A multi-signature method based on sis trapdoor one-way function

Abstract

The application discloses a kind of based on SIS trapdoor one-way function multi-signature method, comprising the following steps: (1) Setup step: trusted party with security parameter as input, output required public parameter of scheme;(2)KeyGen step: each signer with public parameter as input, output public key pair;(3)Sign step: each signer with private key, public key, public parameter, and message as input, output single signature for message;(4)AggKey step: verifier with the public key set of signer as input, output an aggregate public key;(5)Verify step: verifier with public parameter, aggregate public key, message and multi-signature as input, output a bit 1 or 0, represent verification success or failure.The application utilizes the key homomorphism of SIS trapdoor one-way function, realizes the multi-signature of data;Use the lattice-based cryptography system, can resist quantum algorithm attack;Use the probability verification idea, improve the efficiency of verifying multi-signature.

Description

Technical Field

[0001] This invention belongs to the field of information security and network security, and specifically relates to a multi-signature method based on a trapdoor one-way function of SIS. Background Technology

[0002] Multi-signatures (MS) are a security-enhancing digital signature method that requires multiple signers to participate in the signing process. In multi-signatures, at least two or more signers must sign the same document or transaction to ensure its legitimacy and credibility. It is typically used in scenarios where multiple users sign the same message, such as financial transactions, smart contracts, and cryptocurrency transactions, primarily to prevent errors or malicious actions by a single signer. Its advantage lies in allowing a group of signers to jointly generate a multi-signature for the same message, and the validity of the multi-signature can be verified by any entity holding the set of public keys held by the signers. Compared to ordinary digital signatures, multi-signatures achieve signature compression and fast verification, featuring high throughput, small storage space, and fast verification speed.

[0003] With the continuous development of quantum computing technology, the emergence of quantum computers will pose a severe challenge to existing information security systems. Traditional public-key cryptography faces the threat of being broken by quantum computers. Research on post-quantum cryptography is crucial for ensuring future information security. Lattice cryptography, as a post-quantum cryptosystem, is widely recognized as resistant to quantum attacks. The security of lattice cryptography is based on some difficult lattice problems, which have been mathematically proven to be difficult to solve even with quantum computers in a reasonable time. Secondly, lattice cryptography has potential computational efficiency. Compared with other post-quantum cryptosystems, lattice cryptography mainly uses modular addition and modular multiplication operations of small integers. This makes lattice cryptography relatively low in computational complexity. In addition, the algebraic structure of lattice cryptography is simple, making it easy to implement in hardware and software. At the same time, lattice cryptography is a linear cryptography, and its special geometric structure has an inherent advantage in the design of fully homomorphic cryptography. Therefore, research on multiple digital signatures on lattices is of great significance for improving the security, quantum resistance, flexibility, and efficiency of signatures.

[0004] In 2016, Bansarkhani and Sturm[1] (see R. El Bansarkhani and J. Sturm, “An Efficient Lattice-Based Multisignature Scheme with Applications to Bitcoins,” in Cryptology and Network Security, S. Foresti and G. Persiano, Eds., in Lecture Notes in Computer Science, vol. 10052. Cham: Springer International Publishing, 2016, pp. 140–155.) proposed the first provably secure lattice-based multisignature scheme under the random oracle model, describing how the constructed multisignature scheme can be converted into a lattice-based aggregate signature scheme. However, the scheme requires interaction between multiple parties, and the generated signatures may not meet the requirements, posing a possibility of restarting the signature protocol. In 2022, et al. [2] (see I). C. Orlandi, A. Takahashi, and M. Tibouchi, “Two-Round n-out-of-n and Multi-signatures and Trapdoor Commitment from Lattices,” in Public-Key Cryptography–PKC 2021, J.A. Garay, Ed., in Lecture Notes in Computer Science, vol. 12710. Cham: Springer International Publishing, 2021, pp. 99–130., construct a n-out-of-n distributed multi-signature protocol based on the FSwA (Fiat–Shamir with Aborts) type. The protocol relies on the difficulty of the learning error (LWE) and short integer solutions (SIS) problems. Furthermore, the paper proposes the first two-round multi-signature protocol, reducing communication overhead and improving protocol efficiency, and further advancing the development of FSwA basic multi-signatures. Boschini et al. [3] (see C. Boschini, A. Takahashi, and M. Tibouchi, “MuSig-L: Lattice-Based Multi-signature with Single-Round Online Phase,” in Advances in Cryptology–CRYPTO 2022, Y. Dodisand T. Shrimpton, Eds., in Lecture Notes in Computer Science, vol. 13508. Cham: Springer Nature Switzerland, 2022, pp. 276–305.) proposed the lattice-based multi-signature scheme MuSig-L, which for the first time simultaneously achieved design goals such as concurrent security, single-round online phase, and key aggregation. Compared with previous schemes, MuSig-L allows participants to preprocess the first round of “commitment” messages before receiving the messages to be signed, so that only the final response value needs to be communicated during the online phase.

