Adapter signature method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of information security, in particular to an adapter signature method and device, electronic equipment and a storage medium. According to the method, shared public parameters are determined and disclosed based on preset security parameters, and the shared public parameters comprise two prime numbers, a generator, a hash function, a specific message and any message; generating a key pair for the signer based on the shared public parameter, the key pair comprising a public key and a private key; determining an instance associated with the NP relationship and witnessing and disclosing the instance for the verifier; the signer generates a pre-signature according to the shared public parameter, the private key and the instance; the verifier verifies the validity of the pre-signature according to the shared public parameter, the public key and the instance; the verifier generates a full signature according to the shared public parameter, the public key, the pre-signature and the witness; the verifier verifies the validity of the full signature according to the shared public parameter and the public key; the signer extracts witnesses from the pre-signature and the full signature according to the shared public parameters, so that the security of the adapter signature method is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an adapter signing method, a signing device, an electronic device and a storage medium. Background Art

[0002] Adaptor Signatures (AS) is an innovative cryptographic tool that extends the concept of traditional digital signatures. This signature technology allows the signer to generate a pre-signature for a specific puzzle instance, which can be converted into a valid full signature when certain conditions are met. And the conditions met, i.e., the witness, can be proved without leaking information. This process not only retains the security and non-repudiation of traditional signatures, but also adds additional flexibility, allowing conditional signature generation in different scenarios. This feature of adapter signatures is suitable for scenarios that need to reduce on-chain computation, reduce transaction costs, and enhance transaction privacy, such as blockchain and decentralized financial applications.

[0003] However, in the existing adapter signing method, the witness is easily exposed, which results in the low security of the adapter signing method.

[0004] Therefore, how to improve the security of the adapter signature method has become an urgent problem to be solved. Summary of the invention

[0005] The present application provides an adapter signing method, a signing device, an electronic device and a storage medium, aiming to solve the problem of low security of the adapter signing method.

[0006] In a first aspect, an embodiment of the present application provides an adapter signing method, the method comprising: step S1, based on preset security parameters, determining and disclosing shared public parameters required by the signer and the verifier, the shared public parameters comprising prime numbers p and q, a generator g, a hash function H, a specific message m0 and an arbitrary message m; p and q satisfy the relationship q|(p-1), g is The generator in g q ≡1(mod p), Step S2, based on the shared public parameters, generate a key pair for the signer, the key pair including a public key pk and a private key sk; determine the instance Y and witness y associated with the NP relationship for the verifier, and disclose the instance Y; Step S3, the signer generates a pre-signature for the specific message m0 according to the shared public parameters, the private key sk and the instance Y Step S4, the verifier verifies the pre-signature according to the shared public parameters, the public key pk and the instance Y Step S5, the verifier verifies the validity of the shared public parameters, the public key pk, and the pre-signature and the witness y, generate a full signature σ about the arbitrary message m; step S6, the verifier verifies the validity of the full signature σ based on the shared public parameters and the public key pk; step S7, the signer verifies the validity of the full signature σ from the pre-signed The witness y is extracted from the full signature σ, and the witness y is used to implement the adapter signature.

[0007] In a possible implementation, step S2 includes: the signer randomly selects the private key sk based on the shared public parameter, and the private key sk is greater than 1 and less than the prime number q; based on the private key sk and the shared public parameter, a first calculation formula is used to determine the public key pk, and the first calculation formula is pk=g sk (mod p); the verifier randomly selects the witness y based on the shared public parameter, and Based on the witness y and the shared public parameter, the instance Y is determined using a second calculation formula, where the second calculation formula is Y=g y (mod p).

[0008] In a possible implementation, step S3 includes: using a trapdoor commitment algorithm to perform a commitment operation on the instance Y and the specific message m0 according to the shared public parameters to generate a commitment c and an initial opening d0; using a signature algorithm to generate a digital signature based on the shared public parameters, the private key sk, the instance Y and the commitment c. Based on the digital signature The instance Y, the commitment c and the initial opening d0 generate the pre-signature

[0009] In a possible implementation, step S4 includes: parsing the pre-signed Get the digital signature The instance Y, the commitment c and the initial opening d0; using a trapdoor commitment verification algorithm to verify whether the commitment c corresponds to the instance Y, the specific message m0 and the initial opening d0 according to the shared public parameters; if the commitment c is verified, using a signature verification algorithm to verify the digital signature according to the shared public parameters Verify; in the digital signature If the verification is successful, the pre-signature is confirmed efficient.

