Threshold structure maintaining signature generation method and system on an equivalence class

Abstract

The application discloses a threshold structure keeping signature generation method and system on equivalence classes, wherein the method comprises the following steps: 1) a signing party generates its own signature public and private key pair, and initializes a plurality of ideal function functions; 2) t signing parties generate signature shares by using their own private key shares; and 3) an integrated signature is generated by aggregating the signature shares of the t signing parties, and the legality of the signature is verified. The application has the advantages of high security, small communication cost and the like, and can be applied to multiple fields such as anonymous credentials, group signature and the like.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a threshold structure preserving signature generation method and system on equivalence classes. BACKGROUND

[0002] Structure preserving signatures (SPS) is a signature scheme defined on a bilinear pair-friendly group, wherein the message, signature and verification key are composed of source group elements, and the correctness verification of the signature only includes group member checking and pairing product equation. The structure preserving signature is compatible with the non-interactive zero-knowledge proof of Groth Sahai, and helps to avoid the expensive exponential extraction operation in security proof, which makes it popular in the modular design of protocol relying on signature and non-interactive zero-knowledge proof.

[0003] Structure Preserving Signatures on Equivalence Classes (SPSEQ) is an extension of structure preserving signatures, and its core function is to convert the signature sigma generated by the message m under the public key pk into the signature sigma' under pk, which depends on the proper definition of equivalence. The structure preserving signature on equivalence classes has wide application potential in privacy protection mechanism, and is often used as a key component of anonymous credentials, group signatures, blind signatures and related applications.

[0004] Then, the existing method cannot guarantee the correctness of the signature while guaranteeing that the private key is not disclosed. SUMMARY

[0005] The present application provides a threshold structure preserving signature generation method on equivalence classes, which can guarantee the correctness of the signature and the non-disclosure of the private key in the case of multi-party cooperation to generate the signature, and the process of generating the signature must be participated by multiple parties at the same time.

[0006] In order to achieve the above purpose, the first aspect of the present application provides a threshold structure preserving signature generation method on equivalence classes, comprising:

[0007] Each signing party generates its own public-private key pair and initializes several ideal function functions, including the key generation ideal function function, the cryptographic commitment ideal function function, the zero-share sampling ideal function function, and the random vector oblivious linear function evaluation ideal function function. The key generation ideal function function is used to generate the public-private key shares of each signing party. The cryptographic commitment ideal function function includes commitment and open commitment. The zero-share sampling ideal function function is used to generate threshold secret sharing and the random vector oblivious linear function evaluation ideal function function.

[0008] Each signing party uses its own private key share to generate a signature share;

[0009] Aggregate the signature shares of each signing party to generate a complete structure-preserving signature on the equivalence class.

[0010] In one embodiment, each signing party generates its own public and private key pair and initializes several ideal functions, including:

[0011] When receiving an initialization instruction from the environment, each signing party sends a key generation operation instruction to the key generation ideal function, wherein the key generation operation instruction includes key generation parameters, so as to generate the public and private key shares of the signing party based on the key generation parameters through the key generation ideal function;

[0012] Each signing party sets the parameters of the cryptographic commitment ideal power function, the zero-share sampling ideal power function, and the ideal power function of the random vector oblivious linear function evaluation for initialization.

[0013] In one embodiment, the method further comprises:

[0014] When the key generation ideal function receives the adversary's termination command, the key generation ideal function terminates;

[0015] When each signing party receives the public and private key share information sent by the key generation ideal function, it sends the public key share to the environment.

