On-lattice threshold signcryption method capable of realizing equivalent detection function

Abstract

According to the on-lattice threshold signcryption method capable of achieving the equivalent detection function, an improved threshold signcryption algorithm is adopted in the method to generate a final ciphertext, and the algorithm improves the overall efficiency by optimizing calculation steps and reducing the number of needed participants while maintaining the existing safety standard; the algorithm also ensures that the calculation complexity is not obviously increased when equivalent detection is introduced in the signature process; besides, the algorithm provided by the invention adopts an efficient signature generation and verification mechanism, can quickly generate and verify the signature under the condition of minimizing communication and computing resource consumption, and particularly shows an obvious time advantage in a multi-participant threshold environment; and an equivalent detection attribute is introduced into a traditional threshold signcryption scheme, and the attribute allows whether different ciphertexts have equivalence or not to be effectively detected in the signature verification process, so that the safety and the flexibility of the system are improved.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a threshold signcryption method on a grid capable of realizing an equal value detection function. Background Art

[0002] Signcryption is a technology that performs data encryption and digital signature at the same time. It combines the traditional encryption and digital signature step-by-step methods. Specifically, signcryption can combine digital signatures and encryption algorithms in one operation to achieve multiple security measures such as data encryption, authentication, integrity verification, and non-repudiation. Compared with the traditional encryption and signature step-by-step, the advantage of signcryption is that it can reduce the total amount of calculation and communication costs, while ensuring the integrity and security of the algorithm and preventing information leakage and tampering.

[0003] Early threshold signcryption schemes were based on bilinear pairings and were inefficient. Based on the formatted security proof of the threshold signcryption scheme, Li et al. proposed an identity-based threshold signcryption scheme. Under the random oracle model, it was proved that it meets the confidentiality and existence requirements and cannot be forged. Moreover, the scheme does not require the storage of public key dictionaries and the processing of public key certificates, which reduces storage overhead. In addition, Zheng et al. proposed an attribute-based threshold signcryption scheme, and verified its security using the DBDH and CBDH difficulty assumptions under the standard model. The certificateless threshold signcryption scheme proposed by Yu and Wang not only solves the key escrow and certificate management problems, but also has high flexibility and scalability. In this scheme, the signer can generate the key by himself and split it into multiple shares, and then distribute the shares to multiple trusted parties. These trusted parties can jointly complete the signcryption and decryption operations without mutual trust. Compared with the traditional certificate signature scheme, the certificateless threshold signcryption scheme proposed by Yu and Wang has higher efficiency and stronger security. However, none of the above schemes can resist quantum computing attacks.

[0004] Most of the threshold schemes proposed so far have the following disadvantages:

[0005] (1) Time-consuming: Existing solutions may involve cumbersome steps and multiple communications during signature generation and verification, resulting in a long process. This is a significant disadvantage for application scenarios that require rapid response;

[0006] (2) Insufficient security: Some existing technologies may not provide adequate security in certain attack scenarios, especially when facing advanced cryptanalysis and attacks;

[0007] (3) Poor flexibility: Existing solutions may not be flexible enough to adapt to different application scenarios or user needs, and cannot meet the changing needs in specific situations, such as insufficient demand for equal value detection. Summary of the invention

[0008] In order to solve the above problems existing in the prior art, the present invention provides a threshold signcryption method on a grid that can realize the equal value detection function. The technical problem to be solved by the present invention is achieved by the following technical solutions:

[0009] A threshold signcryption method on a grid that can realize an equal value detection function includes:

[0010] Step 1: Input security parameters and run the initialization algorithm to output a set of public parameters;

[0011] Step 2, each user terminal inputs the public parameter set and generates its own public and private key pair using a key generation algorithm; the user terminal includes a message sender and a message receiver;

[0012] Step 3: Each client generates its own secret sharing value using a sharing algorithm based on its own public and private keys and the secret sharing values ​​of other clients.

[0013] Step 4: The message sender uses the threshold signcryption algorithm and its own secret shared value to calculate the final ciphertext of the message to be sent, and sends it to the message receiver;

[0014] Step 5: The message receiver verifies whether the final ciphertext is valid using a decryption algorithm, and decrypts the message value from the valid final ciphertext;

[0015] Step 6: The message receiver uses its own tag to perform an equivalence test on the received final ciphertext.