[0005] In 1996, cryptographer Ajtai[4] (see M. Ajtai, “Generating hard instances of lattice problems (extended abstract),” in Proceedings of the 28-houranual ACM symposium on Theory of computing-STOC'96, Philadelphia, Pennsylvania, United States: ACM Press, 1996, pp. 99–108.) proposed a one-way SIS function implemented in an integer lattice: given a uniformly random matrix And parameters n, m, q, β, define the short input vector The one-way function of SIS is f A (x) = Axmodq.

[0006] Gentry et al. [5] (see C. Gentry, C. Peikert, and V. Vaikuntanathan, “Trapdoors for hard lattices and new cryptographic constructions,” in Proceedings of the fortieth annual ACM symposium on Theory of computing, Victoria British Columbia Canada: ACM, May 2008, pp. 197–206.) constructed a one-way trapdoor function for SIS using a preimage sampleable function. Given matrix parameters n, m, q satisfying q = poly(n) and m ≥ 5nlogq, the TrapGen(m,n,q) algorithm is used to output a random uniform matrix. and Let the trapdoor basis T on the surface satisfy ||T||vO(nlogq). Let the Gaussian parameter be... Matrix A defines a one-way function f for a trapdoor in SIS. A (x) = Axmodq, The trapdoor base T is f A The trapdoor. For a vector y = Axmodq, there exists a probabilistic multinomial-time algorithm that uses the trapdoor T and the SamplePre(T,s,y) algorithm to follow a statistically approximate Gaussian distribution. Sampling to obtain y in f A (x) = the preimage x under y mod q.

[0007] SIS Trapdoor One-Way Function f A (x) = Axmodq itself has key homomorphism, that is Therefore, it is suitable for constructing multi-signatures. However, to date, no scholar has constructed multi-signatures based on the SIS trapdoor one-way function. Summary of the Invention

[0008] The purpose of this invention is to provide a multi-signature method based on the SIS trapdoor one-way function. This method utilizes the key homomorphism of the SIS trapdoor one-way function to achieve multi-signature of data, uses a lattice-based cryptosystem to resist quantum algorithm attacks, and employs the idea of ​​probabilistic verification to improve the efficiency of verifying multi-signatures.

[0009] The present invention is achieved using the following technical solution:

[0010] A multi-signature method based on a trapdoor one-way function of SIS, comprising:

[0011] Step 1: Initialization Step Setup(λ) → params: The trusted party takes the security parameter λ as input and outputs the common parameters required by the scheme, params = (n, m, q, s); where n is the dimension of the vector to be signed, a prime number. Let m ≥ 5n logq, and let the Gaussian parameter s be a real number; For a safe and collision-resistant hash function;

[0012] Step 2: Key generation step KeyGen(params) → (sk i ,pk i ): Each signer U i (i∈[1,k]) takes the common parameter params=(n,m,q,s,H) as input and runs the TrapGen(n,m,q) algorithm to generate a matrix. with grid Trapdoor base T i Output public key pk i ←(A i The private key is sk. i ←(T i ); where pk i =A i Let A be a uniform random matrix. i A one-way function f of SIS is defined. Ai (x)=A i σ i modq;

[0013] Step 3: Sign (sk) i ,pk i ,M,H,params)→e iSigner U i Calculate h = H(M), expressed as h = (h1, h2, ..., h n ), calculate vector t satisfying At = h mod q, and use SamplePre(T) i The algorithm outputs t′, and calculates e. i =t+t'modq serves as the signature for message M;

[0014] Step 4: Public Key Aggregation Step AggKey(pk1,…,pk k → APK: The validator uses the public key matrix A1, A2, ..., A from the k signers. k Randomly select n row vectors and concatenate these row vectors to form an aggregate public key;

[0015] Step 5: Verification Step Verify(params,APK,m,σ) → b: The verifier takes the public parameter params, the aggregate public key APK, the message m, and the multi-signature σ as input and outputs a bit b∈{0,1}; if b=1, the multi-signature is valid, and if b=0, the multi-signature is invalid; in the AggKey algorithm, the mapping σ is a one-to-one random mapping from {1,2,...,n} to the row vector set A; for each l=1,2,...,n, σ(l) represents the l-th concatenated row vector in APK, which originates from a certain original matrix A i The j-th line a i,j .

