Multiple signature method based on SIS trap door one-way function

Abstract

The invention discloses a multi-signature method based on an SIS trap door one-way function. The multi-signature method comprises the following steps: (1) Setup step: a trusted party takes a safety parameter as a public parameter required by an input and output scheme; (2) a KeyGen step: each signer outputs a public and private key pair by taking a public parameter as input; (3) Sign step: each signer takes the private key, the public key, the public parameter and the message as input and outputs a single signature for the message; (4) AggKey step: the verifier takes the signer public key set as input and outputs an aggregation public key; and (5) Verify step: a verifier outputs a bit 1 or 0 by taking the public parameter, the aggregated public key, the message and the multiple signatures as input, which represents that verification succeeds or fails. According to the method, the key homomorphism of the SIS trap door one-way function is utilized, so that multiple signatures of the data are realized; a lattice-based cryptosystem is used, so that the attack of a quantum algorithm can be resisted; the probability verification thought is used, and the efficiency of verifying multiple signatures is improved.

Description

Technical Field

[0001] The invention belongs to the field of information security and network security, and in particular relates to a multi-signature method based on a SIS trapdoor one-way function. Background Art

[0002] Multi-Signatures (MS) is a digital signature method that enhances security and requires multiple signers to sign together. In multi-signatures, at least two or more signers are required to sign the same document or transaction to ensure the legitimacy and credibility of the document or transaction. It is usually used in scenarios where multiple users sign the same message, such as financial transactions, smart contracts, and cryptocurrency transactions. The main purpose is to prevent errors or malicious behavior by a single signer. Its advantage is that it allows a group of signers to jointly generate a multi-signature for the same message, and the validity of the multi-signature can be verified by any entity that holds the signer's public key set. Compared with ordinary digital signatures, multi-signatures achieve signature compression and fast verification, and have the characteristics of high throughput, small storage space, and fast verification speed.

[0003] With the continuous development of quantum computing technology, the emergence of quantum computers will bring severe challenges to the existing information security system. The traditional public key cryptography system faces the threat of being cracked by quantum computers. Research on post-quantum cryptography is crucial to ensure future information security. Lattice cryptography, as a post-quantum cryptography system, is recognized to be able to resist quantum attacks. The security of lattice cryptography is based on some difficult lattice problems, which have been proven to be difficult in mathematics and difficult to solve within an effective time even with quantum computers. Secondly, lattice cryptography has potential computational efficiency. Compared with other post-quantum cryptography systems, lattice cryptography mainly uses modular addition and modular multiplication operations of small integers. This makes lattice cryptography relatively low in computational complexity. In addition, the algebraic structure of lattice cryptography is simple, which is easy to implement in software and hardware. At the same time, lattice cryptography is a linear cryptography, and its special geometric structure has inherent advantages in the design of fully homomorphic cryptography. Therefore, studying multiple digital signatures on lattices is of great significance to improving the security, quantum resistance, flexibility and efficiency of signatures.

[0004] In 2016, Bansarkhani and Sturm[1] (see R. El Bansarkhani and J. Sturm, “An Efficient Lattice-Based Multisignature Scheme with Applications to Bitcoins,” in Cryptology and Network Security, S. Foresti and G. Persiano, Eds., in Lecture Notes in Computer Science, vol. 10052. Cham: Springer International Publishing, 2016, pp. 140–155.) proposed the first provably secure lattice-based multi-signature scheme under the random oracle model, describing how the constructed multi-signature scheme can be converted into a lattice-based aggregate signature scheme. However, the scheme requires multiple parties to interact, and the generated signatures may not meet the requirements, and there is a possibility of restarting the signature protocol. In 2022, et al. [2] (see I. C.Orlandi, A.Takahashi, and M.Tibouchi, "Two-Round n-out-of-nand Multi-signatures and Trapdoor Commitment from Lattices," in Public-Key Cryptography–PKC 2021, J. A. Garay, Ed., in Lecture Notes in Computer Science, vol. 12710. Cham: Springer International Publishing, 2021, pp. 99–130.) constructed an n-out-of-n distributed multi-signature protocol based on the FSwA (Fiat–Shamir with Aborts) type, which relies on the difficulty of the learning error (LWE) and the short integer solution (SIS) problem. In addition, the article proposes the first two-round multi-signature protocol, which reduces communication overhead and improves protocol efficiency, and further promotes the development of FSwA-based multi-signatures. Boschini et al. [3] (see C. Boschini, A. Takahashi, and M. Tibouchi, “MuSig-L: Lattice-Based Multi-signature with Single-Round Online Phase,” in Advances in Cryptology–CRYPTO 2022, Y. Dodis and T. Shrimpton, Eds., in Lecture Notes in Computer Science, vol. 13508. Cham: Springer Nature Switzerland, 2022, pp. 276–305.) proposed a lattice-based multi-signature scheme MuSig-L, which for the first time simultaneously achieved the design goals of concurrent security, single-round online phase, and key aggregation. Compared with previous schemes, MuSig-L allows participants to preprocess the first round of “commitment” messages before receiving the message to be signed, so that only the final response value needs to be communicated in the online phase.

