A method and system for proving generalized designated verifier transfer signature based on SM2

Abstract

The application provides a generalized designated verifier transfer signature proof method and system based on SM2, relates to the technical field of information security, and aims to solve the problems of design defects and high computational complexity of existing schemes. The application mainly comprises a key generation step, a transfer signature generation step, a signature verification step, a signature synthesis step, a signature conversion step and a signature interactive verification protocol step. By using an efficient interactive zero-knowledge proof scheme, the construction eliminates the limitations of verifier registration keys. Compared with the prior art, the construction has optimal computing cost and ideal communication cost.

Description

TECHNICAL FIELD

[0001] The present application relates to information security technology, in particular to a universal designated verifier transitive signature proof (UDVTSP) scheme based on SM2 signature, which is suitable for authentication and privacy protection of dynamically growing graph data system. BACKGROUND

[0002] Graph data structure is an effective way to represent entity relationship in complex environment, and has been widely used in big data, blockchain and other application scenarios. Traditional signature schemes usually cannot cope with the dynamic growth of graph data system, especially in the efficiency of authentication process and privacy protection.

[0003] Transitive signature is a special homomorphic signature that allows a third party holding the signer's public key to generate edge (i, k) signature based on adjacent edges (i, j) and (j, k). Universal designated verifier transitive signature (UDVTS) scheme allows the signer to specify a specific verifier for signature verification. However, the existing UDVTS scheme has design defects, that is, the specified verifier must create its own key pair using the public key parameters provided by the signer. In addition, most of these schemes rely on complex bilinear pairing or exponential operation, resulting in performance bottleneck. Therefore, it is of great significance to design a UDVTS scheme without bilinear pairing and exponential operation. SUMMARY

[0004] The present application proposes a UDVTS scheme based on SM2 signature algorithm, aiming to solve the design defects and high computational complexity of existing schemes. Specifically, to solve the design defect that the specified verifier must create its own key pair using the public key parameters provided by the signer; to reduce the computational complexity of existing works.

[0005] The technical scheme of the present application is: a universal designated verifier transitive signature proof method based on SM2, comprising the following steps:

[0006] Key generation step: given a security coefficient λ, the signer runs the system setting algorithm in SM2 to set the system parameter param, and runs the key generation algorithm in SM2 to generate a key pair (sk, pk);

[0007] Signature generation step: given the private key sk of the signer and nodes i, j∈V, V represents the set of nodes in the graph, output the signature ∑ of edge (i, j) ij; where, ∑ ij From (∑ i , ∑ j , σ ij ) constitute, ∑ i With ∑ j These are the signatures generated by nodes i and j using the SM2 signature algorithm under key sk, respectively. ij It is the public label value of edge (i, j);

[0008] Signature verification steps: ∑ ij Parsing into ∑ ij For (∑ i , ∑ j , σ ij Using the verification algorithm in SM2, verify the signatures of nodes i and j respectively. i ,∑ j Perform verification; if both signatures are valid, continue with their common tag value σ. ij Verify the correctness;

[0009] Signature synthesis steps: Using the public key pk, synthesize the valid signatures ∑ on edges (i,j) and (j,k). ij and ∑ jk The signature of the composite edge (i,k) ∑ ik ;

[0010] Signature conversion steps: The signature holder parses the signature ∑ ij For (∑ i , ∑ j , σ ij ),from Randomly select a secret value u and calculate a new signature value σ′. ij =σ ij +u and additional public information U=u·P, retain the temporary value u, and generate the transformed signature ∑′ ij =(∑ i , ∑ j , σ′ ij ,U); where, Let P be the set of positive integers that are modulo a safe prime number q, and let P be the base point.

[0011] Interactive signature verification steps: The verifier first verifies ∑ i and ∑ j If the validity of σ′ is verified, an interactive protocol is executed with the signer, utilizing the signer's commitment to the private value to verify σ′. ij The effectiveness.

[0012] Furthermore, in the key generation step, the signer sets the system parameter param by running the system setup algorithm SM.Setup of the SM2 algorithm; and runs the key generation algorithm SM.KeyGen to generate a key pair (sk, pk).

