Double-ring based adapter signature method

Abstract

The present invention proposes an adapter signature method based on a double ring, which includes four entities: a system administrator, a signer, an adapter and a third party, and is implemented through the following technical scheme: first, the system administrator calls the initialization Setup algorithm to determine the system parameters and shares the system parameters with other entities; wherein the adapter receives a complete difficult relationship pair, while the signer only receives a commitment value and cannot calculate the corresponding evidence; the signer calls the KeyGen algorithm to generate its public key and private key, and uses the private key and the commitment value to call the PreSign algorithm to calculate the pre-signature of the message; then, after the adapter obtains the message and the pre-signature from the signer, it first calls the PreVerify algorithm to verify the validity of the message and the pre-signature, and then calls the Adapt algorithm to generate the formal signature of the message; finally, the signer sends the pre-signature and the received formal signature to the third party; the third party completes the extraction of evidence by calling the Ext algorithm.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an adapter signature method based on double rings. Background Art

[0002] As a decentralized platform for distributed operation, blockchain has changed the traditional business logic and institutional operation mode, and has been widely used in finance, Internet of Things, charity, healthcare, supply chain and other fields. Taking the financial field as an example, blockchain can achieve fair digital currency transactions without the participation of third-party institutions. However, since on-chain transactions are composed of multiple scripts, the storage and calculation costs of the scripts determine the transaction efficiency and intermediary fees. This often leads to inefficient and high-cost on-chain transactions, which greatly limits the application and promotion of blockchain.

[0003] Adaptor Signature can be used to lock and unlock transactions between adjacent users in the payment channel due to its special algorithm structure, realizing the function of "off-chain calculation and on-chain synchronization", which can greatly reduce the computational overhead and intermediate costs of traditional blockchain transactions. Adaptor Signature is an extension of traditional digital signature, mainly including six algorithms: initialization (Setup), key generation (KeyGen), pre-signature (PreSign), pre-verification (PreVerify), signature adaptation (Adapt) and evidence extraction (Ext).

[0004] The off-chain application of adapter signatures can reduce the cost of on-chain communication, increase the substitutability of transactions, and circumvent the limitations of blockchain scripting languages. However, the existing adapter signature schemes fail to solve the problem of identity privacy leakage when used to implement "off-chain transactions", resulting in the inability to meet the anonymity requirements of blockchain off-chain transactions.

[0005] Linkable Ring Adaptor Signature can effectively solve the above problems, but the existing solutions involve complex signing and verification processes, which causes the storage / communication cost and computational overhead of the signature to increase linearly with the number of ring members, which is not conducive to the practical application of digital currency transactions. Summary of the invention

[0006] Therefore, in order to overcome the defects and shortcomings of the prior art, the present invention proposes a more anonymous and efficient dual ring adapter signature (DualRingAdaptor Signature) scheme based on the dual ring signature.

[0007] The purpose of this invention is to design a more anonymous and efficient adapter signature scheme based on dual-ring signatures, aiming to solve the problems of high storage overhead and complex signature verification of existing linkable ring adapter signatures, thereby reducing the system burden and better meeting the privacy protection needs of blockchain in the fields of finance, Internet of Things, charity, medical health, supply chain, etc.

[0008] It includes four entities: system administrator, signer, adapter, and third party, and is implemented through the following technical solutions: First, the system administrator calls the initialization Setup algorithm to determine the system parameters and share the system parameters with other entities. Among them, the adapter receives the complete difficult relationship pair (Y, y), while the signer only receives the commitment value Y and cannot calculate the corresponding evidence y. The signer calls the KeyGen algorithm to generate its public key and private key, and uses the private key and Y to call the PreSign algorithm to calculate the pre-signature of the message. Then, after the adapter obtains the message and pre-signature from the signer, it first calls the PreVerify algorithm to verify the validity of the message and pre-signature, and then calls the Adapt algorithm to generate the formal signature of the message. Finally, the signer sends the pre-signature and the received formal signature to the third party. The third party completes the extraction of evidence y by calling the Ext algorithm.

[0009] The present invention uses a double-ring signature signing and verification method based on the adapter signature algorithm structure. In addition to meeting the unconditional anonymity of the traditional linkable ring adapter signature, it also has the characteristics of shorter signatures and lower computational complexity, which is more conducive to realizing anonymous and efficient blockchain "off-chain transactions".

