Group signature method and device for signature hybrid encryption based on modular lattice
By using a lattice-based signature hybrid encryption method, specific signature keys and identity encryption components for group members are generated, solving the security and efficiency problems of group signature schemes under quantum computing and achieving efficient signature verification and identity tracking.
Patent Information
- Application Number
- CN202511137799.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-14
- Publication Date
- 2025-10-21
AI Technical Summary
Existing group signature schemes lack security in the face of quantum computing attacks, and have problems such as large signature size, high computational overhead, and inflexible structure, making it difficult to meet the needs of resource-constrained devices or dynamic environments.
A lattice-based signature hybrid encryption method is adopted. By generating a group public key, a group master key, and a group tracking key, a trapdoor generation algorithm and a pseudo-random expansion algorithm are used to generate a signature key specific to the group members. The signature contains a first component for verification and a second component for encrypting the member's identity, thereby realizing the validity verification of the signature and identity tracking.
It effectively resists quantum computing attacks, reduces signature size and computational overhead, and improves the security and practicality of group signature schemes in quantum computing environments.
Smart Images
Figure CN120825293A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of information security technology, and more particularly to a group signature method and device based on modular signature hybrid encryption. Background Art
[0002] At present, with the rapid development and gradual application of quantum computer technology, traditional public key cryptographic algorithms based on mathematical problems such as large integer factorization, discrete logarithms, and elliptic curves are facing unprecedented threats of quantum computing attacks. The field of information security is facing severe challenges, which has prompted the cryptography community to actively research and develop post-quantum cryptographic algorithms that can resist quantum computer attacks.
[0003] Group signature is a special digital signature technology that allows any member of a group to anonymously sign a message on behalf of the entire group. Verifiers can publicly verify the validity of the signature, but cannot determine the specific identity of the signatory of the signature. This is "anonymity." However, in the event of disputes or abuse, designated group administrators can reveal the true source of the signature through a "track" or "open" operation. This is "traceability." These features make group signatures have broad application prospects in scenarios such as electronic voting, Internet of Vehicles, and anonymous authentication.
[0004] However, the group signature schemes that are currently widely studied and deployed are mostly based on traditional public key systems, such as number theory problems based on RSA, DLP or elliptic curves. These constructions will no longer be secure in the face of quantum computing attacks; at the same time, although some post-quantum candidate schemes have attempted to combine group signatures with quantum-resistant technologies such as hashing and encoding, they often have problems such as large signature size, high computational overhead, and inflexible structure, which make it difficult to meet the actual needs of resource-constrained devices or dynamic environments; for example, existing lattice-based group signature schemes require a lot of pre-computation and complex zero-knowledge proof systems, resulting in low verification efficiency and unsuitable for high-frequency interaction scenarios.
[0005] Against the backdrop of the increasing threat of quantum computing and the growing demand for large-scale distributed applications such as the Internet of Things, existing group signature schemes have become unable to meet the demand for higher computing depth, lower dependence and greater flexibility.
[0006] Therefore, how to provide a lattice-based group signature method that can not only ensure security, anonymity and traceability against quantum attacks, but also get rid of the dependence on complex zero-knowledge proofs in order to significantly reduce the signature size and computational overhead is an urgent problem that technicians in this field need to solve. Summary of the Invention
[0007] In view of this, the present invention provides a group signature method and device based on modular signature hybrid encryption to solve some of the technical problems mentioned in the background technology.
[0008] In order to achieve the above object, the present invention adopts the following technical solutions:
[0009] A group signature method based on modular signature hybrid encryption includes the following steps:
[0010] S1. Establish a system based on pre-set public parameters and generate a group public key, a group master key, and a group tracking key. The group public key contains a public key random seed, a public matrix, and an encrypted public key. The group master key contains a private key random seed and a trapdoor corresponding to the public matrix. The group tracking key contains an encrypted private key.
