Multi-party adapter signature generation method and system based on SM9 digital signature

Abstract

The invention discloses a multi-party adapter signature generation method and system based on an SM9 digital signature, and the method comprises the steps: firstly generating a main private key and a main public key through a secret key generation center, storing the main private key, and disclosing the main public key and a signature private key to generate a function identifier; generating a function identifier according to the main private key and the signature private key, and distributing a private key to each participant according to the joint identity identifier of the participant, then generating a pre-signature value of the message to be signed by using the main public key and the private key, verifying the correctness of the pre-signature value, then calculating a second instance according to the pre-signature value, the complete signature value and the first instance, and sending the second instance to the participant; and outputting second evidence under the condition that the second instance is verified to be the correct instance. On the basis of an SM9 signature structure, an adapter function is added, a domestic functional cryptographic algorithm system is further improved, and multi-party cooperation is introduced to generate the adapter signature, so that the correctness and fairness of the cooperation signature can be ensured, and meanwhile, the functional characteristics of the adapter signature can be met.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method and system for generating a multi-party adapter signature based on an SM9 digital signature. Background Art

[0002] Digital signature is an important part of information security technology, similar to the function of physical signature or seal. Digital signature is a set of electronic data generated by the sender, which has applications in identity authentication, data integrity, non-repudiation and anonymity. Through digital signature, it can be verified that the sender of the information is legitimate and cannot be denied, and it can also verify the integrity and validity of the communication data, thereby ensuring the security of the communication data. The identity authentication of the digital signature system is based on the binding of public / private keys and user identities.

[0003] At present, digital signatures mainly rely on public key cryptographic infrastructure, but with the expansion of network scale and application scope, it takes a lot of time and cost for public key cryptographic infrastructure to manage certificates. In order to solve this problem, researchers have proposed an identity-based cryptographic system, which can directly obtain the public key from the user's identity information, naturally bind the public key to the entity, and thus simplify the transmission and verification of the certificate. In the corresponding identity-based digital signature, the public key comes from the user's public information, so the security of the signature depends entirely on the security of the signature key, and the safekeeping of the signature key is crucial. One way is to use a secret sharing scheme to decentrally manage the signature key. The signature key is mapped into n subkeys, which are kept by n participants respectively. Only with the participation of n participants can the complete key be reconstructed and the signature generated.

[0004] The adapter signature scheme is an extended form of the standard digital signature. It can create a "pre-signature" that implies a difficult relation (such as discrete logarithm) state, and can convert the pre-signature into a full signature through the difficult relation evidence. The converted full signature can be verified by a standard signature scheme verification algorithm. Intuitively speaking, the adapter signature should have two properties: 1) Only users who know the difficult relation evidence can convert the pre-signature into a full signature; 2) Any user can extract the difficult relation evidence from the pre-signature and the full signature corresponding to the pre-signature. Based on these two properties, the adapter signature scheme can provide good atomic exchange properties in the blockchain and has been proven to be widely used in practice.

[0005] The SM9 identification cryptographic algorithm is an identification cryptographic standard (standard table number: GM / T 0044-2016SM9 identification cryptographic algorithm), which mainly includes three parts: digital signature algorithm, public key encryption algorithm, and key exchange protocol. The SM9 standard meets the application requirements of electronic authentication service systems and fills the gap in the domestic identification cryptographic system.

[0006] In an asymmetric environment, implementing n participants to collaborate on the adapter signature may encounter problems of increased computational complexity and communication overhead. How to design an efficient and scalable protocol to ensure that the system can still run quickly and reliably as the number of participants increases is a key technical challenge. Summary of the invention

[0007] The purpose of this application is to provide a multi-party adapter signature generation method and system based on SM9 digital signature in order to overcome the existing technical defects, add adapter function on the basis of SM9 signature structure, and further improve the domestic functional cryptographic algorithm system.

[0008] The purpose of this application is achieved through the following technical solutions:

[0009] In a first aspect, the present application proposes a method for generating a multi-party adapter signature based on an SM9 digital signature, the method comprising:

[0010] Key generation algorithm: Use the key generation center to generate the master private key and master public key, save the master private key and disclose the master public key and signature private key generation function identifier, and distribute the private key to each participant based on the master private key, signature private key generation function identifier and the joint identity identifier of the participant;

[0011] Pre-signature generation algorithm: Use the master public key and private key to generate the pre-signature value of the message to be signed;

[0012] Pre-signature verification algorithm: Verify the correctness of the pre-signature value. If it is correct, execute the pre-signature adaptation algorithm. If it is incorrect, the pre-signature value is deemed invalid.

