Method and system for proving signature of universally designated verifier based on SM2 digital identification signature

Abstract

The present invention discloses a method and system for proving a signature of a universally designated verifier based on SM2 digital identification signature, which belongs to the field of information security technology. The method comprises: obtaining a message m, a signature σ of the message m, and the user information ID of the signer from the signer. a , and verify the validity of the signature σ in combination with the system master public key mpk generated by the system administrator; if the signature σ is valid, based on the message m, the signature σ, the user information ID a and the system master public key mpk, generate a conversion signature and a conversion key tk; send the message m and the conversion signature to the designated verifier, and based on the system master public key mpk, the conversion signature, the conversion key tk and the user information ID a The present invention can solve the problems of high certificate management overhead and difficult maintenance of the existing UDVSP solution based on SM2 digital signature.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular to a method and system for proving a universally designated verifier signature based on an SM2 digital identification signature. Background Art

[0002] Universal Designated Verifier Signature Proof (UDVSP) allows a signature owner to convince a designated verifier that they possess the signature without providing the signature, but the designated verifier cannot convince others. UDVSP is widely used to protect privacy in areas such as medical data, electronic voting, anonymous certificates, and electronic income aggregation. For example, in the medical field, suppose the signature owner (patient Alice) receives a new electronic medical record from the signer (doctor D1). Alice can convince the designated verifier (doctor D2) of the record's contents without providing the signature, and doctor D2 cannot convince others of the record's contents.

[0003] Existing UDVSP solutions based on SM2 digital signatures, such as Chinese patent application CN113708927A, require a certificate authority (CA) to maintain and manage user public key certificates, primarily for issuance and revocation. Certificate management overhead increases linearly with the number of users. Consequently, high certificate management overhead is incurred in multi-user environments such as cloud computing and big data, limiting the use of UDVSP solutions based on SM2 digital signatures. Summary of the Invention

[0004] In response to the above problems, the present invention discloses a universally designated verifier signature certification method and system based on SM2 digital identification signature, which can solve the problems of high certificate management overhead and difficult maintenance in the existing UDVSP scheme based on SM2 digital signature, effectively reduce computing overhead and communication costs, thereby alleviating the system burden and better meeting the data security and privacy protection needs in the fields of medical data, electronic voting, anonymous certificates, electronic income aggregation, etc.

[0005] To achieve the purpose of the invention, the technical solution of the present invention includes the following contents.

[0006] A method for proving a signature of a universally designated verifier based on an SM2 digital signature, applied to a signature owner, comprising:

[0007] Obtain the message m, the signature σ of the message m, and the user information ID of the signer from the signer a , and verify the validity of the signature σ in combination with the system master public key mpk generated by the system administrator;

[0008] If the signature σ is valid, based on the message m, the signature σ, the user information ID a And the system master public key mpk, generate the conversion signature and conversion key tk;

[0009] The message m and the transformed signature Sent to the designated verifier, and based on the system master public key mpk, the conversion signature The conversion key tk and the user information ID a Interact with the designated verifier to prove the authenticity of the message m to the designated verifier.

[0010] Furthermore, the process of the system administrator generating the system master public key mpk includes:

[0011] Get the security parameter λ;

[0012] By randomly selecting a large prime number q, determine the non-singular elliptic curve E:y 2 =x 3 +ax+b(modq); where a and b are divided into finite fields Random numbers in ;

[0013] Select a prime n-order cyclic group from all points of the non-singular elliptic curve E and generators

[0014] Choosing a hash function Hash function and hash functions Wherein, the hash function is a cryptographic hash function with a message digest length of v bits, the hash function is a secure cryptographic hash function;

[0015] In finite fields Select a random number x to calculate the partial system master public key P pub =xP;

[0016] Output system master public key And the system master private key msk=x.

[0017] Furthermore, the process of the signer generating the signature σ of the message m includes:

[0018] Based on the system master public key mpk, system master private key msk and the signer's user information ID a , generate the signer's private key sk;

[0019] Get message m;

[0020] The message m is signed by combining the system master public key mpk and the private key sk to obtain the signature σ of the message m.

[0021] Furthermore, the system master public key mpk, system master private key msk and the signer's user information ID a , generate the signer's private key sk, including:

[0022] In finite fields Select a random number l;

[0023] Calculate the partial user private key L = lP and the partial user private key d = l + xh; where the intermediate variable

[0024] Output private key sk = (L, d).

