SM2 ring signature method with constant signature size

Abstract

The present application relates to a kind of constant level signature size SM2 ring signature method, digital signature technology effectively guarantees the authenticity of communication data, integrity and identity verifiability, but in anonymous voting, anonymous payment etc. Scene, traditional digital signature will leak sensitive information.Ring signature can hide signer in user group, can effectively protect the privacy of signer. Since the size of most existing ring signature is linearly related to the number of ring members, some studies have proposed to use a bilinear pair accumulator to implement a constant level ring signature, and many subsequent constant level ring signature schemes have also been proposed, which are also based on bilinear pairing. However, the standard elliptic curve used by the domestic SM2 password does not support bilinear pairing, and it is not possible to implement a constant level ring signature for SM2. Therefore, the present application combines RSA accumulator with SM2 signature design, while maintaining compatibility with national encryption algorithms, it achieves constant signature size.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, in particular to an SM2 ring signature method with constant signature size. BACKGROUND

[0002] Digital signature technology effectively guarantees the authenticity, integrity and identity verifiability of communication data, but in the scene of anonymous voting, anonymous payment, etc., the traditional digital signature will leak sensitive information. In order to solve the above problems, Rivest et al. proposed the concept of ring signature, which hides the signer in a user group, which can effectively protect the privacy of the signer. Since most existing ring signatures have a linear growth relationship with the number of ring members, some studies have proposed to use a bilinear pair accumulator to realize a constant level ring signature, and many constant level ring signature schemes have appeared subsequently, which are also based on bilinear pairing to realize. However, the standard elliptic curve used by the domestic SM2 password does not support bilinear pairing, and it is impossible to realize the constant level ring signature of SM2. SUMMARY

[0003] The technical problem to be solved by the present application is to provide an SM2 ring signature method with constant signature size in view of the above problems and requirements.

[0004] An SM2 ring signature method with constant signature size, comprising the following steps:

[0005] Step 1, system initialization, given security parameter 1 λ , output public parameters:

[0006] Step 2, generate private keys and public keys of t users, wherein the private key of the i-th user is d i , and the public key is PK i ;

[0007] Step 3.1, one of the t users selects t-1 user public keys plus its own public key to form a ring public key Let the user number of the signer be π, 1≤π≤t, input system parameters params, private key d π , and message m;

[0008] Step 3.2, calculate e=H3(m);

[0009] Step 3.3, randomly select a random number Calculate the coordinates of the k times point of the point G on the elliptic curve [k]G=(x r , y r ), r=(e+x r )mod q; randomly select a random number Calculate s=(1+dπ • g2) -1 (k-r-d π • g2) mod q;

[0010] Compute

[0011] Step 3.4, randomly select a random number Q = [g2]P π = (x π′ , y π′ );

[0012] Randomly select a random number a = U c mod n, b = H2(e || a || U || x π′ || V);

[0013] Step 3.5, compute r1 = c + b-g1 -1 • x π ;

[0014] Step 3.6, output signature σ = (r, s, r1, a, U, Q);

[0015] Step 4.1, verifier inputs system parameters params, message m, signature σ, public key list

[0016] Step 4.2, check whether it is true, if not, then the verification fails, if true, then compute e = H3(m), Z = (r + s) mod q, [s]G + [Z]Q = (x r , y r ), and go to the next step;

[0017] Step 4.3, compute R = (e + x r ) mod q, judge whether R is equal to r, if true, go to the next step to continue verification;

[0018] Step 4.4, compute b = H2(e || a || U || x π′ || V);

[0019] Step 4.5, verify whether it is true, if equal, then the verification passes, otherwise, the verification fails;

[0020] The parameters in the above method are defined as follows:

[0021] q: a large prime number;

[0022] : The set of integers consisting of 1, 2, ..., q-1;

[0023] : Quadratic residual cyclic group modulo n;

[0024] mod q: Modulo q operation;

[0025] mod n: Modulo n operation;

[0026] [k]P: A point on the elliptic curve that is k times the value of point P, where k is a positive integer;

[0027] An additive cyclic group of order q;

[0028] G: Additive Cyclic Group The base point;

[0029] λ: Safety parameter;

[0030] x||y: the concatenation of x and y;

[0031] m: Message to be signed;

[0032] e: The identifier hash value of message m;

[0033] PK i : User i's public key;

[0034] d i The user's private key;

[0035] V: The value of the accumulator;

[0036] μ: Initial value of the accumulator;

[0037] W: Signatory evidence;

[0038] H1: Cryptographic hash function,

[0039] H2: Cryptographic hash function

[0040] H3: Cryptographic Hash Function

[0041] : A list of public keys, i.e., {PK1, PK2, ..., PK1} t};

[0042] k, g1, g2, c: group Random elements within;

[0043] σ: The signature value of the message.

[0044] params: Common parameters

[0045] (x r ,y r ) is the commitment value of k, r is the generated challenge value, s is the response of r, U, Q are the commitment values of member evidence W, signer public key PK π , b is the generated challenge value, a, r1 is the random number used when calculating the commitment.

