Blind signature method and device based on non-interactive zero-knowledge proof, equipment and medium

Abstract

The invention discloses a blind signature method and device based on non-interactive zero knowledge proof, equipment and a medium, and relates to the technical field of information security, and the method comprises the steps: determining a public key and a private key based on a preset uniformly-distributed random matrix and a non-zero vector, transmitting a first commitment value generated by using a first random vector to a message provider, the message provider determines a second commitment value and a first non-interactive zero-knowledge proof value based on the second random vector, a preset uniformly distributed random matrix and the first commitment value, and sends a challenge value generated based on the to-be-signed message and the second commitment value and the first non-interactive zero-knowledge proof value to the signer; and if the verification of the first non-interactive zero-knowledge proof value is passed, determining a response value based on a first random vector and a private key, and sending a target response value meeting a preset acceptance condition to the message provider, so that the message provider determines a target blind signature of the to-be-signed message based on the target response value. The blind signature interaction round number is large, and the calculation complexity is high.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a blind signature method, device, equipment and medium based on non-interactive zero-knowledge proof. Background Art

[0002] Blind signature is a technology that allows a user (i.e., a message provider) to obtain the signature of a signer without exposing the message content. It is widely used in occasions where user privacy needs to be protected, such as the anonymity protection of user identity information in a banking system. However, traditional blind signature methods usually require multiple interactions between the message provider and the signer, which increases the communication overhead. And in order to achieve the blindness of the signature, high-level cryptographic components such as homomorphic encryption are often required. Existing blind signature schemes usually require multiple communication steps or interactive protocols, increasing communication latency and complexity. Moreover, the signature process is relatively cumbersome and usually relies on operations such as homomorphic encryption and public key encryption and decryption, which may lead to system performance bottlenecks.

[0003] As can be seen from the above, how to avoid a large number of interaction rounds and high computational complexity in blind signature is an urgent problem to be solved at present. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a blind signature method, device, equipment and medium based on non-interactive zero-knowledge proof, which can avoid a large number of interaction rounds and high computational complexity in blind signature. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a blind signature method based on non-interactive zero-knowledge proof, which is applied to a signer and includes:

[0006] Determine a public key and a private key based on a preset uniformly distributed random matrix and a non-zero vector, determine a first random vector using a Gaussian distribution, and generate a corresponding first commitment value using the preset uniformly distributed random matrix and the first random vector;

[0007] Send the first commitment value to a message provider, so that the message provider determines a second commitment value based on a second random vector, the preset uniformly distributed random matrix and the first commitment value, generates a first non-interactive zero-knowledge proof value using the second commitment value and a third random vector, generates a corresponding challenge value based on the message to be signed and the second commitment value, and sends the challenge value and the first non-interactive zero-knowledge proof value to the signer; wherein, both the second random vector and the third random vector are random vectors determined by the message provider based on the Gaussian distribution;

[0008] Verify the first non-interactive zero-knowledge proof value. If the verification passes, determine a response value for the challenge value based on the first random vector and the private key, and send the target response value that meets the preset acceptance condition to the message provider, so that the message provider determines the de-blinding response value based on the target response value, the second random vector, and the third random vector, and uses the de-blinding response value to determine the target blind signature of the message to be signed.

[0009] Optionally, determining the public key and private key based on a preset uniformly distributed random matrix and a non-zero vector, determining the first random vector using a Gaussian distribution, and generating a corresponding first commitment value using the preset uniformly distributed random matrix and the first random vector includes:

[0010] Generate a preset uniformly distributed random matrix including an identity matrix, and generate a non-zero vector of a preset length. Determine the public key based on the preset uniformly distributed random matrix and the non-zero vector, and determine the non-zero vector as the private key;

[0011] Select a random vector based on the Gaussian distribution of the preset operation environment to obtain the first random vector, and generate a corresponding first commitment value using the preset uniformly distributed random matrix and the first random vector.

[0012] Optionally, sending the first commitment value to the message provider, so that the message provider determines a second commitment value based on the second random vector, the preset uniformly distributed random matrix, and the first commitment value, generates a first non-interactive zero-knowledge proof value using the second commitment value and the third random vector, generates a corresponding challenge value based on the message to be signed and the second commitment value, and sends the challenge value and the first non-interactive zero-knowledge proof value to the signer, includes:

[0013] Send the first commitment value to the message provider, so that after receiving the first commitment value, the message provider determines the second random vector and the third random vector based on the Gaussian distribution, and determines a target vector based on the second random vector, the preset uniformly distributed random matrix, and in combination with the first commitment value;

[0014] Obtain a combined vector by combining the target vector and the zero vector, and determine the second commitment value based on the third random vector and the combined vector;

[0015] Generate a first non-interactive zero-knowledge proof value using the target vector, the second commitment value, the preset uniformly distributed random matrix, and the third random vector, generate a corresponding challenge value based on the message to be signed and the second commitment value using a hash function, and send the challenge value and the first non-interactive zero-knowledge proof value to the signer.

[0016] Optionally, when verifying the first non-interactive zero-knowledge proof value, if the verification passes, determining a response value for the challenge value based on the first random vector and the private key includes:

[0017] After receiving the challenge value and the first non-interactive zero-knowledge proof value sent by the message provider, using a preset verification algorithm to determine whether the first non-interactive zero-knowledge proof value meets the preset zero-knowledge proof condition;

[0018] If the first non-interactive zero-knowledge proof value meets the preset zero-knowledge proof condition, it indicates that the verification passes, and a response value for the challenge value is determined based on the first random vector and the private key.