[0010] In a possible implementation, the step S5 includes: parsing the pre-signed Get the digital signature The instance Y, the commitment c and the initial opening d0; using a trapdoor opening algorithm to convert the initial opening d0 into an opening d associated with the arbitrary message m according to the shared public parameter and the witness y; based on the digital signature The instance Y, the commitment c and the opening d generate the full signature σ.

[0011] In a possible implementation, step S6 includes: parsing the full signature σ according to the public key pk to obtain the digital signature The instance Y, the commitment c and the opening d; using a trapdoor commitment verification algorithm to verify whether the commitment c corresponds to the instance Y, the arbitrary message m and the opening d according to the shared public parameters; if the commitment c is verified, using a signature verification algorithm to verify the digital signature according to the shared public parameters Verify; in the digital signature When the verification is successful, it is determined that the full signature σ is valid.

[0012] In a possible implementation, step S7 includes: parsing the pre-signed Get a digital signature Instance Y1, commitment c1 and initial opening d0; parse the full signature σ according to the public key pk to obtain a digital signature Instance Y2, commitment c2 and opening d; verify the digital signature With the digital signature are the same, whether the instance Y1 is the same as the instance Y2, and whether the commitment c1 is the same as the commitment c2; if the verification is passed, the trapdoor commitment extraction algorithm is used to extract the witness y from the full signature σ according to the shared public parameters and the third calculation formula, and the third calculation formula is

[0013] In a second aspect, an embodiment of the present application provides an adapter signature device, the device comprising: a system parameter generation module for determining and disclosing shared public parameters required by the signer and the verifier based on preset security parameters, the shared public parameters comprising prime numbers p and q, a generator g, a hash function H, a specific message m0 and an arbitrary message m; p and q satisfy the relationship q|(p-1), g is The generator in g q ≡1(mod p), A key generation module, used to generate a key pair for the signer based on the shared public parameters, the key pair including a public key pk and a private key sk; determine an instance Y and a witness y associated with the NP relationship for the verifier, and disclose the instance Y; a pre-signature generation module, used for the signer to generate a pre-signature for the specific message m0 according to the shared public parameters, the private key sk and the instance Y A pre-signature verification module is used for the verifier to verify the pre-signature according to the shared public parameters, the public key pk and the instance Y. The validity of the full signature generation module is used by the verifier to generate the signature according to the shared public parameters, the public key pk, the pre-signature and the witness y, generating a full signature σ about the arbitrary message m; a full signature verification module, used by the verifier to verify the validity of the full signature σ according to the shared public parameters and the public key pk; a witness extraction module, used by the signer to extract the full signature σ from the pre-signed The witness y is extracted from the full signature σ, and the witness y is used to implement the adapter signature.

[0014] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method described in the first aspect or any one of the implementation methods thereof is implemented.

[0015] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect or any one of the implementation methods thereof is implemented.

[0016] Compared with the prior art, the embodiments of the present application have the following beneficial effects: based on preset security parameters, shared public parameters are determined and disclosed, and the shared public parameters include two prime numbers, generators, hash functions, specific messages and arbitrary messages; based on the shared public parameters, a key pair is generated for the signer, including a public key and a private key; the instance and witness associated with the NP relationship are determined for the verifier and the instance is disclosed; the signer generates a pre-signature based on the shared public parameters, the private key and the instance; the verifier verifies the validity of the pre-signature based on the shared public parameters, the public key and the instance; the verifier generates a full signature based on the shared public parameters, the public key, the pre-signature and the witness; the verifier verifies the validity of the full signature based on the shared public parameters and the public key; the signer extracts the witness from the pre-signature and the full signature based on the shared public parameters, thereby improving the security of the adapter signing method.

[0017] The present application enhances the flexibility and conditionality of the signature by integrating a trapdoor commitment scheme with a specific message with an adapter signature scheme, allowing the signature to be adapted or unlocked when specific conditions are met, providing a more secure and flexible encryption method for multi-party transactions and complex relationships; in addition, a weakened version of the trapdoor commitment scheme is designed, which only requires a commitment mechanism with weaker properties; this mechanism can ensure that for a pre-defined fixed message, its corresponding commitment can be opened to another different specific message by the person holding the trapdoor, so that the adapter signature can be compatible with a wide range of NP relations, greatly expanding its scope of application and being able to adapt to a variety of complex scenarios and needs.

