[0032] Challenge phase: The root node calculates the challenge value and broadcasts it downwards;

[0033] Response phase: Each signer generates a local response vector based on the challenge value and aggregates it upwards level by level. Finally, the root node outputs the aggregated multi-signature.

[0034] Signature verification:

[0035] The verifier uses the aggregated public key to verify the validity of the multi-signature by verifying the norm boundary and the lattice basis relation.

[0036] Furthermore, the process of generating the signer key includes:

[0037] S2-1, Private key S is obtained from... Random sampling is performed. Among them, Let m represent the set of m×m matrices consisting of polynomial ring elements modulo 2q;

[0038] S2-2, respectively from and Select a uniform random matrix and P', then by matrix Concatenate with a negative identity matrix of dimension n to construct a new matrix. Right now Last use calculate Where I n It is an identity matrix of dimension n;

[0039] S2-3. Determine whether matrix T can be decomposed into a form of [T'|-I]. n If the block structure of [] is indivisible, it means that the required structure is not met, and S and P' are reselected; otherwise, it is determined that matrix T' belongs to the space. And calculate matrix P using matrix multiplication P” = T'P', ensuring Next, construct the matrix P = [2P'|2P”+qI] n ] T It satisfies TP=qI n mod2q;

[0040] S2-4. Output the public key (T, P) and the private key S.

[0041] Furthermore, the process of generating proof of key ownership includes:

[0042] S3-1, under discrete Gaussian distribution Randomly select a vector Calculate the commitment value

[0043] S3-2. Calculate the challenge vector using the public key matrix and the commitment value e.

[0044] S3-3, Order Then calculate Where b is a value randomly selected from 0 and 1;

[0045] S3-4, Determining proof of possession Does it meet the requirements? Probability, i.e., whether it is valid; if valid, output the probability. If it is invalid, return to step S3-1.

[0046] Furthermore, the process of verifying the legitimacy of the key pair includes:

[0047] S4-1, will Substitution

[0048] S4-2, Judgment and If the keys are equal, the key pair is considered valid; otherwise, the key pair is considered invalid and the multi-signature algorithm is terminated.

[0049] Furthermore, in the process of generating multi-signatures, a complete binary tree structure is used, where each node only communicates with its parent and child nodes to reduce communication bandwidth and interaction rounds.

[0050] Furthermore, when generating a multi-signature, each signer locally computes the commitment key for the message. in Let {(T1, P1) ... (T) represent the set of key pairs for each signer. n ,P n )}, and (T sum ,P sum )express The specific multi-signature process is as follows:

[0051] S5-1, Declaration Phase: If the current signer is the leader (i.e., the root node of the tree structure), it propagates the message to be signed from top to bottom. If not the leader, they wait to receive messages. Then it is forwarded to the node's child nodes; subsequently, the commitment phase begins.

[0052] S5-2, Commitment Phase

[0053] If this node is a leaf node, then from... and Each of them randomly selects its own vector y j and r j ,calculate and partial commitment value in, Let r be a vector space, which satisfies The key ck represents the commitment key; finally, the calculated partial commitment value is sent to its parent node.

[0054] If this node is neither a leaf nor a root node, this node awaits partial commitment values ​​(com) sent by its child nodes. j Similarly, randomly selected from... and Each randomly selects its own random vector y i and r' i ,calculate Finally, calculate the partial aggregate commitment value. Submit the result to its parent node;

[0055] If this node is the root node, the selection of the random vector and the calculation process are the same as those if this node is a non-leaf and non-root node, and the final calculation result is directly used as the final aggregation commitment com; then, the challenge phase begins.

[0056] S5-3, Challenge Phase

[0057] If this node is the root node, first, calculate the challenge value. Where com is the aggregate commitment value, then calculate Finally, (com,T,P) is passed down to its child nodes;

[0058] If this node is not the root node, it waits for (com, T, P) to be passed from its parent node, and then calculates the value of this node. Then (com,T,P) is passed down to its child nodes, all the way to the leaf nodes, and the same operation is performed. After that, the response phase begins.

[0059] S5-4, Response Phase

[0060] If this node is a leaf node, directly calculate the partial multi-signature z. j =y j +(-1) b S j c j The value of b is randomly selected from 0 and 1; finally, z... j ,r j Pass it up to its parent node;

[0061] If this node is neither a leaf node nor a root node, calculate and in This represents the set of child nodes of this node;

[0062] If this node is the root node, its calculation process is the same as that of a non-leaf and non-root node. The difference is that its final calculation result is no longer passed to the parent node, but is directly output as the final multi-signature (z,r,com).

