SM9-based general designated verifier signature proof method and device

Abstract

The application discloses a kind of general designated verifier signature proof methods and devices based on SM9, belong to information security technical field, wherein, the method includes that key generation center generates system master key and system public parameter;Key generation center generates private key based on system master key, system public parameter and the identity character of signer;Signer uses private key to sign message and obtains the signature of message;Designator uses random mask to cover the signature of message and generates conversion signature;Designated verifier and designator verify conversion signature based on interactive verification protocol.The method is combined with interactive verification protocol by SM9 digital signature algorithm, while improving the flexibility of verification, significantly reduces the computing overhead and communication cost, improves verification efficiency.

Description

Technical Field

[0001] The present application belongs to the field of information security technology, and specifically relates to a method and device for proving a signature of a universal designated verifier based on SM9. Background Art

[0002] In traditional digital signature schemes, the signer signs a message using their private key, and anyone can then verify the validity of the signature using the signer's public key. There are many studies addressing the conflict between non-repudiation and signature privacy (controlled verifiability) in this process, such as unrepudiable signatures (US), nominated signatures (NS), designated confirmer signatures (DCS), designated verifier signatures (DVS), and universal designated verifier signatures (UDVS). These research works approach controlled verifiability from different perspectives: Non-repudiation signatures differ from digital signatures in that they cannot be verified without the cooperation of the signer; nominated signatures, in contrast to non-repudiation signatures, cannot be verified without the cooperation of the signer's holder; Designated Verifier Signatures (DCS), compared to non-repudiation signatures, allow for the absence of the signer by allowing a previously designated verifier to confirm the signature for the verifier; Designated Verifier Signatures (DVS), in which the prover non-interactively assigns the proof of a statement to the verifier. The verifier can simulate the proof using its own key, thus preventing the transfer of the proof to convince others of the statement's truth, while the verifier itself is convinced by the proof. However, this scheme only allows the signer to specify the signature (because the assignment requires the signer's key); and Universal Designated Verifier Signatures (UDVS), compared to DVS, are "universal" in that they allow anyone who obtains the signature to specify the verifier. Clearly, among these schemes, UDVS not only meets controlled verifiability requirements, but its "universal" design also makes it quite flexible and widely applicable.

[0003] In a universal designated verifier signature (UDVS), a designated verifier can verify that a message was signed by the signer, but cannot convince anyone else of this fact. UDVS has many variants, such as identity-based versions and versions supporting multiple verifiers. There is also extensive work on supplementing and improving it, such as efforts to achieve provable security, improve efficiency, and enhance security. However, UDVS-type schemes suffer from a common public key setup issue that is difficult to address in practical applications. Specifically, they require the designated verifier to generate a public / private key pair based on system parameters set by the signer and must authenticate the public key. This is unrealistic in practice because the verifier typically possesses an authenticated key pair with different public key parameters than the signer. It is unlikely that the verifier will create another authenticated public / private key pair (based on the parameters set by the signer) simply to verify the signer's signature. This is because key setup itself involves public key infrastructure (PKI) processes. First, in PKI, key independence is often difficult to ensure, and there is no reason to assume that the verifier has correctly selected the key. Second, it can incur significant computational and communication costs.

[0004] UDVSP (a new variant of UDVS) possesses all the properties of UDVS but does not involve any designated verifier's certified public key. However, existing UDVSPs are all based on public key cryptography. The main bottleneck of these solutions is their reliance on public key infrastructure (PKI) to determine the ownership of public keys, which incurs significant operational and maintenance costs. Summary of the Invention

[0005] The purpose of this application is to provide a universal designated verifier signature method and device based on SM9 to solve the problem of low efficiency of the universal designated verifier signature proof scheme.

[0006] According to a first aspect of an embodiment of the present application, a general designated verifier signature certification method based on SM9 is provided, including:

[0007] The key generation center generates the system master key and system public parameters;

[0008] The key generation center generates a private key based on the system master key, the system public parameters and the identity character of the signer;

[0009] The signer signs the message using the private key to obtain the signature of the message;

[0010] The designator masks the signature of the message using a random mask to generate a transformed signature;

[0011] The designated verifier and the designator verify the conversion signature based on an interactive verification protocol.

