Threshold ring signature method and system based on SM2 digital signature algorithm

Abstract

The invention belongs to but is not limited to the technical field of digital signature, and particularly relates to a threshold ring signature method and system based on an SM2 digital signature algorithm, a threshold ring signature is generated through multi-party cooperation, and the security of the system can be effectively improved. On the basis of the SM2, the signature efficiency is effectively improved while the security is ensured, and the core password technology is autonomously controllable. The problems that an existing threshold ring signature scheme is low in efficiency and depends on foreign cryptographic algorithms are solved. Besides, the secret key generation part is completed by cooperation of the third-party mechanism and the user without completely depending on the third-party mechanism, the problem of secret key leakage caused by the fact that the third-party mechanism is not credible or is subjected to hostile attack can be effectively avoided, and the safety is higher.

Description

Technical Field

[0001] The present invention belongs to but is not limited to the field of digital signature technology, and in particular relates to a threshold ring signature method and system based on an SM2 digital signature algorithm. Background Art

[0002] With the continuous development of information security technology, digital signatures need to meet new functional requirements to adapt to various application scenarios. For example, the identity of the real signer needs to be hidden in scenarios such as electronic voting and electronic cash. Ring signature is a special digital signature proposed by Rivest et al. in 2001. It allows any member of a group of users to sign on behalf of the entire group without revealing which member generated the signature, thus realizing the anonymity protection of the signer's identity. Threshold ring signature adds threshold characteristics to ring signature, allowing some members of a group of users to jointly generate a signature, ensuring the anonymity of the signer's identity while providing flexibility and robustness of the signing process. In 2012, Xiao et al. proposed a threshold ring signature scheme for wireless sensor networks based on bilinear pairings. The scheme has robustness and multi-signature functions. In the signature, all messages can be signed at one time, and it can meet the requirements of distributed parallel computing. However, the scheme needs to rely on a trusted third-party organization when generating keys. In 2022, Deng et al. proposed a threshold ring signature scheme based on the national secret SM9 algorithm. This scheme uses the SM4 algorithm to symmetric encrypt the threshold ring signature and embeds a time-sensitive timestamp in the ciphertext, effectively improving the security of the signature. However, the SM9 digital signature algorithm on which the scheme is based requires time-consuming dual-line pair operations, and the scheme is not efficient.

[0003] The SM2 digital signature algorithm is a cryptographic algorithm independently issued by the China National Cryptography Administration. It is based on elliptic curve cryptography, uses domestic elliptic curve parameters and a series of security mechanisms, and is efficient, secure, and self-controllable. It has now become China's national cryptographic standard and is widely used in various fields. However, there is no solution to apply the SM2 digital signature algorithm to threshold ring signature technology.

[0004] In the existing threshold ring signature scheme, the key generation is completed by a third party according to the corresponding key generation rules, and the key security depends on the honesty and trustworthiness of the third party. When generating a threshold ring signature based on bilinear pairings, the generation and verification of the signature needs to be realized through bilinear pairing operations. Since bilinear pairing operations are time-consuming, the efficiency of the scheme is low.

[0005] In view of the above analysis, the technical problems that urgently need to be solved in the existing technology are: the existing technology mostly needs to rely on a third party organization when generating keys, and most of them are based on bilinear pairings. Since bilinear pairing operations are time-consuming, the efficiency of the existing technology is low. Summary of the invention

[0006] In view of the problems existing in the prior art, the present invention provides a threshold ring signature method and system based on the SM2 digital signature algorithm.

[0007] The present invention is implemented as follows: a threshold ring signature method based on the SM2 digital signature algorithm, comprising:

[0008] S1. System initialization;

[0009] S2. Key generation;

[0010] S3. Signature;

[0011] S4. Verify the signature.