[0019] Optionally, determining a response value for the challenge value based on the first random vector and the private key, and sending a target response value that meets the preset acceptance condition to the message provider includes:

[0020] Determining a response value for the challenge value based on the first random vector and the private key;

[0021] Based on the response value and using the rejection sampling algorithm to determine an acceptance probability value corresponding to the signature party's acceptance of the response value, and determining whether the acceptance probability value is greater than a target probability threshold;

[0022] If the acceptance probability value is greater than the target probability threshold, jump to the step of determining a response value for the challenge value based on the first random vector and the private key;

[0023] If the acceptance probability value is not greater than the target probability threshold, it indicates that the response value meets the preset acceptance condition, and the response value is determined as the target response value, and then the target response value is sent to the message provider.

[0024] Optionally, sending a target response value that meets the preset acceptance condition to the message provider so that the message provider determines a de-blinding response value based on the target response value, the second random vector, and the third random vector, and uses the de-blinding response value to determine the target blind signature of the message to be signed includes:

[0025] Sending a target response value that meets the preset acceptance condition to the message provider so that after receiving the target response value, the message provider performs linear relationship verification and norm constraint verification on the target response value;

[0026] If both the linear relationship verification and the norm constraint verification pass, determine the blind response value based on the target response value, the second random vector, and the third random vector;

[0027] Based on the preset uniformly distributed random matrix, the second commitment value, the challenge value, the public key, and the blind response value, determine the second non-interactive zero-knowledge proof value, and based on the second non-interactive zero-knowledge proof value, determine the target blind signature of the message to be signed.

[0028] Optionally, the linear relationship verification and the norm constraint verification of the target response value include:

[0029] Based on the target response value and the preset uniformly distributed random matrix, determine the first parameter result, and use the first commitment value, the challenge value, and the public key to determine the second parameter result, and determine whether the first parameter result is equal to the second parameter result;

[0030] If the first parameter result is equal to the second parameter result, determine whether the two-norm of the target response value is not greater than the target length threshold; the target length threshold is a length threshold determined based on preset protocol parameters;

[0031] If the two-norm of the target response value is not greater than the target length threshold, it indicates that both the linear relationship verification and the norm constraint verification pass.

[0032] In a second aspect, the present application provides a blind signature device based on non-interactive zero-knowledge proof, which is applied to a signer and includes:

[0033] A first commitment determination module, configured to determine a public key and a private key based on a preset uniformly distributed random matrix and a non-zero vector, determine a first random vector using a Gaussian distribution, and generate a corresponding first commitment value using the preset uniformly distributed random matrix and the first random vector;

[0034] A challenge value determination module, configured to send the first commitment value to a message provider, so that the message provider determines a second commitment value based on a second random vector, the preset uniformly distributed random matrix, and the first commitment value, generate a first non-interactive zero-knowledge proof value using the second commitment value and a third random vector, generate a corresponding challenge value based on the message to be signed and the second commitment value, and send the challenge value and the first non-interactive zero-knowledge proof value to the signer; wherein, both the second random vector and the third random vector are random vectors determined by the message provider based on the Gaussian distribution;

[0035] A proof value verification module is used to verify the first non-interactive zero-knowledge proof value. If the verification passes, a response value for the challenge value is determined based on the first random vector and the private key, and a target response value that meets the preset acceptance condition is sent to the message provider, so that the message provider determines a de-blinding response value based on the target response value, the second random vector, and the third random vector, and uses the de-blinding response value to determine the target blind signature of the message to be signed.

[0036] Thirdly, the present application provides an electronic device, including:

[0037] A memory for storing a computer program;

[0038] A processor for executing the computer program to implement the foregoing blind signature method based on non-interactive zero-knowledge proof.

[0039] Fourthly, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the foregoing blind signature method based on non-interactive zero-knowledge proof.

[0040] The present application determines a public key and a private key based on a preset uniformly distributed random matrix and a non-zero vector, determines a first random vector using a Gaussian distribution, and generates a corresponding first commitment value using the preset uniformly distributed random matrix and the first random vector; sends the first commitment value to a message provider, so that the message provider determines a second commitment value based on a second random vector, the preset uniformly distributed random matrix, and the first commitment value, generates a first non-interactive zero-knowledge proof value using the second commitment value and a third random vector, generates a corresponding challenge value based on the message to be signed and the second commitment value, and sends the challenge value and the first non-interactive zero-knowledge proof value to the signer; wherein, both the second random vector and the third random vector are random vectors determined by the message provider based on the Gaussian distribution; verifies the first non-interactive zero-knowledge proof value, if the verification passes, determines a response value for the challenge value based on the first random vector and the private key, and sends a target response value that meets the preset acceptance condition to the message provider, so that the message provider determines a de-blinding response value based on the target response value, the second random vector, and the third random vector, and uses the de-blinding response value to determine the target blind signature of the message to be signed.

[0041] As can be seen from the above, the present application constructs a public key and a private key based on a preset uniformly distributed random matrix and a non-zero vector, which has high security; makes a commitment through the preset uniformly distributed random matrix and a random vector to ensure the unpredictability and uniqueness of the obtained first commitment value, and verifies based on the challenge value and the first non-interactive zero-knowledge proof value determined by the message provider for the first commitment value and the random vector. If the verification passes, the response value determined based on the challenge value and the random vector is sent to the message provider, so that the message provider determines a de-blinding response value based on the target response value that meets the preset acceptance condition, determines a second non-interactive zero-knowledge proof value based on the de-blinding response value, and uses the second non-interactive zero-knowledge proof value as the target blind signature of the message to be signed. In this way, by using a preset uniformly distributed random matrix, multiple random vectors and combining non-interactive zero-knowledge proof for commitment and signature generation, the number of interactions and the computational complexity are reduced, and the efficiency of signature and verification is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on the provided drawings.

