SM2-based message recoverable blind signature generation method and system

Abstract

The invention provides an SM2-based message recoverable blind signature generation method and system, and the method specifically comprises the following steps: a system administrator generates system parameters, and shares the system parameters to two entities, namely a signer and a user; the signer generates a public key and a private key, randomly selects parameters to generate temporary variables and sends the temporary variables to the user; after the user receives the temporary variable, blind processing is carried out on the temporary variable by introducing a random parameter, and a new parameter is generated and fed back to the signer; the signer calculates a temporary signature parameter according to the new parameter and sends the temporary signature parameter to the user; and the user generates a final blind signature by using the temporary signature parameter and outputs the final blind signature, thereby completing the message recoverable blind signature generation process based on SM2. According to the method, the message is hidden in the signature value, a verifier directly decodes the message without extra bandwidth, the storage and communication cost is effectively reduced, meanwhile, an untraceable design is provided, and the data security and privacy protection requirements in the fields of electronic voting, anonymous payment and the like are met.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular, to a method and system for generating a message recoverable blind signature based on SM2. Background Art

[0002] As a core technology for the integrity and non-repudiation of electronic data, digital signatures have been widely used in scenarios such as e-government and financial transactions. Its core functions include identity authentication, data anti-tampering, and behavior traceability. However, traditional digital signatures require the signer to know the message content and cannot meet the anonymity requirements. Blind signature technology allows the signer to generate a legal signature without knowing the message content by blinding the message, significantly enhancing the privacy protection ability, especially suitable for scenarios such as electronic voting and anonymous payment. For example, anonymous payment systems such as BlindCoin achieve complete anonymity of transaction identities through blind signatures.

[0003] Although blind signature technology solves the privacy protection problem, it cannot meet the message recoverability in practical applications and still faces the challenge of message transmission redundancy: traditional blind signatures need to transmit both the message and the signature value, which significantly increases the data interaction volume in scenarios sensitive to bandwidth such as blockchain. Although there is now a method for generating an identity-based recoverable message blind signature that successfully solves this problem, this solution is based on computationally expensive bilinear pair operations and still needs to be further optimized.

[0004] To address the above problems, the present invention designs a method and system for generating a message recoverable blind signature based on SM2 digital signature. Among them, the SM2 elliptic curve public key cryptography algorithm is an elliptic curve public key cryptography algorithm promulgated by the State Cryptography Administration (see the "SM2 Elliptic Curve Public Key Cryptography Algorithm" specification, State Cryptography Administration, December 2010), and the algorithm determines algorithms or protocols including data encryption, digital signature, and key exchange. The SM2 digital signature algorithm is widely used for message transmission due to its high security and high efficiency, and can effectively ensure the reliability of messages during message transmission. Summary of the Invention

[0005] The purpose of the present invention is to propose a method and system for generating a message recoverable blind signature based on SM2, aiming to solve the problem that the existing generation method of blind signature schemes based on SM2 cannot meet the message recoverability, resulting in the need for additional communication bandwidth to send messages, effectively reducing the storage and communication costs, thereby reducing the system burden and better meeting the data security and privacy protection requirements in fields such as electronic voting, anonymous payment, and electronic income aggregation. In addition, the present invention patent provides an untraceable design to ensure that the signer cannot link the signed blind signature with the signature published by the user.

[0006] To achieve the above object, the technical solution of the present invention is as follows:

[0007] The present invention proposes a method for generating a message recoverable blind signature based on SM2, which specifically includes the following steps:

[0008] S1. The system administrator generates system parameters and shares the system parameters with two entities, namely the signer and the user;

[0009] S2. The signer generates a public key and a private key, and the signer randomly selects a parameter to generate a temporary variable K and sends it to the user;

[0010] S3. After receiving the temporary variable K, the user performs a blinding process on the temporary variable K by introducing a random parameter to generate a new parameter r' and feeds it back to the signer;

[0011] S4. The signer calculates a temporary signature parameter s' based on the new parameter r' and sends it to the user;

[0012] S5. The user generates a final blind signature (r, s) using the temporary signature parameter s' and outputs it, completing the process of generating a message recoverable blind signature based on SM2.

