Threshold structure preserving signature generation method and system on equivalence class

Abstract

The invention discloses a threshold structure preserving signature generation method and system on an equivalence class, and the method comprises the following steps: 1), a signature party generates a signature public and private key pair of the signature party, and initializes a plurality of ideal performance functions; 2) t signers use own private key shares to generate signature shares; and 3) aggregating the signature shares of the t signers to generate a completed signature, and verifying the legality of the signature. The method has the advantages of high security, low communication cost and the like, and can be applied to multiple fields of anonymous certificates, group signatures and the like.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a threshold structure-preserving signature generation method and system on an equivalence class. Background Art

[0002] Structure preserving signatures (SPS) are signature schemes defined on bilinear pairing-friendly groups, where the message, signature, and verification key consist only of source group elements, and the correctness verification of the signature only includes group membership checks and pairing product equations. Structure preserving signatures are compatible with GrothSahai's non-interactive zero-knowledge proofs and help avoid expensive exponential extraction operations in security proofs, which makes them popular in the modular design of protocols that rely on signatures and non-interactive zero-knowledge proofs.

[0003] Structure Preserving Signatures on Equivalence Classes (SPSEQ) is an extension of structure preserving signatures. Its core function is to convert the signature σ generated by a message m under a public key pk into the signature σ′ of an equivalent message m′ under pk. This process depends on the proper definition of equivalence. Structure Preserving Signatures on Equivalence Classes have a wide range of application potentials in privacy protection mechanisms and are often used as key components of anonymous credentials, group signatures, blind signatures and related applications.

[0004] However, existing methods cannot ensure that the private key is not leaked while ensuring the correctness of the signature. Summary of the invention

[0005] The present invention provides a threshold structure-preserving signature generation method on an equivalence class. This scheme can ensure the correctness of the signature and prevent the private key from being leaked when multiple parties collaborate to generate the signature, and multiple parties must participate in the signature generation process simultaneously.

[0006] In order to achieve the above object, the first aspect of the present invention provides a method for generating a threshold structure-preserving signature on an equivalence class, comprising:

[0007] Each signing party generates its own signature public-private key pair and initializes several ideal function functions, where the several ideal function functions include key generation ideal function, cryptographic commitment ideal function, zero-share sampling ideal function and random vector oblivious linear function evaluation ideal function. The key generation ideal function function is used to generate the public-private key shares of each signing party. The cryptographic commitment ideal function includes commitment and open commitment. The zero-share sampling ideal function function is used to generate threshold secret sharing and the random vector oblivious linear function evaluation ideal function.

[0008] Each signing party uses its own private key share to generate a signature share;

[0009] Aggregate the signature shares of each signing party to generate a complete structure-preserving signature on the equivalence class.

[0010] In one implementation, each signing party generates its own public and private key pair and initializes several ideal function functions, including:

[0011] When receiving the initialization instruction from the environment, each signing participant sends a key generation operation instruction to the key generation ideal function, wherein the key generation operation instruction includes a key generation parameter, so as to generate the public and private key shares of the signing participant based on the key generation parameter through the key generation ideal function;

[0012] Each signing party sets the parameters of the cryptographic commitment ideal power function, the zero-share sampling ideal power function, and the ideal power function of the random vector oblivious linear function evaluation for initialization.

[0013] In one embodiment, the method further comprises:

[0014] When the key generation ideal function receives a termination command from the adversary, the key generation ideal function terminates;

[0015] When each signing party receives the public and private key share information sent by the key generation ideal function, it sends the public key share to the environment.