[0013] Pre-signature adaptation algorithm: Calculate the complete signature value based on the pre-signature value and the first evidence;

[0014] Evidence extraction algorithm: Calculate the second evidence based on the pre-signature value, the complete signature value and the first instance, calculate the second instance based on the second evidence and verify it.

[0015] In a possible implementation, the step of distributing a private key to each participant according to the master private key, the signature private key generation function identifier, and the joint identity identifier of the participant includes:

[0016] Generate the function identifier hid and the joint identity identifier ID of the participant based on the master private key ks and the signature private key A Calculate the first temporary variable t 1 =H 1 (ID A ||hid,q)+ks, q is a prime number;

[0017] In the first temporary variable t 1 Calculate the second temporary variable if it is not 0 modq means modulo q operation;

[0018] Respectively generate satisfaction s 0 ·s 1 modq=t 2 Two random numbers s 0 and 1 ;

[0019] Construct a t-1 order polynomial p(·)=a 0 +a 1 x+…+a t-1 x t-1 , where the coefficient a 0 ,a 1 …a t-1 are t-1 random numbers and a 0 =s 1 ;

[0020] Randomly select points p(1), p(2), …, p(τ) on τ polynomials, where τ is the number of participants;

[0021] Setting up the first party The private key is In addition to the first party The remaining parties The private key is

[0022] The generated private keys are sent to the corresponding parties respectively.

[0023] In a possible implementation, the step of generating a pre-signature value of a message to be signed using a master public key and a private key includes:

[0024] The party requesting the pre-signature Generate a first instance and a zero-knowledge proof based on the master public key and broadcast them;

[0025] On the first party Verify the first example and the correctness of the zero-knowledge proof by calculating the element g in the multiplication cycle group of order q by each participant and calculating the random array r i , then use the element g and the random array r i Calculate the third temporary variable w i , generate a random array r i and the third temporary variable w i Zero knowledge of the discrete logarithm relation and broadcast;

[0026] Zero knowledge received through the participants Perform verification. If it fails, the protocol is terminated. If it passes, the fourth temporary variable w is calculated, and the first part h of the signature is calculated using the fourth temporary variable w;

[0027] Each participant uses the first part of the signature h to calculate the fifth temporary variable δ i , and execute the multiplication protocol π mul , input the corresponding private key and the fifth temporary variable to obtain the sixth temporary variable α ij ;

[0028] Each participant uses the fifth temporary variable δ i and the sixth temporary variable α ij Calculate the addition fragment a i And add the fragment a i Send to the first party

[0029] On the first party Receive the second addition fragment a from all participants j , calculate the multiplication component α of the second part of the signature and the pre-signature And output the pre-signed value of the message m to be signed

[0030] In a possible implementation, the steps of verifying the correctness of the pre-signature value, executing the pre-signature adaptation algorithm if it is correct, and determining that the pre-signature value is invalid if it is incorrect, include:

[0031] Calculate the intermediate variable P = H 1 (ID A )·P 2 +P pub-s ;

[0032] Calculate the first parameter based on the intermediate variable P

[0033] Calculate the second part of the signature h′=H according to the first parameter w′ 2 (m||w′);

[0034] Determine whether the second part h′ is consistent with the first part h of the signature in the pre-signed value. If they are consistent, execute the pre-signature adaptation algorithm. If they are inconsistent, determine that the pre-signed value is invalid.

[0035] In one possible implementation, the complete signature value σ=(h, S), where Y is the first evidence and S is the complete signature component.

[0036] In a possible implementation, the steps of calculating the second evidence according to the pre-signature value, the complete signature value, and the first instance, and calculating and verifying the second instance according to the second evidence include:

[0037] Based on the pre-signed value The complete signature value σ and the first instance I, calculate the second evidence

[0038] Compute the second instance based on the second evidence

[0039] Verify whether the second instance I is a correct instance. If so, the extraction is successful and the second evidence Y′ is output. If not, the extraction fails.

[0040] In the second aspect, the present application proposes a multi-party adapter signature generation system based on SM9 digital signature, the system comprising:

[0041] A key generation module, used to generate a master private key and a master public key using a key generation center, save the master private key and disclose the master public key and signature private key generation function identifier, and distribute a private key to each participant according to the master private key, signature private key generation function identifier and the joint identity identifier of the participant;

[0042] A pre-signature generation module is used to generate a pre-signature value of a message to be signed using a master public key and a private key;

[0043] The pre-signature verification module is used to verify the correctness of the pre-signature value. If it is correct, the pre-signature adaptation algorithm is executed. If it is incorrect, the pre-signature value is determined to be invalid;

[0044] A pre-signature adaptation module, used to calculate a complete signature value based on the pre-signature value and the first evidence;

[0045] The evidence extraction module is used to calculate the second evidence according to the pre-signature value, the complete signature value and the first instance, and calculate the second instance according to the second evidence and verify it.