[0005] In 1996, cryptographer Ajtai[4] (see M. Ajtai, “Generating hard instances of lattice problems (extended abstract),” in Proceedings of the twenty-eighth anniversary ACM symposium on Theory of computing-STOC'96, Philadelphia, Pennsylvania, United States: ACM Press, 1996, pp. 99–108.) proposed the SIS one-way function implemented in integer lattices: given a uniformly random matrix And parameters n,m,q,β, define the input short vector The SIS one-way function is f A (x) = Axmodq.

[0006] Gentry et al. [5] (see C. Gentry, C. Peikert, and V. Vaikuntanathan, “Trapdoors for hard lattices and new cryptographic constructions,” in Proceedings of the fortieth annual ACM symposium on Theory of computing, Victoria British Columbia Canada: ACM, May 2008, pp. 197–206.) constructed a SIS trapdoor one-way function using the preimage sampleable function. Given matrix parameters n, m, q satisfying q = poly(n) and m ≥ 5nlogq, the TrapGen(m, n, q) algorithm is used to output a random uniform matrix and The trapdoor basis T on satisfies ||T||vO(nlogq). Let Gaussian parameters The matrix A defines a SIS trapdoor one-way function f A (x) = Axmodq, The trapdoor basis T is f A For the vector y = Axmodq, there is a probabilistic polynomial time algorithm that uses the trap door T and the SamplePre(T, s, y) algorithm to statistically approximate a Gaussian distribution. Sampling to find y in f A (x) = the original image x under ymodq.

[0007] SIS trapdoor one-way function f A (x) = Axmodq itself has key homomorphism, that is, Therefore, it is suitable for constructing multi-signatures. However, no scholar has constructed multi-signatures based on SIS trapdoor one-way functions. Summary of the invention

[0008] The purpose of the present invention is to provide a multi-signature method based on SIS trapdoor one-way function, which utilizes the key homomorphism of the SIS trapdoor one-way function to realize multi-signature of data, uses a lattice-based cryptographic system to resist the attack of quantum algorithm, uses the probabilistic verification idea, and improves the efficiency of verifying multi-signature.

[0009] The present invention is achieved by adopting the following technical solutions:

[0010] A multi-signature method based on a SIS trapdoor one-way function, comprising:

[0011] Step 1: Initialization step Setup(λ) → params: The trusted party takes the security parameter λ as input and outputs the public parameters required by the scheme params = (n, m, q, s); where n is the dimension of the signed vector, a prime number Integer m ≥ 5n logq, Gaussian parameter s is a real number; let It is a secure and collision-resistant hash function;

[0012] Step 2: Key generation step KeyGen(params)→(sk i ,pk i ): Each signer U i (i∈[1,k]) takes the public parameters params=(n,m,q,s,H) as input and runs the TrapGen(n,m,q) algorithm to generate the matrix Dative Trapdoor i , output the public key pk i ←(A i ), the private key is sk i ←(T i ), where pk i =A i is a uniform random matrix, A i Defines a SIS one-way function f Ai (x) = A i σ i modq;

[0013] Step 3: Signature step Sign(sk i ,pk i ,M,H,params)→e i: Signed by U i Calculate h = H(M), expressed as h = (h1,h2,…,h n ), calculate the vector t to satisfy At = hmodq, and use SamplePre(T i ,s,-t) algorithm outputs t′ and calculates e i =t+t'modq as the signature of message M;

[0014] Step 4: Public key aggregation step AggKey(pk1,…,pk k )→APK: The verifier obtains k public key matrices A1, A2, ..., A from k signers k Randomly select n row vectors from , and concatenate these row vectors to form an aggregate public key;

[0015] Step 5: Verify step Verify(params,APK,m,σ)→b: The verifier takes public parameters params, aggregate public key APK, message m and multi-signature σ as input, and outputs a bit b∈{0,1}; if b=1, it means that the multi-signature is legal, if b=0, it means that the multi-signature is illegal; in the AggKey algorithm, the mapping σ is a one-to-one random mapping from {1,2,...,n} to the row vector set A; for each l=1,2,...,n, σ(l) represents the l-th row vector of the cascade in APK, which comes from a certain original matrix A i The jth row of a i,j .

