A threshold ring signature method based on lattice cryptography

Abstract

The application provides a threshold ring signature method based on lattice cryptography, which comprises a key generation algorithm, a signature algorithm and a verification algorithm. The key generation algorithm comprises generating a private key and a public key of a user; the signature algorithm comprises selecting a leader for aggregation, distributing a challenge and outputting a final signature; and the verification algorithm verifies whether the signature is generated by t signers legally. A signing process is constructed by using an abortive Fiat-Shamir paradigm (FSwA), comprises three rounds of commitment-challenge-response, is completed through interaction between a user and a leader, and N responses generated contain t real signatures and N-t pseudo signatures generated by using an empty private key. The application avoids the problem of large reliability error of an existing post-quantum threshold ring signature method, so that a shorter signature length is achieved. In addition, the application achieves many good properties such as strong anonymity, scalability, unconfirmability and non-repudiation.

Description

Technical Field

[0001] This invention relates to the field of cryptographic privacy protection, and in particular to a threshold ring signature method based on lattice cryptography. Background Technology

[0002] The concept of ring signatures was first proposed by Rivest, Shamir, and Tauman, and instantiated based on RSA. Ring signatures allow users to dynamically choose a set of public keys (including themselves) and anonymously sign on behalf of that set without revealing the true signer. It is widely used in cryptocurrencies such as Monero, providing complete anonymity, a significant advantage compared to the pseudo-anonymity offered by cryptocurrencies like Bitcoin.

[0003] Bresson, Stern, and Szydlo extended ring signatures to threshold ring signatures, where t out of N signers anonymously generate a signature without revealing who these signers are. Since then, several threshold ring signature schemes have been proposed, such as those based on number theory assumptions or coding theory. However, these schemes suffer from high complexity and large reliability errors.

[0004] The emergence of quantum computers has posed a systemic challenge to classical cryptography. The rapid advancement of quantum computer commercialization in recent years has made it increasingly possible to break classical cryptography in practice. How to address the threat posed by quantum computers has been a hot topic in cryptography research for over a decade. Lattice-based cryptography has attracted widespread attention due to its advantages, including simple algebraic operations, high asymptotic efficiency, reducibility to the worst-case difficulty problem, and support for constructing advanced cryptographic primitives such as fully homomorphic encryption. Therefore, research on lattice-based post-quantum threshold ring signatures is of great significance; however, very few lattice-based threshold signatures have been proposed.

[0005] Therefore, it is necessary to develop a threshold ring signature method to meet the requirements of quantum computing security, while solving the problems of large reliability error and long signature length of existing threshold ring signature methods. Summary of the Invention

[0006] To overcome the shortcomings of existing technologies, a threshold ring signature method based on lattice ciphers is provided. The specific technical solution of this invention is as follows:

[0007] A threshold ring signature method based on lattice ciphers includes a key generation algorithm, a signature algorithm, and a verification algorithm. The key generation algorithm includes generating a polynomial vector x based on the key generation algorithm for BLISS signatures. i =(x i，1 x i，2 )∈R 2 ×1 and polynomial vectors Satisfy ai x i =q mod 2q, which serve as the private and public keys for user i, respectively.

[0008] Signature algorithms include leader selection. The process involves aggregating and distributing challenges, and outputting the final signature. The signing process consists of three rounds:

[0009] In the first round, for all users Leaders From Discrete Gaussian Distribution Choose vector u i =(u i，1 u i，2 and from discrete Gaussian distribution Select auxiliary random vector r i Calculate the commitment value The commitment key ck = H(μ, param) is calculated by the hash function H;

[0010] The second round, for all users Signer From Discrete Gaussian Distribution Select vector u i =(u i，1 u i，2 and from discrete Gaussian distribution Select auxiliary random vector r i Calculate the commitment value Signer Send secretly For leaders Leaders Calculate the sum of commitment values Then, calculate the challenge value. and distributed to Each signer in the list;

[0011] The third round, for all users Signer Based on private key x i And the challenge value c, calculate the signature z i =(-1) b cx i +u i , Using the rejection sampling operation, input parameter (cx) i , z i ), in probability Decide whether to send the signature value z i and random vector r iFor leaders If not, then start again from round 2 of signing; for all Leaders Calculate the pseudo-signature z of the non-signer i =u i .at last, Output threshold ring signature