[0046] In a possible implementation, the key generation module is used to:

[0047] Generate the function identifier hid and the joint identity identifier ID of the participant based on the master private key ks and the signature private key A Calculate the first temporary variable t 1 =H 1 (ID A ||hid,q)+ks, q is a prime number, H 1 is the first cryptographic function;

[0048] In the first temporary variable t 1Calculate the second temporary variable if it is not 0 modq means modulo q operation;

[0049] Respectively generate satisfaction s 0 ·s 1 modq=t 2 Two random numbers s 0 and 1 ;

[0050] Given t parties participating in the signature, construct a t-1 order polynomial p(·)=a 0 +a 1 x+…+a t-1 x t-1 , where the coefficient a 0 ,a 1 …a t-1 are t-1 random numbers and a 0 =s 1 ;

[0051] Randomly select points p(1), p(2), …, p(τ) on τ polynomials;

[0052] Setting up the first party The private key is and P 1 is an additive cyclic group The generators of Other participants The private key is

[0053] The generated private keys are sent to the corresponding parties respectively.

[0054] In a possible implementation, the pre-signature generation module is used to:

[0055] The party requesting the pre-signature Generate a first instance and a zero-knowledge proof based on the master public key and broadcast them;

[0056] On the first party Verify the first example and the correctness of the zero-knowledge proof by calculating the element g in the multiplication cycle group of order q by each participant and calculating the random array r i , then use the element g and the random array r i Calculate the third temporary variable w i , generate a random array r i and the third temporary variable w i Zero knowledge of the discrete logarithm relation and broadcast;

[0057] Zero knowledge received through the participants Perform verification. If it fails, the protocol is terminated. If it passes, the fourth temporary variable w is calculated, and the first part h of the signature is calculated using the fourth temporary variable w;

[0058] Each participant uses the first part of the signature h to calculate the fifth temporary variable δ i , and execute the multiplication protocol π mul , input the corresponding private key and the fifth temporary variable to obtain the sixth temporary variable α ij ;

[0059] Each participant uses the fifth temporary variable δ i and the sixth temporary variable α ij Calculate the addition fragment a i And add the fragment a i Send to the first party

[0060] On the first party Receive the second addition fragment a from all participants j , calculate the multiplication component α of the second part of the signature and the pre-signature And output the pre-signed value of the message m to be signed

[0061] The above-mentioned main scheme of the present application and its further options can be freely combined to form multiple schemes, all of which are schemes that can be adopted and claimed for protection in the present application; and in the present application, (non-conflicting options) options and other options can also be freely combined. After understanding the scheme of the present application, those skilled in the art can understand that there are multiple combinations based on the prior art and common knowledge, all of which are technical schemes to be protected by the present application, and they are not exhaustively listed here.

[0062] The present application discloses a multi-party adapter signature generation method and system based on SM9 digital signature, first using a key generation center to generate a master private key and a master public key, save the master private key and disclose the master public key and signature private key generation function identifier, distribute private keys to each participant according to the master private key, signature private key generation function identifier and the joint identity identifier of the participant, then use the master public key and private key to generate a pre-signature value of the message to be signed, verify the correctness of the pre-signature value, and then calculate the second instance according to the pre-signature value, the complete signature value and the first instance, and output the second evidence when the second instance is verified to be the correct instance. Adding an adapter function on the basis of the SM9 signature structure, further improving the domestic functional cryptographic algorithm system, and introducing multi-party collaborative generation of adapter signatures can meet the functional characteristics of adapter signatures while ensuring the correctness and fairness of collaborative signatures. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0064] Figure 1 A flow chart of a multi-party adapter signature generation method based on SM9 digital signature proposed in an embodiment of the present application is shown.

[0065] Figure 2 The interactive process and calculation method for multiple participants to interactively generate an adapter signature proposed in an embodiment of the present application are shown. DETAILED DESCRIPTION

[0066] The following describes the implementation methods of the present application through specific specific embodiments, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0067] Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative work shall fall within the scope of protection of this application.

[0068] In the existing technology, in an asymmetric environment, implementing n participants to collaborate on the adapter signature may encounter problems of increased computational complexity and communication overhead. How to design an efficient and scalable protocol to ensure that the system can still run quickly and reliably as the number of participants increases is a key technical challenge.

[0069] Therefore, in order to solve the above-mentioned technical problems, the embodiment of the present application proposes a multi-party adapter signature generation method and system based on the SM9 digital signature, which can complete the adapter signature signing in an asymmetric environment and when n participants jointly participate in the operation. At the same time, based on the SM9 signature structure, the adapter function is added, which can further improve the domestic functional cryptographic algorithm system, which is described in detail below.