[0012] In some optional embodiments of the present application, a key generation center generates a system master key and system public parameters, comprising:

[0013] The key generation center generates at least k-bit large prime number r, generates additive cyclic group G1 and G2 with order r, and generates multiplicative cyclic group G T with order r; T determines a bilinear mapping e from: G1×G2 to G

[0014] selects random number P1∈ R G1, P2∈ R G2, calculates P pub =sP2∈G2 and g=e(P1,P pub )∈G T ;

[0015] selects hash functions and

[0016] outputs the system public parameters Mpk={r, G1, G2, G T , e, P1, P2, P pub , g, H1, H2};

[0017] outputs the system master key Msk=s;

[0018] wherein k is a security parameter, represents a positive integer coprime with r and less than r, and R represents a random space.

[0019] In some optional embodiments of the present application, a key generation center generates a private key based on the system master key, the system public parameters and the identity character of a signer, comprising:

[0020] calculates

[0021] outputs the private key D A ;

[0022] wherein ID A ∈{0,1} * is the identity character of the signer.

[0023] In some optional embodiments of the present application, before calculating D A , further comprising:

[0024] judges whether it is true;

[0025] If so, the calculation ends and an error is reported;

[0026] If not, continue with the next steps.

[0027] In some optional embodiments of the present application, the signer uses the private key to sign the message to obtain the signature of the message, including:

[0028] Pick a random number

[0029] Calculate ω = g x , h=H2(M||ω), l=xh, S=lD A ;

[0030] Output σ = (h, S);

[0031] Where M is the message and σ is the signature.

[0032] In some optional embodiments of the present application, before the designator masks the signature of the message with a random mask to generate a transformed signature, the process further includes:

[0033] The designator verifies the signature of the message;

[0034] The verification steps include: the designator calculates h1=H1(ID A ), Q=h1P2+P pub ∈G2、ω′=e(S,Q)g h 、h2=H2(M||ω′);

[0035] Determine whether h is equal to h2;

[0036] If yes, the verification succeeds; if no, the verification fails.

[0037] In some optional embodiments of the present application, the designator uses a random mask to mask the signature of the message to generate a transformed signature, including:

[0038] Pick a random number S′=zS,

[0039] in, is the conversion signature, and sk is the conversion key.

[0040] In some optional embodiments of the present application, the designated verifier and the designator verify the converted signature based on an interactive verification protocol, including:

[0041] Designated validator selects random number and sends c to the designated person;

[0042] The designator selects a random number Calculate ω2 = ω′g -h , t = α + cz, and send a and t to the designated verifier;

[0043] The designated verifier calculates h1=H1(ID A ), Q=h1P2+P pub , ω1=e(S′,Q) and ω2=ω′g -h ,judge Is it true? If so, the verification passes; if not, the verification fails.

[0044] According to a second aspect of an embodiment of the present application, a general designated verifier signature certification device based on SM9 is provided, comprising:

[0045] The initialization module is used to perform initialization steps, including: the key generation center generates the system master key and system public parameters;

[0046] The private key generation module is used to perform the private key generation step, including: a key generation center generates a private key based on the system master key, the system public parameters and the identity character of the signer;

[0047] The signing module is used to execute the signing step, including: the signer uses the private key to sign the message to obtain the signature of the message;

[0048] The conversion module is used to perform a signature conversion step, including: the designator masks the signature of the message using a random mask to generate a converted signature;

[0049] The verification module is used to perform a verification step, including: designating a verifier and the designator verifying the conversion signature based on an interactive verification protocol.

[0050] According to a third aspect of an embodiment of the present application, an electronic device is provided, which may include:

[0051] processor;

[0052] a memory for storing processor-executable instructions;

[0053] The processor is configured to execute instructions to implement the universal designated verifier signature certification method based on SM9 as described in any one of the embodiments of the first aspect.

