Verifiable timed batch secret key release method

Abstract

The invention discloses a verifiable timed batch key release method, which relates to the technical field of wireless network security, and comprises the following steps: S1, setting key parameters; s2, key parameters are initialized through a Setup algorithm; s3, generating a commitment C and a time lock puzzle Z through a Commit algorithm; s4, verifying the commitment C through a Verify algorithm; s5, the time puzzle is unlocked through a ForceOp algorithm, and the complete private key is decrypted and recovered; through mutual cooperation of algorithms, reasonable parameter configuration and reasonable calculation process planning, batch processing of verifiable timing time release is realized, calculation complexity is greatly reduced, through a one-step encryption algorithm, all'secret 'unlocking conditions are unified, a time lock is generated for the unlocking conditions, and the unlocking efficiency is improved. Therefore, the effect that one time lock locks a plurality of'secrets' is achieved, and the problems that secret keys cannot be processed in batches, calculation is complex and communication overhead is too high in verifiable timing cryptography technologies such as VTS and VTD are effectively solved.

Description

[0001] Methodology Area

[0002] The present invention relates to the field of wireless network security technology, and in particular to a method for releasing a verifiable timed batch key.

[0003] Background Methods

[0004] Verifiable timed cryptography is a cryptographic protocol that aims to ensure that data can only be unlocked and accessed at a specified time. It is based on a time lock mechanism and controls the timing of data unlocking through computational complexity. Even participants with keys cannot read information before the set time. The core of this protocol is to combine discrete logarithms and verification mechanisms to ensure the security and accuracy of the decryption process of time-locked encrypted data. It is mainly suitable for application scenarios that require time-sensitive data release or privacy protection, such as electronic voting, confidential information release, and cryptocurrency unlocking.

[0005] The existing verifiable timed cryptography technologies mainly include verifiable timed signatures VTS and verifiable timed discrete logarithms VTD. VTS uses the linear homomorphic time lock puzzle to time lock a digital signature. Only after a predetermined period of continuous calculation can the puzzle be solved and the digital signature obtained. In addition, the sender of VTS will also generate a zero-knowledge proof and send it to the recipient together with the time lock puzzle. The zero-knowledge proof proves that the signature of a certain transaction is locked in the time lock puzzle, and the transaction is agreed upon in advance by the sender and the receiver. Similarly, VTD locks the private key in a non-pair encryption key pair, and also generates a zero-knowledge proof to prove that the private key corresponding to a specific public key is locked in the time lock puzzle. Using this technology, off-chain transaction time locks can be implemented in the blockchain system without the support of on-chain smart contracts, which not only reduces the on-chain overhead, but also improves efficiency, because all operations only need to be completed locally without chain verification.

[0006] However, these verifiable timing cryptography technologies have extremely strong binding properties when locking "secrets". Each time a secret is locked, a corresponding time lock puzzle and proof need to be generated, which makes these technologies unable to achieve batch processing, and thus unable to cope with the situation where multiple transactions occur at the same time, which runs counter to the general trend of the integrated development of blockchain systems.

[0007] In addition, all of these technologies need to generate range proofs for "secrets", which greatly increases the difficulty of proof generation and verification. Although some technologies use "cut-and-choose" technology to improve the efficiency of proof generation and verification, the final effect is still unsatisfactory from a practical application perspective, which ultimately leads to excessive computing and communication overhead of the technology, and is unable to meet the transaction timeliness requirements of current high-throughput blockchain systems.

[0008] Therefore, a method for releasing batch keys with verifiable timing is provided to solve the above problems. Summary of the invention

[0009] The purpose of the present invention is to provide a method for releasing batch keys with verifiable timing, aiming at the deficiencies of the prior art and solving the problems of VTS, VTD and other verifiable timing cryptographic technologies that cannot process keys in batches, have complex calculations and high communication overhead.

[0010] To achieve the above object, the present invention provides a method for releasing batch keys with verifiable timing, comprising the following steps:

[0011] S1: Set key parameters;

[0012] S2: Initialize key parameters through the Setup algorithm;

[0013] S3: Generate commitment C and time lock puzzle Z through the Commit algorithm;

[0014] S4: Verify commitment C through the Verify algorithm;

[0015] S5: Unlock the time lock puzzle Z through the ForceOp algorithm, decrypt and recover the complete private key d.

