Method and system for aggregating proxy signatures on a lattice

Abstract

The application provides a lattice-based aggregated proxy signature method and system, comprising the following steps: S1, generating a key pair of an original signer and a proxy signer by a key generation algorithm; S2, generating a proxy key pair for the proxy signer by the original signer on the original signature side; S3, verifying the validity of the proxy key pair by the original signer's public key on the proxy signature side; S4, generating a proxy signature by the proxy signer's key pair and the proxy key pair on the proxy signature side; S5, verifying the validity of the proxy signature by the proxy signer's public key and the proxy public key on the verification side; S6, aggregating the valid proxy signatures generated by all proxy signers of the same original signer; and S7, verifying the validity of the aggregated signature by the proxy signer's public key and the proxy public key on the verification side.

Description

Technical Field

[0001] The present invention relates to the technical field of proxy signatures, and in particular to a grid-aggregated proxy signature method and system. Background Art

[0002] Proxy signatures allow the original signer to delegate their signing authority to a proxy signer. In a proxy signature scheme, the proxy signer can generate a valid proxy signature on behalf of the original signer. Upon receiving the proxy signature, the verifier can verify not only the validity of the proxy signature but also the authorization of the original signer.

[0003] With the rapid development of quantum computer technology, the emergence and practical application of quantum computers are becoming increasingly possible, posing a serious threat to the security of traditional cryptographic schemes based on the discrete logarithm hard assumption. Specifically, running Shor's algorithm on a quantum computer can efficiently solve the discrete logarithm problem in polynomial time, thereby cracking these schemes. To address this challenge, post-quantum cryptographic algorithms have emerged. Among them, lattice cryptography, based on difficult lattice problems (such as the Learning With Errors (LWE) problem), has taken a dominant position in the post-quantum cryptographic algorithm landscape due to its superior computational efficiency, provable quantum security, and other advantages.

[0004] Aggregate signatures are an important cryptographic tool proposed by Boneh et al. They allow for the efficient aggregation of n distinct signatures on n different messages into a single signature. This feature not only significantly increases verification speed but also significantly reduces storage and bandwidth costs. Summary of the Invention

[0005] In view of the defects in the prior art, the purpose of the present invention is to provide a grid-based aggregate proxy signature method and system.

[0006] According to the present invention, a grid aggregation proxy signature method is provided, comprising:

[0007] Step S1: Generate a key pair of the original signer and the proxy signer through a key generation algorithm;

[0008] Step S2: The original signing side uses the original signer's key pair to generate a proxy key pair for the proxy signer;

[0009] Step S3: The proxy signing side verifies the validity of the proxy key pair using the public key of the original signer;

[0010] Step S4: The proxy signing side generates a proxy signature using the proxy signer's key pair and the proxy key;

[0011] Step S5: The verifying side verifies the validity of the proxy signature using the public key of the proxy signer and the proxy public key.

[0012] Step S6: Aggregating the valid proxy signatures generated by all proxy signers for the same original signer;

[0013] Step S7: The verifying side verifies the validity of the aggregated signature using the public key of the proxy signer and the proxy public key.

[0014] Preferably, the step S1 comprises:

[0015] Step S1.1: Randomly selecting three matrices 、 and ; wherein Z represents an integer set; q represents a prime number; n represents a positive integer, m represents a positive integer, k represents a positive integer, and d represents a positive integer;

[0016] Step S1.2: Calculating , ,

[0017] Step S1.3: Outputting the key pair of the original signer and the key pair of the proxy signer .

[0018] Preferably, the step S2 comprises:

[0019] Step S2.1: Calculating ; wherein represents a hash function, ; ;

[0020] Step S2.2: Calculating , ;

[0021] Step S2.3: Outputting the proxy key pair of the proxy signer .

[0022] Preferably, the step S3 comprises:

[0023] Step S3.1: Calculating ; wherein represents a hash function, ; ;

[0024] Step S3.2: Verifying the equation , if the equation is true, the verification is valid; otherwise, it is invalid.

