Strong forward-secure identity-based signature method on lattices

Abstract

The present invention belongs to the field of cryptography, and relates to fields such as identity-based signature mechanisms and lattice cryptography. In order to resist the attack of quantum computers and realize forward-secure and backward-secure signature mechanisms, the present invention provides a strong forward-secure signature method based on lattice cryptography. The method generates a secure key through a trapdoor generation algorithm based on lattice cryptography and a lattice delegation algorithm, so that the method can resist the attack of quantum computers; the key is updated through lattice delegation technology and hash functions, ensuring that the current key system does not need to be revoked every time a key leak is detected, thereby improving the efficiency and security of the signature.

Description

Technical Field

[0001] The present invention belongs to the field of cryptography, and relates to fields such as identity-based signature mechanism and lattice cryptography, and realizes strong forward security by updating private keys, thereby improving the security of the signature system. Background Art

[0002] Anderson proposed the idea of ​​forward security, which is the core of the key update, in response to the general signature method that cannot solve the user trust problem after the key is leaked. In 2000, Anderson mentioned two types of security in his summary of forward security methods: forward security is to ensure that the leakage of the current key will not harm the previous signed message; backward security is to ensure that the leakage of the current key will not affect the future signing process.

[0003] With the development of quantum computers, the security of traditional strong forward-secure signature methods has been affected. Finding cryptographic methods that can resist quantum algorithm attacks has become an urgent practical issue in the upcoming era of quantum computers. Lattice cryptography has good resistance to quantum attacks, and the operations on the lattice are relatively simple and the calculation speed is fast. This paper combines the strong forward-secure signature method with the lattice cryptography and designs a strong forward-secure signature method based on identity on the lattice, which improves the security and efficiency of the signature system. Summary of the invention

[0004] The technical problem to be solved by the present invention is that, in order to resist the attack of quantum computers, it is not necessary to revoke the current key system every time a key leakage is detected. The present invention provides a lattice-based identity-based strong forward-secure signature method.

[0005] The technical method adopted by the present invention is: generating keys through a trapdoor generation algorithm based on lattice cryptography and a lattice delegation algorithm, so that the method can resist the attack of quantum computers; secondly, the present invention, through the design of private key update, achieves that even if a user accidentally leaks one of the private keys, there is no need to revoke the entire key system, thereby improving the efficiency and security of the signature stage.

[0006] The identity-based strong forward-secure signature method on the lattice includes two entities, namely the identity-based cryptographic system IBC user and the key generation center PKG; the method includes four algorithms, namely system initialization, key extraction and update algorithm, signature algorithm and signature verification algorithm. The specific process is as follows:

[0007] (1) System initialization: Input security parameter n, run trapdoor generation algorithm and hash function to generate public parameter PP = (A0, B0, H1, H2), take (A0, B0) as the primary public key, and generate The master private key and

[0008] (2) Key extraction and update algorithm: An IBC user with the identity ID sends a key request to PKG. After receiving the user's request, PKG selects a suitable period T to generate a key for the user for T periods at one time; PKG runs the lattice delegation algorithm to generate a series of keys for T periods. ID||0 , S.K. ID||1 ...SK ID||T )∈Z m×m ;(SK ID||0 , S.K. ID||1 ...SK ID||T ) as the user's entire key, PKG takes the key (SK ID||0 , S.K. ID||1 ...SK ID||T ) is sent to the user through a secure channel; when the key within the T period is used up or expires, the user with the identity ID can send a key request to PKG again, and PKG will run the algorithm again to generate a series of keys for the user to use;