[0016] A further improvement of the present invention is that in step 1, the public parameters generated by the trusted party are public parameters of the lattice cryptographic system.

[0017] A further improvement of the present invention is that in step 2, the public key generated by the signer is a random uniform matrix, the private key is a trapdoor basis of the dual lattice of the lattice with the random uniform matrix as the lattice basis, and a SIS trapdoor one-way function is defined corresponding to the public key.

[0018] A further improvement of the present invention is that in step 3, the signature process is performed using a trapdoor sk i The preimage of the SIS one-way function is obtained, and the signature generated by the signer is the input of the SIS trapdoor one-way function.

[0019] A further improvement of the present invention is that in step 4, the verifier uses probabilistic verification in the process of aggregating the signer's public key to randomly extract part of the row vectors from each public key matrix.

[0020] A further improvement of the present invention is that in step 5, the verifier combines multiple signatures e according to the selection method of APK in step 4.

[0021] A further improvement of the present invention is that in step 5, specifically: the verifier defines a mapping τ:{1,2,...,n}→{e1,e2,...,e k}; τ will be selected from {e1,e2,...,e k} select the corresponding column vector; specifically, if σ(l) comes from A i , whether it is A i In which rows of i ; Using the mapping τ, by cascading the selected e i Column vector, construct a new nm×1 column vector e, that is, multi-signature in It means that τ(l) is transposed into a row vector and then concatenated vertically, while the outermost transposition converts the entire concatenated result into a column vector;

[0022] Define a mapping ρ:{1,2,…,n}→{h1,h2,…,h n}, according to the row index of the selected row vector of σ, from {h1,h2,…,h n} select the corresponding component, that is, if σ(l)→a i,j , then ρ(l)→{h j};

[0023] A validator receives a multi-signature when the following conditions are met:

[0024] (1) (2) and

[0025] A further improvement of the present invention is that in step 5, the signature verification process is a process of forward calculating the SIS one-way function.

[0026] The present invention has at least the following beneficial technical effects:

[0027] 1. The present invention is a multi-signature technology. The multi-signature technology can verify the digital signatures of multiple signers for the same message at one time. Compared with ordinary digital signatures that require one-by-one verification of signatures, the multi-signature technology can easily verify whether there are illegal signatures among many signatures, greatly saving computing overhead and reducing signature verification time.

[0028] Implementation method: In steps 4 and 5 of the technical solution, the matrix multiplication homomorphism of the SIS trapdoor one-way function is used. and Natural Using (A1||A2) as the aggregate public key and (σ1||σ2) as the aggregate signature can produce the beneficial effect of multi-signature.

[0029] 2. The present invention is a multi-digital signature technology that is resistant to quantum attacks. Quantum-resistant multi-signature technology is a more secure multi-signature technology that can resist quantum computers. Even if the adversary uses a quantum algorithm, it cannot forge the multi-signature of the signer.

[0030] Implementation: In step 1 of the technical solution, by selecting appropriate solution parameters, it can be ensured that the SIS function corresponding to the public key in step 2 It is one-way collision-resistant and ensures that the signature output by the SamplePre algorithm in step 3 is uniformly random. SIS function The one-way anti-collision property of is based on lattice-hard problems. Currently, there are no known classical and quantum algorithms that can quickly solve these lattice-hard problems.

[0031] 3. The present invention is a multiple digital signature technology with an efficient probabilistic verification method.

[0032] Implementation: In step 4, the verifier does not concatenate all public key matrices together as an aggregate public key, but randomly selects n row vectors from the k public key matrices of k signers, and then concatenates these row vectors to form an aggregate public key. In step 5, the verifier combines multiple signatures and verification messages according to the selection method of the aggregate public key in step 4. Steps 4 and 5 use the classical probability model to reduce the verification equation In the case of various parameter sizes, the legitimacy of the multi-signature can be determined with a high probability, that is, whether there are illegal signatures in the multi-signature.

[0033] The classical probability model is a basic concept in probability theory. It is applicable to situations where all possible outcomes are finite and the probability of each outcome occurring is equal. It has the following characteristics:

[0034] (1) Equal likelihood: In the classical probability model, each elementary event (i.e., each possible outcome) is considered equally likely. This means that the probability of any elementary event occurring is the same.