[0025] Furthermore, the message m is signed by combining the system master public key mpk and the private key sk to obtain the signature σ of the message m, including:

[0026] Calculate the user's distinguishable identity and hash value Among them, ENTLA is the user information ID a The bit string length, (x p ,y p ) and (x L ,y L ) represent the horizontal and vertical coordinates of the generator P and the partial user private key L respectively;

[0027] In finite fields Select a random number k and calculate the elliptic curve point K = kP = (x K ,y K ) and partial signature r=(e+x K )(mod n);

[0028] If r≠0 and r+k≠n, calculate the partial signature s=(1+d) -1 (k-rd)(mod n);

[0029] In the case of partial signature s≠0, the signature σ=(L, r, s) of the message m is output.

[0030] Furthermore, the message m, the signature σ of the message m and the user information ID of the signer are obtained from the signer. a , and verify the validity of the signature σ in combination with the system master public key mpk generated by the system administrator, including:

[0031] The partial signature r and the partial signature s belong to a finite field In the case of , calculate the intermediate parameter t = r + s (mod n); wherein, the partial signature r or the partial signature s does not belong to the finite field When , it is determined that the signature σ is invalid;

[0032] When the intermediate variable t≠0, calculate the discernible identity in sequence Intermediate variables Hash value Elliptic curve point K′=sP+t(L+h′P pub )=(x′ K ,y′ K ) and partial signature r′=(e′+x′ K )(mod n); wherein, when the intermediate variable t=0, the signature σ is determined to be invalid;

[0033] If r′=r, the signature σ is determined to be valid.

[0034] Furthermore, the message m, the signature σ, the user information ID a And the system master public key mpk, generate the conversion signature and the conversion key tk, including:

[0035] In finite fields Select a random number a r , random number b r and the number c at any time r ;

[0036] Calculating Distinguished Identity

[0037] Based on the identifiable mark Z a and message m, calculate the hash value

[0038] Generate transformation signature and conversion key tk=(a r ,b r ); Among them, some signatures Partial signature

[0039] Furthermore, the system master public key mpk, the conversion signature The conversion key tk and the user information ID a Interact with the designated verifier to prove the authenticity of the message m to the designated verifier, including:

[0040] Calculating intermediate variables and elliptic curve point K = sP + t(L + hP pub );

[0041] In finite fields Select random numbers α and β from the cyclic group Select a generator R;

[0042] Calculate the commitment value D = R + βP + α (L + hP pub )+β(L+hP pub ), and send the commitment value D to the designated verifier so that the designated verifier A challenge value c is randomly selected and returned to the signature owner;

[0043] Calculate the response (Z K ,z a ,z b ), and the response (Z K ,z a ,z b ) is sent to the designated verifier so that the designated verifier combines the response (Z K ,z a ,z b ) Verify the authenticity of the message m; wherein, the partial response value Z K =R-cK, partial response value z a =α-c·a r (mod n), partial response value x b =β-c·b r (mod n).

[0044] Furthermore, the designated verifier combines the response (Z K ,z a ,z b ) verifying the authenticity of the message m, including:

[0045] Get the system master public key mpk and convert the signature and conversion key tk=(a r ,b r );

[0046] Calculating the hash value and intermediate variables

[0047] Calculate the intermediate variable T = (L' + h'P pub ); where L′ is the conversion signature Partial signature L in;

[0048] Calculating Commitment Value

[0049] In the case of commitment value D' = D, the message m is verified as authentic.

[0050] A universal designated verifier signature proof system based on SM2 digital signature, characterized in that the system comprises:

[0051] A system administrator, configured to generate a system master public key mpk and a system master private key msk;

[0052] A signer, configured to generate a private key sk of the signer based on the system master public key mpk, the system master private key msk and user information ID of the signer a , and sign a message m in combination with the system master public key mpk and the private key sk to obtain a signature sigma of the message m;

[0053] A signature owner, configured to verify validity of the signature sigma; in the case of valid signature sigma, generate a conversion signature and a conversion key tk based on the message m, the signature sigma, the user information ID a and the system master public key mpk; and interact with a designated verifier based on the system master public key mpk, the conversion signature the conversion key tk and the user information ID a to prove authenticity of the message m to the designated verifier;

[0054] A designated verifier, configured to interact with a designated verifier based on the system master public key mpk, the conversion signature the conversion key tk and the user information ID a to verify authenticity of the message m.