[0009] (3) Signature algorithm: A user with ID needs to sign a message m∈{0,1} * Use the user's private key to sign; the user first determines the current cycle, assuming that the current cycle is i, and the user uses his private key SK in the i-th cycle ID||i , a random vector Signed with the ID's identity hash value H(ID), the signature result is e i =(c i , z i ); User randomly selects Message m∈{0,1} * , calculate c i =H2(A° ID || i ·y i , m), where A° ID||i =A ID||i +A′ ID||i , A ID||i and A′ ID||i They are all hash operations of the master public key and identity, specifically A ID||i =A0·(H1(ID||0)H1(ID||1)...H1(ID||i)) -1 , A′ ID||i =B0·(H1(ID||T)H1(ID||T-1)...H1(ID||i)) -1 ; Then calculate z i =SK ID||i ·ci +y i , with probability Output the signature e of the current cycle i i =(c i , z i );T ID||i =A° ID||i ·SK ID||i , then the public key of the user in the i-th cycle is PK ID||i =(A° ID||i , T ID||i );

[0010] (4) Signature Verification Algorithm: Anyone who obtains the signature and public key can serve as a verifier. Upon receiving the signature of the user with ID i Then, use the user's public key PK in the i-th cycle ID||i Verify the message. If c i =H2(A° ID||i ·z i -T ID||i ·c i , m) is established, then the verification passes, otherwise the verification fails. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The present invention will be further described below with reference to the accompanying drawings, in which:

[0012] Figure 1 It is a schematic diagram of the key generation and signature verification process of the present invention; DETAILED DESCRIPTION

[0013] The identity-based strong forward-secure signature method on the lattice includes two entities, namely the identity-based cryptographic system IBC user and the key generation center PKG; the method includes four algorithms, namely system initialization, key extraction and update algorithm, signature algorithm and signature verification algorithm. The specific process is as follows:

[0014] (1) System initialization

[0015] PKG selects a period T and generates three sets of Gaussian parameters σ=(σ0,σ1,……,σ T ),σ′=(σ′0,σ′1,…,σ′ T ), δ=(δ0, δ1,..., δ T ); two hash functions H1: {0, 1} * →Z m×m 、H2:{0,1} * →{v:v∈{-1, 0, 1} k ,||v||≤k}; using the trapdoor generating function in and is the user's master private key, public parameters PP = (A0, B0, H1, H2), save and send it to the user.

[0016] (2) Key extraction and update algorithm

[0017] Key extraction and update are completed by PKG. An IBC user with the identity ID sends a key request to PKG. After receiving the private key request sent by the user, PKG will select a suitable period T and generate all private keys of T periods for the user at one time. The process is as follows:

[0018] PKG extracts the private key from the t=0 period and calculates R ID||0 =H1(ID||0),A ID||0 =A0·(R ID||0 ) -1 , PKG extracts the private key from period t = T and calculates R′ ID||T =H1(ID||T),A′ ID||T =B0·(R′ ID||T ) -1 , PKG performs forward private key renewal from period i-1 to period i and calculates R ID||i-1 =H1(ID||i-1)H1(ID||i-2)...H1(ID||0),A ID||i-1 =A0·(R ID||i-1 ) -1 , R i =H1(ID||i),BasisDel(A ID||i-1 , R i ,sk ID||i-1 , σ i )→sk ID||i PKG performs a backward private key update from period i to period i-1: R′ ID||i =H1(ID||T)H1(ID||T-1)...H1(ID||i),A′ ID||i =B0·(R′ ID||i ) -1 , R′ i-1 =H1(ID||i),BasisDel(A′ ID||i , R′ i-1 , sk′ ID||i ,σ′ i-1 )→sk′ ID||i-1 ; Then the private key of the user in period i is SK ID||i =sk ID||i +sk′ID||i , the public key of the user in the i-th cycle is PK ID||i =(A° ID||i , T ID||i ),in

[0019] A° ID||i =A ID||i +A′ ID||i , T ID||i =A° ID||i ·SK ID||i ;(SK ID||0 , S.K. ID||1 ...SK ID||T ) as the complete key of the user with identity ID, PKG takes the key (SK ID||0 , S.K. ID||1 ...SK ID||T ) is sent to the user through a secure channel; when the key within the T period is used up or expires, the user with identity ID can send a key request to PKG again, and PKG will run the algorithm again to generate a series of keys for the user.