[0012] Among them, R and R 2q All are polynomial rings, q is the modulus, and the system parameter param includes Let N be a set of N users, denoted by 1, 2, ..., N. Let Com represent the set of t signers. ck (·,·) is a trapdoor commitment algorithm that satisfies the additive homomorphism property. The input to the hash function H is the message to be signed μ and the system parameter param. The bits b are randomly selected from (0,1). exp(x) represents the natural logarithm e raised to the power of x. ||·|| represents the Euclidean norm. cosh(·) represents the hyperbolic cosine function. <·,·> represents the vector dot product. It contains t valid BLISS signatures and Nt pseudo-signatures signed with an empty private key. Let be the sum of the committed values, r be the sum of the auxiliary random vectors, M be the expected number of restarts for a single successful user, and s be the sum of the committed values. 2 Indicates variance.

[0013] The threshold ring signature method based on lattice ciphers further includes a verification algorithm, which includes:

[0014] Validator Check for all Signature value z i Does it satisfy ||z i ||≤B;

[0015] Validator Calculate the challenge value Then, check again. If they are equal, then the signature verification is successful.

[0016] Where B represents a preset constant used to limit the validity of signatures. The largest Euclidean norm is set as In the formula, the parameter γ > 1 makes It is negligible (in practice, γ∈[1.1, 1.4]), therefore ||z i The probability of ||>B is negligible, s represents the standard deviation, and n represents the polynomial ring. The degree of the bisector polynomial f(X).

[0017] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the threshold ring signature method based on lattice cryptography.

[0018] The beneficial effects achieved by this invention include:

[0019] 1. This invention uses a BLISS signature authentication protocol to avoid the problem of large reliability errors in existing threshold ring signature methods, thereby achieving a shorter signature length.

[0020] 2. By adopting additive homomorphic trapdoor commitments, the security proof problem caused by the abort problem of Fiat-Shamir transformation on lattices is solved, and an additional benefit is brought: t signatures can be aggregated, so that the signature length is independent of t, the signature is shorter and the verification efficiency is higher.

[0021] 3. This invention satisfies the property of scalability, that is, it allows ring members to add themselves to the signature set of the already created threshold ring signatures at any time, thereby dynamically expanding the threshold value t.

[0022] 4. This invention also achieves strong anonymity, requiring only that the leader is weakly trusted, i.e., not to disclose [the information]. All individual commitments (part of the final signature) .

[0023] 5. This invention satisfies the requirements of unconfirmability and non-repudiation, thus playing a supporting role in strong anonymity. Attached Figure Description

[0024] The invention will be further understood from the following description taken in conjunction with the accompanying drawings. The components in the drawings are not necessarily drawn to scale, but rather the emphasis is on illustrating the principles of the embodiments. In different views, the same reference numerals designate corresponding parts.

[0025] Figure 1 This is a flowchart of the key generation algorithm for a threshold ring signature method based on lattice cipher according to the present invention;

[0026] Figure 2 This is a flowchart of the signature algorithm for a threshold ring signature method based on lattice cipher according to the present invention;

[0027] Figure 3 This is a flowchart of the verification algorithm for a threshold ring signature method based on lattice cipher according to the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to its embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the invention. Other systems, methods, and / or features of this embodiment will become apparent to those skilled in the art after reviewing the following detailed description. All such additional systems, methods, features, and advantages are intended to be included within this specification, within the scope of this invention, and protected by the appended claims. Further features of the disclosed embodiments are described in the following detailed description, and these features will become apparent from the following detailed description.

[0029] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or component referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the accompanying drawings are only for illustrative purposes and should not be construed as limiting the present patent. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0030] The concept of ring signatures was first proposed by Rivest, Shamir, and Tauman, and instantiated based on RSA. Ring signatures allow users to dynamically choose a set of public keys (including themselves) and anonymously sign on behalf of that set without revealing the true signer. It is widely used in cryptocurrencies such as Monero, providing complete anonymity, a significant advantage compared to the pseudo-anonymity offered by cryptocurrencies like Bitcoin.

[0031] Two main techniques have emerged in the research of constructing ring signatures. The first is the classic ring signature, which constructs a ring structure by sequentially calculating N-1 "pseudo-signatures" from a verification function and using the signer's private key to calculate the real signature. The second main technique uses accumulators or zero-knowledge proofs. Accumulators allow the signer to provide proof that their public key is in a set of N public keys compressed into a fixed-size value; another method is to use 1-out-of-N proofs to possess the private key corresponding to a public key in the set.

