A signature method, electronic equipment and computer readable storage medium

Abstract

The application provides a signature method, which comprises the following steps: a key generation center generates public keys and private keys of each user; a verifier constructs a public key set according to the public keys of multiple users, and generates a key mirror according to the public key set and a secret witness of the verifier; a signer uses the key mirror, the public key set and a private key of the signer to pre-sign a generated message; the verifier uses the secret witness to convert the pre-signature into a full signature; and the signer recovers the secret witness according to the full signature and the pre-signature to obtain a required signature. In the signature process, any participant needs to use the public key set and the key mirror to sign, and an external observer cannot directly associate the signature with a specific user, so that the actual signer is hidden in multiple users, and the transaction anonymity is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a signature method, an electronic device and a computer readable storage medium. BACKGROUND

[0002] Adaptor Signature is an enhanced digital signature scheme that combines encryption and signature techniques to enable conditional signing or commitment. This technology allows a signature to be transformed into a valid signature when certain conditions are met, and the satisfaction of the conditions can be proven. This is very useful in many cryptographic applications, such as atomic exchange, smart contracts and distributed ledger technology.

[0003] Ring Signature is a technique that hides one's real identity by introducing the identity information of others and using one's own private key to hide one's real identity. In this way, others only know that it is one of these people, but do not know which specific person it is, so that one's own identity can be successfully hidden. The SM2 ring signature method is improved by improving the SM2 signature algorithm to hide the identity information of the signer while completing the signature. By introducing ring adaptor signature, a powerful privacy-preserving cryptographic technique is provided, allowing users to anonymously sign messages within a group. This signature ensures that the identity of the signer is not identifiable in the group, while still maintaining the unforgeability and non-repudiation of the signature. It is widely used to enhance the anonymity of transactions and communications, especially in scenarios that require high privacy protection, such as electronic voting and privacy-protected digital currency transactions.

[0004] In the above-mentioned existing signature scheme, the adaptor signature cannot realize the anonymity of the user's identity, and the signature of the ring signature does not exist security verification, which cannot guarantee the security of the signature. SUMMARY

[0005] Therefore, the present application provides a signature method, device and storage medium, which can realize the security of the signature while ensuring the privacy of the identity of the signer.

[0006] According to one aspect of the present application, a signature method is provided, which is applied to a signature authorization system, the signature authorization system comprising a key generation center and a plurality of users, the key generation center and each user being in communication, and the plurality of users comprising a signer and a verifier participating in the signature; the method comprising:

[0007] Key generation step: the key generation center generates a public key and a private key for each user;

[0008] Key mirror generation step: the verifier constructs a set of public keys according to the public keys of the plurality of users and generate a key image according to the public key set and a secret witness of the verifier wherein n is the number of public keys in the public key set, and y is the secret witness;

[0009] a pre-signature generation step: the signer uses the key image, the public key set and a private key of the signer to pre-sign a message;

[0010] a full signature generation step: the verifier uses the secret witness to convert the pre-signature into a full signature;

[0011] a secret witness recovery: the signer recovers the secret witness according to the full signature and the pre-signature to obtain a signature required by the signer.

[0012] Optionally, the pre-signature generation step comprises:

[0013] calculating wherein is a preset hash function, is the public key set, m is the message, and k π is a preset random number, π is the position of the public key of the signer in the public key set, Y is a preset public witness, and L π is the key image;

[0014] for i = π + 1, …, n, 1, …, π - 1, sequentially perform the following operations:

[0015] randomly generating calculating wherein c1 = c n+1 , c π+1 is a random number of an initial challenge, used to start a calculation chain; c n is a value after multiple iteration calculations; c n+1 is a final value of the multiple iteration calculations; G is a base point of a preset elliptic curve, pk i is the i-th public key in the public key set;

[0016] calculating to obtain a pre-signature wherein is a signature value of the pre-signature, sk π is the private key of the signer, k π is a preset random number, and mod is a modulo operation, q is a preset constant.

[0017] Optionally, the method further comprises:

[0018] a pre-signature verification step: the inspector verifies whether c′1, is established; if yes, for i = 1, …, n, sequentially calculate Among them, Z i ' is an intermediate calculated value in the pre-signature verification process, which, as part of the computation chain, is used to ensure the correctness of the pre-signature; c'1 = c1, where c'1 is a parameter used for the verification challenge. It is the pre-signature verification value used by the verifier, who can be any one of the multiple users;

[0019] Test c1′=c n+1 'Is it true? If it is true, the verification is successful.

