Adapter signature method and device based on finite field

Abstract

The invention discloses an adapter signature method and device based on a finite field, and the method comprises the steps: a second user obtains the public information of a first user, and the first user is a user which carries out the signature based on a to-be-signed object; the second user generates a pre-signature based on a private key of the second user and the public information; the first user verifies the pre-signature, and after verification is passed, the pre-signature is adapted to be a formal signature; a second user obtains the formal signature, and candidate difficulty relationship evidence of the first user is extracted from the formal signature; and verifying the extracted candidate difficult relationship evidence of the first user, and if the verification is passed, determining that the candidate difficult relationship evidence is the same as the difficult relationship evidence, that is, the formal signature confirms that the first user has signed the object to be signed. The method is efficient and safe, has strong adaptability, and can ensure safe generation, verification and tracing of the signature in a scene with multi-user and multi-party participation.

Description

Technical Field

[0001] The present invention relates to the field of information security and cryptographic technology, and in particular to a finite field-based adapter signature method and device. Background Art

[0002] With the rapid development of information technology and the Internet, electronic signatures and digital authentication have become one of the important foundations of network security. Digital signatures are widely used in the fields of electronic contracts, financial transactions, data encryption, etc. to ensure the authenticity, integrity and non-repudiation of information. However, when traditional digital signature schemes are dealing with increasingly complex network attacks, some existing signature schemes are vulnerable to replay attacks or forged signatures, and most signature schemes lack flexible matching mechanisms and cannot effectively support signature conversion or interaction in multi-user scenarios. In a signature environment that requires multi-party participation, how to ensure the flexibility and security of signatures has become an important issue. In order to solve these problems, adapter signature schemes have gradually become a research hotspot in the field of cryptography in recent years. Adapter signatures can not only ensure the security, adaptability and non-repudiation of signatures, but also support complex multi-party signature scenarios, especially for emerging applications such as blockchain. Summary of the invention

[0003] In view of this, the present invention provides an adapter signature method and device based on a finite field, which can solve the above technical problems.

[0004] In order to solve the above technical problems, the present invention is implemented as follows.

[0005] An adapter signature method based on a finite field, comprising:

[0006] Step S1: The second user obtains the public information of the first user, where the first user is a user who signs based on the object to be signed; the second user generates a pre-signature based on its own private key and the public information;

[0007] Step S2: the first user verifies the pre-signature, and after the verification is passed, the pre-signature is adapted to a formal signature;

[0008] Step S3: The second user obtains the formal signature, extracts the candidate difficult relationship evidence of the first user from the formal signature, and verifies the extracted candidate difficult relationship evidence of the first user. If the verification passes, it is determined that the candidate difficult relationship evidence is the same as the difficult relationship evidence, that is, the formal signature confirms that the first user has signed the object to be signed.

[0009] Preferably, in step S1, the second user obtains the public information of the first user, where the first user is a user who signs based on the object to be signed; the second user generates a pre-signature based on its own private key and the public information, including:

[0010] Step S11: The second user obtains the object to be signed and generates a private key x B and the public key Where g is a finite field The generator on , p is a prime number with a length of 2048 bits, x for g B Second power, for Modulo p; obtain the message M to be signed sent by the first user; select a random number k and calculate the temporary public key K = g k (mod p), g k is g to the power of k, g k (mod p) is g k Modulo p; calculate the hash value e=h(M) of the message to be signed M, where h(·) is a hash function using the SM3 algorithm, and calculate r=f(K||Y||M) through the key derivation function f(·), where K, Y, and M are the temporary public key, the public difficulty relationship of the first user, and the message to be signed, respectively, || is a connection symbol indicating string concatenation, and r is the calculation result; the object to be signed is an electronic contract or data to be encrypted, and Y=g y (modp), y is the difficult relationship evidence of the first user, g y is g to the power of y, g y (mod p) is g y module p;

[0011] Step S12: The second user generates a pre-signature And the pre-signed value sent to the first user; wherein, ex B The hash value e and the second user's private key x B The product of kr is the product of the random number k and r, ex B -kr(mod p-1) is (ex B -kr) modulo p-1.