[0055] Compared with the prior art, the present application designs a new UDVSP scheme based on SM2 digital signature, which not only meets two types of security of self-adaptive selection attack unforgeability (UF-CMA) and anti-spoofing attack (R-IM), but also avoids the management and maintenance of the public key certificate with huge overhead based on the SM2 digital signature UDVSP scheme. BRIEF DESCRIPTION OF DRAWINGS

[0056] Figure 1 A flowchart of a universal designated verifier signature proof method based on SM2 digital signature according to an exemplary embodiment is shown. DETAILED DESCRIPTION

[0057] In order to make the purpose, content and advantages of the present application clearer and more explicit, so that those skilled in the art can understand the present application, the present application will be further described in detail below. The specific steps of the embodiment are as follows:

[0058] Since the current UDVSP scheme based on SM2 digital signature involves certificate management with large overhead and difficult maintenance under the PKI framework, the management overhead of the certificate increases linearly with the number of users, in order to meet the application requirements of high performance and low power consumption in the fields of medical data, electronic voting, anonymous certificate and electronic income aggregation, the scheme needs to be further optimized.

[0059] Figure 1 An embodiment flowchart of the application includes four entities of a system administrator, a signer, a signature owner and a designated verifier. First, the system administrator calls the initialization Setup algorithm to determine the system master public key, and shares the system master public key with other entities. Then, the signer calls Extract under the system master private key to generate a user private key, and calls Sign to calculate the signature of the message using the user private key. Next, the signature owner obtains the message, the signature and the user information from the signer, first calls Verf to verify the validity of the message and the signature, and then calls the conversion algorithm Tran to generate a conversion signature and a conversion key. Finally, the signature owner performs the IVerf protocol with the designated verifier using the conversion signature and the conversion key tk, and completes the proof process, so that the designated verifier believes that the signature sigma is a reliable signature signed on m without revealing any details of the signature sigma.

[0060] In the embodiment, the symbols are explained as follows:

[0061] ID a : identity of the user.

[0062] ENTLA: ID a : two bytes converted from the bit length of ID.

[0063] q: a large prime number.

[0064] F q : a finite field containing q elements.

[0065] a, b: elements in F q , which define an elliptic curve E on F q .

[0066] E(F q ): a set of all rational points (including the infinite point O) of the elliptic curve E on F q .

[0067] #E(F q ): the number of points on E(F q ), referred to as the order of the elliptic curve E(F q ).

[0068] ​O: A special point on the elliptic curve, called the point at infinity or the zero point.

[0069] The cyclic group containing all points of the elliptic curve E and the points at infinity.

[0070] P: Group The generator of .

[0071] n: the order of the generator P (n is #E(F q ) of the prime factors of ).

[0072] Secure cryptographic hashing function.

[0073] A cryptographic hash function with a message digest length of v bits.

[0074] Secure cryptographic hashing function

[0075] The set of elements in the set {1,2,...,n} that are relatively prime to element n.

[0076] Z a : The user's identifiable identifier, a hash value of some elliptic curve system parameters and user-selected parameters.

[0077] e: The output value of the cryptographic hash function applied to the message M and the user's distinguishable identifier Za.

[0078] This paper proposes a UDVSP solution based on SM2 identification digital signature, which specifically includes the following five algorithms and one protocol:

[0079] Algorithm 1. Initialization (Setup): The algorithm inputs the security parameter λ, randomly selects a large prime number q, and determines the non-singular elliptic curve E:y 2 =x 3 +ax+b(mod q)(where, ), select a prime n-order cyclic group from all points of E (including the point at infinity) and generators Choosing a secure hash function is a cryptographic hash function with a message digest length of v bits, is a secure cryptographic hash function. Randomly selected Calculate the partial system master public key P pub =xP. The algorithm outputs the system master public key The present invention is designed based on the SM2 digital identification signature, so it uses the same system parameters as the SM2 digital identification signature. For specific parameter symbol definitions, see the specific implementation method (1. Symbols and Definitions).

[0080] Algorithm 2. Key Extraction: The algorithm inputs the system master public key mpk, master private key msk and user information ID a , randomly selected Calculate the partial user private key L=lP, intermediate variable Partial user private key d = l + xh. The algorithm outputs the user's private key sk = (L, d).

[0081] Algorithm 3. Signature (Sign): The algorithm inputs the system master public key mpk, the user private key sk = (L, d) and the message m. Calculate the user's distinguishable identity and hash value ENTLA is ID a The bit string length, (x p ,y p ) and (x L ,y L ) are the horizontal and vertical coordinates of P and L respectively. Randomly select Calculate the elliptic curve point K = kP = (x K ,y K ) and partial signature r=(e+x K )(mod n). If r=0 or r+k=n, reselect k and calculate again, otherwise calculate the partial signature s=(1+d) -1 (k-rd)(mod n). If s≠0, output the message m and signature σ=(L,r,s).