[0011] S2. For group members associated with the identity, use the group owner's key and the trapdoor-based preimage sampling algorithm to generate a group member-specific signing key;
[0012] S3. Generate a group signature for a message using a group member-specific signing key and identity, wherein the group signature comprises a first component for verifying the validity of the signature and a second component comprising an encrypted representation of the group member's identity;
[0013] S4. Verify the validity of the group signature by processing the first component of the group signature using the group public key;
[0014] S5. Decrypt the second component of the valid group signature using the group tracking key to obtain the identity of the signing group member.
[0015] Preferably, the common parameters include an integer modulo a prime number, a polynomial degree, a cyclotomic polynomial, a discrete Gaussian distribution and its standard deviation, a first Hash function, and a second Hash function.
[0016] Preferably, the specific contents of step S1 include:
[0017] S11. Generate a common matrix through the trapdoor generation algorithm TrapGen(k, l, q) and its corresponding modular trapdoor k and l represent the polynomial dimensions of the modular lattice, and q is an integer modulo a prime number;
[0018] S12. Generate a public-private key pair (pk_E, sk_E) for a public-key encryption scheme that is secure against chosen-plaintext attacks.
[0019] S13. Generate a 64-byte public key random seed ρ;
[0020] S14. Define the group public key to include the public key random seed ρ, the public matrix A, and the encrypted public key pk_E. Define the group master key to include the module trapdoor T corresponding to the public matrix A and a randomly generated private key seed ρ′. Define the group tracking key to include the encrypted private key sk_E.
[0021] S15. Initialize the registration list reg to be empty.
[0022] Preferably, the specific contents of step S2 include:
[0023] S21. The private key random seed ρ′ is expanded into a polynomial vector using the private key seed deterministic pseudo-random expansion algorithm ExpandS(ρ′) As part of the group member's signing key, where η is the size of the signature key's normal form, k represents the polynomial dimension of the modular lattice, and x comes from a distribution with a maximum normal form smaller than η;
[0024] S22. The public key random seed ρ is expanded into a polynomial vector using the ExpandPK(ρ) algorithm and the polynomial matrix Calculate the public identity vector g i =Bx i , and through the trapdoor sampling algorithm Sample(A, T A ,ug i , n) output the other part of the signature key s i ;
[0025] S23. The identity vector g i Add to the registration list and output the signature key (x i , s i ).
[0026] Preferably, the specific contents of step S3 include:
[0027] S31. The public key random seed ρ is expanded into a polynomial vector using the ExpandPK(ρ) algorithm and the polynomial matrix
[0028] S32. Use the encryption public key pk_E to encrypt the identity vector of the group member and generate a ciphertext ct1←K-PKE.Encrypt(pk_E, g i ,r), constituting the second component of the group signature;
[0029] S33. Enter a rejection sampling loop, calculate the commitment value (w1, w2) = (By1, By1 + Ay2) in the loop, and calculate the challenge value based on the message and the commitment value and Calculate the response value (z1, z2) = (y1 + cx i ,y2+cs i ), determine whether the response value meets the predefined norm limit, if so, accept the response value, otherwise, repeat the rejection sampling cycle process;
[0030] S34. The received response value (z1, z2) and the challenge value The first component of the group signature is output as
[0031] Preferably, in step S4, the specific method for verifying the validity of the group signature is:
[0032] S41. Reconstruct the commitment value w′2=Bz1+Az2-uc using the first component of the group signature and the group public key;
[0033] S42. Verify that the hash of the reconstructed commitment value matches the hash of the original commitment value And verify whether the norm of the response values in the first component is within the predefined norm bounds ||z1|| ∞ ≤B and ||z2|| ∞ ≤B, if all are satisfied, the signature verification is successful.
[0034] Preferably, in step S5, the specific method of revealing the identity of the signature group members is:
[0035] S51. For the second component of the group signature, the identity vector g is recovered using the decryption algorithm of the K-PKE encryption scheme and the group tracking key sk_E i and
[0036] S52. If g i ∈reg and satisfy Then the algorithm returns identity i.