[0016] A further improvement of the present invention is that, in step 1, the public parameters generated by the trusted party are the public parameters of the lattice cryptosystem.

[0017] A further improvement of the present invention is that, in step 2, the public key generated by the signer is a random uniform matrix, the private key is a trapdoor basis of the dual lattice of the lattice with the random uniform matrix as the basis, and the public key is defined with a corresponding SIS trapdoor one-way function.

[0018] A further improvement of this invention is that, in step 3, the signature process utilizes a trapdoor sk. i The preimage of the SIS one-way function is obtained, and the signature generated by the signer is the input of the SIS trapdoor one-way function.

[0019] A further improvement of the present invention is that, in step 4, the verifier uses probabilistic verification during the aggregation of the signer's public key, randomly selecting a portion of the row vectors from each public key matrix.

[0020] A further improvement of the present invention is that, in step 5, the verifier combines the multi-signature e according to the APK selection method in step 4.

[0021] A further improvement of this invention is that, in step 5, specifically: the verifier defines a mapping τ:{1,2,...,n}→{e1,e2,...,e k};τ will, depending on the choice of σ, be from {e1,e2,...,e k Select the corresponding column vector from A; specifically, if σ(l) comes from A i Regardless of A i In which row is τ(l)=e i Using mapping τ, select e through cascading. i Column vector, construct a new nm×1 column vector e, i.e., multi-signature. in This means that τ(l) is transposed into a row vector and then concatenated vertically, while the outermost transpose converts the entire concatenation result into a column vector;

[0022] Define a mapping ρ: {1,2,…,n} → {h1,h2,…,h n}, based on the row index of the selected row vector of σ, from {h1,h2,…,h n Choose the corresponding component in}, that is, if σ(l)→a i,j Then ρ(l)→{h j};

[0023] The verifier accepts the multi-signature when the following conditions are met:

[0024] (1) (2) and

[0025] A further improvement of the present invention is that, in step 5, the signature verification process is a process of forward calculation of the SIS one-way function.

[0026] The present invention has at least the following beneficial technical effects:

[0027] 1. This invention is a multi-signature digital signature technology. Multi-signature technology allows for the simultaneous verification of digital signatures from multiple signers for the same message. Compared to ordinary digital signatures, which require verification of each signature individually, multi-signature technology can easily verify the presence of invalid signatures among many signatures, significantly reducing computational overhead and signature verification time.

[0028] Implementation method: Steps 4 and 5 of the technical solution utilize the matrix multiplication homomorphism of the SIS trapdoor one-way function. and Of course Using (A1||A2) as the aggregate public key and (σ1||σ2) as the aggregate signature, we can achieve the beneficial effect of multi-signature.

[0029] 2. This invention is a quantum-resistant multi-signature technology. Quantum-resistant multi-signature technology is a more secure multi-signature technology that can resist quantum computers. Even if an adversary uses quantum algorithms, they will not be able to forge the signer's multi-signature.

[0030] Implementation method: In step 1 of the technical solution, by selecting appropriate solution parameters, it can be guaranteed that the SIS function corresponding to the public key in step 2 will be successful. It is unidirectionally collision-resistant, while ensuring that the signature output by the SamplePre algorithm in step 3 is uniformly random. SIS function The one-way collision resistance property is based on lattice-hard problems, and there are currently no known classical or quantum algorithms that can quickly solve these lattice-hard problems.

[0031] 3. This invention is a multi-signature technology with an efficient probabilistic verification method.

[0032] Implementation: In step 4, the verifier does not concatenate all public key matrices to form the aggregate public key. Instead, it randomly selects n row vectors from the k public key matrices of the k signers and then concatenates these row vectors to form the aggregate public key. In step 5, the verifier combines the multi-signature and verification message according to the selection method of the aggregate public key in step 4. Steps 4 and 5 utilize a classical probabilistic model to reduce the verification equation. Given all the parameter sizes, the validity of a multi-signature can be determined with a very high probability, i.e., whether there is an invalid signature in the multi-signature.

[0033] The classical probability model is a fundamental concept in probability theory. It applies to situations where there are a finite number of possible outcomes, and each outcome has an equal probability of occurring. It has the following characteristics:

[0034] (1) Equal probability: In the classical probability model, every basic event (i.e. every possible outcome) is considered to be equally likely. This means that the probability of any basic event occurring is the same.