[0054] The above technical solution of this application has the following beneficial technical effects:

[0055] The embodiment of the present application provides a general designated verifier signature certification method based on SM9. By combining the SM9 digital signature algorithm with the interactive verification protocol, it significantly reduces the computational overhead and communication cost while improving the verification flexibility, thereby improving the verification efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a flowchart of a general designated verifier signature certification method based on SM9 in an exemplary embodiment of the present application;

[0057] Figure 2 is a flowchart of a universal designated verifier signature certification method based on SM9 in another exemplary embodiment of the present application;

[0058] Figure 3 is a schematic diagram of a universal designated verifier signature certification device based on SM9 in an exemplary embodiment of the present application;

[0059] Figure 4 is a schematic structural diagram of an electronic device in an exemplary embodiment of the present application; DETAILED DESCRIPTION

[0060] To make the objectives, technical solutions, and advantages of this application more clearly understood, this application is further described below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are merely illustrative and are not intended to limit the scope of this application. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion in the concepts of this application.

[0061] The accompanying drawings illustrate schematic diagrams of layer structures according to embodiments of the present application. These figures are not drawn to scale; for clarity, some details are exaggerated and some details may be omitted. The shapes of the various regions and layers shown in the figures, as well as their relative sizes and positional relationships, are merely exemplary and may deviate in practice due to manufacturing tolerances or technical limitations. Furthermore, those skilled in the art may design regions / layers with different shapes, sizes, and relative positions as needed.

[0062] Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0063] In the description of this application, it should be noted that the terms "first", "second" and "third" are used for descriptive purposes only and should not be understood as indicating or implying relative importance.

[0064] In addition, the technical features involved in the different embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.

[0065] In the following, in combination with the accompanying drawings, a general designated verifier signature certification method and device based on SM9 provided by the embodiment of the present application is described in detail through specific embodiments and their application scenarios.

[0066] like Figure 1 As shown, in the first embodiment of the present application, a general designated verifier signature certification method based on SM9 is provided, including the following steps:

[0067] Step S101: The key generation center generates a system master key and system public parameters;

[0068] Step S102: The key generation center generates a private key based on the system master key, system public parameters and the signer's identity character;

[0069] Step S103: The signer signs the message using the private key to obtain the signature of the message;

[0070] Step S104: The designator uses a random mask to mask the signature of the message to generate a converted signature;

[0071] Step S105: The designated verifier and the designator verify the converted signature based on the interactive verification protocol.

[0072] This embodiment provides a general designated verifier signature certification method based on SM9. By combining the SM9 digital signature algorithm with the interactive verification protocol, it significantly reduces the computational overhead and communication cost while improving the verification flexibility, thereby improving the verification efficiency.

[0073] Specifically, step S101 includes:

[0074] The key generation center generates a large prime number r of at least k bits, generates additive cyclic groups G1 and G2 of order r, and generates multiplicative cyclic group G of order r. T , determine from: G1×G2 to G T The bilinear map e;

[0075] Choose a random number P1∈ R G1, P2∈ R G2, Calculate P pub =sP2∈G2 and g=e(P1,P pub )∈G T ;

[0076] Choosing a hash function and

[0077] Output system common parameters Mpk={r,G1,G2,G T ,e,P1,P2,P pub ,g,H1,H2};

[0078] Output system master key Msk=s;

[0079] Among them, k is the security parameter, represents a positive integer that is coprime to r and smaller than r, and R represents a random space.

[0080] Step S102 includes:

[0081] judge whether it is established;

[0082] If so, the calculation ends and an error is reported;

[0083] If not, continue with the next steps;

[0084] calculate

[0085] Output private key D A ;

[0086] Among them, ID A ∈{0,1} * The signer's identity character.

