Blind signature system and method using lattice-based cryptography

Abstract

A computer-implemented method of generating a signature for a message is disclosed. The user device processes the message and the random data to generate a commitment for the message and transmits the commitment to the signer device. The signer device derives a target vector from the commitment and samples short vectors that solve lattice problems involving the target vector using a secret trapdoor function. The signer device then sends the short vector to the user device, which verifies the short vector solution lattice problem. Upon successful verification of the short vector, the user device generates a signature that establishes knowledge of the short vector based on the message and the common data.

Description

Technical Field

[0001] The present disclosure relates to a system and method for generating blind signatures using lattice-based cryptography. Background Art

[0002] A blind signature is an interactive protocol between a user and a signer that enables the user to obtain a signature on a message from the signer without revealing the message to the signer. At the end of the protocol, the user obtains a valid signature on the message under the signer's secret key. For security reasons, the blind signature scheme is such that the signer does not know the message and the secret key is kept secret from the signer. Applications of blind signatures include electronic cash, anonymous credentials, and electronic voting.

[0003] Digital signature schemes typically involve three functions:

[0004] Skeygen, which generates the signing key sk and the verification key vk;

[0005] Sign, which generates a signature using the signing key sk; and

[0006] Verify, which allows the signature to be verified using the verification key vk.

[0007] Blind signature schemes can utilize commitments and non-interactive zero-knowledge (NIZK) proofs of knowledge.

[0008] A promise scheme typically involves a tuple of three functions:

[0009] Ckeygen, which generates common parameters;

[0010] Com(m,r), which outputs a commitment c of message m using random data r;

[0011] Open(c,r) which opens the commitment c of message m using random data r.

[0012] The commitment scheme has a binding property that ensures that a commitment c = com(m, r) cannot be unwrapped into any message other than m, and a hiding property that ensures that a commitment c looks completely random even if the message m corresponding to the commitment c is known.

[0013] NIZK proof of knowledge is a non-interactive proof of knowledge that can be used to prove knowledge of a secret without revealing it. For security purposes, the NIZK proof of knowledge scheme must be zero-knowledge, i.e., the scheme does not disclose any information about the secret, and reliable, i.e., only the prover who knows the secret can output a valid proof.

[0014] For example, the following is a blind signature scheme:

[0015]

[0016] User U knows the message m and the verification key vk, while the signer S knows the signing key sk. User U randomly samples random data r and random data u. Then, the user generates a commitment c using Com(m,r) and sends the commitment to the signer S. Upon receipt of the commitment c, the signer S signs the commitment c using the signing key sk to generate a signature σ. Then, the signer S sends the signature σ to user U. User U then uses Verify(vk,c,σ) to verify whether the signature is a valid signature for the commitment c, and after successful verification, uses the public key pk to encrypt the commitment c, the signature σ, and the random data u to generate the ciphertext c. Then, user U generates a proof π that allows anyone who knows the message, the ciphertext ct, and the proof π to establish that user U has knowledge σ of a valid signature for the commitment to the message m.

[0017] Lattice-based cryptography refers to a class of cryptographic schemes whose security is based on the difficulty of mathematical problems on lattices. Most lattice-based cryptographic schemes are considered post-quantum, as they are conjectured to be resistant to attacks by malicious parties with access to envisioned large-scale quantum computers. Therefore, lattice-based cryptographic schemes are attracting increasing interest in preparation for the time when such large-scale quantum computers become a reality.

[0018] In this manual, the following notation will be used:

[0019] Vectors are represented by lowercase bold font (e.g. t).

[0020] Matrices are in uppercase bold font (e.g. A).

[0021] ·R q is the base ring, which is commutative: it can be, for example, The form of a business ring, where is the ring of integers modulo q;

[0022] The notation x←S means that x is sampled uniformly at random from the set S.

[0023] Lattice-based cryptographic schemes usually require computing a matrix-vector product A·x, where x is subject to some constraints. The short integer solution (SIS) problem and the learning with errors (LWE) problem are the main topics of lattice-based cryptography. In short:

[0024] Given A, t, the SIS problem consists of finding a short secret vector s such that A·s=t;

[0025] Given A, t, the LWE problem consists of finding vectors s and e such that A·s+e=t, where the error vector e is short and the secret vector s is either unconstrained (Uniform Secret LWE) or required to be short (Short Secret LWE).