[0032] Bresson, Stern, and Szydlo extended ring signatures to threshold ring signatures, where t out of N signers anonymously generate a single signature without revealing their identities. Several threshold ring signature schemes have since been proposed, such as those based on number theory assumptions or coding theory. These schemes suffer from high complexity, large reliability errors, and long signature lengths. In lattice ciphers, Cayrel, Lindner, Ruckert, and Silva proposed a lattice version of the coding scheme proposed by Melchor, Cayrel, and Gaborit. Their CLRS authentication protocol (i.e., the authentication protocol proposed by Cayrel, Lindner, Ruckert, and Silva) is similar to Stern's authentication protocol based on the coding scheme. Bettaieb and Schrek improved the signature length by using another CLRS challenge-response proof to handle anonymity. However, all of the above schemes employ a Stern-like authentication protocol, resulting in a reliability error of 1 / 2. Recently, Haque and Scafuro proposed a general construction of threshold ring signatures under the quantum random oracle model (QROM) based on trapdoor commitments and threshold secret sharing schemes; however, it is not scalable.

[0033] In recent years, research on threshold signatures and ring signatures has been activated by many new applications such as blockchain. Some recent works have investigated threshold versions of ECDSA and Schnorr; however, these schemes are not resistant to quantum computing attacks. One of the main motivations for constructing threshold signatures is to reduce the risk of key leakage or loss, which can occur in various ways, such as the failure of a single device. Furthermore, threshold signatures have important applications in scenarios requiring collaborative decision-making by multiple users, such as when a certain number of signers (t) are needed to pass a resolution. In these applications, anonymity is often required simultaneously. While ring signatures provide complete anonymity, implementing threshold features in ring signatures is difficult. Past post-quantum threshold ring signatures have mostly been based on cumbersome Stern-like zero-knowledge proofs using coded cryptography, resulting in large signature lengths due to high reliability errors. In contrast, progress and achievements in number theory are more abundant, introducing concepts such as scalability and strong anonymity.

[0034] The emergence of quantum computers has posed a systemic challenge to classical cryptography. The rapid advancement of quantum computer commercialization in recent years has made it increasingly possible to break classical cryptography in practice. How to address the threat posed by quantum computers has been a hot topic in cryptography research for over a decade. Lattice-based cryptography has attracted widespread attention due to its advantages, including simple algebraic operations, high asymptotic efficiency, reducibility to the worst-case difficulty problem, and support for constructing advanced cryptographic primitives such as fully homomorphic encryption. Therefore, research on lattice-based post-quantum threshold ring signatures is of great significance; however, very few lattice-based threshold signatures have been proposed.

[0035] In the post-quantum domain, Bansarkhani and Sturm proposed the first multi-signature algorithm following the FSwA (Fiat-Shamir with Abort) paradigm, and several variants have recently been proposed. However, as... As others have stated, due to the abort problem of the Fiat-Shamir paradigm in lattice-based settings, the security proofs of all these protocols are either incomplete or rely on non-standard, difficult assumptions. By utilizing the additive homomorphic commitment scheme of Baum et al. to circumvent the problems caused by aborts, they constructed an N-out-of-N distributed signature scheme and a multi-signature scheme with complete security proofs. They also added a trapdoor to the commitment, thereby reducing the round complexity of their scheme to two rounds. The threshold ring signature constructed in this invention also needs to address the security proof problem brought about by the FSwA paradigm.

[0036] To address the aforementioned problems, this invention provides a threshold ring signature method based on lattice ciphers, such as... Figures 1-3 As shown, it includes a key generation algorithm, a signature algorithm, and a verification algorithm.

[0037] The parameter settings and symbol explanations for the lattice-based threshold ring signature method are as follows:

[0038] ■N=100, t=10, let m=512, q=12289, s=107, κ=23, B=12872;

[0039] ■R, R q Defined as polynomial rings respectively Among them, Z[X] and Z q [X] denotes a polynomial ring with integer coefficients of unlimited degree, q is the modulus, and f(X) is defined as f(X) = X n +1 is the 2nth cycloid polynomial;

[0040] ■ Order Let {1, 2, ..., N} be a set of N users. Let t be the set of t signers, where t;

[0041] ■ This indicates that the selected leader will perform the aggregation and distribution of challenges and output the final signature. Indicates the verifier;

