An efficient certificateless signature method that resists secret value leakage

Abstract

The present invention proposes an efficient certificateless signature method that resists secret value leakage, which is composed of the following steps: system initialization stage, partial private key generation stage, secret value selection stage, public key generation stage, signature stage, and signature verification stage. This method has the following characteristics: 1. Compared with the traditional anti-Normal type attacker method, this method has higher security and can ensure the confidentiality of the user's partial private key when the user's secret value is leaked; 2. Compared with the traditional anti-Strong type and Super type attacker scheme, this method has obvious efficiency advantages; 3. The scale of the user's partial private key, secret value, and public key is the same as the traditional anti-Normal type attacker scheme, and is composed of only one group element.

Description

Technical Field

[0001] The invention belongs to the field of computer security, and in particular relates to an efficient certificateless signature method that resists secret value leakage. Background Art

[0002] Digital signature technology is an important cryptographic tool for authentication in information systems to ensure data integrity and non-repudiation. In the traditional public key cryptography system, the cost of establishing and maintaining the public key infrastructure (PKI) is huge. In order to simplify the workflow of the certificate center and reduce the cost of issuing, managing, and authenticating digital certificates, Adi Shamir proposed an identity-based cryptography system. Under this system, users do not need to calculate public keys and apply for digital certificates to bind their identities and public keys; but at the same time, this system introduces a trusted third party to generate and distribute private keys for the applicants based on their identities. Such a process also brings about the key escrow problem, that is, the trusted third party owns the private keys of all users. Based on the above research, Al-Riyami and Paterson proposed a certificateless cryptography system that combines the characteristics of the identity-based system and the traditional public key system. In the certificateless system, there is a third party specifically responsible for calculating the user's partial private key based on the user's identity; at the same time, the user himself also generates a secret value and calculates the public key. The user's partial private key and the secret value together serve as his own complete private key, and the public key does not need to be supplemented by a digital certificate to bind his identity.

[0003] After a long period of research and development, digital signature technology under the certificateless cryptographic system has formed a relatively mature design method. In addition to the first and second categories of attackers originally proposed, researchers further subdivided attackers into Normal, Strong, and Super categories. Generally speaking, in the certificateless signature method against Normal attackers, the first type of attacker can directly replace the public key of the target user and obtain the user's valid signature under the original public key, but cannot grasp the target user's secret value, and the efficiency of the scheme is relatively high; in the certificateless signature method against Strong and Super attackers, the first type of attacker can obtain the valid signature under the original public key and the newly replaced public key, and can also obtain the target user's secret value, but the efficiency of the scheme is lower than that of the Normal scheme. In summary, the current certificateless signature method needs to make a trade-off between security and efficiency.

[0004] In practical applications, more and more scenarios need to consider new security requirements and efficiency requirements. For example, with the promotion and popularization of electronic health systems, personal health data monitoring has become an indispensable part of the daily life of many users. Personal physical status data, such as blood pressure, heart rate, fall detection, etc., can be collected and transmitted to the server of the medical center through various smart wearable devices. Certificateless signature technology can be used to verify data integrity. In order to use it in the daily monitoring system of health data, the special security requirements of the system should also be considered. First, the sensors in smart wearable devices passively collect and transmit data, so the device can be built-in with chips and encapsulated with execution logic when it leaves the factory. Usually, there is no need to worry about situations like ordinary users being induced or using replaced secret values ​​to calculate signatures. Therefore, the system does not need to consider the ability of attackers to obtain valid signatures under replaced public keys, that is, it only needs to consider classifying attackers as Normal. Secondly, due to the particularity of the working environment and working mode of wearable devices, the secret values ​​built into the device are likely to be leaked. For example, smart bracelets, smart watches and other devices often suffer from accidents such as loss and theft. At this time, the attacker may obtain the user's secret value stored on the smart device. On the other hand, wearable devices have limited resources, and the battery size and battery life must also be considered, which places high requirements on the efficiency indicators of the certificateless signature method used. Traditional methods that are secure against Normal attackers cannot meet the security requirements of resisting secret value leakage; while methods that are secure against Strong and Super attackers are less efficient and cannot guarantee sufficient portability and battery life requirements for the device. Among the existing certificateless signature technologies, it is difficult to find a method that has the best of both worlds. Summary of the invention