[0043] Figure 1 It is a flowchart of a blind signature method based on non-interactive zero-knowledge proof disclosed in the present application;

[0044] Figure 2 It is a flowchart of a specific blind signature method based on non-interactive zero-knowledge proof disclosed in the present application;

[0045] Figure 3 It is a schematic structural diagram of a blind signature device based on non-interactive zero-knowledge proof disclosed in the present application;

[0046] Figure 4 It is a structural diagram of an electronic device disclosed in the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0047] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0048] Currently, existing blind signature schemes usually require multiple communication steps or interactive protocols, increasing communication latency and complexity. Moreover, the signature process is rather cumbersome and typically relies on operations such as homomorphic encryption and public key encryption and decryption, which may lead to system performance bottlenecks. Therefore, this application provides a blind signature method based on non-interactive zero-knowledge proof. By using a preset uniformly distributed random matrix, multiple random vectors, and combining non-interactive zero-knowledge proof for commitment and signature generation, the number of interactions and computational complexity are reduced, and the efficiency of signature and verification is improved.

[0049] See Figure 1 As shown, an embodiment of the present invention discloses a blind signature method based on non-interactive zero-knowledge proof, which is applied to a signer and includes:

[0050] Step S11: Determine the public key and private key based on a preset uniformly distributed random matrix and a non-zero vector, determine the first random vector using the Gaussian distribution, and generate the corresponding first commitment value using the preset uniformly distributed random matrix and the first random vector.

[0051] In this embodiment, first, a preset uniformly random matrix including an n-dimensional identity matrix is generated, and the preset uniformly random matrix and the identity matrix are concatenated to obtain a public key matrix. The public key vector is obtained by multiplying the public key matrix and a non-zero short vector, and the public key is determined based on the public key vector and the public key matrix. The private key is determined using the non-zero short vector. In a specific implementation, the preset uniformly distributed random matrix can be ; where represents the set of matrices with elements in the integer ring modulo q , and the elements in the preset uniformly distributed random matrix are uniformly selected from . The public key matrix can be , where represents concatenating the n-dimensional identity matrix and the preset uniformly distributed random matrix by columns to obtain , that is, obtaining the public key matrix . Then, the public key matrix and the non-zero short vector are used to determine the public key vector , and the corresponding formula is as follows:

[0052] ;

[0053] where the non-zero short vector ; represents the set of m-dimensional vectors with elements in the integer ring modulo q , and the non-zero short vector Satisfy , indicating that the two-norm of the non-zero short vector cannot exceed the target norm threshold . After obtaining the above, the public key is determined based on the public key vector, and the corresponding formula is:

[0054] ;

[0055] where is the public key, is the public key matrix, is the public key vector. The calculation formula corresponding to the private key is:

[0056] ;

[0057] where is the private key, is the non-zero short vector.

[0058] It can be understood that after obtaining the public key and the private key, a random vector is selected based on the Gaussian distribution of the preset operation environment to obtain a first random vector, and the first commitment value is generated by multiplying the public key matrix corresponding to the preset uniform distribution random matrix and the first random vector. In a specific embodiment, the Gaussian distribution is , indicating a zero vector at the center and a standard deviation of of the -dimensional Gaussian distribution.

[0059] Specifically, the public key and the private key are determined based on the preset uniform distribution random matrix and the non-zero vector, the first random vector is determined using the Gaussian distribution, and the first commitment value is generated using the preset uniform distribution random matrix and the first random vector, including: generating a preset uniform distribution random matrix including the identity matrix, and generating a non-zero vector of a preset length, determining the public key based on the preset uniform distribution random matrix and the non-zero vector, and determining the non-zero vector as the private key; selecting a random vector based on the Gaussian distribution of the preset operation environment to obtain a first random vector, and generating the corresponding first commitment value using the preset uniform distribution random matrix and the first random vector.

[0060] Step S12: Send the first commitment value to the message provider, so that the message provider determines a second commitment value based on the second random vector, the preset uniformly distributed random matrix, and the first commitment value, generates a first non-interactive zero-knowledge proof value using the second commitment value and the third random vector, generates a corresponding challenge value based on the message to be signed and the second commitment value, and sends the challenge value and the first non-interactive zero-knowledge proof value to the signer; wherein, both the second random vector and the third random vector are random vectors determined by the message provider based on the Gaussian distribution.

[0061] In this embodiment, after obtaining the first commitment value, send the first commitment value to the message provider, so that after receiving the first commitment value, the message provider selects a second random vector and a third random vector from the Gaussian distribution, and determines a target vector based on the second random vector, the public key matrix corresponding to the preset uniformly distributed random matrix, and the first commitment value. The formula corresponding to the target vector is as follows:

[0062] ;

[0063] wherein, is the target vector, is the public key matrix corresponding to the preset uniformly distributed random matrix, is the second random vector, is the first commitment value. After obtaining the target vector, combine the target vector and the zero vector to obtain a combined vector, and determine the second commitment value based on the third random vector, the public key matrix corresponding to the preset uniformly distributed random matrix, and the combined vector. The formula corresponding to the second commitment value is as follows:

[0064] ;

[0065] wherein, is the second commitment value, and are the components in the second commitment value, is the public key matrix corresponding to the preset uniformly distributed random matrix, is the third random vector, is the target vector, is the combined vector.

[0066] It can be understood that after obtaining the second commitment value, generate a first non-interactive zero-knowledge proof value using the target vector, the second commitment value, the preset uniformly distributed random matrix, and the third random vector. The formula corresponding to the first non-interactive zero-knowledge proof value is as follows:

[0067] ;

[0068] Wherein, is the first non-interactive zero-knowledge proof value, is the public key matrix corresponding to the preset uniformly distributed random matrix, is the second commitment value, is the third random vector, is the target vector. After obtaining the first non-interactive zero-knowledge proof value, a corresponding challenge value is generated based on the message to be signed and the second commitment value by using a hash function, and the formula corresponding to the challenge value is as follows:

[0069] ;

[0070] Wherein, is the challenge value, is the output space of the hash function, is the message to be signed, is a component in the second commitment value. After obtaining the challenge value, the challenge value and the first non-interactive zero-knowledge proof value are sent to the signer.