[0035] (2) Finiteness: The sample space (i.e., the set of all possible outcomes) in the classical probability model is finite. This means that the number of possible outcomes is countable, not infinite.

[0036] (3) Mutual exclusion and completeness: In the classical probability model, the basic events in the sample space are mutually exclusive (i.e., they cannot occur at the same time) and complete (i.e., they contain all possible outcomes).

[0037] In this method, to determine the legality of multi-signatures, the probability of the verification conditions in step 5 not being met is analyzed using a classical probability model. First, several key variables are defined: n is the number of row vectors in the public key matrix, x is the number of invalid row vectors (the inner product of a row vector and an invalid signature is not equal to the corresponding message component), and k is the number of signers.

[0038] According to the random selection method in this approach, the probability that a multi-signature will fail verification is:

[0039]

[0040] Since the signatures generated in step 3 are uniformly random, if an invalid signature exists, x is close to n. Therefore, the probability that the multi-signature fails verification is close to 1. This means that as long as an invalid signature exists, the multi-signature can be verified as invalid through an efficient probabilistic verification method. Attached Figure Description

[0041] Figure 1 This is a flowchart of a multi-signature method based on a trapdoor one-way function in SIS. Detailed Implementation

[0042] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto. The following content is a further detailed description of the present invention with reference to specific preferred embodiments, and it should not be considered that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, several simple deductions or substitutions can be made without departing from the concept of the present invention, and all such deductions or substitutions should be considered to fall within the protection scope of the present invention.

[0043] like Figure 1 As shown, the present invention provides a multi-signature method based on a SIS trapdoor one-way function, comprising the following steps:

[0044] Step 1 Setup(λ) → (params): Given the security parameter λ, the trusted party runs the Setup algorithm to generate parameters params = (n, m, q, s). Here, n is the dimension of the vector to be signed, and is a prime number. Let m ≥ 5nlogq, and the Gaussian parameter s be a real number. This is a secure, collision-resistant hash function. The public parameters generated by the trusted party are the same as those of the lattice cryptosystem. As a post-quantum cryptosystem, lattice cryptography is resistant to attacks by quantum algorithms and offers high security.

[0045] Step 2 KeyGen(params) → (sk i ,pk i ): Signer U i(i∈[1,k]) takes the common parameter params=(n,m,q,s,H) as input and runs the TrapGen(n,m,q) algorithm to generate a matrix. with grid Trapdoor base T i Output public key pk i ←(A i The private key is sk. i ←(T i ).

[0046] Step 3 Sign(sk) i ,pk i ,M,H,params)→e i Let the message be M∈{0,1} * Signer U i Calculate h = H(M), expressed as h = (h1, h2, ..., h n ), calculate vector t satisfying At = h mod q, and use SamplePre(T) i The algorithm outputs t′, and calculates e. i =t+t'modq serves as the signature for message M. The signature generated by the signer is the input to the SIS trapdoor one-way function. Due to the one-way nature and collision resistance of the SIS trapdoor one-way function, the signature is guaranteed to be unforgeable, and the signing method is secure.

[0047] Step 4: AggKey(pk1,...,pk) k .APK: The validator uses a matrix of k public keys A1, A2, ..., A from k signers. k We randomly select n row vectors and concatenate them to form an aggregate public key. The specific process is as follows:

[0048] Matrix A i Contains row vector {a i,1 ,a i,2 ,...,a i,n}, where a i,j It is A i The j-th row vector, and Let A denote the set of all row vectors in the original matrix: The number of elements is kn. Randomly select n unique row vectors from A. Define σ: {1,2,...,n} → {a 1,1 ,...,a i,j ,...,a k,n Let A be a one-to-one mapping from {1,2,...,n} to A, satisfying For l = 1, 2, ..., n, concatenate these n unique row vectors into In the process of aggregating the signer's public key, the verifier utilizes the idea of ​​probabilistic verification. Instead of simply concatenating all public key matrices, the verifier randomly extracts a portion of row vectors from each public key matrix, reducing the size of the aggregated public key matrix, i.e., the number of rows, thereby reducing the overhead of storing the aggregated public key.

[0049] Step 5: Verify(APK, h, e) i ,params): In the AggKey algorithm, the mapping σ is a one-to-one random mapping from {1,2,...,n} to the set of row vectors A. For each l = 1,2,...,n, σ(l) represents the l-th concatenated row vector in APK, derived from some original matrix A. i The j-th line a i,j The verifier combines the multi-signature e according to the APK selection method in the AggKey algorithm.

