A lattice-based threshold signcryption method capable of realizing equivalent detection function

Abstract

The application provides a threshold signature method on a lattice, which can realize equivalent detection function; in the method, an improved threshold signature algorithm is used to generate final ciphertext; the algorithm improves overall efficiency by optimizing calculation steps and reducing the number of required participants while maintaining existing security standards; and the algorithm also ensures that the calculation complexity is not significantly increased when the equivalent detection is introduced in the signature process; in addition, the algorithm uses an efficient signature generation and verification mechanism, which can quickly generate and verify the signature while minimizing communication and calculation resource consumption, and has obvious time advantage in a multi-participant threshold environment; and the application introduces the equivalent detection attribute in the traditional threshold signature scheme, which can effectively detect whether different ciphertexts have equivalent in the signature verification process, thereby improving the security and flexibility of the system.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a lattice threshold signcryption method capable of realizing equivalent detection function. BACKGROUND

[0002] Signcryption technology is a technology that simultaneously completes data encryption and digital signature, which combines the traditional encryption and digital signature step-by-step manner. Specifically, signcryption technology can combine digital signature and encryption algorithm in one operation to realize data encryption, authentication, integrity verification and non-repudiation and other security measures. Compared with the traditional encryption and signature step-by-step, the advantages of signcryption technology are that it can reduce the total amount of calculation and communication cost, and also ensure the integrity and security of the algorithm, prevent information leakage and tampering.

[0003] Early threshold signcryption schemes are based on bilinear pairings, which are inefficient. Based on the format security proof of threshold signcryption scheme, Li et al. proposed an identity-based threshold signcryption scheme, which is proved to meet the confidentiality and existential unforgeability in the random oracle model, and the scheme does not need to store the public key dictionary and process the public key certificate, reducing the storage overhead. In addition, Zheng et al. proposed an attribute-based threshold signcryption scheme, which is verified under the DBDH and CBDH difficulty assumptions in the standard model to prove its security. The certificateless threshold signcryption scheme proposed by Yu and Wang not only solves the key escrow problem and certificate management problem, but also has high flexibility and scalability. In this scheme, the signer can generate the key and split it into multiple shares, and then distribute the shares to multiple trusted parties, which can jointly complete signcryption and decryptions operation without mutual trust. Compared with the traditional certificate signature scheme, the certificateless threshold signcryption scheme proposed by Yu and Wang has higher efficiency and stronger security. However, the above-mentioned schemes cannot resist quantum computing attacks.

[0004] Most of the current proposed threshold schemes have the following shortcomings:

[0005] (1) Time-consuming: The existing schemes may involve complicated steps and multiple communications in the process of signature generation and verification, resulting in a long time-consuming process. This is a significant disadvantage for application scenarios that require fast response;

[0006] (2) Insufficient security: Some existing technologies may not provide sufficient security in certain attack scenarios, especially when facing advanced cryptographic analysis and attacks;

[0007] (3) Poor flexibility: existing solutions may not be flexible enough to adapt to different application scenarios or user needs, and may not meet the changing needs in specific situations, such as insufficient equal value detection requirements. SUMMARY

[0008] In order to solve the above problems existing in the prior art, the present application provides a lattice threshold signature method capable of realizing equal value detection function. The technical problem to be solved by the present application is solved by the following technical scheme:

[0009] A lattice threshold signature method capable of realizing equal value detection function comprises:

[0010] Step 1, input security parameters and run an initialization algorithm to output a public parameter set;

[0011] Step 2, each user end inputs the public parameter set and generates its own public and private key pair using a key generation algorithm; the user end includes a message sender and a message receiver;

[0012] Step 3, each user end generates its own secret sharing value using a sharing algorithm according to its own public and private keys and other user end secret sharing values;

[0013] Step 4, the message sender calculates the final ciphertext of the message to be sent using a threshold signature algorithm and its own secret sharing value, and sends it to the message receiver;

[0014] Step 5, the message receiver verifies whether the final ciphertext is valid using a secret algorithm, and decrypts the message value from the valid final ciphertext;

[0015] Step 6, the message receiver uses its own label to perform equal value test on the received final ciphertext.

