A randomized blind signature method and system with strong unlinkability

Abstract

The present invention relates to a randomizable blind signature method and system with strong unlinkability. The method comprises: after the signing end authenticates the message provider, the message provider sends a first secret message including a secret commitment message and a corresponding zero-knowledge proof to the signing end; after the signing end verifies the first secret message sent by the message provider with a zero-knowledge proof, the signing end generates a randomizable blind signature; the message provider receives the randomizable blind signature sent by the signing end and verifies it; the message provider sends a second secret message including a randomized blind signature and a zero-knowledge proof to the verification end; the second secret message sent by the message provider undergoes a randomized blind signature and a zero-knowledge proof verification at the verification end; after the signing end verifies the second secret message provided by the verification end, it deanonymizes the message to obtain a commitment message and tracks the identity of the message provider. The present invention realizes a randomizable blind signature that is simultaneously anonymous, strongly unlinkable, and traceable.

Description

Technical Field

[0001] The present invention belongs to the technical field of privacy data processing, and in particular relates to a randomized blind signature method and system with strong unlinkability. Background Art

[0002] Digital signatures are used as a module within various cryptographic protocols to implement complex cryptographic functions. In recent years, digital signatures have evolved not only towards greater speed and efficiency, but also with the addition of numerous additional features, such as randomization and unlinkability. When used as a module, signature algorithms must be both efficient and compatible with other cryptographic modules. For example, privacy-preserving schemes often require commitments to secret data and signatures on these commitments, and they must also be compatible with zero-knowledge proof protocols.

[0003] In a blind signature, a user can obtain the signer's signature without revealing their own secret message. Therefore, blind signatures are blind and effectively protect user privacy. This blindness has led to their widespread application in areas such as electronic cash, electronic voting, and e-government. In these applications, users are increasingly demanding functional features, such as more efficient design, reduced communication, strong unlinkability, and traceability in electronic cash applications. Currently, one of the most widely used digital signature modules is the CL signature, designed by Camenisch and Lysyanskaya in 2014. The CL system, based on bilinear groups, offers high flexibility and can be used in cryptographic systems such as anonymous certificates, aggregate signatures, and electronic cash. However, due to the positive correlation between signature length and the number of messages to be signed, the CL system has limited practical application in some cryptographic scenarios. In 2015, Pointcheval et al. combined zero-knowledge proofs with blind signatures to propose a blind signature scheme that can conceal secret messages. A small number of blind signatures are based on lattice cryptography, but these lack randomization or unlinkability. While blind signatures have strong unlinkability, traceability, and randomizability, they are also limited by resource storage and communication volume and cannot be put into large-scale use. Summary of the Invention

[0004] In view of the above analysis, the present invention aims to disclose a randomized blind signature method and system with strong unlinkability, so as to realize a randomized blind signature with anonymity, strong unlinkability and traceability.

[0005] The present invention discloses a randomizable blind signature method with strong unlinkability, comprising:

[0006] Step S1: After the identity information of the message provider is authenticated by the signing end, the first secret message including the secret commitment message and the corresponding zero-knowledge proof is sent to the signing end;

[0007] Step S2: After the first secret message sent by the message provider is verified by zero-knowledge proof at the signing end, the signing end generates a randomizable blind signature;

[0008] Step S3: The message provider receives the randomizable blind signature sent by the signature provider and verifies it;

[0009] Step S4: The message provider sends a second secret message including the randomized blind signature and the corresponding zero-knowledge proof to the verifier.

[0010] Step S5: The second secret message sent by the message providing end is verified by the randomized blind signature and zero-knowledge proof at the verification end;

[0011] Step S6: After verifying the second secret message provided by the verification end, the signing end uses the deanonymization private key to obtain the commitment message of the message providing end, and tracks the identity of the message providing end by searching the local database.

[0012] Furthermore, during the system establishment phase, public parameters are provided to the signing end, the message provider, and the verifier. The public parameters include bilinear group parameters and the hash function required for zero-knowledge proof. The signing end generates a public-private key pair for randomized blind signatures and a deanonymized public-private key pair based on the public parameters. The public keys of the two public-private key pairs are then disclosed to the message provider and the verifier.

[0013] Bilinear group parameters |n|≥2λ, where n is a prime number, λ is a security parameter, G1, G2 and G T are three cyclic groups of order prime number n, P and are the generators of G1 and G2 respectively; e is G1×G2→G T Bilinear map of .