[0016] In one embodiment, each signing participant generates a signature share using its own private key share, including:

[0017] When receiving the signature operation instruction from the environment, each signing participant performs initialization operations and randomly selects parameters to generate signature intermediate variables;

[0018] The signature participant sends a commitment operation instruction to the ideal function of the cryptographic commitment, sends a sampling operation instruction to the ideal function of the random vector oblivious linear function evaluation, and sends an instruction of sharing zero with other signature participants to the ideal function of the zero share sampling;

[0019] When the signature participant receives a message of commitment completion sent by the ideal function of the cryptographic commitment based on the commitment operation instruction, a message of preparing operation sent by the ideal function of the random vector oblivious linear function evaluation based on the sampling operation instruction, and a message of sampling completion, and a message of performing masking operation sent by the ideal function of the zero share sampling based on the instruction of sharing zero with other signature participants, the signature participant sends a multiplication operation instruction to the ideal function of the random vector oblivious linear function evaluation;

[0020] Receiving the instruction of product additive sharing operation sent by other signature participants, the ideal function of the random vector oblivious linear function evaluation is run together; then the signature participant sends a commitment opening operation instruction to the ideal function of the cryptographic commitment, and sends a consistency checking operation instruction to other signature participants;

[0021] When receiving a message of opening commitment sent by the ideal function of the cryptographic commitment based on the commitment opening operation instruction, an output sent by the ideal function of the random vector oblivious linear function evaluation based on the instruction of product additive sharing operation, and a message of consistency checking result of other signature participants, the signature participant generates a signature share.

[0022] In an embodiment, the method further comprises: if the instance of the ideal function of the random vector oblivious linear function evaluation shared by two signature participants is aborted, one signature participant sends a failure instruction to other signature participants.

[0023] In an embodiment, aggregating the signature shares of each signature participant to generate a complete structure-preserving signature on an equivalence class comprises:

[0024] When receiving the signature share message sent by other signature participants, the signature parameter is generated according to the signature share therein, and a complete structure-preserving signature on an equivalence class is constituted.

[0025] In an embodiment, the method further comprises:

[0026] The generated complete structure-preserving signature on an equivalence class is verified, if the verification is passed, the signature is output, otherwise, a failure instruction is output.

[0027] Based on the same inventive concept, the second aspect of the present application provides a threshold structure-preserving signature generation system on an equivalence class, comprising:

[0028] An initialization module is used for each signing party to generate its own signature public and private key pair and initialize several ideal function functions, including the key generation ideal function function, the cryptographic commitment ideal function function, the zero-share sampling ideal function function, and the random vector oblivious linear function evaluation ideal function function. The key generation ideal function function is used to generate the public and private key shares of each signing party. The cryptographic commitment ideal function function includes commitment and open commitment. The zero-share sampling ideal function function is used to generate threshold secret sharing and the random vector oblivious linear function evaluation ideal function function.

[0029] The signature share generation module is used by each signing party to generate a signature share using their own private key share;

[0030] The structure-preserving signature generation module on the equivalence class is used to aggregate the signature shares of each signing party to generate a complete structure-preserving signature on the equivalence class.

[0031] Based on the same inventive concept, the third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which implements the method described in the first aspect when the program is executed by a processor.

[0032] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0033] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0034] (1) Multiple signatories (signing participants) must participate together to complete the signing of the message without leaking part of their private keys; (2) The communication cost is low and has an optimal number of interaction rounds; (3) No complex zero-knowledge proof is required to ensure security under the malicious adversary model. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0036] Figure 1 The overall flow chart of the threshold structure-preserving signature generation method on the equivalence class provided by the embodiment of the present invention;

[0037] Figure 2A structure diagram of a threshold structure maintaining signature generation system provided by an embodiment of the present application is shown. DETAILED DESCRIPTION

[0038] The present application discloses a threshold structure maintaining signature generation method on equivalence classes. The method comprises the following steps: 1) a signature party generates its own signature public and private key pair and initializes a plurality of ideal function functions; 2) t signature parties generate signature shares using their own private key shares; and 3) a complete signature is generated by aggregating the signature shares of the t signature parties, and the legality of the signature is verified. The present application has the advantages of high security and small communication cost, and can be applied to multiple fields such as anonymous credentials and group signature.