[0070] When generating the SM9 digital signature, τ (τ ≥ 2) participants are pre-set, expressed as in As the leader of signature in asymmetric environment, Let [τ] be the set of {1,…,τ}, the participants of the digital signature Have a common ID A ,IC A It is the identification ID of user A and can uniquely determine the public key of user A.

[0071] Please refer to Figure 1 , Figure 1 A flow chart of a multi-party adapter signature generation method based on SM9 digital signature proposed in an embodiment of the present application is shown. The method meets the requirements of pre-signature correctness, pre-signature adaptability, and difficult relationship evidence extractability, including:

[0072] Step S100: Use the key generation center to generate a master private key and a master public key, save the master private key and publish the master public key and signature private key generation function identifier, and distribute private keys to each participant based on the master private key, signature private key generation function identifier and the participant's joint identity identifier.

[0073] Step S100 executes the key generation algorithm, which is completed by the key generation center KGC (Key Generation Center). The "SM9 Identification Cryptographic Algorithm" specification is selected as a reference. First, a random number ks∈{1,…,q-1} is generated as the master private key, and then the The element P in pub-s =[ks]P 2 As the master public key, where and All of them have a prime order of q (q>2 191 ). The random number ks is kept secret and the element P is made public. pub-s , and at the same time select and disclose the signature private key generation function identifier hid represented by one byte.

[0074] In a possible implementation, the step of distributing a private key to each participant according to the master private key, the signature private key generation function identifier, and the joint identity identifier of the participant includes:

[0075] Generate the function identifier hid and the joint identity identifier ID of the participant based on the master private key ks and the signature private key A Calculate the first temporary variable t 1 =H 1 (ID A ||hid,q)+ks, q is a prime number, H 1 is the first cryptographic function;

[0076] In the first temporary variable t 1 Calculate the second temporary variable if it is not 0 modq means modulo q operation;

[0077] Respectively generate satisfaction s 0 ·s 1 modq=t 2 Two random numbers s 0 and 1 ;

[0078] Construct a t-1 order polynomial p(·)=a 0 +a 1 x+…+a t-1 x t-1 , where the coefficient a 0 ,a 1 …a t-1 are t-1 random numbers and a 0 =s 1 ;

[0079] Randomly select points p(1), p(2), …, p(τ) on τ polynomials, where τ is the number of participants;

[0080] Setting up the first party The private key is In addition to the first party The remaining parties The private key is

[0081] The generated private keys are sent to the corresponding parties respectively.

[0082] In the key generation algorithm, the key generation center KGC distributes private keys to all participants. First, the key generation center KGC calculates the first temporary variable t 1 =H 1 (ID A ||hid,q)+ks, where H 1 And the subsequent H 2 Both are the first and second cryptographic functions derived from the cryptographic hash function, corresponding to the cryptographic hash functions in the SM9 Identification Cryptographic Algorithm specification. Then determine t 1 Is it 0? If t 1 = 0, it is necessary to regenerate the master private key, calculate and publish the signature master public key, and update the signature private key of the existing user. 1 ≠0, calculate the second temporary variable In the embodiment of the present application, the multiplication sign "·" is omitted when no ambiguity is generated, such as a·b is simplified to ab, 3·c is simplified to 3c, mod q represents modulo q operation (modulo looperation), and the priority of the modulo n operator mod q is the lowest, such as a+b mod q is equivalent to (a+b) mod q, ab mod q is equivalent to (ab) mod q, and ab mod q is equivalent to (ab) mod q. x||y represents the concatenation of x and y, and x and y are bit strings or byte strings.

[0083] Then the key generation center KGC generates two random numbers s 0 ,s 1 ∈{1,…,q-1}, which satisfies s 0 ·s 1 modq=t 2 , then construct a polynomial p(·)=a with order t-1 0 +a 1 x+…+a t-1 x t-1 , coefficient a 1 …a t-1 is t-1 random numbers and a 0 =s 1 , randomly select points p(1), p(2),…, p(τ) on τ polynomials.

[0084] Figure 2 The interactive process and calculation method of generating adapter signatures by multiple participants in the embodiment of the present application are shown. The private key is and in and Both The private key held, Used to participate in the subsequent multiplication protocol π nul , Used to generate signatures later. The private key is The generated partial private keys are securely sent to the corresponding parties.

[0085] Step S200: Generate a pre-signature value of the message to be signed using the master public key and the private key.