[0014] Furthermore, the process of generating the first secret message in step S1 includes:

[0015] 1) The message provider provides a secret commitment message Q, Q = m·P∈G1 * ;G1 * is the set of non-zero elements in G1;

[0016] 2) Generate a random number k←Z n * , calculate R = k·P; Z n * is the ring Z of integers modulo n n The set of non-zero elements in ;

[0017] 3) Calculate h1 = H(P||Q||R||info1), s1 = k - h1·m(mod n), where info1 is the other message including the timestamp;

[0018] 4) Obtain the first secret message Tr1 = (Q, R, h1, s1, info1).

[0019] Furthermore, in step S2, the signing end performs zero-knowledge proof verification on the first secret message Tr1=(Q, R, h1, s1, info1), and then uses the private key sk=(y, X) of the randomizable blind signature to generate a randomizable blind signature;

[0020] Specifically include:

[0021] 1) Calculate R′ = s1·P + h1·Q;

[0022] 2) Calculate h1′=H(P||Q||R′||info1) and verify that h1′=h1; if they are not equal, terminate the protocol; if they are equal, the verification succeeds;

[0023] 3) After verification, a random number a←Z is generated n * , calculate A = a·P, B = a·Q, C = a·X+y·B, and obtain the randomizable blind signature σ = (A, B, C);

[0024] 4) Generate the corresponding entry (Q, ID U ,info1) is saved in the local database, and the randomizable blind signature σ=(A,B,C) is sent to the message provider.

[0025] Furthermore, in step S3, the message providing end receives the randomizable blind signature sent by the signing end, and uses the public key of the randomizable blind signature Verifying the randomizable blind signature; specifically comprising:

[0026] 1) Verify that A, B, and C all ∈ G1 * , and B=m·A, If both are true and the verification succeeds, let res = true, otherwise let res = false;

[0027] 2) Send res to the signing end.

[0028] Furthermore, in step S4, the randomized blind signature process for the randomizable blind signature includes:

[0029] Generate a random number ω←Z n *, randomize the randomizable blind signature to obtain a new signature (A, B, C)←(ω·A,ω·B,ω·C), and let σ=(A,B,C) to obtain the randomized blind signature.

[0030] Furthermore, the process of obtaining the second secret message includes:

[0031] 1) Generate a random number r←Z n * , calculate D = r·P, E = Q + r·Z; Z is the deanonymization public key;

[0032] 2) Generate a random number k m ←Z n * , k r ←Z n * , calculate R m =k m A, R d =k r P, R e =k m P+k r ·Z;

[0033] 3) Calculate h2 = H(P||A||B||C||D||E||Z||R) m ||R d ||R e ||info2), s2=k m -h2·m(mod n), t2=k r -h2·r(mod n), where info2 is the other message including the timestamp.

[0034] 4) Let Ψ = (D, E), π = (σ, h2, s2, t2);

[0035] 5) Obtain the second secret message Tr2 = (info2, Ψ, π).

[0036] Furthermore, in step S5, the second secret message Tr2 sent by the message provider is verified by the verification end using the deanonymized public key Z for zero-knowledge proof and the randomizable blind signature public key Verify the correctness of randomizable blind signatures;

[0037] The specific verification process includes:

[0038] 1) Verify that A, B, C, D, E ∈ G1 * If at least one of them is not true, set res = false and jump to step 5);

[0039] 2) Calculate R m′=s2·A+h2·B,R d ′=t2·P+h2·D,R e ′=s2·P+t2·Z+h2·E;

[0040] 3) Calculate h2′=H(P||A||B||C||D||E||Z||R) m ′||R d ′||R e ′||info2), if h2′≠h2, set res=false and jump to step 5);

[0041] 4) Verification If true, let res = true, otherwise let res = false;

[0042] 5) Send res to the user who provided the message, ending the entire signature verification process.

[0043] Furthermore, in step S6, the signing end verifies the second secret message Tr2 = (info2, Ψ, π) provided by the verification end. After the verification is passed, the signing end calculates Q = Ez·D for Ψ = (D, E) using the deanonymization private key z, and obtains the commitment message Q of the message provider. By searching the entry (Q, ID U ,info1) Tracking message provider's identity information ID U .