[0039] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0040] Embodiment one

[0041] The present application provides a threshold structure maintaining signature generation method on equivalence classes, please refer to Figure 1 , comprising:

[0042] S1: Each signature party generates its own signature public and private key pair and initializes a plurality of ideal function functions, wherein the plurality of ideal function functions comprise a key generation ideal function function, a cryptographic commitment ideal function function, a zero share sampling ideal function function and a random vector inadvertent linear function evaluation ideal function function, the key generation ideal function function is used for generating public and private key shares of each signature party, the cryptographic commitment ideal function function comprises commitment and commitment opening, the zero share sampling ideal function function is used for generating a threshold secret sharing, and the random vector inadvertent linear function evaluation ideal function function;

[0043] S2: Each signature party generates a signature share using its own private key share;

[0044] S3: A complete threshold structure maintaining signature on equivalence classes is generated by aggregating the signature shares of each signature party.

[0045] Specifically, the specific symbols used and involved in the present application are described as follows:

[0046] q: a large prime number.

[0047] An integer set consisting of 0, 1, 2, …, q-1.

[0048] The additive cyclic group of order prime number q.

[0049] The multiplicative cyclic group of order prime number q.

[0050] G, Cyclic Group The generator of .

[0051] uH, group u times the element H in the group Chinese elements u times.

[0052] n: The upper limit of the number of signatories.

[0053] t: threshold value.

[0054] l: length of the message vector.

[0055] [t]: The set of integers consisting of 1, 2, …, t.

[0056] sk: the signer's private key sk={x i} i∈[l] .

[0057] pk: the signer's public key

[0058] : Message to be signed It is a message equivalence class representative element.

[0059] λ j (·): Lagrange interpolation basis function.

[0060] j,k: Signature subscript.

[0061] J: The signer subscript set, where |J| = t.

[0062] Signing party.

[0063] Key generation ideal function. Input is (n, t, q), the output is m public and private key shares.

[0064] Ideal cryptographic commitment function. Contains two algorithms: committed and decommit.

[0065] Zero-share sampling ideal function. The input is The output is l zero-valued (n,t)-threshold secret shares.

[0066] The ideal function for evaluating a random vector of random linear functions. The input is {x i} i∈[l] , the output is θ,{c i ,d i} i∈[l] , satisfying the equation x i θ=c i +d i , where θ is a random number, x i is the input variable, c i d i is the output variable.

[0067] Specifically, this invention provides a method for generating threshold structure-preserving signatures on equivalence classes, including various signing parties, multiple ideal function functions, and an environment. S1 is system initialization, including generating the signing keys of each party and initializing several ideal function functions. S2 is the generation of signature shares, with each party generating its own signature share through interaction with the ideal function functions. S3 is the generation of a complete structure-preserving signature on the equivalence class, generating the complete signature by aggregating the signature shares of each party.

[0068] In one embodiment, each signing party generates its own public and private key pair and initializes several ideal functions, including:

[0069] When receiving an initialization instruction from the environment, each signing party sends a key generation operation instruction to the key generation ideal function, wherein the key generation operation instruction includes key generation parameters, so as to generate the public and private key shares of the signing party based on the key generation parameters through the key generation ideal function;

[0070] Each signing party sets the parameters of the cryptographic commitment ideal power function, the zero-share sampling ideal power function, and the ideal power function of the random vector oblivious linear function evaluation for initialization.

[0071] In one embodiment, the method further comprises:

[0072] When the key generation ideal function receives the adversary's termination command, the key generation ideal function terminates;

[0073] When each signing party receives the public and private key share information sent by the key generation ideal function, it sends the public key share to the environment.

[0074] In the specific implementation process, the participants To illustrate the implementation of the initialization step, consider the case where a (init, sid) is received from the environment, where sid is a fresh session identifier, and each participant performs the following steps:

[0075] Check if (key-pair, sid, pk, p(i)) exists, where key-pair is a key-pair identifier. If not, send (keygen, sid) to the ideal function

[0076] When the ideal function is aborted, abort.