[0013] Furthermore, the key generation steps specifically include:

[0014] Step 1.1: The signer chooses a safe elliptic curve defined on a finite field, and its equation is of the form E:y 2 =x 3 +a·x+b, where a and b are the two parameters defining the equation of the elliptic curve, ensuring that (4a 3 +27b 2 mod p ≠ 0, mod is the modulo operation, choose a base point of order q P = (x p y p (P≠O), set the coordinating number μ, μ=#E(Fp) / q=1; where a and b are elements defining the elliptic curve; p is a prime number defining the size of the finite field; q is another prime number used to define the order of the subgroup; P is the base point, a specific point on the elliptic curve; #E(F p ) represents the elliptic curve E in the finite field F p The total number of points on it;

[0015] Step 1.2: Publicize system parameters It is a group whose generators are based on a base point P, and it is the set of positive integers modulo q. Randomly select an integer as the private key sk, calculate the public key pk = sk·P, and publish pk as the signature verification public key.

[0016] Furthermore, the signature generation steps specifically include:

[0017] Step 2.1: If node i is not in the set V of nodes in the storage graph, then add node i to V. Randomly select a secret label l(i) and calculate the corresponding public label L(i) = l(i)·P. The signer uses the SM.Sign algorithm in SM2 to sign i||L(i), i.e., σ i ←SM.Sign(sk,i||L(i)), and set ∑ i =(i,L(i),σ i ) serves as the dot signature (i.e., node certificate) of node i;

[0018] Step 2.2: Calculate the dot signature ∑ of node j using the same method. j =(j,L(j),σ j). Wherein, L(j) is the public label of node j, σ j is the signature generated by using SM.Sign algorithm on i||L(i) ;

[0019] Step 2.3: Calculate the label σ ij = l(i) - l(j) of edge (i, j), and set ∑ ij = ( ∑ i , ∑ j , σ ij ) as the signature of edge (i, j).

[0020] Further, the signature verification step specifically includes:

[0021] Step 3.1: Parse ∑ ij into ( ∑ i , ∑ j , σ ij ), and continue to parse ∑ i and ∑ j into (i, L(i), σ i ) and (j, L(j), σ j ) respectively;

[0022] Step 3.2: Run the verification algorithm SM.Verf in SM2, using the public key pk and the concatenation i||L(i) of node i and its public label to verify the point signature ∑ i . If SM.Verf (pk, i||L(i), σ i ) = 0, the algorithm returns 0, indicating that the verification fails. Similarly, use the public key pk and the concatenation j||L(j) of node j and its public label to verify the point signature ∑ j . If SM.Verf (pk, j||L(j), σ j ) = 0, the algorithm returns 0, indicating that the verification fails;

[0023] Step 3.3: Verify whether the equation σ ij ·P = L(i) - L(j) is true, if true, return 1, the verification is successful; otherwise, return 0, the verification fails.

[0024] Further, the signature synthesis algorithm step specifically includes:

[0025] Step 4.1: Parse the signatures ∑ ij and ∑ jk of edges (i, j) and (j, k) into ( ∑ i , ∑ i , σ ij ) and ( ∑ j , ∑ k , σ jk ) respectively;

[0026] Step 4.2: combine the parsed σ ij and σ jk , i.e. compute σ ik = σ ij + σ jk . Set (∑ i ,∑ k ,σ ik ) as the signature ∑ ik of edge (i, k).

[0027] Further, the signature conversion algorithm steps specifically include:

[0028] Step 5.1: receive parameters param, public key pk, and signature ∑ ij of edge (i, j), the algorithm parses ∑ ij into three parts (∑ i ,∑ j ,σ ij );

[0029] Step 5.2: the algorithm selects a random number u in . Add the random number u to the original signature value σ ij to generate a new signature value σ' ij , i.e. compute the new signature σ' ij = σ ij + u;

[0030] Step 5.3: compute the result of multiplication of random number U and base point P by U = u·P;

[0031] Step 5.5: set ∑' ij = (∑ i ,∑ j ,σ' ij , u) as the signature of the converted edge (i, j), i.e. composed of ∑ i and ∑ j , converted value σ' ij , and U respectively.