[0046] Further, the step 1 specifically comprises the following steps:

[0047] Step 1.1, generating two large security prime numbers p ′ ,q ′ , calculating n = p ′ · q ′ , and destroying p ′ , q ′ .

[0048] Step 1.2, generating μ, as the initial value of the accumulator.

[0049] Step 1.3, selecting an additive cyclic group of order q generator G, a cryptographic hash function

[0050]

[0051] Step 1.4, output the public parameters:

[0052] Further, in the step 2, the method for generating the private key and the public key of the i-th user comprises the following steps:

[0053] The i-th user randomly selects a private key d i ∈ [1, q-1] as a secret private key, calculates the public key PK i = [d i ] G = (x i , y i ) and makes it public, and x i must be a prime number, if not, reselect d i and calculate the public key.

[0054] The beneficial effects of the present application are:

[0055] 1. Through the innovative fusion design of RSA accumulator and SM2 signature, the verification process only needs two elliptic curve point multiplications and two modulus power operations, which significantly improves the efficiency compared with the traditional ring signature scheme.

[0056] 2. The signature size is constant in the (r,s,r1,a,U,Q) six-tuple structure, which is significantly better than the existing schemes where the ring signature size increases linearly with the number of ring members, and remains efficient in large-scale groups.

[0057] 3. Compatible with the SM2 national cryptographic standard, it can be quickly integrated into existing cryptographic systems that use SM2 (such as in the financial and government sectors) without additional modifications.

[0058] 4. The signing is completed independently, without the need for a key generation center (KGC) or a trusted third party, thus avoiding single points of failure and trust risks.

[0059] 5. By constructing a zero-knowledge proof parameter system, the security of membership proofs is ensured while avoiding bilinear pairing operations, effectively overcoming the technical obstacle that the SM2 standard curve does not support bilinear pairing.

[0060] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. Attached Figure Description

[0061] Figure 1 This is a schematic diagram of the process of the present invention. Detailed Implementation

[0062] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0063] The parameters designed in this invention are defined as follows:

[0064] q: a large prime number.

[0065] : The set of integers consisting of 1, 2, ..., q-1.

[0066] : Quadratic residual cyclic group modulo n.

[0067] mod q: Modulo q operation.

[0068] mod n: Modulo n operation.

[0069] [k]P: A point on the elliptic curve that is k times the value of point P, where k is a positive integer.

[0070] : An additive cyclic group of order q.

[0071] G: Additive Cyclic Group The basis.

[0072] λ: Safety parameter.

[0073] x||y: The concatenation of x and y.

[0074] m: Message to be signed.

[0075] e: The identifier hash value of message m.

[0076] PK i : The public key of user i.

[0077] d i The user's private key.

[0078] V: The value of the accumulator.

[0079] μ: Initial value of the accumulator;

[0080] W: Signatory evidence.

[0081] H1: Cryptographic hash function, H2: Cryptographic hash function H3: Cryptographic Hash Function

[0082] : A list of public keys, i.e., {PK1, PK2, ..., PK1} t}

[0083] k, g1, g2, c: group Random elements within.

[0084] ? = : Determine if both sides of an equation are equal.

[0085] σ: The signature value of the message.

[0086] params: Common parameters like Figure 1 As shown, this invention proposes an SM2 ring signature method and system with a constant signature size. The specific scheme flow is as follows: This scheme includes four stages: system initialization, key generation algorithm, signature algorithm, and verification algorithm;

[0087] 1) System initialization: Given security parameter 1 λ Perform the following steps:

[0088] ① Generate two large safe prime numbers p ′ ,q ′ Calculate n = p ′ ·q ′ and destroy p ′ ,q ′ .

[0089] ② Generate μ, Used as the initial value for the accumulator.

[0090] ③ Select an additive cyclic group of order q Generator G, cryptographic hash function

[0091]

[0092] (4) Output public parameters:

[0093] 2) Key generation algorithm:

[0094] (1) User i randomly selects d i ∈[1,q-1] as a secret private key, calculates PK i =[d i ]G=(x i ,y i ), and publishes x i , which must be a prime number. If it does not meet the requirement, reselect d i .

[0095] 3) Signature algorithm: The signing user selects t-1 user public keys, adds its own public key to form a ring public key The signer is the πth user (1≤π≤t) among them, inputs system parameters params, private key d π , and message m.

[0096] (1) Calculate e=H3(m);

[0097] (2) Randomly select a random number Calculate [k]G=(x r ,y r ), r=(e+x r )mod q;

[0098] (3) Randomly select a random number Calculate s=(1+d π ·g2) -1 (k-r·d π ·g2)mod q;

[0099] (4) Calculate

[0100] (5) Calculate

[0101] (6) Randomly select a random number Q=[g2]PK π =(x π′ ,y π′ );

[0102] (7) Randomly select a random number a=U c mod n, b=H2(e||a||U||xπ′ ||V);

[0103] ⑧ Calculate r1 = c + b·g1 -1 ·x π ;

[0104] ⑨ Output signature σ=(r,s,r1,a,U,Q);

[0105] Where (x) r ,y r ) is the commitment value to k, r is the generated challenge value, s is the response to r, and U and Q are the member evidence W and the signer's public key PK, respectively. π The commitment value is b, the generated challenge value is a, and r1 is a random number used to calculate the commitment.