[0071] Specifically, sending the first commitment value to the message provider so that the message provider determines the second commitment value based on the second random vector, the preset uniformly distributed random matrix, and the first commitment value, generates the first non-interactive zero-knowledge proof value by using the second commitment value and the third random vector, generates a corresponding challenge value based on the message to be signed and the second commitment value, and sends the challenge value and the first non-interactive zero-knowledge proof value to the signer, includes: sending the first commitment value to the message provider so that after receiving the first commitment value, the message provider determines the second random vector and the third random vector based on the Gaussian distribution, and determines the target vector based on the second random vector, the preset uniformly distributed random matrix, and in combination with the first commitment value; obtaining a combined vector by combining the target vector and the zero vector, and determining the second commitment value based on the third random vector and the combined vector; generating the first non-interactive zero-knowledge proof value by using the target vector, the second commitment value, the preset uniformly distributed random matrix, and the third random vector, generating a corresponding challenge value based on the message to be signed and the second commitment value by using a hash function, and sending the challenge value and the first non-interactive zero-knowledge proof value to the signer.

[0072] Step S13: Verify the first non-interactive zero-knowledge proof value. If the verification passes, determine a response value for the challenge value based on the first random vector and the private key, and send the target response value that meets the preset acceptance condition to the message provider, so that the message provider determines a de-blinding response value based on the target response value, the second random vector, and the third random vector, and uses the de-blinding response value to determine the target blind signature of the message to be signed.

[0073] In this embodiment, after receiving the challenge value and the first non-interactive zero-knowledge proof value, use a preset verification algorithm to determine whether the first non-interactive zero-knowledge proof value meets the preset zero-knowledge proof condition to verify the correctness of the first non-interactive zero-knowledge proof value. If the first non-interactive zero-knowledge proof value meets the preset zero-knowledge proof condition, it indicates that the verification passes, and then determine a response value for the challenge value based on the first random vector and the private key. The formula corresponding to the response value is as follows:

[0074] ;

[0075] Where, is the response value, is the first random vector, is the challenge value, is the private key. It is worth mentioning that the preset zero-knowledge proof condition can be set according to the actual situation and will not be specifically limited here.

[0076] Specifically, the verification of the first non-interactive zero-knowledge proof value, if the verification passes, and determining a response value for the challenge value based on the first random vector and the private key includes: after receiving the challenge value and the first non-interactive zero-knowledge proof value sent by the message provider, use a preset verification algorithm to determine whether the first non-interactive zero-knowledge proof value meets the preset zero-knowledge proof condition; if the first non-interactive zero-knowledge proof value meets the preset zero-knowledge proof condition, it indicates that the verification passes, and determine a response value for the challenge value based on the first random vector and the private key.

[0077] It can be understood that after obtaining the response value, based on the response value and using the rejection sampling algorithm, determine the acceptance probability value corresponding to the signature party's acceptance of the response value, and determine whether the acceptance probability value is greater than the target probability threshold. If the acceptance probability value is greater than the target probability threshold, jump to the step of determining the response value for the challenge value based on the first random vector and the private key to regenerate the response value; if the acceptance probability value is not greater than the target probability threshold, it indicates that the response value meets the preset acceptance condition, determine the response value as the target response value, and send the target response value to the message provider. In a specific embodiment, the acceptance probability value is , where is a zero-centered vector with a standard deviation of of the -dimensional Gaussian distribution at the response value at the probability density function value, is a positive integer, usually taken as 12, which is a scaling factor used to adjust the acceptance probability range of rejection sampling. If the acceptance probability value is not greater than 1, then the response value is determined as the target response value, and the target response value is sent to the message provider.

[0078] Specifically, determining the response value for the challenge value based on the first random vector and the private key, and sending the target response value that meets the preset acceptance condition to the message provider includes: determining the response value for the challenge value based on the first random vector and the private key; determining the acceptance probability value corresponding to the signature party's acceptance of the response value based on the response value and using the rejection sampling algorithm, and determining whether the acceptance probability value is greater than the target probability threshold; if the acceptance probability value is greater than the target probability threshold, jump to the step of determining the response value for the challenge value based on the first random vector and the private key; if the acceptance probability value is not greater than the target probability threshold, it indicates that the response value meets the preset acceptance condition, determine the response value as the target response value, and then send the target response value to the message provider.

[0079] In this embodiment, after obtaining the target response value that meets the preset acceptance condition, send the target response value to the message provider so that after the message provider receives the target response value, perform linear relationship verification and norm constraint verification on the target response value. If both the linear relationship verification and the norm constraint verification pass, then determine the blind signature response value based on the target response value, the second random vector, and the third random vector. The formula corresponding to the blind signature response value is as follows:

[0080] ;

[0081] Among them, is the de - blinding response value, is the target response value, is the second random vector, is the third random vector. After obtaining the de - blinding response value, based on the preset uniformly - distributed random matrix, the second commitment value, the challenge value, the public key, and the de - blinding response value, determine the second non - interactive zero - knowledge proof value. The formula corresponding to the second non - interactive zero - knowledge proof value is as follows:

[0082] ;

[0083] Among them, is the second non - interactive zero - knowledge proof value, is the public - key matrix corresponding to the preset uniformly - distributed random matrix, is the component in the second commitment value, is the challenge value, is the public - key vector in the public key, is the de - blinding response value. After obtaining the second non - interactive zero - knowledge proof value, determine the second non - interactive zero - knowledge proof value as the target blind signature corresponding to the message to be signed.