[0044] The present invention also discloses a randomizable blind signature system with strong unlinkability, comprising: a message providing end, a signing end, and a verification end;

[0045] After the signing end authenticates the identity information of the message providing end, the message providing end sends a first secret message including a secret commitment message and a corresponding zero-knowledge proof to the signing end;

[0046] After the signing end verifies the first secret message through zero-knowledge proof, it generates a randomizable blind signature and sends it to the message providing end for verification;

[0047] The message providing end sends a second secret message including a randomized blind signature and a corresponding zero-knowledge proof to the verifying end;

[0048] The second secret message sent by the message providing end is verified by the randomized blind signature and zero-knowledge proof at the verification end.

[0049] After the signing end verifies the second secret message provided by the verification end, it uses the deanonymization private key to obtain the commitment message of the message providing end and tracks the identity information of the message providing end.

[0050] The present invention can achieve at least one of the following beneficial effects:

[0051] The solution disclosed in the present invention is a randomized blind signature method and system that is simultaneously anonymous, strongly unlinkable, and traceable. It has passed the security proof under the random oracle model, has controllable storage space scale, and meets the requirements of both security and availability. Compared with methods with similar security properties, this method has higher efficiency and availability.

[0052] The present invention has anonymity. Except for the signer, the verifier cannot trace the message provider from the signature verification process.

[0053] The present invention has strong unlinkability. Except for the message provider and the signer, no one can determine whether any two signature verifications are initiated by the same user.

[0054] The present invention has traceability. Even if a malicious message providing user and a verifier combine, they cannot forge the commitment message Q without exposing their identity.

[0055] The size of the signatory database stored in the present invention is controllable. The size of the signatory database is proportional to the number of users providing messages. The storage capacity is controllable and combined with existing database retrieval technology, it greatly improves the tracking speed.

[0056] The present invention can also be used to construct other cryptographic protocols such as group signatures, anonymous certificates, pseudonym systems, electronic cash, and single sign-on systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The accompanying drawings are only for the purpose of illustrating particular embodiments and are not to be considered limiting of the present invention. Like reference symbols denote like parts throughout the drawings.

[0058] Figure 1 Flowchart of a randomized blind signature method with strong unlinkability in an embodiment of the present invention;

[0059] Figure 2 This is a block diagram of a randomizable blind signature system with strong unlinkability in an embodiment of the present invention. DETAILED DESCRIPTION

[0060] The preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, which constitute a part of this application and are used to illustrate the principles of the present invention together with the embodiments of the present invention.

[0061] Example 1

[0062] First, the abbreviations and key terms in this embodiment are defined

[0063] Trusted Authority

[0064] ID identification, information that can uniquely identify a user

[0065] λ safety index

[0066] n is the order of the n-torsion subgroup of the elliptic curve, which is a prime number

[0067] Z n Ring of integers modulo n

[0068] Z n * Z n The set of non-zero elements

[0069] {0,1} * The set of all bit strings of arbitrary length

[0070] {0,1} λ The set of all bit strings of length λ

[0071] (G1,+) additive cyclic group of order n

[0072] G1 * The set of non-zero elements in G1

[0073] (G2,+) additive cyclic group of order n

[0074] Q is a point on the elliptic curve Q≠O

[0075] mQ or m·Q (m≥0) is the m-fold point of the elliptic curve point Q

[0076] The generator P of P (G1,+)=(x P ,y P ), P≠O

[0077] Generator of (G2,+)

[0078] (G T ,×) n-factorial cyclic group

[0079] e G1×G2→G T Bilinear map

[0080] H: {0,1} * →Z n Hash function

[0081] info1,info2 Other information generated during the signature or verification process

[0082] Bilinear group parameters G1, G2 and G Tare three cyclic groups of order n, the operations in G1 and G2 are recorded as addition, G T The operation in is recorded as multiplication, P and are the generators of G1 and G2 respectively, and there is a bilinear mapping (called bilinear pairing) e: G1×G2→G T Satisfy the following properties:

[0083] (1) Bilinear: For any Q1∈G1 and Q2∈G2, a,b∈Z n , there is e(a·Q1,b·Q2)=e(Q1,Q2) ab ;

[0084] (2) Non-degenerate: It's G T Generators of

[0085] (3) Computability: G1, G2, G T There are known effective algorithms for group operations, group element comparison, group membership judgment, and calculation of e;

[0086] (4) Non-isomorphism: G1≠G2, and there is no known efficiently computable isomorphic mapping between G1 and G2 in either direction.

