A blind adapter signature method and system based on an SM2 algorithm

Abstract

The application discloses a blind adapter signature method and system based on an SM2 algorithm. The method is used for blind signature of a signature maker on a blinded to-be-signed message, and the blind signature is unblinded to be a pre-signature. The pre-signature can be verified through a pre-signature verification algorithm, and can be adapted to an SM2 signature. The adapted SM2 signature can be verified through an SM2 standard digital signature. The pre-signature and the corresponding SM2 signature can extract a secret value. The blind adapter signature scheme designed in the application can blind a message before signature, can protect transaction details, can retain atomicity of the adapter signature, can more flexibly solve privacy and security problems in digital payment, and can provide a safer and more private digital payment solution.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a blind adapter signature method and system based on the SM2 algorithm. Background Technology

[0002] Adapter signature is a novel cryptographic primitive that evolved from the scriptless script proposed by Poelstra. It links message authentication with the disclosure of secret values. Due to its wide application in various applications, such as atomic swaps and payment channels, it has attracted widespread attention from scholars both at home and abroad.

[0003] With the development of adapter signature technology, adapter signatures based on Schnorr, ECDSA, lattice signatures, and SM2 signatures have emerged, making research on adapter signatures increasingly popular. While existing adapter signatures possess atomicity and can be integrated into various blockchains, providing good flexibility and interoperability in payment channels, they lack privacy protection features. For payment scenarios and applications with high privacy requirements, adapter signatures need a certain degree of blindness to more flexibly address privacy and security issues in digital payments, providing more secure and private digital payment solutions. However, existing adapter signatures do not possess this blindness. Summary of the Invention

[0004] To address the shortcomings mentioned above, the present invention aims to provide a blind adapter signature method and system based on the SM2 algorithm. The blind adapter signature scheme employs a method that blinds the message before signing, protecting transaction details while preserving the atomicity of the adapter signature. This provides a more flexible solution to privacy and security issues in digital payments, offering a more secure and private digital payment solution.

[0005] To achieve the above objectives, the present invention adopts the following technical solution.

[0006] This invention discloses a blind adapter signature method based on the SM2 algorithm. The signing participants include a Signer holding the signing private key, an Adaptor knowing the secret value, a User holding the signed message, an Extractor who can simultaneously obtain both the pre-signature and the signature, and a Verifier who knows the hard relation state corresponding to the public key and the secret value. The method includes the following steps:

[0007] (1) System initialization

[0008] Each signing participant performs system initialization, including generating public cryptographic parameters, generating key pairs, temporary key pairs, hard relation pairs, and blinding factors for SM2 blind adapter signing, and calculating commitments;

[0009] (2) Message blinding

[0010] Users generate blinded messages to be signed based on the blinding factor, the message to be signed, and the hard relation pair;

[0011] (3) Blind signature generation

[0012] The signer generates a blind signature based on the blinded message to be signed, the key, and the temporary key;

[0013] (4) Unblinding

[0014] The user calculates the pre-signature based on the blind signature and the blinding factor;

[0015] (5) Presignature verification

[0016] The verifier verifies the validity of the pre-signature based on the public key, the hard relation state and commitment, and the pre-signature.

[0017] (6) Adaptation

[0018] The adapter adapts the SM2 signature based on the pre-signature and the evidence of the difficult relationship;

[0019] (7) Extraction

[0020] The extractor extracts the corresponding secret value based on the pre-signature, SM2 signature, and hard relation state.

[0021] In this invention, during the system initialization process in step (1), the common parameters of the cryptographic system include: the elliptic curve related parameters (q, Fq, n, G) of the SM2 algorithm, where q is a large prime number, Fq is a finite field containing q elements, n is a prime number, and G is a base point of the elliptic curve with an order of n.

[0022] Generate a key pair, including the signer's public and private keys. The public key is generated based on the private key. The signer, user, extractor, and verifier can obtain the public key but cannot obtain the private key. This includes the signer randomly selecting an integer x as the private key. Given the set of all invertible elements modulo n, calculate the public key P = xG to obtain the public-private key pair (sk, pk) = (x, P);

[0023] Generate a temporary key pair, including a temporary public key and a temporary private key. The temporary public key is generated based on the temporary private key. Only the signer knows the temporary private key, and only the signer and the user know the temporary public key. The temporary public key includes: the signer randomly selecting an integer t as the temporary private key. Calculate the temporary public key T = tG to obtain the temporary public-private key pair (t, T);

[0024] When generating hard relation pairs, a hard relation pair for the adapter is generated. This hard relation pair includes hard relation evidence (i.e., a secret value) and a hard relation state. The hard relation state is generated based on the hard relation evidence. The signer, user, extractor, and verifier can access the hard relation state before the adapter, but cannot access the hard relation evidence. This includes: the adapter randomly selecting an integer y as the hard relation evidence, i.e., the secret value. Calculate the difficult relation state Y = yG to obtain the difficult relation pair (y, Y);

[0025] Generate a blinding factor; the user randomly selects an integer a. We obtain the blinding factors a and b;

[0026] When calculating commitment, the fitter calculates A. a =yP+Y and publish A a The signer calculates A s = (1+x)Y and publish A s User A a With A s If they are equal, then promise that A = A. s The promised value is published to all signing participants; if they are not equal, the key pair and hard relation pair are regenerated.