[0084] Specifically, sending the target response value that meets the preset acceptance condition to the message provider, so that the message provider determines the de - blinding response value based on the target response value, the second random vector, and the third random vector, and uses the de - blinding response value to determine the target blind signature of the message to be signed, includes: sending the target response value that meets the preset acceptance condition to the message provider, so that after the message provider receives the target response value, perform linear - relationship verification and norm - constraint verification on the target response value; if both the linear - relationship verification and the norm - constraint verification pass, then determine the de - blinding response value based on the target response value, the second random vector, and the third random vector; determine the second non - interactive zero - knowledge proof value based on the preset uniformly - distributed random matrix, the second commitment value, the challenge value, the public key, and the de - blinding response value, and determine the target blind signature of the message to be signed based on the second non - interactive zero - knowledge proof value.

[0085] Further, when performing linear - relationship verification on the target response value, determine the first parameter result based on the target response value and the preset uniformly - distributed random matrix, and determine the second parameter result using the first commitment value, the challenge value, and the public key, and judge whether the first parameter result and the second parameter result are equal, that is, judge whether the following formula is equal. The formula is:

[0086] ;

[0087] wherein, is the public key matrix corresponding to the preset uniformly distributed random matrix, is the target response value, is the first commitment value, is the challenge value, is the public key vector in the public key. If the first parameter result is equal to the second parameter result, then it is judged whether the two-norm of the target response value is not greater than the target length threshold, and the corresponding formula is as follows:

[0088] ;

[0089] wherein, is the two-norm of the target response value, is the target length threshold, and the target length threshold is a length threshold determined based on preset protocol parameters; if the two-norm of the target response value is not greater than the target length threshold, it indicates that both the linear relationship verification and the norm constraint verification pass.

[0090] Specifically, the linear relationship verification and the norm constraint verification of the target response value include: determining a first parameter result based on the target response value and the preset uniformly distributed random matrix, and using the first commitment value, the challenge value, and the public key to determine a second parameter result, and judging whether the first parameter result is equal to the second parameter result; if the first parameter result is equal to the second parameter result, then judging whether the two-norm of the target response value is not greater than the target length threshold; the target length threshold is a length threshold determined based on preset protocol parameters; if the two-norm of the target response value is not greater than the target length threshold, it indicates that both the linear relationship verification and the norm constraint verification pass.

[0091] It should be noted that the blind signature scheme based on non-interactive zero-knowledge proof in this embodiment can be applied to the anonymity protection of user identity information in the banking system. The message provider refers to the bank customer, such as the initiator of a transaction. The signer refers to the bank. The bank needs to sign this transaction to endorse its validity, but does not need to know the transaction details, so that the bank can complete the signature without understanding the specific content of the transaction, ensuring the anonymity of the user identity information.

[0092] As can be seen from the above, this application constructs the public key and private key based on a preset uniformly distributed random matrix and a non-zero vector, which has high security; makes commitments through the preset uniformly distributed random matrix and random vectors to ensure the unpredictability and uniqueness of the obtained first commitment value, and verifies based on the challenge value and the first non-interactive zero-knowledge proof value determined by the message provider for the first commitment value and the random vector. If the verification passes, the response value determined based on the challenge value and the random vector is sent to the message provider, so that the message provider determines the de-blinding response value based on the target response value that meets the preset acceptance condition, determines the second non-interactive zero-knowledge proof value based on the de-blinding response value, and uses the second non-interactive zero-knowledge proof value as the target blind signature of the message to be signed. In this way, by using the preset uniformly distributed random matrix and multiple random vectors and combining non-interactive zero-knowledge proofs for commitment and signature generation, the number of interactions and computational complexity are reduced, and the efficiency of signature and verification is improved.

[0093] As can be seen from the above embodiments, this application makes commitments and generates signatures based on a preset uniformly distributed random matrix, multiple random vectors, and non-interactive zero-knowledge proofs. Therefore, the process of making commitments and generating signatures based on a preset uniformly distributed random matrix, multiple random vectors, and non-interactive zero-knowledge proofs is described.

[0094] See Figure 2 As shown, an embodiment of the present invention discloses a specific blind signature method based on non-interactive zero-knowledge proof, which is applied to the signer and includes:

[0095] In this embodiment, first, a first random vector is selected based on the Gaussian distribution of the preset operation environment to obtain a first random vector, and then a preset uniformly random matrix including an identity matrix is generated. The identity matrix is concatenated with the preset uniformly random matrix to obtain a public key matrix. Then, a public key vector is determined based on the public key matrix and a non-zero short vector. The public key is obtained by using the public key vector and the public key matrix, and the private key is determined based on the non-zero short vector. After obtaining the public key and the private key, a first commitment value is generated based on the public key matrix corresponding to the preset uniformly distributed random matrix and the first random vector, and the second commitment value is sent to the message provider. After receiving the first commitment value, the message provider determines a second random vector and a third random vector based on the Gaussian distribution, determines a target vector based on the second random vector, the public key matrix corresponding to the preset uniformly distributed random matrix, and the first commitment value, then combines the target vector and the zero vector to obtain a combined vector, and determines the second commitment value by using the third random vector, the public key matrix corresponding to the preset uniformly distributed random matrix, and the combined vector.

[0096] Next, after obtaining the second commitment value, a first non-interactive zero-knowledge proof value is generated using the target vector, the second commitment value, the preset uniformly distributed random matrix, and the third random vector. A corresponding challenge value is generated using the message to be signed and the second commitment value and a hash function, and the challenge value and the first non-interactive zero-knowledge proof value are sent to the signer. Then, a preset verification algorithm is used to determine whether the first non-interactive zero-knowledge proof value meets the preset zero-knowledge proof condition; if the first non-interactive zero-knowledge proof value meets the preset zero-knowledge proof condition, it indicates that the verification passes. A response value corresponding to the challenge value is determined based on the first random vector and the private key, and then, based on the response value and using the rejection sampling algorithm, it is determined whether the acceptance probability value corresponding to the signer's acceptance of the response value is not greater than the target probability threshold. If the acceptance probability value is not greater than the target probability threshold, it indicates that the response value meets the preset acceptance condition, and the response value is determined as the target response value.