[0016] Preferably, in step S1, setting key parameters specifically includes the following steps:

[0017] S11: Control the secret key length and hash value output length by setting the security parameter λ;

[0018] S12: Setting the time threshold required for decryption by setting the time parameter T;

[0019] S13: Construct a discrete logarithm-based time lock puzzle Z by setting discrete logarithm group parameters;

[0020] S14: Set the secret key bit length |sk|;

[0021] S15: Set up polynomial secret sharing and random numbers r, α, β used to generate commitment C and time lock puzzle Z.

[0022] Preferably, in step S13, the discrete pair group parameters include the cyclic group G, the generator g0 and the order q 0 .

[0023] Preferably, in step S2, the key parameters are initialized by the Setup algorithm, which specifically includes the following steps:

[0024] S21: Input the security parameter λ and the time parameter T into the Setup algorithm to generate the parameter crs of the non-interactive zero-knowledge proof NIZK;

[0025] S22: calling the parameter generation function of the linear homomorphic time lock puzzle LHTLP, and generating the public parameter pp of the linear homomorphic time lock puzzle LHTLP based on the security parameter λ and the time parameter T;

[0026] S23: Generate an elliptic curve key pair {d, D};

[0027] S24: Output public parameters pp, parameters crs of non-interactive zero-knowledge proof NIZK, generator g0, private key d and public key D.

[0028] Preferably, in step S3, a commitment C is generated by a Commit algorithm, which specifically includes the following steps:

[0029] S31: Commit algorithm receives NIZK parameters crs, private key set {sk k}, and the private key set {sk k}The corresponding public key set {pk k}, LHTLP public parameters pp and elliptic curve key pair {d, D};

[0030] S32: According to the private key set {sk k} Randomly generate a t-1 degree polynomial p k (x) to achieve secret sharing;

[0031] S33: According to the private key set {sk k} and the polynomial p k (x) Generate encrypted private key share {sk i，k};

[0032] S34: Generate time lock puzzle Z;

[0033] S35: Generate commitment C and proof π.

[0034] Preferably, in step S35, the Commit algorithm generates the commitment C based on the Sigma protocol, which specifically includes the following steps:

[0035] Step 1: The sender creates a commitment C based on the random number r and sends the commitment C to the receiver;

[0036] Step 2: After the receiver gets the commitment C, it calculates the challenge value c through the hash function H and sends the challenge value to the sender;

[0037] Step 3: The sender accepts the challenge value c, creates a response based on the random number r and the challenge value c, and sends the response to the receiver;

[0038] Step 4: The receiver calculates c' through the hash function H' and determines the consistency of c and c'. If c and c' are consistent, it proves that the receiver knows the existence of the encrypted information. If c and c' are inconsistent, it proves that the receiver does not know the existence of the encrypted information.

[0039] Preferably, in step S4, the commitment C is verified by a Verify algorithm, which specifically includes the following steps:

[0040] S41: The Verify algorithm receives the public key set {pk k}, commitment C and proof π;

[0041] S42: Parse the structure of commitment C;

[0042] S43: Verify private key share {sk i，k}Consistency with the time lock puzzle Z, private key share {sk i，k} and public key pk k If the public key pk k and the time lock puzzle Z are both related to the private key share {sk i，k}, returns a signal of successful verification, otherwise returns a signal of failed verification.

[0043] Preferably, in step S5, the time lock puzzle Z is unlocked by the ForceOp algorithm, and the complete private key is decrypted and recovered, which specifically includes the following steps:

[0044] S51: The ForceOp algorithm receives the time parameter T, the public parameter pp of LHTLP and the commitment C;

[0045] S52: Calculate the decryption key d through the time lock puzzle solving function TLP.PSolve, and decrypt the encrypted private key share {sk i，k};

[0046] S53: Collect private key shares {sk i，k}, based on Lagrange interpolation to reconstruct the complete private key set {sk k};

[0047] S54: Output private key set {sk k} to complete the unlocking operation.

[0048] Therefore, the present invention adopts the above-mentioned method for releasing batch keys with verifiable timing, which has the following beneficial effects:

[0049] (1) The commit algorithm uses one-time encryption to unify all the "secrets" to be locked and generate the secret text of the "secret". No matter how many secret texts are generated, only one unlocking key is needed to decrypt these secret texts, thus realizing batch processing in the secret locking stage;

[0050] (2) The commit algorithm generates a time-locked puzzle containing the decryption key and a corresponding zero-knowledge proof. Compared with the proof in the prior art, the generation method of this proof adopts the more efficient Sigma protocol and removes the expensive range proof.