[0013] Preferably, the system administrator generates the system parameters as follows:

[0014] Randomly select a large prime number q, and determine a non-singular elliptic curve E: y 2 = x 3 + ax + b (mod q), where a, b ∈ F q F q is a finite field containing q elements, and a, b are elements in F q The elliptic curve E on F is defined by a, b; select a prime number n-order cyclic group q from all points of E including the infinite point and a generator Define 3 hash functions F1: {0, 1} l2 → {0, 1} l1 F2: {0, 1} l1 → {0, 1} l2 and |q| = l1 + l2, where {0, 1} * is an arbitrarily long string composed of 0 and 1, {0, 1} |q| is a string composed of 0 and 1 with a length consistent with the bit length of q, and |q| is the bit length of the large prime number q. {0, 1} l1 represents a string composed of 0 and 1 with a length of l1, and {0, 1} l2 represents a string composed of 0 and 1 with a length of l2; output the system parameters

[0015] Preferably, S2 is specifically as follows:

[0016] Randomly select the private key SK = x ∈ F of the signer Signer q , calculate the public key PK = [x]G; the signer Signer randomly selects is the set composed of elements relatively prime to the element n in the set {1, 2,..., n}, calculate the first temporary variable K = [k]G, and send the temporary variable K to the user User.

[0017] Preferably, S3 is specifically as follows:

[0018] After the user User receives the temporary variable K, randomly select Blind the temporary variable K, calculate the second temporary variable K' = [α]K + [β]G = (r x , r y ); the user calculates the third temporary variable Then calculate the signature value where m is the message to be signed; the user calculates the fourth temporary variable r' = α -1 (r + β) (mod q) and send the fourth temporary variable r' to the signer.

[0019] Preferably, S4 is specifically as follows:

[0020] After the signer receives the temporary variable r', calculate the temporary signature parameter s' = (1 + x) -1 (k - r'x) (mod q), and send the temporary signature parameter s' to the user, where x is the private key SK.

[0021] Preferably, S5 is specifically as follows:

[0022] After the user receives the temporary signature parameter s', calculate the signature value s = αs' + β (mod q), and output the blind signature (r, s).

[0023] Preferably, the verifier verifies and recovers the message according to the blind signature as follows:

[0024] The verifier receives the system parameters pp, the public key PK = [x]G and the blind signature (r, s);

[0025] During verification, calculate the temporary variable K' = sG + sPK - rG, and then calculate the temporary variable u'1 represents the value of the leftmost l1 bits of the u string, u'2 represents the value of the rightmost l2 bits of the u string, and recover the message through Recover the message;

[0026] If F1(m') = u'1, the signature is valid and the recovered message m' is output; otherwise, the signature is invalid.

[0027] The present invention also provides a message recoverable blind signature generation system based on SM2, including a processor, a memory, and a computer program stored on the memory. When the processor executes the computer program, it specifically executes the steps in any of the above-mentioned message recoverable blind signature generation methods based on SM2.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] The present invention designs a blind signature scheme that meets message recoverability based on the SM2 algorithm, aiming to solve the problem that the existing blind signature scheme generation method based on SM2 cannot meet message recoverability, resulting in the need for additional communication bandwidth to send messages. It effectively reduces storage and communication costs, thereby reducing the system burden and better meeting the data security and privacy protection requirements in fields such as electronic voting, anonymous payment, and electronic income aggregation. In addition, the present invention patent provides an untraceable design to ensure that the signer cannot link the signed blind signature with the signature published by the user. Description of the Drawings

[0030] Figure 1 It is a flowchart of a message recoverable blind signature generation method based on SM2 in an embodiment of the present invention. Detailed Embodiments

[0031] Next, in combination with the attached Figure 1 , the technical solutions of the present invention will be specifically described.

[0032] The present invention provides a message recoverable blind signature generation method based on SM2 to solve the problem that the existing blind signature scheme based on SM2 cannot meet message recoverability and results in additional communication bandwidth. It includes two entities: a signer and a user. The present invention is implemented through the following steps:

[0033] First, the system administrator calls the signature parameter initialization algorithm to determine the system parameters and shares the system parameters with the two entities;

[0034] Then, the signer calls the signer key generation algorithm to generate a public key and a private key, and calls the signer variable generation algorithm to generate a first temporary variable K, and sends K to the user;

[0035] After receiving K, the user calls the user variable generation algorithm to blind K to obtain a second K', calculates a third temporary variable u, a signature value r, and a fourth temporary variable r', and sends r' to the signer;

[0036] The signer invokes the temporary signature generation algorithm to generate a temporary signature s' and sends it to the user;

[0037] The user invokes the final signature generation algorithm to calculate the signature value s and outputs the blind signature (r, s).