[0063] Furthermore, accept (z,r,com) as a message. The signature is generated and verified using the aggregated public key. The signature verification process includes:

[0064] S6-1, If ​​the public key set is large Where N represents the number of signers, if the verification algorithm terminates and the verification fails, then proceed to the next step.

[0065] S6-2, Verification and Does it satisfy the condition, where η represents the maximum value of the infinite norm of the signature z? If it does not satisfy the condition, the verification algorithm terminates and the verification fails; otherwise, proceed to the next step.

[0066] S6-3, Verify when N is odd. Whether it is true, or when N is even. If true, output 1; otherwise, output 0.

[0067] Compared with existing technologies, the principles and advantages of this technical solution are as follows:

[0068] 1. Robust Post-Quantum Security Mechanism: This technical solution is built upon lattice-hard problems such as MSIS (Module-SIS) and MLWE (Module-LWE), which remain computationally challenging even under quantum computing models, ensuring the multi-signature scheme maintains high security in the post-quantum era. Compared to traditional schemes based on discrete logarithms, it possesses inherent resistance to quantum attacks and can effectively defend against attacks from quantum algorithms such as Shor's algorithm.

[0069] 2. Anti-malicious key attack capability: This technical solution introduces a POP (Proof of Possession) mechanism to verify that the signer possesses a legitimate key pair, effectively preventing malicious signers from controlling the aggregated public key to generate forged signatures by forging public keys. This mechanism significantly improves the overall security of the system and prevents honest signers from being misled into accepting illegal multi-signatures.

[0070] 3. Efficient Signature Generation and Verification Process: This technical solution employs a homomorphic commitment mechanism and a tree structure to organize signature participants, effectively reducing the number of interaction rounds and the amount of communication data required during the signing process. The tree structure localizes communication between participants, reducing overall bandwidth consumption and improving aggregation efficiency, demonstrating good adaptability and scalability in large-scale distributed systems.

[0071] 4. Significantly optimized communication and computing overhead: Compared with traditional lattice-based multi-signature schemes, this technical solution significantly reduces the amount of communication data and computing resource consumption while maintaining security through structural optimization and process simplification, making the solution more feasible and efficient in practical applications.

[0072] 5. Adaptable to Multiple Application Scenarios: The multi-signature method proposed in this technical solution features flexible parameters and adjustable security levels, making it suitable for various typical application environments such as blockchain, multi-party joint signatures, and digital currency wallets. The security mechanisms, structural design, and performance optimizations supported by the solution provide a solid foundation for practical deployment and facilitate integration and widespread application. Attached Figure Description

[0073] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the services required in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0074] Figure 1 This is a flowchart illustrating the principle of a secure and efficient lattice-based multi-signature method according to an embodiment of the present invention.

[0075] Figure 2 This is a flowchart illustrating the generation of the signer's key in a secure and efficient lattice-based multi-signature method according to an embodiment of the present invention.

[0076] Figure 3 This is a flowchart illustrating the generation of key ownership proof in a secure and efficient lattice-based multi-signature method according to an embodiment of the present invention.

[0077] Figure 4 This is a flowchart illustrating the key ownership verification process in a secure and efficient lattice-based multi-signature method according to an embodiment of the present invention.

[0078] Figure 5 This is a flowchart illustrating the generation of multiple signatures in a secure and efficient lattice-based multiple signature method according to an embodiment of the present invention.

[0079] Figure 6 This is a flowchart illustrating the signature verification process in a secure and efficient lattice-based multi-signature method according to an embodiment of the present invention. Detailed Implementation

[0080] The present invention will be further described below with reference to specific embodiments:

[0081] like Figure 1 As shown in this embodiment, a secure and efficient lattice-based multi-signature method includes the following steps:

[0082] S1. System Initialization:

[0083] The system's common parameters pp = (q, n, m, σ, H0, H1, H2) are generated based on the safety parameters; q is a prime number used to divide an infinitely large spatial region into multiple smaller regions with the same pattern; m is a positive integer representing the number of rows in the matrix; n is a positive integer representing the number of columns in the matrix; σ is the Gaussian parameter used in the Gaussian sampling algorithm.