[0051] (3) The relationship between the proof and the time-lock puzzle is verified by the verify algorithm. Since the commit algorithm has already processed all the “secrets” in batches and output a time-lock puzzle and proof that unlocks the key, the verify algorithm only needs to verify the puzzle and proof, which reduces the difficulty of the calculation.

[0052] (4) Low computational complexity. The computational complexity of proof generation in existing schemes is O(n 2 ), and the complexity of this solution is only O(n).

[0053] The method scheme of the present invention is further described in detail below through the drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A flow chart of a method for releasing batch secret keys that can be verified and timed according to the present invention;

[0055] Figure 2 The present invention provides a technical roadmap for a method for releasing batch keys that can be verified at a fixed time. DETAILED DESCRIPTION

[0056] The method scheme of the present invention is further described below through drawings and embodiments.

[0057] Unless otherwise defined, method terms or scientific terms used in the present invention shall have the common meanings understood by one of ordinary skill in the art to which the present invention belongs.

[0058] The words "include" or "comprises" and the like used in the present invention mean that the elements before the word include the elements listed after the word, and do not exclude the possibility of also including other elements. The orientation or position relationship indicated by the terms "inside", "outside", "upper", "lower", etc. is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation of the present invention. When the absolute position of the described object changes, the relative position relationship may also change accordingly. In the present invention, unless otherwise clearly specified and limited, the terms "attachment" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral body; it can be directly connected, or indirectly connected through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0059] Example

[0060] like Figure 1 and Figure 2 As shown, assume a scenario: the sender wants to send k of his own digital signature private keys to the receiver, but hopes that these private keys can only be used after a period of time T. Based on this scenario, the implementation steps of this solution are described in detail;

[0061] The present invention provides a method for releasing a batch of secret keys that can be verified and timed, comprising the following steps:

[0062] S1: Set key parameters to ensure the security of the protocol and the correctness of its execution;

[0063] In step S1, key parameters are set, which specifically includes the following steps:

[0064] S11: Control the key length and hash value output length by setting the security parameter λ to ensure the protocol's anti-attack capability and overall security;

[0065] S12: The time threshold required for decryption is set by setting the time parameter T, and the decryption time of the data is limited by increasing the calculation complexity, so as to realize the time locking function of the data;

[0066] S13: Construct a discrete logarithm-based time lock puzzle Z by setting discrete logarithm group parameters. The discrete logarithm group has good security to prevent early decryption.

[0067] In step S13, the discrete pair group parameters include the cyclic group G, the generator g0 and the order q0;

[0068] S14: Set the secret key bit length |sk| to ensure the security strength of the private key d;

[0069] S15: Set polynomial secret sharing and random numbers r, α, β used to generate commitment C and time lock puzzle Z to increase the randomness and security of the protocol and prevent external attacks.

[0070] S2: Initialize key parameters through the Setup algorithm to provide a basis for subsequent encryption and verification operations;

[0071] In step S2, the key parameters are initialized by the Setup algorithm, which specifically includes the following steps:

[0072] S21: Input the security parameter λ and the time parameter T into the Setup algorithm to generate the parameter crs of the non-interactive zero-knowledge proof NIZK, which is used to generate a non-interactive zero-knowledge proof to ensure the correctness of the commitment C without leaking private information, thereby ensuring the verification security of the protocol;

[0073] S22: calling the parameter generation function of the linear homomorphic time lock puzzle LHTLP, generating the public parameter pp of the linear homomorphic time lock puzzle LHTLP based on the security parameter λ and the time parameter T, which is used to generate the time lock puzzle Z, control the time of the decryption process, and ensure that the data cannot be decrypted before the set time;

[0074] S23: Generate an elliptic curve key pair {d, D} for encryption and verification of the private key d to ensure the security of the private key d and the reliability of the verification;

[0075] S24: Output public parameters pp, parameters crs of non-interactive zero-knowledge proof NIZK, generator g0, private key d and public key D.