[0018] This application also improves the privacy of transactions. By introducing a trapdoor commitment scheme, the witness is effectively hidden in the pre-signature and the adapter signature. In the adapter signing process, the witness cannot be directly obtained through one of the pre-signature or the full signature. Only under certain conditions can the witness be legally extracted from the pre-signature and the full signature, protecting the privacy and business secrets of the participants. In addition, this application optimizes the signature generation and verification process, reduces transaction costs, improves efficiency, and provides strong support for the promotion of the application of encryption technology.

[0019] This application combines the trapdoor commitment of a specific adaptive message with the standard adapter signature method, which can be applied to any signature scheme and any NP relation adapter signature scheme, and maintains good compatibility with existing cryptographic standards and systems. It provides a beneficial solution for signatures under data confidentiality conditions in general NP relations. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 A flowchart of an adapter signing method provided in one embodiment of the present application;

[0022] Figure 2 A schematic diagram of the process of step S2 provided in an embodiment of the present application;

[0023] Figure 3 A schematic diagram of the process of step S3 provided in an embodiment of the present application;

[0024] Figure 4 A schematic diagram of the process of step S4 provided in an embodiment of the present application;

[0025] Figure 5 A schematic diagram of the process of step S5 provided in an embodiment of the present application;

[0026] Figure 6 A schematic diagram of the process of step S6 provided in an embodiment of the present application;

[0027] Figure 7 A schematic diagram of the process of step S7 provided in an embodiment of the present application;

[0028] Figure 8 A structural block diagram of an adapter signature device provided in one embodiment of the present application;

[0029] Fig. 9 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0030] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0031] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0032] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0033] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0034] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0035] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0036] Adaptor Signatures (AS) is an innovative cryptographic tool that extends the concept of traditional digital signatures. This signature technology allows the signer to generate a pre-signature for a specific puzzle instance, which can be converted into a valid full signature when certain conditions are met. And the satisfied conditions, i.e. witnesses, can be proven without leaking information. This process not only retains the security and non-repudiation of traditional signatures, but also adds additional flexibility, allowing conditional signature generation in different scenarios. This feature of adapter signatures is particularly suitable for scenarios that need to reduce on-chain computation, reduce transaction costs, and enhance transaction privacy, such as blockchain and decentralized financial applications.

[0037] The nondeterministic polynomial time (NP) relation is a core concept in computational complexity theory, describing a special set of problems whose solutions can be verified in polynomial time. In the NP relation, given a problem instance Y and a potential solution y, it is possible to efficiently determine in polynomial time whether the pair (Y, y) satisfies a certain relation R. The feasibility of this verification process makes the NP relation very useful in cryptography and algorithm design, such as in constructing difficult problems in cryptographic systems and verifying solutions.

[0038] Trapdoor commitment is a cryptographic mechanism that allows a message to be encrypted without immediately revealing its contents, allowing the committer to transform a commitment to one message into another message while possessing a secret trapdoor.

[0039] In the existing adapter signature method, the witness is easily exposed, resulting in low security of the adapter signature method. In order to solve this technical problem, the present application proposes an adapter signature method, which determines and discloses shared public parameters based on preset security parameters, and the shared public parameters include two prime numbers, generators, hash functions, specific messages and arbitrary messages; based on the shared public parameters, a key pair is generated for the signer, including a public key and a private key; the instance and witness associated with the NP relationship are determined for the verifier and the instance is disclosed; the signer generates a pre-signature based on the shared public parameters, private key and instance; the verifier verifies the validity of the pre-signature based on the shared public parameters, public key and instance; the verifier generates a full signature based on the shared public parameters, public key, pre-signature and witness; the verifier verifies the validity of the full signature based on the shared public parameters and public key; the signer extracts the witness from the pre-signature and the full signature based on the shared public parameters, thereby improving the security of the adapter signature method.

[0040] For ease of understanding, the technical solution of the present application will be described in detail below with reference to the accompanying drawings.

[0041] Figure 1 This is a flowchart of an adapter signing method provided by an embodiment of the present application. For ease of description, only the part related to the present embodiment is shown. The method provided by the present embodiment includes the following steps:

[0042] Step S1, based on the preset security parameters, determine and disclose the shared public parameters required by the signer and the verifier, the shared public parameters include prime numbers p and q, generator g, hash function H, specific message m0 and any message m; p and q satisfy the relationship q|(p-1), g is The generator in g q ≡1(mod p),

[0043] Specifically, step S1 is a system parameter generation step, which determines and publicly shares public parameters params={p, q, g, m, m0, H} by inputting preset security parameters.