[0012] Preferably, the step S2: the first user verifies the pre-signature, and after the verification is passed, adapts the pre-signature to a formal signature, including:

[0013] The first user obtains the pre-signature Calculate separately and Xe (mod p); where is the value calculated in the pre-signature, indicating the value of g Power, K r is the temporary public key K to the power of r, X e is the e-th power of the public key X of the second user, X e (mod p) is X e module p;

[0014] if Equal to X e (mod p), the verification is successful, and the first user uses the difficult relationship evidence y, which is calculated by the following formula:

[0015]

[0016] Adapt the pre-signature to the formal signature (S, K), y -1 is the inverse of y, for Modulo p-1.

[0017] Preferably, the step S3: the second user obtains the formal signature, extracts the candidate difficult relationship evidence of the first user from the formal signature; verifies the extracted candidate difficult relationship evidence of the first user, and if the verification passes, determines that the candidate difficult relationship evidence is the same as the difficult relationship evidence, including:

[0018] The second user obtains the official signature and extracts the candidate difficult relationship evidence of the first user from the official signature. The extraction formula is as follows:

[0019]

[0020] Among them, y′ is the candidate difficult relation evidence, S -1 is the inverse of the formal signature S, for modulo p-1;

[0021] Verify the extracted candidate difficult relationship evidence of the first user and calculate g y′ and Y(modp), where g y′ is g raised to the power of y′, Y(mod p) is Y modulo p;

[0022] If g y′ If it is equal to Y(mod p), the verification is successful;

[0023] If the verification is successful, it is determined that y′ is the same as the difficult relationship evidence.

[0024] Preferably, the difficult relationship evidence y is associated with the identity information of the first user, and is one of a private key, a cryptographic certificate, and a biometric feature of the first user.

[0025] An adapter signature device based on a finite field, comprising:

[0026] The device comprises:

[0027] Pre-signature module: configured to obtain the public information of the first user for the second user, where the first user is a user who signs based on the object to be signed; the second user generates a pre-signature based on its own private key and the public information;

[0028] Adaptation module: configured to verify the pre-signature for the first user, and after the verification is passed, adapt the pre-signature to a formal signature;

[0029] Verification module: configured to obtain the formal signature for the second user, extract the candidate difficult relationship evidence of the first user from the formal signature; verify the extracted candidate difficult relationship evidence of the first user, and if the verification passes, determine that the candidate difficult relationship evidence is the same as the difficult relationship evidence, that is, the formal signature confirms that the first user has signed the object to be signed.

[0030] The present invention provides a computer-readable storage medium, wherein a plurality of instructions are stored in the storage medium; the plurality of instructions are used for a processor to load and execute the method as described above.

[0031] An electronic device provided by the present invention is characterized in that the electronic device comprises:

[0032] A processor, which is used to execute multiple instructions;

[0033] A memory for storing a plurality of instructions;

[0034] The plurality of instructions are used to be stored by the memory and loaded and executed by the processor to implement the method as described above.

[0035] Beneficial effects:

[0036] (1) The present invention combines hash functions, key derivation functions and random number generation to provide higher security and efficiency for digital signatures, and is widely used in digital authentication, electronic signatures, blockchain and other scenarios requiring high-security signatures;

[0037] (2) The present invention is efficient, secure and highly adaptable, and can ensure the secure generation, verification and traceability of signatures in scenarios with multiple users and multiple parties, ensuring that only users who have evidence of difficult relationships can complete signature conversion;

[0038] (3) The present invention introduces a random number k in the signature generation process, combined with the discrete logarithm problem, so that attackers cannot infer the private key or forge a valid signature through a known signature sample. The signature adaptation process relies on the user's difficult relationship evidence y. Only users who have the evidence can complete the signature conversion, which enhances the security of the signature process. Through the extraction algorithm, any legal formal signature can extract the difficult relationship evidence y, ensuring the traceability of the signature and preventing the signer from denying his participation in the signing behavior. At the same time, the signer cannot deny his participation in the signing behavior afterwards, which enhances the legal effect and credibility of the signature. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flow chart of the adapter signature method based on finite fields of the present invention;

[0040] Figure 2 It is an interactive schematic diagram of the adapter signature method based on a finite field of the present invention;

[0041] Figure 3 This is a schematic diagram of the pre-signature generation and verification process of the present invention;

[0042] Figure 4 A schematic diagram of the signature adaptation and difficulty relationship evidence extraction process of the present invention;

[0043] Figure 5 It is a schematic diagram of the structure of the adapter signature device based on the finite field of the present invention. DETAILED DESCRIPTION

[0044] The present invention is described in detail below in conjunction with the accompanying drawings and embodiments.