[0027] In this invention, in step (2), the user calculates the intermediate variable K = aT + bG using blinding factors a and b, and the intermediate variable R = K + A = (r x ,r y ), r x ,r y These are the x and y coordinates of R, respectively, and the intermediate variable r = H(m) + r x Calculate the blinded message to be signed, c = a -1 (r+b)mod n, send c to the signer;

[0028] In step (3), after the signer receives the blinded message c to be signed, the intermediate variable is calculated. Blind signature And blind signature Send to the user;

[0029] In step (4), the user calculates intermediate variables using blinding factors a and b. Pre-signature pre-signed This is the result of unblinding;

[0030] In step (5), any verifier who knows the signer's public key P and the hard relation state Y can verify the pre-signature. The verification process includes: calculating intermediate variables. intermediate variables intermediate variable r * =H(m)+r x * Verify r * = r is true. If true, output true; otherwise, output false.

[0031] In step (6), the fitter obtains a pre-signature. Then, the SM2 signature δ is derived by combining it with the secret value y. The process includes: calculating... Let the signature be δ = (r, s);

[0032] In step (7), the extractor obtains the pre-signature. After signing δ, the secret value y is extracted. * The process is as follows: Calculation Verify the difficult relation state Y = (y * If G is true, output the secret value y. * Otherwise, if the extraction fails, output "fail".

[0033] Another aspect of this invention discloses a blind adapter signature system based on the SM2 algorithm. The signing participants include a Signer holding the signing private key, an Adaptor knowing the secret value, a User holding the message to be signed, an Extractor capable of simultaneously obtaining the pre-signature and the signature, and a Verifier knowing the hard relation state corresponding to the verification public key and the secret value; including:

[0034] System initialization module: Each signing participant performs system initialization, including generating cryptographic system public parameters, generating key pairs, temporary key pairs, hard relation pairs and blinding factors for SM2 blind adapter signatures, and calculating commitments;

[0035] Message Blinding Module: Users generate blinded messages to be signed based on the blinding factor, the message to be signed, and the difficulty relationship pair;

[0036] Blind signature generation module: The signer generates a blind signature based on the blinded message to be signed, the key, and the temporary key;

[0037] Deblinding module: The user calculates the pre-signature based on the blind signature and the blinding factor;

[0038] Pre-signature verification module: The verifier verifies the validity of the pre-signature based on the public key, the hard relation state and commitment, and the pre-signature.

[0039] Adaptation module: The adaptor adapts the SM2 signature based on the pre-signature and the evidence of the hard relation;

[0040] Extraction module: The extractor extracts the corresponding secret value based on the pre-signature, SM2 signature, and hard relation state.

[0041] As can be seen from the above technical solution, the present invention has the following advantages:

[0042] (1) It has a blind nature, allowing users to maintain a high degree of privacy when making digital payments. Since the signer only signs the blinded message and cannot obtain the detailed information of the transaction, users can make payments anonymously, thereby protecting their personal privacy.

[0043] (2) It has blindness without affecting the adapter function. Users can obtain a pre-signature by deblinding the blind signature. The pre-signature can be verified and can also generate an SM2 signature through adaptation. The pre-signature and the corresponding SM2 signature can also be used to extract a secret value.

[0044] In summary, blind adapter signatures can more flexibly address privacy and security issues in digital payments, providing a more secure and private digital payment solution; and can provide privacy protection features without compromising the atomicity of the adapter signature. Attached Figure Description

[0045] Figure 1 The diagram shows the logical relationships between the various algorithms in the SM2 blind adapter signature generation method.

[0046] Figure 2 This is a system flowchart based on the SM2 blind adapter signature generation method. Detailed Implementation

[0047] To make the objectives, techniques, and advantages of the embodiments of the present invention clearer, the embodiments of this application will be described in detail below with reference to the accompanying drawings. Obviously, the embodiments described below are only some embodiments of the present invention, and not all of them. Based on the disclosed embodiments, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0048] To more clearly describe the embodiments, the symbols defined herein are as follows:

[0049] (q,Fq,n,G): Elliptic curve related parameters of the SM2 algorithm, where q is a large prime number, Fq is a finite field containing q elements, n is a prime number, and G is a base point of the elliptic curve with order n.