[0106] 4) Verification Algorithm: The verifier inputs system parameters params, message m, signature σ, and public key list.

[0107] ① Inspection If the condition is not met, the test fails; otherwise, calculate e = H3(m) and Z = (r + ...

[0108] s)mod q,[s]G+[Z]Q=(x r ,y r );

[0109] ② Calculate R = (e + x) r )mod q, check if R is equal to r, if true, continue the verification;

[0110] ③Calculation b=H2(e||a||U||x π′ ||V).

[0111] ④ Verification If they are equal, the verification passes; otherwise, the verification fails.

[0112] The above description provides examples of the preferred embodiments of the present invention. Parts not detailed herein are common knowledge to those skilled in the art. The scope of protection of the present invention is determined by the claims. Any equivalent modifications based on the technical teachings of the present invention are also within the scope of protection of the present invention.

Claims

1. A constant-level signature size SM2 ring signature method, characterized in that, Includes the following steps: Step 1: System initialization, specify security parameter 1. λ Output common parameters: Step 2: Generate private and public keys for a total of t users, where the private key of the i-th user is d. i The public key is PK. i ; Step 3.1: One of the t users who signs selects t-1 user public keys and adds them to their own public key to form a ring public key. Let the signer's user sequence number be π, 1≤π≤t, and the input system parameters be params and the private key d. π , and message m; Step 3.2: Calculate e = H3(m); Step 3.3: Randomly select a random number Calculate the coordinates of a point [k]G = (x) on the elliptic curve, which is a multiple of point G. r ,y r ), r = (e + x r mod q; randomly selects a random number. Calculate s = (1 + d) π ·g2) -1 (kr·d π ·g2)mod q; calculate Step 3.4: Randomly select a random number Q = [g2]P π =(x π′ ,y π′ Randomly select random numbers. a = U c mod n, b = H2(e||a||U||x) π′ ||V); Step 3.5: Calculate r1 = c + b·g1 -1 ·x π ; Step 3.6: Output signature σ = (r, s, r1, a, U, Q); Step 4.1: The verifier inputs the system parameters params, message m, signature σ, and public key list. Step 4.2, Inspection If the condition is not met, the verification fails; if it is met, calculate e = H3(m), Z = (r + s) mod q, and [s]G + [Z]Q = (x r ,y r ), and proceed to the next step; Step 4.3: Calculate R = (e + x) r )mod q, check if R is equal to r, if true, proceed to the next step to continue verification; Step 4.4, Calculation b=H2(e||a||U||x π′ ||V); Step 4.5, Verification Check if the conditions are true or false. If they are equal, the verification is considered successful; otherwise, the verification fails. The parameters in the above method are defined as follows: q: a large prime number; The set of integers consisting of 1, 2, ..., q-1; The quadratic residual cyclic group modulo n; mod q: Modulo q operation; mod n: Modulo n operation; [k]P: A point on the elliptic curve that is k times the value of point P, where k is a positive integer; An additive cyclic group of order q; G: Additive Cyclic Group The basis; λ: Safety parameter; x||y: the concatenation of x and y; m: Message to be signed; e: The identifier hash value of message m; PK i : User i's public key; d i The user's private key; V: The value of the accumulator; μ: Initial value of the accumulator; W: Signatory evidence; H1: Cryptographic hash function, H2: Cryptographic hash function H3: Cryptographic Hash Function A list of public keys, i.e., {PK1, PK2, ..., PK1} t }; k, g1, g2, c: group Random elements within; σ: The signature value of the message. params: Common parameters (x r ,y r ) is the commitment value to k, r is the generated challenge value, s is the response to r, and U and Q are the member evidence W and the signer's public key PK, respectively. π The commitment value is b, the generated challenge value is a, and r1 is a random number used to calculate the commitment.

2. The SM2 ring signature method with constant-level signature size according to claim 1, characterized in that, Step 1 specifically includes the following steps: Step 1.1: Generate two large, safe prime numbers p′ and q′, calculate n = p′·q′, and destroy p′ and q′. Step 1.2: Generate μ. As the initial value of the accumulator Step 1.3: Select an additive cyclic group of order q. The generator is G, and the cryptographic hash function is G. Step 1.4, Output common parameters:

3. The SM2 ring signature method with constant-level signature size according to claim 1, characterized in that, In step 2, the method for generating the private and public keys of the i-th user includes the following steps: The i-th user randomly selects a private key d. i The key ∈ [1, q-1] is stored as the private key, and the public key PK is calculated. i =[d i G = (x i ,y i And made public, x i It must be a prime number; if it does not meet this requirement, choose a different d. i And calculate the public key.

Images