Adapter signature method, signature device, electronic equipment and storage medium

Abstract

The application relates to the technical field of information security, in particular to an adapter signature method, a signature device, electronic equipment and a storage medium. The application determines and discloses shared public parameters based on preset security parameters, the shared public parameters including two prime numbers, a generating element, a hash function, a specific message and an arbitrary message; a key pair, including a public key and a private key, is generated for a signer based on the shared public parameters; an instance and a witness associated with NP relationship are determined for a verifier and the instance is disclosed; a pre-signature is generated by the signer according to the shared public parameters, the private key and the instance; the effectiveness of the pre-signature is verified by the verifier according to the shared public parameters, the public key and the instance; a full signature is generated by the verifier according to the shared public parameters, the public key, the pre-signature and the witness; the effectiveness of the full signature is verified by the verifier according to the shared public parameters and the public key; and the witness is extracted from the pre-signature and the full signature by the signer according to the shared public parameters, thereby improving the security of the adapter signature method.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to an adaptor signature method, a signature device, an electronic device and a storage medium. BACKGROUND

[0002] Adaptor Signature (AS) is an innovative cryptographic tool that extends the concept of traditional digital signatures. This signature technique allows a signer to generate a pre-signature for a specific instance of a hard problem, which can be converted into a valid full signature when certain conditions are met. The conditions, i.e. the witness, can be proven without revealing information. This process not only preserves the security and non-repudiation of traditional signatures, but also adds additional flexibility, allowing conditional signature generation in different scenarios. This feature of adaptor signature is suitable for scenarios that require reduced on-chain computation, reduced transaction costs and enhanced transaction privacy, such as blockchain and decentralized financial applications.

[0003] However, in the existing adaptor signature method, the witness is easily exposed, which leads to low security of the adaptor signature method.

[0004] Therefore, how to improve the security of the adaptor signature method has become a problem to be solved. SUMMARY

[0005] The present application provides an adaptor signature method, a signature device, an electronic device and a storage medium, aiming to solve the problem of low security of the adaptor signature method.

[0006] In a first aspect, an adaptor signature method is provided, which comprises the following steps: S1, determining and disclosing shared public parameters required by a signer and a verifier based on preset security parameters, wherein the shared public parameters comprise prime numbers p and q, a generator g, a hash function H, a specific message m0 and an arbitrary message m; p and q satisfy the relationship q|(p-1), g is a generator in and g q ≡1(mod p), S2, generating a key pair for the signer based on the shared public parameters, wherein the key pair comprises a public key pk and a private key sk; determining an instance Y associated with a NP relationship and a witness y for the verifier, and disclosing the instance Y; S3, the signer generates a pre-signature S4, the verifier verifies the pre-signature validity; step S5, the verifier generates a full signature σ on the arbitrary message m according to the shared common parameter, the public key pk, the pre-signature and the witness y; step S6, the verifier verifies the validity of the full signature σ according to the shared common parameter and the public key pk; step S7, the signer extracts the witness y from the pre-signature and the full signature σ according to the shared common parameter, the witness y is used to realize the adapter signature.

[0007] In a possible implementation, the step S2 comprises: the signer randomly selects the private key sk based on the shared common parameter, the private key sk is greater than 1 and less than the prime number q; and determines the public key pk based on the private key sk and the shared common parameter by using a first calculation formula, the first calculation formula is pk=g sk (mod p); the verifier randomly selects the witness y based on the shared common parameter, and determines the instance Y based on the witness y and the shared common parameter by using a second calculation formula, the second calculation formula is Y=g y (mod p).

[0008] In a possible implementation, the step S3 comprises: performing a commitment operation on the instance Y and the specific message m0 according to the shared common parameter by using a trapdoor commitment algorithm to generate a commitment c and an initial opening d0; and generating a digital signature based on the digital signature the instance Y, the commitment c and the initial opening d0 by using a signature algorithm, the pre-signature

[0009] In a possible implementation, the step S4 comprises: parsing the pre-signature based on the public key pk to obtain the digital signature the instance Y, the commitment c and the initial opening d0; verifying whether the commitment c corresponds to the instance Y, the specific message m0 and the initial opening d0 by using a trapdoor commitment verification algorithm according to the shared common parameter; in the case that the commitment c is verified, verifying the digital signature based on the shared common parameter by using a signature verification algorithm; and in the case that the digital signature is verified, determining that the pre-signature is valid.

[0010] In a possible implementation, the step S5 comprises: parsing the pre-signature according to the public key pk to obtain the digital signature obtaining the digital signature the instance Y, the commitment c and the initial opening d0; using a trapdoor opening algorithm, converting the initial opening d0 into an opening d associated with the arbitrary message m according to the shared common parameter and the witness y; based on the digital signature the instance Y, the commitment c and the opening d, generating the full signature σ.