[0025] Preferably, the step S4 comprises:

[0026] Step S4.1: Select two vectors ,in, The parameter is The discrete normal distribution of

[0027] Step S4.2: Calculation , ;

[0028] Step S4.3: Calculation ;in, is a hash function, ; Message space ;

[0029] Step S4.4: Calculation ;in, is a hash function, ;

[0030] Step S4.5: Calculation , ;

[0031] Step S4.6: The probability output ,by( The probability output ,in, ,in is the cardinality of natural logarithms;

[0032] Step S4.7: Output signature .

[0033] Preferably, step S5 includes:

[0034] Step S5.1: Calculation ;in, is a hash function, ; Message space ;

[0035] Step S5.2: Calculation ;in, is a hash function, ;

[0036] Step S5.3: Verify the equation , , and Is it true? Where s represents a real number. If true, the verification is valid; otherwise, it is invalid.

[0037] Preferably, step S6 includes:

[0038] Step S6.1: Compute , ;

[0039] Step S6.2: Compute , ;

[0040] Step S6.3: Output aggregated signature .

[0041] Preferably, the step S7 comprises:

[0042] Step S7.1: Compute wherein, is a hash function, ; message space ;

[0043] Step S7.2: Compute wherein, is a hash function, ;

[0044] Step S7.3: Compute , ;

[0045] Step S7.4: Verify whether the equation , , and is valid; if valid, then the verification is valid; otherwise, it is invalid.

[0046] According to the present application, a lattice-based aggregated proxy signature system is provided, comprising:

[0047] Module M1: generating a key pair of the original signer and the proxy signer by a key generation algorithm;

[0048] Module M2: the original signature side generates a proxy key pair for the proxy signer using the key pair of the original signer;

[0049] Module M3: the proxy signature side verifies the validity of the proxy key pair using the public key of the original signer;

[0050] Module M4: the proxy signature side generates a proxy signature using the key pair of the proxy signer and the proxy key;

[0051] Module M5: the verification side verifies the validity of the proxy signature using the public key of the proxy signer and the proxy public key;

[0052] Module M6: aggregating all valid proxy signatures generated by the proxy signers for the same original signer;

[0053] Module M7: The verifying side verifies the validity of the aggregated signature using the public key of the proxy signer and the proxy public key.

[0054] Preferably, the module M1 comprises:

[0055] Module M1.1: Randomly select three matrices , and ; wherein Z represents a set of integers; q represents a prime number; n represents a positive integer, m represents a positive integer, k represents a positive integer, d represents a positive integer;

[0056] Module M1.2: Calculate , ,

[0057] Module M1.3: Output the key pair of the original signer and the key pair of the proxy signer ;

[0058] The module M2 comprises:

[0059] Module M2.1: Calculate ; wherein represents a hash function, ; ;

[0060] Module M2.2: Calculate , ;

[0061] Module M2.3: Output the proxy key pair of the proxy signer ;

[0062] The module M3 comprises:

[0063] Module M3.1: Calculate ; wherein represents a hash function, ; ;

[0064] Module M3.2: Verify the equation , if the equation is true, it is verified to be valid; otherwise, it is invalid;

[0065] The module M4 comprises:

[0066] Module M4.1: Select two vectors , wherein is a discrete normal distribution with parameter ;

[0067] Module M4.2: Calculate , ;

[0068] Module M4.3: Compute ; where, is a hash function, ; message space ;

[0069] Module M4.4: Compute ; where, is a hash function, ;

[0070] Module M4.5: Compute , ;

[0071] Module M4.6: Output with probability , output with probability , where, where is the base of the natural logarithm;

[0072] Module M4.7: Output signature ;

[0073] The module M5 comprises:

[0074] Module M5.1: Compute ; where, is a hash function, ; message space ;

[0075] Module M5.2: Compute ; where, is a hash function, ;