[0035] (2) Finiteness: The sample space (i.e., the set of all possible outcomes) in the classical probability model is finite. This means that the number of possible outcomes can be counted, not infinite.

[0036] (3) Mutual Exclusivity and Completeness: In the classical probability model, the basic events in the sample space are mutually exclusive (i.e., they cannot occur at the same time) and complete (i.e., they contain all possible outcomes).

[0037] In this method, in order to determine the legitimacy of the multi-signature, the classical probability model is used to analyze the probability that the verification condition is not satisfied in step 5. First, several key variables are defined, where n is the number of row vectors of the public key matrix, x is the number of illegal row vectors (the inner product of a row vector and an illegal signature is not equal to the corresponding message component), and k is the number of signers.

[0038] According to the random selection method in this method, the probability that the multi-signature cannot pass the verification is:

[0039]

[0040] Since the signatures generated in step 3 are uniformly random, if there are illegal signatures, x is close to n, so the probability that the multi-signature cannot be verified is close to 1. This means that as long as there are illegal signatures, the multi-signature can be verified to be illegal through an efficient probabilistic verification method. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a flowchart of the multi-signature method based on the SIS trapdoor one-way function. DETAILED DESCRIPTION

[0042] The present invention is further described in detail below in conjunction with specific embodiments, but the implementation of the present invention is not limited thereto. The following content is a further detailed description of the present invention in conjunction with specific preferred implementations, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

[0043] like Figure 1 As shown, the present invention provides a multi-signature method based on a SIS trapdoor one-way function, comprising the following steps:

[0044] Step 1 Setup (λ) → (params): Given the security parameter λ, the trusted party runs the Setup algorithm to generate the parameters params = (n, m, q, s). Where n is the dimension of the signed vector, a prime number For integer m ≥ 5nlogq, Gaussian parameter s is a real number. It is a secure and collision-resistant hash function. The public parameters generated by the trusted party are the public parameters of the lattice cryptographic system. As a post-quantum cryptographic system, the lattice cryptographic system can resist the attack of quantum algorithms and has high security.

[0045] Step 2KeyGen(params)→(sk i ,pk i ): Signed by U i(i∈[1,k]) takes the public parameters params=(n,m,q,s,H) as input and runs the TrapGen(n,m,q) algorithm to generate the matrix Dative Trapdoor i , output the public key pk i ←(A i ), the private key is sk i ←(T i ).

[0046] Step 3Sign(sk i ,pk i ,M,H,params)→e i :Let the message be M∈{0,1} * , signed by U i Calculate h = H(M), expressed as h = (h1,h2,…,h n ), calculate the vector t to satisfy At = hmodq, and use SamplePre(T i ,s,-t) algorithm outputs t′ and calculates e i =t+t'modq as the signature of the message M. The signature generated by the signer is the input of the SIS trapdoor one-way function. Due to the one-way and anti-collision properties of the SIS trapdoor one-way function, the signature is guaranteed to be unforgeable and the signature method is safe.

[0047] Step 4 AggKey(pk1,...,pk k .APK: The verifier obtains k public key matrices A1, A2, ..., A from k signers k Randomly select n row vectors from , and concatenate these row vectors to form an aggregate public key. The specific process is as follows:

[0048] Matrix A i Contains the row vector {a i,1 ,a i,2 ,...,a i,n}, where a i,j Yes A i The j-th row vector of Let A represent the set of all row vectors in the original matrix: The number of elements is kn. Randomly select n non-repeating row vectors from A. Define σ:{1,2,...,n}→{a 1,1 ,...,a i,j ,...,a k,n} is a one-to-one mapping from {1,2,...,n} to A, satisfying For l = 1, 2, ..., n, concatenate these n non-repeating row vectors into In the process of aggregating the signer's public key, the verifier uses the idea of ​​probabilistic verification. Instead of simply cascading all the public key matrices, it randomly extracts some row vectors from each public key matrix, reducing the size of the aggregated public key, that is, the number of rows of the aggregated public key matrix, thereby reducing the overhead of storing the aggregated public key.

[0049] Step 5Verify(APK,h,e i ,params): In the AggKey algorithm, the mapping σ is a one-to-one random mapping from {1,2,...,n} to the row vector set A. For each l=1,2,...,n, σ(l) represents the lth row vector of the cascade in APK, which comes from a certain original matrix A i The jth row of a i,j The verifier combines the multi-signatures based on the APK selection in the AggKey algorithm.