[0016] In one implementation, each signing participant generates a signature share using its own private key share, including:

[0017] When receiving the signature operation instruction from the environment, each signature participant performs initialization operation and generates signature intermediate variables after randomly selecting parameters;

[0018] The signing party sends the commitment operation instruction to the cryptographic commitment ideal function, sends the sampling operation instruction to the random vector oblivious linear function evaluation ideal function, and sends the instruction for zero secret sharing with other signing parties to the zero-share sampling ideal function;

[0019] After the signing party receives the message of completion of commitment sent by the cryptographic commitment ideal function based on the commitment operation instruction, the message of preparation for operation and sampling completion sent by the random vector oblivious linear function evaluation ideal function based on the sampling operation instruction, and the message of masking operation sent by the zero-share sampling ideal function based on the instruction of sharing zero secrets with other signing parties, the signing party sends the multiplication operation instruction to the random vector oblivious linear function evaluation ideal function;

[0020] Receive instructions for product-additive sharing operations sent by other signing parties, and jointly run the ideal function of random vector oblivious linear function evaluation; then send the commitment opening operation instruction to the cryptographic commitment ideal function, and send the consistency check operation instruction to other signing parties;

[0021] After receiving the open commitment message sent by the cryptographic commitment ideal function based on the commitment open operation instruction, the output sent by the ideal function evaluated by the random vector oblivious linear function based on the product additive sharing operation instruction, and the consistency check result messages from other signing participants, the signing participant generates a signature share.

[0022] In one embodiment, the method further includes: if an instance of an ideal functional function of an inadvertent linear function evaluation of a random vector shared by two signing parties is aborted, one signing party sends a failure instruction to the other signing party.

[0023] In one implementation, the signature shares of each signing party are aggregated to generate a complete structure-preserving signature on an equivalence class, including:

[0024] After receiving the signature share message sent by other signing participants, the signature parameters are generated according to the signature share therein, and a complete structure on the equivalence class is constructed to maintain the signature.

[0025] In one embodiment, the method further comprises:

[0026] The structure preservation signature on the generated complete equivalence class is verified. If the verification passes, the signature is output, otherwise, a failure instruction is output.

[0027] Based on the same inventive concept, the second aspect of the present invention provides a threshold structure-preserving signature generation system on an equivalence class, comprising:

[0028] An initialization module is used for each signing party to generate its own signature public and private key pair and initialize several ideal function functions, where the several ideal function functions include a key generation ideal function function, a cryptographic commitment ideal function function, a zero-share sampling ideal function function, and an ideal function function of random vector oblivious linear function evaluation. The key generation ideal function function is used to generate the public and private key shares of each signing party. The cryptographic commitment ideal function function includes commitment and open commitment. The zero-share sampling ideal function function is used to generate threshold secret sharing and the ideal function function of random vector oblivious linear function evaluation.

[0029] The signature share generation module is used by each signing party to generate a signature share using its own private key share;

[0030] The structure-preserving signature generation module on the equivalence class is used to aggregate the signature shares of each signing party to generate a complete structure-preserving signature on the equivalence class.

[0031] Based on the same inventive concept, the third aspect of the present invention provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the method described in the first aspect is implemented.

[0032] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0033] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0034] (1) Multiple signatories (signature participants) must participate together to complete the signing of the message without leaking their respective private keys; (2) The communication cost is low and has an optimal number of interaction rounds; (3) No complex zero-knowledge proof is required to ensure security under the malicious adversary model. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 The overall flow chart of the threshold structure-preserving signature generation method on the equivalence class provided by the embodiment of the present invention;

[0037] Figure 2A structural diagram of a threshold structure-preserving signature generation system on an equivalence class provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0038] The present invention discloses a method for generating signatures with threshold structure preservation on an equivalence class. The method comprises the following steps: 1) the signatory generates its own signature public-private key pair and initializes several ideal function functions; 2) t signatory parties use their own private key shares to generate signature shares; 3) the signature shares of t signatory parties are aggregated to generate a completed signature, and the legitimacy of the signature is verified. The present invention has the advantages of high security and low communication cost, and can be applied to multiple fields such as anonymous credentials and group signatures.

[0039] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] Embodiment 1

[0041] The embodiment of the present invention provides a method for generating a threshold structure-preserving signature on an equivalence class, see Figure 1 ,include:

[0042] S1: Each signing party generates its own signature public and private key pair and initializes several ideal function functions, where the several ideal function functions include key generation ideal function, cryptographic commitment ideal function, zero-share sampling ideal function and random vector oblivious linear function evaluation ideal function. The key generation ideal function is used to generate the public and private key shares of each signing party. The cryptographic commitment ideal function includes commitment and open commitment. The zero-share sampling ideal function is used to generate threshold secret sharing and the random vector oblivious linear function evaluation ideal function.