[0005] The present invention proposes an efficient certificateless signature method that resists secret value leakage. This method is an improvement on the traditional anti-Normal attacker scheme. By redesigning the signature phase, it is ensured that under the condition that the user's secret value is leaked, the attacker still cannot calculate and obtain the user's partial private key. Secondly, the specific parameters and steps of the system initialization phase, partial private key generation phase, secret value generation phase, and public key generation phase of the method are consistent with the traditional certificateless signature method that resists Normal attackers, ensuring efficiency.

[0006] In order to achieve the above object, the technical solution of the present invention is as follows: an efficient certificateless signature method that resists secret value leakage, the method comprising the following steps:

[0007] Step 1: System initialization phase: The key generation center KGC inputs a security parameter 1 λ , the output is the system master public key mpk and master key msk, that is,

[0008] Setup(1λ )→(mpk, msk);

[0009] Step 2: Partial private key generation phase: The key generation center KGC inputs the master public key mpk, the master private key msk and a user's identity information ID, and outputs the user's partial private key D ID ,Right now

[0010] PartialKey(mpk,msk,ID)→D ID ;

[0011] Step 3: Secret value generation phase: The user inputs the master public key mpk and the user's identity information ID, and the output is the user's secret value x ID ,Right now

[0012] SecretValue(mpk, ID) → x ID ;

[0013] Step 4: Public key generation phase: The user enters the public key mpk, the user's identity ID and the secret value x ID , the output is the user's public key pk ID ,Right now

[0014] PublicKey(mpk, ID, x ID )→pk ID ;

[0015] Step 5: Signature phase: The user enters the system master public key mpk, the user's identity ID, and the user's partial private key D ID , the user's secret value x ID and the message to be signed m, the output is a signature σ m ,Right now

[0016] Sign(mpk,ID,D ID , x ID ,m)→σ m ;

[0017] Step 6: Signature verification phase: The user enters the system master public key mpk, the user's identity ID, and the user's public key pk ID , a message m and a signature σ m The output is "1" if the verification is successful, otherwise the output is "0" if the verification fails. This scheme achieves a balanced optimization of both security and efficiency. In terms of security, compared with the traditional method of security against Normal attackers, this method can additionally resist attacks of secret value leakage; in terms of efficiency, compared with the traditional method of security against Strong and Super attackers, this method has obvious advantages in efficiency. The specific definition of the method is similar to that of traditional certificateless signature.

[0018] Among them, step 1 is as follows: System initialization stage: Set BG(1 λ )→(e,p,G,G T ) is a bilinear group generation algorithm, which inputs the security parameter 1 λ , output prime p-order cyclic group G, G T , where e: G×G→G T It is a bilinear pairing operation. The key generation center KGC inputs security parameter 1 λ , run BG(1 κ )→(e,p,G,G T ), then select the generator P∈G and randomly select s∈Z p And calculate P pub =s·P, select hash function H2: {0, 1} * →Z p , H1, H3: {0, 1} * →G, where Z p is a cyclic group formed by modulo p. The system's master public key and master private key are set as follows

[0019] mpk={e,p,G,G T ,P,H1,H2,H3,P pub},msk=s,

[0020] The key generation center KGC publishes the system master public key mpk and secretly stores the system master private key msk.

[0021] Among them, in step 2, the partial key generation phase: the key generation center KGC inputs the system master public key mpk, the master private key msk=s and the user's identity information ID, and calculates Q ID =H1(ID) and D ID =s·Q ID , output part of the private key of the user ID and transmit it to the user through a secure channel.

[0022] Among them, in step 4, the public key generation phase: the user enters the system master public key mpk, user identity ID and secret value x ID , calculate pk ID =x ID P, output pk ID as your public key.