[0082] Algorithm 4. Verify: The algorithm inputs the system master public key mpk and user information ID a , message m and signature to be verified σ=(L,r,s), if If t = 0, then output 0, otherwise calculate t = r + s (mod n). K′=sP+t(L+h′P pub )=(x′ K ,y′ K ) and r′=(e′+x′ K )(mod n). If r′=r, then output 1 to indicate that the signature is valid, otherwise output 0 to indicate that it is invalid.

[0083] Algorithm 5. Transformation (Tran): The algorithm inputs the system master public key mpk and user information ID a , message m and signature to be verified σ=(L,r,s), randomly selected and calculate Output transformation signature and conversion key tk=(a r ,b r ).

[0084] Protocol 6. Interactive Proof (IVerf): The protocol inputs the system master public key mpk and user information ID a and transform signature The signature owner P additionally inputs the conversion key tk and signature σ, and the signature owner P performs the following interactions with the designated verifier V:

[0085] 1) P is calculated first K=sP+t(L+hP pub ), and then randomly select Calculate the commitment value D = R + βP + α (L + hP pub )+β(L+hP pub ). Finally, P sends D to V.

[0086] 2) V randomly selects the challenge value And return c to P.

[0087] 3) Response to the P Computing Challenge K =R-cK,z a =α-c·a r (mod n),z b =β-c·b r (mod n), and (Z K ,z a ,z b ) is sent to V.

[0088] 4) V calculation T=(L′+h′P pub )and If D′=D, then output 1 to indicate acceptance, otherwise output 0.

[0089] In summary, the present invention designs a more secure and efficient UDVSP solution based on SM2 digital identity signatures. The digital signature algorithm based on the national secret SM2 (see "A Digital Signature Method and System Based on an SM2 Identity Base," He Debiao, Zhang Jiani, Chen Miwen, and Zhang Yubo, December 2010, Patent Application Publication No.: CN108809658A) is a modified version of the national secret SM2 digital signature algorithm. The SM2 digital identity signature avoids time-consuming bilinear pairing operations and primarily utilizes identity identifiers to generate user private keys. Its application and management do not rely on digital certificates, certificate libraries, or key libraries, resulting in low complexity and high security. The algorithm includes four algorithms: initialization, key parsing, signature, and verification.

[0090] This paper designs a new UDVSP scheme using SM2 digital signatures. It not only meets the security requirements of Unforgeable by Adaptive Selective Attack (UF-CMA) and Resist Impersonation Attack (R-IM), but also avoids the expensive management and maintenance of public key certificates. It can better meet the needs of practical applications in a common PC test environment.

[0091] While specific embodiments of the present invention have been disclosed for illustrative purposes, intended to facilitate understanding and implementation of the present invention, those skilled in the art will appreciate that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the disclosure of the preferred embodiments, and the scope of protection claimed in the present invention shall be determined by the scope of the claims.