[0044] In the specific implementation, a preset security parameter λ is input. Under the effect of the preset security parameter λ, the system selects large prime numbers p and q, and q|(p-1), g is The generator in g q ≡1(mod p); choose a cryptographic hash function H(·); choose a specific message m0 and an arbitrary message m, By selecting parameters p, q, g, m, m0, H, the shared common parameters params = {p, q, g, m, m0, H} are determined, where the specific message m0 refers to a specific message pre-specified when building the plan; the arbitrary message m refers to any other message in the message space except the specific message m0.

[0045] Step S2: Based on the shared public parameters, a key pair is generated for the signer, the key pair including a public key pk and a private key sk; an instance Y and a witness y associated with the NP relationship are determined for the verifier, and the instance Y is made public.

[0046] Specifically, step S2 is a key generation step, which generates a public key pk and a private key sk corresponding to the signed message for the signer through a key generation algorithm, selects or constructs a witness and an instance associated with the NP relationship for the verifier, and makes the instance public.

[0047] Step S3: The signer generates a pre-signature for a specific message m0 based on the shared public parameters, private key sk and instance Y.

[0048] Specifically, step S3 is a pre-signature generation step.

[0049] In the specific implementation, the private key sk, arbitrary message m and instance Y are used as input, and the commitment algorithm of the trapdoor commitment scheme is used to perform a commitment operation on the instance Y and the specific message m0 pre-defined in the shared public parameters to generate a commitment c and an initial opening d0. The signature algorithm of the signature scheme is used to combine the private key sk, the arbitrary message m in the shared public parameters, the instance Y and the commitment c to generate a digital signature Digital signature Instance Y, commitment c and initial opening d0 are combined to form a presignature

[0050] Step S4: The verifier verifies the pre-signature based on the shared public parameters, public key pk and instance Y. effectiveness.

[0051] Specifically, step S4 is a pre-signature verification step.

[0052] In the specific implementation, the public key pk, arbitrary message m, pre-signature and instance Y as input. Parse the pre-signature using the public key pk To include a digital signature The structure of instance Y, commitment c and initial opening d0. Commitment c is verified using the verification algorithm of the trapdoor commitment scheme. This involves checking whether commitment c correctly corresponds to instance Y and the specific message m0 and initial opening d0. If the verification algorithm returns 0, indicating that the commitment is invalid, the pre-signature verification fails and returns 0. If the commitment verification passes, the digital signature is verified using the verification algorithm of the signature scheme. According to the return value of the verification algorithm, if the signature is valid, the verification result is returned; if the signature is invalid, the verification result is returned.

[0053] Step S5: The verifier uses the shared public parameters, public key pk, and pre-signature and witness y, generate a full signature σ for any message m.

[0054] Specifically, step S5 is a full signature generation step.

[0055] In the specific implementation, the public key pk, arbitrary message m, pre-signature and witness y as input. Parse the pre-signature with the public key pk To include a digital signature The structure of instance Y, commitment c, and initial opening d0. Using the incoming witness y and the trapdoor opening algorithm of the trapdoor commitment scheme, commitment c is adapted. The adaptation process involves using witness y to transform the initial opening d0 into a new opening d associated with an arbitrary message m. The digital signature obtained by parsing The instance Y, commitment c and the newly generated opening d are combined to construct the full signature σ.

[0056] In step S6, the verifier verifies the validity of the full signature σ based on the shared public parameters and the public key pk.

[0057] Specifically, step S6 is a full signature verification step.

[0058] In the specific implementation, the public key pk, arbitrary message m and full signature σ are used as input, and the full signature σ is parsed by the public key pk to contain the digital signature The structure of instance Y, commitment c and opening d. Commitment c is verified using the verification algorithm of the trapdoor commitment scheme. This involves checking whether commitment c correctly corresponds to instance Y and arbitrary message m and opening d. If the verification algorithm returns 0, indicating that the commitment is invalid, the pre-signature verification fails and returns 0. If the commitment verification passes, the digital signature is verified using the verification algorithm of the signature scheme. Verify. According to its return value, if the signature is valid, it returns the result of verification passing; if the signature is invalid, it returns the result of verification failing.

[0059] Step S7: The signer uses the shared public parameters to The witness y is extracted from the full signature σ, and the witness y is used to implement the adapter signature.