[0086] Step S200 executes the pre-signature generation algorithm, and uses the master public key and the private key to generate the pre-signature value of the message to be signed, including:

[0087] The party requesting the pre-signature Generate a first instance and a zero-knowledge proof based on the master public key and broadcast them;

[0088] On the first party Verify the first example and the correctness of the zero-knowledge proof by calculating the element g in the multiplication cycle group of order q by each participant and calculating the random array r i , then use the element g and the random array r i Calculate the third temporary variable w i , generate a random array r i and the third temporary variable w i Zero knowledge of the discrete logarithm relation and broadcast;

[0089] Zero knowledge received through the participants Perform verification. If it fails, the protocol is terminated. If it passes, the fourth temporary variable w is calculated, and the first part h of the signature is calculated using the fourth temporary variable w;

[0090] Each participant uses the first part of the signature h to calculate the fifth temporary variable δ i , and execute the multiplication protocol π mul , input the corresponding private key and the fifth temporary variable to obtain the sixth temporary variable α ij ;

[0091] Each participant uses the fifth temporary variable δ i and the sixth temporary variable α ij Calculate the addition fragment a i And add the fragment a i Send to the first party

[0092] On the first party Receive the second addition fragment a from all participants j , calculate the multiplication component α of the second part of the signature and the pre-signature And output the pre-signed value of the message m to be signed

[0093] The party that first requests the pre-signature generates the first instance And about zero-knowledge proof where z is the difficult relation instance in the adapter signature, Y is the first evidence, and P Y is the proof algorithm in zero-knowledge proof, and then broadcasts (I,π) and uses the first participant Verify the correctness of (I,π), if it is incorrect, stop, if it is correct, use each participant calculate The element g=e(P 1 ,Ppub-s ),in is a multiplicative cyclic group of order q, e represents the arrive The bilinear pairing map, P 1 and P 2 The additive cyclic group and The generator of . Then generate a random array r i ∈{1,…,q-1} and calculate the third temporary variable At the same time, generate i ,w i )Zero-knowledge of discrete logarithmic relations at last broadcast

[0094] Next, each participant from (Except All parties except Each participant broadcasts its Receive broadcasts from all parties other than itself and then verify zero-knowledge The correctness of the protocol must ensure that all parties have passed the verification. If one party fails the verification, the protocol is terminated. Then, the fourth temporary variable w=∏ is calculated using the difficult relation instance z in the adapter signature in the first example. i∈[τ] w i z, calculate the first part of the signature h=H using the fourth temporary variable w 2 (m||w,q), where m is the message to be signed, H 2 A second cryptographic function derived from the cryptographic hash function.

[0095] Through each participant Calculate the fifth temporary variable δ i =(r i -h / τ) mod q, r i is a random number, and with all Execute multiplication protocol π mul , using the corresponding private key and the fifth temporary variable δ i Get the sixth temporary variable α ij , j∈[τ] / {i}. Specifically, Input δ i , enter Execute the first π mul Get separately and satisfy enter Input δ j Execute the second π mul Get separately and satisfy Will Add together to get Will Add together to get Can get where the multiplication protocol π is used mul Implement the basic cross-multiplication operation, that is, for both inputs (a 1 ,b 1 ) and (a 2 ,b 2 ), output c to both parties respectively 1 and c 2 Make it satisfy c 1 +c 2 =a 1 b 2 +a 2 b 1 modq.

[0096] Each participant Calculate addition fragments where a ij For the participants and Execute π mul The generated value will then be added to the fragment a i Send to the first party On the first party Receive the second addition fragment a from all participants j (j∈[τ]) Then calculate the multiplication component of the second part of the signature α=∑ j∈[τ] a j modq and presignature And output the pre-signed value of the message m to be signed

[0097] Step S300: Verify the correctness of the pre-signature value. If it is correct, execute the pre-signature adaptation algorithm. If it is incorrect, determine that the pre-signature value is invalid.

[0098] Step S300 executes the steps of the pre-signature verification algorithm, including:

[0099] Calculate the intermediate variable P = H 1 (ID A )·P 2 +P pub-s;

[0100] Calculate the first parameter based on the intermediate variable P

[0101] Calculate the second part of the signature h′=H according to the first parameter w′ 2 (m||w′);

[0102] Determine whether the second part h′ is consistent with the first part h of the signature in the pre-signed value. If they are consistent, execute the pre-signature adaptation algorithm. If they are inconsistent, determine that the pre-signed value is invalid.