[0037] A group signature system based on modular lattice signature hybrid encryption, based on the aforementioned modular lattice signature hybrid encryption group signature method, comprising: a system establishment module, a signature key generation module, a signature generation module, a signature verification module, and an identity tracking module;
[0038] A system establishment module is used to establish the system based on preset public parameters and generate a group public key, a group master key, and a group tracking key. The group public key contains a public key random seed, a public matrix, and an encrypted public key. The group master key contains a private key random seed and a module trapdoor corresponding to the public matrix. The group tracking key contains an encrypted private key.
[0039] The signature key generation module is used to generate a group member-specific signature key for the group member associated with the identity using the group master key and the trapdoor-based preimage sampling algorithm;
[0040] a signature generation module, configured to generate a group signature for a message using a signing key and identity specific to the group member, wherein the group signature comprises a first component for verifying the validity of the signature and a second component comprising an encrypted representation of the identity of the group member;
[0041] a signature verification module for verifying the validity of the group signature by using the group public key through the first component of processing the group signature;
[0042] The identity tracking module is configured to decrypt the second component of the valid group signature using the group tracking key to obtain the identity of the signing group member.
[0043] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the group signature method of modular-based signature hybrid encryption.
[0044] A processing terminal includes a memory and a processor. The memory stores a computer program that can be run on the processor. When the processor executes the computer program, the group signature method based on modular signature hybrid encryption is implemented.
[0045] It can be seen from the above technical solution that compared with the prior art, the present invention discloses a group signature method and device based on modular lattice signature hybrid encryption. Through a novel "signature-hybrid-encryption" architecture, it can effectively resist quantum computing attacks without the need for complex zero-knowledge proof. While maintaining the anonymity of the group signature, it provides efficient computing capabilities and greatly reduces the size of the signature, thereby improving the security and practicality of the group signature scheme in a quantum computing environment. BRIEF DESCRIPTION OF THE DRAWINGS
[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0047] Figure 1 A schematic diagram of a group signature method based on modular hybrid encryption provided by the present invention;
[0048] Figure 2 This is a schematic diagram of a processing terminal provided by the present invention. DETAILED DESCRIPTION
[0049] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.
[0050] The embodiment of the present invention discloses a group signature method based on modular hybrid signature encryption, comprising the following steps:
[0051] S1. Establish a system based on pre-set public parameters and generate a group public key, a group master key, and a group tracking key. The group public key contains a public key random seed, a public matrix, and an encrypted public key. The group master key contains a private key random seed and a trapdoor corresponding to the public matrix. The group tracking key contains an encrypted private key.
[0052] S2. For group members associated with the identity, use the group owner's key and the trapdoor-based preimage sampling algorithm to generate a group member-specific signing key;
[0053] S3. Generate a group signature for a message using a group member-specific signing key and identity, wherein the group signature comprises a first component for verifying the validity of the signature and a second component comprising an encrypted representation of the group member's identity;
[0054] S4. Verify the validity of the group signature by processing the first component of the group signature using the group public key;
[0055] S5. Decrypt the second component of the valid group signature using the group tracking key to obtain the identity of the signing group member.
[0056] In order to further implement the above technical solution, the common parameters include integer modulo prime number q, polynomial degree n, cyclotomic polynomial discrete Gaussian distribution and its standard deviation σ, the first hash function H and the second hash function hash.
[0057] In this embodiment, q∈N * , n∈N * , N * represents the set of positive integers; φ=x n +1; discrete Gaussian distribution Z n Represents n-dimensional integer space, standard deviation First hash function H: {0, 1} * →{0, 1} n , which means mapping a binary string of arbitrary length into a binary character of length n; the second hash function hash: It represents mapping a binary string of arbitrary length into an n-dimensional vector space modulo q.
[0058] In order to further implement the above technical solution, the specific contents of step S1 include:
[0059] S11. Generate a common matrix through the trapdoor generation algorithm TrapGen(k,l,q) and its corresponding modular trapdoor k and l represent the polynomial dimensions of the modular lattice, q is an integer modulo a prime number, 1≤l≤L, L∈N * ;
[0060] S12. Generate a public-private key pair (pk_E, sk_E) for a public-key encryption scheme that is secure against chosen-plaintext attacks.