[0032] Further, the interactive designated verification protocol of signature steps specifically include:

[0033] Step 6.1: the designated verifier checks the validity of ∑ i ,∑ j , if SM.Verf(pk, i||L(i), σ i ) = 1 and SM.Verf(pk, j||L(j), σ j ) = 1, the verifier and the signature holder perform subsequent operations;

[0034] Step 6.2: The signee selects a random number X in and computes the commitment X = x·P, and sends X to the verifier;

[0035] Step 6.3: The verifier randomly selects a number w in and sends w to the signee;

[0036] Step 6.4: The signee computes Z = X + w·σ' using x and w and σ' ij and sends z to the verifier; ij

[0037] Step 6.5: The verifier uses the received x, z, w, and the known U, L(i) and L(j) to verify whether the equation X = z·P - w·(U + L(i) - L(j)) holds; if it does, the verifier accepts the signature; otherwise, the signature is rejected.

[0038] The present application also provides a generalized designated verifier transfer signature proof system based on SM2, comprising a processor and a memory, the memory being used to store program instructions, and the processor being used to call the stored instructions in the memory to execute a generalized designated verifier transfer signature proof method based on SM2 as described in the above technical solution.

[0039] In existing UDVTS schemes, the designated verifier must create his own key pair using the public key parameters provided by the signer. In addition, due to expensive bilinear pairing or modular exponentiation, these schemes have serious performance defects. In the present application, we design a UDVTS scheme based on SM2 signature without bilinear pairing and exponentiation. By using an efficient interactive zero-knowledge proof scheme, the construction eliminates the limitations of verifier registration keys. Compared with existing works, the construction has optimal computational cost and ideal communication cost. The main contributions of the present application are as follows:

[0040] 1. Flexibility: By using zero-knowledge proof technology, the design defect that the designated verifier must create his own key pair using the public key parameters provided by the signer in existing works is eliminated, making the setting of the designated verifier more flexible.

[0041] 2. Efficiency: By designing based on SM2 signature, bilinear pairing and exponentiation in existing UDVTS schemes are avoided, significantly reducing the computational complexity.

[0042] 3. Privacy protection: By using zero-knowledge proof technology, only the designated verifier can verify the signature, and other third parties cannot confirm the validity of the signature, ensuring data privacy.

[0043] ​4. Transitivity: allows third-party signers to compose the signature of edge (i, k) based on the signatures of adjacent edges (i, j) and (j, k) using the signer's public key, which is suitable for efficient authentication of dynamic undirected transitively graphs.

[0044] 5. Security: based on cryptographic security assumptions, the scheme has anti-forgery, privacy and non-transferability. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 The overall framework diagram of a UDVTSP method based on SM2 provided by an embodiment of the present application is provided.

[0046] Figure 2 The schematic diagram of a signature generation process provided by an embodiment of the present application is provided.

[0047] Figure 3 The schematic diagram of a transitive signature composition process provided by an embodiment of the present application is provided.

[0048] Figure 4 The schematic diagram of a signature conversion and interactive designated verification process provided by an embodiment of the present application is provided.

[0049] Figure 5 The flowchart of a UDVTSP method based on SM2 provided by an embodiment of the present application is provided. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below with embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application.

[0051] The specific descriptors and definitions are given below:

[0052] Lambda: security parameter.

[0053] E: Elliptic curve itself.

[0054] P: Prime number, defines the size of the finite field.

[0055] a, b: Two parameters that define the elliptic curve equation.

[0056] Q: Another prime number, used to define the order of the subgroup.

[0057] P: Base point, a specific point on the elliptic curve.

[0058] O: A special point on the elliptic curve, called the infinite point or zero point.

[0059] The group formed by the base point P as the generator.

[0060] μ: multiplicity.

[0061] E(F p ): denotes the total number of points of the elliptic curve E over the finite field F p

[0062] Set of positive integers modulo q.

[0063] V: set of nodes in the graph.

[0064] l: function that assigns a private label to each node.

[0065] L: function that computes a public label for each node.

[0066] N: set of all possible nodes.

[0067] i,j,k: node identifiers.

[0068] σ i ,σ j ,σ k : signatures of nodes i, j, k, respectively.

[0069] σ ij ,σ jk : labels of edges (i,j) and (j,k), respectively.

[0070] ∑ i ,∑ j ,∑ k : certificates of nodes i, j, k, containing node information, public label, and signature, respectively.

[0071] ∑ ij ,∑ jk : signatures of edges (i,j) and (j,k), respectively.

[0072] x,w: values randomly chosen in the interactive proof process.

[0073] X: commitment of x, X = x·P.

[0074] σ′ ij : transformed signature.

[0075] U: public part related to the transformed signature.

[0076] ∑′ ij : transformed signature of edge (i,j).

[0077] ||: used to concatenate two strings or values.