[0016] Beneficial effects:

[0017] 1. This invention proposes a threshold signcryption method on a lattice that can realize the equal value detection function. In this method, an improved threshold signcryption algorithm is used to generate the final ciphertext. While maintaining the existing security standards, the algorithm improves the overall efficiency by optimizing the calculation steps and reducing the number of participants required. In addition, the algorithm also ensures that when the equal value detection is introduced in the signature process, the computational complexity will not be significantly increased;

[0018] 2. The present invention designs a decryption algorithm, which adopts an efficient signature generation and verification mechanism, and can quickly generate and verify signatures while minimizing communication and computing resource consumption, especially in a threshold environment with multiple participants, showing obvious time advantages.

[0019] 3. The present invention introduces an equivalence detection property into the traditional threshold signcryption scheme. This property allows the effective detection of whether different ciphertexts are equivalent during the signature verification process, thereby improving the security and flexibility of the system.

[0020] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a flow chart of a threshold signcryption method on a grid that can realize an equal value detection function provided by the present invention. DETAILED DESCRIPTION

[0022] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0023] The purpose of the present invention is to address the deficiencies of the above-mentioned prior art and propose a threshold signcryption method that can realize the equal value detection function, which can improve the overall efficiency of encryption and signature, and also provide an equal value detection function. The present invention can flexibly adapt to various application requirements, especially in scenarios where signature verification is required according to different conditions or data, providing stronger adaptability and practicality. It also meets the one-way OW-CCA, confidentiality IND-CCA2 and unforgeability UF-CMA, greatly improving the security of the solution.

[0024] The technical problems mainly solved by the present invention are as follows:

[0025] The threshold signcryption scheme proposed in the present invention is for the message sender U s And the message receiver U r The scheme is designed for interactive scenarios between different parties. It mainly includes five algorithm stages, namely initialization algorithm, key generation algorithm, secret sharing algorithm, threshold signcryption algorithm, decryption algorithm, etc.

[0026] like Figure 1 As shown, the present invention provides a threshold signcryption method on a grid that can realize an equal value detection function, comprising:

[0027] Step 1: Input security parameters and run the initialization algorithm to output a set of public parameters;

[0028] Specifically, step 1 includes:

[0029] Step 11: Input security parameter n, prime number q≥3, positive integer m≥5nlogq, Gaussian parameter and the complexity of p

[0030] Step 12: Set a collision-resistant hash function, where the collision-resistant hash function includes: a one-way collision-resistant hash function H = {0, 1} * →{0,1} k , collision-resistant hash function H′={0,1} * →{-1,1} p , hash function Where k is the message length;

[0031] Step 13: Set the signcryption user set U = {U1,…,U l}, where l is the set size, t is the threshold value, and the user end U i Identity is ID i , message sender U s ∈U’s identity is ID s , message receiver The identity is ID r , i=1,…,l;

[0032] Step 14, set the common parameters params = {q, m, n, σ, ω, k, H, H′, H1, l, t}.

[0033] Step 2, each user terminal inputs the public parameter set and generates its own public and private key pair using a key generation algorithm; the user terminal includes a message sender and a message receiver;

[0034] Specifically, step 2 includes:

[0035] Step 21, input common parameters params and select p+1 uniform random matrices and publish;

[0036] Step 22, run the trapdoor generation method TrapGen(q,n,m) for the user end U i (i=1,…,l) Generate A i , T i , A′ i and T i ′, and (A i ,A′ i ,A 1 ,…,A p ,B) As the user end U i The public key of i ,T i ′) as the user end U i The private key of

[0037] Step 23, run the trap generation algorithm TrapGen(q,n,m) for the message receiver U r Generate Ar , T r , A′ r and T′ r , and (A r ,A′ r ,A 1 ,…,A p ,B) As the message receiver U r The public key of r ,T′ r ) as the message receiver U r The private key of

[0038] Step 3: Each client generates its own secret sharing value using a sharing algorithm based on its own public and private keys and the secret sharing values ​​of other clients.