[0038] Algorithm 1. Initialization of signature parameters: Randomly select a large prime number q, determine the non-singular elliptic curve E: y 2 = x 3 + ax + b (mod q) (where a, b ∈ F q , F q is a finite field containing q elements, and a, b are elements in F q The elliptic curve E on F is defined by a and b) q Among all the points (including the infinite point) on E, select a cyclic group of prime order n and a generator Define 3 hash functions F1: {0, 1} l2 → {0, 1} l1 , F2: {0, 1} l1 → {0, 1} l2 and |q| = l1 + l2, where {0, 1} * is an arbitrarily long string composed of 0 and 1, {0, 1} |q| is a string composed of 0 and 1 with the same bit length as q, and |q| is the bit length of the large prime number q. {0, 1} l1 represents a string of length l1 composed of 0 and 1, and {0, 1} l2 represents a string of length l2 composed of 0 and 1; Output the system parameters This invention is designed based on the SM2 digital signature, so it uses the same system parameters as SM2. The specific parameter symbols are defined as follows:

[0039] q: Large prime number;

[0040] F q : Finite field containing q elements;

[0041] a, b: Elements in F q They define an elliptic curve E on F q ;

[0042] E(F q ): The set composed of all rational points (including the infinite point O) of the elliptic curve E on F q ;

[0043] #E(F q ): E(F q) The number of points on the upper side, called the order of the elliptic curve E(F q )

[0044] O: A special point on the elliptic curve, called the point at infinity or the zero point;

[0045] A cyclic group containing all points of the elliptic curve E and the point at infinity;

[0046] G: The generator of the group )

[0047] n: The order of the generator G (n is a prime factor of #E(F q )

[0048] A secure cryptographic hash function;

[0049] The set consisting of elements in the set {1, 2,..., n} that are relatively prime to the element n;

[0050] x||y: The concatenation of x and y, where x and y can be bit strings or byte strings;

[0051] [k]P: The k-fold point of the point P on the elliptic curve, where k is a positive integer; similarly, the definitions of [x]G, [k]G, [α]K, and [β]G in this application can be obtained;

[0052] (r x , r y ) : The value of the x-coordinate and the value of the y-coordinate of a certain point;

[0053] α -1 : The multiplicative inverse of α modulo q.

[0054] Algorithm 2. Signer Key Generation: The algorithm takes the system parameter pp as input, randomly selects the private key SK = x ∈ F of the signer Signer q , and calculates the public key PK = [x]G.

[0055] Algorithm 3. Signer Variable Generation: The algorithm takes the system parameter pp as input. The signer Signer randomly selects calculates the first temporary variable K = [k]G, and sends K to the user User.

[0056] Algorithm 4. User Variable Generation: The algorithm takes the system parameter pp and the message m to be signed as input. After the user User receives K, randomly selects performs blinding processing on K, and calculates the second temporary variable K' = [α]K + [β]G = (r x , r y ). Then, the user calculates the third temporary variable Calculate the signature value again Subsequently, the user calculates the fourth temporary variable r' through r' = α -1 (r + β)(mod q) and sends it to the signer.

[0057] Algorithm 5. Generation of temporary signature: The algorithm takes the system parameters pp and the private key SK = x as input. After receiving r', the signer calculates the temporary signature s' = (1 + x) -1 (k - r'x)(mod q) and sends s' to the user.

[0058] Algorithm 6. Generation of the final signature: The algorithm takes the system parameters pp as input. After receiving s', the user calculates the signature value s = αs' + β (mod q) and outputs the blind signature (r, s).

[0059] Algorithm 7. Verification and message recovery: The algorithm takes the system parameters pp and the public key PK = [x]G as input. During verification, it calculates the temporary variable K' = sG + sPK - rG, and then calculates the temporary variable u'1 represents the value of the leftmost l1 bits of the u string, and u'2 represents the value of the rightmost l2 bits of the u string. Through Recover the message. If F1(m') = u'1, the signature is valid and the recovered message m' is output; otherwise, the signature is invalid.

[0060] The present invention also proposes a message recoverable blind signature generation system based on SM2, including a processor, a memory, and a computer program stored on the memory. When the processor executes the computer program, it specifically executes the steps in any of the above-mentioned message recoverable blind signature generation methods based on SM2.