[0023] Among them, in step 5, the signing stage: the user enters the system master public key mpk, user identity ID, and part of the private key D ID , secret value x ID and the message m to be signed, select a random number r∈Z p And calculate

[0024] U=r·P∈G,

[0025] h m =H2(U||ID||pk ID ||m)∈Z p ,

[0026] H m =H3(U||ID||pk ID ||m)∈G,

[0027] Where U is the result of scalar multiplication of the base point P of the elliptic curve, h m and H m They are the calculation results of hash functions H2 and H3 respectively; continue to calculate

[0028] V=h m ·D ID +x ID ·H m +r·P pub ,

[0029] Where V is the user's partial private key D ID , the calculation result of the previous step H m and master public key parameters P pub The results of scalar multiplication are calculated respectively; finally, the user outputs σ m =(U, V) as the signature of the message m. The signing phase in step 5 ensures that when the user's secret value x ID When leaked, the attacker cannot calculate the user's partial private key D through the secret value and the user's signature ID This security requirement cannot usually be guaranteed in traditional certificateless signing methods that are resistant to Normal attackers.

[0030] Among them, in step 6, the signature verification phase: the signature verifier enters the system master public key mpk, the signing user identity ID, and the signing user public key pk ID , message m and signature σ m =(U, V), verify whether the following equation is true

[0031]

[0032] Where Q ID=H1(ID),h m =H2(U||ID||pk ID ||m), H m =H3(U||ID||pk ID ||m), if the equation holds, output 1, indicating that the signature is verified; otherwise, output 0, indicating that the signature verification fails.

[0033] The signature phase in step 5 has obvious advantages in terms of computational overhead and signature length compared with the existing certificateless signature method that is resistant to Strong and Super attackers. The specific comparison and analysis are shown in Table 1.

[0034] The specific parameters and steps of the system initialization phase, partial private key generation phase, secret value generation phase, and public key generation phase in steps 1-4 are consistent with the traditional certificateless signature method against Normal attackers to maximize efficiency. Therefore, the scale of the system master public key, user partial private key, user secret value, and user public key of this method is the same as that of the traditional method, and is composed of only one group element. The increased overhead of the method for improving security is only reflected in the signing phase and signature verification phase in steps 5-6.

[0035] Compared with the existing technology, the advantages of this scheme are as follows: This method has the following characteristics. 1. Compared with the traditional anti-Normal type attacker method, this method has higher security and can ensure the confidentiality of the user's partial private key when the user's secret value is leaked; 2. Compared with the traditional anti-Strong type and Super type attacker scheme, this method has obvious efficiency advantages; 3. The scale of the user's partial private key, secret value, and public key is the same as the traditional anti-Normal type attacker scheme, and is composed of only one group element. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a process framework diagram of the present invention. DETAILED DESCRIPTION

[0037] In order to deepen the recognition and understanding of the present invention, the technical solution is described in detail below with reference to the accompanying drawings.

[0038] Embodiment 1: An efficient certificateless signature method for resisting secret value leakage, the method comprising the following steps:

[0039] Step 1: System initialization phase: The key generation center KGC inputs a security parameter 1 λ , the output is the system master public key mpk and master key msk, that is,

[0040] Setup(1 λ )→(mpk, msk);

[0041] Step 2: Partial private key generation phase: The key generation center KGC inputs the master public key mpk, the master private key msk and a user's identity information ID, and outputs the user's partial private key D ID ,Right now

[0042] PartialKey(mpk,msk,ID)→D ID ;

[0043] Step 3: Secret value generation phase: The user inputs the master public key mpk and the user's identity information ID, and the output is the user's secret value x ID ,Right now

[0044] SecretValue(mpk, ID) → x ID ;

[0045] Step 4: Public key generation phase: The user enters the public key mpk, the user's identity ID and the secret value x ID , the output is the user's public key pk ID ,Right now

[0046] PublicKey(mpk, ID, x ID )→pk ID ;

[0047] Step 5: Signature phase: The user enters the system master public key mpk, the user's identity ID, and the user's partial private key D ID , the user's secret value x ID and the message to be signed m, the output is a signature σ m ,Right now

[0048] Sign(mpk,ID,D ID , x ID ,m)→σ m ;

[0049] Step 6: Signature verification phase: The user enters the system master public key mpk, the user's identity ID, and the user's public key pk ID , a message m and a signature σ m The output is "1" if the verification is successful, otherwise the output is "0" if the verification fails.