[0084] H0, H1, and H2 are all hash functions;

[0085] S2. Generate the signer's key:

[0086] Each signer independently generates a pair of public and private keys, where the private key is a matrix sampled from a lattice-discrete Gaussian distribution, and the public key is a pair of matrices that satisfy the MSIS / MLWE problem constructed using the TrapGen algorithm;

[0087] S3, Proof of ownership of the generated key:

[0088] Each signer generates a corresponding proof of ownership for the public and private keys to prevent malicious key attacks;

[0089] S4. Verify the validity of the key pair:

[0090] The ownership proof generated by each signer is used to verify the validity of each signer's public and private keys. If valid, proceed to the next step; otherwise, terminate the multi-signature algorithm.

[0091] S5. Generate multi-signatures:

[0092] The signers are organized using a tree structure, and the signing process is divided into the following stages:

[0093] Declaration phase: The root node signer broadcasts the message to be signed;

[0094] Commitment phase: Each signer generates a random vector locally and calculates a partial commitment value, which is then aggregated upwards level by level;

[0095] Challenge phase: The root node calculates the challenge value and broadcasts it downwards;

[0096] Response phase: Each signer generates a local response vector based on the challenge value and aggregates it upwards level by level. Finally, the root node outputs the aggregated multi-signature.

[0097] S6. Signature Verification:

[0098] The verifier uses the aggregated public key to verify the validity of the multi-signature by verifying the norm boundary and the lattice basis relation.

[0099] In the above, such as Figure 2 As shown, the process of generating the signer key includes:

[0100] S2-1, Private key S is obtained from... Random sampling is performed. Among them, Let m represent the set of m×m matrices consisting of polynomial ring elements modulo 2q;

[0101] S2-2, respectively from and Select a uniform random matrix and P', then by matrix Concatenate with a negative identity matrix of dimension n to construct a new matrix. Right now Last use calculate Where I n It is an identity matrix of dimension n;

[0102] S2-3. Determine whether matrix T can be decomposed into a form of [T'|-I]. n If the block structure of [] is indivisible, it means that the required structure is not met, and S and P' are reselected; otherwise, it is determined that matrix T' belongs to the space. And calculate matrix P using matrix multiplication P” = T'P', ensuring Next, construct the matrix P = [2P'|2P”+qI] n ] T It satisfies TP=qI n mod2q;

[0103] S2-4. Output the public key (T, P) and the private key S.

[0104] In the above, such as Figure 3 As shown, the process of generating proof of key ownership includes:

[0105] S3-1, under discrete Gaussian distribution Randomly select a vector Calculate the commitment value

[0106] S3-2. Calculate the challenge vector using the public key matrix and the commitment value e.

[0107] S3-3, Order Then calculate Where b is a value randomly selected from 0 and 1;

[0108] S3-4, Determining proof of possession Does it meet the requirements? Probability, i.e., whether it is valid; if valid, output the probability. If it is invalid, return to step S3-1.

[0109] In the above, such as Figure 4 As shown, the process of verifying the legitimacy of a key pair includes:

[0110] S4-1, will Substitution

[0111] S4-2, Judgment and If the keys are equal, the key pair is considered valid; otherwise, the key pair is considered invalid and the multi-signature algorithm is terminated.

[0112] Specifically, in the process of multi-signature generation, a tree structure is introduced to organize the signers. One signer is randomly selected as the root node of this tree structure, numbered 1, and the remaining signers are numbered from 2 to n. The root node then organizes the numbers into a complete binary tree and stores this structure in an array; this storage method is also called sequential storage. Finally, the array is broadcast to all other signers, thus allowing all signers to know their position in the tree structure. In this structure, each signer only interacts with its parent and child nodes, thereby reducing communication bandwidth. Furthermore, this structure allows for the generation of sub-multi-signatures for any subtree of the tree structure. In addition, the tree structure distributes the aggregation task among the parent nodes, reducing the centralized computational burden and improving aggregation efficiency.

[0113] Each signer computes the commitment key for the message locally. in Let {(T1, P1) ... (T) represent the set of key pairs for each signer. n ,P n )}, and (T sum ,P sum )express like Figure 5 As shown, the specific multi-signature process is as follows:

[0114] S5-1, Declaration Phase: If the current signer is the leader (i.e., the root node of the tree structure), it propagates the message to be signed from top to bottom. If not the leader, they wait to receive messages. Then it is forwarded to the node's child nodes; subsequently, the commitment phase begins.

[0115] S5-2, Commitment Phase

[0116] If this node is a leaf node, then from... and Each of them randomly selects its own vector y j and r j ,calculate and partial commitment value in, Let r be a vector space, which satisfies The key ck represents the commitment key; finally, the calculated partial commitment value is sent to its parent node.