[0016] Advantages:

[0017] 1. The present application proposes a lattice threshold signature method capable of realizing equal value detection function, in which an improved threshold signature algorithm is used to generate the final ciphertext. This algorithm maintains the existing security standards while optimizing the calculation steps and reducing the number of required participants, thereby improving the overall efficiency. In addition, the algorithm ensures that the introduction of equal value detection in the signature process does not significantly increase the computational complexity;

[0018] 2. The present application designs a signature decryption algorithm, which uses an efficient signature generation and verification mechanism to quickly generate and verify signatures with minimal communication and computing resource consumption. In particular, in a multi-participant threshold environment, it shows a clear time advantage.

[0019] 3. The application introduces an equivalence detection attribute in a traditional threshold signcryption scheme, which allows effective detection of whether different ciphertexts have equivalence during signature verification, thereby improving the security and flexibility of the system.

[0020] The application will be further described in detail below in combination with the drawings and examples. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 is a flowchart of a lattice threshold signcryption method provided by the application, which can realize equivalence detection function. DETAILED DESCRIPTION

[0022] The application will be further described in detail below in combination with the drawings and examples.

[0023] The application aims to solve the problems of the prior art and provides a lattice threshold signcryption method that can realize equivalence detection function, which can improve the overall efficiency of encryption and signature, and also provides equivalence detection function. The application can flexibly adapt to various application requirements, especially in scenarios that require signature verification according to different conditions or data, providing stronger adaptability and practicality. It also meets the requirements of one-wayness OW-CCA, confidentiality IND-CCA2, and unforgeability UF-CMA, greatly improving the security of the scheme.

[0024] The technical problems solved by the application are as follows:

[0025] The threshold signcryption scheme proposed in the application is designed for the interaction scenario between the message sender U s and the message receiver U r . The scheme mainly includes five algorithm stages, namely initialization algorithm, key generation algorithm, secret sharing algorithm, threshold signcryption algorithm, and signature decryption algorithm.

[0026] As shown in Figure 1 , the application provides a lattice threshold signcryption method that can realize equivalence detection function, which includes:

[0027] Step 1: input security parameters and run initialization algorithm to output public parameter set;

[0028] Specifically, step 1 includes:

[0029] Step 11: input security parameters n, prime number q≥3, positive integer m≥5nlogq, Gaussian parameter and the complexity

[0030] Step 12: Set a collision-resistant hash function, which includes: a one-way collision-resistant hash function H = {0, 1} * →{0,1} k , collision-resistant hash function H′={0,1} * →{-1,1} p , hash function Where k is the message length;

[0031] Step 13: Set the signcryption user set U = {U1,…,U l}, where l is the set size, t is the threshold value, and the user end U i Identity is ID i , message sender U s ∈U’s identity is ID s , message receiver The identity is ID r , i=1,…,l;

[0032] Step 14: Set the common parameters params = {q, m, n, σ, ω, k, H, H′, H1, l, t}.

[0033] Step 2: Each user terminal inputs the public parameter set and generates its own public and private key pair using a key generation algorithm; the user terminal includes a message sender and a message receiver;

[0034] Specifically, step 2 includes:

[0035] Step 21: Input the common parameters params and select p+1 uniform random matrices and publish;

[0036] Step 22: Run the trapdoor generation method TrapGen(q,n,m) for the user terminal U i (i=1,…,l) generates A i 、T i , A′ i and T i ′, and (A i ,A′ i ,A 1 ,…,A p ,B) As the user end U i The public key of i ,T i ′) as the user end U i The private key of

[0037] Step 23: Run the trapdoor generation algorithm TrapGen(q,n,m) for the message receiver U r Generate Ar , T r , A′ r and T′ r , and (A r , A′ r , A 1 , …, A p , B) are the public keys of the message receiver U r , and (T r , T′ r ) are the private keys of the message receiver U r .