[0060] Specifically, step S7 is a witness extraction step.

[0061] In the specific implementation, the public key pk, arbitrary message m, pre-signature The full signature σ and instance Y are taken as input. The pre-signature is parsed by the public key pk To include a digital signature The structure of instance Y1, commitment c1 and initial opening d0, parsing the full signature σ to include the digital signature The structure of instance Y2, commitment c2 and final opening d. Checking the digital signatures in the pre-signature and the adapted signature and Are they the same, are the instances Y1 and Y the same, and are the commitments c1 and c the same. If the instance or commitment does not match, an error or failure flag is returned. If the instance and commitment verification pass, the extraction algorithm of the trapdoor commitment scheme is called to extract the witness y from the full signature.

[0062] The technical solution provided in this embodiment determines and discloses shared public parameters based on preset security parameters, and the shared public parameters include two prime numbers, generators, hash functions, specific messages and arbitrary messages; based on the shared public parameters, a key pair is generated for the signer, including a public key and a private key; the instance and witness associated with the NP relationship are determined for the verifier and the instance is disclosed; the signer generates a pre-signature based on the shared public parameters, the private key and the instance; the verifier verifies the validity of the pre-signature based on the shared public parameters, the public key and the instance; the verifier generates a full signature based on the shared public parameters, the public key, the pre-signature and the witness; the verifier verifies the validity of the full signature based on the shared public parameters and the public key; the signer extracts the witness from the pre-signature and the full signature based on the shared public parameters, thereby improving the security of the adapter signing method.

[0063] Figure 2 A schematic diagram of the process of step S2 provided in an embodiment of the present application. Figure 2 As shown, based on the above embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically, in this embodiment, step S2 includes:

[0064] S210, the signer randomly selects a private key sk based on the shared public parameters, and the private key sk is greater than 1 and less than the prime number q.

[0065] S220, based on the private key sk and the shared public parameter, using a first calculation formula to determine the public key pk, the first calculation formula is pk = g sk (mod p).

[0066] S230, the verifier randomly selects a witness y based on the shared public parameters, and

[0067] S240, based on the witness y and the shared public parameters, use the second calculation formula to determine the instance Y. The second calculation formula is Y = g y (mod p).

[0068] In a specific implementation, the signer S randomly selects a private key sk, where 1 < sk < q, and calculates and publishes the public key pk = g sk (mod p); the verifier R randomly selects a witness Calculate the instance Y = g y (mod p) through the second calculation formula, and send the instance Y to the signer.

[0069] The technical solution provided in this embodiment improves the accuracy of key generation and at the same time improves the security of the adapter signature method.

[0070] Figure 3 It is a schematic flowchart of step S3 provided in an embodiment of the present application. Combining Figure 3 As shown, on the basis of the above embodiment, this embodiment further explains and optimizes the technical solution. Specifically, in this embodiment, step S3 includes:

[0071] S310, adopt the trapdoor commitment algorithm, and perform a commitment operation on the instance Y and the specific message m0 according to the shared public parameters to generate a commitment c and an initial opening d0.

[0072] S320, adopt a signature algorithm, and generate a digital signature based on the shared public parameters, the private key sk, the instance Y, and the commitment c

[0073] S330, based on the digital signature The instance Y, the commitment c, and the initial opening d0 generate a pre-signature

[0074] In a specific implementation, the signer randomly selects a random number d0, and calculates the commitment value of the specific message m0 according to the shared public parameters The signer selects a random number k according to the shared public parameters, 1 < k < q, calculates r ≡ g k (mod p), calculates e = H(r, (m, Y, c)), calculates s ≡ sk·e + k (mod q), and takes (e, s) as the generated digital signature for (m, Y, c), denoted as Denote the pre-signature as And send it to the verifier.

[0075] The technical solution provided by this embodiment improves the accuracy of pre-signature generation and at the same time improves the security of the adapter signing method.

[0076] Figure 4 A schematic diagram of the process of step S4 provided in an embodiment of the present application. Figure 4 As shown, based on the above embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically, in this embodiment, step S4 includes:

[0077] S410, parse the pre-signature according to the public key pk Get a digital signature Instance Y, commitment c and initial opening d0.

[0078] S420, using a trapdoor commitment verification algorithm, verifying whether the commitment c corresponds to the instance Y, the specific message m0, and the initial opening d0 according to the shared public parameters.

[0079] S430, when the commitment c is verified, the digital signature is verified using the signature verification algorithm according to the shared public parameters. to verify.