[0011] In a possible implementation, the step S6 comprises: parsing the full signature σ according to the public key pk to obtain the digital signature the instance Y, the commitment c and the opening d; using a trapdoor commitment verification algorithm, verifying whether the commitment c corresponds to the instance Y, the arbitrary message m and the opening d according to the shared common parameter; in the case that the commitment c passes the verification, using a signature verification algorithm, verifying the digital signature according to the shared common parameter; in the case that the digital signature passes the verification, determining that the full signature σ is valid.

[0012] In a possible implementation, the step S7 comprises: parsing the pre-signature according to the public key pk to obtain the digital signature obtaining the digital signature the instance Y1, the commitment c1 and the initial opening d0; parsing the full signature σ according to the public key pk to obtain the digital signature the instance Y2, the commitment c2 and the opening d; verifying the digital signature and the digital signature whether the same, whether the instance Y1 and the instance Y2 are the same, and whether the commitment c1 and the commitment c2 are the same; if the verification passes, using a trapdoor commitment extraction algorithm, extracting the witness y from the full signature σ according to the shared common parameter and a third calculation formula, the third calculation formula being

[0013] In a second aspect, the embodiments of the present application provide an adapter signature device, the device comprising: a system parameter generation module configured to determine and disclose shared common parameters required by a signer and a verifier based on preset security parameters, the shared common parameters comprising a prime number p and a prime number q, a generator g, a hash function H, a specific message m0 and an arbitrary message m; p and q satisfy a relationship formula q|(p-1), g is a generator in , and g q ≡1(mod p), A key generation module is used to generate a key pair for the signer based on the shared public parameters, the key pair including a public key pk and a private key sk; to determine an instance Y and a witness y associated with the NP relationship for the verifier, and to disclose the instance Y; a pre-signature generation module is used for the signer to generate a pre-signature for the specific message m0 based on the shared public parameters, the private key sk, and the instance Y. The pre-signature verification module is used by the verifier to verify the pre-signature based on the shared public parameters, the public key pk, and the instance Y. The validity of the signature; a full signature generation module, used by the verifier to generate the signature based on the shared public parameters, the public key pk, and the pre-signature. The witness y generates a full signature σ for any message m; the full signature verification module is used by the verifier to verify the validity of the full signature σ based on the shared public parameters and the public key pk; the witness extraction module is used by the signer to extract the witness from the pre-signature based on the shared public parameters. The witness y is extracted from the full signature σ, and the witness y is used to implement the adapter signature.

[0014] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method as described in the first aspect or any of the implementations thereof.

[0015] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in the first aspect or any of the implementations thereof.

[0016] The beneficial effects of this application's embodiments compared to existing technologies are as follows: Based on preset security parameters, shared public parameters are determined and disclosed, including two prime numbers, a generator, a hash function, a specific message, and any message; based on the shared public parameters, a key pair, including a public key and a private key, is generated for the signer; an instance and witness associated with the NP relationship are determined for the verifier and the instance is disclosed; the signer generates a pre-signature based on the shared public parameters, the private key, and the instance; the verifier verifies the validity of the pre-signature based on the shared public parameters, the public key, and the instance; the verifier generates a full signature based on the shared public parameters, the public key, the pre-signature, and the witness; the verifier verifies the validity of the full signature based on the shared public parameters and the public key; and the signer extracts the witness from the pre-signature and the full signature based on the shared public parameters, thus improving the security of the adapter signing method.

[0017] The application enhances the flexibility and conditionality of the signature by fusing the trapdoor commitment scheme with a specific message and the adaptor signature scheme, allows the signature to be adapted or unlocked under certain conditions, and provides a more secure and flexible encryption means for multi-party transactions and complex relationships; in addition, a weakened version of the trapdoor commitment scheme is designed, which only requires a commitment mechanism with weaker properties; this mechanism can ensure that for a predefined fixed message, the corresponding commitment can be opened by the person holding the trapdoor to another different specific message, so that the adaptor signature can be compatible with a wide range of NP relationships, greatly expanding its application range and adapting to various complex scenarios and needs.

[0018] The application also improves the privacy of transactions, effectively hides the witness in pre-signature and adaptive signature by introducing the trapdoor commitment scheme. In the process of adaptive signature, the witness cannot be directly obtained from one of the pre-signature or full signature, but only under certain conditions can the witness be extracted from the pre-signature and full signature legally, protecting the privacy and trade secrets of the participants. In addition, the application optimizes the signature generation and verification process, reduces transaction costs and improves efficiency, providing strong support for the promotion of the application of encryption technology.