[0061] S13. Generate a 64-byte public key random seed ρ;
[0062] S14. Define the group public key to include the public key random seed ρ, the public matrix A, and the encrypted public key pk_E. Define the group master key to include the module trapdoor T corresponding to the public matrix A and a randomly generated private key seed ρ′. Define the group tracking key to include the encrypted private key sk_E.
[0063] S15. Initialize the registration list reg to be empty.
[0064] In order to further implement the above technical solution, the specific contents of step S2 include:
[0065] S21. The private key random seed ρ′ is expanded to a polynomial vector with a small norm through the private key seed deterministic pseudo-random expansion algorithm ExpandS(ρ′) As part of the member signing key, where η is the size of the signature key's normal form, k represents the polynomial dimension of the modular lattice, and x comes from a distribution with a maximum normal form less than η;
[0066] S22. The public key random seed ρ is expanded into a polynomial vector using the public key seed deterministic pseudo-random expansion algorithm ExpandPK(ρ) and the polynomial matrix Calculate the public identity vector g i =Bx i , and through the trapdoor sampling algorithm Sample(A, T A ,ug i , n) output the other part of the signature key s i ;
[0067] S23. The identity vector g i Add to the registration list and output the signature key (xi , s i ).
[0068] In order to further implement the above technical solution, the specific contents of step S3 include:
[0069] S31. The public key random seed ρ is expanded into a polynomial vector through the public key seed deterministic pseudo-random expansion algorithm ExpandPK(ρ) and the polynomial matrix
[0070] S32. Use the encryption public key pk_E to encrypt the identity vector of the group member and generate a ciphertext ct1←K-PKE.Encrypt(pk_E, g i , r), constituting the second component of the group signature, r is a randomly generated pseudo-random seed in the K-PKE encryption algorithm;
[0071] S33. Enter a rejection sampling loop, in which the commitment value (w1, w2) = (By1, By1 + Ay2) is calculated, where B is the polynomial matrix expanded by ExpandPK(ρ) from the public key random seed, y1 and y2 are the random mask polynomial vectors generated during the signing process, and the challenge value is calculated based on the message and the commitment value. and μ is the message value to be signed, ct2 is the ciphertext obtained by the K-PKE encryption scheme for the challenge value c1, and the response value (z1, z2) is calculated based on the challenge value and the group member's signature key. i ,y2+cs i ), determine whether the response value meets the predefined norm limit, if so, accept the response value, otherwise, repeat the rejection sampling cycle process;
[0072] S34. The received response value (z1, z2) and the challenge value The first component of the group signature is output as
[0073] In order to further implement the above technical solution, the specific method of verifying the validity of the group signature in step S4 is as follows:
[0074] S41. Reconstruct the commitment value w′2=Bz1+Az2-uc using the first component of the group signature and the group public key;
[0075] S42. Verify that the hash of the reconstructed commitment value matches the hash of the original commitment value And verify whether the norm of the response values in the first component is within the predefined norm bounds ||z1|| ∞ ≤B and ||z2|| ∞≤B, where B is the upper limit of signature rejection sampling. If all of them are satisfied, the signature verification is successful.
[0076] To further implement the above technical solution, the specific method of revealing the identity of the signature group members in step S5 is:
[0077] S51. For the second component of the group signature, the identity vector g is recovered using the decryption algorithm of the K-PKE encryption scheme and the group tracking key sk_E i and
[0078] S52. If g i ∈reg and satisfies Then the algorithm returns identity i.
[0079] A modular lattice-based signature hybrid encryption group signature system, based on a modular lattice-based signature hybrid encryption group signature method, including: a system establishment module, a signature key generation module, a signature generation module, a signature verification module and an identity tracking module;
[0080] A system establishment module is used to establish the system based on preset public parameters and generate a group public key, a group master key, and a group tracking key. The group public key contains a public key random seed, a public matrix, and an encrypted public key. The group master key contains a private key random seed and a module trapdoor corresponding to the public matrix. The group tracking key contains an encrypted private key.