[0039] Specifically, step 3 includes:

[0040] Step 31: User terminal U i Generate their respective secret shared values ​​s i , and randomly select vector Let a i0 =0, generate l t-1 order polynomials: f i (ξ)=a i(t-1) ξ t-1 +…+a i1 ξ+a i0 ;

[0041] Step 32: User terminal U i and U j Perform interactive calculations ij =f i (ID j ), where j = 1,…,l;

[0042] Step 33: User terminal U j Output secret shared value

[0043] Step 4: The message sender uses the threshold signcryption algorithm and its own secret shared value to calculate the final ciphertext of the message to be sent, and sends it to the message receiver;

[0044] Specifically, step 4 includes:

[0045] Step 41, message sender U s Select a message M∈{0,1} from the message space k , where k is the message length, calculate f = H1 (ID s ,ID r ,M);

[0046] Step 42, message sender Us Send the selected message M to the user U i ;

[0047] Step 43: User terminal U i Run the original image sampling algorithm SamplePre(A i ,T i ,σ,f+s i ) Get the signature e of the message M i And sent to the message sender U s ;

[0048] Step 44, if the message sender U s Signature received i If the number is greater than or equal to the threshold value t, the message sender U s Run the general original image sampling algorithm SampleMat(A s ,T s ,σ,A i ) Get C i , and calculate in D = (l!) 2 ,

[0049] Step 45, message sender U s Pick a uniform random vector Random Selection calculate And calculate the partial ciphertext value

[0050] Step 46, message sender U s Calculate b = H′(c1‖c2)∈{-1,1} p ,

[0051] Step 47, select p uniform random matrices R i ∈{-1,1} m×m , where i = 1,…,p, and define

[0052] Step 48, message sender U s Random Selection Calculate z1 = R T y1,

[0053] Step 49, message sender U s Send the final ciphertext C = (e, c1, c2, c3, c4) to the message receiver Ur .

[0054] Step 5: The message receiver verifies whether the final ciphertext is valid using a decryption algorithm, and decrypts the message value from the valid final ciphertext;

[0055] Specifically, step 5 includes:

[0056] Step 51: Message receiver U r Calculate b = H′(c1‖c2)∈{-1,1} p , and run the left sampling algorithm get

[0057] Step 52: Message receiver U r calculate

[0058] Step 53: Message receiver U r For each i=1,…,k, compare w i and Is it close? If so, output M i =1, otherwise output M i =0, we get M;

[0059] Step 54: Message receiver U r Run the left sampling algorithm get

[0060] Step 55, message recipient I r calculate

[0061] Step 56: Message receiver U r For each i=1,…,k, compare w i 'and Is it close? If so, output h i =1, otherwise output h i =0, we get h;

[0062] The closeness of the present invention refers to that if the difference between the two is within a tolerance range, then the two are determined to be close, otherwise they are considered to be not close. The tolerance range is a pre-set range and can be adjusted according to actual conditions.

[0063] Step 57, if A s e=Df,||e||≤β and h=H(M) all hold, then the message receiver U r Decrypt the message value M from the final ciphertext C = (e, c1, c2, c3, c4), otherwise output ⊥.

[0064] Step 6: The message receiver uses its own tag to perform an equivalence test on the received final ciphertext.

[0065] Specifically, step 6 includes:

[0066] Step 61, set the message recipient U r The label value of

[0067] This step sends the message to the receiver U r The private key (T r ,T′ r ) as the tag value, denoted as t r =T′ r .

[0068] Step 62: Each message receiver uses its own tag value to perform an equivalence test on the final ciphertext it receives.