[0050] H(m): Take the hash value of m.

[0051] The set of all modulo n invertible elements.

[0052] mod n: Modulo n operation.

[0053] m: Message to be signed.

[0054] c: The message to be signed after blinding.

[0055] Blind signature.

[0056] Pre-signed.

[0057] δ: Signature.

[0058] (y,Y): Instances of difficult relation pairs.

[0059] A: The calculated commitment value.

[0060] a, b: Blinding factors.

[0061] Example 1: A blind adapter signature generation method based on SM2. Figure 1 The logical relationship diagram of each algorithm in the SM2 blind adapter signature generation method is shown below. Figure 1 As shown, the signing method includes:

[0062] Step 1: System initialization, which includes the following process:

[0063] (1) Generate public parameters for the cryptographic system, including: elliptic curve related parameters (q, Fq, n, G) of the SM2 algorithm, where q is a large prime number, Fq is a finite field containing q elements, n is a prime number, and G is a base point of the elliptic curve with order n.

[0064] (2) Key generation. The signer randomly selects an integer x as the private key. Given the set of all modularly invertible elements modulo n, compute the public key P = xG to obtain the public-private key pair (sk, pk) = (x, P).

[0065] (3) Temporary key generation. The signer randomly selects an integer t as the temporary private key. Given the set of all modularly multiplicative invertible elements modulo n, compute the temporary public key T = tG to obtain the public-private key pair (t, T).

[0066] (4) Generation of difficult relation pairs. The fitter randomly selects an integer y as evidence of a difficult relation. Given the set of all modularly multiplicative invertible elements modulo n, calculate the difficult relation state Y = yG to obtain the difficult relation pair (y, Y).

[0067] (5) Generate the blinding factor; the user randomly selects an integer a. We obtain the blinding factors a and b;

[0068] (6) Commitment A calculation. The fitter calculates A. a =yP+Y and publish A a The signer calculates A s = (1+x)Y and publish A s User A a With A s Are they equal? ​​If they are equal, then A = A s The promised value is published to all the signing participants, and if they are not equal, the key pair and hard relation pair are regenerated.

[0069] Step 2: Message Blinding. The user calculates the intermediate variable K = aT + bG using blinding factors a and b, and the intermediate variable R = K′ + A = (r... x ,r y ), intermediate variable r = H(m) + r x Calculate the blinded message to be signed, c = a -1 (r+b)mod n, send c to the signer.

[0070] Step 3: Generate a blind signature. After receiving c, the signer calculates... Blind signature And blind signature Send to the user.

[0071] Step 4: Unblinding. The user calculates intermediate variables using blinding factors a and b. Pre-signature pre-signed This is the result of unblinding.

[0072] Step 5: Pre-signature verification. The verifier calculates... Calculate R * =K * +A=(r x * ,r y * ), r * =H(m)+r x * Verify r * = r is true. If true, the verification passes and outputs true; otherwise, the verification fails and outputs false.

[0073] Step 6: Adaptation. Adaptor calculation. Let the signature be δ = (r, s).

[0074] Step 7: Extraction. The extractor calculates... Verify Y = (y * If G is true, output the secret value y. * Otherwise, if the extraction fails, output "fail".

[0075] Example 2: A system based on SM2 blind adapter signature. Figure 2 Here is a system flowchart based on the SM2 blind adapter signature generation method, such as Figure 2 As shown, assuming the message to be signed is m, and the final extracted secret value is y. The system includes:

[0076] 1. System initialization module.

[0077] It can output the generated key pair (sk,pk), the temporary key pair (t,T), the hard relation pair (y,Y), and the blinding factors a and b. It can also input the key pair and the hard relation pair and output the calculated commitment A.

[0078] 2. Message blinding module.

[0079] Input blinding factors a and b, message m to be signed and hard relation state Y, output the generated blinded message pair to be signed (r, c).

[0080] 3. Blind signature generation module.

[0081] Input the blinded message to be signed m, the key sk, and the temporary key t, and output the generated blind signature.

[0082] 4. Unblinding module.

[0083] Input a blind signature (c, s”) and blinding factors a and b, output the computed pre-signature.

[0084] 5. Pre-signature verification module.

[0085] Input public key pk, pre-signature Given a difficult relation state Y and a commitment A, output whether the pre-signature is valid: true if valid, false otherwise.

[0086] 6. Adaptation module.

[0087] Enter pre-signature Given the difficult relation evidence y, output the adapted SM2 signature (r,s).

[0088] 7. Extraction module.

[0089] Enter pre-signature Given the SM2 signature (r,s) and the difficult relation state Y, output the corresponding extracted secret value y.