[0080] S440, in digital signature If the verification is successful, confirm the pre-signature efficient.

[0081] In the specific implementation, the verifier receives the pre-signed And parse according to the public key pk Calculated based on shared common parameters And verify the equation c′=c. If the verification algorithm is not established, it means that the commitment is invalid. At this time, the pre-signature verification fails and returns 0. If the commitment verification passes, continue to verify the digital signature. Verify; Verifier analysis Calculate r′≡g s y -e (mod p), calculate e′=H(r′,m), and verify whether e′=e holds; if the verification algorithm holds, it proves that the pre-signature is valid.

[0082] The technical solution provided by this embodiment improves the accuracy of pre-signature verification and at the same time improves the security of the adapter signing method.

[0083] Figure 5 A flowchart of step S5 is provided in accordance with an embodiment of the present application. Figure 5 As shown, based on the above embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically, in this embodiment, step S5 includes:

[0084] S510, parse the pre-signature according to the public key pk Get a digital signature Instance Y, commitment c and initial opening d0.

[0085] S520, using a trapdoor opening algorithm, converting the initial opening d0 into an opening d associated with an arbitrary message m according to the shared public parameters and the witness y.

[0086] S530, based on digital signature Instance Y, commitment c and opening d, generate the full signature σ.

[0087] In the specific implementation, the pre-signature is parsed according to the public key pk To include a digital signature The structure of instance Y, commitment c and initial opening d0; the verifier solves the equation m0+yd0=m+yd mod q to get d; the digital signature obtained by parsing The instance Y, commitment c and the newly generated opening d are combined to construct the full signature σ; finally, the verifier makes the full signature σ public.

[0088] The technical solution provided by this embodiment improves the accuracy of full signature generation and at the same time improves the security of the adapter signature method.

[0089] Figure 6 A schematic diagram of the process of step S6 provided in an embodiment of the present application. Figure 6 As shown, based on the above embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically, in this embodiment, step S6 includes:

[0090] S610, parse the full signature σ according to the public key pk to obtain a digital signature Example Y, commitment c and opening d.

[0091] S620, using a trapdoor commitment verification algorithm, verify whether the commitment c corresponds to the instance Y, the arbitrary message m, and the opening d according to the shared public parameters.

[0092] S630, when the commitment c is verified, the digital signature is verified using the signature verification algorithm according to the shared public parameters. to verify.

[0093] S640, in digital signature If the verification is successful, the full signature σ is determined to be valid.

[0094] In the specific implementation, the verifier receives the full signature σ sent by the signer and parses it according to the public key pk Calculate c′=g based on shared common parameters m Y d mod p, and verify the equation c′=c. If the verification algorithm does not hold, it indicates that the commitment is invalid. In this case, the full signature verification fails and returns 0. If the commitment verification passes, continue to verify the digital signature. Verify; Verifier analysis Calculate r′≡g s y -e (mod p), calculate e′=H(r′,m), and verify whether e′=e holds; if the verification algorithm holds, the full signature is proven to be valid.

[0095] The technical solution provided by this embodiment improves the accuracy of full signature verification and at the same time improves the security of the adapter signature method.

[0096] Figure 7 A flowchart of step S7 is provided in accordance with an embodiment of the present application. Figure 7 As shown, based on the above embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically, in this embodiment, step S7 includes:

[0097] S710, parse the pre-signature according to the public key pk Get a digital signature Instance Y1, commitment c1 and initial opening d0.

[0098] S720, parse the full signature σ according to the public key pk to obtain a digital signature Example Y2, commitment c2 and opening d.

[0099] S730, verify digital signature With digital signature are the same, whether instance Y1 is the same as instance Y2, and whether commitment c1 is the same as commitment c2.

[0100] S740, if the verification is successful, the trapdoor commitment extraction algorithm is used to extract the witness y from the full signature according to the shared public parameters and the third calculation formula. The third calculation formula is

[0101] In the specific implementation, the pre-signature is parsed according to the public key pk To include a digital signature The structure of instance Y1, commitment c1 and initial opening d0, parsing the full signature σ to include the digital signature The structure of instance Y2, commitment c2 and opening d; check the digital signature in the pre-signature and full signature With digital signature are the same, whether instance Y1 is the same as instance Y2, and whether commitment c1 is the same as commitment c2; if the instance or commitment does not match, an error or failure flag is returned; if the instance and commitment are verified, the witness is calculated through the third calculation formula

[0102] In the technical solution provided by this embodiment, the witness y can only be extracted through the pre-signature and the adaptation signature together, and cannot be extracted from either one alone, which ensures the concealment of the witness and improves the security of the adapter signature method.