[0103] When a party needs to request a pre-signature, receive the pre-signature And the message to be signed m and execute the pre-signature verification algorithm to verify the correctness of the pre-signature, first calculate the intermediate variable P = H 1 (ID A )·P 2 +P pub-s , and then use the intermediate variable P to calculate the first parameter where g u represent The u-th power of the element g in the group, that is, g u =g·g·g…·g, (a total of u), u is a positive integer. Then the first parameter w′ is used to calculate the second part of the signature h′=H 2 (m||w′), and determine whether h′ and h are consistent. If they are consistent, then It must be a legal pre-signature, otherwise the pre-signature is invalid.

[0104] Step S400: Calculate a complete signature value according to the pre-signature value and the first evidence.

[0105] Step S400 executes the pre-signature adaptation algorithm, and the complete signature value σ=(h,S), where Y is the first evidence and S is the complete signature component.

[0106] After verifying the correctness of the pre-signature, the party requesting the pre-signature decides whether to perform signature adaptation based on whether the pre-signature is correct. That is, for a given pre-signature value and the first evidence Y, calculate the complete signature value σ=(h,S), where S represents the components of the complete signature.

[0107] Step S500: Calculate the second evidence according to the pre-signature value, the complete signature value and the first instance, calculate the second instance according to the second evidence and perform verification.

[0108] Step S500 executes the steps of the evidence extraction algorithm, including:

[0109] Based on the pre-signed value The complete signature value σ and the first instance I, calculate the second evidence

[0110] Compute the second instance based on the second evidence

[0111] Verify whether the second instance I is a correct instance. If so, the extraction is successful and the second evidence Y′ is output. If not, the extraction fails.

[0112] With the pre-signed value and the corresponding signature value, evidence can be extracted. First, for the given pre-signed value and its corresponding signature value σ and instance I, calculate Second, verify Is it a correct instance? If so, the extraction is successful and Y′ is output; otherwise, the extraction fails.

[0113] In order to make the scheme more secure, during the communication process between the participant set [τ], each participant can use zero-knowledge proof to prove that the data sent comes from the sender, reducing the risk of data forgery. For example, the interactive Sigma protocol can be used to prove that the data sent comes from the sender, reducing the risk of data forgery. At the same time, it can also prevent malicious participants from interfering with the joint signature process.

[0114] Therefore, the method proposed in this application is to jointly generate the adapter pre-signature by a leader and multiple participants. After an adapter pre-signature is generated, the user can convert the pre-signature into a full signature through the difficult relationship evidence, and any user can extract the difficult relationship evidence through the pre-signature and the full signature. On the basis of the SM9 signature structure, adding an adapter function can further improve the domestic functional cryptographic algorithm system. Introducing multiple parties to collaborate to generate adapter signatures can meet the functional characteristics of adapter signatures while ensuring the correctness and fairness of collaborative signatures.

[0115] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0116] First, based on the SM9 signature structure, add adapter function to further improve the domestic functional cryptographic algorithm system.

[0117] Second, a multi-party adapter signature based on the SM9 algorithm in an unbalanced environment is proposed, which can complete the adapter signature signing in an asymmetric environment with only n participants participating in the operation.

[0118] A possible implementation of a multi-party adapter signature generation system based on SM9 digital signature is provided below, which is used to execute the various execution steps and corresponding technical effects of the multi-party adapter signature generation method shown in the above embodiment and possible implementation, and the system includes:

[0119] A key generation module, used to generate a master private key and a master public key using a key generation center, save the master private key and disclose the master public key and signature private key generation function identifier, and distribute a private key to each participant according to the master private key, signature private key generation function identifier and the joint identity identifier of the participant;

[0120] A pre-signature generation module is used to generate a pre-signature value of a message to be signed using a master public key and a private key;

[0121] The pre-signature verification module is used to verify the correctness of the pre-signature value. If it is correct, the pre-signature adaptation algorithm is executed. If it is incorrect, the pre-signature value is determined to be invalid;

[0122] A pre-signature adaptation module, used to calculate a complete signature value based on the pre-signature value and the first evidence;

[0123] The evidence extraction module is used to calculate the second evidence according to the pre-signature value, the complete signature value and the first instance, and calculate the second instance according to the second evidence and verify it.

[0124] In a possible implementation, the key generation module is used to:

[0125] Generate the function identifier hid and the joint identity identifier ID of the participant based on the master private key ks and the signature private key A Calculate the first temporary variable t 1 =H 1 (ID A ||hid,q)+ks, q is a prime number, H 1 is the first cryptographic function;

[0126] In the first temporary variable t 1 Calculate the second temporary variable if it is not 0 modq means modulo q operation;

[0127] Respectively generate satisfaction s 0 ·s 1 modq=t 2 Two random numbers s 0 and 1 ;

[0128] Given t parties participating in the signature, construct a t-1 order polynomial p(·)=a 0 +a 1 x+…+a t-1 xt-1 , where the coefficient a 0 ,a 1 …a t-1 are t-1 random numbers and a 0 =s 1 ;

[0129] Randomly select points p(1), p(2), …, p(τ) on τ polynomials;

[0130] Setting up the first party The private key is and P 1 is an additive cyclic group The generators of Other participants The private key is

[0131] The generated private keys are sent to the corresponding parties respectively.