[0045] like Figure 1-Figure 2 As shown, the present invention proposes an adapter signature method based on a finite field, the method comprising:

[0046] Step S1: The second user obtains the public information of the first user, where the first user is a user who signs based on the object to be signed; the second user generates a pre-signature based on its own private key and the public information;

[0047] Step S2: the first user verifies the pre-signature, and after the verification is passed, the pre-signature is adapted to a formal signature;

[0048] Step S3: The second user obtains the formal signature, extracts the candidate difficult relationship evidence of the first user from the formal signature, and verifies the extracted candidate difficult relationship evidence of the first user. If the verification passes, it is determined that the candidate difficult relationship evidence is the same as the difficult relationship evidence, that is, the formal signature confirms that the first user has signed the object to be signed.

[0049] In the present invention, if the verification is successful, it is determined that the candidate difficult relationship evidence is the same as the difficult relationship evidence, that is, the formal signature confirms that the first user has signed the object to be signed, thereby ensuring the authenticity and non-repudiation of the formal signature.

[0050] In step S1, the second user obtains the public information of the first user, where the first user is a user who signs based on the object to be signed; the second user generates a pre-signature based on its own private key and the public information, including:

[0051] Step S11: The second user obtains the object to be signed and generates a private key x B and the public key Where g is a finite field The generator on , p is a prime number with a length of 2048 bits, x for g B Second power, for Modulo p; obtain the message M to be signed sent by the first user; select a random number k and calculate the temporary public key K = g k (mod p), g k is g to the power of k, g k (mod p) is g k modulo p; calculate the hash value e=h(M) of the message to be signed M, where h(·) is a hash function using the SM3 algorithm, and calculate r=f(K||Y||M) through the key derivation function f(·), where K, Y, and M are respectively a temporary public key, a public hard relation of the first user, and the message to be signed, and || is a connection symbol indicating string concatenation; the object to be signed is an electronic contract or data to be encrypted, and Y=g y (mod p), y is the difficult relationship evidence of the first user, g y is g to the power of y, g y (mod p) is g y module p;

[0052] Step S12: The second user generates a pre-signature And the pre-signed value sent to the first user; wherein, ex B The hash value e and the second user's private key x B The product of kr is the product of the random number k and r, ex B -kr(mod p-1) is (ex B -kr) modulo p-1.

[0053] The step S2: the first user verifies the pre-signature, and after the verification is passed, adapts the pre-signature to a formal signature, including:

[0054] The first user obtains the pre-signature Calculate separately in, is the value calculated in the pre-signature, indicating the value of g Power, K r is the temporary public key K to the power of r, X e is the e-th power of the public key X of the second user, X e (mod p) is X e module p;

[0055] if Equal to X e (mod p), the verification is successful, and the first user uses the difficult relationship evidence y, which is calculated by the following formula:

[0056]

[0057] Adapt the pre-signature to the formal signature (S, K), y -1 is the inverse of the difficult relation evidence y, for Modulo p-1.

[0058] In the present invention, K r Used to ensure the randomness and uniqueness of the signature generation process, Used to confirm the validity of the signature during the verification process, X e Used to verify the legitimacy of the signature.

[0059] The step S3: the second user obtains the official signature, extracts the candidate difficult relationship evidence of the first user from the official signature; verifies the extracted candidate difficult relationship evidence of the first user, and if the verification passes, determines that the candidate difficult relationship evidence is the same as the difficult relationship evidence, including:

[0060] The second user obtains the official signature and extracts the candidate difficult relationship evidence of the first user from the official signature. The extraction formula is as follows:

[0061]

[0062] Among them, y′ is the candidate difficult relation evidence, S -1 is the inverse of the formal signature S, for modulo p-1;

[0063] Verify the extracted candidate difficult relationship evidence of the first user and calculate g y′ and Y(modp), where g y′ is g raised to the power of y′, Y(mod p) is Y modulo p;

[0064] If g y′ If it is equal to Y(mod p), the verification is successful;

[0065] If the verification is successful, it is determined that y′ is the same as the difficult relationship evidence.