[0077] When a message is received from the ideal function , send to the environment.

[0078] Each party performs any initialization procedures associated with and .

[0079] Note that keygen is the instruction identifier for the key generation operation, the ideal function performs the key generation operation, and the ideal function aborts when it receives an abort command from the adversary. key-pair is a key-pair identifier, represents a key-pair message, represents public key information.

[0080] In one embodiment, each signing participant generates a signing share using its own private key share, including:

[0081] When a signing operation instruction is received from the environment, each signing participant performs an initialization operation and generates a signing intermediate variable after randomly selecting a parameter;

[0082] The signing participant sends a commitment operation instruction to the cryptographic commitment ideal function, a sampling operation instruction to the random vector oblivious linear function evaluation ideal function, and an instruction for a zero secret share with other signing participants to the zero share sampling ideal function;

[0083] ​When the signing participant receives the message of opening the commitment sent by the cryptographic commitment ideal function based on the commitment opening operation instruction, the output sent by the ideal function of the random vector oblivious linear function evaluation based on the product additive sharing operation instruction and the consistency check result message of the other signing participant, the signing participant generates the signature share.

[0084] After receiving the instruction of the product additive sharing operation sent by the other signing participant, the ideal function of the random vector oblivious linear function evaluation is run together; then the commitment opening operation instruction is sent to the cryptographic commitment ideal function, and the consistency check operation instruction is sent to the other signing participant.

[0085] When receiving the opening commitment message sent by the cryptographic commitment ideal function based on the commitment opening operation instruction, the output sent by the ideal function of the random vector oblivious linear function evaluation based on the product additive sharing operation instruction and the consistency check result message of the other signing participant, the signing participant generates the signature share.

[0086] In the specific implementation process, the process of generating the signature share is as follows:

[0087] 1) When receiving (sign, sid, sigid, J) from the environment, initialize the protocol. Let J -k : = J \ {k}, k ∈ J

[0088] 2) randomly select and calculate R j : = r j · G,

[0089] 3) send

[0090] For all j ∈ J -k , give

[0091] For all j ∈ J -k , give

[0092] give

[0093] 4) When receiving

[0094] For all j ∈ J-k , message of

[0095] for all j e J -k , message of

[0096] for all j e J -k , message of

[0097] message of

[0098] compute and send to Next, after receiving the message of -k compute and φ j,k : = y j - χ j,k . Then, send to send to

[0099] 5) When receiving the message of

[0100]

[0101]

[0102]

[0103] check the following equations (consistency check): (i) (ii) (iii) (iv) If all the above equations are true, compute

[0104]

[0105]

[0106] ​​​​​

[0107] And (fragment,sid,sigid, u j})Send to each k∈J -j Participants, in the above formula with u i is the element of the signature share. On the other hand, if and Shared The instance is terminated, or any of the above equations does not hold, then Will send (fail,sid,sigid) to all other participants and The corresponding point in the concurrent signing session sends a similar message to the environment, outputs (failure, sid, sigid), and no longer continues to execute the following steps (the step of signature share aggregation), nor participates in the Any future signing sessions.

[0108] It should be noted that sign is the instruction identifier of the signature operation, and sigid is the signature identifier. (sign, sid, sigid, J) means that the signer set J is required to sign the message The command to sign. -k :=J\{k}, k∈J, represents the set consisting of all elements that belong to set J but not to set {k}, y j Used for The subsequent signature, R j 、 is the signature intermediate variable.

[0109] express Towards promise Tuple, Express to Initiate and Run the ideal function together express The initiative aims to The secret sharing of zero is performed between the two operations, commit represents the instruction identifier of the commitment operation, sample represents the instruction identifier of the sampling operation, committed represents the instruction identifier of the commitment completion operation, ready is the instruction identifier of the ready operation, mask is the instruction identifier of the mask operation, j,k yes Generate a random number, is the secret share of zero.