[0012] Further, S1 specifically includes: the management center obtains the size of n, the size of the threshold value t, t<n, inputs the security parameter λ, randomly and secretly selects a large prime number p, and sets F p is a finite field, in F p Define an elliptic curve E(F p ):y 2 =x 3 +ax+b, where a,b∈F p , (x, y) is a point on the elliptic curve and satisfies 4a 3 +27b 2 ≠0, It is E(F p ) is an additive cyclic group consisting of the points on it, q is its order, G is the group base point. is a hash function selected from the SM3 cryptographic hash algorithm, where {0,1} * Represents a set of binary strings, Finally, output the system parameters Assume that each user's identity is ID i , i∈[1,n], let L={1,2,...,n} represent the user identity index in the ring, W={1,...,t} represent the user identity index participating in the threshold ring signature, It is the identity index of the user who does not participate in the threshold ring signature.

[0013] Further, S2 specifically includes: the user in the ring sends his identity information ID i ,i∈[1,n] is sent to the management center, which calculates Z i =H1 (ID i ), and then send Z i Secret sent to user ID i Next, the user ID i Random Selection Generate private key sk i =H 2 (d i ·Z i ), calculate and publish the public key pk i =sk i ·G.

[0014] Further, S3 specifically includes: assuming that the message to be signed is M, the threshold value is t, and the public key set V of the users in the ring is V={pk 1 ,......,pk n}. The signing steps are as follows:

[0015] (1) User i∈W participating in the signature is randomly selected Calculate (x i ,y i ) = k i G;

[0016] (2) For Random Selection And calculate (x i ,y i )=s i ·G+(r i +s i )·pk i ;

[0017] (3) Calculation

[0018] (4) For Construct a polynomial f of degree nt, and transform r 0 As the secret to be shared, that is, f(0) = r 0 , and f(i)=r i , f is of the form f(x)=r 0 +r 1 ·x+.....+r i ·x n-t ;

[0019] (5) Each user i∈W participating in the signature calculates r i =f(i), and calculate s i =((1+sk i ) -1 ·(k i -r i ·ski ))modq;

[0020] (6) Output threshold ring signature δ = (s 1 ,...s n ,f).

[0021] Further, S4 specifically includes: after receiving the threshold ring signature δ, the verifier performs verification according to the following steps:

[0022] (1) Check whether the polynomial f is an nt-order polynomial. If not, the verification fails.

[0023] (2) Inspection i '、 Is it true? If not, the verification fails.

[0024] (3) Calculate t i =(f′(i)+s i ′)modq, where i∈[1,n], if t i =0, the verification fails;

[0025] (4) Calculate (x i ′,y i ′)=s i ′·G+t i ·pk i , i∈[1,n];

[0026] (5) Calculation Check whether R=f′(0) holds. If so, the verification succeeds; otherwise, the verification fails.

[0027] Another object of the present invention is to provide a threshold ring signature system based on the SM2 digital signature algorithm for implementing the threshold ring signature method based on the SM2 digital signature algorithm, comprising:

[0028] System initialization module, used for system initialization;

[0029] A key generation module, used for generating keys;

[0030] Signature module, used for signature operation;

[0031] Signature verification module, used to verify the signature.

[0032] Another object of the present invention is to provide a computer device, the computer device comprising a memory and a processor, the memory storing a computer program, and when the computer program is executed by the processor, the processor executes the steps of the threshold ring signature method based on the SM2 digital signature algorithm.

[0033] Another object of the present invention is to provide a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of the threshold ring signature method based on the SM2 digital signature algorithm.

[0034] Another object of the present invention is to provide an information data processing terminal, which includes the threshold ring signature system based on the SM2 digital signature algorithm.

[0035] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0036] First, when generating a key, the third party first hashes the user's identity information, and then sends the hash value to the user. After receiving the hash value, the user selects a random number and performs a point multiplication operation with the hash value, and then hashes it again. The hashed result is the private key, and then the corresponding public key is generated according to the key generation rule in the SM2 digital signature algorithm. The generation of the key in this process requires the third party and the user to work together, without having to rely entirely on the third party, which effectively avoids the key leakage problem caused by the dishonesty of the third party or malicious attacks, and improves security.