[0066] Furthermore, the difficult relationship evidence y is associated with the identity information of the first user, such as the private key, cryptographic certificate, biometric data, etc. of the first user.

[0067] The present invention introduces a random number k when generating a pre-signature and ensures that k≠0, avoiding the generation of an invalid temporary public key K=1, effectively improving the uniqueness and anti-attack property of the signature and avoiding replay attacks; using the national cryptographic algorithm SM3 as the hash function, combined with the key derivation function f(K||Y||M), improves the randomness and anti-collision property of the pre-signature, ensuring the high security of the signature generation process. The extraction algorithm can safely extract the first user's difficult relationship evidence y from the formal signature (S, K), and confirm the legitimacy of the signature through verification, thereby enhancing the traceability and verification validity of the signature; the formal signature contains the first user's difficult relationship evidence y to ensure that the signature is non-repudiable, so that the signer cannot deny the act of participating in the signing, thereby enhancing the legal effect of the signature; the adaptation signature is implemented based on the first user's difficult relationship evidence y, so even if an attacker obtains the pre-signature It is also impossible to generate a legal formal signature without y, ensuring the security of the adaptation process, and guaranteeing the unforgeability and non-repudiation of the signature by binding the difficult relationship evidence with the user identity.

[0068] The present invention is based on finite fields The public key cryptosystem based on the discrete logarithm problem is used to ensure the security of the signature scheme. A public-private key pair is constructed using a 2048-bit prime number p and a generator g, and signature generation and verification are performed based on this.

[0069] The present invention designs four main algorithms, namely a pre-signature generation algorithm, a pre-signature verification algorithm, an adaptation algorithm and an extraction algorithm.

[0070] The present invention uses the SM3 hash function and the key derivation function f(·) to ensure the anti-collision and randomness of the signature.

[0071] The present invention provides an embodiment of an adapter signature method based on a finite field.

[0072] System Initialization

[0073] In the adapter signature scheme of the present invention, the system initialization phase is used to generate the user's public-private key pair and difficult relationship evidence, providing a basis for subsequent signature generation and verification.

[0074] The second user's private key and public key generation: The second user randomly selects a private key x B , by calculating Get the public key X of the second user, where g is a finite field The generator of X is public and available to the first user and other verification parties, while x B It is private and is used only for signature generation.

[0075] User 1 generates a difficult relationship evidence: The first user randomly selects a difficult relationship evidence y for the signature adaptation process and calculates the public difficult relationship Y = g y (mod p), the first user discloses Y to the second user, but retains y as private information for subsequent signature adaptation and verification processes.

[0076] Pre-signature generation

[0077] The second user generates a pre-signature: The second user receives the first user's public difficulty relationship Y and the message to be signed M∈{0,1} * , randomly select a temporary key k to enhance the randomness and uniqueness of the pre-signature, and calculate the corresponding temporary public key K = g k (mod p). Calculate the hash value e=h(M) of the message M, where h(·) is the SM3 hash function to ensure the message's anti-collision performance; use the key derivation function f(K||Y||M) to calculate the derived value r, which combines the temporary public key K, the difficult relation Y, and the message M to ensure the randomness and unpredictability of the generated derived value. Use the private key x of the second user B And the calculated e and r, generate a pre-signature

[0078]

[0079] The second user generates a pre-signed Sent to the first user as the pre-signature value Value_PreSign for subsequent verification and adaptation operations by the first user.

[0080] Pre-signature verification

[0081] The first user verifies the pre-signature of the second user: the first user receives the pre-signature value sent by the second user To ensure that the message sent by the second user has not been tampered with, the first user verifies the message using the verification algorithm Verify and calculates the hash value e′=h(M) of the message M, where h(·) is the hash function selected by the second user. r′=f(K||Y||M) is calculated to ensure that the derived value during verification is consistent with that of the second user, preventing the pre-signature from being tampered with during transmission. The first user uses the public key of the second user Verify and check whether the pre-signature satisfies the following equation:

[0082]

[0083] If the verification passes (i.e. the equation holds true), the first user receives the signature and outputs true, otherwise it outputs false and rejects the pre-signature.

[0084] Signature Adaptation

[0085] After the first user verifies the pre-signature of the second user, the first user can convert the pre-signature into a formal signature through an adaptation algorithm. The adaptation process relies on the difficult relationship evidence y held by the first user.