[0097] Further, the target response value is sent to the message provider so that the message provider can perform linear relationship verification and norm constraint verification on the target response value. If both the linear relationship verification and the norm constraint verification pass, a deblinding response value is determined based on the target response value, the second random vector, and the third random vector. Then, a second non-interactive zero-knowledge proof value is determined based on the preset uniformly distributed random matrix, the second commitment value, the challenge value, the public key, and the deblinding response value, and the second non-interactive zero-knowledge proof value is determined as the target blind signature of the message to be signed.

[0098] As can be seen from the above, in this application, a first random vector is first selected based on the Gaussian distribution, a public key matrix is obtained using a preset uniformly random matrix, and the public key and the private key are determined in combination with a non-zero short vector. Then, a first commitment value is generated using the public key matrix and the first random vector in the public key so that the message provider can determine the target vector and the second commitment value based on the first commitment value, and generate a first non-interactive zero-knowledge proof value and a challenge value. After the signer verifies the response value corresponding to the challenge value, the target response value is determined so that the message provider can determine the deblinding response value after verifying the target response value to generate the final target blind signature. In this way, without relying on public key encryption and decryption technology, the signature blindness is achieved through non-interactive zero-proof, reducing the number of interaction rounds and the computational complexity, making the signature process more efficient, suitable for lightweight signature verification scenarios, and ensuring the security and reliability of the digital signature system.

[0099] Correspondingly, as shown in Figure 3 This application also provides a blind signature device based on non-interactive zero-knowledge proof, which is applied to the signer and includes:

[0100] The first commitment system determination module 11 is configured to determine a public key and a private key based on a preset uniformly distributed random matrix and a non-zero vector, determine a first random vector using a Gaussian distribution, and generate a corresponding first commitment value using the preset uniformly distributed random matrix and the first random vector;

[0101] The challenge value determination module 12 is configured to send the first commitment value to a message provider, so that the message provider determines a second commitment value based on a second random vector, the preset uniformly distributed random matrix, and the first commitment value, generates a first non-interactive zero-knowledge proof value using the second commitment value and a third random vector, generates a corresponding challenge value based on the message to be signed and the second commitment value, and sends the challenge value and the first non-interactive zero-knowledge proof value to the signer; wherein, both the second random vector and the third random vector are random vectors determined by the message provider based on the Gaussian distribution;

[0102] The proof value verification module 13 is configured to verify the first non-interactive zero-knowledge proof value. If the verification is passed, a response value for the challenge value is determined based on the first random vector and the private key, and a target response value that meets a preset acceptance condition is sent to the message provider, so that the message provider determines a deblinding response value based on the target response value, the second random vector, and the third random vector, and determines a target blind signature of the message to be signed using the deblinding response value.

[0103] As can be seen from the above, the present application constructs a public key and a private key based on a preset uniformly distributed random matrix and a non-zero vector, and has high security; commitments are made through the preset uniformly distributed random matrix and random vectors to ensure the unpredictability and uniqueness of the obtained first commitment value. Verification is performed based on the challenge value and the first non-interactive zero-knowledge proof value determined by the message provider for the first commitment value and the random vectors. If the verification is passed, the response value determined based on the challenge value and the random vectors is sent to the message provider, so that the message provider determines a deblinding response value based on the target response value that meets the preset acceptance condition, determines a second non-interactive zero-knowledge proof value based on the deblinding response value, and uses the second non-interactive zero-knowledge proof value as the target blind signature of the message to be signed. In this way, commitments and signature generation are performed using a preset uniformly distributed random matrix, multiple random vectors, and non-interactive zero-knowledge proofs, reducing the number of interactions and computational complexity, and improving the efficiency of signature and verification.

[0104] In some specific embodiments, the first commitment system determination module 11 may specifically include:

[0105] A private key determination unit, configured to generate a preset uniformly distributed random matrix including an identity matrix, and generate a non-zero vector with a preset length, determine a public key based on the preset uniformly distributed random matrix and the non-zero vector, and determine the non-zero vector as the private key;

[0106] A random vector selection unit, configured to select a random vector based on the Gaussian distribution of a preset operation environment to obtain a first random vector, and generate a corresponding first commitment value by using the preset uniformly distributed random matrix and the first random vector.

[0107] In some specific embodiments, the challenge value determination module 12 may specifically include:

[0108] A target vector determination unit, configured to send the first commitment value to a message provider, so that after receiving the first commitment value, the message provider determines a second random vector and a third random vector based on the Gaussian distribution, and determines a target vector based on the second random vector, the preset uniformly distributed random matrix, and in combination with the first commitment value;

[0109] A vector combination unit, configured to obtain a combined vector by combining the target vector and a zero vector, and determine a second commitment value based on the third random vector and the combined vector;

[0110] A challenge value generation unit, configured to generate a first non-interactive zero-knowledge proof value by using the target vector, the second commitment value, the preset uniformly distributed random matrix, and the third random vector, generate a corresponding challenge value based on the message to be signed and the second commitment value by using a hash function, and send the challenge value and the first non-interactive zero-knowledge proof value to the signer.

[0111] In some specific embodiments, the proof value verification module 13 may specifically include:

[0112] A first proof value judgment unit, configured to, after receiving the challenge value and the first non-interactive zero-knowledge proof value sent by the message provider, judge whether the first non-interactive zero-knowledge proof value meets the preset zero-knowledge proof condition by using a preset verification algorithm;

[0113] A first response value determination unit, configured to, if the first non-interactive zero-knowledge proof value meets the preset zero-knowledge proof condition, indicate that the verification is passed, and determine a response value for the challenge value based on the first random vector and the private key.