[0132] In a possible implementation, the pre-signature generation module is used to:

[0133] The party requesting the pre-signature Generate a first instance and a zero-knowledge proof based on the master public key and broadcast them;

[0134] On the first party Verify the first example and the correctness of the zero-knowledge proof by calculating the element g in the multiplication cycle group of order q by each participant and calculating the random array r i , then use the element g and the random array r i Calculate the third temporary variable w i , generate a random array r i and the third temporary variable w i Zero knowledge of the discrete logarithm relation and broadcast;

[0135] Zero knowledge received through the participants Perform verification. If it fails, the protocol is terminated. If it passes, the fourth temporary variable w is calculated, and the first part h of the signature is calculated using the fourth temporary variable w;

[0136] Each participant uses the first part of the signature h to calculate the fifth temporary variable δ i , and execute the multiplication protocol π mul , input the corresponding private key and the fifth temporary variable to obtain the sixth temporary variable α ij ;

[0137] Each participant uses the fifth temporary variable δ iand the sixth temporary variable α ij Calculate the addition fragment a i And add the fragment a i Send to the first party

[0138] On the first party Receive the second addition fragment a from all participants j , calculate the multiplication component α of the second part of the signature and the pre-signature And output the pre-signed value of the message m to be signed

[0139] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A multi-party adapter signature generation method based on SM9 digital signature, characterized in that: The method comprises: Key generation algorithm: Use the key generation center to generate the master private key and master public key, save the master private key and disclose the master public key and signature private key generation function identifier, and distribute the private key to each participant based on the master private key, signature private key generation function identifier and the joint identity identifier of the participant; Pre-signature generation algorithm: Use the master public key and private key to generate the pre-signature value of the message to be signed; Pre-signature verification algorithm: Verify the correctness of the pre-signature value. If it is correct, execute the pre-signature adaptation algorithm. If it is incorrect, the pre-signature value is deemed invalid. Pre-signature adaptation algorithm: Calculate the complete signature value based on the pre-signature value and the first evidence; Evidence extraction algorithm: Calculate the second instance based on the pre-signature value, the complete signature value and the first instance, and output the second evidence when the second instance is verified to be the correct instance.

2. The method for generating a multi-party adapter signature according to claim 1, wherein: The steps of distributing a private key to each participant according to the master private key, the signature private key generation function identifier, and the joint identity identifier of the participant include: Generate the function identifier hid and the joint identity identifier ID of the participant based on the master private key ks and the signature private key A Calculate the first temporary variable t1=H1(ID A ||hid,q)+ks, q is a prime number, H1 is the first cryptographic function; Calculate the second temporary variable if the first temporary variable t1 is not 0 modq means modulo q operation; Generate two random numbers s0 and s1 respectively that satisfy s0·s1modq=t2; Given t parties participating in the signature, construct a t-1 order polynomial p(·)=a0+a1x+...+a t-1 x t-1 , where the coefficients a0, a1…a t-1 They are all t-1 random numbers and a0=s1; Randomly select points p(1), p(2), …, p(τ) on τ polynomials; Setting up the first party The private key is and P1 is an additive cyclic group The generators of Other participants The private key is The generated private keys are sent to the corresponding parties respectively.

3. The method for generating a multi-party adapter signature according to claim 1, wherein: The steps of generating a pre-signature value of a message to be signed using a master public key and a private key include: The party requesting the pre-signature Generate a first instance and a zero-knowledge proof based on the master public key and broadcast them; On the first party Verify the first example and the correctness of the zero-knowledge proof by calculating the element g in the multiplication cycle group of order q by each participant and calculating the random array r i , then use the element g and the random array r i Calculate the third temporary variable w i , generate a random array r i and the third temporary variable w i Zero knowledge of the discrete logarithm relation and broadcast; Zero knowledge received through the participants Perform verification. If it fails, the protocol is terminated. If it passes, the fourth temporary variable w is calculated, and the first part h of the signature is calculated using the fourth temporary variable w; Each participant uses the first part of the signature h to calculate the fifth temporary variable δ i , and execute the multiplication protocol π mul , input the corresponding private key and the fifth temporary variable to obtain the sixth temporary variable α ij ; Each participant uses the fifth temporary variable δ i and the sixth temporary variable α ij Calculate the addition fragment a i And add the fragment a i Send to the first party On the first party Receive the second addition fragment a from all participants j , calculate the multiplication component α of the second part of the signature and the pre-signature And output the pre-signed value of the message m to be signed 4. The method for generating a multi-party adapter signature according to claim 3, wherein: The steps of verifying the correctness of the pre-signed value, executing the pre-signed adaptation algorithm if it is correct, and determining that the pre-signed value is invalid if it is incorrect include: Calculate the intermediate variable P = H1 (ID A )·P2+P pub-s ; Calculate the first parameter based on the intermediate variable P According to the first parameter w ′ Calculate the second part of the signature h ′ =H2(m||w ′ ); Judge the second part h ′ Whether it is consistent with the first part h of the signature in the pre-signed value, if it is consistent, the pre-signature adaptation algorithm is executed; if it is inconsistent, the pre-signed value is determined to be invalid.