[0117] If this node is neither a leaf nor a root node, this node awaits partial commitment values ​​(com) sent by its child nodes. j Similarly, randomly selected from... and Each randomly selects its own random vector y i and r' i ,calculate Finally, calculate the partial aggregate commitment value. Submit the result to its parent node;

[0118] If this node is the root node, the selection of the random vector and the calculation process are the same as those if this node is a non-leaf and non-root node, and the final calculation result is directly used as the final aggregation commitment com; then, the challenge phase begins.

[0119] S5-3, Challenge Phase

[0120] If this node is the root node, first, calculate the challenge value. Where com is the aggregate commitment value, then calculate Finally, (com,T,P) is passed down to its child nodes;

[0121] If this node is not the root node, it waits for (com, T, P) to be passed from its parent node, and then calculates the value of this node. Then (com,T,P) is passed down to its child nodes, all the way to the leaf nodes, and the same operation is performed. After that, the response phase begins.

[0122] S5-4, Response Phase

[0123] If this node is a leaf node, directly calculate the partial multi-signature z. j =y j +(-1) b S j c j The value of b is randomly selected from 0 and 1; finally, z... j ,r j Pass it up to its parent node;

[0124] If this node is neither a leaf node nor a root node, calculate and in This represents the set of child nodes of this node;

[0125] If this node is the root node, its calculation process is the same as that of a non-leaf and non-root node. The difference is that its final calculation result is no longer passed to the parent node, but is directly output as the final multi-signature (z,r,com).

[0126] In the above, such as Figure 6 As shown, (z,r,com) is accepted as a message. The signature is generated and verified using the aggregated public key. The signature verification process includes:

[0127] S6-1, If ​​the public key set is large Where N represents the number of signers, if the verification algorithm terminates and the verification fails, then proceed to the next step.

[0128] S6-2, Verification and Does it satisfy the condition, where η represents the maximum value of the infinite norm of the signature z? If it does not satisfy the condition, the verification algorithm terminates and the verification fails; otherwise, proceed to the next step.

[0129] S6-3, Verify when N is odd. Whether it is true, or when N is even. If true, output 1; otherwise, output 0.

[0130] The above-described embodiments are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Therefore, any changes made in accordance with the shape and principle of the present invention should be covered within the protection scope of the present invention.

Claims

1. A secure and efficient lattice-based multi-signature method, characterized in that, include: System initialization: The system's common parameters pp = (q, n, m, σ, H0, H1, H2) are generated based on security parameters; q is a prime number used to divide an infinitely large spatial region into multiple smaller regions with the same pattern; m is a positive integer representing the number of rows in the matrix; n is a positive integer representing the number of columns in the matrix; σ is the Gaussian parameter used in the Gaussian sampling algorithm; H0, H1, and H2 are all hash functions. Generate signer key: Each signer independently generates a pair of public and private keys, where the private key is a matrix sampled from a lattice-discrete Gaussian distribution, and the public key is a pair of matrices that satisfy the MSIS / MLWE problem constructed using the TrapGen algorithm; Proof of ownership of the generated key: Each signer generates a corresponding proof of ownership for the public and private keys to prevent malicious key attacks; Verify the validity of the key pair: The ownership proof generated by each signer is used to verify the validity of each signer's public and private keys. If valid, proceed to the next step; otherwise, terminate the multi-signature algorithm. Generate multi-signatures: The signers are organized using a tree structure, and the signing process is divided into the following stages: Declaration phase: The root node signer broadcasts the message to be signed; Commitment phase: Each signer generates a random vector locally and calculates a partial commitment value, which is then aggregated upwards level by level; Challenge phase: The root node calculates the challenge value and broadcasts it downwards; Response phase: Each signer generates a local response vector based on the challenge value and aggregates it upwards level by level. Finally, the root node outputs the aggregated multi-signature. Signature verification: The verifier uses the aggregated public key to verify the validity of the multi-signature by verifying the norm boundary and the lattice basis relation.