[0050] Specifically: The verifier defines a mapping τ:{1,2,...,n}→{e1,e2,...,e k}. τ will, depending on the choice of σ, range from {e1,e2,...,e k Select the corresponding column vector from}. Specifically, if σ(l) comes from A i Regardless of A i In which row is τ(l)=e i We use the mapping τ to select e through concatenation (i.e., vertical splicing). i A column vector can be used to construct a new nm×1 column vector e, which is a multi-signature. Where τ(l) T This means that τ(l) is transposed into a row vector and then concatenated vertically, while the outermost transpose converts the entire concatenation result into a column vector.

[0051] Similarly, define the mapping ρ:{1,2,...,n}→{h1,h2,…,h n}, it will select the row index from {h1,h2,…,h} based on the row index of the row vector selected by σ. n Choose the corresponding component in}, that is, if σ(l)→a i,j Then ρ(l)→{h j}

[0052] A verifier accepts a multi-signature if and only if the following conditions are met:

[0053] (1) (2) and

[0054] The verifier utilizes the idea of ​​probabilistic verification, using the same extraction method as randomly extracting the row vectors of the public key matrix to extract message components. This allows the verifier to verify the validity of multi-signatures with only a few matrix multiplications, reducing the computational overhead of the signature verification process.

[0055] Correctness analysis of the algorithm:

[0056] In this invention, for message M, the signer U i Calculate h = H(M), calculate vector t satisfying At = h mod q, and use SamplePre(T) i The algorithm outputs t′, and calculates e. i =t+t'modq as the signature e of message M i Therefore, A i e i mod q = A i (t+t')mod q=h mod q, and

[0057] σ(l) comes from A i The j-th row, i.e., a i,j is the l-th row vector in the APK, and τ(l) is the corresponding signature vector e. i According to the Sign algorithm, e i The signature of message M satisfies A i e i =hmodq, for A i Each line a i,j They all i,j ,e i >=h j mod q, therefore:

[0058]

[0059] The norm of a multi-signature e is actually the norm of a concatenated single signature. These column vectors are derived directly from the individual e. i The multisignature e was selected from the original vectors and was not scaled or transformed in any way. Therefore, the norm of the multisignature e should be equal to the sum of the norms of the original signature vectors, i.e. For any k and any message M, the signatures e of each signer i Verify(params,APK,M,e) will always be 1, that is... and

[0060] Analysis of the unforgeability of signatures in the algorithm:

[0061] The unforgeability of a single signature​

[0062] Theorem: Suppose there exists an adversary If the unforgeability of a single signature in the scheme can be broken with probability ∈, then there exists a multinomial-time adversary capable of breaking the collision resistance of the SIS one-way function. adversary Through simulation and adversaries Challengers who engage in simulated game interaction It can break the collision resistance of the SIS one-way function with a non-negligible probability of approaching ∈, thus solving the SVP problem.

[0063] Given a uniformly random matrix Given parameters n, m, q, and β, define the input short vector x∈{0,1}. m The one-way function of SIS is f A (x)=Axmodq. Reference [4] has proven that as long as m>n·log(q), f A :D n →R n It is a reasonable one-way function. Without loss of generality, before performing a signature lookup on M, assume... Query H on each message M. Define SampleDom(1 n ) is a variable from the domain D n The sampling algorithm, for its sampled x∈D n f A The distribution of (x) is R n A uniform distribution on the surface.

[0064] For different M∈{0,1} * H query on the top Let e M ←SampleDom(1 n ), storage (M,e M ), return f A (e M ) to the enemy If M∈{0,1} * I was asked about H before. Search (M,e) M and return f A (e M ).

[0065] when For M∈{0,1} * When asking for a signature, Search (M,e) M and return e M .

[0066] Without loss of generality, let's assume the adversary Outputting fake Previously, regarding M * H was questioned. When the adversary produce hour, search Output As f A A pair of collisions.

[0067] adversary Perspectives in real-world chosen-message attacks and The perspectives provided are the same. From the adversary's perspective, for each different M's H query, The returned value is f A (e M ), where e M ←SampleDom(1 n According to the property of uniform output of SampleDom, f A (e M ) and in reality The output behaves the same. With the value of H(M) fixed, for each signature query of M, The returned distribution is SampleDom(1) n The value of e) M Therefore, e M In actual systems, they are also uniformly distributed.