[0086] The first user converts the pre-signature into a formal signature: After verifying the legitimacy of the pre-signature, the first user uses his own difficult relationship evidence y and the pre-signature The pre-signature is Adapted to S:

[0087]

[0088] where y -1 It is the inverse element of the first user's difficult relationship evidence y under modulo p-1, ensuring that only the first user can convert the pre-signature into a legal formal signature. After outputting the formal signature (S, K), that is, Value_Sign, it is sent to the second user. At this point, the second user can verify the signature and extract the first user's difficult relationship evidence y through the extraction algorithm.

[0089] Difficult Relationship Evidence Extraction

[0090] The second user extracts the difficult relationship evidence from the formal signature: After receiving the formal signature (S, K) and pre-signature of the first user, the second user and the open difficult relationship Y=g y (modp), the validity of the signature is verified by the extraction algorithm, and the first user's difficult relationship evidence y is tried to be extracted from the signature. And the formal signature S is calculated as follows:

[0091]

[0092] In order to verify the legitimacy of the extracted y′, the second user verifies whether y′ satisfies:

[0093] g y′ =Y(modp)

[0094] If the verification is successful, the second user confirms that y′ is a valid difficult relationship evidence y, confirms that the signature is legal, and outputs the extraction result y′; if the verification fails, the second user extracts the failure symbol ⊥.

[0095] Security Analysis

[0096] The adapter signature scheme of the present invention ensures the unforgeability, adaptability, extractability and non-repudiation of the signature through a multi-level security design:

[0097] Unforgeability: Since signature generation depends on the private key x of the second user B , random number k and the first user’s difficult relationship evidence y. Without knowing these parameters, the adversary cannot forge a valid signature.

[0098] Adaptability: The signature adaptation process completely relies on the first user’s difficult relationship evidence y, ensuring that only users who have the difficult relationship evidence can convert the pre-signature into a formal signature.

[0099] Extractability: The formal signature contains the first user’s difficult relationship evidence y. The second user can safely extract the difficult relationship evidence through the extraction algorithm and verify the legitimacy of the signature.

[0100] Non-repudiation: Since the generation of the formal signature depends on the first user’s difficult relationship evidence y, and the extraction algorithm can extract this evidence from the signature, it ensures that the first user cannot deny his participation in the signing process.

[0101] The present invention provides a highly secure and adaptable signature scheme through the multi-level design of signature generation, verification, adaptation and extraction, which is particularly suitable for application scenarios with high security requirements such as blockchain, electronic contracts and digital currencies.

[0102] The present invention also provides an adapter signature device based on a finite field, the device comprising:

[0103] The device comprises:

[0104] Pre-signature module: configured to obtain the public information of the first user for the second user, where the first user is a user who signs based on the object to be signed; the second user generates a pre-signature based on its own private key and the public information;

[0105] Adaptation module: configured to verify the pre-signature for the first user, and after the verification is passed, adapt the pre-signature to a formal signature;

[0106] Verification module: configured to obtain the formal signature for the second user, extract the candidate difficult relationship evidence of the first user from the formal signature; verify the extracted candidate difficult relationship evidence of the first user, and if the verification passes, determine that the candidate difficult relationship evidence is the same as the difficult relationship evidence, that is, the formal signature confirms that the first user has signed the object to be signed.

[0107] The above specific embodiments only describe the design principle of the present invention. The shapes and names of the components in the description may be different and are not limited. Therefore, those skilled in the art in the field of the present invention may modify or replace the technical solutions recorded in the above embodiments; and these modifications and replacements do not deviate from the creative purpose and technical solutions of the present invention and should all fall within the protection scope of the present invention.

Claims

1. A finite field based adapter signature method, characterized in that: The method comprises: Step S1: The second user obtains the public information of the first user, where the first user is a user who signs based on the object to be signed; the second user generates a pre-signature based on its own private key and the public information; Step S2: the first user verifies the pre-signature, and after the verification is passed, the pre-signature is adapted to a formal signature; Step S3: The second user obtains the formal signature, extracts the candidate difficult relationship evidence of the first user from the formal signature, and verifies the extracted candidate difficult relationship evidence of the first user. If the verification passes, it is determined that the candidate difficult relationship evidence is the same as the difficult relationship evidence, that is, the formal signature confirms that the first user has signed the object to be signed.