Claims

1. A method for proving a universally designated verifier signature based on SM2 digital signature, characterized in that: Applied to a signature owner, the method includes: Obtain the message m, the signature σ of the message m, and the user information ID of the signer from the signer a , and verify the validity of the signature σ in combination with the system master public key mpk generated by the system administrator; If the signature σ is valid, based on the message m, the signature σ, the user information ID a And the system master public key mpk, generate the conversion signature and conversion key tk; The message m and the transformed signature Sent to the designated verifier, and based on the system master public key mpk, the conversion signature The conversion key tk and the user information ID a Interact with a designated verifier to prove the authenticity of the message m to the designated verifier; The process of the system administrator generating the system master public key mpk includes: Get the security parameter λ; By randomly selecting a large prime number q, determine the non-singular elliptic curve E:y 2 =x 3 +ax+b(mod q); where a and b are divided into finite fields Random numbers in ; Select a prime n-order cyclic group from all points of the non-singular elliptic curve E and generators Choosing a hash function Hash function and hash functions Wherein, the hash function is a cryptographic hash function with a message digest length of v bits, the hash function is a secure cryptographic hash function; In finite fields Select a random number x to calculate the partial system master public key P pub =xP; Output system master public key and the system master private key msk=x; the process of the signer generating the signature σ of the message m includes: Based on the system master public key mpk, system master private key msk and the signer's user information ID a , generate the signer's private key sk; Get message m; Combine the system master public key mpk and the private key sk to sign the message m to obtain the signature σ of the message m; The system master public key mpk, the system master private key msk and the user information ID of the signer a , generate the signer's private key sk, including: In finite fields Select a random number l; Calculate the partial user private key L = lP and the partial user private key d = l + xh; where the intermediate variable Output private key sk = (L, d); The message m is signed by combining the system master public key mpk and the private key sk to obtain the signature σ of the message m, including: Calculate the user's distinguishable identity and hash value Among them, ENTLA is the user information ID a The length of the bit string, (x p ,y p ) and (x L ,y L ) represent the horizontal and vertical coordinates of the generator P and the partial user private key L respectively; In finite fields Select a random number k and calculate the elliptic curve point K = kP = (x K ,y K ) and partial signature r=(e+x K )(mod n); If r≠0 and r+k≠n, calculate the partial signature s=(1+d) -1 (k-rd)(mod n); In the case of partial signature s≠0, the signature of the output message m is σ=(L,r,s); The message m, the signature σ of the message m and the user information ID of the signer are obtained from the signer. a , and verify the validity of the signature σ in combination with the system master public key mpk generated by the system administrator, including: The partial signature r and the partial signature s belong to a finite field In the case of , calculate the intermediate variable t = r + s (mod n); wherein, the partial signature r or the partial signature s does not belong to the finite field When , it is determined that the signature σ is invalid; When the intermediate variable t≠0, calculate the discernible identity in sequence Intermediate variables Hash value Elliptic curve point K′=sP+t(L+h′P pub )=(x′ K ,y′ K ) and partial signature r′=(e′+x′ K )(mod n); wherein, when the intermediate variable t=0, the signature σ is determined to be invalid; If r′=r, the signature σ is determined to be valid.

2. The method according to claim 1, characterized in that The method is based on the message m, the signature σ, and the user information ID a And the system master public key mpk, generate the conversion signature and the conversion key tk, including: In finite fields Select a random number a r , random number b r and the number c at any time r ; Calculating Distinguished Identity Based on the identifiable mark Z a and message m, calculate the hash value Generate transformation signature and conversion key tk=(a r ,b r ); Among them, some signatures Partial signature 3. The method according to claim 2, characterized in that The system master public key mpk, the conversion signature The conversion key tk and the user information ID a Interact with the designated verifier to prove the authenticity of the message m to the designated verifier, including: Calculating intermediate variables and elliptic curve point K = sP + t(L + hP pub ); In finite fields Select random numbers α and β from the cyclic group Select a generator R; Calculate the commitment value D = R + βP + α (L + hP pub )+β(L+hP pub ), and send the commitment value D to the designated verifier so that the designated verifier A challenge value c is randomly selected and returned to the signature owner; Calculate the response (Z K ,z a ,z b ), and the response (Z K ,z a ,z b ) is sent to the designated verifier so that the designated verifier combines the response (Z K ,z a ,z b ) Verify the authenticity of the message m; wherein, the partial response value Z K =R-cK, partial response value z a =α-c·a r (mod n), partial response value z b =β-c·b r (mod n).

4. The method according to claim 3, characterized in that The designated verifier combines the response (Z K ,z a ,z b ) verifying the authenticity of the message m, including: Get the system master public key mpk and convert the signature and conversion key tk=(a r ,b r ); Calculating the hash value and intermediate variables Calculate the intermediate variable T = (L' + h'P pub ); where L′ is the conversion signature Partial signature L in; Calculating Commitment Value In case the commitment value D′=D, the message m is verified to be authentic.

5. A universally designated verifier signature certification system based on SM2 digital signature, characterized in that: The system applies the method according to any one of claims 1 to 4, including: System administrator, used to generate the system master public key mpk and system master private key msk; Signer, used based on the system master public key mpk, system master private key msk and the signer's user information ID a , generate the signer's private key sk, and sign the message m with the system master public key mpk and the private key sk to obtain the signature σ of the message m; The signature owner is used to verify the validity of the signature σ; if the signature σ is valid, based on the message m, the signature σ, the user information ID a And the system master public key mpk, generate the conversion signature and conversion key tk; based on the system master public key mpk, the conversion signature The conversion key tk and the user information ID a Interact with a designated verifier to prove the authenticity of the message m to the designated verifier; Designated verifier, used to convert the signature based on the system master public key mpk The conversion key tk and the user information ID a Interact with a designated verifier to verify the authenticity of the message m.

Images