[0087] Step S103 includes:

[0088] Pick a random number

[0089] Calculate ω = g x , h=H2(M||ω), l=xh, S=lD A ;

[0090] Output σ = (h, S);

[0091] Where M is the message and σ is the signature.

[0092] Step S104 includes:

[0093] The designated party verifies the signature of the message;

[0094] The verification steps include: the designator calculates h1=H1(ID A ), Q=h1P2+P pub ∈G2、ω′=e(S,Q)g h 、h2=H2(M||ω′);

[0095] Determine whether h is equal to h2;

[0096] If yes, the verification succeeds; if no, the verification fails;

[0097] Pick a random number S′=zS,

[0098] in, is the conversion signature, and sk is the conversion key.

[0099] Step S105 includes:

[0100] Designated validator selects random number And send c to the designated person;

[0101] The designator selects a random number Calculate ω2 = ω′g -h , t = α + cz, and send a and t to the designated verifier;

[0102] The designated verifier calculates h1=H1(ID A ), Q=h1P2+P pub , ω1=e(S′,Q) and ω2=ω′g -h ,judge Is it true? If so, the verification passes; if not, the verification fails.

[0103] like Figure 2 As shown, in the second embodiment of the present application, a universal designated verifier signature proof (UDVSPsm9) method based on SM9 is provided, which is divided into five stages, namely the initialization stage, the registration stage, the signing stage, the verification stage, and the interactive verification stage. There are four roles involved in UDVSPsm9, namely PKG, signer, signature holder / designator, and designated verifier. The conceptual relationship table of these roles and the corresponding processes is shown in Table 3-1:

[0104] Table 3-1

[0105]

[0106] Specifically, the four roles and their functions are described as follows:

[0107] 1) The Private Key Generator (PKG) plays the role of a key generation center in identity-based signatures (IBS). It is responsible for generating the system's master key pair and generating a private key for each user, bound to their identity. PKG functions include initializing system parameters, generating user private keys, and ensuring the security of these keys.

[0108] 2) The Signer is responsible for signing the document and securely transmitting the document / signature pair to the signature holder. The Signer creates a secret (signing) key and a public (verification) key pair and, after signing, transmits the signature and the document to the signature holder.

[0109] 3) The signature holder (Designator) is also called the designator. They obtain a valid signature from the signer and create a transformed signature. Through an interactive protocol, they prove to the designated verifier that this transformed signature is a valid signature obtained from the signer on the corresponding file.

[0110] 4) Designated Verifier: This is the target object for which the signature holder wants to prove the validity of the signature. In UDVSP, the designated verifier verifies the validity of the signature through an interactive protocol with the signature holder without having access to the original signature.

[0111] like Figure 2 As shown, the workflow of UDVSPsm9 is divided into five stages.

[0112] Phase 1: Initialization phase: The system administrator or key generator (PKG) initializes system parameters, including selecting security parameters, generating elliptic curve parameters, and generating the system master key (Msk) and system public parameters (Mpk).

[0113] Phase 2: Registration. The signer submits their identity to the PKG, which generates a private key corresponding to their public key. The signer's private key is used to sign files, and the public key is used to verify signatures.

[0114] Phase 3: Signing phase. The signer uses his private key to sign the message, and the generated signature is transmitted to the designated party requesting the signature via a secure channel.

[0115] Phase 4: Verification. Upon receiving the signature, the designator must first verify its authenticity and validity. If it fails, the process returns to Phase 3 and requires the signer to re-sign. If it passes, the signature conversion can proceed.

[0116] Phase 5: Interactive Verification. The designator first masks the signature with a random mask to generate a transformed signature, and then begins the interactive verification process. After the designated verifier issues a random challenge and responds, the designated verifier makes a judgment based on the information obtained during the interaction and the discriminant. If the verifier accepts the proof, verification passes; otherwise, verification fails.