[0076] Module M5.3: Verify whether the equation , , and is valid; where s represents a real number; if valid, the verification is valid; otherwise, it is invalid;

[0077] The module M6 comprises:

[0078] Module M6.1: Compute , ;

[0079] Module M6.2: Compute , ;

[0080] Module M6.3: Output aggregated signature ;

[0081] The module M7 comprises:

[0082] Module M7.1: calculating wherein, is a hash function, ; message space ;

[0083] Module M7.2: calculating wherein, is a hash function, ;

[0084] Module M7.3: calculating , ;

[0085] Module M7.4: verifying whether the equation , , and is established; if yes, the verification is valid; otherwise, it is invalid.

[0086] Compared with the prior art, the present application has the following beneficial effects:

[0087] 1. The present application uses the trapdoor-free technology on the lattice to construct a proxy signature method, which significantly reduces the size of the proxy private key and the proxy signature compared with the proxy signature scheme constructed by the lattice-based delegation technology based on the bonsai tree principle and fixed dimension, and provides potential post-quantum security characteristics for the proxy signature.

[0088] 2. The present application adds the signature aggregation function to the proxy signature, aggregates n different proxy signatures generated by all proxy signers of the same original signer into one signature; compared with n independent proxy signatures, the length of the signature is effectively reduced, and the speed of signature verification is improved; when transmitting and storing, only the message and the corresponding aggregated signature need to be transmitted and stored, which effectively reduces the storage space and communication overhead of the signature.

[0089] 3. The present application realizes the proxy of signature authority and the aggregation of proxy signature based on the trapdoor-free technology on the lattice and the aggregation signature technology; firstly, the trapdoor-free technology on the lattice is adopted to provide potential post-quantum security for the proxy signature, and secondly, combined with the aggregation signature technology, the speed of signature verification is improved, and the storage space and communication overhead of the signature are reduced. BRIEF DESCRIPTION OF DRAWINGS

[0090] Other features, objects and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments, made with reference to the accompanying drawings:

[0091] Figure 1 A flow chart of a method for aggregating proxy signature on a lattice. DETAILED DESCRIPTION

[0092] The application will be described in detail below with specific examples. The following examples will help those skilled in the art further understand the application, but in no way limit the application. It should be noted that for those skilled in the art, without departing from the concept of the application, a number of changes and improvements can be made. These are within the scope of the application.

[0093] Example 1

[0094] According to the method and system for aggregating proxy signature on a lattice provided by the application, the trapdoor-free technology on a lattice is adopted, which outputs candidate signatures with a certain probability and makes the distribution of output signatures irrelevant to the signature private key of the signer, effectively reducing the size of the proxy private key and proxy signature, and providing potential post-quantum security; the aggregation signature technology is adopted to aggregate n different proxy signatures generated by all proxy signers of the same original signer. Specifically, for the proxy signatures of n different messages generated by all proxy signers of the same original signer, anyone can aggregate these individual proxy signatures into a single signature. When transmitting and storing, only the message and the corresponding aggregated signature need to be transmitted and stored, effectively reducing the storage space of the signature and communication overhead. In the verification stage, the verifier only needs to verify the aggregated proxy signature, thereby improving the speed of signature verification.

[0095] As shown in Figure 1 , the method for aggregating proxy signature on a lattice comprises:

[0096] Step 1, initialization algorithm : generate lattice aggregation proxy signature system parameters. The algorithm steps are as follows:

[0097] Select a security parameter . Let , be a prime number, be a positive integer, , the parameter , , where is the base of natural logarithm.

[0098] Select three hash functions: , , , where the message space .

[0099] Output the system parameters .

[0100] Step 2, Key generation algorithm : Run the key generation algorithm to generate the original signer's and proxy signer's key pairs. The algorithm steps are as follows:

[0101] Step 2.1: Randomly select three matrices , and ;

[0102] Step 2.2: Compute , ;

[0103] Step 2.3: Output the original signer's key pair and the proxy signer's key pair .