[0043] S2: Each signing party generates a signature share using its own private key share;

[0044] S3: Aggregate the signature shares of each signing party to generate a complete structure-preserving signature on the equivalence class.

[0045] Specifically, the specific symbols used and involved in this application are described as follows:

[0046] q: a large prime number.

[0047] The set of integers consisting of 0, 1, 2, …, q-1.

[0048] The additive cyclic group of order prime number q.

[0049] The multiplicative cyclic group of order prime number q.

[0050] G, Cyclic Group The generator of .

[0051] uH, group u times the element H in the group Medium Element u times.

[0052] n: The upper limit of the number of signatories.

[0053] t: threshold value.

[0054] l: length of the message vector.

[0055] [t]: An integer set consisting of 1, 2, …, t.

[0056] sk: the signer's private key sk = {x i} i∈[l] .

[0057] pk: the signer's public key

[0058] : Message to be signed It is a message equivalence class representative element.

[0059] λ j (·): Lagrange interpolation basis function.

[0060] j,k: Signature subscript.

[0061] J: the signer subscript set, where |J|=t.

[0062] Signing party.

[0063] Key generation ideal function. The input is (n, t, q), the output is m public and private key shares.

[0064] Ideal cryptographic commitment function. Contains two algorithms: committed and decommit.

[0065] Zero-share sampling ideal function. The input is The output is l zero-valued (n,t)-threshold secret shares.

[0066] The ideal function for evaluating a random vector random linear function. The input is {x i} i∈[l] , the output is θ,{c i ,d i} i∈[l] , satisfying the equation x i θ=c i +d i , where θ is a random number and x i is the input variable, c i d i is the output variable.

[0067] Specifically, the present invention provides a method for generating a threshold structure-preserving signature on an equivalence class, including various signing participants, multiple ideal function functions, and an environment. S1 is system initialization, including generating the signature key of each participant and initializing several ideal function functions. S2 is the generation of signature shares, where each participant generates its own signature share through interaction with the ideal function function. S3 is the generation of a complete structure-preserving signature on an equivalence class, where a complete signature is generated by aggregating the signature shares of each participant.

[0068] In one implementation, each signing party generates its own public and private key pair and initializes several ideal function functions, including:

[0069] When receiving the initialization instruction from the environment, each signing participant sends a key generation operation instruction to the key generation ideal function, wherein the key generation operation instruction includes a key generation parameter, so as to generate the public and private key shares of the signing participant based on the key generation parameter through the key generation ideal function;

[0070] Each signing party sets the parameters of the cryptographic commitment ideal power function, the zero-share sampling ideal power function, and the ideal power function of the random vector oblivious linear function evaluation for initialization.

[0071] In one embodiment, the method further comprises:

[0072] When the key generation ideal function receives a termination command from the adversary, the key generation ideal function terminates;

[0073] When each signing party receives the public and private key share information sent by the key generation ideal function, it sends the public key share to the environment.

[0074] In the specific implementation process, the participants Take the following as an example to explain the specific implementation process of the initialization step. Receive (init, sid), where sid is the fresh session identifier, each participant Perform the following steps:

[0075] Check if (key-pair,sid,pk,p(i)) exists, where key-pair is the key pair identifier. If not, send (keygen,sid) to the ideal function

[0076] When the ideal function When the suspension Abort.

[0077] When receiving the ideal function News back, send Give environment.

[0078] Each party executes and Any initialization process related to it.

[0079] It should be noted that keygen is the instruction identifier for the key generation operation, and the ideal function Execute the key generation operation. When receiving the adversary's abort command, the ideal function will terminate. key-pair is the key pair identifier. represents a key pair message, Indicates public key information.