[0042] ■Key Set From the small polynomial S η ={x∈R:||x|| ∞ Composed of ≤η}, and parameterized by integer η≥0;

[0043] ■Challenge Collection Composed of small and sparse polynomials: C = {c ∈ R: ||c|| ∞ =1∧||c||1=κ}, and parameterized by the integer κ≥0;

[0044] ■SHA3-512 hash function H0: {0, 1} * →C, mapped to challenge set C;

[0045] ■SHA3-512 hash function Mapped to a polynomial ring R q m'-dimensional vector on;

[0046] ■||·|| ∞ Let ||·||1 represent the infinite norm, ||·||1 represent the Manhattan norm, and ||·|| represent the Euclidean norm.

[0047] ■For x∈R m , Indicates v∈R m Gaussian function of s∈R, discrete Gaussian distribution With v as the center, it is defined as in If the center v = 0, it is abbreviated as

[0048] ■ Vectors, bold italic lowercase letters, such as x, a, u, r;

[0049] ■ Matrix, bold italic uppercase letters, such as A;

[0050] ■ Indicates from Gaussian distribution A random auxiliary vector r is randomly selected from the data.

[0051] ■ exp(x) represents the natural logarithm e raised to the power of x;

[0052] ■cosh() represents the hyperbolic cosine function; input x, output...

[0053] ■<z,x> This represents the vector dot product, i.e., the scalar product z1x1 + z2x2 + ... + z n x n ;

[0054] ■Com ck (·,·) represents a trapdoor commitment algorithm that satisfies the additive homomorphic property. The commitment key is ck. The algorithm takes two parameters as input: the first parameter is the commitment message, and the second parameter is an auxiliary random number.

[0055] The key generation algorithm includes generating a polynomial vector x = (x i，1 x i，2 )∈R 2×1 and polynomial vectors Satisfy a i x i =q mod 2q, which serve as the private and public keys for user i, respectively.

[0056] Specifically, such as Figure 1 As shown, a polynomial vector x = (x_i) is generated according to the key generation algorithm for BLISS signatures. i，1 x i，2 )∈R 2×1 and polynomial vectors The specific steps of the key generation algorithm include the following: Given density parameters δ1 and δ2, select a prime number q, and randomly generate two nth-degree polynomials f. i and g i In each polynomial there is The coefficients are taken from {±1}, and there are... One coefficient is taken from {±2}, and the other coefficients are all 0. If the polynomial f i If it is irreversible, then regenerate f. i and g i .user The private key is x i =(x i，1 x i，2 ) t =(f i 2g i +1) t The public key is defined as Where a q =(2g) i +1) / f i mod q. It's easy to verify a. i x i =0 mod q and a i x i=1 mod 2, therefore a i x i =q mod 2q.

[0057] like Figure 2 As shown, the signature algorithm includes selecting a leader. The process involves aggregating and distributing challenges, and outputting the final signature. The signing process consists of three rounds:

[0058] In the first round, for all users For the Nt users who do not participate in signing, the following steps are performed: Leader From Discrete Gaussian Distribution Choose vector u i =(u i，1 u i，2 and from discrete Gaussian distribution Select auxiliary random vector r i The commitment value is calculated using the commitment algorithm. The commitment key ck = H(μ, param) is calculated by the hash function H;

[0059] The second round, for all users That is, the t users who participated in the signing performed the following steps: Signers From Discrete Gaussian Distribution Select vector u i =(u i，1 u i，2 and from discrete Gaussian distribution Select auxiliary random vector r i The commitment value is calculated using the commitment algorithm. The commitment key ck = H(μ, param) is consistent with that of the first round, and the signer... Send secretly For leaders Leaders Sum the commitments received from all users to calculate the sum of the commitment values. Then, sum the committed values As one of the inputs to the hash function H0, the challenge value is then calculated. and distributed to Each signer in the list;

[0060] The third round, for all users That is, the t users who participated in the signing performed the following steps: Signers Based on private key x i And the challenge value c, first sample random bits. Calculate signature z i =(-1)b cx i +u i , Then use the rejection sampling operation, input parameter (cx) i , z i ), in probability Decide whether to send the signature value z i and random vector r i For leaders If not, then start again from round 2 of signing; for all That is, among the Nt users who do not participate in signing, the leader Calculate the pseudo-signature z of the non-signer i =u i .at last, Output threshold ring signature