[0061] The message recoverable blind signature generation method and system designed based on the SM2 digital signature of the present invention can meet the message recoverability: the message is hidden in the signature value through the encoding rule, and the verifier can directly decode the message from the signature without receiving the message separately, greatly reducing the communication and storage overhead; at the same time, it avoids the high-time-consuming bilinear pairing operation and reduces the calculation overhead; in addition, the present invention patent can meet the untraceability, that is, the signer cannot link the signed blind signature with the signature published by the user.

[0062] The above are the preferred embodiments of the present invention. All changes made according to the technical solution of the present invention that do not exceed the scope of the technical solution of the present invention in terms of the functions and effects produced belong to the protection scope of the present invention.

Claims

1. A method for generating a message recoverable blind signature based on SM2, characterized in that, Specifically, it includes the following steps: S1. The system administrator generates system parameters and shares the system parameters with two entities, namely the signer and the user; S2. The signer generates a public key and a private key. The signer randomly selects a parameter to generate a temporary variable K and sends it to the user; S3. After receiving the temporary variable K, the user performs a blinding process on the temporary variable K by introducing a random parameter, generates a new parameter r' and feeds it back to the signer; S4. The signer calculates a temporary signature parameter s' based on the new parameter r' and sends it to the user; S5. The user uses the temporary signature parameter s' to generate a final blind signature (r, s) and outputs it, completing the process of generating a message recoverable blind signature based on SM2.

2. The method for generating a message recoverable blind signature based on SM2 according to claim 1, wherein, The system administrator generates system parameters specifically as follows: Randomly select a large prime number q, and determine a non-singular elliptic curve E: y 2 = x 3 + ax + b (mod q), where a, b ∈ F q , and F q is a finite field containing q elements, and a, b are elements in F q , and define the elliptic curve E on F q by a and b; select a prime-order additive cyclic group and a generator from all the points of E that include the point at infinity; define three hash functions F1: {0, 1} l2 → {0, 1} l1 , F2: {0, 1} l1 → {0, 1} l2 and H2: |q| = l1 + l2, where {0, 1} |q| is a string consisting of 0 and 1 with the same bit length as q, |q| is the bit length of the large prime number q, {0, 1} l1 represents a string consisting of 0 and 1 with a length of l1, and {0, 1} l2 represents a string consisting of 0 and 1 with a length of l2; output the system parameters 3. The method for generating a message recoverable blind signature based on SM2 according to claim 2, wherein, S2 specifically is as follows: Randomly select the private key SK = x ∈ F of the signer Signer q , calculate the public key PK = [x]G; the signer Signer randomly selects is the set consisting of elements in the set {1, 2,..., n} that are relatively prime to the element n, calculate the first temporary variable K = [k]G, and send the temporary variable K to the user User.

4. A method for generating a message recoverable blind signature based on SM2 according to claim 2, characterized in that, S3 specifically is as follows: After the user "User" receives the temporary variable K, randomly select Blind the temporary variable K, and calculate the second temporary variable K' = [α]K + [β]G = (r x , r y ); The user calculates the third temporary variable Then calculate the signature value where m is the message to be signed; The user calculates the fourth temporary variable r' through r' = α -1 (r + β) (mod q) and sends the temporary variable r' to the signer.

5. A method for generating a message recoverable blind signature based on SM2 according to claim 3, wherein, S4 specifically is as follows: After the signer receives the temporary variable r', calculate the temporary signature parameter s'=(1 + x) -1 (k - r'x)(mod q), and send the temporary signature parameter s' to the user, where x is the private key SK.

6. A method for generating a message recoverable blind signature based on SM2 according to claim 4, characterized in that, S5 specifically is as follows: After receiving the temporary signature parameter s', the user calculates the signature value s = αs' + β (mod q) and outputs the blind signature (r, s).

7. A method for generating a message recoverable blind signature based on SM2 according to claim 1, wherein The verifier verifies and recovers the message based on the blind signature specifically as follows: The verifier receives the system parameters pp, the public key PK = [x]G, and the blind signature (r, s); During verification, calculate the temporary variable K' = sG + sPK - rG, and then calculate the temporary variable u'1 represents the value of the leftmost l1 bits of the u string, and u'2 represents the value of the rightmost l2 bits of the u string. By recover the message; If F1(m') = u'1, the signature is valid and the recovered message m' is output; otherwise, the signature is invalid.

8. A message recoverable blind signature generation system based on SM2, characterized in that, It includes a processor, a memory, and a computer program stored on the memory. When the processor executes the computer program, it specifically executes the steps in the method for generating a message recoverable blind signature based on SM2 as described in any one of claims 1-7.

Images