[0110] express Initiate and Run the ideal function together Provide input multiply represents the instruction identifier of the multiplication operation. express Initiate and Run the ideal function together Calculation output share represents the instruction identifier of the product additive sharing operation, express Towards The commitment opening instruction, decommit indicates the instruction identifier of the commitment opening, Indicates the elements contained in the brackets Used for consistency checking. check-adjust indicates the identifier of the consistency checking instruction.

[0111] Instructions for signing shares, express The signature share of the fragment is the identifier of the signature share instruction, and (fail,sid,sigid) and (failure,sid,siigid) represent failed instructions.

[0112] In one embodiment, the method further includes: if an instance of an ideal performance function of an oblivious linear function evaluation of a random vector shared by the two signing participants is aborted, one signing participant sending a failure instruction to the other signing participant.

[0113] In one embodiment, the signature shares of each signing party are aggregated to generate a complete structure-preserving signature on an equivalence class, including:

[0114] After receiving the signature share message sent by other signing participants, the signature parameters are generated according to the signature share, and a complete structure on the equivalence class is constructed to maintain the signature.

[0115] In one embodiment, the method further comprises:

[0116] The structure-preserving signature on the generated complete equivalence class is verified. If the verification passes, the signature is output; otherwise, a failure instruction is output.

[0117] The steps to generate a complete signature are as follows:

[0118] When all participants k∈J are received -j News calculate and Then verify Is it true. If not, output (failure, sid, sigid) to the environment. Otherwise, output

[0119] When receiving a message (fail, sid, sigid) from any participant, Send (failure,sid,sigid) to the environment and do not execute the above steps again.

[0120] It should be noted that Instructions for signing shares, express The signature share, Represents the complete signature message, signature represents the instruction identifier of the final signature, It is a structure on the equivalence class that holds the signature, and pk represents the public key.

[0121] Compared with the existing technology, the present invention has the following advantages: (1) t signatories must participate together to complete the signing of the message without leaking part of their private keys; (2) the communication cost is low and has an optimal number of interaction rounds; (3) no complex zero-knowledge proof is required to ensure security under the malicious adversary model.

[0122] Example 2

[0123] Based on the same inventive concept, this embodiment provides a threshold structure-preserving signature generation system on an equivalence class, see Figure 2 ,include:

[0124] Initialization module 301 is used for each signing party to generate its own signature public and private key pair and initialize several ideal function functions, where the several ideal function functions include a key generation ideal function, a cryptographic commitment ideal function, a zero-share sampling ideal function, and an ideal function function of random vector oblivious linear function evaluation. The key generation ideal function function is used to generate the public and private key shares of each signing party. The cryptographic commitment ideal function includes commitment and open commitment. The zero-share sampling ideal function function is used to generate threshold secret sharing and the ideal function function of random vector oblivious linear function evaluation.

[0125] The signature share generation module 302 is used for each signing participant to generate a signature share using their own private key share;

[0126] a structure-preserving signature generation module 303 for aggregating the signature shares of the respective signature participants to generate a complete structure-preserving signature on the equivalence class.

[0127] Since the system introduced in the second embodiment of the present application is the system used in the method for generating a structure-preserving signature on an equivalence class in the first embodiment of the present application, the specific structure and variations of the system can be understood by those skilled in the art based on the method introduced in the first embodiment of the present application, and thus will not be described here again. Any system used in the method in the first embodiment of the present application belongs to the scope of the present application.

[0128] Embodiment Three

[0129] Based on the same inventive concept, the present application further provides a computer readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first embodiment.

[0130] Since the computer readable storage medium introduced in the third embodiment of the present application is the computer readable storage medium used in the method for generating a structure-preserving signature on an equivalence class in the first embodiment of the present application, the specific structure and variations of the computer readable storage medium can be understood by those skilled in the art based on the method introduced in the first embodiment of the present application, and thus will not be described here again. Any computer readable storage medium used in the method in the first embodiment of the present application belongs to the scope of the present application.