[0061] Among them, R and R 2q All are polynomial rings, q is the modulus, and the system parameter param includes Let H0 represent the public key set of N users, and let H0 be a hash function that maps to the challenge set C. Let N be a set of N users, denoted by 1, 2, ..., N. Let Com represent the set of t signers. ck (·,·) is a trapdoor commitment algorithm that satisfies the additive homomorphism property. The input to the hash function H is the message to be signed μ and the system parameter param. The bits b are randomly selected from {0,1}, exp(x) represents the natural logarithm e raised to the power of x, ||·|| represents the Euclidean norm, cosh(·) represents the hyperbolic cosine function, and <·,·> represents the vector dot product. It contains t valid BLISS signatures and Nt pseudo-signatures signed with an empty private key. Let be the sum of the committed values, r be the sum of the auxiliary random vectors, M be the expected number of restarts for a single successful user, and s be the sum of the committed values. 2 Indicates variance.

[0062] The threshold ring signature method based on lattice ciphers also includes a verification algorithm, such as... Figure 3 As shown, the verification algorithm includes the following steps: input signature σ, verifier First check for all Signature value z i Does it satisfy ||z i ||≤B;Verifier Then call the hash function H0, and input the sum of the commitment values. Calculate the challenge value using message μ. Then, check again. If they are equal, then the signature verification is successful.

[0063] Where B represents a preset constant used to limit the validity of signatures. The largest Euclidean norm is set as In the formula, the parameter γ > 1 makes It is negligible (in practice, γ∈[1.1, 1.4]), therefore ||z i The probability of ||>B is negligible, s represents the standard deviation, and n represents the polynomial ring. The degree of the bisector polynomial f(X).

[0064] This invention avoids using Stern-like authentication protocols with large reliability errors, and instead adopts Lyubashevsky's identity authentication protocol. At the same time, it uses the additive homomorphic commitment method to solve the security proof problem caused by the Fiat-Shamir paradigm with abort in the lattice, and successfully obtains a threshold ring signature with a shorter signature length, thus solving the problem proposed by Cayrel, Lindner, Ruckert and Silva.

[0065] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described threshold ring signature method based on lattice cryptography.

[0066] In summary, the beneficial effects achieved by this invention include:

[0067] 1. This invention employs a BLISS signature-based authentication protocol, avoiding the large reliability error problem of Stern-like authentication protocols, achieving a shorter signature length, and solving the problems raised by Cayrel, Lindner, Ruckert, and Silva. Stern-like authentication protocols, such as the CLRS authentication protocol in the diagram, have a reliability error of 1 / 2, therefore requiring more than 128 repetitions to reduce the reliability error to a negligible value, such as 2. -128 The authentication protocol used in this invention only needs to be executed once.

[0068] 2. The distributed FSwA signature, proposed by Bettaieb et al. in 2021, cannot fully prove its security due to the abort problem. This invention employs additive homomorphic trapdoor commitments to solve the security proof problem caused by the abort problem of Fiat-Shamir transformations on lattices. It also brings an additional benefit: t signatures can be aggregated, making the signature length independent of t. Compared to Bettaieb and Schrek's scheme, the signature is shorter and the verification efficiency is higher.

[0069] 3. This invention satisfies the property of flexibility, allowing ring members to add themselves to the signature set of an already created threshold ring signature at any time, thereby dynamically expanding the threshold value t. Specifically, this can be achieved by... i =u i Replace with z i =(-1) b cx i +u i To expand the threshold value in the scheme, since the two have the same The distribution is such that the replacement will not affect the anonymity of the signer.

[0070] 4. This invention also achieves strong anonymity, requiring only that the leader is weakly trusted, i.e., not to disclose [the information]. All individual commitments (part of the final signature) Bettaieb and Schrek's approach relies on the leader replacing t authentications, requiring the leader to be completely trustworthy.

[0071] 5. This invention satisfies the properties of unverifiability and non-repudiation. Unverifiability means that a user cannot prove that he / she participated in the generation of a specific signature, while non-repudiation means that a user cannot prove that he / she did not participate in the generation of a specific signature. These two properties play a supporting role in strong anonymity.