[0103] Figure 8 This is a structural block diagram of an adapter signature device provided by an embodiment of the present application. For the sake of convenience, only the parts related to the embodiment of the present application are shown. Figure 8 The adapter signing device 800 may include a system parameter generation module 801, a key generation module 802, a pre-signature generation module 803, a pre-signature verification module 804, a full signature generation module 805, a full signature verification module 806 and a witness extraction module 807.

[0104] System parameter generation module 801 is used to determine and disclose the shared public parameters required by the signer and the verifier based on the preset security parameters. The shared public parameters include prime numbers p and q, generator g, hash function H, specific message m0 and any message m; p and q satisfy the relationship q|(p-1), g is The generator in g q ≡1(mod p),

[0105] The key generation module 802 is used to generate a key pair for the signer based on the shared public parameters, the key pair including a public key pk and a private key sk; determine the instance Y and witness y associated with the NP relationship for the verifier, and disclose the instance Y.

[0106] Pre-signature generation module 803, used by the signer to generate a pre-signature for a specific message m0 based on the shared public parameters, private key sk and instance Y

[0107] Pre-signature verification module 804 is used by the verifier to verify the pre-signature based on the shared public parameters, public key pk and instance Y. effectiveness.

[0108] Full signature generation module 805 is used by the verifier to generate a signature based on shared public parameters, public key pk, pre-signature and witness y, generate a full signature σ for any message m.

[0109] The full signature verification module 806 is used by the verifier to verify the validity of the full signature σ based on the shared public parameters and the public key pk.

[0110] Witness extraction module 807, used by the signer to extract the pre-signed The witness y is extracted from the full signature σ, and the witness y is used to implement the adapter signature.

[0111] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0112] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0113] Fig. 9 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Fig. 9 As shown, the electronic device 9 of this embodiment includes: at least one processor 90 ( Fig. 9 Only one is shown), a memory 91, and a computer program 92 stored in the memory 91 and executable on at least one processor 90, the processor 90 executes the computer program 92 to implement the above Figures 1 to 7 The steps in any method embodiment, or the implementation of the above Figure 8 Functions of each module / unit in the device embodiment.

[0114] The electronic device 9 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The electronic device 9 may include but is not limited to a processor 90 and a memory 91. Those skilled in the art will appreciate that Fig. 9It is only an example of the electronic device 9 and does not constitute a limitation on the electronic device 9. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0115] The processor 90 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0116] In some embodiments, the memory 91 may be an internal storage unit of the electronic device 9, such as a hard disk or memory of the electronic device 9. In other embodiments, the memory 91 may also be an external storage device of the electronic device 9, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 9. Further, the memory 91 may also include both an internal storage unit of the electronic device 9 and an external storage device. The memory 91 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as program codes of a computer program. The memory 91 may also be used to temporarily store data that has been output or is to be output.

[0117] The embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0118] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include at least: any entity or device capable of carrying the computer program code to an electronic device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.

[0119] A computer-readable storage medium provided in an embodiment of the present application has the same beneficial effects as the above-mentioned adapter signing method.

[0120] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0121] A computer program product provided in an embodiment of the present application has the same beneficial effects as the above-mentioned adapter signing method.

[0122] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0123] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0124] In the embodiments provided in the present application, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0125] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0126] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. An adapter signing method, characterized in that: The method comprises: Step S1, based on the preset security parameters, determine and disclose the shared public parameters required by the signer and the verifier, the shared public parameters include prime numbers p and q, generator g, hash function H, specific message m0 and any message m; p and q satisfy the relationship q|(p-1), g is The generator in g q ≡1(mod p), Step S2, based on the shared public parameters, generating a key pair for the signer, the key pair comprising a public key pk and a private key sk; determining an instance Y and a witness y associated with the NP relationship for the verifier, and making the instance Y public; Step S3, the signer generates a pre-signature for the specific message m0 based on the shared public parameters, the private key sk and the instance Y Step S4, the verifier verifies the pre-signature according to the shared public parameters, the public key pk and the instance Y effectiveness; Step S5: the verifier verifies the shared public parameters, the public key pk, and the pre-signature and the witness y, generate a full signature σ about the arbitrary message m; Step S6, the verifier verifies the validity of the full signature σ according to the shared public parameters and the public key pk; Step S7: the signer generates a The witness y is extracted from the full signature σ, and the witness y is used to implement the adapter signature.