[0104] Step 3, Proxy key generation algorithm : The original signer uses the proxy signer's and his own key pair to generate the proxy signer's proxy key pair. The algorithm steps are as follows:

[0105] Step 3.1: Compute ,

[0106] Step 3.2: Compute , ,

[0107] Step 3.3: Output the proxy signer's proxy key pair .

[0108] Step 4, Proxy key verification algorithm : The proxy signer uses the original signer's public key to verify whether the proxy key pair is valid. If valid, it means that the proxy signer accepts the proxy key pair, otherwise, it is rejected; the algorithm steps are as follows:

[0109] Step 4.1: Compute ,

[0110] Step 4.2: Verify the equation ,

[0111] Step 4.3: If the equation holds, the algorithm outputs 1, otherwise, outputs 0.

[0112] Step 5, Proxy signature algorithm : Given a message , the proxy signer uses the proxy signer's key pair and proxy keys Generate a proxy signature. The algorithm steps are as follows:

[0113] Step 5.1: Select two vectors ,in The parameter is The discrete normal distribution of

[0114] Step 5.2: Calculation , ;

[0115] Step 5.3: Calculation ;

[0116] Step 5.4: Calculation ;

[0117] Step 5.5: Calculation , ;

[0118] Step 5.6: The probability output ,by( The probability output ;

[0119] Step 5.7: Output signature .

[0120] Step 6: Proxy signature verification algorithm : Given a message ,sign , the public key of the proxy signer and the proxy public key Verify the validity of the proxy signature. The algorithm steps are as follows:

[0121] Step 6.1: Calculation ,

[0122] Step 6.2: Calculation ,

[0123] Step 6.3: Verify the Equation , , and Is it true? If so, the Verify algorithm outputs 1; otherwise, it outputs 0.

[0124] Step 7: Aggregation Algorithm : Multiple (message, signature, (proxy signer's public key, proxy signer's proxy public key)) tuples generated by the proxy signer given the same original signer The algorithm steps are as follows:

[0125] Step 7.1: Compute , ,

[0126] Step 7.2: Compute , ,

[0127] Step 7.3: Output aggregated signature .

[0128] Step 8, Aggregated verification algorithm : Given a plurality of (message, (proxy signer's public key, proxy signer's proxy public key)) tuples , an aggregated signature . The algorithm steps are as follows:

[0129] Step 8.1: Compute ,

[0130] Step 8.2: Compute ,

[0131] Step 8.3: Compute , ,

[0132] Step 8.4: Verify that the equations , , and hold. If they do, the algorithm outputs 1; otherwise, it outputs 0.

[0133] The present application also provides a lattice-based aggregated proxy signature system, which can be realized by performing the process steps of the lattice-based aggregated proxy signature method, i.e., the lattice-based aggregated proxy signature method can be understood by those skilled in the art as a preferred embodiment of the lattice-based aggregated proxy signature system.

[0134] Those skilled in the art know that, in addition to implementing the system, device and each module thereof provided by the present application in the form of pure computer readable program code, the same program can also be realized by logically programming the method steps in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded microcontrollers, etc. Therefore, the system, device and each module thereof provided by the present application can be considered as a hardware component, and the modules included therein for implementing various programs can also be considered as structures within the hardware component; the modules for implementing various functions can also be considered as both software programs for implementing methods and structures within the hardware component.

[0135] The specific embodiments of the present application are described above. It needs to be understood that the present application is not limited to the specific embodiments described above, and various changes or modifications can be made by those skilled in the art within the scope of the claims, which does not affect the essential content of the present application. The embodiments of the present application and the features in the embodiments can be combined with each other at will without conflict.