[0010] The specific technical solutions are as follows:

[0011] An adapter signature method based on a double ring is characterized in that: four entities are involved, namely, a system administrator, a signer, an adapter and a third party; first, the system administrator calls an initialization Setup algorithm to determine system parameters and shares the system parameters with other entities; wherein, the adapter receives a complete difficult relationship pair (Y, y), while the signer only receives a commitment value Y and cannot calculate the corresponding evidence y; the signer calls a KeyGen algorithm to generate its public key and private key, and uses the private key and Y to call a PreSign algorithm to calculate a pre-signature of a message; then, after the adapter obtains the message and pre-signature from the signer, it first calls a PreVerify algorithm to verify the validity of the message and the pre-signature, and then calls an Adapt algorithm to generate a formal signature of the message; finally, the signer sends the pre-signature and the received formal signature to the third party; the third party completes the extraction of evidence y by calling an Ext algorithm.

[0012] Furthermore, it specifically includes the following 6 algorithm steps:

[0013] Step 1. System initialization Setup: used to generate the parameters required for the entire signature system, including at least: system-related parameter group Hash function H(·) and a pair of difficult relation instances I Y :(Y,y);

[0014] Step 2. Key generation KeyGen: used to generate the public and private key pair (pk, sk) of the user User. The specific process is as follows:

[0015] Step 2.1: The key generation center KGC randomly selects an integer As User's private key sk = x;

[0016] Step 2.2: The key generation center KGC calculates and publishes the User's public key pk based on the selected master private key x using formula (1):

[0017] pk=g x mod p (1)

[0018] Among them, mod p represents modulo p operation;

[0019] Step 3. PreSign generation: used by user User to generate a presignature for message M The specific process is as follows:

[0020] Step 3.1: User User randomly selects a group of users and obtains a public key set pk={pk1,…,pk n}, let the index of User in the group be j, that is, the public and private key pair of User in the group is (pk j ,sk j );

[0021] Step 3.2: User randomly selects an integer and n-1 integers Where i≠j; User calculates R according to formula (2):

[0022]

[0023] Among them, g represents the group domain The generator of Indicates that the cumulative multiplication operation is performed from 1 to n according to the index i;

[0024] Step 3.3: User calculates c according to formula (3):

[0025] c=H(M,pk,R) (3)

[0026] Where H(·) represents a secure hash function;

[0027] Step 3.4: User calculates c according to formula (4) j :

[0028]

[0029] in, Indicates that the accumulation operation is performed from 1 to n according to the index i;

[0030] Step 3.5: User calculates the partial pre-signature according to formula (5) And judge like If true, return to step 3.2, otherwise go to step 3.6:

[0031]

[0032] Step 3.6: User integrates all c i and c j Generate a vector a←(c1,…,c n );

[0033] Step 3.7: User calculates P according to formula (6):

[0034]

[0035] Step 3.8: User User calls the Non-interactive Sum Argument (NISA) algorithm in the zero-knowledge proof ROOF Function, calculate the proof value π←NISA.P ROOF ({param,pk,g,P,c},a);

[0036] Step 3.9: User outputs pre-signature

[0037] Step 4. Pre-signature verification PreVerify: used to verify the signature of message M Legality, the specific verification process is as follows:

[0038] Step 4.1: The verifier recalculates c = H(M, pk, R) according to formula (3);

[0039] Step 4.2: The verifier recalculates according to formula (6)

[0040] Step 4.3: The verifier calls V of the NISA algorithm ERIFY function and checks 0←NISA.V ERIFY({param,pk,g,P,c},π) is true, if not, the message pre-signature is legal, otherwise, the message pre-signature is illegal;

[0041] Step 5. Signature adaptation: It is used to adapt the owner U1 of the difficult relationship pair (Y, y) to the formal signature σ = (z, R, π) of the message M. The specific adaptation process is as follows:

[0042] Step 5.1: U1 parses the pre-signature of message M into And calculate the partial formal signature z according to formula (7):

[0043]

[0044] Step 5.2: U1 outputs the formal signature of message M as σ = (z, R, π);

[0045] Step 6. Evidence extraction Ext: used by the pre-signature and formal signature owner U2 to extract the evidence y of the commitment Y in the difficult relationship pair. The specific extraction process is as follows:

[0046] Step 6.1: U2 parses the pre-signature and formal signature of message M into and σ = (z, R, π), and calculate the evidence y of the difficult relationship according to formula (8);

[0047]

[0048] Step 6.2: Check Y=g y Is it true? If so, U2 outputs evidence y of the difficult relationship, otherwise it outputs a null value.