[0131] Embodiment Four

[0132] Based on the same inventive concept, the present application further provides a computer device, which includes a storage, a processor, and a computer program stored in the storage and executable on the processor, and the processor implements the method in the first embodiment when executing the program.

[0133] Since the computer device introduced in the fourth embodiment of the present application is the computer device used in the method for generating a structure-preserving signature on an equivalence class in the first embodiment of the present application, the specific structure and variations of the computer device can be understood by those skilled in the art based on the method introduced in the first embodiment of the present application, and thus will not be described here again. Any computer device used in the method in the first embodiment of the present application belongs to the scope of the present application.

[0134] Those skilled in the art will appreciate that embodiments of the present application can be devised for a variety of other systems which are currently developed or later developed. Thus, the present application is intended to include alternative steps as can be possessed now or developed in the future for performing the purposes of the application. Examples of the application can be provided as a method, a system or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, and the like) embodying computer readable program code thereon for use by or in connection with an instruction execution system. For the purposes of this description, a computer-usable or computer readable storage medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

[0135] The present application is described in reference to the drawings, which are as follows: Figure 1 The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. Figure 1 The flowchart and block diagram in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart and block diagrams can represent a module, segment, or portion of code, which comprises one or more executable

[0136] While the preferred embodiments of the application have been described, additional variations and modifications can be made to the embodiments described and shown, and it is therefore intended that the application cover any and all variations of the preferred embodiments which fall within the scope of the present application. Accordingly, the appended claims are intended to cover all such modifications and variations as falling within the scope of the application.

[0137] It will be apparent to those skilled in the art that various modifications and variations can be made to the present application without departing from the spirit or scope of the application. Thus, it is intended that the present application cover the modifications and variations of this application provided they come within the scope of the appended claims and their equivalents.

Claims

1. A threshold structure-preserving signature generation method on an equivalence class, characterized in that: include: Each signing party generates its own public-private key pair and initializes several ideal function functions, including a key generation ideal function, a cryptographic commitment ideal function, a zero-share sampling ideal function, and an ideal function for random vector oblivious linear function evaluation. The key generation ideal function is used to generate the public-private key shares of each signing party. The cryptographic commitment ideal function includes commitment and open commitment. The zero-share sampling ideal function is used to generate threshold secret sharing. Each signing party uses its own private key share to generate a signature share; Aggregate the signature shares of each signing party to generate a complete structure-preserving signature on the equivalence class; Among them, each signing participant uses his or her own private key share to generate a signature share, including: When receiving the signature operation instruction from the environment, each signing participant performs initialization operations and randomly selects parameters to generate signature intermediate variables; The signing party sends the commitment operation instruction to the cryptographic commitment ideal function, sends the sampling operation instruction to the ideal function of random vector oblivious linear function evaluation, and sends the instruction for zero secret sharing with other signing parties to the zero-share sampling ideal function; After the signing party receives the message of completion of commitment sent by the cryptographic commitment ideal function based on the commitment operation instruction, the message of preparation for operation and sampling completion sent by the ideal function of random vector oblivious linear function evaluation based on the sampling operation instruction, and the message of masking operation sent by the zero-share sampling ideal function based on the instruction of sharing zero secret with other signing parties, the signing party sends the multiplication operation instruction to the ideal function of random vector oblivious linear function evaluation; Receive the instructions for the product-additive sharing operation sent by other signing participants, and jointly run the ideal function of random vector oblivious linear function evaluation; then send the commitment opening operation instruction to the cryptographic commitment ideal function, and send the check consistency operation instruction to other signing participants; After receiving the open commitment message sent by the cryptographic commitment ideal function based on the commitment open operation instruction, the output sent by the ideal function evaluated by the random vector oblivious linear function based on the product additive sharing operation instruction, and the consistency check result message from other signing participants, the signing participant generates a signature share.