[0078] ​∪: set union operation, indicating adding an element or set to another set.

[0079] →: maps to, indicating that a function maps the elements of one set to another set.

[0080] As shown in Figure 1 and Figure 5 , the overall framework diagram of the SM2 signature-based UDVTSP method provided by the embodiment of the application is shown, and the specific steps are as follows:

[0081] Step 1) Key generation algorithm KeyGen: Given a security factor λ, the signer sets the system parameters by running the system setting algorithm of the SM2 signature Run the key generation algorithm of the SM2 signature to generate a key pair (sk, pk). Perform the following steps:

[0082] Step 1.1: The signer selects a secure elliptic curve defined on a finite field, and the equation form is E: y 2 = x 3 +a·x+b, a, b are two parameters defining the equation of the elliptic curve, and ensure that (4a 3 +27b 2 )mod p ≠ 0, mod is the remainder, select a q-order base point P = (x p , y p ) (P ≠ O), set the cofactor μ, μ = #E(Fp) / q = 1; wherein a and b are elements defining the elliptic curve; p is a prime number, defining the size of the finite field; is a group consisting of the base point P as a generator; q is another prime number, used to define the order of the subgroup; P is the base point, which is a specific point on the elliptic curve; #E(F p ) represents the total number of points of the elliptic curve E on the finite field F p ;

[0083] Step 1.2: Publicize system parameters In , an integer is randomly selected as the private key sk, the public key pk = sk·P is calculated, and pk is publicized as the signature verification public key.

[0084] Step 2) Transmission signature algorithm TSign: Given the private key sk of the signer and the vertices i, j ∈ V, output the transmission signature ∑ ij , as shown in Figure 2 , perform the following steps:

[0085] Step 2.1: If node i is not in the set V of nodes stored in the graph, add node i to V. In A secret label l(i) is randomly selected, and the corresponding public label L(i) = l(i) P is calculated. The signer uses the signature algorithm SM.Sign in SM2 to sign i || L(i), i.e., σ i ← SM.Sign(sk, i || L(i)), and ∑ i = (i, L(i), σ i ) is taken as the point signature (i.e., node certificate) of node i;

[0086] Step 2.2: The point signature ∑ j = (j, L(j), σ j ) of node j is calculated in the same way. Where L(j) is the public label of node j, and σ j is the signature generated by using the SM.Sign algorithm on i || L(i);

[0087] Step 2.3: The label σ ij = l(i) - l(j) of edge (i, j) is calculated, and ∑ ij = (∑ i , ∑ j , σ ij ) is taken as the signature of edge (i, j).

[0088] Step 3) Signature verification algorithm Verf: Verify the validity of the edge signature, by parsing ∑ ij , ∑ i and ∑ j , and using the signature verification algorithm of SM2, verify the concatenation of nodes i and j and their public labels i || L(i) and j || L(j), if the algorithm returns 0, the verification fails; if the result is 1, the verification passes. Continue to verify whether σ ij · P = L(i) - L(j) is true. If true, return 1, verification success; otherwise, return 0, verification failure. Perform the following steps:

[0089] Step 3.1: Parse ∑ ij into (∑ i , ∑ j , σ ij ), and continue to parse ∑ i and ∑ j into (i, L(i), σ i ) and (j, L(j), σ j ) respectively;

[0090] Step 3.2: Use the public key pk and the concatenation of nodes i or j and their public labels i || L(i) and j || L(j) to verify, if SM.Verf(pk, i || L(i), σ i) = 0 or SM.Verf(pk,j||L(j),σ j If ) = 0, then return 0, indicating verification failure.

[0091] Step 3.3: Verify σ ij ·Whether P and L(i)-L(j) are equal, if σ ij If P = L(i) - L(j), then return 1, indicating successful verification; otherwise, return 0, indicating failed verification.

[0092] Step 4) Synthesis Algorithm Comp: Given a parameter set param, receive the public key pj and two valid signatures ∑ on edges (i,j) and (j,k). ij and ∑ jk The signature holder calculates the signature ∑ on edge (i, k) as follows: ik ,like Figure 3 As shown:

[0093] Step 4.1: ∑ the signatures of edges (i,j) and (j,k). ij and ∑ jk They are respectively analyzed as (∑ i ,∑ i ,σ ij ) and (∑ j ,∑ k ,σ jk );

[0094] Step 4.2: Analyze the obtained σ ij and σ jk Perform combinations, i.e., calculate σ ik =σ ij +σ jk . (∑ i ,∑ k ,σ ik ) as the signature of edge (i,k) ∑ ik .