[0117] The UDVSP (UDVSPsm9) designed based on the SM9 digital signature algorithm provided in this embodiment is a universal designated verifier signature verification method based on SM9. It not only has identity-based properties, but also consumes fewer time-consuming operations in each algorithm compared to previous identity-based UDVSP implementations, resulting in higher performance. The UDVSP designed in this embodiment includes six algorithms: Setup, PKE, Sign, Verify, Transform, and IVerify, as follows:

[0118] 1. Initialization (Setup)

[0119] Setup(1 k )→(Mpk,Msk):

[0120] r is a large prime number with at least k digits, G1, G2, G T is a cyclic group of order r, e:G1×G2→G T is a bilinear mapping. Where P1∈ R G1, stands for

[0121] P1 is a randomly selected point in G1, and similarly: P2∈ R G2, Calculate P pub =sP2∈G2, g=e(P1,P pub )∈G T , select a collision-resistant Hash function Finally, the master key of the output system is Msk=s, and the public parameters of the system are Mpk={r,G1,G2,G T ,e,P1,P2,P pub ,g,H1,H2}.

[0122] 2. Private Key Extraction (PKE)

[0123] PKE(Mpk,Msk,ID A )→D A :

[0124] ID A ∈{0,1} * is a string representing the identity. First verify s+H1(ID A )≡0mod r is true, if so, you need to reselect the ID A Otherwise calculate the secret key

[0125] 3. Sign

[0126] Sign(Mpk, D A , M) → σ:

[0127] Randomly select Then compute ω = g x , h = H2(M || ω), l = x - h and S = lD A . The final signature is σ = (h, S).

[0128] 4. Verify (Verify)

[0129] Verify(Mpk, ID A , M, σ) → 0 / 1:

[0130] First compute h1 = H1(ID A ), Q = h1P2 + P pub ∈ G2, ω' = e(S, Q)g h and h2 = H2(M || ω'). Determine whether h = h2 holds, yes output 1, otherwise output 0.

[0131] 5. Transform (Transform)

[0132]

[0133] Randomly select S' = zS,

[0134] 6. Interactive Verify (IVerify, Interactive Verify), wherein P is the prover in the interactive verification protocol and V is the verifier in the interactive verification protocol

[0135]

[0136] First P, V each compute: h1 = H1(ID A ), Q = h1P2 + P pub , ω1 = e(S', Q) and ω2 = ω'g -h . P computes: ω1 = e(S, Q) z , ω2 = ω'g -h .

[0137] V computes h1 = H1(ID A ), Q = h1P2 + P pub , ω1 = e(S', Q) and ω2 = ω'g -h .

[0138] Then determine whether H2(M || ω') = h holds, if not, terminate. If yes, the following interactive verification process is performed.

[0139] P: Send a to V.

[0140] V: Random selection Send c to P.

[0141] P: Calculate t = α + cz and send t to V.

[0142] V: Judgment Is it true? If it is true, output 1, otherwise output 0.

[0143] The correctness of the signature and verification algorithms in this UDVSPsm9 scheme is the same as that of the SM9 digital signature algorithm. The correctness of the conversion and interactive verification algorithms will be briefly proved below: so

[0144] The correctness of UDVSPsm9 consists of two consistency requirements: "Sign and Verify consistency" and "Transform and IVerify consistency." In our UDVSPsm9, the former requirement is the same as that of the SM9 digital signature algorithm. Based on the first four steps, the following equation holds.

[0145]

[0146] Therefore, h2 = H2(M||ω′) = H2(M||ω) = h. The consistency of Transform and IVerify will be briefly explained below. Based on the last two steps of UDVSPsm9, the following equation is correct.

[0147]

[0148] so Established.

[0149] The present invention conducts a security analysis on a general designated verifier signature certification method based on SM9 provided in the above embodiment:

[0150] Theorem 1. Assuming that the OMDL problem is difficult to solve in G1, the UDVSP system based on SM9 signature is secure against Type-1 impersonation attacks in the random oracle model.