[0037] The present invention is based on the SM2 digital signature algorithm. In the signature generation and verification process, only elliptic curve point multiplication, elliptic curve point addition and hash operations need to be performed. Compared with the existing scheme that requires a relatively time-consuming bilinear pairing operation, the efficiency of the scheme is greatly improved and has better practical application value. In addition, the SM2 digital signature algorithm is independently promulgated by the China National Cryptography Administration, which can realize the independent control of the core cryptographic algorithm.

[0038] Most of the prior art needs to rely on a third party organization when generating keys, while this scheme is completed by a third party organization and a user in collaboration when generating keys, which can effectively avoid the key leakage problem caused by the dishonesty of the third party organization or when it is attacked maliciously, thereby improving security. In addition, most of the prior art is based on bilinear pairings, and since the bilinear pairing operation is time-consuming, the efficiency of the prior art is relatively low. The SM2 digital signature algorithm adopted by the present invention is based on elliptic curve cryptography, and does not require time-consuming bilinear pairing operations during the implementation of the scheme. Under the premise of ensuring security, the efficiency of the scheme is greatly improved. At the same time, the use of the SM2 digital signature algorithm meets the requirements of independent and controllable core cryptographic technology in my country, and promotes the application of national secret algorithms.

[0039] 1. In the present invention, the key generation is completed by a third party organization and the user in collaboration, which can effectively avoid the key leakage problem caused by the dishonesty of the third party organization or malicious attacks, thereby improving security.

[0040] 2. The present invention is based on the SM2 digital signature algorithm, and the overall efficiency of the solution is higher and has better practicality.

[0041] 3. The present invention is based on the SM2 digital signature algorithm, and the core cryptographic algorithm is autonomous and controllable.

[0042] Second, as auxiliary evidence of the inventiveness of the claims of the present invention, it is also reflected in the following important aspects:

[0043] (1) The expected benefits and commercial value of the technical solution of the present invention after transformation are:

[0044] The technical solution of the present invention has broad application prospects in privacy protection, collaborative work, decentralization, etc., such as electronic voting systems, blockchain and cryptocurrency, decentralized identity authentication and other application scenarios.

[0045] (2) The technical solution of the present invention solves a technical problem that people have been eager to solve but have never been able to solve successfully: the present invention combines the SM2 digital signature algorithm with the threshold ring signature, which not only improves the efficiency of the solution, but also expands the application of the national secret algorithm, and realizes the requirement of autonomous control of the core cryptographic algorithm in cryptographic technology. The key generation requires the joint participation of users and third-party institutions, which overcomes the problem that the key generation in the existing scheme must rely on a trusted third-party institution, and can effectively avoid the key leakage problem caused by the dishonesty of the third-party institution or malicious attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flow chart of a threshold ring signature method based on the SM2 digital signature algorithm provided by an embodiment of the present invention;

[0047] Figure 2 It is a structural diagram of a threshold ring signature system based on the SM2 digital signature algorithm provided by an embodiment of the present invention;

[0048] Figure 3 It is a relationship diagram between the number of signers and the signature overhead of the threshold ring signature method based on the SM2 digital signature algorithm provided in an embodiment of the present invention;

[0049] Figure 4 It is a relationship diagram between the number of signers and the verification overhead of the threshold ring signature method based on the SM2 digital signature algorithm provided by an embodiment of the present invention;

[0050] Figure 5 It is a relationship diagram between the number of users in the ring and the signature overhead of the threshold ring signature method based on the SM2 digital signature algorithm provided by an embodiment of the present invention;

[0051] Figure 6This is a relationship diagram between the number of users in the ring and the verification overhead of the threshold ring signature method based on the SM2 digital signature algorithm provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0053] like Figure 1 As shown, the threshold ring signature method based on the SM2 digital signature algorithm provided in the embodiment of the present invention includes:

[0054] S1. System initialization;

[0055] S2. Key generation;

[0056] S3. Signature;

[0057] S4. Verify the signature.