[0114] In some specific embodiments, the proof value verification module 13 may specifically include:

[0115] The first response value determination unit is configured to determine a response value for the challenge value based on the first random vector and the private key;

[0116] The acceptance probability value determination unit is configured to determine an acceptance probability value corresponding to the response value that the signer accepts based on the response value and using the rejection sampling algorithm, and determine whether the acceptance probability value is greater than a target probability threshold;

[0117] The response value re - determination unit is configured to, if the acceptance probability value is greater than the target probability threshold, jump to the step of determining a response value for the challenge value based on the first random vector and the private key;

[0118] The target response value sending unit is configured to, if the acceptance probability value is not greater than the target probability threshold, indicate that the response value meets a preset acceptance condition, determine the response value as the target response value, and then send the target response value to the message provider.

[0119] In some specific embodiments, the proof value verification module 13 may specifically include:

[0120] The response value sending unit is configured to send a target response value that meets a preset acceptance condition to the message provider, so that after receiving the target response value, the message provider performs linear relationship verification and norm constraint verification on the target response value;

[0121] The de - blinded response value determination unit is configured to, if both the linear relationship verification and the norm constraint verification pass, determine a de - blinded response value based on the target response value, the second random vector, and the third random vector;

[0122] The second proof value determination unit is configured to determine a second non - interactive zero - knowledge proof value based on the preset uniformly distributed random matrix, the second commitment value, the challenge value, the public key, and the de - blinded response value, and determine the target blind signature of the message to be signed based on the second non - interactive zero - knowledge proof value.

[0123] In some specific embodiments, the proof value verification module 13 may specifically include:

[0124] The parameter result determination unit is configured to determine a first parameter result based on the target response value and the preset uniformly distributed random matrix, determine a second parameter result using the first commitment value, the challenge value, and the public key, and determine whether the first parameter result and the second parameter result are equal;

[0125] The two - norm judgment unit is configured to, if the first parameter result and the second parameter result are equal, determine whether the two - norm of the target response value is not greater than a target length threshold;

[0126] A verification passed unit, configured to indicate that both the linear relationship verification and the norm constraint verification pass if the two-norm of the target response value is not greater than a target length threshold.

[0127] Furthermore, an embodiment of the present application also discloses an electronic device. Figure 4 It is a structural diagram of an electronic device 20 shown according to an exemplary embodiment. The content in the figure should not be considered as any limitation on the scope of use of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the blind signature method based on non-interactive zero-knowledge proof disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0128] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows is any communication protocol applicable to the technical solution of the present application, and no specific limitation is imposed on it here; the input / output interface 25 is used to obtain external input data or output data to the outside, and its specific interface type can be selected according to specific application needs, and no specific limitation is made here.

[0129] In addition, as a carrier for resource storage, the memory 22 may be a read-only memory, a random access memory, a disk, or an optical disc, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0130] Among them, the operating system 221 is used to manage and control each hardware device and the computer program 222 on the electronic device 20, and it may be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program that can be used to complete the blind signature method based on non-interactive zero-knowledge proof executed by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs that can be used to complete other specific tasks.

[0131] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the blind signature method based on non-interactive zero-knowledge proof disclosed above. For the specific steps of this method, reference may be made to the corresponding content disclosed in the foregoing embodiments, and details are not described herein again.

[0132] In this specification, the various embodiments are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. For the same or similar parts among the various embodiments, reference can be made to each other. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple. For the relevant parts, reference can be made to the description in the method section.

[0133] Those skilled in the art can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed in this article can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0134] The steps of the methods or algorithms described in combination with the embodiments disclosed in this article can be directly implemented by hardware, software modules executed by a processor, or a combination of the two. The software modules can be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium well-known in the technical field.

[0135] Finally, it should also be noted that in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article or device including the said element.

[0136] The above has introduced the technical solution provided by the present application in detail. Specific examples are used herein to elaborate on the principle and implementation manner of the present application. The description of the above embodiments is only used to help understand the method and its core idea of the present application; at the same time, for those of ordinary skill in the art, according to the idea of the present application, there will be changes in the specific implementation manner and application scope. In summary, the content of this specification should not be construed as a limitation to the present application.

Claims

1. A blind signature method based on non-interactive zero-knowledge proof, characterized in that Applied to the signer, including: Determine the public key and private key based on a preset uniformly distributed random matrix and a non-zero vector, determine the first random vector using a Gaussian distribution, and generate a corresponding first commitment value using the preset uniformly distributed random matrix and the first random vector; Send the first commitment value to the message provider so that the message provider determines a second commitment value based on a second random vector, the preset uniformly distributed random matrix, and the first commitment value, generates a first non-interactive zero-knowledge proof value using the second commitment value and a third random vector, generates a corresponding challenge value based on the message to be signed and the second commitment value, and sends the challenge value and the first non-interactive zero-knowledge proof value to the signer; wherein, both the second random vector and the third random vector are random vectors determined by the message provider based on the Gaussian distribution; Verify the first non-interactive zero-knowledge proof value. If the verification passes, determine a response value for the challenge value based on the first random vector and the private key, and send a target response value that meets the preset acceptance condition to the message provider so that the message provider determines a de-blinding response value based on the target response value, the second random vector, and the third random vector, and uses the de-blinding response value to determine the target blind signature of the message to be signed.

2. The blind signature method based on non-interactive zero-knowledge proof according to claim 1, characterized in that, The determining the public key and private key based on a preset uniformly distributed random matrix and a non-zero vector, determining the first random vector using a Gaussian distribution, and generating a corresponding first commitment value using the preset uniformly distributed random matrix and the first random vector includes: Generate a preset uniformly distributed random matrix including an identity matrix, and generate a non-zero vector of a preset length. Determine the public key based on the preset uniformly distributed random matrix and the non-zero vector, and determine the non-zero vector as the private key; Select a random vector based on the Gaussian distribution of the preset operation environment to obtain the first random vector, and generate a corresponding first commitment value using the preset uniformly distributed random matrix and the first random vector.