[0080] In one implementation, each signing participant generates a signature share using its own private key share, including:

[0081] When receiving the signature operation instruction from the environment, each signature participant performs initialization operation and generates signature intermediate variables after randomly selecting parameters;

[0082] The signing party sends the commitment operation instruction to the cryptographic commitment ideal function, sends the sampling operation instruction to the random vector oblivious linear function evaluation ideal function, and sends the instruction for zero secret sharing with other signing parties to the zero-share sampling ideal function;

[0083] After the signing party receives the message of completion of commitment sent by the cryptographic commitment ideal function based on the commitment operation instruction, the message of preparation for operation and sampling completion sent by the random vector oblivious linear function evaluation ideal function based on the sampling operation instruction, and the message of masking operation sent by the zero-share sampling ideal function based on the instruction of sharing zero secrets with other signing parties, the signing party sends the multiplication operation instruction to the random vector oblivious linear function evaluation ideal function;

[0084] Receive instructions for product-additive sharing operations sent by other signing parties, and jointly run the ideal function of random vector oblivious linear function evaluation; then send the commitment opening operation instruction to the cryptographic commitment ideal function, and send the consistency check operation instruction to other signing parties;

[0085] After receiving the open commitment message sent by the cryptographic commitment ideal function based on the commitment open operation instruction, the output sent by the ideal function evaluated by the random vector oblivious linear function based on the product additive sharing operation instruction, and the consistency check result messages from other signing participants, the signing participant generates a signature share.

[0086] In the specific implementation process, the process of generating signature shares is as follows:

[0087] 1) When receiving (sign, sid, sigid, J) Initialize the protocol. Let J -k :=J\{k},k∈J

[0088] 2) Random Selection And calculate R j :=r j G,

[0089] 3) send

[0090] For all j∈J -k , Give

[0091] For all j∈J -k , Give

[0092] Give

[0093] 4) When receiving

[0094] For all j∈J-k , News

[0095] For all j∈J -k , News

[0096] For all j∈J -k , News

[0097] News

[0098] calculate And send Give Then, after receiving all j∈J -k News after, calculate and φ j,k :=y j -x j,k Then, send Give send Give

[0099] 5) When receiving

[0100] News

[0101] News

[0102] News

[0103] Check the following equation (perform consistency check): (i) (ii) (iii) (iv) If the above equations are all true, calculate

[0104]

[0105]

[0106]

[0107] And (fragment, sid, sigid, u j})Send to each k∈J -j The participants of with u i is the element of the signature share. On the other hand, if and Shared The instance terminates, or any of the above equations does not hold, then will send (fail, sid, sigid) to all other participants and The corresponding point in the concurrent signing session sends a similar message to the environment, outputs (failure, sid, sigid), and no longer continues to execute the following steps (the step of aggregating signature shares), nor does it participate in the Any future signing sessions.

[0108] It should be noted that sign is the instruction identifier of the signature operation, and sigid is the signature identifier. (sign, sid, sigid, J) means that the signer set J is required to sign the message The command to sign. -k :=J\{k}, k∈J, which means the set consisting of all elements that belong to set J but not to set {k}, y j Used for The subsequent signature, R j , Is the signature intermediate variable.

[0109] express Towards promise Tuple, Express to Initiate and Run the ideal function together express The initiative aims to The secret sharing of zero is performed between the two operations, commit represents the instruction identifier of the committed operation, sample represents the instruction identifier of the sampled operation, committed represents the instruction identifier of the committed completed operation, ready represents the instruction identifier of the ready operation, mask represents the instruction identifier of the masked operation, and j,k yes The random number generated, is the secret share of zero.

[0110] express Initiate and Run the ideal function together Providing Input multiply represents the instruction identifier of the multiplication operation. express Initiate and Run the ideal function together Calculation Output share represents the instruction identifier of the product addition sharing operation. express Towards The commitment opening instruction, decommit indicates the instruction identifier of the commitment opening, Indicates the elements contained in brackets Used for consistency checking, check-adjust indicates the identifier of the consistency checking instruction.

[0111] Instructions for signing shares, express The signature share of the fragment is the identifier of the signature share instruction, and (fail,sid,sigid) and (failure,sid,siigid) represent failed instructions.

[0112] In one embodiment, the method further includes: if an instance of an ideal functional function of an inadvertent linear function evaluation of a random vector shared by two signing parties is aborted, one signing party sends a failure instruction to the other signing party.