[0026] There are various problems associated with using lattice-based cryptographic schemes in blind signature schemes such as the one described above. In particular, the required proof of knowledge is concrete and complex relations must be proved, and this problem is exacerbated by the fact that all efficient lattice-based signature schemes first generate a hash of the message before signing, so the relation that needs to be proved is no longer σ=sign(sk,c), but σ=sign(sk,H(c)). This means that the security of the scheme cannot be formally proved, because security requires that the hash function H be modeled as a random oracle, but the NIZK knowledge proof requires an explicit description of the hash function. In addition, and perhaps more importantly, proving properties of hash functions in zero-knowledge is very complicated, and this leads to very inefficient schemes. Summary of the invention

[0027] According to a first aspect of the invention, there is provided a computer-implemented method of generating a signature for a message. A user device processes a message and random data to generate a commitment to the message, and transmits the commitment to a signer device. The signer device derives a target vector from the commitment, and uses a secret trapdoor function to sample a short vector that solves a lattice problem involving the target vector. The signer device then sends the short vector to a user device, which verifies that the short vector solves the lattice problem. Upon successful verification of the short vector, the user device generates a signature that establishes knowledge of the short vector based on the message and the public data.

[0028] According to a second aspect of the invention, there is provided a user device comprising a processor for processing a message and random data to generate a commitment of the message. The user device further comprises a transmitter for transmitting the commitment to a signer device and a receiver for receiving a short vector from the signer device in response to the transmission of the commitment. The processor is then configured to verify that the short vector solves a lattice problem and upon successful verification of the short vector, generate a signature establishing knowledge of the short vector based on the message and the public data.

[0029] According to a third aspect of the present invention, there is provided an apparatus for signing a message, the apparatus having authority over a secret trapdoor function. The apparatus comprises: a receiver for receiving a commitment from a user device, the commitment corresponding to a message to be signed; and a processor configured to derive a target vector from the commitment and to sample a short vector for solving a lattice problem involving the target vector using the secret trapdoor function. The apparatus also comprises a transmitter for transmitting the short vector to the user device.

[0030] Further features and advantages of the present invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 schematically illustrates an overview of a message in a blind signature scheme according to an example;

[0032] Figure 2 It is schematically shown in Figure 1 Flowchart of the operations performed to generate a blind signature in a blind signature scheme. DETAILED DESCRIPTION

[0033] Figure 1 A computing system comprising a user device 1 , a recipient device 3 and a signer device 5 is shown. Figure 1 Also shown is the message transfer performed by sending a message m from the user device 1 to the recipient device 3 with a blind signature provided by the signer device 5.

[0034] The user device 1 comprises a transmitter 9, a receiver 11 and a processor 7 configured to perform cryptographic functions. Similarly, the signer device 5 comprises a transmitter 15, a receiver 17 and a processor 13 configured to perform cryptographic functions. The signer device 5 also has access to a secret trapdoor function 19.

[0035] As shown, user device 1 uses transmitter 9 to send a first message M1 to receiver 17 of signer device 5, which first message M1 conveys a commitment c of message m and a first non-interactive zero-knowledge (NIZK) proof π1. As will be discussed below, user device 1 generates commitment c based on message m, a publicly available tool vector g, and some random data r, and user device 1 also generates a first NIZK proof π1 that establishes that commitment c opens to message m.

[0036] Commitment c is a trapdoor sampling compatible commitment, and the signer device 5. In this way, the signer device 5 is able to use the secret trapdoor function 19 to solve a lattice problem that would otherwise be difficult to solve. The lattice problem is difficult to solve without knowledge of the secret trapdoor function 19, and therefore the blind signature scheme works on the assumption that a valid solution to the lattice problem must have been generated using the secret trapdoor function 7. In this regard, it is worth noting that the lattice problem is resistant to attacks using either or both classical computing systems and quantum computing systems. Therefore, the solution to the lattice problem is resistant even to attacks by a malicious party with access to a large-scale quantum computer. This property allows the blind signature scheme of this example to be considered "post-quantum".

[0037] In this example, the lattice problem is to sample a vector e∈Rk(2+k) , so that:

[0038]

[0039] where a1, a2, b1, ... b k is is a publicly available vector uniformly distributed in , t is the target vector derived from the commitment c using the publicly available function ParseCom(c), and u is the vector obtained from A is a publicly available value randomly sampled from a, and B is a publicly available boundary value. Given the constraints on the length of vector e, vector e will be referred to as a short vector e hereinafter. The secret trapdoor function 19 is associated with the public vector a1 (and therefore, will sometimes be referred to as the trapdoor function T hereinafter). a1 ), and has the following properties: for any n>0, any and any Signer Device 5 can sample So that [a1│v]·e=u and ∥e∥ <B。

[0040] The signer device 5 then uses the transmitter 15 to send a second message M2 to the receiver 11 of the user device 1, thereby conveying the short vector e. Given that the user device 1 can determine the target vector t using the function ParseCom(c) and the rest of the data in the lattice problem is publicly available, the user device 1 can verify whether the short vector e is a valid solution to the lattice problem. After the user device 1 has verified that the short vector e is valid, the user device 1's knowledge of the short vector e can be used as evidence that the signer device 5 determined the short vector e of the commitment c.