[0069] Specifically, step 62 includes:

[0070] Step 621, determine any two message recipients, one of which is message recipient U ri , and the other is the message receiver U rj ; Among them, the message receiver U ri Tags ri =T′ ri and the final ciphertext C received i ;

[0071] Step 622: Message receiver U ri Do the following:

[0072] First calculate b i =H′(c i1 ‖c i2 )=(b i1 ,…,b ip ), run the left sampling algorithm Get g i ;in, Second, calculate Finally, for each d=1,…,k, compare w id and Is it close? If so, output h id =1, otherwise output h id = 0, we get h i ;

[0073] Step 623: Message receiver U rj Do the following:

[0074] Calculate b j =H′(c i1‖c i2 )=(b j1 ,…,b jp ), run the left sampling algorithm Get g j ;in, Second, calculate Finally, for each d=1,…,k, compare w jd and Is it close? If so, output h jd =1, otherwise output h jd = 0, we get h j ;

[0075] Step 624, if h i =h j , the output indicates that the final ciphertext equality test is successful, and the output is 0 otherwise.

[0076] The present invention proposes a threshold signcryption method on a lattice that can realize an equivalence detection function. In the method, an improved threshold signcryption algorithm is used to generate a final ciphertext. While maintaining the existing security standards, the algorithm improves the overall efficiency by optimizing the calculation steps and reducing the number of participants required; and the algorithm also ensures that when equivalence detection is introduced in the signing process, the calculation complexity will not be significantly increased; in addition, the algorithm of the present invention adopts an efficient signature generation and verification mechanism, which can quickly generate and verify signatures while minimizing the consumption of communication and computing resources, especially in a threshold environment with multiple participants, showing obvious time advantages; and the present invention introduces an equivalence detection attribute in the traditional threshold signcryption scheme, which allows the effective detection of whether different ciphertexts are equivalent during the signature verification process, thereby improving the security and flexibility of the system.

[0077] It is worth noting that the terms "first" and "second" in the present invention are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0078] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality of components or steps.

[0079] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A threshold signcryption method on a grid capable of realizing an equal value detection function, characterized in that: include: Step 1: Input security parameters and run the initialization algorithm to output a set of public parameters; Step 2, each user terminal inputs the public parameter set and generates its own public and private key pair using a key generation algorithm; the user terminal includes a message sender and a message receiver; Step 3: Each client generates its own secret sharing value using a sharing algorithm based on its own public and private keys and the secret sharing values ​​of other clients. Step 4: The message sender uses the threshold signcryption algorithm and its own secret shared value to calculate the final ciphertext of the message to be sent, and sends it to the message receiver; Step 5: The message receiver verifies whether the final ciphertext is valid using a decryption algorithm, and decrypts the message value from the valid final ciphertext; Step 6: The message receiver uses its own tag to perform an equivalence test on the received final ciphertext.

2. The lattice threshold signcryption method capable of realizing equal value detection function according to claim 1, characterized in that: Step 1 includes: Step 11: Input security parameter n, prime number q≥3, positive integer m≥5nlogq, Gaussian parameter and the complexity of p Step 12: Set a collision-resistant hash function, where the collision-resistant hash function includes: a one-way collision-resistant hash function H = {0, 1} * →{0,1} k , collision-resistant hash function H′={0,1} * →{-1,1} p , hash function Where k is the message length; Step 13: Set the signcryption user set U = {U1,…,U l }, where l is the set size, t is the threshold value, and the user end U i Identity is ID i , message sender U s ∈U’s identity is ID s , message receiver The identity is ID r , i=1,…,l; Step 14, set the common parameters params = {q, m, n, σ, ω, k, H, H′, H1, l, t}.