[0151] prove:

[0152] make is an imposter who attempts to destroy the UDVSP system based on the SM9 digital signature algorithm, and B is an attacker of the OMDL problem. Assume that B is given the system parameters {G1, G2, G T ,e,r}. First, B queries the challenge oracle C() to obtain a challenge point S0. Where S0=s0P, s0∈ R Z r And unknown. Then B randomly selects an integer s∈ R Z r And output the signer's public key pk={G1,G2,e,r,P1,P2,P pub =sP2,ID A ,H1,H2}, where and is a hash function that is considered a random oracle.

[0153] Let the signed message be m, and B randomly selects 3 integers And set H1(ID A )=h1,ω=g x , where g=e(P,P pub ), then let h=H2(m||ω). Then B calculates And convert the signature Send to A. B continues Simulate n executions of the interactive verification protocol with the honest designator P: query the challenge oracle C to obtain the challenge point S i , where i∈{1,2,…,n}. Calculate a i =e(S i ,P pub ) x-h and send it to when Send back to c i Afterwards, the discrete logarithm oracle DL q,P ()Query S i =c i S0, get the output t i . verify Is it true?

[0154] Notice a i =e(S i ,P pub ) x-h , and t i =s i +c i s0 mod r, so the following formula holds.

[0155]

[0156] After executing the above simulation n times, B now tries to extract s0. First, B runs To obtain a in step 1 of the interactive verification protocol, randomly select an integer c∈ R Z r , then run To get the response t and verify ae(S′,Q) c ? =(ω′g -h ) t Is it true? If it is true, then reselect a random integer c′∈ R Z r , run again To get the response t′ and verify ae(S′,Q) c′ ? =(ω′g -h ) t′ Is it true? If it is true, then e(S′,Q) c-c′ =(ω′g -h ) t-t′ ,Right now From this we can calculate With s0, according to t i =s i +c i s0 mod r, all s can be calculated i , where i∈{1,2,…,n}, which solves the OMDL problem on G1.

[0157] Theorem 2. Assuming that CDHP is difficult in G1, the UDVSP system based on SM9 signatures is secure against Type-2 impersonation attacks in the random oracle model.

[0158] prove:

[0159] make is an imposter who attempts to destroy the UDVSP system based on the SM9 digital signature algorithm under the Type-2 attack, while B is a forger who attempts to destroy the SM9 signature scheme under the chosen message attack. Assume that B is given the public parameters {G1, G2, G T ,e,r,P,P pub =sP,H1,H2}, where and is a hash function that can be considered as a random oracle. Then B selects an arbitrary string m∈{0,1} * Then B asks A to obtain And a in the first step of the interactive protocol. After B receives a, he chooses a randomly selected Run A to obtain t and test ae(S′,Q) c ? =(ω′g -h ) t If it is true, B runs A in the same state as before but chooses a different challenge c′, obtains a different corresponding t′ and checks whether ae(S′,Q) c′ ? =(ω′g -h ) t′ If established, B outputs As a forged signature. Note that e(S′,Q) c-c′ =(ω′g -h ) t-t′ ,have Therefore is a valid SM9 signature for m.

[0160] The present invention performs a performance analysis on a general designated verifier signature certification method based on SM9 provided in the above embodiment:

[0161] This section first theoretically analyzes the computational overhead and communication cost of UDVSP, and then compares UDVSP-sm9 with UDVSP-bls, UDVSP-bb, and UDVSP-hess.

[0162] In elliptic curve-based cryptographic schemes, theoretical analysis of scheme efficiency mainly considers the number of time-consuming operations, such as bilinear pairing.

[0163] We first test the time consumption of each operation. The test environment is as follows: Ryzen R7 5800H 3.2GHz processor; Windows 11 operating system; 16GB memory; cryptographic algorithm library is JPBC2.0.0; elliptic curve is TypeF, embedding degree is 12, parameter is 160b (indicating the order of the elliptic curve), in the actual code G1, G2, G T , Z q The lengths of the elements in the datagram are 40B, 80B, 240B, and 20B respectively. The final test results are shown in Table 3-1.