[0049] The present invention and its preferred embodiment have the following advantages and beneficial effects:

[0050] First, the existing adapter signature scheme can reduce the computational overhead and intermediary fees in traditional blockchain transactions, but it still cannot solve problems such as on-chain address correlation and cannot be applied to anonymous transaction scenarios of blockchain (such as Monero).

[0051] Secondly, the existing Linkable Ring Adaptor Signature can ensure the anonymity of the payer and detect double spending in digital currency transactions with anonymity requirements. However, the signature has a complex signing and verification process, which causes the storage / communication cost and computational overhead of the signature to increase linearly with the number of ring members.

[0052] This paper proposes a more anonymous and efficient dual-ring adapter signature scheme based on dual-ring signature. In addition to meeting the unconditional anonymity of traditional linkable ring adapter signatures, the new scheme also has the characteristics of shorter signatures and lower computational complexity, which is more conducive to realizing anonymous and efficient blockchain digital currency transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0054] Figure 1 The figure is a schematic diagram of the implementation process of the embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to make the features and advantages of this patent more obvious and easy to understand, the following embodiments are specifically described in detail with the accompanying drawings as follows:

[0056] 1. Symbols and definitions

[0057] KGC: Key Generation Center.

[0058] User,U1,U2: user.

[0059] p,q: large prime numbers.

[0060] A finite field with p elements.

[0061] g: group domain The generator of .

[0062] I Y :It is expressed as a pair of difficult relations (Y, y), which is Y=g in discrete logarithms y .

[0063] H(·): A secure cryptographic hash function with a mapping relationship of {0,1} * →{0,1} l , and l is greater than the maximum value that |q| can take.

[0064] j: A random number selected from {1,2,…,n}.

[0065] x,r,{c1,…,c n-1}: The elements in .

[0066] sk: sk = x, the signer's private key.

[0067] pk:pk=g x mod p, the signer's public key.

[0068] pk:pk={pk1,…,pk n}, user group public key collection.

[0069] sk j : The private key of the signer in the group.

[0070] pk j : The public key of the signer in the group.

[0071] M: The signed message.

[0072] It means to perform cumulative multiplication operation from 1 to n according to index i.

[0073] It means to perform accumulation operation from 1 to n according to index i.

[0074] ∧: means “and”.

[0075] Pre-signed.

[0076] σ: σ = (z, R, π), formal signature.

[0077] π: The proof calculated by the proof algorithm.

[0078] NISA (Non-interactive Sum Argument): Non-interactive sum proof algorithm in zero-knowledge proof.

[0079] NISA.P ROOF ({param,g,P,c},a): Proof algorithm in non-interactive sum proof algorithm to output proof

[0080] NISA.V ERIFY ({param,g,P,c},π): The verification algorithm in the non-interactive summation proof algorithm, which outputs 0 / 1 to determine whether the verification is successful.

[0081] 2. Signature Generation and Verification

[0082] like Figure 1As shown, the implementation process of the scheme in this embodiment includes four entities: system administrator, signer, adapter, and third party. First, the system administrator calls the initialization Setup algorithm to determine the system parameters and share the system parameters with other entities. Among them, the adapter receives the complete difficult relationship pair (Y, y), while the signer only receives the commitment value Y and cannot calculate the corresponding evidence y. The signer calls the KeyGen algorithm to generate its public key and private key, and uses the private key and Y to call the PreSign algorithm to calculate the pre-signature of the message. Then, after the adapter obtains the message and pre-signature from the signer, it first calls the PreVerify algorithm to verify the validity of the message and pre-signature, and then calls the Adapt algorithm to generate the formal signature of the message. Finally, the signer sends the pre-signature and the received formal signature to the third party. The third party can call the Ext algorithm to complete the extraction of evidence y.