[0087] The embodiment of the present invention discloses a randomizable blind signature method with strong unlinkability, such as Figure 1 As shown, including:

[0088] Step S1: After the identity information of the message provider is authenticated by the signing end, the first secret message including the secret commitment message and the corresponding zero-knowledge proof is sent to the signing end;

[0089] Step S2: After the first secret message sent by the message provider is verified by zero-knowledge proof at the signing end, the signing end generates a randomizable blind signature;

[0090] Step S3: The message provider receives the randomizable blind signature sent by the signature provider and verifies it;

[0091] Step S4: The message provider sends a second secret message including the randomized blind signature and the corresponding zero-knowledge proof to the verifier.

[0092] Step S5: The second secret message sent by the message providing end is verified by the randomized blind signature and zero-knowledge proof at the verification end.

[0093] Step S6: After verifying the second secret message provided by the verification end, the signing end uses the deanonymization private key to obtain the commitment message of the message providing end, and tracks the identity of the message providing end by searching the local database.

[0094] The above steps S1-S6 realize the generation, verification and tracking of randomized blind signatures.

[0095] In this embodiment, during the system establishment phase, public parameters are provided to the signing end, the message provider, and the verifier. The public parameters include the bilinear group parameter Λ and the hash function H required for zero-knowledge proof. The signing end generates a public-private key pair for randomizing blind signatures and a deanonymizing public-private key pair based on the public parameters. The public keys of the two public-private key pairs are then disclosed to the message provider and the verifier.

[0096] Bilinear group parameters |n|≥2λ, where n is a prime number, λ is a security parameter, G1, G2 and G T are three cyclic groups of order prime number n, P and are the generators of G1 and G2 respectively; e is G1×G2→G T Bilinear map of .

[0097] Among them, the public parameter pp can be obtained by a trusted authority The bilinear group parameter Λ can be generated according to the given security parameter λ (eg λ=128).

[0098] The signing end generates two public and private key pairs based on the public parameters as follows:

[0099] Generate a public-private key pair for randomized blind signature: x←Z n * , y←Z n * , X=x·P, Private key sk = (y, X), public key Make the public key pk public.

[0100] Generate deanonymized public and private key pairs: z←Z n * , Z = z·P, z is the signer's private key, Z is the signer's public key; make the public key Z public.

[0101] In step S1, the identity information ID of the message provider U Send to the signing end for authentication, and the authenticated message provider sends a first secret message Tr1 = (Q, R, h1, s1, info1) including the commitment message and the corresponding zero-knowledge proof to the signing end;

[0102] The process of generating the first secret message Tr1 includes:

[0103] 1) The message provider provides a secret commitment message Q, Q = m·P∈G1 * ;G1 * is the set of non-zero elements in G1;

[0104] 2) Generate a random number k←Z n * , calculate R = k·P; Z n * is the ring Z of integers modulo n n The set of non-zero elements in ;

[0105] 3) Calculate h1 = H(P||Q||R||info1), s1 = k - h1·m(mod n), where info1 is the other message including the timestamp;

[0106] 4) Obtain the first secret message Tr1 = (Q, R, h1, s1, info1).

[0107] After the signing end performs zero-knowledge proof verification on the first secret message Tr1=(Q, R, h1, s1, info1), a randomizable blind signature is generated using the private key sk=(y, X) capable of randomizing the blind signature;

[0108] Specifically include:

[0109] 1) Calculate R′ = s1·P + h1·Q;

[0110] 2) Calculate h1′=H(P||Q||R′||info1) and verify that h1′=h1; if they are not equal, terminate the protocol; if they are equal, the verification succeeds;

[0111] 3) After verification, a random number a←Z is generated n * , calculate A = a·P, B = a·Q, C = a·X+y·B, and obtain the randomizable blind signature σ = (A, B, C);

[0112] 4) Generate the corresponding entry (Q, ID U ,info1) is saved in the local database, and the randomizable blind signature σ=(A,B,C) is sent to the message provider.

[0113] The signing end will generate the entry (Q, ID U ,info1) is saved in the local database for the subsequent deanonymization process.