[0068] Final opponent Output a valid signature forgery with a probability close to ∈ It is M * A valid signature, therefore f was formed A A pair of collisions. Two cases will be discussed. The probability of:

[0069] 1. If the opponent For M * Signature inquiry was conducted, adversary Received e M* .because It is a valid forgery, therefore

[0070] 2. If the opponent M not * A signature inquiry was conducted, in the adversary's view of M * In the H inquiry, Storage tuples return Give in Given The minimum entropy is ω(log n), therefore The probability is 1-2. -ω(logn) ≈1.

[0071] Therefore, we can conclude that... Able to output an f with a probability that is non-negligible to ∈ A The collision. If there are two inputs. Make Then you can find Λ ⊥ A short vector in (A) because Since they are all short binary vectors, e is also short, satisfying the condition... And ||e|| ∞ =max i |e i | = 1. e is Λ ⊥ The solution to the SIS problem in (A). Because the SIS problem is difficult, it is difficult to find the collision of the one-way function of the SIS trapdoor, and the individual signatures in the scheme are unforgeable.

[0072] The unforgeability of multi-signature

[0073] Theorem: Suppose there exists an adversary If the unforgeability of multiple signatures in a scheme can be broken with probability ∈, then there exists a polynomial-time adversary that can break the collision resistance of a one-way function in SIS. adversary Through simulation and adversaries Challengers who engage in simulated game interaction It can be achieved with a non-negligible probability. Solve CVP.

[0074] prove:

[0075] Initialization phase: Given a CVP instance, including the matrix and given vector beg The challenger finds the grid point closest to b. The challenger copies b k times and stacks them vertically to form... Copy b k times and expand to get Challenger The public parameters params = (n, m, q, s) are generated using the security parameter λ. Here, n is the dimension of the vector being signed, and is a prime number. Let m ≥ 5n log q, and let the Gaussian parameter s be a real number. For a safe and collision-resistant hash function. Run the KeyGen(params) algorithm to generate a matrix. with grid Trapdoor base T i , respectively (sk i ,pk i ), will pk c =C is set as the challenge public key. The secret key sk is stored. i Returns (params, pk c ,pk i ) to the enemy

[0076] H queries: c maintains an initially empty list L H It contains two types of elements: M and H(M). The adversary A maximum of q can be performed H The H-question. Upon receiving the H-question, the challenger... Search list L H If corresponding M and H(M) exist, then they are adversaries. Provide H(M); otherwise, for the first The challenger was asked a question from... Select a random vector H(M), and add M and H(M) to list L. H and return H(M) to the opponent. For the i-th (i＝c) In the next inquiry, the challenger calculates H(M). c =Ccmodq, which sets M and H(M) together. c Add to list L H And return H(M). c Give to the enemy

[0077] Signature inquiry: Enemy inquiry At most q S Next. When the challenger receives the message M and the public key set PK = {pk1,...,pk} from the adversary. k After}, if it contains pk c If the challenger succeeds, the game ends; otherwise, the challenger runs Sign(sk). i ,pk i The M, H, params) algorithm and the AggKey (PK) algorithm are used to construct a valid multi-signature e for message M under PK using the mapping τ, and return e to the adversary.

[0078] Forgery Phase: The opponent outputs a forged (M) * APK * PK * ,e * If pk c ∈PK* And Verify(params,APK) * M * ,e * If )→1, then (M) * APK * PK * ,e * This constitutes a successful forgery. The simulated game termination condition during the signature inquiry phase ensures that the adversary has not inquired about M. * In PK * The following describes the process by which the challenger uses an adversary to forge and resolve the CVP instance:

[0079] Because Verify(params,APK) * M * ,e * If )→1, then we have:

[0080] Challengers will Included PK c Select the row vectors from the data and recombine them into... Similarly, from multi-signature e * According to pk c In APK * Find pk using the row vector index. c The corresponding single signature e'; from H(M * Select the corresponding components from ) and combine them into H(M) * ) c At this point, the challenger received a reward from PK. c The public key matrix composed of row vectors A by H(M) * The new message vector H(M) is composed of the components in ) * ) c ′, and H(M * ) c In PK c The corresponding signature e' under ′, and the three satisfy the following relationship:

[0081] pk c ′·e′=H(M * ) c 'modq

[0082] In PK c In the case where '≠B', the challenger fails to resolve the CVP instance; in pk c When ′=B, H(M) * ) c e′ = Bbmodq. e′ can be considered as a one-way function f of SIS.B The preimage of some output Bb in (x). Since the parameters satisfy m>(n / k)·log(q), the SIS one-way function f B (x) is unidirectional and collision-resistant. The challenger constructed e′ using a forged multi-signature from the adversary, such that f B (e')=H(M * ) c 'modq = Bbmodq, which means f is broken. B (e') Unidirectionality. The challenger can... The CVP problem on the above is reduced to f B Regarding the one-dimensionality of (x): if the challenger can disrupt f B The unidirectionality of (x) can solve the problem. CVP issues.