[0058] like Figure 2 As shown, the threshold ring signature system based on the SM2 digital signature algorithm provided by the embodiment of the present invention includes:

[0059] System initialization module, used for system initialization;

[0060] A key generation module, used for generating keys;

[0061] Signature module, used for signature operation;

[0062] Signature verification module, used to verify the signature.

[0063] 1. System initialization algorithm

[0064] The management center obtains the size of n, the size of the threshold value t, t<n, inputs the security parameter λ, randomly and secretly selects a large prime number p, and sets F p is a finite field, in F p Define an elliptic curve E(F p ):y 2 =x 3 +ax+b, where a,b∈F p , (x, y) is a point on the elliptic curve and satisfies 4a 3 +27b 2 ≠0, It is E(F p ) is an additive cyclic group consisting of the points on it, q is its order, G is the group base point. is a hash function selected from the SM3 cryptographic hash algorithm, where {0,1} * Represents a set of binary strings, Finally, output the system parameters Assume that each user's identity is ID i , i∈[1,n], let L={1,2,...,n} represent the user identity index in the ring, W={1,...,t} represent the user identity index participating in the threshold ring signature, It is the identity index of the user who does not participate in the threshold ring signature.

[0065] 2. Key Generation Algorithm

[0066] The user in the ring will give his / her identity information ID i ,i∈[1,n] is sent to the management center, which calculates Z i =H 1 (ID i ), and then send Z i Secret sent to user ID i Next, the user ID i Random Selection Generate private key sk i =H 2 (d i ·Z i ), calculate and publish the public key pk i =sk i ·G.

[0067] 3. Signature Algorithm

[0068] Assume that the message to be signed is M, the threshold value is t, and the public key set of users in the ring is V = {pk 1 ,......,pk n}. The signing steps are as follows:

[0069] (1) User i∈W participating in the signature is randomly selected Calculate (x i ,y i ) = k i G;

[0070] (2) For Random Selection And calculate (x i ,y i )=s i ·G+(r i +s i )·pk i ;

[0071] (3) Calculation

[0072] (4) For Construct a polynomial f of degree nt, and transform r 0 As the secret to be shared, that is, f(0) = r 0 , and f(i)=r i , f is of the form f(x)=r 0 +r 1 ·x+.....+r i ·x n-t ;

[0073] (5) Each user i∈W participating in the signature calculates r i =f(i), and calculate s i =((1+sk i ) -1 ·(k i -r i ·sk i ))modq;

[0074] (6) Output threshold ring signature δ = (s 1 ,...s n ,f).

[0075] 4. Verification Algorithm

[0076] After receiving the threshold ring signature δ, the verifier performs verification according to the following steps:

[0077] (1) Check whether the polynomial f is an nt-order polynomial. If not, the verification fails.

[0078] (2) Inspection Is it true? If not, the verification fails.

[0079] (3) Calculate t i =(f′(i)+s i ′)modq, where i∈[1,n], if t i =0, the verification fails;

[0080] (4) Calculate (x i ′,y i ′)=s i ′·G+t i ·pk i , i∈[1,n];

[0081] (5) Calculation Check whether R=f′(0) holds. If so, the verification succeeds; otherwise, the verification fails.

[0082] An application embodiment of the present invention provides a computer device, which includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor executes the steps of a threshold ring signature method based on an SM2 digital signature algorithm.

[0083] An application embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of a threshold ring signature method based on an SM2 digital signature algorithm.

[0084] An application embodiment of the present invention provides an information data processing terminal, which includes a threshold ring signature system based on an SM2 digital signature algorithm.

[0085] The specific application field or related products of the invention.