[0020] Optionally, the full signature generation step includes:

[0021] Calculate σ = (s1, s2, ..., s n c1) obtains the full signature; where, y is the witness to the aforementioned secret. For the pre-signature, i = 1, ..., n, where n is the number of public keys in the public key set, s i It is the signature value in the full signature.

[0022] Optionally, after the full signature generation step, the method further includes a full signature adaptation step:

[0023] For i = 1, 2, ..., n, calculate Z sequentially. i "=s i G+s i pk i +c″ i pk i , Where, c1″=c1,Z i " is the intermediate calculated value that needs to be verified during the full signature adaptation process, used for full signature adaptation, c i+1 " is the challenge value required for full signature verification, used to verify whether the full signature is successfully adapted;

[0024] Test c1″=c n+1 "Whether it is valid or not, if it is valid, the adaptation is successful."

[0025] Optionally, before the pre-signature generation step, the method further includes:

[0026] Public key set update steps: The signer determines whether its own public key is in the public key set. If not, it replaces any public key in the public key set with its own public key and updates the key image.

[0027] Optionally, the key generation step includes:

[0028] Choose a random number as each user's private key sk;

[0029] The public key pk of each user is calculated as pk = skG, wherein G is a preset base point of an elliptic curve.

[0030] According to another aspect of the present application, there is provided a signature authorization system, comprising a key generation center and a plurality of users, the key generation center and each user being in communication, the plurality of users comprising a signer and a verifier participating in a signature; the signature authorization system implements the signature method described above.

[0031] According to still another aspect of the present application, there is provided an electronic device, comprising a memory and a processor, the memory storing a computing program, when the computing program is executed by the processor, the processor implements the signature method described above.

[0032] According to yet another aspect of the present application, there is provided a computer readable storage medium, storing a computing program, when the computing program is executed by a processor, the processor implements the signature method described above.

[0033] The signature method of the present application has the following beneficial effects over the prior art:

[0034] The public key set is constructed by the public keys of the plurality of users and the key image is generated, in the signature process, any participant needs to sign through the public key set and the key image, an external observer cannot directly associate the signature with a specific user, thereby hiding the actual signer in the plurality of users, increasing the transaction anonymity; in addition, the key image is generated according to the secret witness and the public key set, the signature of the signer depends on the private key of the signer, the public key set and the key image generation, the secret witness is uniquely held by the verifier, the private key is only held by the signer, only the user with the corresponding private key can generate a valid signature, which makes the signature unforgeable and increases the security of the signature;

[0035] The present application can also enhance privacy protection by hiding the real identity of participants, making it impossible to directly associate transactions with specific users during the signing process. This anonymity is achieved through the use of ring adapter signature technology, which allows participants to participate in the signing and verification process while keeping their identity secret. This is extremely important for applications that require user privacy protection, such as voting systems, anonymous transactions, etc.; it can also improve transaction security, as ring adapter signatures are non-forgery, each signature is unique and directly dependent on the user's private key and the specific configuration of the ring. This dependency makes it difficult to forge or tamper with the signature, greatly improving the security of the system. In addition, the generation and verification process of the signature does not expose critical private key information, enhancing the system's ability to resist external attacks; it can also improve compatibility and efficiency: the present application uses the SM2 algorithm, a public key encryption technology that meets relevant standards and has been widely used in related systems, with good compatibility. At the same time, compared with traditional ring signature technology, it has improved efficiency, supporting fast signature generation and verification processes, suitable for use in resource-constrained environments. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0037] Figure 1 A signing authorization system schematic diagram of an embodiment of the present application;

[0038] Figure 2 A signing method flowchart of an embodiment of the present application;

[0039] Figure 3 A signing method flowchart of another embodiment of the present application;

[0040] Figure 4 A signing method flowchart of another embodiment of the present application;

[0041] Figure 5 An electronic device schematic diagram of an embodiment of the present application. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of the present application.

[0043] As shown in Figure 1 , the disclosed signature authorization system includes a key generation center and a plurality of users. Each user is usually a direct participant in a transaction or a mutually trusted entity, and the key generation center is a third-party platform that provides support for transactions between users. Communication is established between the key generation center and each user, and when the users transact, they operate through the key generation center. Among them, the plurality of users includes a signer and a verifier who transact, as well as other transaction participants.