[0083] Specifically, this dual-ring adapter signature scheme mainly includes six algorithms: initialization (Setup), key generation (KeyGen), pre-signature (PreSign), pre-verification (PreVerify), signature adaptation (Adapt), and evidence extraction (Ext). The specific steps are as follows:

[0084] Step 1. System initialization Setup: used to generate the parameters required for the entire signature system, including at least: system-related parameter group Hash function H(·) and a pair of difficult relation instances I Y :(Y,y);

[0085] Step 2. Key generation KeyGen: used to generate the public and private key pair (pk, sk) of the user User. The specific process is as follows:

[0086] Step 2.1: The key generation center KGC randomly selects an integer As User's private key sk = x;

[0087] Step 2.2: The key generation center KGC calculates and publishes the User's public key pk based on the selected master private key x using formula (1):

[0088] pk=g x mod p (1)

[0089] Among them, mod p represents modulo p operation;

[0090] Step 3. PreSign generation: used by user User to generate a presignature for message M The specific process is as follows:

[0091] Step 3.1: User User randomly selects a group of users and obtains a public key set pk={pk1,…,pkn}, let the index of User in the group be j, that is, the public and private key pair of User in the group is (pk j ,sk j );

[0092] Step 3.2: User randomly selects an integer and n-1 integers Where i≠j; User calculates R according to formula (2):

[0093]

[0094] Among them, g represents the group domain The generator of Indicates that the cumulative multiplication operation is performed from 1 to n according to the index i; Step 3.3: User User calculates c according to formula (3):

[0095] c=H(M,pk,R) (3)

[0096] Where H(·) represents a secure hash function;

[0097] Step 3.4: User calculates c according to formula (4) j :

[0098]

[0099] in, Indicates that the accumulation operation is performed from 1 to n according to the index i;

[0100] Step 3.5: User calculates the partial pre-signature according to formula (5) And judge like If true, return to step 3.2, otherwise go to step 3.6:

[0101]

[0102] Step 3.6: User integrates all c i and c j Generate a vector a←(c1,…,c n );

[0103] Step 3.7: User calculates P according to formula (6):

[0104]

[0105] Step 3.8: User User calls the Non-interactive Sum Argument (NISA) algorithm in the zero-knowledge proof.ROOF Function, calculate the proof value π←NISA.P ROOF ({param,pk,g,P,c},a);

[0106] Step 3.9: User outputs pre-signature

[0107] Step 4. Pre-signature verification PreVerify: used to verify the signature of message M Legality, the specific verification process is as follows:

[0108] Step 4.1: The verifier recalculates c = H(M, pk, R) according to formula (3);

[0109] Step 4.2: The verifier recalculates according to formula (6)

[0110] Step 4.3: The verifier calls V of the NISA algorithm ERIFY function and checks 0←NISA.V ERIFY ({param,pk,g,P,c},π) is true, if not, the message pre-signature is legal, otherwise, the message pre-signature is illegal;

[0111] Step 5. Signature adaptation: It is used to adapt the owner U1 of the difficult relationship pair (Y, y) to the formal signature σ = (z, R, π) of the message M. The specific adaptation process is as follows:

[0112] Step 5.1: U1 parses the pre-signature of message M into And calculate the partial formal signature z according to formula (7):

[0113]

[0114] Step 5.2: U1 outputs the formal signature of the message M as σ = (z, R, π);

[0115] Step 6. Evidence extraction Ext: used by the pre-signature and formal signature owner U2 to extract the evidence y of the commitment Y in the difficult relationship pair. The specific extraction process is as follows:

[0116] Step 6.1: U2 parses the pre-signature and formal signature of message M into and σ = (z, R, π), and calculate the evidence y of the difficult relationship according to formula (8);

[0117]

[0118] Step 6.2: Check Y=g y Is it true? If so, U2 outputs evidence y of the difficult relationship, otherwise it outputs a null value.

[0119] This patent is not limited to the above-mentioned optimal implementation mode. Anyone can derive other various forms of dual-ring based adapter signature methods under the inspiration of this patent. All equivalent changes and modifications made according to the scope of the patent application of the present invention should be covered by this patent.