[0086] The threshold ring signature scheme based on the SM2 digital signature algorithm proposed in the present invention is suitable for the electronic voting system. The threshold ring signature technology can ensure the authenticity and validity of the voting results and the anonymity of the voter's identity during the electronic voting process. The use of the SM2 digital signature algorithm not only expands the application of the national secret algorithm in the field of electronic voting, but also greatly improves the efficiency of the scheme, and has higher practical application value. The present invention involves three entities in the implementation process of electronic voting, namely the voting management center, the voter, and the counting center. The specific implementation process is as follows:

[0087] (1) Registration stage

[0088] The voting management center first generates system parameters according to the system initialization algorithm and publishes them, and then voters register to obtain voting qualifications. Voters send their identity information to the voting management center for review. After the review is passed, the registration is completed, and then the voting management center and the voter jointly generate the corresponding public and private keys according to the key generation algorithm;

[0089] (2) Voting stage

[0090] After the voter fills in the ballot result, a threshold ring signature is generated according to the signature algorithm, and then the voting result and signature are sent to the counting center through a secure channel;

[0091] (3) Counting stage

[0092] After receiving the voting results and signatures, the counting center first verifies the threshold ring signature through a verification algorithm to ensure that the voting results have not been tampered with. If the verification fails, it will refuse to accept it; if the verification passes, the voting results will be counted and announced.

[0093] Relevant evidence of the technical effects achieved by the embodiments of the present invention.

[0094] The present invention is compared with references [1-3] in terms of computational overhead. The operations involved are mainly elliptic curve point multiplication operations T p , Elliptic curve point addition operation T a , hash operation T h , Operation T of mapping bit string to elliptic curve point hp and bilinear pairing operation T b ,The time required for other operations accounts for a very small proportion of the overall operation time, so it can be ignored. In order to make a more intuitive comparison, we conducted experiments on a computer with an AMD R7-7840H & 3.8GHz CPU, 32.00GB memory, 2TB hard disk and Windows 10 Professional operating system, and tested the single operation time of related operations by calling the GO language CRYPTO standard library, as shown in Table 1.

[0095] Table 1 Single operation time of related operations

[0096]

[0097] In Table 2, n is the number of ring members, and t is the threshold value. According to the analysis of Table 2, the present invention only requires 2n-t elliptic curve point multiplication operations, nt elliptic curve point addition operations, and 1 hash operation in the signature generation algorithm, which is more efficient than references [1-3]. The present invention requires 2n elliptic curve point multiplication operations, n elliptic curve point addition operations, and 1 hash operation in the signature verification algorithm, which greatly improves the efficiency compared with references [1-3]. Since the efficiency of signature generation and signature verification is affected by n and t, a comparative experiment with n and t being changed respectively was conducted while keeping the experimental environment unchanged. The experimental results are as follows: Figures 3 to 6 shown.

[0098] Table 2 Analysis of computational overhead of different solutions

[0099]

[0100] Figure 3 and Figure 4 The results show that when n remains unchanged, the signature overhead of the present invention is negatively correlated with t, and the verification overhead is not affected by t. The computational overhead of signature generation and signature verification in the present invention is lower than that in references [1-3]. Figure 5 and Figure 6 The results show that when t remains unchanged, the signature generation and signature verification overheads of the present invention are positively correlated with n, and when n is any value, the computational overhead is less than that of the literature [1-3]. In summary, the present invention has obvious advantages in the efficiency of signature generation and signature verification stages and has high practical value.

[0101] Among them, literature [1] Zheng Jian, Lai Hengcai. Blockchain electronic voting scheme based on one-time ring signature [J]. Computer Application Research, 2020, 37(11): 3378-3391; literature [2] WANG L, PENG C, TAN W. Secure RingSignature Scheme for Privacy-Preserving Blockchain [J]. Entropy, 2023, 25(9): 1334; literature [3] LIN TC, YEH TY, HWANG M S. Cryptanalysis of an ID-based DeniableThreshold Ring Authentication [J]. Int. J. Netw. Secur, 2019, 21(2): 298-302;

[0102] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0103] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A threshold ring signature method based on SM2 digital signature algorithm, characterized in that: include: S1. System initialization; S2. Key generation; S3. Signature; S4. Verify the signature.