3. The upper threshold signcryption method capable of realizing equal value detection function according to claim 2, characterized in that: Step 2 includes: Step 21, input common parameters params and select p+1 uniform random matrices A 1 ,…,A p , and publish; Step 22, run the trapdoor generation method TrapGen(q,n,m) for the user end U i (i=1,…,l) generates a i , T i , A′ i and T i ′, and (A i ,A′ i ,A 1 ,…,A p ,B) As the user end U i The public key of i ,T i ′) as the user end U i The private key of Step 23, run the trap generation algorithm TrapGen(q,n,m) for the message receiver U r Generate A r , T r , A′ r and T r ′, and (A r ,A′ r ,A 1 ,…,A p ,B) As the message receiver U r The public key of r ,T r ′) as the message receiver U r The private key of 4. The upper threshold signcryption method capable of realizing equal value detection function according to claim 3, characterized in that: Step 3 includes: Step 31: User terminal U i Generate their respective secret shared values ​​s i , and randomly select vector Let a i0 =0, generate l t-1 order polynomials: f i (ξ)=a i(t-1) ξ t-1 +…+a i1 ξ+a i0 ; Step 32: User terminal U i and U j Perform interactive calculations ij =f i (ID j ), where j = 1,…,l; Step 33: User terminal U j Output secret shared value 5. The upper threshold signcryption method capable of realizing equal value detection function according to claim 4, characterized in that: Step 4 includes: Step 41, message sender U s Select a message M∈{0,1} from the message space k , where k is the message length, calculate g = H1 (ID s ,ID r ,M); Step 42, message sender U s Send the selected message M to the user U i ; Step 43: User terminal U i Run the original image sampling algorithm SamplePre(A i ,T i ,σ,f+s i ) Obtain the signature e of the message M i And sent to the message sender U s ; Step 44, if the message sender U s Signature received i If the number is greater than or equal to the threshold value t, the message sender U s Run the general original image sampling algorithm SampleMat(A s ,T s ,σ,A i ) Get C i , and calculate in D = (l!) 2 , Step 45, message sender U s Select a uniform random vector d1, Randomly select x1, calculate And calculate the partial ciphertext value Step 46, message sender U s Calculate b = H′(c1‖c2)∈{-1,1} p , Step 47, select p uniform random matrices R i ∈{-1,1} m×m , where i = 1,…,p, and define Step 48, message sender U s Randomly select y1, Calculate z1 = R T y1, Step 49, message sender U s Send the final ciphertext C = (e, c1, c2, c3, c4) to the message receiver U r .

6. The upper threshold signcryption method capable of realizing equal value detection function according to claim 5, characterized in that: Step 5 includes: Step 51: Message receiver U r Calculate b = H′(c1‖c2)∈{-1,1} p , and run the left sampling algorithm get Step 52: Message receiver U r calculate Step 53: Message receiver U r For each i=1,…,k, compare w i and Is it close? If so, output M i =1, otherwise output M i =0, we get M; Step 54: Message receiver U r Run the left sampling algorithm get Step 55: Message receiver U r calculate Step 56: Message receiver U r For each i=1,…,k, compare w i 'and Is it close? If so, output h i =1, otherwise output h i =0, we get h; Step 57, if A s e=Df,‖e‖≤βand h=H(M) all hold, then the message receiver U r Decrypt the message value M from the final ciphertext C = (e, c1, c2, c3, c4), otherwise output ⊥.

7. The upper threshold signcryption method capable of realizing equal value detection function according to claim 6, characterized in that: Step 6 includes: Step 61, set the message recipient U r The label value of Step 62: Each message receiver uses its own tag value to perform an equivalence test on the final ciphertext it receives.

8. The upper threshold signcryption method capable of realizing equal value detection function according to claim 7, characterized in that: Step 61 includes: The message receiver U r The private key (T r ,T r ′) as the tag value, denoted as t r =T r ′.

9. The upper threshold signcryption method capable of realizing equal value detection function according to claim 8, characterized in that: Step 62 includes: Step 621, determine any two message recipients, one of which is message recipient U ri , and the other is the message receiver U rj ; Among them, the message receiver U ri Tags ri =T r ' i and the final ciphertext C received i ; Step 622: Message receiver U ri Do the following: First calculate b i =H′(c i1 ‖c i2 )=(b i1 ,…,b ip ), run the left sampling algorithm Get g i ;in, Second, calculate Finally, for each d=1,…,k, compare w id and Is it close? If so, output h id =1, otherwise output h id = 0, we get h i ; Step 623: Message receiver U rj Do the following: Calculate b j =H′(c i1 ‖c i2 )=(b j1 ,…,b jp ), run the left sampling algorithm Get g j ;in, Second, calculate Finally, for each d=1,…,k, compare w jd and Is it close? If so, output h jd =1, otherwise output h jd = 0, we get h j ; Step 624, if h i =h j , the output indicates that the final ciphertext equality test is successful, and the output is 0 otherwise.

Images