[0041] In this example, the signer device 5 then generates a second NIZK proof π2 that will serve as a blind signature for the message m. In this regard, for security purposes, it is important that the second NIZK proof π2 only requires publicly available information, such that the second NIZK proof π2 does not depend on any information specific to that execution of the protocol, so that the information cannot be linked to the protocol if revealed. Therefore, the second NIZK proof π2 should not disclose information about the random data used to generate the commitment or the target vector used to generate the short vector e. To achieve this, the signer device 5 reformulates the lattice problem as of the form, where:

[0042]

[0043] where g is a vector of publicly available tools, r1…r k is a vector drawn from random data r, and e 2,1 Refers to the i-th coefficient of e2. By this formula, the vector consists of publicly available information, while the vector —Hereinafter referred to as the modified short vector — includes information from the short vector e and random data. In this example, the second NIZK proves π2 according to the vector The sum value u establishes that the signer has a short vector e. In this way, given the vector is derived using the hash h of the message m, and the second NIZK proof π2 acts as a signature.

[0044] Those skilled in the art will appreciate that the form of the second NIZK proof π2 is direct and does not require information about the manner in which the hash function generates the hash h of the message m. In fact, there are known proofs for obtaining a hash h based on a public vector (e.g., vector ) and the knowledge of the polynomial (e.g., random data u) to establish the secret vector (e.g., the modified short vector )’s knowledge.

[0045] The user device 1 then sends a third message M3 to the recipient device 3, thereby conveying the message and the second NIZK proof π 2. The recipient can then verify the second NIZK proof π 2 to verify the message m.

[0046] Reference above Figure 1 The described blind signature scheme involves a single message M1 sent from user device 1 to signer device 5, and a single message M2 sent from signer device 5 to user device 1. Therefore, the blind signature scheme can be called "round-optimal" because it involves a minimum number of messages between user device 1 and signer device 5.

[0047] Reference above Figure 1 Another advantage of the described blind signature scheme is that the signature size is approximately 100KB and it supports an unlimited number of signatures.

[0048] Now refer to Figure 2 Provide the above reference Figure 1 Further details of the blind signature scheme are described.

[0049] like Figure 1 As shown, to generate a blind signature for a message m, user device 1 first uses a hash function H at S1 to calculate a cryptographic hash h of message m and uniformly samples random data r. Then, user device 1 generates a commitment based on the hash h and the random data r at S3. Specifically, the commitment is generated using the function Com(m,r), which uses publicly available parameters a1, a2, b1, ..., b k , publicly available tool vector g, and in The publicly available parameter b0 is uniformly distributed in . The tool vector g is usually considered to be g: = [1│b│b 2 │...│bk-1 ],in But if we only consider correctness, it can be Any vector in .

[0050] The Com(m,r) function can be expressed as follows:

[0051]

[0052] The function Expand(r) takes n bits of random data r as input and Output k uniform vectors r1, ..., r k .

[0053] Then, user device 1 uses zero-knowledge protocol π1 at S5 to determine a first NIZK proof π1, where for the polynomial So that ∥h∥≤B h , and commitment c proves knowledge of h and r. In this example, the zero-knowledge protocol Π1 is a straight-line extractable proof.

[0054] Then, the user device 1 sends the commitment c and the first NIZK certificate π1 to the signatory device 5 at S7 (see Figure 1 Message M1).

[0055] After receipt of the commitment c and the first NIZK proof π1 at S9, the signer device 5 verifies the first NIZK proof π1 at S11 to check the commitment c. If the verification fails, no further action is taken. If the verification passes, the signer device 5 samples a short vector e that satisfies the lattice problem discussed above at S13. As discussed above, this involves using the function ParseCom(c) to generate the target vector t and then using the secret trapdoor function 19 to determine the short vector e.

[0056] For any vector a1, if there is a small (hidden) basis for a lattice orthogonal to a1, then this vector can be used as a trapdoor vector by using a pre-image sampling algorithm such as that disclosed in the article "Trapdoors for hard lattices and new cryptographic constructions" by Gentry et al. (40th ACM STOC, pp. 197-206). In this example, the so-called NTRU trapdoor is used. For this trapdoor, the matrix a1 is of the form [1│h], where is the quotient of two small polynomials h=g / f, where in general f and g have coefficients in the range {-1,0,1}. Such matrices have smaller trapdoors than those proposed in the above-mentioned article by Gentry et al.