[0113] In one implementation, the signature shares of each signing party are aggregated to generate a complete structure-preserving signature on an equivalence class, including:

[0114] After receiving the signature share message sent by other signing participants, the signature parameters are generated according to the signature share therein, and a complete structure on the equivalence class is constructed to maintain the signature.

[0115] In one embodiment, the method further comprises:

[0116] The structure preservation signature on the generated complete equivalence class is verified. If the verification passes, the signature is output, otherwise, a failure instruction is output.

[0117] The steps to generate a complete signature are as follows:

[0118] When all participants k∈J are received -j News calculate and Then verify Is it true? If not, output (failure, sid, sigid) to the environment. Otherwise, output

[0119] When receiving a message (fail, sid, sigid) from any participant, Send (failure, sid, sigid) to the environment and do not execute the above steps again.

[0120] It should be noted that Instructions for signing shares, express The signature share of Represents the complete signature message, signature represents the instruction identifier of the final signature, is a structure on the equivalence class that holds the signature, and pk represents the public key.

[0121] Compared with the prior art, the present invention has the following advantages: (1) t signatories must participate together to complete the signing of the message without leaking part of their private keys; (2) the communication cost is low and has the optimal number of interaction rounds; (3) no complex zero-knowledge proof is required to ensure security under the malicious adversary model.

[0122] Embodiment 2

[0123] Based on the same inventive concept, this embodiment provides a threshold structure-preserving signature generation system on an equivalence class, see Figure 2 ,include:

[0124] Initialization module 301, used for each signing party to generate its own signature public and private key pair, and initialize several ideal function functions, where the several ideal function functions include key generation ideal function function, cryptographic commitment ideal function function, zero-share sampling ideal function function and random vector oblivious linear function evaluation ideal function function, the key generation ideal function function is used to generate the public and private key shares of each signing party, the cryptographic commitment ideal function function includes commitment and open commitment, the zero-share sampling ideal function function is used to generate threshold secret sharing, and the random vector oblivious linear function evaluation ideal function function;

[0125] The signature share generation module 302 is used for each signing participant to generate a signature share using his own private key share;

[0126] The structure-preserving signature generation module 303 on the equivalence class is used to aggregate the signature shares of each signing participant to generate a complete structure-preserving signature on the equivalence class.

[0127] Since the system introduced in the second embodiment of the present invention is a system used to implement the structure-preserving signature generation method on the equivalence class in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the system, so it is not repeated here. All systems used in the method in the first embodiment of the present invention belong to the scope of protection of the present invention.

[0128] Embodiment 3

[0129] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0130] Since the computer-readable storage medium introduced in the third embodiment of the present invention is the computer-readable storage medium used to implement the structure-preserving signature generation method on the equivalence class in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the computer-readable storage medium, so it is not repeated here. All computer-readable storage media used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0131] Embodiment 4

[0132] Based on the same inventive concept, the present application also provides a computer device, including storage, a processor, and a computer program stored in the storage and executable on the processor. When the processor executes the program, the method in Embodiment 1 is implemented.

[0133] Since the computer device introduced in the fourth embodiment of the present invention is a computer device used to implement the threshold structure preserving signature generation method on the equivalence class in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the computer device, so it is not repeated here. All computer devices used in the method in the first embodiment of the present invention belong to the scope of protection of the present invention.

[0134] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0135] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0136] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0137] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A threshold structure-preserving signature generation method on an equivalence class, characterized in that: include: Each signing party generates its own signature public-private key pair and initializes several ideal function functions, where the several ideal function functions include key generation ideal function, cryptographic commitment ideal function, zero-share sampling ideal function and random vector oblivious linear function evaluation ideal function. The key generation ideal function function is used to generate the public-private key shares of each signing party. The cryptographic commitment ideal function includes commitment and open commitment. The zero-share sampling ideal function function is used to generate threshold secret sharing and the random vector oblivious linear function evaluation ideal function. Each signing party uses its own private key share to generate a signature share; Aggregate the signature shares of each signing party to generate a complete structure-preserving signature on the equivalence class.