[0050] Specifically: the verifier defines a mapping τ:{1,2,...,n}→{e1,e2,...,e k}. τ will be selected from {e1,e2,...,e k Specifically, if σ(l) comes from A i , whether it is A i In which rows of i We use the mapping τ to concatenate (i.e., vertically concatenate) the selected e i Column vector, you can construct a new nm×1 column vector e, that is, multi-signature Where τ(l) T It means that τ(l) is transposed into a row vector and then vertically concatenated, and the outermost transposition converts the entire concatenated result into a column vector.

[0051] Similarly, define a mapping ρ:{1,2,...,n}→{h1,h2,…,h n}, which will select the row index of the row vector according to σ, from {h1,h2,…,h n} select the corresponding component, that is, if σ(l)→a i,j , then ρ(l)→{h j}.

[0052] A validator receives a multi-signature if and only if the following conditions are met:

[0053] (1) (2) and

[0054] The verifier uses the idea of ​​probabilistic verification and uses the same extraction method as randomly extracting the row vector of the public key matrix to extract the components of the message. This allows the verifier to verify whether the multi-signature is legal by calculating fewer matrix multiplications during verification, reducing the computational overhead of the signature verification process.

[0055] Correctness analysis of the algorithm:

[0056] In the present invention, for a message M, the signer U i Calculate h = H (M), calculate the vector t to satisfy At = h mod q, and use SamplePre (T i ,s,-t) algorithm outputs t′ and calculates e i =t+t'modq as the signature e of message M i Therefore, A i e i mod q=A i (t+t') mod q = h mod q, and

[0057] σ(l) comes from A i The jth row of a i,j , is the l-th row vector in APK, τ(l) is the corresponding signature vector e i According to the Sign algorithm, e i is the signature of message M, satisfying A i e i = hmodq, for A i Each row of a i,j , both have i,j ,e i >=h j mod q, thus:

[0058]

[0059] The norm of the multi-signature e is actually the norm of the concatenated individual signatures. These column vectors are directly derived from the individual e i , and no additional scaling or transformation is performed, so the norm of the multi-signature e should be equal to the sum of the norms of the original signature vectors, that is, For any k and any message M, the signatures e of each signer i , there is always Verify(params,APK,M,e)→1, that is and

[0060] Analysis of the unforgeability of signatures in the algorithm:

[0061] Unforgeability of a single signature​

[0062] Theorem: Assume there is an adversary If the unforgeability of a single signature in the scheme can be broken with probability ∈, then there exists a polynomial-time adversary that can break the collision resistance of the SIS one-way function. adversary Through simulation and adversary Challenger for simulated game interaction It is possible to crack the collision resistance of the SIS one-way function with a probability that is non-negligible close to ∈, thereby solving the SVP problem.

[0063] Given a uniform random matrix And parameters n,m,q,β, define the input short vector x∈{0,1} m The SIS one-way function is f A (x) = Axmodq. Reference [4] has proved that as long as m>n·log(q), f A :D n →R n is a reasonable one-way function. Without loss of generality, before performing a signature query on M, assume Query H on each message M. Define SampleDom(1 n ) is a domain D n The sampling algorithm in n , f A (x) distribution is R n Uniform distribution on .

[0064] For different M∈{0,1} * H query on, Let e M ←SampleDom(1 n ), store (M,e M ), returns f A (e M ) to the opponent If M∈{0,1} * H was asked before, Search(M,e M ) and returns f A (e M ).

[0065] when For M∈{0,1} * When asking for a signature, Find(M,e M ) and returns e M .

[0066] Without loss of generality, assume that the adversary In the output of the fake Before, for M * H questioning was conducted. produce hour, search Output As f A A pair of collisions.

[0067] adversary Perspective and The perspective provided is the same. From the adversary’s perspective, for each different M query, The returned value is f A (e M ), where e M ←SampleDom(1 n ), according to the uniform output property of SampleDom, f A (e M ) and in practice The output performance is the same. Fix the value of H(M), for each signature query of M, Returns the distribution as SampleDom(1 n ) value e M , so e M In actual systems, it is also evenly distributed.

[0068] Final Rival Output a valid signature forgery with a probability close to ∈ It is M * is a valid signature, so Formed f A A pair of collisions. Let's discuss two cases. Probability:

[0069] 1. If the opponent To M * Signature query was performed, the adversary Received M* .because is a valid forgery, so

[0070] 2. If the opponent Not for M * After the signature query is performed, the adversary * In the H inquiry, Storing Tuples return Give in Given The minimum entropy of is ω(log n), so The probability is 1-2 -ω(logn) ≈1.