[0044] The key generation center performs initialization operations before the transaction, specifically, the key generation center generates system parameters for the entire system. The system parameters can be empirical values set according to experience, or can be calculated through an elliptic curve equation in the SM2 algorithm. When the system parameters are generated through the elliptic curve equation in the SM2 algorithm, the key generation center obtains a security parameter λ and selects a base point G according to a preselected elliptic curve. The coefficients a and b in the preselected elliptic curve y 2 = x 3 + ax + b satisfy 4a 3 + 27b 2 ≠ 0, and the elliptic curve has a sufficiently large finite field where p is a prime number. The points on the elliptic curve should have a high order to resist attacks on the discrete logarithm problem on the elliptic curve. The base point G is a generator in the elliptic curve group that satisfies the above conditions, and its order n is a large prime number. The selection of the base point G has an important impact on system security and efficiency, and the base point G is usually selected by a person skilled in the art according to experience. An elliptic curve L that meets the requirements is selected from the elliptic curve group to determine the parameters a and b. After selecting the elliptic curve L and the base point G, the key generation center selects a suitable hash function and verifies whether these parameters meet the security requirements to ensure that all curves and parameters not only meet the theoretical requirements but also can resist various attacks that may be encountered in reality, such as congruence attacks, small subgroup attacks, etc. After the elliptic verification condition is passed, the system parameters are obtained, including the base point G. The SM2 algorithm is a public key encryption technology that meets national standards and has been widely used in commercial and government systems, with good compatibility.

[0045] After determining the system parameters, the key generation center generates the public key and the private key of each user. Specifically, a random number is selected as the private key sk of each user, and the public key pk = skG is distributed to each user through a secure channel. The key generation center selects a random number y as the secret witness, which must be within the range of the finite field defined by the elliptic curve The secret witness is the private secret witness of the verifier when transacting, which is not disclosed to ensure the security of the transaction. The key generation center calculates the public witness Y using the selected elliptic curve and the base point G. In some embodiments, Y can be calculated by the point multiplication operation on the elliptic curve, i.e. y = yG. Of course, in other embodiments, Y can also be calculated by other operations, and the embodiments of the present application are not limited thereto. The public witness Y can be accessed and verified by other participants in the transaction, but the secret witness y cannot be derived from Y.

[0046] After the key generation center completes the above operations, the verifier of the transaction obtains the public keys of multiple users to construct a public key set and generates a key image L π . Among them, the public key set includes n public keys, and the key image The verifier publishes the public key set , the public witness Y and the key image L π for the signer to sign the generated message m.

[0047] The signer π uses the key image L π , the public key set and its own private key sk π to pre-sign the generated message. Specifically, the signer calculates where k π is a preset random number, and π is the position of the public key of the signer in the public key set.

[0048] For i = π + 1, …, n, 1, …, π - 1, the following operations are performed in turn:

[0049] Randomly generate Calculate where c1 = c n+1 , c π+1 is a random number of an initial challenge, used to start the chain calculation; c n is the value after multiple iterations of calculation; c n+1 is the final value of the multiple iteration calculation; G is the base point of the preset elliptic curve, and pk i is the i-th public key in the public key set.

[0050] Calculate to get the pre-signature where is the signature value of the pre-signature, and skπ k is the signer's private key. π q is a preset random number, mod is the modulo operation, and q is a preset constant.

[0051] After the signer pre-signs the generated message m, the verifier uses a secret witness to convert the pre-signature into a full signature. Specifically, the verifier, upon receiving the pre-signature... Then, for i = π+1, ..., n, 1, ..., π-1, calculate... The full signature σ = (s1, s2, ..., s) is obtained. n (c1). After the validator publishes the full signature, the signer can obtain the full signature. The signer can restore the secret witness based on the full signature and the pre-signature to obtain the signature they need.

[0052] In this embodiment of the invention, the signature system includes users other than the signer and verifier. A public key set is constructed using the public keys of multiple users, and a key image is generated. During the signing process, any participant must sign using the public key set and the key image. External observers cannot directly associate the signature with a specific user, thus hiding the actual signer among multiple users and increasing transaction anonymity. In addition, the key image is generated based on the secret witness and the public key set. The signer's signature depends on the signer's private key, the public key set, and the key image. The secret witness is uniquely held by the verifier, and the private key is held only by the signer. Only users with the corresponding private key can generate a valid signature, which makes the signature unforgeable and increases the security of the signature.

[0053] Another embodiment of the present invention provides a signature method, which is applied to Figure 1 A signature authorization system, the method including, for example Figure 2 The following steps are shown:

[0054] Step S10: Key generation step.