2. The method for generating a threshold structure-preserving signature on an equivalence class according to claim 1, wherein: Each signing party generates its own public and private key pair and initializes several ideal functional functions, including: When receiving an initialization instruction from the environment, each signing party sends a key generation operation instruction to the key generation ideal function, wherein the key generation operation instruction includes key generation parameters, so as to generate the public and private key shares of the signing party based on the key generation parameters through the key generation ideal function; Each signing party sets the parameters of the cryptographic commitment ideal power function, the zero-share sampling ideal power function, and the ideal power function of the random vector oblivious linear function evaluation for initialization.

3. The method for generating a threshold structure-preserving signature on an equivalence class according to claim 2, wherein: The method further comprises: When the key generation ideal function receives the adversary's termination command, the key generation ideal function terminates; When each signing party receives the public and private key share information sent by the key generation ideal function, it sends the public key share to the environment.

4. The method for generating a threshold structure-preserving signature on an equivalence class according to claim 1, wherein: The method further includes: if an instance of an ideal performance function of an oblivious linear function evaluation of a random vector shared by the two signing parties aborts, one signing party sending a failure instruction to the other signing party.

5. The method for generating a threshold structure-preserving signature on an equivalence class according to claim 4, wherein: Aggregate the signature shares of each signing party to generate a complete structure-preserving signature on the equivalence class, including: After receiving the signature share message sent by other signing participants, the signature parameters are generated according to the signature share, and a complete structure on the equivalence class is constructed to maintain the signature.

6. The method for generating a threshold structure-preserving signature on an equivalence class according to claim 5, wherein: The method further comprises: The structure-preserving signature on the generated complete equivalence class is verified. If the verification passes, the signature is output; otherwise, a failure instruction is output.

7. A threshold structure-preserving signature generation system on equivalence classes, characterized in that: include: An initialization module is used for each signing party to generate its own public and private key pair and initialize several ideal function functions, including a key generation ideal function, a cryptographic commitment ideal function, a zero-share sampling ideal function, and an ideal function for random vector oblivious linear function evaluation. The key generation ideal function is used to generate the public and private key shares of each signing party. The cryptographic commitment ideal function includes commitment and open commitment. The zero-share sampling ideal function is used to generate threshold secret sharing. The signature share generation module is used by each signing party to generate a signature share using their own private key share; The structure-preserving signature generation module on the equivalence class is used to aggregate the signature shares of each signing party to generate a complete structure-preserving signature on the equivalence class; Among them, each signing participant uses his or her own private key share to generate a signature share, including: When receiving the signature operation instruction from the environment, each signing participant performs initialization operations and randomly selects parameters to generate signature intermediate variables; The signing party sends the commitment operation instruction to the cryptographic commitment ideal function, sends the sampling operation instruction to the ideal function of random vector oblivious linear function evaluation, and sends the instruction for zero secret sharing with other signing parties to the zero-share sampling ideal function; After the signing party receives the message of completion of commitment sent by the cryptographic commitment ideal function based on the commitment operation instruction, the message of preparation for operation and sampling completion sent by the ideal function of random vector oblivious linear function evaluation based on the sampling operation instruction, and the message of masking operation sent by the zero-share sampling ideal function based on the instruction of sharing zero secret with other signing parties, the signing party sends the multiplication operation instruction to the ideal function of random vector oblivious linear function evaluation; Receive the instructions for the product-additive sharing operation sent by other signing participants, and jointly run the ideal function of random vector oblivious linear function evaluation; then send the commitment opening operation instruction to the cryptographic commitment ideal function, and send the check consistency operation instruction to other signing participants; After receiving the open commitment message sent by the cryptographic commitment ideal function based on the commitment open operation instruction, the output sent by the ideal function evaluated by the random vector oblivious linear function based on the product additive sharing operation instruction, and the consistency check result message from other signing participants, the signing participant generates a signature share.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for generating a threshold structure-preserving signature on an equivalence class as claimed in any one of claims 1 to 6 is implemented.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for generating a threshold structure-preserving signature on an equivalence class according to any one of claims 1 to 6 is implemented.

Images