[0114] In step S3, the message provider receives the randomizable blind signature sent by the signature provider and uses the public key of the randomizable blind signature Verifying the randomizable blind signature;

[0115] The specific verification process is as follows:

[0116] 1) Verify that A, B, and C all ∈ G1 *, and B=m·A, If both are true and the verification succeeds, let res = true, otherwise let res = false;

[0117] 2) Send res to the signing end.

[0118] In step S4, the message provider sends a second secret message including a randomized blind signature and a corresponding zero-knowledge proof to the verifier.

[0119] The randomized blind signature process for the randomizable blind signature includes:

[0120] Generate a random number ω←Z n * , randomize the randomizable blind signature to obtain a new signature (A, B, C)←(ω·A,ω·B,ω·C), and let σ=(A,B,C) to obtain the randomized blind signature.

[0121] The process of obtaining the second secret message Tr2 includes:

[0122] 1) Generate a random number r←Z n * , calculate D = r·P, E = Q + r·Z; Z is the deanonymization public key;

[0123] 2) Generate a random number k m ←Z n * , k r ←Z n * , calculate R m =k m A, R d =k r P, R e =k m P+k r ·Z;

[0124] 3) Calculate h2 = H(P||A||B||C||D||E||Z||R) m ||R d ||R e ||info2), s2=k m -h2·m(mod n), t2=k r -h2·r(mod n), where info2 is the other message including the timestamp.

[0125] 4) Let Ψ = (D, E), π = (σ, h2, s2, t2);

[0126] 5) Obtain the second secret message Tr2 = (info2, Ψ, π).

[0127] In step S5, the second secret message Tr2 sent by the message provider is verified by the verification end using the deanonymized public key Z for zero-knowledge proof and the randomizable blind signature public key Verify the correctness of randomizable blind signatures.

[0128] The specific verification process includes:

[0129] 1) Verify that A, B, C, D, E ∈ G1 * If at least one of them is not true, set res = false and jump to step 5);

[0130] 2) Calculate R m ′=s2·A+h2·B,R d ′=t2·P+h2·D,R e ′=s2·P+t2·Z+h2·E;

[0131] 3) Calculate h2′=H(P||A||B||C||D||E||Z||R) m ′||R d ′||R e ′||info2), if h2′≠h2, set res=false and jump to step 5);

[0132] 4) Verification If true, let res = true, otherwise let res = false;

[0133] 5) Send res to the user who provided the message, ending the entire signature verification process.

[0134] In a more preferred solution of this embodiment, after the blind signature generation and verification are completed through steps S1-S5, the anonymization process of step S6 is also included;

[0135] Specifically, in step S6, the signing end verifies the second secret message Tr2 = (info2, Ψ, π) provided by the verification end (the method is the same as S5). After the verification is passed, the deanonymization private key z is used to calculate Q = Ez·D for Ψ = (D, E) to obtain the commitment message Q of the message provider. By searching the entry (Q, ID U ,info1) Tracking message provider's identity information ID U .

[0136] In summary, the solution of this embodiment is:

[0137] 1) Anonymity;

[0138] In step S5, the verifier cannot trace the secret commitment information Q of the message provider from the signature verification process. During the signature verification process, the message provider does not provide any user-related information to the verifier, only the randomized blind signature. The adversary cannot find the secret commitment information Q corresponding to the blinded signature. According to the DDH hypothesis, the zero-knowledge proof of B = m·A, D = r·P, and E = m·P+r·Z does not disclose information about m and Q (= m·P). Therefore, only the signing party can obtain the secret commitment information Q, and the verifier cannot obtain it, maintaining anonymity.

[0139] 2) Strong unlinkability;

[0140] Aside from the message provider and the signer, no one can determine whether any two signature verifications were initiated by the same user. Each verification uses a different random blinded signature. Due to the blind nature of the signature, it is impossible to determine whether different randomized blind signatures are linked, i.e., correspond to the same Q. Furthermore, based on the DDH assumption and the random generation of r each time, different zero-knowledge proofs for B = m·A, D = r·P, and E = m·P+r·Z are also unlinkable (i.e., determining whether they correspond to the same m is computationally infeasible). Therefore, it has strong unlinkability.

[0141] 3) Traceability;

[0142] In step S6, the signing end searches the signer database through the deanonymization process to obtain the identity information ID of the user who provided the message U ; In this way, even if a malicious message provider and verifier work together, they cannot forge the secret commitment information Q without exposing their identity; the signing end can track their identity information through the deanonymization process and identify the malicious message provider.