[0038] Step 3, each user terminal generates its own secret sharing value by using a sharing algorithm according to its own public and private keys and the secret sharing values of other user terminals;

[0039] Specifically, step 3 includes:

[0040] Step 31, the user terminal U i generates its own secret sharing value s i and randomly selects a vector Let a i0 = 0, generate l t-1 order polynomials: f i (ξ) = a i(t-1) ξ t-1 + … + a i1 ξ + a i0 ;

[0041] Step 32, the user terminals U i and U j perform interactive calculation s ij = f i (ID j ), where j = 1, …, l;

[0042] Step 33, the user terminal U j outputs the secret sharing value

[0043] Step 4, the message sender calculates the final ciphertext of the message to be sent by using a threshold signcryption algorithm and its own secret sharing value, and sends it to the message receiver;

[0044] Specifically, step 4 includes:

[0045] Step 41, the message sender U s selects a message M ∈ {0, 1} k from the message space, where k is the message length, and calculates f = H1(ID s , ID r , M);

[0046] Step 42, the message sender Us send the selected message M to the user U i ;

[0047] Step 43, the user U i runs the pre-image sampling algorithm SamplePre(A i , T i , σ, f + s i ) to obtain the signature e i of the message M and sends it to the message sender U s ;

[0048] Step 44, if the number of signatures e s received by the message sender U i is greater than or equal to the threshold value t, the message sender U s runs the general pre-image sampling algorithm SampleMat(A s , T s , σ, A i ) to obtain C i , and calculates where D = (1!) 2 ,

[0049] Step 45, the message sender U s selects a uniform random vector randomly selects calculates and calculates the partial ciphertext value

[0050] Step 46, the message sender U s calculates b = H'(c1‖c2) ∈ {-1, 1} p ,

[0051] Step 47, selects p uniform random matrices R i ∈ {-1, 1} m×m , where i = 1, …, p, and defines

[0052] Step 48, the message sender U s randomly selects calculates z1= R T y1,

[0053] Step 49, the message sender U s sends the final ciphertext C = (e, c1, c2, c3, c4) to the message receiver Ur .

[0054] Step 5, the message receiver verifies whether the final ciphertext is valid by using the secret algorithm, and decrypts the message value from the valid final ciphertext;

[0055] Specifically, step 5 includes:

[0056] Step 51, the message receiver U r calculates b = H'(c1‖c2) ∈ {-1, 1} p and runs the left sampling algorithm to obtain

[0057] Step 52, the message receiver U r calculates

[0058] Step 53, the message receiver U r compares w i and whether they are close, if they are close, outputs M i = 1, otherwise outputs M i = 0, to obtain M;

[0059] Step 54, the message receiver U r runs the left sampling algorithm to obtain

[0060] Step 55, the message receiver I r calculates

[0061] Step 56, the message receiver U r compares w i ' and whether they are close, if they are close, outputs h i = 1, otherwise outputs h i = 0, to obtain h;

[0062] wherein, the closeness of the present application refers to that the difference between the two is within a tolerance range, then it is determined that the two are close, otherwise it is considered not close, the tolerance range is a pre-set range, which can be adjusted according to actual conditions.

[0063] Step 57, if A s e = Df, ||e|| ≤ β and h = H(M) are all true, the message receiver U r decrypts the message value M from the final ciphertext C = (e, c1, c2, c3, c4), otherwise outputs ⊥.

[0064] Step 6: The message receiver uses its own tag to perform an equivalence test on the received final ciphertext.

[0065] Specifically, step 6 includes:

[0066] Step 61, set the message recipient U r The label value of

[0067] This step will send the message to the recipient U r The private key (T r ,T′ r ) as the tag value, represented by t r =T′ r .

[0068] In step 62, each message receiver uses its own tag value to perform an equivalence test on the final ciphertext it receives.

[0069] Specifically, step 62 includes:

[0070] Step 621, determine any two message recipients, one of which is message recipient U ri , the other is the message receiver U rj ; Among them, the message receiver U ri Tags ri =T′ ri and a final ciphertext C received i ;

[0071] Step 622: Message receiver U ri Do the following:

[0072] First calculate b i =H′(c i1 ‖c i2 )=(b i1 ,…,b ip ), run the left sampling algorithm Get g i ;in, Second, calculate Finally, for each d=1,…,k, compare w id and Is it close? If so, output h id =1, otherwise output h id =0, we get h i ;

[0073] Step 623, the message receiver U rj Do the following:

[0074] Calculate b j =H′(c i1‖c i2 )=(b j1 ,…,b jp ), run the left sampling algorithm Get g j ;in, Secondly calculate Finally, for each d=1,…,k, compare w jd and Is it close? If so, output h jd =1, otherwise output h jd =0, we get h j ;

[0075] Step 624, if h i =h j , the output indicates that the final ciphertext equality test is successful, and the output is 0 otherwise.