[0019] The application combines the trapdoor commitment of the specific adaptive message and the standard adaptor signature method, and can be applied to any signature scheme and any NP relationship of the adaptor signature scheme, maintaining good compatibility with existing cryptography standards and systems. It provides a beneficial solution for signature under data privacy conditions in general NP relationships. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0021] Figure 1 A flowchart of an adaptor signature method provided by an embodiment of the present application is shown in the figure;

[0022] Figure 2 A flowchart of step S2 provided by an embodiment of the present application is shown in the figure;

[0023] Figure 3 A flowchart of step S3 provided by an embodiment of the present application is shown in the figure;

[0024] Figure 4 A flowchart of step S4 provided by an embodiment of the present application is shown in the figure;

[0025] Figure 5 A flowchart illustrating step S5 provided in an embodiment of this application;

[0026] Figure 6 A flowchart illustrating step S6 provided in an embodiment of this application;

[0027] Figure 7 A flowchart illustrating step S7 provided in an embodiment of this application;

[0028] Figure 8 A structural block diagram of an adapter signature device provided in an embodiment of this application;

[0029] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0030] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0031] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0032] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0033] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0034] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0035] Reference to "one embodiment" or "some embodiments" or "one implementation" or "some implementations" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. The appearance of the phrases in various places in the specification is not therefore necessarily referring to the same embodiment(s) or the same place of disclosure. The terms "including," "comprising," "having," and variations thereof are meant to encompass the items listed thereafter and equivalents thereof as well as additional items. The terms "coupled" and "connected" and variations thereof are intended to encompass a connection between two members, which is strict but does not necessarily mean direct.

[0036] Adaptor Signatures (AS) is an innovative cryptographic tool that extends the concept of traditional digital signatures. This signature technique allows a signer to generate a pre-signature for a specific instance of a hard problem. The pre-signature can be converted into a valid full signature when certain specific conditions are met, known as a witness. The witness can be proven without revealing information. This process not only preserves the security and non-repudiation of traditional signatures, but also adds additional flexibility, allowing conditional signature generation in different scenarios. This feature of Adaptor Signatures is particularly suitable for scenarios that require reduced on-chain computation, lower transaction costs, and enhanced transaction privacy, such as blockchain and decentralized financial applications.

[0037] Nondeterministic Polynomial time (NP) relation is a core concept in computational complexity theory, describing a special set of problems whose solutions can be verified in polynomial time. In NP relation, given a problem instance Y and a potential solution y, it can be effectively determined in polynomial time whether the pair (Y, y) satisfies a specific relation R. The feasibility of this verification process makes NP relation very useful in cryptography and algorithm design, such as constructing puzzles and verifying solutions in cryptographic systems.

[0038] Trapdoor commitment is a cryptographic mechanism that allows a message to be encrypted and committed without immediately revealing the content. It allows the committer to convert the commitment for a certain message into another message while holding a secret trapdoor.

[0039] In the existing adapter signature method, the witness is easy to expose, resulting in low security of the adapter signature method. In order to solve this technical problem, the application provides an adapter signature method, based on a preset security parameter, determining and disclosing a shared public parameter, the shared public parameter including two prime numbers, a generator, a hash function, a specific message and an arbitrary message; based on the shared public parameter, generating a key pair for a signer, including a public key and a private key; determining an instance associated with NP relationship and a witness for a verifier and disclosing the instance; the signer generates a pre-signature according to the shared public parameter, the private key and the instance; the verifier verifies the validity of the pre-signature according to the shared public parameter, the public key and the instance; the verifier generates a full signature according to the shared public parameter, the public key, the pre-signature and the witness; the verifier verifies the validity of the full signature according to the shared public parameter and the public key; the signer extracts the witness from the pre-signature and the full signature according to the shared public parameter, improving the security of the adapter signature method.

[0040] In order to facilitate understanding, the technical solutions of the application will be described in detail below with reference to the drawings.

[0041] Figure 1 A flowchart of an adapter signature method provided by an embodiment of the application is shown, only the part related to the embodiment is shown for the convenience of description, and the method provided by the embodiment includes the following steps:

[0042] Step S1, based on a preset security parameter, determining and disclosing shared public parameters required by a signer and a verifier, the shared public parameters including prime numbers p and q, a generator g, a hash function H, a specific message m0 and an arbitrary message m; p and q satisfy the relationship q|(p-1), g is a generator in , and g q ≡1(mod p),

[0043] Specifically, step S1 is a system parameter generation step, through the input of the preset security parameter, the shared public parameter params={p, q, g, m, m0, H} is determined and disclosed.

[0044] In specific implementation, the preset security parameter λ is input, under the action of the preset security parameter λ, the system selects large prime numbers p and q, and q|(p-1), g is a generator in , and g q ≡1(mod p); a cryptographic hash function H(·) is selected; a specific message m0 and an arbitrary message m are selected, A public parameter params={p, q, g, m, m0, H} is determined by selecting parameters p, q, g, m, m0, and H, wherein the specific message m0 refers to a specific message pre-specified when the scheme is constructed, and the arbitrary message m refers to any other message in the message space except the specific message m0.