5. The multi-party adapter signature generation method according to claim 1, characterized in that: The complete signature value σ=(h,S), where Y is the first evidence and S is the complete signature component.

6. The method for generating a multi-party adapter signature according to claim 1, wherein: The step of calculating the second instance according to the pre-signature value, the complete signature value, and the first instance, and outputting the second evidence when verifying that the second instance is a correct instance, comprises: Based on the pre-signed value The complete signature value σ and the first instance I, calculate the second evidence Compute the second instance based on the second evidence Verify whether the second instance I is a correct instance. If so, the extraction is successful and output the second evidence Y ′ If not, the extraction fails.

7. The method for generating a multi-party adapter signature according to claim 1, wherein: The method further comprises: Zero-knowledge proofs are used in communications between parties to prove that the data sent came from the sender.

8. A multi-party adapter signature generation system based on SM9 digital signature, characterized in that: The system comprises: A key generation module, used to generate a master private key and a master public key using a key generation center, save the master private key and disclose the master public key and signature private key generation function identifier, and distribute a private key to each participant according to the master private key, signature private key generation function identifier and the joint identity identifier of the participant; A pre-signature generation module is used to generate a pre-signature value of a message to be signed using a master public key and a private key; The pre-signature verification module is used to verify the correctness of the pre-signature value. If it is correct, the pre-signature adaptation algorithm is executed. If it is incorrect, the pre-signature value is determined to be invalid; A pre-signature adaptation module, used to calculate a complete signature value based on the pre-signature value and the first evidence; The evidence extraction module is used to calculate the second evidence according to the pre-signature value, the complete signature value and the first instance, calculate the second instance according to the second evidence and verify it.

9. The multi-party adapter signature generation system according to claim 8, characterized in that: Key generation module for: Generate the function identifier hid and the joint identity identifier ID of the participant based on the master private key ks and the signature private key A Calculate the first temporary variable t1=H1(ID A ||hid,q)+ks, q is a prime number, H1 is the first cryptographic function; Calculate the second temporary variable if the first temporary variable t1 is not 0 modq means modulo q operation; Generate two random numbers s0 and s1 respectively that satisfy s0·s1modq=t2; Given t parties participating in the signature, construct a t-1 order polynomial p(·)=a0+a1x+…+a t-1 x t-1 , where the coefficients a0, a1…a t-1 They are all t-1 random numbers and a0=s1; Randomly select points p(1), p(2), …, p(τ) on τ polynomials; Setting up the first party The private key is and P1 is an additive cyclic group The generators of Other participants The private key is The generated private keys are sent to the corresponding parties respectively.

10. The multi-party adapter signature generation system according to claim 8, wherein: Pre-signature generation module for: The party requesting the pre-signature Generate a first instance and a zero-knowledge proof based on the master public key and broadcast them; On the first party Verify the first example and the correctness of the zero-knowledge proof by calculating the element g in the multiplication cycle group of order q by each participant and calculating the random array r i , then use the element g and the random array r i Calculate the third temporary variable w i , generate a random array r i and the third temporary variable w i Zero knowledge of the discrete logarithm relation and broadcast; Zero knowledge received through the participants Perform verification. If it fails, the protocol is terminated. If it passes, the fourth temporary variable w is calculated, and the first part h of the signature is calculated using the fourth temporary variable w; Each participant uses the first part of the signature h to calculate the fifth temporary variable δ i , and execute the multiplication protocol π mnul , input the corresponding private key and the fifth temporary variable to obtain the sixth temporary variable α ij ; Each participant uses the fifth temporary variable δ i and the sixth temporary variable α ij Calculate the addition fragment a i And add the fragment a i Send to the first party On the first party Receive the second addition fragment a from all participants j , calculate the multiplication component α of the second part of the signature and the pre-signature And output the pre-signed value of the message m to be signed

Images