[0083] Since Be'modq = f B (e')=H(M * ) c e'modq = Bbmodq, so clearly e' and b are both H(M) * ) c The preimage of ', but e' is a short vector, while b is not. Let H(M) be the preimage of ', but e' is a short vector, while b is not. * ) c All preimages of ′ (whether or not they are short vectors) are represented as It can be represented as A co-set, namely Since B·(b-e')=0modq, then (be′) is The grid points on the b; and since e′ is a short vector, (b-e′) is very close to b, therefore (be′) is a given... The solution to a CVP with respect to the target vector b is the solution to the CVP instance that the challenger needs to solve. Due to the difficulty of CVP, the multi-signature in the scheme is unforgeable.

[0084] Next, we analyze the probability that the challenger will successfully crack the CVP instance using the adversary's forged multi-signature.

[0085] Forged (M) * APK * PK * ,e * A challenger can exploit an adversary's forgery to solve a CVP instance if the following conditions are met:

[0086] (a)H(M * ) = c;

[0087] (b) The simulation game was not terminated during the signature inquiry phase;

[0088] (c)pk c ∈PK * And Verify(params,APK) * M * ,e * →1

[0089] (d)pk c ′=B;

[0090] The probability that condition (a) is true is P. a =1 / q H Condition (b) also ensures that the adversary has not inquired about M. * In PK * The probability of a multi-signature being valid is P. b =1 / q S Condition (c) is the condition for an adversary to successfully forge documents as defined in the security model, therefore the probability of it being true is P. b =∈. The probability that condition (d) is true is The conclusion is that if an adversary can forge multiple signatures with a probability of ∈, then the challenger can use... The probability of solving CVP.

[0091] 1. Symbol definitions in this invention:

[0092] In this invention, bold lowercase letters are used to represent vectors, such as vector b. Bold uppercase letters are used to represent matrices, such as matrix A. Representing a number field, Let e1 represent the integer field modulo q. Given two vectors e1 and e2 of the same dimension,<e1,e2> Let ω(f(n)) represent the dot product of vectors. Assume a constant c > 0, and use ω(f(n)) to represent a function whose growth rate exceeds cf(n), and use poly(n) to represent a polynomial function f(n) = O(n^2). c The Euclidean norm (L2 norm) of a vector is represented by ||·||. The norm of a matrix is ​​defined as the norm of its longest column vector, such as matrix S = {s1, ..., s2}. k Let ||S|| denote the length of the longest column vector, i.e., ||S|| = max i ||s i ||, i∈[1,k]. For any matrix S, This represents the matrix after Gram-Schmidt orthogonalization. Let D represent the Gram-Schmidt norm. Λ,s,c This represents a Gaussian distribution centered at c and with Gaussian parameter s on the lattice Λ. All logarithms used in this paper are base 2.

[0093] 2. Basic Knowledge

[0094] Trapdoor generation algorithm

[0095] TrapGen algorithm for generating trapdoors: Given matrix parameters n, m, q satisfying q = poly(n) and m ≥ 5nlogq, there exists a probabilistic multinomial-time algorithm TrapGen(m,n,q) that outputs a matrix and a full-rank set The distribution of matrix A is statistically close to a uniform distribution, and ||S||≤O(nlogq). The set S can be effectively transformed into a lattice. Trapdoor base T.

[0096] Preimage sampling function

[0097] Given an n-dimensional lattice Λ(A), a trapdoor basis T, Gaussian parameters s, and a vector y, there exists a probabilistic multinomial-time algorithm SamplePre(T,s,y) that follows a Gaussian distribution D. Λ(A),s,y Output the vector x∈Λ(A) that is close to y.

[0098] SIS Trapdoor One-Way Function

[0099] In 1996, cryptographer Ajtai proposed a one-way SIS function implemented in an integer lattice: given a uniformly random matrix... Given parameters n, m, q, and β, define the input short vector x∈{0,1}. m The one-way function of SIS is f A (x) = Axmodq, which has the following properties:

[0100] (1) Unidirectionality: Let Given input x, there exists a valid algorithm that outputs y; given input y, outputting x is difficult. A The one-dimensionality of (x) can be reduced to the lattice Solve the CVP problem in dual lattices.