[0055] In this step, the key generation center generates the public and private keys for each user. The specific generation method can be any key generation method. In some embodiments, the public and private keys for each user are generated using the SM2 algorithm. When generating the public and private keys for each user using the SM2 algorithm, system parameters are first selected using the elliptic curve in the SM2 algorithm. Specifically, the user inputs a security parameter λ, and the system parameters are calculated based on the pre-selected elliptic curve. The key generation center obtains the security parameter λ and selects a base point G based on the pre-selected elliptic curve. Wherein, the pre-selected elliptic curve y... 2 =x 3 The coefficients a and b in +ax+b satisfy 4a 3 +27b 2 ≠0, and the elliptic curve has a sufficiently large finite field. where p is a prime number. The points on the elliptic curve should have a high order to resist the discrete logarithm problem attack on the elliptic curve. The base point G is a generator in the elliptic curve group satisfying the above conditions, and the order n is a large prime number. The selection of the base point G has an important influence on the security and efficiency of the system, and the base point G is usually selected by experienced technicians in the field. Select an elliptic curve L that meets the requirements from the elliptic curve group to determine the parameters a and b. After selecting the elliptic curve L and the base point G, the key generation center selects a suitable hash function and verifies whether these parameters meet the security requirements to ensure that all curves and parameters not only meet the theoretical requirements but also resist various attacks that may be encountered in reality, such as congruence attacks, small subgroup attacks, etc. After passing the elliptic verification condition, the system parameters are obtained, including the base point G. The SM2 algorithm is a public key encryption technology that meets national standards and has been widely used in commercial and government systems, with good compatibility.

[0056] After determining the system parameters, the key generation center generates the public key and private key of each user. Specifically, a random number is selected as the private key sk of each user, and the public key pk = skG is distributed to each user through a secure channel. The key generation center selects a random number y as the secret witness, which must be within the range of the finite field defined by the elliptic curve L. The secret witness is the private secret witness of the verifier during the transaction and is not disclosed to ensure the security of the transaction.

[0057] Step S20: Key image generation step.

[0058] In this step, the verifier constructs a public key set from the public keys of multiple users and generates a key image L π from the public key set and its own secret witness y. The key image is the product of the verifier's secret witness and the public key set, i.e. where y is the secret witness. The verifier publishes the public key set , the public witness Y, and the key image L π for the signer to sign the generated information m. Among them, the public key set includes n public keys. It should be known that when constructing the public key set, part of the users in the multiple users can be selected to construct the public key set, or all users can be selected to construct the public key set. By selecting multiple users to participate in signing, the actual signer can be hidden.

[0059] Step S30: Pre-signature generation step.

[0060] In this step, the signer π uses the key image L π , the public key set and its own private key sk π The generated message is pre-signed. Specifically, the signer calculates... Where, k π π is a preset random number, and π is the position of the signer's public key in the public key set.

[0061] For i = π+1, ..., n, 1, ..., π-1, perform the following operations in sequence:

[0062] Randomly generated calculate Where, c1 = c n+1 c π+1 This is a random number for the initial challenge, used to begin calculating the chain; c n It is the value after multiple iterations of calculation; c n+1 It is the final value calculated through multiple iterations; pk i Let i be the i-th public key in the public key set.

[0063] calculate Get pre-signed in, It is the pre-signed signature value, sk π k is the signer's private key. π q is a preset random number, mod is the modulo operation, and q is a preset constant.

[0064] In some embodiments, before generating a pre-signature, the signer needs to verify whether their own public key is in the public key set. If not, they replace any public key in the set with their own public key and update the key image. The specific process is as follows: Updated public key set Calculate L π =sk π Y, Updated Key Mirror Set

[0065] Step S40: Full signature generation step.

[0066] In this step, the verifier uses a secret witness to transform the pre-signature into a full signature. Specifically, the verifier receives the pre-signature... Then, for i = π+1, ..., n, 1, ..., π-1, calculate... The full signature σ = (s1, s2, ..., s) is obtained. n ,c1),s i It is the signature value in the full signature.

[0067] Step S50: Secret Restoration Witness Step.

[0068] In this step, after the verifier publishes the full signature, the signer can obtain the full signature, and the signer can recover the secret witness according to the full signature and the pre-signature. When the signer obtains σ, the signer can recover the secret witness according to the full signature σ and the pre-signature Thus, the secret witness y is recovered. The specific recovery process is as follows:

[0069]

[0070] σ = (s1, s2,..., s n , c1)

[0071]

[0072] After the secret witness y is determined, the signature required by the signer can be obtained according to the secret witness y and the pre-signature. Specifically, the signer can convert the pre-signature of the verifier into a full signature according to the secret witness y of the verifier and the pre-signature of the verifier. The specific generation method of the pre-signature of the verifier is the same as that of the pre-signature of the signer. After the verifier full signature and the full signature of the signer are obtained, the transaction is completed.