[0045] In step S2, a key pair including a public key pk and a private key sk is generated for the signer based on the shared public parameter, an instance Y and a witness y associated with the NP relation are determined for the verifier, and the instance Y is disclosed.

[0046] Specifically, step S2 is a key generation step, in which a key generation algorithm is used to generate a public key pk and a private key sk corresponding to a signature message for the signer, and an instance and a witness associated with the NP relation are selected or constructed for the verifier, and the instance is disclosed.

[0047] In step S3, the signer generates a pre-signature

[0048] Specifically, step S3 is a pre-signature generation step.

[0049] In a specific implementation, the private key sk, the arbitrary message m, and the instance Y are taken as inputs, a commitment algorithm of a trapdoor commitment scheme is used to perform a commitment operation on the instance Y and the specific message m0 pre-defined in the shared public parameter, a commitment c and an initial opening d0 are generated, a signature algorithm of a signature scheme is used to generate a digital signature from the private key sk, the arbitrary message m in the shared public parameter, the instance Y, and the commitment c. The instance Y, the commitment c, and the initial opening d0 are combined to form a pre-signature

[0050] In step S4, the verifier verifies the validity of the pre-signature based on the shared public parameter, the public key pk, and the instance Y.

[0051] Specifically, step S4 is a pre-signature verification step.

[0052] In a specific implementation, the public key pk, the arbitrary message m, the pre-signature and the instance Y are taken as inputs. The pre-signature is parsed into the digital signature Structure of instance Y, commitment c and initial opening d0. The commitment c is verified using the verification algorithm of the trapdoor commitment scheme. This involves checking whether the commitment c correctly corresponds to the instance Y and the specific message m0 and the initial opening d0. If the verification algorithm returns 0, indicating that the commitment is invalid, the pre-signature verification fails and 0 is returned. If the commitment verification passes, the verification algorithm of the signature scheme is used to verify the digital signature . According to the return value of the verification algorithm, if the signature is valid, a result of verification passed is returned; if the signature is invalid, a result of verification failed is returned.

[0053] Step S5, the verifier generates a full signature σ with respect to an arbitrary message m according to the shared common parameters, the public key pk, the pre-signature and the witness y.

[0054] Specifically, step S5 is a full signature generation step.

[0055] In specific implementation, the public key pk, the arbitrary message m, the pre-signature and the witness y are taken as inputs. The pre-signature is parsed into a digital signature instance Y, commitment c and initial opening d0. The commitment c is adapted using the trapdoor opening algorithm of the trapdoor commitment scheme with the incoming witness y. The adaptation process involves converting the initial opening d0 into a new opening d associated with the arbitrary message m using the witness y. The parsed digital signature instance Y, commitment c and the newly generated opening d are combined to construct the full signature σ.

[0056] Step S6, the verifier verifies the validity of the full signature σ according to the shared common parameters and the public key pk.

[0057] Specifically, step S6 is a full signature verification step.

[0058] In specific implementation, the public key pk, the arbitrary message m and the full signature σ are taken as inputs, and the full signature σ is parsed into a digital signature instance Y, commitment c and opening d. The commitment c is verified using the verification algorithm of the trapdoor commitment scheme. This involves checking whether the commitment c correctly corresponds to the instance Y and the arbitrary message m and the opening d. If the verification algorithm returns 0, indicating that the commitment is invalid, the pre-signature verification fails and 0 is returned. If the commitment verification passes, the verification algorithm of the signature scheme is used to verify the digital signature . According to the return value thereof, if the signature is valid, a result of verification passed is returned; if the signature is invalid, a result of verification failed is returned.

[0059] Step S7, the signer generates a full signature σ with respect to an arbitrary message m according to the shared common parameters, the pre-signature and the witness y is extracted from the full signature sigma to realize the adaptor signature.

[0060] Specifically, the step S7 is a witness extraction step.

[0061] In a specific implementation, the pre-signature The full signature sigma and the instance Y are taken as inputs. The pre-signature is parsed into a digital signature The instance Y1, the commitment c1 and the initial opening d0, and the full signature sigma are parsed into a digital signature The instance Y2, the commitment c2 and the final opening d. The digital signatures in the pre-signature and the adaptor signature are checked and are the same, the instances Y1 and Y are the same, and the commitments c1 and c are the same. If the instances or the commitments do not match, an error or a failure flag is returned. If the instances and the commitments are verified, an extraction algorithm of the trapdoor commitment scheme is called to extract the witness y from the full signature.