2. The method for generating a threshold structure-preserving signature on an equivalence class according to claim 1, characterized in that: Each signing party generates its own public and private key pair and initializes several ideal functional functions, including: When receiving the initialization instruction from the environment, each signing participant sends a key generation operation instruction to the key generation ideal function, wherein the key generation operation instruction includes a key generation parameter, so as to generate the public and private key shares of the signing participant based on the key generation parameter through the key generation ideal function; Each signing party sets the parameters of the cryptographic commitment ideal power function, the zero-share sampling ideal power function, and the ideal power function of the random vector oblivious linear function evaluation for initialization.

3. The method for generating a threshold structure-preserving signature on an equivalence class according to claim 2, characterized in that: The method further comprises: When the key generation ideal function receives a termination command from the adversary, the key generation ideal function terminates; When each signing party receives the public and private key share information sent by the key generation ideal function, it sends the public key share to the environment.

4. The method for generating a threshold structure-preserving signature on an equivalence class according to claim 3, characterized in that: Each signing party uses its own private key share to generate a signature share, including: When receiving the signature operation instruction from the environment, each signature participant performs initialization operation and generates signature intermediate variables after randomly selecting parameters; The signing party sends the commitment operation instruction to the cryptographic commitment ideal function, sends the sampling operation instruction to the random vector oblivious linear function evaluation ideal function, and sends the instruction for zero secret sharing with other signing parties to the zero-share sampling ideal function; After the signing party receives the message of completion of commitment sent by the cryptographic commitment ideal function based on the commitment operation instruction, the message of preparation for operation and sampling completion sent by the random vector oblivious linear function evaluation ideal function based on the sampling operation instruction, and the message of masking operation sent by the zero-share sampling ideal function based on the instruction of sharing zero secrets with other signing parties, the signing party sends the multiplication operation instruction to the random vector oblivious linear function evaluation ideal function; Receive instructions for product-additive sharing operations sent by other signing parties, and jointly run the ideal function of random vector oblivious linear function evaluation; then send the commitment opening operation instruction to the cryptographic commitment ideal function, and send the consistency check operation instruction to other signing parties; After receiving the open commitment message sent by the cryptographic commitment ideal function based on the commitment open operation instruction, the output sent by the ideal function evaluated by the random vector oblivious linear function based on the product additive sharing operation instruction, and the consistency check result messages from other signing participants, the signing participant generates a signature share.

5. The method for generating a threshold structure-preserving signature on an equivalence class according to claim 4, characterized in that: The method also includes: if the instance of the ideal functional function of the random vector shared by the two signing parties is aborted by the inadvertent linear function evaluation, one signing party sends a failure instruction to the other signing party.

6. The method for generating a threshold structure-preserving signature on an equivalence class according to claim 5, characterized in that: Aggregate the signature shares of each signing party to generate a complete structure-preserving signature on the equivalence class, including: After receiving the signature share message sent by other signing participants, the signature parameters are generated according to the signature share therein, and a complete structure on the equivalence class is constructed to maintain the signature.

7. The method for generating a threshold structure-preserving signature on an equivalence class according to claim 6, characterized in that: The method further comprises: The structure preservation signature on the generated complete equivalence class is verified. If the verification passes, the signature is output, otherwise, a failure instruction is output.

8. A threshold structure-preserving signature generation system on equivalence classes, characterized in that: include: An initialization module is used for each signing party to generate its own signature public and private key pair and initialize several ideal function functions, where the several ideal function functions include a key generation ideal function function, a cryptographic commitment ideal function function, a zero-share sampling ideal function function, and an ideal function function of random vector oblivious linear function evaluation. The key generation ideal function function is used to generate the public and private key shares of each signing party. The cryptographic commitment ideal function function includes commitment and open commitment. The zero-share sampling ideal function function is used to generate threshold secret sharing and the ideal function function of random vector oblivious linear function evaluation. The signature share generation module is used by each signing party to generate a signature share using its own private key share; The structure-preserving signature generation module on the equivalence class is used to aggregate the signature shares of each signing party to generate a complete structure-preserving signature on the equivalence class.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for generating a threshold structure-preserving signature on an equivalence class as described in any one of claims 1 to 7 is implemented.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the threshold structure preserving signature generation method on the equivalence class as described in any one of claims 1 to 7 is implemented.

Images