Claims

1. A blind adapter signature method based on the SM2 algorithm, characterized in that, The signing participants include the signer who holds the signing private key, the adapter who knows the secret value, the user who holds the message to be signed, the extractor who can obtain both the pre-signature and the signature simultaneously, and the verifier who knows the hard relation state corresponding to the verification public key and secret value; the process includes the following steps: (1) System initialization Each signing participant performs system initialization, including generating public cryptographic parameters, generating key pairs, temporary key pairs, hard relation pairs, and blinding factors for SM2 blind adapter signing, and calculating commitments; (2) Message blinding Users generate blinded messages to be signed based on the blinding factor, the message to be signed, and the hard relation pair; (3) Blind signature generation The signer generates a blind signature based on the blinded message to be signed, the key, and the temporary key; (4) Unblocking The user calculates the pre-signature based on the blind signature and the blinding factor; (5) Pre-signature verification The verifier verifies the validity of the pre-signature based on the public key, the hard relation state and commitment, and the pre-signature. (6) Adaptation The adapter adapts the SM2 signature based on the pre-signature and the evidence of the difficult relationship; (7) Extraction The extractor extracts the corresponding secret value based on the pre-signature, SM2 signature, and hard relation state; where: In step (1), during system initialization, the common parameters of the cryptographic system include: elliptic curve parameters related to the SM2 algorithm. ,in, For large prime numbers, For inclusion A finite field of elements It is a prime number. Let be a base point of an elliptic curve, and its order be . ; Generate a key pair; the signer randomly selects an integer as the private key. , Given the set of all modularly invertible elements modulo n, compute the public key. Obtain the public / private key pair ; Generate a temporary key pair, and the signer randomly selects an integer. As a temporary private key Calculate the temporary public key Obtain temporary public / private key pair ; Generate difficult relation pairs, and the fitter randomly selects an integer. Secret values ​​serve as evidence of difficult relationships. Calculate the difficult relation state Obtaining difficult relationships ; Generate a blinding factor; the user randomly selects an integer. The blinding factor was obtained. ; When calculating commitment, the fitter calculates intermediate variables. And announce The signer calculates intermediate variables And announce User comparison and If they are equal, then make a commitment. The promised value is published to all signing participants. If they are not equal, a new temporary key pair and hard relation pair are generated.

2. The blind adapter signature method based on the SM2 algorithm according to claim 1, characterized in that, In step (2), the user utilizes the blinding factor Calculate intermediate variables intermediate variables , They are x-coordinate and y-coordinate, intermediate variables , This indicates a message awaiting signature. Indicates to Take the hash value and calculate the blinded message to be signed. ,Will Send to the signer; In step (3), the signer receives the blinded message to be signed. Then, calculate the intermediate variables. Blind signature And blind signature Send to the user; In step (4), the user utilizes the blinding factor Calculate intermediate variables = Pre-signature Presigned This is the result of unblinding; In step (5), anyone who knows the signer's public key... Difficult Relationship Status Verifiers for pre-signing The verification process includes: calculating intermediate variables. intermediate variables , They are x-coordinate and y-coordinate, intermediate variables ,verify If the condition is met, output true if the condition is met; otherwise, output false if the condition is not met. In step (6), the fitter obtains a pre-signature. Afterwards, with the secret value Together, we can adapt and create SM2 signatures. The process includes: calculating intermediate variables. SM2 signed ; In step (7), the extractor obtains the pre-signature. and signature Then, extract the secret value. The process is as follows: Calculation Verify the state of difficult relationships If true, output the secret value. Otherwise, if the extraction fails, output "fail".

3. A blind adapter signature system employing the method of claim 1, characterized in that, The signing participants include the signer who holds the signing private key, the adapter who knows the secret value, the user who holds the message to be signed, the extractor who can obtain both the pre-signature and the signature simultaneously, and the verifier who knows the hard relation state corresponding to the verification public key and secret value; including: System initialization module: Each signing participant performs system initialization, including generating cryptographic system public parameters, generating key pairs, temporary key pairs, hard relation pairs and blinding factors for SM2 blind adapter signatures, and calculating commitments; Message Blinding Module: Users generate blinded messages to be signed based on the blinding factor, the message to be signed, and the difficulty relationship pair; Blind signature generation module: The signer generates a blind signature based on the blinded message to be signed, the key, and the temporary key; Deblinding module: The user calculates the pre-signature based on the blind signature and the blinding factor; Pre-signature verification module: The verifier verifies the validity of the pre-signature based on the public key, the hard relation state and commitment, and the pre-signature. Adaptation module: The adaptor adapts SM2 signatures based on pre-signatures and hard relation evidence; Extraction module: The extractor extracts the corresponding secret value based on the pre-signature, SM2 signature, and hard relation state.

Images