2. The threshold ring signature method based on the SM2 digital signature algorithm as claimed in claim 1, characterized in that: S1 specifically includes: the management center obtains the size of n, the size of the threshold value t, t<n, inputs the security parameter λ, randomly and secretly selects a large prime number p, and sets F p is a finite field, in F p Define an elliptic curve E(F p ):y 2 =x 3 +ax+b, where a,b∈F p , (x, y) is a point on the elliptic curve and satisfies 4a 3 +27b 2 ≠0, It is E(F p ) is an additive cyclic group consisting of the points on it, q is its order, G is the group base point. is a hash function selected from the SM3 cryptographic hash algorithm, where {0,1} * Represents a set of binary strings, Finally, output the system parameters Assume that each user's identity is ID i , i∈[1,n], let L={1,2,...,n} represent the user identity index in the ring, W={1,...,t} represent the user identity index participating in the threshold ring signature, It is the identity index of the user who does not participate in the threshold ring signature.

3. The threshold ring signature method based on the SM2 digital signature algorithm as claimed in claim 1, characterized in that: S2 specifically includes: the user in the ring sends his identity information ID i ,i∈[1,n] is sent to the management center, which calculates Z i =H1(ID i ), and then send Z i Secret sent to user ID i Next, the user ID i Random Selection Generate private key sk i =H2(d i ·Z i ), calculate and publish the public key pk i =sk i ·G.

4. The threshold ring signature method based on the SM2 digital signature algorithm as claimed in claim 1, characterized in that: S3 specifically includes: assuming that the message to be signed is M, the threshold value is t, and the public key set of users in the ring is V = {pk1,...,pk n }, the signing steps are as follows: (1) User i∈W participating in the signature is randomly selected Calculate (x i ,y i ) = k i G; (2) For Random Selection And calculate (x i ,y i )=s i ·G+(r i +s i )·pk i ; (3) Calculation (4) For Construct a polynomial f of degree nt and use r0 as the secret to be shared, that is, f(0) = r0 and f(i) = r i , f is in the form of f(x)=r0+r1·x+.....+r i ·x n-t ; (5) Each user i∈W participating in the signature calculates r i =f(i), and calculate s i =((1+sk i ) -1 ·(k i -r i ·sk i ))modq; (6) Output threshold ring signature δ = (s1, ...s n ,f).

5. The threshold ring signature method based on the SM2 digital signature algorithm as claimed in claim 1, characterized in that: S4 specifically includes: after receiving the threshold ring signature δ, the verifier performs verification according to the following steps: (1) Check whether the polynomial f is an nt-order polynomial. If not, the verification fails. (2) Inspection i '、 Is it true? If not, the verification fails. (3) Calculate t i =(f′(i)+s i ′)modq, where i∈[1,n], if t i =0, the verification fails; (4) Calculate (x i ′,y i ′)=s i ′·G+t i ·pk i , i∈[1,n]; (5) Calculation Check whether R=f′(0) holds. If so, the verification succeeds; otherwise, the verification fails.

6. A threshold ring signature system based on the SM2 digital signature algorithm for implementing the threshold ring signature method based on the SM2 digital signature algorithm as claimed in any one of claims 1 to 5, characterized in that: include: System initialization module, used for system initialization; A key generation module, used for generating keys; Signature module, used for signature operation; Signature verification module, used to verify the signature.

7. A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the threshold ring signature method based on the SM2 digital signature algorithm as described in any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to execute the steps of the threshold ring signature method based on the SM2 digital signature algorithm as described in any one of claims 1 to 5.

9. An information data processing terminal, comprising the threshold ring signature system based on the SM2 digital signature algorithm as claimed in claim 6.

Images