[0143] 4) The size of the database stored on the signature side is controllable;

[0144] The scale of the signature-side database is proportional to the user scale of the message provider. The storage capacity is controllable and combined with existing database retrieval technology, it greatly improves the tracking speed.

[0145] 5) Can be applied to a variety of application systems;

[0146] It can be used to construct group signatures, anonymous certificates, pseudonym systems, electronic cash, single sign-on systems and other cryptographic protocols; and to implement randomized blind signatures with strong unlinkability.

[0147] Based on this, the technical solution in this embodiment, compared to existing methods, skillfully designs a randomized blind signature method that simultaneously maintains anonymity, strong unlinkability, and traceability. It has passed security proof under a random oracle model, has controllable storage space scale, and meets both security and usability requirements. Compared to methods with similar security properties, this method offers higher efficiency and usability.

[0148] Example 2

[0149] The embodiment of the present invention discloses a randomizable blind signature system with strong unlinkability, such as Figure 2 As shown, it includes: a message providing end, a signing end and a verification end;

[0150] After the signing end authenticates the identity information of the message providing end, the message providing end sends a first secret message including a secret commitment message and a corresponding zero-knowledge proof to the signing end;

[0151] After the signing end verifies the first secret message through zero-knowledge proof, it generates a randomizable blind signature and sends it to the message providing end for verification;

[0152] The message providing end sends a second secret message including a randomized blind signature and a corresponding zero-knowledge proof to the verifying end;

[0153] The second secret message sent by the message providing end is verified by the randomized blind signature and zero-knowledge proof at the verification end.

[0154] After the signing end verifies the second secret message provided by the verification end, it uses the deanonymization private key to obtain the commitment message of the message providing end and tracks the identity information of the message providing end.

[0155] The specific technical details and beneficial effects of this embodiment are the same as those of Example 1. Please refer to Example 1 for details and will not be described in detail here.

[0156] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with this technical field within the technical scope disclosed by the present invention should be covered by the scope of protection of the present invention.

Claims

1. A randomizable blind signature method with strong unlinkability, characterized in that: include: Step S1: After the identity information of the message provider is authenticated by the signing end, the first secret message including the secret commitment message and the corresponding zero-knowledge proof is sent to the signing end; Step S2: After the first secret message sent by the message provider is verified by zero-knowledge proof at the signing end, the signing end generates a randomizable blind signature; Step S3: The message provider receives the randomizable blind signature sent by the signature provider and verifies it; Step S4: The message provider sends a second secret message including the randomized blind signature and the corresponding zero-knowledge proof to the verifier. Step S5: The second secret message sent by the message providing end is verified by the randomized blind signature and zero-knowledge proof at the verification end; Step S6: After verifying the second secret message provided by the verification end, the signing end uses the deanonymization private key to obtain the commitment message of the message providing end, and tracks the identity of the message providing end by searching the local database.

2. The randomizable blind signature method with strong unlinkability according to claim 1, characterized in that: During the system establishment phase, public parameters are provided to the signing end, message providing end, and verification end. The public parameters include bilinear group parameters and the hash function required for zero-knowledge proof. The signing end generates a public-private key pair for randomized blind signature and a de-anonymized public-private key pair based on the public parameters; and discloses the public keys of the two public-private key pairs to the message provider and the verifier; Bilinear group parameters |n|≥2λ, where n is a prime number, λ is a security parameter, G1, G2 and G T are three cyclic groups of order prime number n, P and are the generators of G1 and G2 respectively; e is G1×G2→G T Bilinear mapping.

3. The randomizable blind signature method with strong unlinkability according to claim 2, characterized in that: The process of generating the first secret message in step S1 includes: 1) The message provider provides a secret commitment message Q, Q = m·P∈G1 * ;G1 * is the set of non-zero elements in G1; m≥0; 2) Generate a random number k←Z n * , calculate R = k·P; Z n * is the ring Z of integers modulo n n The set of non-zero elements in ; 3) Calculate h1 = H(P||Q||R||info1), s1 = (k-h1·m) mod n, where info1 is the other message including the timestamp; 4) Obtain the first secret message Tr1 = (Q, R, h1, s1, info1).