[0076] The present invention proposes a threshold signcryption method on a grid that can realize the equivalence detection function. In this method, an improved threshold signcryption algorithm is used to generate the final ciphertext. While maintaining the existing security standards, the algorithm improves the overall efficiency by optimizing the calculation steps and reducing the number of participants required; and the algorithm also ensures that when equivalence detection is introduced in the signing process, the computational complexity will not be significantly increased; in addition, the algorithm of the present invention adopts an efficient signature generation and verification mechanism, which can quickly generate and verify signatures while minimizing the consumption of communication and computing resources, especially in a threshold environment with multiple participants, showing a significant time advantage; and the present invention introduces an equivalence detection property into the traditional threshold signcryption scheme. This property allows the effective detection of whether different ciphertexts are equivalent during the signature verification process, thereby improving the security and flexibility of the system.

[0077] It is worth noting that the terms "first" and "second" in this disclosure are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, features defined as "first" or "second" may explicitly or implicitly include one or more of such features. In the description of this disclosure, "plurality" means two or more, unless otherwise specifically defined.

[0078] Although the present application is described herein with reference to various embodiments, those skilled in the art will be able to understand and implement other variations of the disclosed embodiments in practicing the claimed application by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality.

[0079] The above description is further detailed in connection with specific preferred embodiments of the present application, and it is not to be construed that the specific implementation of the present application is limited to these descriptions. For those skilled in the art to which the present application belongs, without departing from the concept of the present application, a number of simple deductions or substitutions can be made, and all of them should be considered as falling within the protection scope of the present application.

Claims

1. A threshold signcryption method on a grid that can realize an equal value detection function, characterized in that: include: Step 1: Input security parameters and run the initialization algorithm to output a set of public parameters. Step 2: Each user terminal inputs the public parameter set and generates its own public and private key pair using a key generation algorithm; the user terminal includes a message sender and a message receiver; Step 3: Each client generates its own secret shared value using a sharing algorithm based on its own public and private keys and the secret shared values ​​of other clients. Step 4: The message sender uses the threshold signcryption algorithm and its own secret shared value to calculate the final ciphertext of the message to be sent and sends it to the message receiver; Step 5: The message receiver verifies whether the final ciphertext is valid using a decryption algorithm, and decrypts the message value from the valid final ciphertext; Step 6: The message receiver uses its own tag to perform an equivalence test on the received final ciphertext; Step 1 includes: Step 11: Input security parameter n, prime number q≥3, positive integer m≥5nlogq, Gaussian parameter and the complexity of p Step 12: Set a collision-resistant hash function, which includes: a one-way collision-resistant hash function H = {0, 1} * →{0,1} k , collision-resistant hash function H′={0,1} * →{-1,1} p , hash function Where k is the message length; Step 13: Set the signcryption user set U = {U1,…,U l }, where l is the set size, t is the threshold value, and the user end U i Identity is ID i , message sender U s ∈U’s identity is ID s , message receiver The identity is ID r , i=1,…,l; Step 14: Set common parameters params = {q, m, n, σ, ω, k, H, H′, H1, l, t}; Step 2 includes: Step 21: Input common parameters params and select p+1 uniform random matrices A 1 ,…,A p , and publish; Step 22: Run the trapdoor generation method TrapGen(q,n,m) for the user terminal U i (i=1,…,l) generates A i 、T i , A′ i and T′ i , and (A i ,A′ i ,A 1 ,…,A p ,B) As the user end U i The public key of i ,T′ i ) as the user end U i The private key of Step 23: Run the trapdoor generation algorithm TrapGen(q,n,m) for the message receiver U r Generate A r 、T r , A′ r and T′ r , and (A r ,A′ r ,A 1 ,…,A p ,B) As the message receiver U r The public key of r ,T′ r ) as the message receiver U r The private key of Step 3 includes: Step 31: User terminal U i Generate their respective secret shared values ​​s i , and randomly select vector Let a i0 =0, generate l t-1 order polynomials: f i (ξ)=a i(t-1) ξ t-1 +…+a i1 ξ+a i0 ; Step 32: User terminal U i and U j Perform interactive calculations ij =f i (ID j ), where j = 1,…, l; Step 33: User terminal U j Output secret shared value Step 4 includes: Step 41, message sender U s Select a message M∈{0,1} from the message space k , where k is the message length, calculate f=H1(ID s ,ID r ,M); Step 42, message sender U s Send the selected message M to the user U i ; Step 43: User terminal U i Run the original image sampling algorithm SamplePre(A i ,T i ,σ,f+s i ) Obtain the signature e of the message M i And sent to the message sender U s ; Step 44: If the message sender U s Signature received i If the number is greater than or equal to the threshold value t, the message sender U s Run the general original image sampling algorithm SampleMat(A s ,T s ,σ,A i ) Get C i , and calculate in D=(l!) 2 , Step 45, message sender U s Pick a uniform random vector Random selection calculate And calculate the partial ciphertext value Step 46, message sender U s Calculate b = H′(c1‖c2)∈{-1,1} p , Step 47, select p uniform random matrices R i ∈{-1,1} m×m , where i=1,…,p, and define Step 48, message sender U s Random selection Calculate z1 = R T y1, Step 49, message sender U s Send the final ciphertext C = (e, c1, c2, c3, c4) to the message receiver U r .