[0020] (3) Signature Algorithm

[0021] The user with identity ID needs to respond to a message m∈{0,1} * To sign with the user's private key, the user first determines the current cycle. Assuming the current cycle is i, the user uses the private key SK of the current cycle. ID||i Sign the message. The user enters the public parameter PP, the message m∈{0,1} * , the private key SK in the i-th cycle ID||i , randomly select a vector Calculate c i =H2(A° ID||i ·y i , m), calculate z i =SK ID||i ·c i +y i , with probability Output the signature of the current time i =(c i , z i ), if there is no output, re-execute the algorithm.

[0022] (4) Signature Verification Algorithm

[0023] After the user signs the message, anyone who obtains the signature and public key can act as a verifier and use the user's public key PK for that period. ID||i Verify the signature. The verifier inputs the public parameter PP, the original message m, and the public key PK of the current cycle i.ID||i , Signed i If c i =H2(A° ID||i ·z i -T ID||i ·c i , m) and If both are true, the signature is accepted; otherwise, it is rejected.

[0024] Verification of the effectiveness of the present invention

[0025] In order to verify the validity of the invention, this patent provides proof and analysis from two aspects: correctness and existence and non-forgeability. The specific process is as follows:

[0026] (1) The present invention combines lattice cryptography with identity-based strong forward-secure signature technology, and proposes a lattice-based identity-based strong forward-secure signature method; in order to verify the correctness of the method, this patent provides a correctness analysis process, as shown below:

[0027] H2(A° ID||i ·z i -T ID||i ·c i , m)

[0028] =H2(A° ID||i ·(SK ID||i ·c i +y i )-A° ID||i ·SK ID||i ·c i , m)

[0029] =H2(A° ID||i ·y i , m)

[0030] =c i

[0031] (2) The present invention proposes a lattice-based identity-based strong forward-secure signature method, which satisfies the existential unforgeability property. This patent provides a security analysis model to make the method meet EUF-CMA security, as shown below:

[0032] (2.1) In the random oracle model, if the SIS problem is difficult, the identity-based strong forward-secure signature method on the lattice has existential unforgeability under chosen-message attacks.

[0033] (2.2) Game. In the game, C is the challenger and A is the opponent. The specific game process is as follows:

[0034] (2.2.1) Initialization phase

[0035] Challenger C runs the system initialization algorithm to obtain the public parameter PP and the master private key Send the public parameter PP to adversary A;

[0036] (2.2.2) Phase 1

[0037] H1 query: For any i=1, 2, ..., T, C, maintain a list of H1 queries L1=(ID||i, Q i ), where Q i Represents the hash value of ID||i, the initial list is empty. A pairs (ID||i, Q i ) performs H1 query, if (ID||i, Q i )In L1, C will Q i In response to H1's query, C randomly selects a G i As a response to H1 query, (ID||i, G i ) is added to L1.

[0038] H2 query: C maintains a list of H2 queries L2 = (A° ID||i ·y i , c i ), the initial list is empty. A pairs (A° ID||i ·y i , c i ) conduct H2 inquiry, if (A° ID||i ·y i , c i )In L2, C will c i In response to H2's query, C randomly selects a C i In response to H2, (A° ID||i ·y i , C i ) is added to L2.

[0039] Key extraction and update query: C maintains a list L3 = (ID||i, A° ID||i , S.K. ID||i ), the initial list is empty. C responds to the initial or updated key query as follows: (1) C first checks whether the corresponding hash value exists in list L1. If so, it directly returns the corresponding hash value and calculates A ID||i =A0·(H1(ID||0)H1(ID||1)...H1(ID||i)) -1 , A′ ID||i=B0·(H1(ID||T)H1(ID||T-1)...H1(ID||i)) -1 , if the corresponding hash value does not exist, C randomly selects a matrix Run the BasisDel algorithm to generate the private key SK ID||i and add it to L3. (2) C maintains a list L4 = (ID||i, SK ID||i ,sk ID||i-1 ,sk ID||i+1 ), if A queries ID||i for key update, C returns A's private key SK for the current period ID||i In response, C checks list L1 to see if there is a corresponding hash value. If so, it directly returns the corresponding hash value and calculates R i+1 =H1(ID||i+1), R i-1 =H1(ID||i-1), if the corresponding hash value does not exist, C randomly selects a matrix Run the BasisDel algorithm to generate a small private key sk ID||i-1 and sk ID||i+1 And added to L4.