4. The randomizable blind signature method with strong unlinkability according to claim 3, characterized in that: In step S2, the signing end performs zero-knowledge proof verification on the first secret message Tr1=(Q, R, h1, s1, info1), and then uses the private key sk=(y, X) of the randomizable blind signature to generate a randomizable blind signature; Specifically include: 1) Calculate R′ = s1·P + h1·Q; 2) Calculate h1′=H(P||Q||R′||info1) and verify that h1′=h1; if they are not equal, terminate the protocol; if they are equal, the verification succeeds; 3) After verification, a random number a←Z is generated n * , calculate A = a·P, B = a·Q, C = a·X+y·B, and obtain the randomizable blind signature σ = (A, B, C); 4) Generate the corresponding entry (Q, ID U ,info1) is saved in the local database, and the randomizable blind signature σ=(A,B,C) is sent to the message provider.

5. The randomizable blind signature method with strong unlinkability according to claim 4, characterized in that: In step S3, the message provider receives the randomizable blind signature sent by the signature provider and uses the public key of the randomizable blind signature Verify the randomizable blind signature; include: 1) Verify that A, B, and C all ∈ G1 * , and B=m·A, If both are true and the verification succeeds, let res = true, otherwise let res = false; 2) Send res to the signing end.

6. The randomizable blind signature method with strong unlinkability according to claim 5, characterized in that: In step S4, the randomized blind signature process for the randomizable blind signature includes: Generate a random number ω←Z n * , randomize the randomizable blind signature to obtain a new signature (A, B, C)←(ω·A,ω·B,ω·C), and let σ=(A,B,C) to obtain the randomized blind signature.

7. The randomizable blind signature method with strong unlinkability according to claim 6, characterized in that: The process of obtaining the second secret message includes: 1) Generate a random number r←Z n * , calculate D = r·P, E = Q + r·Z; Z is the deanonymization public key; 2) Generate a random number k m ←Z n * , k r ←Z n * , calculate R m =k m A, R d =k r P, R e =k m P+k r ·Z; 3) Calculate h2 = H(P||A||B||C||D||E||Z||R) m ||R d ||R e ||info2), s2=(k m -h2·m)mod n, t2=(k r -h2·r)mod n, where info2 is other information including timestamp; 4) Let Ψ = (D, E), π = (σ, h2, s2, t2); 5) Obtain the second secret message Tr2 = (info2, Ψ, π).

8. The randomizable blind signature method with strong unlinkability according to claim 6, characterized in that: In step S5, the second secret message Tr2 sent by the message provider is verified by the verification end using the deanonymized public key Z for zero-knowledge proof and the randomizable blind signature public key Verify the correctness of randomizable blind signatures; The specific verification process includes: 1) Verify that A, B, C, D, E ∈ G1 * If at least one of them is not true, set res = false and jump to step 5); 2) Calculate R m ′=s2·A+h2·B,R d ′=t2·P+h2·D,R e ′=s2·P+t2·Z+h2·E; 3) Calculate h2′=H(P||A||B||C||D||E||Z||R) m ′||R d ′||R e ′||info2), if h2′≠h2, set res=false and jump to step 5); 4) Verification If true, let res = true, otherwise let res = false; 5) Send res to the user who provided the message, ending the entire signature verification process.

9. The randomizable blind signature method with strong unlinkability according to claim 6, characterized in that: In step S6, the signing end verifies the second secret message Tr2 = (info2, Ψ, π) provided by the verification end. After the verification is successful, the signing end calculates Q = Ez·D for Ψ = (D, E) using the deanonymization private key z, and obtains the commitment message Q of the message provider. By searching the entry (Q, ID U ,info1) Tracking message provider's identity information ID U .

10. A randomizable blind signature system with strong unlinkability, characterized in that: include: Message providing end, signing end and verification end; After the signing end authenticates the identity information of the message providing end, the message providing end sends a first secret message including a secret commitment message and a corresponding zero-knowledge proof to the signing end; After the signing end verifies the first secret message through zero-knowledge proof, it generates a randomizable blind signature and sends it to the message providing end for verification; The message providing end sends a second secret message including a randomized blind signature and a corresponding zero-knowledge proof to the verifying end; The second secret message sent by the message provider is verified by the randomized blind signature and zero-knowledge proof at the verification end; After the signing end verifies the second secret message provided by the verification end, it uses the deanonymization private key to obtain the commitment message of the message providing end and tracks the identity information of the message providing end.

Images