[0062] The technical scheme provided by the embodiment is based on preset security parameters, determines and discloses shared public parameters, the shared public parameters include two prime numbers, a generator, a hash function, a specific message and an arbitrary message; based on the shared public parameters, a key pair including a public key and a private key is generated for a signer; an instance and a witness associated with an NP relation are determined for a verifier and the instance is disclosed; the signer generates a pre-signature according to the shared public parameters, the private key and the instance; the verifier verifies the validity of the pre-signature according to the shared public parameters, the public key and the instance; the verifier generates a full signature according to the shared public parameters, the public key, the pre-signature and the witness; the verifier verifies the validity of the full signature according to the shared public parameters and the public key; and the signer extracts the witness from the pre-signature and the full signature according to the shared public parameters, thereby improving the security of the adaptor signature method.

[0063] Figure 2 The flowchart of the step S2 provided by an embodiment of the application is shown. In combination with Figure 2 shown, on the basis of the above embodiment, the technical scheme is further described and optimized in the embodiment, specifically, in the embodiment, the step S2 includes:

[0064] S210, the signer randomly selects a private key sk based on the shared public parameters, the private key sk is greater than 1 and less than a prime number q.

[0065] S220, based on the private key sk and the shared public parameters, a first calculation formula is used to determine the public key pk, the first calculation formula is pk=g sk (mod p).

[0066] S230, the verifier randomly selects a witness y based on the shared public parameter, and

[0067] S240, based on the witness y and the shared public parameter, an instance Y is determined by using a second calculation formula Y=g y (mod p).

[0068] In a specific implementation, the signer S randomly selects a private key sk, where 1<sk<q, calculates and publicly discloses a public key pk=g sk (mod p) by using a first calculation formula; the verifier R randomly selects a witness calculates an instance Y=g y (mod p) by using a second calculation formula, and sends the instance Y to the signer.

[0069] The technical scheme provided by the embodiment improves the accuracy of key generation, and improves the security of the adapter signature method.

[0070] Figure 3 A flowchart of step S3 is provided for an embodiment of the application. As shown in Figure 3 the above embodiment, the technical scheme is further described and optimized in the embodiment, specifically, in the embodiment, step S3 includes:

[0071] S310, using a trapdoor commitment algorithm, an instance Y and a specific message m0 are committed according to the shared public parameter, to generate a commitment c and an initial opening d0.

[0072] S320, using a signature algorithm, a digital signature

[0073] S330, based on the digital signature instance Y, the commitment c and the initial opening d0, a pre-signature

[0074] In a specific implementation, the signer randomly selects a random number d0, and calculates the commitment value of the specific message m0 according to the shared public parameter The signer selects a random number k according to the shared public parameter, 1<k<q, calculates r≡g k (mod p), calculates e=H(r,(m,Y,c)), calculates s≡sk·e+k(mod q), takes (e,s) as the generated digital signature about (m,Y,c), denoted as takes the pre-signature as and sends it to the verifier.

[0075] The technical scheme provided by the embodiment improves the accuracy of the pre-signature generation, and improves the security of the adapter signature method.

[0076] Figure 4 The flowchart of step S4 provided by an embodiment of the application is shown in FIG. 4. Figure 4 Based on the above embodiment, the technical scheme is further described and optimized in the embodiment, specifically, in the embodiment, step S4 comprises:

[0077] S410, the pre-signature is parsed according to the public key pk to obtain a digital signature , an instance Y, a commitment c and an initial opening d0.

[0078] S420, a trapdoor commitment verification algorithm is used to verify whether the commitment c corresponds to the instance Y, a specific message m0 and the initial opening d0 according to shared public parameters.

[0079] S430, in the case that the commitment c is verified, a signature verification algorithm is used to verify the digital signature according to the shared public parameters.

[0080] S440, in the case that the digital signature is verified, it is determined that the pre-signature is valid.

[0081] In a specific implementation, the verifier receives the pre-signature sent by the signer and parses the pre-signature According to the shared public parameters, c' is calculated and the equation c' = c is verified. If the verification algorithm is not established, it indicates that the commitment is invalid, at this time, the pre-signature verification fails, and 0 is returned. If the commitment is verified, the digital signature is verified; the verifier parses r'≡g s y -e (mod p) is calculated, e' = H(r', m) is calculated, and it is verified whether e' = e is established; if the verification algorithm is established, it is proved that the pre-signature is valid.

[0082] The technical scheme provided by the embodiment improves the accuracy of the pre-signature verification, and improves the security of the adapter signature method.

[0083] Figure 5 The flowchart of step S5 provided by an embodiment of the application is shown in FIG. 5. Figure 5 Based on the above embodiment, the technical scheme is further described and optimized in the embodiment, specifically, in the embodiment, step S5 comprises:

[0084] S510, parsing the pre-signature according to the public key pk obtaining the digital signature the instance Y, the commitment c and the initial opening d0.