[0101] (2) Collision resistance: It is difficult to find two inputs x1 ≠ x2 such that y1 = y2. A The collision resistance of (x) can be reduced to Solve the SVP problem in dual lattices.

[0102] (3) Pairwise independent: For two inputs x1≠x2, the outputs y1 and y2 are independent.

[0103] (4) Regularity: f A (x) maps the mbit input space to the nlogqn output space, exhibiting compressibility. Because f A(x) simultaneously possesses the property of being pairwise independent. According to the Remainder Hash Lemma, f A (x) has regularity, meaning that for each element y in the output space, it has the same properties.

[0104] A one-way trapdoor function for SIS can be constructed using a preimage-sampling function. Given matrix parameters n, m, q satisfying q = poly(n) and m ≥ 5nlogq, the TrapGen(m,n,q) algorithm outputs a random uniform matrix. and Let the trapdoor basis T on the Gaussian surface satisfy ||T||≤O(nlogq). Let the Gaussian parameter be... Matrix A defines a one-way function f for a trapdoor in SIS. A (x) = Axmodq, The trapdoor base T is f A The trapdoor. For a vector y = Axmodq, there exists a probabilistic multinomial-time algorithm that uses the trapdoor T and the SamplePre(T,s,y) algorithm to follow a statistically approximate Gaussian distribution. Sampling to obtain y in f A (x) = the preimage x under y mod q.

[0105] Although the present invention has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention fall within the scope of protection claimed by the present invention.

Claims

1. A multi-signature method based on a SIS trapdoor one-way function, characterized in that, include: Step 1: Initialization Steps Trusted party uses security parameters Common parameters required for the input and output schemes ;in The dimension of the vector being signed, a prime number. integer Gaussian parameters Let be a real number; For a safe and collision-resistant hash function; Step 2: Key Generation Step Each signer With common parameters and H As input, , Run for the number of signers Algorithm generates matrix with grid trapdoor base Output public key The private key is ;in It is a random uniform matrix. A one-way function of SIS is defined. ; Step 3: Signature Step Signer calculate , represented as Calculate vector satisfy ,use Algorithm output ,calculate As a message The signature; Step 4: Public Key Aggregation Step : The verifier from Signer Public key matrix Random selection A set of row vectors, concatenated to form an aggregate public key. ;matrix Includes row vectors ,in yes The There are row vectors, and ;make Represents the set of all row vectors in the original matrix; in In the algorithm, mapping It is from To row vector set One-to-one random mapping; for each , express The middle tier Each row vector originates from a certain original matrix. The OK ; Step 5: Verification Steps : The verifier uses public parameters Aggregate public keys ,information and multi-signature For input, output one bit. ;like If , then the multi-signature is valid. This indicates that the multi-signature is invalid, specifically: the verifier defines a mapping. ; According to The choice, from Select the corresponding column vector; specifically, if From Regardless In which line does it all have Use mapping Selected through cascading Column vectors, constructing a new column vector Multi-signature ,in Indicates will The transpose is converted into a row vector and then concatenated vertically, while the outermost transpose converts the entire concatenation result into a column vector; Define mapping ,according to Select the row index of the row vector, from Select the corresponding component, i.e., if ,but ; The verifier accepts the multi-signature when the following conditions are met: (1) (2) and .

2. The multi-signature method based on a SIS trapdoor one-way function according to claim 1, characterized in that, In step 1, the public parameters generated by the trusted party are the public parameters of the lattice cryptosystem.

3. The multi-signature method based on a SIS trapdoor one-way function according to claim 1, characterized in that, In step 2, the public key generated by the signer is a random uniform matrix, the private key is a trapdoor basis of the dual lattice of the lattice with the random uniform matrix as the basis, and the public key is defined with a corresponding SIS trapdoor one-way function.

4. The multi-signature method based on a SIS trapdoor one-way function according to claim 1, characterized in that, In step 3, the signing process utilizes a trapdoor. The preimage of the SIS one-way function is obtained, and the signature generated by the signer is the input of the SIS trapdoor one-way function.

5. A multi-signature method based on a SIS trapdoor one-way function according to claim 1, characterized in that, In step 4, the verifier uses probabilistic verification during the aggregation of signer public keys, randomly selecting a portion of row vectors from each public key matrix.

6. A multi-signature method based on a SIS trapdoor one-way function according to claim 1, characterized in that, In step 5, the verifier follows the steps in step 4. Choice of methods for combining multi-signature .

7. A multi-signature method based on a SIS trapdoor one-way function according to claim 1, characterized in that, In step 5, the signature verification process is a forward computation of the SIS one-way function.

Images