[0076] S3: Generate commitment C and time lock puzzle Z through the Commit algorithm. The Commit algorithm is used to generate commitments through polynomial secret sharing and time lock puzzle encryption, so that the private key d cannot be unlocked before a specific time;

[0077] In step S3, a commitment C is generated through the Commit algorithm, which specifically includes the following steps:

[0078] S31: Commit algorithm receives NIZK parameters crs, private key set {sk k}, and the private key set {sk k}The corresponding public key set {pk k}, LHTLP public parameters pp and elliptic curve key pair {d, D};

[0079] S32: According to the private key set {sk k} Randomly generate a t-1 degree polynomial pk (x) to achieve secret sharing;

[0080] S33: According to the private key set {sk k} and the polynomial p k (x) Generate encrypted private key share {sk i，k}, a random polynomial is used to construct a secret sharing scheme, through the random coefficient a i，k The private key set {sk k} is divided into several shares to realize the private key set {sk k} secure distribution and encryption;

[0081] S34: Generate a time lock puzzle Z to ensure that the private key d cannot be unlocked before the time parameter T arrives;

[0082] S35: Generate commitment C and proof π to ensure that each encrypted private key share {sk i，k} and the public key set {pk k}The correctness of the corresponding relationship.

[0083] In step S35, the Commit algorithm generates commitment C based on the Sigma protocol, which specifically includes the following steps:

[0084] Step 1: The sender creates a commitment C based on the random number r and sends the commitment C to the receiver;

[0085] Step 2: After the receiver gets the commitment C, it calculates the challenge value c through the hash function H and sends the challenge value to the sender;

[0086] Step 3: The sender accepts the challenge value c, creates a response based on the random number r and the challenge value c, and sends the response to the receiver;

[0087] Step 4: The receiver calculates c' through the hash function H' and determines the consistency of c and c'. If c and c' are consistent, it proves that the receiver knows the existence of the encrypted information. If c and c' are inconsistent, it proves that the receiver does not know the existence of the encrypted information.

[0088] S4: Verify the commitment C through the Verify algorithm to verify whether the commitment C generated in the Commit algorithm is correct to ensure that the encrypted private key share {sk i，k} corresponds to the public key set {pk k};

[0089] In step S4, the commitment C is verified by the Verify algorithm, which specifically includes the following steps:

[0090] S41: The Verify algorithm receives the public key set {pk k}, commitment C and proof π;

[0091] S42: Parse the structure of commitment C;

[0092] S43: Verify private key share {sk i，k}Consistency with the time lock puzzle Z, private key share {sk i，k} and public key pk k The consistency of the private key set {sk k} Correct encryption, if the public key pk k and the time lock puzzle Z are both related to the private key share {sk i，k}, returns a signal of successful verification, otherwise returns a signal of failed verification.

[0093] S5: Unlock the time lock puzzle Z through the ForceOp algorithm, decrypt and recover the complete private key d.

[0094] In step S5, the time lock puzzle Z is unlocked by the ForceOp algorithm, and the complete private key is decrypted and recovered, which specifically includes the following steps:

[0095] S51: The ForceOp algorithm receives the time parameter T, the public parameter pp of LHTLP and the commitment C;

[0096] S52: Calculate the decryption key d through the time lock puzzle solving function TLP.PSolve, and decrypt the encrypted private key share {sk i，k};

[0097] S53: Collect private key shares {sk i，k}, based on Lagrange interpolation to reconstruct the complete private key set {sk k};

[0098] S54: Output private key set {sk k} to complete the unlocking operation.

[0099] Therefore, the present invention adopts the above-mentioned method for releasing batch keys with verifiable timed time, and realizes batch processing of verifiable timed time release through the mutual cooperation of algorithms, reasonable configuration of parameters and reasonable planning of calculation process, and greatly reduces the calculation complexity. Through a one-step encryption algorithm, the unlocking conditions of all "secrets" are unified, and a time lock is generated for the unlocking condition, thereby achieving the effect of locking multiple "secrets" with one time lock, that is, batch processing.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the method scheme of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, ordinary method personnel in the field should understand that they can still modify or replace the method scheme of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified method scheme to deviate from the spirit and scope of the method scheme of the present invention.