[0095] Step 5) Signature Transform Algorithm: The signature holder parses the signature ∑ ij For (∑ i , ∑ j , σ ij ),from Randomly select a value u and calculate the new signature value σ′. ij =σ ij +u and additional public information

[0096] U = u·P, retaining a temporary secret value u, and generating the transformed signature.

[0097] ∑′ ij =(∑ i , ∑j , σ' ij , U), as Figure 4 shown, in particular:

[0098] Step 5.1 : receiving the parameter param, the public key pk, and the signature ∑ ij of the edge (i, j). The algorithm parses ∑ ij into three parts (∑ i , ∑ j , σ ij );

[0099] Step 5.2: the algorithm selects a random number u in Z . A new signature value σ' ij is generated by adding the random number u to the original signature value σ ij , i.e. the new signature σ' ij = σ ij + u is calculated.

[0100] Step 5.3: the result of the multiplication of the random number u and the base point P is calculated by U = u · P.

[0101] Step 5.5: ∑' ij = (∑ i , ∑ j , σ' ij , U) is set as the converted signature of the edge (i, j), i.e. it consists of ∑ i and ∑ j , the converted value σ' ij , and U, respectively.

[0102] Step 6) Interactive Designated Verification Protocol IVProof: the verifier verifies whether ∑ i and ∑ j are valid by the verification algorithm of SM2. If SM.Verf(pk, i || L(i), σ i ) = 1 and SM.Verf(pk, j || L(j), σ j ) = 1, it is proved that the signature is valid, and then it is verified whether the equation X = z · P - w · (U + L(i) - L(j)) is established, where X is the commitment about the private value x in . If it is established, the verifier accepts the signature, otherwise rejects the signature. The following interactive protocol is executed by the designated verifier verifier and the signature holder:

[0103] Step 6.1 : the verifier checks the validity of ∑ i and ∑ j , if SM.Verf(pk, i || L(i), σ i ) = 1 and SM.Verf(pk, j || L(j), σ j) = 1, the verifier and the holder perform the subsequent operation.

[0104] Step 6.2: The holder randomly selects a value x in , calculates the commitment X = X·P, and sends X to the verifier.

[0105] Step 6.3: The verifier randomly selects a number w in , and sends w to the holder.

[0106] Step 6.4: The holder calculates z = x + w·σ' using x and w and σ' ij , and sends z to the verifier. ij

[0107] Step 6.5: The verifier uses the received x, z, w, and the known U, L(i) and L(j) to verify whether the equation X = z·P - w·(U + L(i) - L(j)) holds. If it holds, the verifier accepts the signature; otherwise, the verifier rejects the signature. The correctness analysis uses the following derivation process:

[0108] X = z·P - w·(U + L(i) - L(j))

[0109] = (x + w·σ' ij )·P - w·(U + L(i) - L(j))

[0110] = x·P + w·σ' ij ·P - w·(U + L(i) - L(j))

[0111] = x·P + w·(σ ij + u)P - w·(U + L(i) - L(j))

[0112] = x·P.

[0113] On the other hand, the embodiment of the present application also provides a generalized designated verifier transfer signature proof system based on SM2, comprising a processor and a memory, the memory is used for storing program instructions, and the processor is used for calling the stored instructions in the memory to execute the generalized designated verifier transfer signature proof method based on SM2 as described in the above technical solution.

[0114] In summary, the above specific embodiments are only implementation cases of the present application under certain conditions, and are not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. performed on the premise of following the spirit and principles of the present application should be included in the protection scope of the present application.​

Claims

1. A generalized designated verifier transfer signature proof method based on SM2, characterized in that, The method comprises the following steps: Key generation step: given a security factor The signer runs the system setting algorithm in SM2 to set the system parameters , and runs the key generation algorithm in SM2 to generate a key pair ; Signature generation step: given the private key of the signer and nodes , denote the set of nodes in the graph, the output edges of the signature ; where, consists of , are the signatures generated by the nodes under the key based on the SM2 signature algorithm, is the public label value of the edge ; Signature verification steps: Parsing into for The verification algorithm in SM2 is used to verify the nodes respectively. , signature Perform verification; if both signatures are valid, continue with... Verify the correctness; Signature generation steps: using the public key , will the side and Valid signature on and Composite edge signature ; Signature conversion step: signature holder parses signature For , randomly select a random number from , calculate the new label value and additional public information , keep the random number , generate the converted signature ; wherein, represents the positive integer set of the modulus safe prime number , and is the base point;​ Interactive signature verification steps: The verifier first verifies... and If the verification passes, an interactive protocol is executed with the signature holder, utilizing the signature holder's commitment to the private value for verification. The effectiveness.