Claims

1. A dual-ring based adapter signature method, characterized in that: It involves four entities: system administrator, signer, adapter, and third party. First, the system administrator calls the initialization Setup algorithm to determine the system parameters and share the system parameters with other entities. The adapter receives the complete difficult relationship pair (Y, y), while the signer only receives the commitment value Y and cannot calculate the corresponding evidence y. The signer calls the KeyGen algorithm to generate its public key and private key, and uses the private key and Y to call the PreSign algorithm to calculate the pre-signature of the message. Then, after the adapter obtains the message and pre-signature from the signer, it first calls the PreVerify algorithm to verify the validity of the message and pre-signature, and then calls the Adapt algorithm to generate the formal signature of the message. Finally, the signer sends the pre-signature and the received formal signature to the third party. The third party completes the extraction of evidence y by calling the Ext algorithm. Specifically, it includes the following 6 algorithm steps: Step 1. System initialization Setup: used to generate the parameters required for the entire signature system, including at least: system-related parameter group Hash function H(·) and a pair of difficult relation instances I Y :(Y,y); Among them, p and q are large prime numbers. is a finite field containing p elements, and g is a group field The generator of Step 2. Key generation KeyGen: used to generate the public and private key pair (pk, sk) of the user User. The specific process is as follows: Step 2.1: The key generation center KGC randomly selects an integer As User's private key sk = x; Step 2.2: The key generation center KGC calculates and publishes the User's public key pk based on the selected master private key x using formula (1): pk=g x modp (1) Among them, modp represents modulo p operation; Step 3. PreSign generation: used by user User to generate a presignature for message M Among them, π is the proof calculated by the proof algorithm. The specific process is as follows: Step 3.1: User User randomly selects a group of users and obtains a public key set pk={pk1,…,pk n }, let the index of User in the group be j, that is, the public and private key pair of User in the group is (pk j ,sk j ); Step 3.2: User randomly selects an integer and n-1 integers Where i≠j; User calculates R according to formula (2): Among them, g represents the group domain The generator of Indicates that the cumulative multiplication operation is performed from 1 to n according to the index i; Step 3.3: User calculates c according to formula (3): c=H(M,pk,R)(3) Where H(·) represents a secure hash function; Step 3.4: User calculates c according to formula (4) j : in, Indicates that the accumulation operation is performed from 1 to n according to the index i; Step 3.5: User calculates the partial pre-signature according to formula (5) And judge like If true, return to step 3.2, otherwise go to step 3.6: Step 3.6: User integrates all c i and c j Generate a vector a←(c1,…,c n ); Step 3.7: User calculates P according to formula (6): Step 3.8: User User calls the non-interactive sum proof algorithm NISA in the zero-knowledge proof P ROOF Function, calculate the proof value π←NISA.P ROOF ({param,pk,g,P,c},a); Step 3.9: User outputs pre-signature Step 4. Pre-signature verification PreVerify: used to verify the signature of message M Legality, the specific verification process is as follows: Step 4.1: The verifier recalculates c = H(M, pk, R) according to formula (3); Step 4.2: The verifier recalculates according to formula (6) Step 4.3: The verifier calls V of the NISA algorithm ERIFY function and checks 0←NISA.V ERIFY ({param,pk,g,P,c},π) is true, if not, the message pre-signature is legal, otherwise, the message pre-signature is illegal; Step 5. Signature adaptation: It is used to adapt the owner U1 of the difficult relationship pair (Y, y) to the formal signature σ = (z, R, π) of the message M. The specific adaptation process is as follows: Step 5.1: U1 parses the pre-signature of message M into And calculate the partial formal signature z according to formula (7): Step 5.2: U1 outputs the formal signature of message M as σ = (z, R, π); Step 6. Evidence extraction Ext: used by the pre-signature and formal signature owner U2 to extract the evidence y of the commitment Y in the difficult relationship pair. The specific extraction process is as follows: Step 6.1: U2 parses the pre-signature and formal signature of message M into and σ = (z, R, π), and calculate the evidence y of the difficult relationship according to formula (8); Step 6.2: Check Y=g y Is it true? If so, U2 outputs evidence y of the difficult relationship, otherwise it outputs a null value.

Images