[0164] Table 3-1 Operation symbols and execution time

[0165]

[0166]

[0167] We can see that scalar multiplication in G1 and G2 groups, G T Power calculation in groups and from G1 and G2 to G TThe group pairing calculation is relatively time-consuming. The UDVSP solution proposed in this invention has advantages in these areas. The specific theoretical analysis and comparison results are shown in Table 3-2. In the communication overhead, we mainly consider the interactive verification part of UDVSP. In the computational overhead, we mainly consider the four most time-consuming operations. Among them, the present invention converts the equivalent group calculation (such as Z q ×G1→G1 and The group operations are in the form of addition and multiplication respectively. g1sm , T g2sm , T bp and T gte Represent the time consumption of g1sm, g2sm, bp and gte respectively.

[0168] Table 3-2 Theoretical analysis of computational and communication overheads in UDVSPsm9 and other excellent works

[0169]

[0170]

[0171] It can be seen that compared with the original UDVSP schemes (UDVSP-bls and UDVSP-bb), the scheme of the present invention not only has the good property of being identity-based, but also has certain advantages in the number of pairing calculations that are the most time-consuming, especially in the interactive verification step. Compared with the UDVSP scheme UDVSP-hess, which is also identity-based, the scheme of the present invention also has certain advantages in the signing, verification and interactive verification steps, and has a huge advantage in the interactive verification step.

[0172] Finally, to analyze the actual performance, the present invention implements each solution and conducts tests. The test results of each solution are shown in Table 3-3.

[0173] Table 3-3 Comparison results of actual measurements

[0174]

[0175] As can be seen, the Sign, Verify, Transform, and IVerify algorithms of the proposed UDVSP solution take 14.15ms, 69.11ms, 1.51ms, and 128.2ms, respectively. Compared to existing solutions, the computational overhead of the proposed UDVSP solution is significantly reduced, with the exception of the Transform algorithm, which has similar computational overhead. Specifically, the Verify and IVerify steps of UDVSPsm9 are approximately 47.8% and 62.7% lower, respectively, than those of the conventional ID-UDVSP.

[0176] Combining the results from the three tables, UDVSPsm9 reduces the most time-consuming bilinear pairing operations compared to the other three solutions, eliminating one and three operations in the verification and interactive verification phases, respectively. The additional operations added by UDVSPsm9 are only a minor factor compared to the bilinear pairing, which is why it achieves better results. In summary, the solution of the present invention offers superior performance and excellent practicality.

[0177] like Figure 3 As shown, based on the same inventive concept, a third embodiment of the present application provides a universal designated verifier signature certification device based on SM9, including:

[0178] The initialization module 11 is used to perform initialization steps, including: the key generation center generates the system master key and system public parameters;

[0179] The private key generation module 12 is used to perform the private key generation step, including: the key generation center generates a private key based on the system master key, the system public parameters and the identity character of the signer;

[0180] The signing module 13 is used to perform the signing step, including: the signer uses the private key to sign the message to obtain the signature of the message;

[0181] The conversion module 14 is used to perform the signature conversion step, including: the designator masks the signature of the message using a random mask to generate a converted signature;

[0182] The verification module 15 is used to perform the verification step, including: the designated verifier and the designator verify the converted signature based on the interactive verification protocol.

[0183] Alternatively, as Figure 4 As shown, an embodiment of the present application also provides an electronic device 1100, including a processor 1101, a memory 1102, and a program or instruction stored in the memory 1102 and executable on the processor 1101. When the program or instruction is executed by the processor 1101, each process of the embodiment of the above-mentioned general designated verifier signature certification method based on SM9 is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0184] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0185] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by the processor, the various processes of the above-mentioned embodiment of the general designated verifier signature certification method based on SM9 are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0186] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (ROM), random access memory (RAM), a magnetic disk, or an optical disk.