Claims

1. A grid aggregation proxy signature method, characterized in that: include: Step S1: Generate a key pair of the original signer and the proxy signer through a key generation algorithm; Step S2: The original signing side uses the original signer's key pair to generate a proxy key pair for the proxy signer; Step S3: The proxy signing side verifies the validity of the proxy key pair using the public key of the original signer; Step S4: The proxy signing side generates a proxy signature using the proxy signer's key pair and the proxy key pair; Step S5: The verification side verifies the validity of the proxy signature using the proxy signer's public key and the proxy public key; Step S6: Aggregate the valid proxy signatures generated by all proxy signers of the same original signer; Step S7: The verification side verifies the validity of the aggregate signature using the public key of the proxy signer and the proxy public key; The step S1 comprises: Step S1.1: Randomly select three matrices S∈{-d,...,0,...,d} m×m and S 1,1 ∈{-d,...,0,...,d} m×k ; Wherein, Z represents a set of integers; q represents a prime number; n represents a positive integer, m represents a positive integer, k represents a positive integer, and d represents a positive integer; Step S1.2: Calculation Step S1.3: Output the original signer's key pair (Pk, sk) = ((A, T), S) and the proxy signer's key pair (Pk 1,1 ,sk 1,1 )=((A,T 1,1 ),S 1,1 ); The step S2 comprises: Step S2.1: Calculate S ID =H0(ID)∈{-1,0,1} m×k ; Where H0 represents the hash function, H0:{0,1} * →{-1,0,1} m×k ; ID∈{0,1} * ; Step S2.2: Calculate S 1,2 =SS ID ∈Z m×k , Step S2.3: Output the proxy key pair (Pk 1,2 ,sk 1,2 )=((A,T 1,2 ),S 1,2 ); The step S3 comprises: Step S3.1: Calculate S ID =H0(ID)∈{-1,0,1} m×k ; Where H0 represents the hash function, H0:{0,1} * →{-1,0,1} m×k ; ID∈{0,1} * ; Step S3.2: Verify the equation If the equality holds, the verification is valid; otherwise, it is invalid; The step S4 comprises: Step S4.1: Select two vectors in, is a discrete normal distribution with parameter s; Step S4.2: Calculation Step S4.3: Calculate c 1,1 =H1(w 1,1 ,T 1,1 ,m)∈{-1,0,1} k ; Among them, H1 is the hash function, Message Space Step S4.4: Calculate c 1,2 =H2(w 1,2 ,T 1,2 ,m)∈{-1,0,1} k ; Among them, H2 is the hash function, Step S4.5: Calculation Step S4.6: The probability output (z 1,1 ,w 1,1 ),by The probability output (z 1,2 ,w 1,2 ), where M≈e, where e is the base of natural logarithms; Step S4.7: Output signature σ=(z 1,1 ,w 1,1 ,z 1,2 ,w 1,2 ); The step S5 comprises: Step S5.1: Calculate c 1,1 =H1(w 1,1 ,T 1,1 ,m)∈{-1,0,1} k ; Among them, H1 is the hash function, Message Space Step S5.2: Calculate c 1,2 =H2(w 1,2 ,T 1,2 ,m)∈{-1,0,1} k ; Among them, H2 is the hash function, Step S5.3: Verify the equation and Is it true? Where s represents a real number. If true, the verification is valid. Otherwise, it is invalid. The step S6 comprises: Step S6.1: Calculation w′1=(w 1,1 ,...,w n,1 ); Step S6.2: Calculation w′2=(w 1,2 ,...,w n,2 ); Step S6.3: Output aggregate signature σ agg =(z1,w′1,z2,w′2); The step S7 comprises: Step S7.1: Calculate c i,1 =H1(w i,1 ,T i,1 ,m i )∈{-1,0,1} k , where H1 is the hash function, Message Space Step S7.2: Calculate c i,2 =H2(w i,2 ,T i,2 ,m i )∈{-1,0,1} k , where H2 is the hash function, Step S7.3: Calculation Step S7.4: Verify the equation and Is it true? If so, the verification is valid; otherwise, it is invalid.