Claims

1. A method for releasing batch keys with verifiable timing, characterized in that: The following steps are involved: S1: Set key parameters; S2: Initialize key parameters through the Setup algorithm; S3: Generate commitment C and time lock puzzle Z through the Commit algorithm; S4: Verify commitment C through the Verify algorithm; S5: Unlock the time lock puzzle Z through the ForceOp algorithm, decrypt and recover the complete private key d.

2. A method for releasing a verifiable timed batch key according to claim 1, characterized in that: In step S1, key parameters are set, which specifically includes the following steps: S11: Control the secret key length and hash value output length by setting the security parameter λ; S12: Setting the time threshold required for decryption by setting the time parameter T; S13: Construct a discrete logarithm-based time lock puzzle Z by setting discrete logarithm group parameters; S14: Set the secret key bit length |sk|; S15: Set up polynomial secret sharing and random numbers r, α, β used to generate commitment C and time lock puzzle Z.

3. A method for releasing a verifiable timed batch key according to claim 2, characterized in that: In step S13, the discrete pair group parameters include the cyclic group G, the generator g0 and the order q0.

4. A method for releasing a verifiable timed batch key according to claim 1, characterized in that: In step S2, the key parameters are initialized by the Setup algorithm, which specifically includes the following steps: S21: Input the security parameter λ and the time parameter T into the Setup algorithm to generate the parameter crs of the non-interactive zero-knowledge proof NIZK; S22: calling the parameter generation function of the linear homomorphic time lock puzzle LHTLP, and generating the public parameter pp of the linear homomorphic time lock puzzle LHTLP based on the security parameter λ and the time parameter T; S23: Generate an elliptic curve key pair {d, D}; S24: Output public parameters pp, parameters crs of non-interactive zero-knowledge proof NIZK, generator g0, private key d and public key D.

5. A method for releasing a verifiable timed batch key according to claim 1, characterized in that: In step S3, a commitment C is generated through the Commit algorithm. The following steps are involved: S31: Commit algorithm receives NIZK parameters crs, private key set {sk k }, and the private key set {sk k }The corresponding public key set {pk k }, LHTLP public parameters pp and elliptic curve key pair {d, D}; S32: According to the private key set {sk k } Randomly generate a t-1 degree polynomial p k (x) to achieve secret sharing; S33: According to the private key set {sk k } and the polynomial p k (x) Generate encrypted private key share {sk i，k }; S34: Generate time lock puzzle Z; S35: Generate commitment C and proof π.

6. A method for releasing a verifiable timed batch key according to claim 5, characterized in that: In step S35, the Commit algorithm generates commitment C based on the Sigma protocol, which specifically includes the following steps: Step 1: The sender creates a commitment C based on the random number r and sends the commitment C to the receiver; Step 2: After the receiver gets the commitment C, it calculates the challenge value c through the hash function H and sends the challenge value to the sender; Step 3: The sender accepts the challenge value c, creates a response based on the random number r and the challenge value c, and sends the response to the receiver; Step 4: The receiver calculates c' through the hash function H' and determines the consistency of c and c'. If c and c' are consistent, it proves that the receiver knows the existence of the encrypted information. If c and c' are inconsistent, it proves that the receiver does not know the existence of the encrypted information.

7. A method for releasing a verifiable timed batch key according to claim 1, characterized in that: In step S4, the commitment C is verified by the Verify algorithm, which specifically includes the following steps: S41: The Verify algorithm receives the public key set {pk k }, commitment C and proof π; S42: Parse the structure of commitment C; S43: Verify private key share {sk i，k }Consistency with the time lock puzzle Z, private key share {sk i，k } and public key pk k If the public key pk k and the time lock puzzle Z are both related to the private key share {sk i，k }, returns a signal of successful verification, otherwise returns a signal of failed verification.

8. A method for releasing a verifiable timed batch key according to claim 1, characterized in that: In step S5, the time lock puzzle Z is unlocked by the ForceOp algorithm, and the complete private key is decrypted and recovered, which specifically includes the following steps: S51: The ForceOp algorithm receives the time parameter T, the public parameter pp of LHTLP and the commitment C; S52: Calculate the decryption key d through the time lock puzzle solving function TLP.PSolve, and decrypt the encrypted private key share {sk i，k }; S53: Collect private key shares {sk i，k }, based on Lagrange interpolation to reconstruct the complete private key set {sk k }; S54: Output private key set {sk k } to complete the unlocking operation.

Images