[0071] Therefore, it is concluded that It can output an f with a probability that is non-negligible close to ∈ A If there are two input Make Then we can find Λ ⊥ A short vector in (A) because are all short binary vectors, so e is also short, satisfying And ||e|| ∞ =max i |e i |=1. e is Λ ⊥ Solution to the SIS problem in (A). Because the SIS problem is difficult, it is difficult to find a collision of the SIS trapdoor one-way function, and the single signature in the scheme is unforgeable.

[0072] Unforgeability of multi-signatures

[0073] Theorem: Assume there is an adversary If the unforgeability of the multi-signature in the scheme can be broken with probability ∈, then there exists a polynomial time adversary that can break the collision resistance of the SIS one-way function adversary Through simulation and adversary Challenger for simulated game interaction With non-negligible probability Resolve CVP.

[0074] prove:

[0075] Initialization phase: Given a CVP instance, including the matrix and the given vector beg The challenger copies B k times and stacks them vertically to form Copy b k times and expand it to get Challenger Use the security parameter λ to generate the public parameters params = (n, m, q, s). Where n is the dimension of the signed vector, a prime number For integer m ≥ 5n log q, the Gaussian parameter s is a real number. A secure and collision-resistant hash function. Run the KeyGen(params) algorithm to generate the matrix Dative Trapdoor i , respectively (sk i ,pk i ), pk c = C is set as the challenge public key. Keep sk secret i , return (params,pk c ,pk i ) to the opponent

[0076] H asks: c maintains an initially empty list L H , contains two types of elements: M and H(M). The maximum number of q H H query. When receiving H query, the challenger Search List L H , if there exists a corresponding M and H(M), then it is an adversary Provide H(M); otherwise, for the The challenger asked Select a random vector H(M) from the list L and add M and H(M) to the list L. H , and returns H(M) to the adversary For the i (i＝c) The challenger calculates H(M) c = Ccmodq, M and H(M) c Add to list L H , and returns H(M) c To the opponent

[0077] Signature query: Adversary query Maximum q S When the challenger receives the message M and the public key set PK={pk1,...,pk k}, if it contains pk c , the game is terminated; otherwise, the challenger runs Sign(sk i ,pk i ,M,H,params) algorithm and AggKey(PK) algorithm, use the mapping τ to construct a valid multi-signature e about the message M under PK, and return e to the adversary.

[0078] Forgery phase: The adversary outputs forged (M * ,APK * ,PK * ,e * ), if pk c ∈PK* , and Verify(params,APK * ,M * ,e * )→1, then (M * ,APK * ,PK * ,e * ) is a successful forgery. The termination condition of the simulation game in the signature query phase ensures that the adversary has not asked M * In PK * The following describes the process of the challenger using the adversary to forge and solve the CVP instance:

[0079] Since Verify(params,APK * ,M * ,e * )→1, then:

[0080] The challenger will Contained in pk c The row vectors in are selected and recombined into Similarly, from the multi-signature * According to pk c In APK * In the row vector index, find pk c The corresponding single signature e'; from H(M * ) and combine them into H(M * ) c ′. At this point, the challenger has obtained a c The public key matrix composed of row vectors A by H(M * ) is a new message vector composed of the components * ) c ′, and H(M * ) c ′ in pk c ', and the three satisfy the relationship:

[0081] pk c '·e'=H(M * ) c ′modq

[0082] In pk c In the case of ′≠B, the challenger fails to solve the CVP instance; in pk c ′=B, H(M * ) c ′=Bbmodq. e′ can be regarded as a SIS one-way function fB (x) is the original image of an output Bb. Since the parameters satisfy m>(n / k)·log(q), the SIS one-way function f B (x) is one-way and collision-resistant. The challenger constructs e′ using the multi-signature forged by the adversary, so that f B (e')=H(M * ) c ′modq=Bbmodq, which destroys f B (e') One-way. The challenger can The CVP problem on f is reduced to B (x) unidirectional: If the challenger can destroy f B The unidirectionality of (x) can be solved CVP issues on.

[0083] Since Be'modq = f B (e')=H(M * ) c ′modq=Bbmodq, obviously e′ and b are both H(M * ) c ′, but e′ is a short vector, and b is not a short vector. * ) c All pre-images of ′ (whether short or not) are expressed as can be expressed as A coset of Since B·(b-e')=0modq, (be') is Since e′ is a short vector, (b-e′) is very close to b, so (be′) is given The solution of a CVP with the target vector b is the solution of the CVP instance that the challenger needs to solve. According to the difficulty of CVP, the multi-signature in the scheme is unforgeable.