[0187] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned embodiment of the general designated verifier signature certification method based on SM9, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0188] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0189] It should be noted that, in the present invention, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the opposite order according to the functions involved. For example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0190] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0191] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

Claims

1. A universal designated verifier signature certification method based on SM9, characterized in that: include: The key generation center generates the system master key and system public parameters; The key generation center generates a private key based on the system master key, the system public parameters and the identity character of the signer; The signer signs the message using the private key to obtain the signature of the message; The designator masks the signature of the message using a random mask to generate a transformed signature; The designated verifier and the designated person verify the converted signature based on an interactive verification protocol; The key generation center generates the system master key and system public parameters, including: The key generation center generates at least Large prime number of bits , the generation order is The additive cyclic group of and , the generation order is The multiplicative cyclic group of , determine from arrive Bilinear map ; Select random number 、 、 ,calculate and ; Choosing a hash function and ; Output the system common parameters ; Output the system master key ; in, is a safety parameter, Represents coprime and less than The set of positive integers, represents random space; The key generation center generates a private key based on the system master key, the system public parameters and the identity character of the signer, including: calculate ; Output the private key ; in, The identity characters of the signer; The signer uses the private key to sign the message to obtain the signature of the message, including: Pick a random number ; calculate 、 、 、 ; Output ; Among them, M is the message, For signature; Before the designator masks the signature of the message with a random mask to generate a transformed signature, the process further includes: The designator verifies the signature of the message; The verification steps include: the designator calculates 、 、 、 ; judge Is it equal to ; If yes, the verification succeeds; if no, the verification fails; The designator uses a random mask to mask the signature of the message to generate a transformed signature, including: Pick a random number , ; in, To convert the signature, For conversion key.

2. A universal designated verifier signature certification method based on SM9 according to claim 1, characterized in that: calculate Before, also includes: judge whether it is established; If so, the calculation ends and an error is reported; If not, continue with the next steps.

3. A universal designated verifier signature certification method based on SM9 according to claim 1, characterized in that: The designated verifier and the designator verify the converted signature based on an interactive verification protocol, including: Designated validator selects random number , and sent to said designee; The designator selects a random number ,calculate , , , and and Send to the designated verifier; The designated verifier calculates , , and ,judge Is it true? If so, the verification passes; if not, the verification fails.

4. A universal designated verifier signature certification device based on SM9, characterized in that: include: The initialization module is used to perform initialization steps, including: the key generation center generates the system master key and system public parameters; The private key generation module is used to perform the private key generation step, including: a key generation center generates a private key based on the system master key, the system public parameters and the identity character of the signer; The signing module is used to execute the signing step, including: the signer uses the private key to sign the message to obtain the signature of the message; The conversion module is used to perform a signature conversion step, including: the designator masks the signature of the message using a random mask to generate a converted signature; A verification module, configured to perform a verification step, including: designating a verifier and the designator verifying the conversion signature based on an interactive verification protocol; The key generation center generates the system master key and system public parameters, including: The key generation center generates at least Large prime number of bits , the generation order is The additive cyclic group of and , the generation order is The multiplicative cyclic group of , determine from arrive Bilinear map ; Select random number 、 、 ,calculate and ; Choosing a hash function and ; Output the system common parameters ; Output the system master key ; in, is a safety parameter, Represents coprime and less than The set of positive integers, represents random space; The key generation center generates a private key based on the system master key, the system public parameters and the identity character of the signer, including: calculate ; Output the private key ; in, The identity characters of the signer; The signer uses the private key to sign the message to obtain the signature of the message, including: Pick a random number ; calculate 、 、 、 ; Output ; Among them, M is the message, For signature; Before the designator masks the signature of the message with a random mask to generate a transformed signature, the process further includes: The designator verifies the signature of the message; The verification steps include: the designator calculates 、 、 、 ; judge Is it equal to ; If yes, the verification succeeds; if no, the verification fails; The designator uses a random mask to mask the signature of the message to generate a transformed signature, including: Pick a random number , ; in, To convert the signature, For conversion key.

5. An electronic device, characterized in that: include: A processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements a general designated verifier signature certification method based on SM9 as described in any one of claims 1 to 3.

Images