[0050]

[0051] Among them, step 1: system initialization phase: Assume BG(1 λ )→(e,p,G,G T ) is a bilinear group generation algorithm. The algorithm inputs the security parameter 1 λ , output prime p-order cyclic group G, G T, where e: G×G→G T It is a bilinear pairing operation. The key generation center KGC inputs security parameter 1 λ , run BG(1 κ )→(e,p,G,G T ), then select the generator P∈G and randomly select s∈Z p And calculate P pub =s·P, select hash function H2: {0, 1} * →Z p , H1, H3: {0, 1} * →G, where Z p is a cyclic group formed by modulo p. The system's master public key and master private key are set as follows

[0052] mpk={e,p,G,G T ,P,H1,H2,H3,P pub},msk=s,

[0053] The key generation center KGC publishes the system master public key mpk and secretly stores the system master private key msk.

[0054] The initialization phase in step 1 outputs an additional hash function H2: {0, 1} * →Z p , as part of the system's master public key, and is used in subsequent signing and verification stages.

[0055] Step 2: Partial key generation phase: The key generation center KGC inputs the system master public key mpk, the master private key msk=s and the user's identity information ID, and calculates Q ID =H1(ID) and D ID =s·Q ID , output part of the private key of the user ID and transmit it to the user through a secure channel.

[0056] Step 3: Secret value generation phase: The user enters the system master public key mpk and user identity ID, and randomly selects Output x ID as its own secret value.

[0057] Step 4: Public key generation phase: The user enters the system master public key mpk, user identity ID and secret value x ID , calculate pk ID =x ID P, output pk ID as your public key.

[0058] Step 5: Signature phase: The user enters the system master public key mpk, user ID, and part of the private key D ID , secret value xID and the message m to be signed, randomly select r∈Z p And calculate

[0059] U=r·P,

[0060] h m =H2(U||ID||pk ID ||m)∈Z p ,

[0061] H m =H3(U||ID||pk ID ||m)∈G,

[0062] Continue calculation

[0063] V=h m ·D ID +x ID ·H m +r·P pub .

[0064] Finally, the user outputs σ m =(U, V) as the signature of message m.

[0065] The signing phase in step 5 introduces an additional element U=r·P to protect the user's partial private key and prevent the attacker from inferring the partial private key through the signature due to the leakage of the secret value; then, all elements involved in the signature are bound to the user's partial private key, as follows: m =H2(U||ID||pk ID ||m)∈Z p , and include h in the second part of the signature m ·D ID .

[0066] Step 6: Signature verification phase: The signature verifier enters the system master public key mpk, the signing user identity ID, and the signing user public key pk ID , message m and signature σ m =(U, V), verify whether the following equation is true

[0067]

[0068] Where Q ID =H1(ID),h m =H2(U||ID||pk ID ||m), H m =H3(U||ID||pk ID ||m). If the equation holds, output 1, indicating that the signature is verified; otherwise, output 0, indicating that the signature verification fails.

[0069] The signature verification stage in step 6 requires an additional verification of the first part of the signature U=rP, as follows: The verification equation contains U, specifically h m Q ID +U.

[0070] Table 1 is a comparison of the efficiency of the present invention and the traditional anti-Normal, Strong and Super methods.

[0071] Table 1

[0072]

[0073] Note: G, Z p denotes the binary length of an element in an elliptic curve point group and a cyclic group modulo p, respectively, T H , T m , T p , T e They represent a hash operation, a scalar multiplication operation on the elliptic curve point group, a bilinear pairing operation, and a bilinear pairing range group G. T The time cost of upper modular exponentiation operation,the time cost of group operation is ignored in the,comparison of all the calculation costs.

[0074] The above content is only one embodiment of the present invention, and its description is detailed, but it cannot be used as a limitation on the scope of the invention patent. Under the premise of those skilled in the art without creative work, through deformation or minor improvements, they are also included in the patent protection scope of the present invention.