2. The method of claim 1, wherein the method is a generalized designated verifier transfer signature proof method based on SM2. In the key generation step, the signer sets the system parameters by running the system setup algorithm in the SM2 algorithm ; runs the key generation algorithm in SM2 to generate a key pair .​ 3.The method of claim 1, wherein: The key generation step specifically comprises: Step 1.1: The signer selects a secure elliptic curve defined over a finite field and in the form of its equation , are two parameters that define the elliptic curve equation, ensuring , mod is the remainder, and a base point of prime order is selected, and a cofactor , 1 is set, where and are elements that define the elliptic curve; is a prime number that defines the size of the finite field; is another prime number that defines the order of the subgroup; is the base point, which is a specific point on the elliptic curve; denotes the total number of points of the elliptic curve over the finite field ; Step 1.2: Publicize system parameters , It is based on the base point As a group composed of generators, in Randomly select an integer as the private key. ,calculate and will Published as a public key for signature verification.

4. The method of claim 1, wherein the method is based on SM2. The signature generation step specifically comprises: Step 2.1: If node A set of nodes not in the storage graph In the middle, the node will be join in In; in Randomly select a secret tag Calculate the corresponding public tags The signer uses the SM2 signature algorithm. For nodes and its public label Serial Sign it, that is and will As a node The dot signature is the node certificate; Step 2.2: Calculate the node's point signature ; where, is the public label of the node , and is the signature generated on using the algorithm;​ Step 2.3: Compute edges of the disclosed tag value and set as the signature of the edge .

5. The method of claim 1, wherein the method is a generalized designated verifier transfer signature proof method based on SM2. The signature verification step specifically comprises: Step 3.1: Parse into , continue to parse and into and respectively; Step 3.2: Run the verification algorithm in SM2 , using the public key and the concatenation of the node and its public label to verify the point signature , If then the algorithm returns , indicating a failure of the verification; similarly, the point signature is verified using the public key and the concatenation of the node and its public label ; if then the algorithm returns , indicating a failure of the verification; Step 3.3: Verify equality if it is true, return , verification success; otherwise return , verification failure.

6. The method of claim 1, wherein the method is a generalized designated verifier transfer signature proof method based on SM2. The signature synthesis algorithm step specifically comprises: Step 4.1: The signature of and are parsed into and respectively; and ; Step 4.2: The parsed and are combined, i.e. the is calculated as the signature of the edge .

7. The method of claim 1, wherein the method is a generalized designated verifier transfer signature proof method based on SM2. The signature conversion algorithm step specifically comprises: Step 5.1 : Receiving parameters , a public key , and a signature of an edge , the algorithm will parse into three parts ; Step 5.2: The algorithm selects a random number in the range of the public tag value and adds the random number to the public tag value to generate a new tag value , i.e. ; Step 5.3: By computing the random number the result of the multiplication with the base point ; Step 5.5: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require the full context.] Set as after conversion The signatures, that is, respectively by and New label value ,as well as composition.

8. The method of claim 4, wherein the method is a generalized designated verifier transfer signature proof method based on SM2. The interactive designated verification protocol of the signature specifically comprises: Step 6.1: Designated Verifier Check If and , the verifier and the signee perform the subsequent operations; Step 6.2: The signature holder randomly chooses a value ∈ , computes the commitment and sends to the verifier; Step 6.3: The verifier randomly selects a number from the set and sends to the holder. Step 6.4: Holder uses and and computes and sends to the verifier; Step 6.5: The verifier uses the received , , and the known , and to verify that the equation holds; if it does, the verifier accepts the signature; otherwise, the signature is rejected. 9.A generalized designated verifier transfer signature proof system based on SM2, characterized in that: The device comprises a processor and a memory, the memory is used for storing program instructions, and the processor is used for calling the stored instructions in the memory to execute the method.

Images