[0085] S520, converting the initial opening d0 into an opening d associated with an arbitrary message m by using a trapdoor opening algorithm according to the shared public parameter and the witness y.

[0086] S530, verifying the digital signature the instance Y, the commitment c and the opening d, generating the full signature sigma.

[0087] In a specific implementation, the pre-signature is parsed according to the public key pk for the structure of the instance Y, the commitment c and the initial opening d0; the verifier solves the equation m0+yd0=m+yd mod q to obtain d; and the parsed digital signature the instance Y, the commitment c and the newly generated opening d are combined to construct the full signature sigma; and finally the verifier discloses the full signature sigma.

[0088] The technical scheme provided by the embodiment improves the accuracy of full signature generation and improves the security of the adapter signature method.

[0089] Figure 6 The flowchart of step S6 provided by an embodiment of the present application is shown. In combination with Figure 6 shown, on the basis of the above embodiment, the technical scheme is further described and optimized in the embodiment, specifically, in the embodiment, step S6 includes:

[0090] S610, parsing the full signature sigma according to the public key pk to obtain the digital signature the instance Y, the commitment c and the opening d.

[0091] S620, verifying whether the commitment c corresponds to the instance Y, an arbitrary message m and the opening d by using a trapdoor commitment verification algorithm according to the shared public parameter.

[0092] S630, in the case that the commitment c is verified, verifying the digital signature by using a signature verification algorithm according to the shared public parameter.

[0093] S640, in the case that the digital signature is verified, determining that the full signature sigma is valid.

[0094] In a specific implementation, the verifier receives the full signature sigma sent by the signer and parses ​According to the shared public parameter, c' = g m Y d mod p, and verifies the equation c' = c. If the verification algorithm is not true, it indicates that the commitment is invalid, at which time the full signature verification fails, and 0 is returned. If the commitment verification passes, the digital signature is verified; the verifier parses calculates r'≡g s y -e (mod p), calculates e' = H(r', m), and verifies whether e' = e is true; if the verification algorithm is true, it proves that the full signature is valid.

[0095] The technical scheme provided by the embodiment improves the accuracy of full signature verification and improves the security of the adapter signature method.

[0096] Figure 7 A flowchart of step S7 is provided for an embodiment of the application. In combination with the above embodiment, the technical scheme is further described and optimized in the embodiment, specifically, in the embodiment, step S7 includes: Figure 7

[0097] S710, the pre-signature is parsed according to the public key pk to obtain the digital signature Instance Y1, commitment c1, and initial opening d0.

[0098] S720, the full signature σ is parsed according to the public key pk to obtain the digital signature Instance Y2, commitment c2, and opening d.

[0099] S730, the digital signature is verified whether the digital signature is the same, whether instance Y1 and instance Y2 are the same, and whether commitment c1 and commitment c2 are the same.

[0100] S740, if the verification passes, the trapdoor commitment extraction algorithm is used to extract the witness y from the full signature according to the shared public parameter and a third calculation formula, and the third calculation formula is

[0101] In a specific implementation, the pre-signature is parsed according to the public key pk to obtain the structure containing the digital signature Instance Y1, commitment c1, and initial opening d0, and the full signature σ is parsed as the structure containing the digital signature Instance Y2, commitment c2, and opening d; the digital signatures in the pre-signature and the full signature are checked ​​​​whether the instance Y1 is same as the instance Y2, and whether the commitment c1 is same as the commitment c2; if the instance or the commitment is not matched, an error or a failure flag is returned; if the instance and the commitment are verified, the witness y is calculated by a third calculation formula

[0102] The technical scheme provided by the embodiment guarantees the concealment of the witness, and improves the security of the adaptor signature method.

[0103] Figure 8 A structural block diagram of an adaptor signature device provided by an embodiment of the present application is shown in the figure. For the convenience of description, only the parts related to the embodiments of the present application are shown. Referring to Figure 8 , the adaptor signature device 800 can include a system parameter generation module 801, a key generation module 802, a pre-signature generation module 803, a pre-signature verification module 804, a full signature generation module 805, a full signature verification module 806, and a witness extraction module 807.

[0104] The system parameter generation module 801 is configured to determine and disclose shared common parameters required by a signer and a verifier based on preset security parameters. The shared common parameters include a prime number p and a prime number q, a generator g, a hash function H, a specific message m0, and an arbitrary message m. The p and q satisfy the relationship q|(p-1), the g is a generator in , and g q ≡1(mod p),

[0105] The key generation module 802 is configured to generate a key pair including a public key pk and a private key sk for the signer based on the shared common parameters, and determine an instance Y and a witness y associated with the NP relationship for the verifier, and disclose the instance Y.