[0084] Next, we analyze the probability that the challenger can successfully crack the CVP instance using the multi-signature forged by the adversary.

[0085] Forged (M * ,APK * ,PK * ,e * ) The challenger can solve the CVP instance using the adversary’s forgery if the following conditions are met:

[0086] (a)H(M * )=c;

[0087] (b) The simulation game is not terminated during the signature inquiry phase;

[0088] (c)pk c ∈PK * , and Verify(params,APK * ,M * ,e * ) → 1

[0089] (d)pk c ′=B;

[0090] The probability that condition (a) is true is P a =1 / q H ; Condition (b) also ensures that the adversary has not asked M * In PK * The probability of the multi-signature under this condition being established is P b =1 / q S ; Condition (c) is the condition for the adversary to successfully forge defined in the security model, so the probability of its establishment is P b =∈. The probability that condition (d) is true is We conclude that if the adversary can forge multiple signatures with probability ∈, then the challenger can The probability of solving CVP.

[0091] 1. Definition of symbols in the present invention:

[0092] In the present invention, bold lowercase letters are used to represent vectors, such as vector b. Bold uppercase letters are used to represent matrices, such as matrix A. Represents the number field, represents the domain of integers modulo q. Given two vectors e1 and e2 of the same dimension,<e1,e2> represents the inner product of a vector. Let constant c>0, use ω(f(n)) to represent a function that grows faster than cf(n), and use poly(n) to represent a polynomial function f(n)=O(n c ). Use ||·|| to represent the Euclidean norm (L2 norm) of a vector. Define the norm of a matrix as the norm of its longest column vector, such as the matrix S = {s1,…,s k}, use ||S|| to represent the length of the longest column vector, that is, ||S||=max i ||s i ||, i∈[1,k]. For any matrix S, represents the matrix after Gram-Schmidt orthogonalization, Denotes the Gram-Schmidt norm. D Λ,s,c represents a Gaussian distribution with c as the center and s as the Gaussian parameter on the grid Λ. The logarithms used in this paper are all based on 2.

[0093] 2. Basic knowledge

[0094] Trapdoor Generation Algorithm

[0095] TrapGen: Given matrix parameters n, m, q such that q = poly(n) and m ≥ 5nlogq, there exists a probabilistic polynomial-time algorithm TrapGen(m, n, q) that outputs a matrix and a full-rank set The distribution of the matrix A is statistically close to uniform distribution, and ||S||≤O(nlogq), and the set S can be effectively transformed into a grid The trapdoor base T.

[0096] Pre-image sampling function

[0097] Given an n-dimensional lattice Λ(A), a trapdoor basis T, Gaussian parameters s, and a vector y, there exists a probabilistic polynomial-time algorithm SamplePre(T,s,y) that follows a Gaussian distribution D Λ(A),s,y Output a vector x∈Λ(A) that is close to y.

[0098] SIS Trapdoor One-Way Function

[0099] In 1996, cryptographer Ajtai proposed the SIS one-way function implemented in integer lattices: given a uniformly random matrix And parameters n,m,q,β, define the input short vector x∈{0,1} m The SIS one-way function is f A (x) = Axmodq, which has the following properties:

[0100] (1) Unidirectionality: When the input is x, there is an efficient algorithm to output y; when the input is y, it is difficult to output x. A The unidirectionality of (x) can be reduced to Solve the CVP problem in the dual lattice of .

[0101] (2) Collision resistance: It is difficult to find two inputs x1≠x2 such that y1=y2. A The collision resistance of (x) can be reduced to Solve the SVP problem in the dual lattice of .

[0102] (3) Pairwise independence: For two inputs x1≠x2, the outputs y1 and y2 are independent.

[0103] (4) Regularity: f A (x) maps the input space of mbit to the output space of nlogqn, which is compressible. A(x) has the property of pairwise independence. According to the residual hashing theorem, f A (x) has regularity, that is, for every element y in the output space, it has the same

[0104] The SIS trapdoor one-way function can be constructed using the original image sampleable function. Given matrix parameters n, m, q satisfying q = poly (n) and m ≥ 5nlogq, use the TrapGen (m, n, q) algorithm to output a random uniform matrix and The trapdoor basis T on satisfies ||T||≤O(nlogq). Let Gaussian parameter The matrix A defines a SIS trapdoor one-way function f A (x) = Axmodq, The trapdoor basis T is f A For the vector y = Axmodq, there is a probabilistic polynomial time algorithm that uses the trap door T and the SamplePre(T, s, y) algorithm to statistically approximate a Gaussian distribution. Sampling to find y in f A (x) = the original image x under ymodq.