[0072] While the invention has been described above with reference to various embodiments, it should be understood that many changes and modifications can be made without departing from the scope of the invention. That is, the methods, systems, and devices discussed above are examples. Various configurations can be appropriately omitted, substituted, or added to various processes or components. For example, in alternative configurations, methods can be performed in a different order than those described, and / or various components can be added, omitted, and / or combined. Moreover, features described with respect to certain configurations can be combined in various other configurations, such as different aspects and elements of the configuration can be combined in a similar manner. Furthermore, the elements therein can be updated as the technology develops; that is, many elements are examples and do not limit the scope of this disclosure or the claims.

[0073] Specific details are provided in the specification to offer a thorough understanding of exemplary configurations, including implementations. However, configurations can be practiced without these specific details; for example, well-known circuits, processes, algorithms, structures, and techniques have been shown without unnecessary detail to avoid obscuring the configuration. This description provides only exemplary configurations and does not limit the scope, applicability, or configuration of the claims. Rather, the foregoing description of the configurations will provide those skilled in the art with an enabling description for implementing the described techniques. Various changes can be made to the function and arrangement of the elements without departing from the spirit or scope of this disclosure.

[0074] In summary, the above detailed description is intended to be illustrative rather than restrictive, and it should be understood that these embodiments are for illustrative purposes only and not for limiting the scope of protection of the invention. After reading the description of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent changes and modifications also fall within the scope defined by the claims of this invention.

Claims

1. A threshold ring signature method based on lattice cipher, characterized in that, The threshold ring signature method based on lattice cryptography includes a key generation algorithm, a signature algorithm, and a verification algorithm; The key generation algorithm includes generating a polynomial vector x. i =(x i,1 ,x i,2 )∈R 2×1 and polynomial vectors Satisfy a i x i =q mod 2q, which serve as the private and public keys for user i, respectively; Signature algorithms include leader selection. The process involves aggregating and distributing challenges, and outputting the final signature. The signing process consists of three rounds: In the first round, for all users Leaders From Discrete Gaussian Distribution Choose vector u i =(u i,1 ,u i,2 and from discrete Gaussian distribution Select auxiliary random vector r i Calculate the commitment value The commitment key ck = H(μ, param) is calculated by the hash function H; The second round, for all users Signer From Discrete Gaussian Distribution Select vector u i =(u i,1 ,u i,2 and from discrete Gaussian distribution Select auxiliary random vector r i Calculate the commitment value Signer Send secretly For leaders Leaders Calculate the sum of commitment values Then, calculate the challenge value. and distributed to Each signer in the list; The third round, for all users Signer Based on private key x i And the challenge value c, calculate the signature z i =(-1) b cx i +u i , Using the rejection sampling operation, input parameter (cx) i ,z i ), in probability Decide whether to send the signature value z i and random vector r i For leaders If not, then start again from round 2 of signing; for all Leaders Calculate the pseudo-signature z of the non-signer i =u i ,at last, Output threshold ring signature Among them, R and R 2q All are polynomial rings, q is the modulus, and the system parameter param includes Let N represent a set of N users, denoted by 1, 2, ..., N. Let Com represent the set of t signers. ck (·,·) is a trapdoor commitment algorithm that satisfies the additive homomorphism property. The input to the hash function H is the message to be signed μ and the system parameter param. The bits b are randomly selected from {0,1}. exp(x) represents the natural logarithm e raised to the power of x. ||·|| represents the Euclidean norm. cosh(·) represents the hyperbolic cosine function. <·,·> represents the vector dot product. It contains t valid BLISS signatures and Nt pseudo-signatures signed with an empty private key. Let be the sum of the committed values, r be the sum of the auxiliary random vectors, M be the expected number of restarts for a single successful user, and s be the sum of the committed values. 2 Indicates variance; The verification algorithm is used to verify whether a signature was legally generated by t signers. The verification process includes: Validator Check for all Signature value z i Does it satisfy ||z i ||≤B; Validator Calculate the challenge value Then, check again. If they are equal, then the signature verification is successful; Where B represents a preset constant used to limit the validity of signatures. The largest Euclidean norm is set as In the formula, parameter γ>1, s represents the standard deviation, and n represents the polynomial ring. The degree of the bisector polynomial f(X).

2. The threshold ring signature method based on lattice cipher as described in claim 1, characterized in that, Generate a polynomial vector x based on the key generation algorithm for BLISS signatures. i =(x i,1 ,x i,2 )∈R 2×1 and polynomial vectors Satisfy a i x i =q mod 2q.

3. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the threshold ring signature method based on lattice cryptography as described in any one of claims 1-2.

Images