2. The method according to claim 1, characterized in that In step S1, the second user obtains the public information of the first user, where the first user is a user who signs based on the object to be signed; The second user generates a pre-signature based on his own private key and the public information, including: Step S11: The second user obtains the object to be signed and generates a private key x B and the public key Where g is a finite field The generator on , p is a prime number with a length of 2048 bits, x for g B Second power, for Modulo p; obtain the message M to be signed sent by the first user; select a random number k and calculate the temporary public key K = g k (modp), g k is g to the power of k, g k (mod p) is g k Modulo p; calculate the hash value e=h(M) of the message to be signed M, where h(·) is a hash function using the SM3 algorithm, and calculate r=f(K‖Y‖M) through the key derivation function f(·), where K, Y, and M are the temporary public key, the public difficulty relationship of the first user, and the message to be signed, respectively, || is a connection symbol indicating string concatenation, and r is the calculation result; the object to be signed is an electronic contract or data to be encrypted, and Y=g y (mod p), y is the difficult relationship evidence of the first user, g y is g to the power of y, g y (mod p) is g y module p; Step S12: The second user generates a pre-signature And the pre-signed value sent to the first user; wherein, ex B The hash value e and the second user's private key x B The product of kr is the product of the random number k and r, ex B -kr(mod p-1) is (ex B -kr) modulo p-1.

3. The method according to claim 1, characterized in that The step S2: the first user verifies the pre-signature, and after the verification is passed, adapts the pre-signature to a formal signature, including: The first user obtains the pre-signature Calculate separately and X e (mod p); where is the value calculated in the pre-signature, indicating g Power, K r is the temporary public key K to the power of r, X e is the e-th power of the public key X of the second user, X e (mod p) is X e module p; if Equal to X e (mod p), the verification is successful, and the first user uses the difficult relationship evidence y, which is calculated by the following formula: Adapt the pre-signature to the formal signature (S, K), y -1 is the inverse of y, for Modulo p-1.

4. The method according to claim 1, characterized in that The step S3: the second user obtains the official signature, extracts the candidate difficult relationship evidence of the first user from the official signature; verifies the extracted candidate difficult relationship evidence of the first user, and if the verification passes, determines that the candidate difficult relationship evidence is the same as the difficult relationship evidence, including: The second user obtains the official signature and extracts the candidate difficult relationship evidence of the first user from the official signature. The extraction formula is as follows: Among them, y′ is the candidate difficult relation evidence, S -1 is the inverse of the formal signature S, for modulo p-1; Verify the extracted candidate difficult relationship evidence of the first user and calculate g y′ and Y(mod p), where g y′ is g raised to the power of y′, Y(mod p) is Y modulo p; If g y′ If it is equal to Y(mod p), the verification is successful; If the verification is successful, it is determined that y′ is the same as the difficult relationship evidence.

5. The method according to any one of claims 1 to 4, characterized in that The difficult relationship evidence y is associated with the identity information of the first user, and is one of the private key, cryptographic certificate, and biometric feature of the first user.

6. An adapter signature device based on a finite field, characterized in that: The device comprises: Pre-signature module: configured to obtain the public information of the first user for the second user, where the first user is a user who signs based on the object to be signed; the second user generates a pre-signature based on its own private key and the public information; Adaptation module: configured to verify the pre-signature for the first user, and after the verification is passed, adapt the pre-signature to a formal signature; Verification module: configured to obtain the formal signature for the second user, extract the candidate difficult relationship evidence of the first user from the formal signature; verify the extracted candidate difficult relationship evidence of the first user, and if the verification passes, determine that the candidate difficult relationship evidence is the same as the difficult relationship evidence, that is, the formal signature confirms that the first user has signed the object to be signed.

7. A computer-readable storage medium, characterized in that: The storage medium stores a plurality of instructions; the plurality of instructions are used for a processor to load and execute the method as described in any one of claims 1 to 5.

8. An electronic device, characterized in that: The electronic device comprises: A processor, which is used to execute multiple instructions; A memory for storing a plurality of instructions; The plurality of instructions are used to be stored in the memory and loaded and executed by the processor according to any one of claims 1 to 5.

Images