[0106] The pre-signature generation module 803 is configured to generate a pre-signature

[0107] The pre-signature verification module 804 is configured to verify the validity of the pre-signature by the verifier according to the shared common parameters, the public key pk, and the instance Y.

[0108] The full signature generation module 805 is configured to generate a full signature σ about the arbitrary message m by the verifier according to the shared common parameters, the public key pk, the pre-signature , and the witness y.

[0109] The full signature verification module 806 is configured to verify, by the verifier, validity of the full signature σ according to the shared common parameter and the public key pk.

[0110] The witness extraction module 807 is configured to extract, by the signer, the witness y from the pre-signature and the full signature σ according to the shared common parameter, the witness y being used to implement the adaptor signature.

[0111] It should be noted that the information interaction and execution process between the above apparatuses / units are based on the same concept as the method embodiments of the present application, and the specific functions and technical effects brought by the above apparatuses / units can be referred to the method embodiments part, which will not be repeated here.

[0112] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of functional units and modules is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the apparatus is divided into different functional units or modules to complete all or part of the above-described functions. The functional units and modules in the embodiments can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or software. In addition, the specific names of the functional units and modules are only for easy distinction, and do not limit the protection scope of the present application. The specific working process of the units and modules in the system can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0113] Figure 9 The structural schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 9. As shown in the figure, the electronic device 9 of this embodiment includes at least one processor 90 (only one is shown in the figure), a memory 91, and a computer program 92 stored in the memory 91 and executable on the at least one processor 90. When the processor 90 executes the computer program 92, the steps in any of the foregoing method embodiments are implemented, or the functions of the modules / units in the foregoing apparatus embodiment are implemented. Figure 9 Figure 9 Figures 1 to 7 Figure 8

[0114] The electronic device 9 can be a desktop computer, a notebook computer, a palm computer, a cloud server, and the like. The electronic device 9 can include but is not limited to the processor 90 and the memory 91. Those skilled in the art can understand that the electronic device 9 can further include other components, which will not be described herein. Figure 9 ​​​​The electronic device 9 is merely an example and does not limit the electronic device 9, which can include more or fewer components than shown, or combine some components, or have different components, such as an input / output device, a network access device, and the like.

[0115] The processor 90 can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, and the like. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0116] The memory 91 can be an internal storage unit of the electronic device 9, such as a hard disk or a memory of the electronic device 9 in some embodiments. The memory 91 can also be an external storage device of the electronic device 9, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, and the like in other embodiments. Further, the memory 91 can include both an internal storage unit and an external storage device of the electronic device 9. The memory 91 is used to store an operating system, an application program, a boot loader, data, and other programs, such as program codes of a computer program, and the like. The memory 91 can also be used to temporarily store data that has been output or will be output.

[0117] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the steps in the above-mentioned various method embodiments.

[0118] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, all or part of the processes in the above-mentioned embodiment methods can be instructed by a computer program to relevant hardware for completion, and the computer program can be stored in a computer readable storage medium. The computer program can be executed by a processor to implement the steps of each method embodiment. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer readable medium at least includes any entity or device capable of carrying the computer program code to an electronic device, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium. For example, U disk, mobile hard disk, magnetic disk or optical disk, etc.

[0119] The computer readable storage medium provided by the embodiment of the present application has the same beneficial effects as the above-mentioned adapter signature method.

[0120] The computer program product provided by the embodiment of the present application includes a computer program, and the computer program can implement the steps in each method embodiment when executed by a processor.

[0121] The computer program product provided by the embodiment of the present application has the same beneficial effects as the above-mentioned adapter signature method.

[0122] In the above embodiments, the description of each embodiment has its own focus, and the parts not described or recorded in a certain embodiment can be referred to the relevant description of other embodiments.