[0057] Then, the signer device 5 sends the short vector e to the user device 1 (see Figure 1 Message M2).

[0058] After receiving the short vector e at S17, the user device 1 verifies at S19 whether the short vector e satisfies the lattice problem. Then, as discussed in detail above, the user device 1 modifies the short vector e at S21 to generate a modified short vector Then, the user device 1 outputs the second NZIK certificate π2 to the recipient device 3 (see Figure 1 Message M3).

[0059] refer to Figure 1 and Figure 2 The blind signature algorithm described can be expressed in the following pseudocode:

[0060]

[0061] In this pseudocode, the function ParseRand uses the function Expand(r) discussed above to determine the vectors r1, ..., r k .

[0062] Modifications and further embodiments

[0063] In the example described above, the user device 1 uses the straight-line extractable proof to determine the first NIZK proof π1. For example, compared to Fiat-Shamir with an abort proof, the straight-line extractable proof is relatively complex and gives a larger proof size, but also provides improved security. For applications where security loss is not a significant issue, other protocols such as protocols based on Fiat-Shamir with an abort proof may be used, or even the first NIZK proof π1 may be omitted entirely.

[0064] Lattice-based proofs are known to have "slack", i.e. the secret being proved is larger than the secret is actually known, but lattice-based proofs have recently been developed that remove this slack at the expense of increasing proof size. Thus, when choosing a zero-knowledge protocol Π1 for the first NIZK proof π1, the interaction between desired security, proof size, and processing complexity needs to be considered. In contrast, for the second NIZK proof π2, the only concern is proof size, and any NIZK protocol Π2 can be used.

[0065] Reference above Figure 1 and Figure 2The blind signature scheme described can be easily transformed into a partially blind signature scheme. A partially blind signature is an extension of a blind signature where the signatory device 5 can include information in the message m, such as an expiration date or revocation of an old signature. To bind a signature to a specific message μ, simply modify the right-hand side of the lattice problem from u to u–H(μ).

[0066] You can choose common parameters b1, ..., b k So that b1=b2=…=b k This allows the signer device 5 to simply sample a short vector e such that:

[0067] [a1│a2+t│b1]·e=u.

[0068] Doing so reduces the signature size at the expense of increasing the complexity of the zero-knowledge protocol Π2.

[0069] The lattice problem can be further modified. For example, the public parameters b1, ..., b k It is included only for security and can be omitted from the lattice problem, so that the signer device 5 is a [a1|a2+t] sampled preimage. The public parameter a2 can even be omitted, so that the signer device 5 is a [a1|t] sampled preimage, although this potentially makes the blind signature scheme vulnerable to attack.

[0070] To further simplify the blind signature scheme, the NIZK protocol Π2 can be conveyed as and To allow the recipient device 3 to authenticate Although this takes into account the short vector e and the modified short vector The similarity between them potentially destroys the unlinkability of the blind signature scheme. Alternatively, the user device can sample a small vector And u'=[a1│a2+t│b1│…│b k ]f T It is sent to the signer device along with the commitment c and possibly the first NIZK proof π1. The user device can then output As a signature. Depending on whether rejection sampling is used and the size of f, this technique can hide the modified short vector This technique can be further optimized by sampling multiple vectors f and storing the multiple vectors f in a hash tree so that rejection sampling succeeds with overwhelming probability.

[0071] In the above blind signature scheme, the public parameters a1, a2, b1, ..., b k Both Alternatively, the blind signature scheme can accommodate the public parameters as matrices instead of vectors, and use different column dimensions for each matrix. For example, instead of the vector A1, one can use We can use the matrix A2 and Instead of vector a2 and target vector t; we can use The matrix B in i Instead of vectors b1, ..., b k Using matrices instead of vectors for common parameters provides finer granularity.

[0072] The cryptographic functions discussed above may be implemented in software, hardware, or a combination of software or hardware. Thus, the operations of the user device 1 and the signer device 5 discussed above may be implemented as processor implementable instructions that, when executed by a processor, perform their respective functions. Alternatively, the functions of the user device 1 and the signer device 5 discussed above may be implemented by hardware circuits such as FPGAs or ASICs that perform their respective functions, or a combination of processor implementable instructions and hardware. Regardless of whether these functions are implemented by software, hardware means, or a mixture of software and hardware means, these functions may be said to be implemented by modules of the user device 1 and the signer device 5.