2. The secure and efficient lattice-based multi-signature method according to claim 1, characterized in that, The process of generating a signer key includes: S2-1, Private key S is obtained from... Random sampling in the middle; among which, Let m represent the set of m×m matrices consisting of polynomial ring elements modulo 2q; S2-2, respectively from and Select a uniform random matrix and P', then by matrix Concatenate with a negative identity matrix of dimension n to construct a new matrix. Right now Last use calculate Where I n It is an identity matrix of dimension n; S2-3. Determine whether matrix T can be decomposed into a form of [T'|-I]. n If the block structure of [] is indivisible, it means that the required structure is not met, and S and P' are reselected; otherwise, it is determined that matrix T' belongs to the space. And calculate matrix P using matrix multiplication P” = T'P', ensuring Next, construct the matrix P = [2P'|2P”+qI] n ] T It satisfies TP=qI n mod2q; S2-4. Output the public key (T, P) and the private key S.

3. The secure and efficient lattice-based multi-signature method according to claim 1, characterized in that, The process of generating proof of ownership of a key includes: S3-1, under discrete Gaussian distribution Randomly select a vector Calculate the commitment value S3-2. Calculate the challenge vector using the public key matrix and the commitment value e. S3-3, Order Then calculate Where b is a value randomly selected from 0 and 1; S3-4, Determining proof of possession Does it meet the requirements? Probability, i.e., whether it is valid; if valid, output the probability. If it is invalid, return to step S3-1.

4. The secure and efficient lattice-based multi-signature method according to claim 3, characterized in that, The process of verifying the legitimacy of a key pair includes: S4-1, will Substitution S4-2, Judgment and If the keys are equal, the key pair is considered valid; otherwise, the key pair is considered invalid and the multi-signature algorithm is terminated.

5. The secure and efficient lattice-based multi-signature method according to claim 1, characterized in that, The tree structure used in generating multi-signatures is a complete binary tree structure, where each node only communicates with its parent and child nodes to reduce communication bandwidth and interaction rounds.

6. The secure and efficient lattice-based multi-signature method according to claim 5, characterized in that, When generating a multi-signature, each signer locally computes the commitment key for the message. in Let {(T1, P1) ... (T) represent the set of key pairs for each signer. n ,P n )}, and (T sum ,P sum )express The specific multi-signature process is as follows: S5-1, Declaration Phase: If the current signer is the leader (i.e., the root node of the tree structure), it propagates the message to be signed from top to bottom. If not the leader, they wait to receive messages. Then it is forwarded to the node's child nodes; subsequently, the commitment phase begins. S5-2, Commitment Phase If this node is a leaf node, then from... and Each of them randomly selects its own vector y j and r j ,calculate and partial commitment value in, Let r be a vector space, which satisfies The key ck represents the commitment key; finally, the calculated partial commitment value is sent to its parent node. If this node is neither a leaf nor a root node, this node awaits partial commitment values ​​(com) sent by its child nodes. j Similarly, randomly selected from... and Each randomly selects its own random vector y i and r' i ,calculate Finally, calculate the partial aggregate commitment value. Submit the result to its parent node; If this node is the root node, the selection of the random vector and the calculation process are the same as those if this node is a non-leaf and non-root node, and the final calculation result is directly used as the final aggregation commitment com; then, the challenge phase begins. S5-3, Challenge Phase If this node is the root node, first, calculate the challenge value. Where com is the aggregate commitment value, then calculate Finally, (com,T,P) is passed down to its child nodes; If this node is not the root node, it waits for (com, T, P) to be passed from its parent node, and then calculates the value of this node. Then (com,T,P) is passed down to its child nodes, all the way to the leaf nodes, and the same operation is performed. After that, the response phase begins. S5-4, Response Phase If this node is a leaf node, directly calculate the partial multi-signature z. j =y j +(-1) b S j c j The value of b is randomly selected from 0 and 1; finally, z... j ,r j Pass it up to its parent node; If this node is neither a leaf node nor a root node, calculate and in This represents the set of child nodes of this node; If this node is the root node, its calculation process is the same as that of a non-leaf and non-root node. The difference is that its final calculation result is no longer passed to the parent node, but is directly output as the final multi-signature (z,r,com).

7. The secure and efficient lattice-based multi-signature method according to claim 6, characterized in that, Accept (z,r,com) as a message The signature is generated and verified using the aggregated public key. The signature verification process includes: S6-1, If ​​the public key set is large Where N represents the number of signers, if the verification algorithm terminates and the verification fails, then proceed to the next step. S6-2, Verification and Does it satisfy the condition, where η represents the maximum value of the infinite norm of the signature z? If it does not satisfy the condition, the verification algorithm terminates and the verification fails; otherwise, proceed to the next step. S6-3, Verify when N is odd. Whether it is true, or when N is even. If true, output 1; otherwise, output 0.

Images