[0105] Although the present invention has been described in detail above with general descriptions and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements may be made thereto based on the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all fall within the scope of protection claimed by the present invention.

Claims

1. A multi-signature method based on SIS trapdoor one-way function, characterized in that: include: Step 1: Initialization step Setup(λ)→params: The trusted party takes the security parameter λ as input and outputs the public parameters required by the scheme params=(n,m,q,s); where n is the dimension of the signed vector, a prime number Integer m ≥ 5nlogq, Gaussian parameter s is a real number; let It is a secure and collision-resistant hash function; Step 2: Key generation step KeyGen(params)→(sk i ,pk i ): Each signer U i (i∈[1,k]) takes the public parameters params=(n,m,q,s,H) as input and runs the TrapGen(n,m,q) algorithm to generate the matrix Dative Trapdoor i , output the public key pk i ←(A i ), the private key is sk i ←(T i ), where pk i =A i is a uniform random matrix, A i Defines a SIS one-way function Step 3: Signature step Sign(sk i ,pk i ,M,H,params)→e i : Signed by U i Calculate h = H(M), expressed as h = (h1,h2,…,h n ), calculate the vector t to satisfy At = hmodq, and use SamplePre(T i ,s,-t) algorithm outputs t′ and calculates e i =t+t'modq as the signature of message M; Step 4: Public key aggregation step AggKey(pk1,...,pk k )→APK: The verifier obtains k public key matrices A1, A2, ..., A from k signers k Randomly select n row vectors from , and concatenate these row vectors to form an aggregate public key; Step 5: Verify step Verify(params,APK,m,σ)→b: The verifier takes public parameters params, aggregate public key APK, message m and multi-signature σ as input, and outputs a bit b∈{0,1}; if b=1, it means that the multi-signature is legal, if b=0, it means that the multi-signature is illegal; in the AggKey algorithm, the mapping σ is a one-to-one random mapping from {1,2,...,n} to the row vector set A; for each l=1,2,...,n, σ(l) represents the l-th row vector of the cascade in APK, which comes from a certain original matrix A i The jth row of a i,j .

2. A multi-signature method based on SIS trapdoor one-way function according to claim 1, characterized in that: In step 1, the public parameters generated by the trusted party are the public parameters of the lattice cryptographic system.

3. A multi-signature method based on SIS trapdoor one-way function according to claim 1, characterized in that: In step 2, the public key generated by the signer is a random uniform matrix, and the private key is a trapdoor basis of the dual lattice of the lattice with the random uniform matrix as the lattice basis. A SIS trapdoor one-way function is defined corresponding to the public key.

4. A multi-signature method based on SIS trapdoor one-way function according to claim 1, characterized in that: In step 3, the signing process is done using the trapdoor sk i The preimage of the SIS one-way function is obtained, and the signature generated by the signer is the input of the SIS trapdoor one-way function.

5. A multi-signature method based on SIS trapdoor one-way function according to claim 1, characterized in that: In step 4, the verifier uses probabilistic verification in the process of aggregating the signer's public key and randomly extracts some row vectors from each public key matrix.

6. A multi-signature method based on SIS trapdoor one-way function according to claim 1, characterized in that: In step 5, the verifier combines the multi-signature e according to the APK selection method in step 4.

7. A multi-signature method based on SIS trapdoor one-way function according to claim 1, characterized in that: In step 5, the verifier defines a mapping τ:{1,2,...,n}→{e1,e2,...,e k }; τ will be selected from {e1,e2,...,e k } select the corresponding column vector; specifically, if σ(l) comes from A i , whether it is A i In which rows of i ; Using the mapping τ, by cascading the selected e i Column vector, construct a new nm×1 column vector e, that is, multi-signature in It means that τ(l) is transposed into a row vector and then concatenated vertically, while the outermost transposition converts the entire concatenated result into a column vector; Define a mapping ρ:{1,2,...,n}→{h1,h2,…,h n }, according to the row index of the selected row vector of σ, from {h1,h2,…,h n } select the corresponding component, that is, if σ(l)→a i,j , then ρ(l)→{h j }; A validator receives a multi-signature when the following conditions are met: (1) (2) and 8. A multi-signature method based on SIS trapdoor one-way function according to claim 1, characterized in that: In step 5, the signature verification process is the process of forward calculating the SIS one-way function.

Images