2. The upper threshold signcryption method capable of realizing equal value detection function according to claim 1, characterized in that: Step 5 includes: Step 51: Message receiver U r Calculate v = H′(c1‖c2)∈{-1,1} p , and run the left sampling algorithm get Step 52: Message receiver U r calculate Step 53: Message receiver U r For each i=1,…,k, compare w i and Is it close? If so, output M i =1, otherwise output M i =0, we get M; Step 54: Message receiver U r Run the left sampling algorithm get Step 55, message receiver U r calculate Step 56: Message receiver U r For each i=1,…,k, compare w′ i and Is it close? If so, output h i =1, otherwise output h i =0, we get h; Step 57, if A s e = Df, ‖e‖ ≤ β and h = H(M) all hold, then the message receiver U r decodes the message value M from the final ciphertext C = (e, c1, c2, c3, c4), otherwise outputs ⊥.

3. The upper threshold signcryption method capable of realizing equal value detection function according to claim 2, characterized in that: Step 6 includes: Step 61, set the message receiver U r The label value of In step 62, each message receiver uses its own tag value to perform an equivalence test on the final ciphertext it receives.

4. The upper threshold signcryption method capable of realizing equal value detection function according to claim 3, characterized in that: Step 61 includes: The message receiver U r The private key (T r ,T′ r ) as the tag value, represented by t r =T′ r .

5. The upper threshold signcryption method capable of realizing equal value detection function according to claim 4, characterized in that: Step 62 includes: Step 621, determine any two message recipients, one of which is message recipient U ri , the other is the message receiver U rj ; Among them, the message receiver U ri Tags ri =T′ ri and a final ciphertext C received i ; Step 622: Message receiver U ri Do the following: First calculate b i =H′(c i1 ‖c i2 )=(b i1 ,…,b ip ), run the left sampling algorithm Get g i ;in, Secondly calculate Finally, for each d=1,…,k, compare w id and Is it close? If so, output h id =1, otherwise output h id =0, we get h i ; Step 623: Message receiver U rj Do the following: Calculate b j =H′(c i1 ‖c i2 )=(b j1 ,…,b jp ), run the left sampling algorithm Get g j ;in, Secondly calculate Finally, for each d=1,…,k, compare w jd and Is it close? If so, output h jd =1, otherwise output h jd =0, we get h j ; Step 624, if h i =h j , the output indicates that the final ciphertext equality test is successful, and the output is 0 otherwise.

Images