[0073] In the embodiment of the present application, the signature system includes other users in addition to the signer and the verifier, a public key set is constructed through the public keys of the multiple users, and a key image is generated. In the signature process, any participant needs to sign through the public key set and the key image, and an external observer cannot directly associate the signature with a specific user, thereby hiding the actual signer in multiple users and increasing the transaction anonymity. In addition, the key image is generated according to the secret witness and the public key set, the signature of the signer is generated depending on the private key of the signer and the public key set and the key image, the secret witness is uniquely held by the verifier, the private key is only held by the signer, and only the user with the corresponding private key can generate a valid signature, which makes the signature unforgeable and increases the security of the signature.

[0074] Figure 3 A signature method of another embodiment of the present application is shown, and the method includes the following steps:

[0075] Step S11: key generation step.

[0076] Step S21: key image generation step.

[0077] Step S31: pre-signature generation step.

[0078] Steps S11 to S31 are the same as steps S10 to S30, respectively. Please refer to the description of steps S10 to S30.

[0079] Step S41: pre-signature verification step.

[0080] In this step, the verifier obtains the published key image L. π Public key set pre-signed Afterwards, regarding the pre-signature Verification will be performed. The specific verification process is as follows:

[0081] The examiner examines c′1. Does it hold true? If it does, then for i = 1, ..., n, calculate sequentially. Among them, Z i ' is an intermediate calculated value in the pre-signature verification process. As part of the computation chain, it is used to ensure the correctness of the pre-signature. c'1 = c1, where c'1 is the parameter used for the verification challenge. It is the pre-signature verification value used by the verifier, who can be any one of multiple users.

[0082] Test c1′=c n+1 Check if the condition is true. If true, the verification passes. If the verification passes, proceed with the following steps.

[0083] Step S51: Full signature generation step.

[0084] Step S61: Secret Restoration Witness Step.

[0085] Steps S51 to S61 are the same as steps S40 to S50. Please refer to the description of steps S40 to S50.

[0086] In this embodiment, the pre-signature is verified after the signer performs the pre-signature, thus ensuring the security of the signature.

[0087] Figure 4 Another embodiment of the present invention illustrates a signature method, which includes the following steps:

[0088] Step S12: Key generation step.

[0089] Step S22: Key image generation step.

[0090] Step S32: Pre-signature generation step.

[0091] Step S42: Full signature generation steps.

[0092] Steps S11 to S31 are the same as steps S10 to S30, respectively. Please refer to the description of steps S10 to S30.

[0093] Step S52: Full signature adaptation steps.

[0094] In this step, after obtaining the full signature, the verifier adapts it. Specifically, for i = 1, 2, ..., n, Z is calculated sequentially. i "=s i G+s i pk i +c″ i pk i , Where, c1″=c1; Z i " is an intermediate calculated value that needs to be verified during the full signature adaptation process, and is used for full signature adaptation. i+1 " is the challenge value required for full signature verification, used to verify whether the full signature is successfully adapted. Verify that c1" = c n+1 "Whether it is valid or not, if it is valid, the adaptation is successful."

[0095] Step S62: Secret Restoration Witness Step.

[0096] In this embodiment, a full signature adaptation step is added to ensure signature accuracy.

[0097] This invention utilizes ring adapter signatures, allowing participants to verify transactions without revealing their specific identities. This provides crucial privacy protection for applications requiring anonymity, such as certain cryptocurrency transactions. Due to the use of random witnesses and ring signatures, external observers cannot directly associate signatures with specific keys or identities, thus increasing transaction security and anonymity. The ring adapter signature scheme can be flexibly integrated into various systems and applications and is easily scalable to support larger signature groups or more complex verification scenarios. Since each signature is generated based on the user's private key and a specific ring configuration, this increases the unforgeability of the signature. Only users with the corresponding private key can generate valid signatures. Ring adapter signatures generate a unique witness value for each transaction, making it impossible to replay old transactions (to forge or reuse previous transactions).

[0098] Figure 5 A schematic diagram of an electronic device according to an embodiment of the present invention is shown, such as... Figure 5 As shown, the electronic device of this embodiment includes a memory 51 and a processor 52. The memory 51 stores a calculation program, which can be executed by the processor 52. When the calculation program is executed by the processor 52, the processor 52 can implement the steps corresponding to the signature method in any of the above embodiments.