[0123] Those skilled in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0124] In the embodiments of the present application, it should be understood that the disclosed apparatus / electronic device and method can be implemented in other manners. For example, the embodiments of the apparatus / electronic device described above are merely schematic; for example, the division of the modules or units is merely logical function division; an actual mapping of physical boundaries can be different, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between different units, or among them, can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0125] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0126] The above embodiments are merely used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalent ones; and these modifications or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. An adapter signing method, characterized by, The method comprises: Step S1, based on preset security parameters, determine and disclose the shared public parameters required by the signer and the verifier, the shared public parameters including prime number p and prime number q, generator g, hash function H, specific message m0 and arbitrary message m; p and q satisfy the relationship q|(p-1), g is the generator in q , and g In step S2, a key pair is generated for the signer based on the shared common parameter, the key pair comprising a public key pk and a private key sk; an instance Y associated with the NP relation and a witness y are determined for the verifier, and the instance Y is disclosed; Step S3, the signer generates a pre-signature on the specific message m0 according to the shared public parameter, the private key sk and the instance Y Step S4, the verifier verifies the validity of the pre-signature according to the shared common parameter, the public key pk and the instance Y. ; Step S5, the verifier generates a full signature σ on the arbitrary message m according to the shared common parameter, the public key pk, the pre-signature and the witness y. In step S6, the verifier verifies the validity of the full signature σ according to the shared common parameter and the public key pk; Step S7, the signer extracts the witness y from the pre-signature and the full signature σ according to the shared public parameter, the witness y being used to implement the adaptor signature; The step S3 comprises: A trapdoor commitment algorithm is used to perform a commitment operation on the instance Y and the specific message m0 according to the shared common parameter, to generate a commitment c and an initial opening d0; using a signature algorithm, based on the shared public parameter, the private key sk, the instance Y, and the commitment c, to generate a digital signature based on the digital signature the instance Y, the commitment c, and the initial opening d0, generate the pre-signature The step S5 comprises: parsing the pre-signature according to the public key pk obtaining the digital signature the instance Y, the commitment c, and the initial opening d0 A trapdoor opening algorithm is used to convert the initial opening d0 into an opening d associated with the arbitrary message m according to the shared common parameter and the witness y; based on the digital signature the instance Y, the commitment c, and the opening d, generating the full signature σ; The step S7 comprises: parsing the pre-signature according to the public key pk obtaining a digital signature instance Y1, commitment c1, and initial opening d0 The full signature σ is parsed according to the public key pk to obtain a digital signature Example Y2, commitment c2, and opening d; verifying the digital signature with the digital signature whether the instance Y1 and the instance Y2 are identical, and whether the commitment c1 and the commitment c2 are identical; If the verification passes, the trapdoor commitment extraction algorithm is used to extract the witness y from the full signature σ according to the shared public parameter and a third computation formula, which is 2. The method of claim 1, wherein, The step S2 comprises: The signer randomly selects the private key sk based on the shared common parameter, the private key sk being greater than 1 and less than the prime number q; Based on the private key sk and the shared public parameter, the public key pk is determined by using a first calculation formula, and the first calculation formula is pk = g sk (mod p); the verifier randomly selects the witness y based on the shared common parameter, and Based on the witness y and the shared common parameter, the instance Y is determined using a second calculation formula, Y = g y (mod p).

3. The method of claim 1, wherein, The step S4 comprises: parsing the pre-signature according to the public key pk obtaining the digital signature the instance Y, the commitment c, and the initial opening d0 A trapdoor commitment verification algorithm is used to verify whether the commitment c corresponds to the instance Y, the specific message m0 and the initial opening d0 according to the shared common parameter; In case the commitment c is verified, a signature verification algorithm is employed to verify the digital signature according to the shared public parameter In the case where the digital signature is valid, it is determined that the pre-signature is valid.

4. The method of claim 1, wherein, The step S6 comprises: parsing the full signature σ according to the public key pk, to obtain the digital signature the instance Y, the commitment c, and the opening d A trapdoor commitment verification algorithm is used to verify whether the commitment c corresponds to the instance Y, the arbitrary message m and the opening d according to the shared common parameter; In case the commitment c is verified, a signature verification algorithm is employed to verify the digital signature according to the shared public parameter In the digital signature In case of verification pass, it is determined that the full signature σ is valid.

5. An adapter signing device, characterized by The device comprises: The system parameter generation module is configured to determine and disclose shared public parameters required by the signer and the verifier based on preset security parameters, wherein the shared public parameters include a prime number p and a prime number q, a generator g, a hash function H, a specific message m0, and an arbitrary message m; p and q satisfy a relationship q|(p-1), g is a generator in , and g q ≡1(mod p), A key generation module is configured to generate a key pair for the signer based on the shared common parameter, the key pair comprising a public key pk and a private key sk; determine an instance Y associated with the NP relation and a witness y for the verifier, and disclose the instance Y; a pre-signature generation module configured to generate, by the signer, a pre-signature about the specific message m0 according to the shared public parameter, the private key sk and the instance Y The pre-signature verification module is used by the verifier to verify the pre-signature based on the shared public parameters, the public key pk, and the instance Y. Validity; a full signature generation module configured to generate, by the verifier, a full signature σ on the arbitrary message m according to the shared common parameter, the public key pk, the pre-signature and the witness y. A full signature verification module is configured to verify the validity of the full signature σ by the verifier according to the shared common parameter and the public key pk; a witness extraction module for extracting, from the pre-signature and the full signature s, a witness y for implementing the adaptor signature by the signer according to the shared public parameter.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the method according to any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, wherein the computer program comprises the following steps of: The computer program is executed by the processor to implement the method according to any one of claims 1 to 4.

Images