[0073] The above embodiments should be understood as illustrative examples of the present invention. Additional embodiments of the present invention are contemplated. It should be understood that any feature described with respect to any one embodiment may be used alone or in combination with other features described, and may also be used in combination with one or more features of any other embodiment or any combination of any other embodiment. In addition, equivalents and modifications not described above may also be adopted without departing from the scope of the present invention as defined by the appended claims.

Claims

1. A computer-implemented method of generating a signature for a message, comprising: At the user device: processing a message m and random data r to generate a commitment c of the message, and transmitting the commitment c to a signer device; At the signer device: deriving a target vector t from said commitment c; Solving the lattice problem A·e using secret trapdoor function sampling T = a short vector e of u, where: A is a matrix of the form [a1│v], where a1 is a common parameter and v depends on the target vector t; u is a polynomial; and The secret trapdoor function is associated with the public parameter a1 so that for any v∈R q n , the signer device is able to sample a short vector e∈R q n+k , for the short vector, ∥e∥ is less than the boundary value B, and [a1│v]e T =u; and transmitting the short vector e to the user device, and at the user device: verifying that the short vector e solves the lattice problem; and A signature establishing knowledge of the short vector e is generated based on the message and public data.

2. The computer-implemented method of claim 1, wherein: The generation of the commitment c includes: generating a hash h of the message; and A commitment c is generated based on the hash h and the random data r.

3. The computer-implemented method of claim 2, wherein: The commitment c is in the form of: Where h is the hash of the message and 4. The computer-implemented method of claim 2 or 3, further comprising generating a first non-interactive zero-knowledge proof establishing knowledge of the hash h and the random data r.

5. The method according to claim 3 or 4, wherein: The target vector t corresponds to the lowest k rows of the commitment.

6. A method as claimed in any preceding claim, wherein: The lattice problem is of the form: ∧||e|≤B Among them, a2 is a public parameter.

7. The method of claim 6, wherein: The signer device provides information μ to accompany the message m and to be used for the right hand side of the lattice problem u=u'-H(μ), where u' is a polynomial.

8. A method as claimed in any preceding claim, wherein: Establishing knowledge of the short vector e based on the message m and the public data comprises generating a second non-interactive zero-knowledge proof.

9. The method of claim 8, wherein: Establishing the non-interactive zero-knowledge proof involves rewriting the lattice problem equation into the following form: in, can be derived from said message and said public data, The non-interactive zero-knowledge proof establishes the identity of knowledge.

10. A user device, configured to: Processing a message m and random data r to generate a commitment c of said message m; transmitting said commitment c to the signer device; receiving, in response to said transmission of said commitment c, a short vector e from said signer device; Verify that the short vector e solves the lattice problem; as well as A signature establishing knowledge of the short vector e is generated based on the message m and public data.

11. The user device according to claim 10, wherein: The generation of the commitment includes: generating a hash (h) of the message; and A commitment is generated based on the hash and the random data, wherein the commitment is in the form of: Among them, r1…r k is a random parameter derived from said random data (r), h is said hash of said message, g is a tool vector, and And wherein the target vector corresponds to the lowest k rows of the commitment.

12. The user device according to claim 11, wherein: The lattice problem is of the form: ∧||e||≤B Among them, a1 and a2 are public parameters, e is the short vector, t is the target vector, u is public random data, and B is a fixed boundary value.

13. The user device according to any one of claims 10 to 12, wherein: Generating the signature includes establishing a non-interactive zero-knowledge proof based on the message and the public data to establish knowledge of the short vector, Optionally, establishing the second non-interactive zero-knowledge proof includes rewriting the lattice problem equation into the following form: in, can be derived from said message and said public data, Wherein, the non-interactive zero-knowledge proof establishes the identity of the user according to the message and the public data. knowledge.

14. A device for signing a message, the device having access to a secret trapdoor function and configured to: receiving a commitment c from a user device, the commitment c corresponding to a message m to be signed; deriving a target vector t from said commitment c; Solve the lattice problem A·e using the secret trapdoor function sampling T = a short vector e of u, where: A is a matrix of the form [a1│v], where a1 is a common parameter and v depends on the target vector t; u is a polynomial; and The secret trapdoor function is associated with the public parameter a1 so that for any v∈R q n , the signer device is able to sample a short vector e∈R q n+k , for the short vector, ∥e∥ is less than the boundary value B, and [a1│v]e T =u; and The short vector is transmitted to the user device.

15. The device of claim 14, wherein: The apparatus is configured to provide information μ for accompanying the message m, and the right-hand side of the lattice problem is of the form u - H(μ).

Images