3. The blind signature method based on non-interactive zero-knowledge proof according to claim 1, characterized in that, The sending the first commitment value to the message provider so that the message provider determines a second commitment value based on a second random vector, the preset uniformly distributed random matrix, and the first commitment value, generates a first non-interactive zero-knowledge proof value using the second commitment value and a third random vector, generates a corresponding challenge value based on the message to be signed and the second commitment value, and sends the challenge value and the first non-interactive zero-knowledge proof value to the signer includes: Send the first commitment value to the message provider so that after receiving the first commitment value, the message provider determines a second random vector and a third random vector based on the Gaussian distribution, and determines a target vector based on the second random vector, the preset uniformly distributed random matrix, and in combination with the first commitment value; Obtain a combined vector by combining the target vector and a zero vector, and determine the second commitment value based on the third random vector and the combined vector; Generate a first non-interactive zero-knowledge proof value by using the target vector, the second commitment value, the preset uniformly distributed random matrix, and the third random vector, generate a corresponding challenge value based on the message to be signed and the second commitment value by using a hash function, and send the challenge value and the first non-interactive zero-knowledge proof value to the signer.

4. The blind signature method based on non-interactive zero-knowledge proof according to claim 1, characterized in that, Verify the first non-interactive zero-knowledge proof value. If the verification passes, determine a response value for the challenge value based on the first random vector and the private key, including: After receiving the challenge value and the first non-interactive zero-knowledge proof value sent by the message provider, use a preset verification algorithm to determine whether the first non-interactive zero-knowledge proof value meets the preset zero-knowledge proof condition; If the first non-interactive zero-knowledge proof value meets the preset zero-knowledge proof condition, it indicates that the verification passes, and determine a response value for the challenge value based on the first random vector and the private key.

5. The blind signature method based on non-interactive zero-knowledge proof according to any one of claims 1 to 4, characterized in that, Determine a response value for the challenge value based on the first random vector and the private key, and send a target response value that meets the preset acceptance condition to the message provider, including: Determine a response value for the challenge value based on the first random vector and the private key; Based on the response value, use the rejection sampling algorithm to determine an acceptance probability value for the signer to accept the response value, and determine whether the acceptance probability value is greater than the target probability threshold; If the acceptance probability value is greater than the target probability threshold, jump to the step of determining a response value for the challenge value based on the first random vector and the private key; If the acceptance probability value is not greater than the target probability threshold, it indicates that the response value meets the preset acceptance condition, determine the response value as the target response value, and then send the target response value to the message provider.

6. The blind signature method based on non-interactive zero-knowledge proof according to claim 1, characterized in that, Send the target response value that meets the preset acceptance condition to the message provider so that the message provider can determine a deblinding response value based on the target response value, the second random vector, and the third random vector, and use the deblinding response value to determine the target blind signature of the message to be signed, including: Send the target response value that meets the preset acceptance condition to the message provider so that the message provider can perform a linear relationship verification and a norm constraint verification on the target response value after receiving the target response value; If both the linear relationship verification and the norm constraint verification pass, determine a deblinding response value based on the target response value, the second random vector, and the third random vector; Determine a second non-interactive zero-knowledge proof value based on the preset uniformly distributed random matrix, the second commitment value, the challenge value, the public key, and the deblinding response value, and determine the target blind signature of the message to be signed based on the second non-interactive zero-knowledge proof value.

7. The blind signature method based on non-interactive zero-knowledge proof according to claim 6, wherein Perform a linear relationship verification and a norm constraint verification on the target response value, including: Determine a first parameter result based on the target response value and the preset uniformly distributed random matrix, determine a second parameter result using the first commitment value, the challenge value, and the public key, and determine whether the first parameter result and the second parameter result are equal; If the first parameter result and the second parameter result are equal, then determine whether the two-norm of the target response value is not greater than a target length threshold; the target length threshold is a length threshold determined based on preset protocol parameters; If the two-norm of the target response value is not greater than the target length threshold, it indicates that both the linear relationship verification and the norm constraint verification have passed.

8. A blind signature device based on non-interactive zero-knowledge proof, characterized in that Applied to the signer, it includes: A first commitment value determination module, configured to determine a public key and a private key based on a preset uniformly distributed random matrix and a non-zero vector, determine a first random vector using a Gaussian distribution, and generate a corresponding first commitment value using the preset uniformly distributed random matrix and the first random vector; A challenge value determination module, configured to send the first commitment value to the message provider, so that the message provider determines a second commitment value based on a second random vector, the preset uniformly distributed random matrix, and the first commitment value, generates a first non-interactive zero-knowledge proof value using the second commitment value and a third random vector, generates a corresponding challenge value based on the message to be signed and the second commitment value, and sends the challenge value and the first non-interactive zero-knowledge proof value to the signer; wherein, both the second random vector and the third random vector are random vectors determined by the message provider based on the Gaussian distribution; A proof value verification module, configured to verify the first non-interactive zero-knowledge proof value, and if the verification passes, determine a response value for the challenge value based on the first random vector and the private key, and send a target response value that meets the preset acceptance condition to the message provider, so that the message provider determines a de-blinding response value based on the target response value, the second random vector, and the third random vector, and determines the target blind signature of the message to be signed using the de-blinding response value.

9. An electronic device, characterized in that, It includes: A memory, configured to store a computer program; A processor, configured to execute the computer program to implement the blind signature method based on non-interactive zero-knowledge proof according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, For storing a computer program, wherein the computer program, when executed by a processor, implements the blind signature method based on non-interactive zero-knowledge proof according to any one of claims 1 to 7.

Images