[0099] It should be understood that in the embodiments of the present application, the memory 51 can be any kind of computer readable memory, such as RAM, Flash, etc., and the embodiments of the present application are not limited to the specific type of the memory 51. The processor 52 can be one or more, and the processor 52 can execute the corresponding logic of the computing program and output the computing result.

[0100] The embodiments of the present application also provide a computer readable storage medium, which stores a computing program, and when the computing program is executed, the steps corresponding to the signature method in any one of the above embodiments can be implemented.

[0101] The above only describes the preferred embodiments of the present application and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method of signing, characterized by, The method is applied to a signature authorization system, which includes a key generation center and multiple users. Communication is established between the key generation center and each user. The multiple users include signers and verifiers who participate in the signing process. The method includes: Key generation steps: The key generation center generates public and private keys for each user; Key image generating step: the verifier constructs a set of public key collection according to the public keys of the plurality of users and generates a key image according to the public key collection and its own secret witness wherein n is the number of public keys in the public key collection, and y is the secret witness. Pre-signature generation steps: The signer uses the key image, the public key set, and their own private key to pre-sign the generated message; Full signature generation steps: The verifier uses the secret witness to convert the pre-signature into a full signature; Secret Witness Recovery: The signer recovers the secret witness based on the full signature and the pre-signature to obtain the signature they need.

2. The method of claim 1, wherein, The pre-signature generation step includes: Computing wherein, is a preset hash function, is the public key set, m is the generated message, k π is a preset random number, π is the position of the public key of the signer in the public key set, Y is a preset public witness, L π is the key image; For i = π + 1, ..., n, 1, ..., π - 1, perform the following operations in sequence: Randomly generated Computing wherein c1 = c n+1 , c π+1 is a random number of an initial challenge for starting a chain of computation; c n is a value after multiple iterations of computation; c n+1 is a final value of the multiple iterations of computation; G is a base point of a preset elliptic curve, pk i is the i-th public key in the public key set; Computing Obtaining a pre-signature wherein, is a signature value of the pre-signature, sk π is a private key of the signer, k π is a preset random number, mod is a modulo operation, and q is a preset constant.

3. The method of claim 2, wherein, The method further includes: Pre-signature verification step: the verifier checks c'1, if it is true, then for i = 1,... n, in turn calculates wherein Z i ' is an intermediate calculation value in the pre-signature verification process, which is part of a calculation chain, used to ensure the correctness of the pre-signature; c'1 = c1, c'1 is a parameter used to verify the challenge, is a pre-signature verification value used by the verifier, and the verifier is any one of the plurality of users; Check if c1' = c holds, if so the verification is passed. n+1 ' holds, if so the verification is passed.

4. The method of claim 2, wherein, The full signature generation steps include: Calculate σ = (s1, s2, ..., s n c1) obtains the full signature; where, y is the witness to the aforementioned secret. For the pre-signature, i = 1, ..., n, where n is the number of public keys in the public key set, s i It is the signature value in the full signature.

5. The method as described in claim 4, characterized in that, Following the full signature generation step, the method further includes a full signature adaptation step: For i = 1, 2, ..., n, calculate Z sequentially. i "=s i G+s i pk i +c″ i pk i , Where, c1″=c1,Z i " is the intermediate calculated value that needs to be verified during the full signature adaptation process, used for full signature adaptation, c i+1 " is the challenge value required for the full signature verification, used to verify whether the full signature is successfully adapted; Check if c1"= c n+1 is true, if true then adaptation is successful.

6. The method as described in claim 1, characterized in that, Prior to the pre-signature generation step, the method further includes: Public key set update steps: The signer determines whether its own public key is in the public key set. If not, it replaces any public key in the public key set with its own public key and updates the key image.

7. The method as described in claim 1, characterized in that, The key generation step includes: Choose a random number as each user's private key sk; Calculate the public key pk = skG for each user, where G is the base point of a preset elliptic curve.

8. A signature authorization system, the signature authorization system comprising a key generation center and multiple users, wherein the key generation center and each user establish communication, and the multiple users include signers and verifiers participating in the signing; characterized in that, The signature authorization system performs the signature method as described in any one of claims 1-7.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a calculation program, and when the calculation program is executed by the processor, the processor implements the signature method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computational program, which, when executed by a processor, implements the signature method as described in any one of claims 1-7.

Images