2. A grid-based aggregated proxy signature system, characterized in that: include: Module M1: Generates the key pair of the original signer and the proxy signer through the key generation algorithm; Module M2: The original signing side uses the original signer's key pair to generate a proxy key pair for the proxy signer; Module M3: The proxy signature side verifies the validity of the proxy key pair using the original signer's public key; Module M4: The proxy signature side uses the proxy signer's key pair and the proxy key pair to generate a proxy signature; Module M5: The verification side verifies the validity of the proxy signature using the proxy signer's public key and the proxy public key; Module M6: Aggregate the valid proxy signatures generated by all proxy signers of the same original signer; Module M7: The verification side uses the public key of the proxy signer and the proxy public key to verify the validity of the aggregate signature; The module M1 includes: Module M1.1: Randomly select three matrices S∈{-d,...,0,...,d} m×m and S 1,1 ∈{-d,...,0,...,d} m×k ; Wherein, Z represents a set of integers; q represents a prime number; n represents a positive integer, m represents a positive integer, k represents a positive integer, and d represents a positive integer; Module M1.2: Computation Module M1.3: Output the original signer's key pair (Pk, sk) = ((A, T), S) and the proxy signer's key pair (Pk 1,1 ,sk 1,1 )=((A,T 1,1 ),S 1,1 ); The module M2 includes: Module M2.1: Calculating S ID =H0(ID)∈{-1,0,1} m×k ; Where H0 represents the hash function, H0:{0,1} * →{-1,0,1} m×k ; ID∈{0,1} * ; Module M2.2: Calculation of S 1,2 =SS ID ∈Z m×k , Module M2.3: Output the proxy signer's proxy key pair (Pk 1,2 ,sk 1,2 )=((A,T 1,2 ),S 1,2 ); The module M3 includes: Module M3.1: Calculating S ID =H0(ID)∈{-1,0,1} m×k ; Where H0 represents the hash function, H0:{0,1} * →{-1,0,1} m×k ; ID∈{0,1} * ; Module M3.2: Verifying Equations If the equality holds, the verification is valid; otherwise, it is invalid; The module M4 includes: Module M4.1: Selecting Two Vectors in, is a discrete normal distribution with parameter s; Module M4.2: Computation Module M4.3: Calculation of c 1,1 =H1(w 1,1 ,T 1,1 ,m)∈{-1,0,1} k ; Among them, H1 is the hash function, Message Space Module M4.4: Calculation of c 1,2 =H2(w 1,2 ,T 1,2 ,m)∈{-1,0,1} k ; Among them, H2 is the hash function, Module M4.5: Computation Module M4.6: The probability output (z 1,1 ,w 1,1 ),by The probability output (z 1,2 ,w 1,2 ), where M≈e, where e is the base of natural logarithms; Module M4.7: Output signature σ=(z 1,1 ,w 1,1 ,z 1,2 ,w 1,2 ); The module M5 includes: Module M5.1: Calculation of c 1,1 =H1(w 1,1 ,T 1,1 ,m)∈{-1,0,1} k ; Among them, H1 is the hash function, Message Space Module M5.2: Calculation of c 1,2 =H2(w 1,2 ,T 1,2 ,m)∈{-1,0,1} k ; Among them, H2 is the hash function, Module M5.3: Verifying Equations and Is it true? Where s represents a real number. If true, the verification is valid. Otherwise, it is invalid. The module M6 includes: Module M6.1: Computation w′1=(w 1,1 ,...,w n,1 ); Module M6.2: Computing w′2=(w 1,2 ,...,w n,2 ); Module M6.3: Output aggregate signature σ agg =(z1,w′1,z2,w′2); The module M7 includes: Module M7.1: Calculation of c i,1 =H1(w i,1 ,T i,1 ,m i )∈{-1,0,1} k , where H1 is the hash function, Message Space Module M7.2: Calculation of c i,2 =H2(w i,2 ,T i,2 ,m i )∈{-1,0,1} k , where H2 is the hash function, Module M7.3: Computing Module M7.4: Verifying Equations and Is it true? If so, the verification is valid; otherwise, it is invalid.

Images