[0040] Signature query: Adversary A queries the signature of message m. B first browses lists L1 and L2. For any time i≤T, if there are corresponding hash values ​​in lists L1 and L2, C calculates z i =SK ID||i ·c i +y i , with probability Output the signature of the current time i =(c i , z i ); otherwise, randomly select a vector c′ i , z′ i , through H2(A° ID||i ·z′ i -T ID||i ·c′ i , m) query H2 to get c i Then calculate z i =SK ID||i ·c i +y i Finally output the signature e of the current time i =(c i , z i ).

[0041] (2.2.3) Forgery stage

[0042] Adversary A decides when to end the above inquiry process; outputs the current time i* ID * , message m * and signature The adversary wins if the following conditions hold: 1≤i * ≤T; ID * Not asked in key extraction and update queries; (ID * ,i * , m * ) has not been asked in the signature inquiry; Passed verification.

[0043] Adversary A makes polynomially bounded queries, and challenger C is responsible for answering;

[0044] (3) The present invention updates the private key and implements an identity-based strong forward-secure signature method on a lattice based on lattice theory through lattice delegation technology and hash functions. To verify the unforgeability of the method, the EUF-CMA security model is constructed through the difficulty of the SIS problem to implement the security of the signature method.

Claims

1. A strong forward-secure digital signature method based on identity on a lattice, characterized by: This method includes two entities, namely the identity-based cryptographic system IBC user and the key generation center PKG. The specific implementation steps include the following four algorithms: (1) System initialization Input security parameter n, run trapdoor generation algorithm and hash function to generate public parameter PP = (A0, B0, H1, H2), take (A0, B0) as the primary public key, and generate it with lattice delegation algorithm The master private key and (2) Key extraction and update algorithm An IBC user with the identity ID sends a key request to PKG. After receiving the user's request, PKG will select a suitable period T to generate a key for the user for T periods at one time; PKG runs the lattice delegation algorithm to generate a series of keys (SK ID||0 , S.K. ID||1 ...SK ID||T )∈Z m×m ;(SK ID||0 , S.K. ID||1 ...SK ID||T ) as the key for the entire period of the user, PKG uses the key (SK ID||0 , S.K. ID||1 ...SK ID||T ) is sent to the user through a secure channel; when the key within the T period is used up or expires, the user with the identity ID sends a key request to PKG again, and PKG will run the algorithm again to generate a series of keys for the user to use; (3) Signature Algorithm In this algorithm, the user with identity ID needs to sign a message m∈{0,1}* using the user's private key. The user first determines the current cycle. Assuming the current cycle is i, the user uses his private key SK in the i-th cycle. ID||i , a random vector Signed with the ID's identity hash value H(ID), the signature result is e i =(c i , z i ); User randomly selects Message m∈{0,1} * , calculate c i =H2(A° ID||i ·y i , m), where A° ID||i =A ID||i +A′ ID||i , A ID||i and A′ ID||i They are all hash operations of the master public key and identity, specifically A ID||i =A0·(H1(ID||0)H1(ID||1)...H1(ID||i)) -1 , A′ ID||i =B0·(H1(ID||T)H1(ID||T-1)...H1(ID||i)) -1 ; Then calculate z i =SK ID||i ·c i +y i , with probability Output the signature e of the current cycle i i =(c i , z i );T ID||i =A° ID||i ·SK ID||i , then the public key of the user in the i-th cycle is PK ID||i =(A° ID||i , T ID||i ); (4) Verification algorithm Anyone who gets the signature and public key can act as a verifier. i Then, use the user's public key PK in the i-th cycle ID||i Verify the message signature pair. If c i =H2(A° ID||i ·z i -T ID||i ·c i , m) is established, then the verification passes, otherwise the verification fails.

Images