Claims

1. An efficient certificateless signature method that resists secret value leakage, characterized in that: The method comprises the following steps: Step 1: System initialization phase: The key generation center KGC inputs a security parameter 1 λ , the output is the system master public key mpk and master key msk, that is, Setup(1 λ )→(mpk,msk); Step 2: Partial private key generation phase: The key generation center KGC inputs the master public key mpk, the master private key msk and a user's identity information ID, and outputs the user's partial private key D ID ,Right now PartialKey(mpk,msk,ID)→D ID ; Step 3: Secret value generation phase: The user inputs the master public key mpk and the user's identity information ID, and the output is the user's secret value x ID ,Right now SecretValue(mpk,ID)→x ID ; Step 4: Public key generation phase: The user enters the public key mpk, the user's identity ID and the secret value x ID , the output is the user's public key pk ID ,Right now PublicKey(mpk,ID,x ID )→pk ID ; Step 5: Signature phase: The user enters the system master public key mpk, the user's identity ID, and the user's partial private key D ID , the user's secret value x ID and the message m to be signed, the output is a signature σ m ,Right now Sign(mpk,ID,D ID ,x ID ,m)→σ m ; Step 6: Signature verification phase: The user enters the system master public key mpk, the user's identity ID, and the user's public key pk ID , a message m and a signature σ m , the output is "1" to indicate that the verification is successful, otherwise the output is "0" to indicate that the verification fails, that is, Step 1 is as follows: System initialization phase: Set BG(1 λ )→(e,p,G,G T ) is a bilinear group generation algorithm, which inputs the security parameter 1 λ , output prime p-order cyclic group G,G T , where e:G×G→G T It is a bilinear pairing operation, and the key generation center KGC inputs the security parameter 1 λ , run BG(1 κ )→(e,p,G,G T ), then select the generator P∈G and randomly select s∈Z p And calculate P pub =s·P, select hash function H2:{0,1} * →Z p ,H1,H3:{0,1} * →G, where Z p The system's master public key and master private key are set as follows: mpk={e,p,G,G T ,P,H1,H2,H3,P pub },msk=s, The key generation center KGC publishes the system master public key mpk and secretly stores the system master private key msk. In step 2, the partial key generation phase: the key generation center KGC inputs the system master public key mpk, the master private key msk=s and the user's identity information ID, and calculates Q ID =H1(ID) and D ID =s·Q ID , output the partial private key of the user ID and transmit it to the user through a secure channel, In step 4, Public key generation phase: The user inputs the system master public key mpk, user ID and secret value x ID , calculate pk ID =x ID P, output pk ID As your public key, In step 5, signing phase: the user enters the system master public key mpk, user ID, and part of the private key D ID , secret value x ID and the message m to be signed, select a random number r∈Z p And calculate U=r·P∈G, h m =H2(U∥ID∥pk ID ∥m)∈Z p , H m =H3(U∥ID∥pk ID ∥m)∈G, Where U is the result of scalar multiplication of the base point P of the elliptic curve, h m and H m They are the calculation results of hash functions H2 and H3 respectively; continue to calculate V=h m ·D ID +x ID ·H m +r·P pub , Where V is the user's partial private key D ID , the calculation result of the previous step H m and master public key parameters P pub The results of scalar multiplication are calculated respectively; finally, the user outputs σ m =(U,V) as the signature of the message m, the signing stage in step 5 ensures that the user's secret value x ID When leaked, the attacker cannot calculate the user's partial private key D through the secret value and the user's signature ID ,Security requirements are usually not guaranteed in traditional certificateless signature methods against Normal attackers.,In step 6, signature verification phase: the signature verifier inputs the system master public key mpk, the signature user identity ID, and the signature user public key pk ID , message m and signature σ m =(U,V), verify whether the following equation is true Where Q ID =H1(ID),h m =H2(U∥ID∥pk ID ∥m), H m =H3(U∥ID∥pk ID ∥m), if the equation holds, output 1, indicating that the signature is verified; otherwise, output 0, indicating that the signature verification fails.

Images