2. The method according to claim 1, characterized in that: The step S2 comprises: The signer randomly selects the private key sk based on the shared public parameter, and the private key sk is greater than 1 and less than the prime number q; Based on the private key sk and the shared public parameter, the public key pk is determined using a first calculation formula, wherein the first calculation formula is pk=g sk (mod p); The verifier randomly selects the witness y based on the shared public parameter, and Based on the witness y and the shared public parameter, the instance Y is determined using a second calculation formula, where the second calculation formula is Y=g y (mod p).

3. The method according to claim 1, characterized in that: The step S3 comprises: Using a trapdoor commitment algorithm, a commitment operation is performed on the instance Y and the specific message m0 according to the shared public parameters to generate a commitment c and an initial opening d0; A digital signature is generated based on the shared public parameter, the private key sk, the instance Y and the commitment c using a signature algorithm Based on the digital signature The instance Y, the commitment c and the initial opening d0 generate the pre-signature 4. The method according to claim 3, characterized in that The step S4 comprises: Parse the pre-signature according to the public key pk Get the digital signature The instance Y, the commitment c and the initial opening d0; Adopting a trapdoor commitment verification algorithm, verifying whether the commitment c corresponds to the instance Y, the specific message m0, and the initial opening d0 according to the shared public parameters; If the commitment c is verified, a signature verification algorithm is used to verify the digital signature according to the shared public parameters. To verify; In the digital signature If the verification is successful, the pre-signature is confirmed efficient.

5. The method according to claim 3, characterized in that The step S5 comprises: Parse the pre-signature according to the public key pk Get the digital signature The instance Y, the commitment c and the initial opening d0; Adopting a trapdoor opening algorithm, converting an initial opening d0 into an opening d associated with the arbitrary message m according to the shared public parameter and the witness y; Based on the digital signature The instance Y, the commitment c and the opening d generate the full signature σ.

6. The method according to claim 5, characterized in that The step S6 comprises: Parse the full signature σ according to the public key pk to obtain the digital signature The instance Y, the commitment c and the opening d; Using a trapdoor commitment verification algorithm, verifying whether the commitment c corresponds to the instance Y, the arbitrary message m, and the opening d according to the shared public parameters; If the commitment c is verified, a signature verification algorithm is used to verify the digital signature according to the shared public parameters. To verify; In the digital signature When the verification is successful, it is determined that the full signature σ is valid.

7. The method according to claim 1, characterized in that The step S7 comprises: Parse the pre-signature according to the public key pk Get a digital signature Instance Y1, commitment c1 and initial opening d0; Parse the full signature σ according to the public key pk to obtain the digital signature Instance Y2, commitment c2 and opening d; Verify the digital signature With the digital signature are the same, whether the instance Y1 is the same as the instance Y2, and whether the commitment c1 is the same as the commitment c2; If the verification is successful, the trapdoor commitment extraction algorithm is used to extract the witness y from the full signature σ according to the shared public parameters and the third calculation formula. The third calculation formula is:

8. An adapter signature device, characterized in that: The device comprises: The system parameter generation module is used to determine and disclose the shared public parameters required by the signer and the verifier based on the preset security parameters. The shared public parameters include prime numbers p and q, generator g, hash function H, specific message m0 and any message m; p and q satisfy the relationship q|(p-1), g is The generator in g q ≡1(mod p), A key generation module, configured to generate a key pair for the signer based on the shared public parameters, the key pair comprising a public key pk and a private key sk; determine an instance Y and a witness y associated with the NP relationship for the verifier, and disclose the instance Y; A pre-signature generation module, used for the signer to generate a pre-signature for the specific message m0 according to the shared public parameters, the private key sk and the instance Y A pre-signature verification module is used for the verifier to verify the pre-signature according to the shared public parameters, the public key pk and the instance Y. effectiveness; The full signature generation module is used for the verifier to generate a full signature based on the shared public parameters, the public key pk, and the pre-signature and the witness y, generate a full signature σ about the arbitrary message m; A full signature verification module, used by the verifier to verify the validity of the full signature σ based on the shared public parameters and the public key pk; A witness extraction module is used for the signer to extract the pre-signed The witness y is extracted from the full signature σ, and the witness y is used to implement the adapter signature.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images