[0081] The signature key generation module is used to generate a group member-specific signature key for the group member associated with the identity using the group master key and the trapdoor-based preimage sampling algorithm;
[0082] a signature generation module, configured to generate a group signature for a message using a signing key and identity specific to the group member, wherein the group signature comprises a first component for verifying the validity of the signature and a second component comprising an encrypted representation of the identity of the group member;
[0083] a signature verification module for verifying the validity of the group signature by using the group public key through the first component of processing the group signature;
[0084] The identity tracking module is configured to decrypt the second component of the valid group signature using the group tracking key to obtain the identity of the signing group member.
[0085] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements a group signature method based on modular lattice-based signature hybrid encryption.
[0086] A processing terminal includes a memory 203 and a processor 201. The memory 203 stores a computer program that can be run on the processor. When the processor 201 executes the computer program, it implements a group signature method based on modular signature hybrid encryption. The terminal also includes a communication interface 202 and a communication bus 204. The processor 201, the communication interface 202, and the memory 203 communicate with each other via the communication bus 204. The processor 201 can call the logic instructions in the memory 203 to execute a group signature method based on modular signature hybrid encryption. The logic instructions in the memory 203 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. The technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method of the present invention. The storage medium includes: a USB flash drive, a mobile hard drive, a read-only memory (ROM, Read-Only Memory) Memory), random access memory (RAM), magnetic disk or optical disk, etc., which can store program code.
[0087] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.
[0088] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A group signature method based on modular signature hybrid encryption, characterized in that: The following steps are involved: S1. Establish a system based on pre-set public parameters and generate a group public key, a group master key, and a group tracking key. The group public key contains a public key random seed, a public matrix, and an encrypted public key. The group master key contains a private key random seed and a trapdoor corresponding to the public matrix. The group tracking key contains an encrypted private key. S2. For group members associated with the identity, use the group owner's key and the trapdoor-based preimage sampling algorithm to generate a group member-specific signing key; S3. Generate a group signature for a message using a group member-specific signing key and identity, wherein the group signature comprises a first component for verifying the validity of the signature and a second component comprising an encrypted representation of the group member's identity; S4. Verify the validity of the group signature by processing the first component of the group signature using the group public key; S5. Decrypt the second component of the valid group signature using the group tracking key to obtain the identity of the signing group member.
2. A group signature method based on modular hybrid encryption according to claim 1, characterized in that: The public parameters include an integer modulo a prime number, a polynomial degree, a cyclotomic polynomial, a discrete Gaussian distribution and its standard deviation, a first hash function, and a second hash function.
3. A group signature method based on modular hybrid encryption according to claim 1, characterized in that: The specific contents of step S1 include: S11. Generate a common matrix through the trapdoor generation algorithm TrapGen(k, l, q) and its corresponding modular trapdoor k and l represent the polynomial dimensions of the modular lattice, and q is an integer modulo a prime number; S12. Generate a public-private key pair (pk_E, sk_E) for a public-key encryption scheme that is secure against chosen-plaintext attacks. S13. Generate a 64-byte public key random seed ρ; S14. Define the group public key to include the public key random seed ρ, the public matrix A, and the encrypted public key pk_E. Define the group master key to include the module trapdoor T corresponding to the public matrix A and a randomly generated private key seed ρ′. Define the group tracking key to include the encrypted private key sk_E. S15. Initialize the registration list reg to be empty.
4. A group signature method based on modular hybrid encryption according to claim 1, characterized in that: The specific contents of step S2 include: S21. The private key random seed ρ′ is expanded into a polynomial vector using the private key seed deterministic pseudo-random expansion algorithm ExpandS(ρ′) As part of the group member's signing key, where η is the size of the signature key's normal form, k represents the polynomial dimension of the modular lattice, and x comes from a distribution with a maximum normal form smaller than η; S22. The public key random seed ρ is expanded into a polynomial vector using the public key seed deterministic pseudo-random expansion algorithm ExpandPK(ρ) and the polynomial matrix Calculate the public identity vector g i =Bx i , and through the trapdoor sampling algorithm Sample(A, T A ,ug i , n) output the other part of the signature key s i ; S23. The identity vector g i Add to the registration list and output the signature key (x i , s i ).
5. The group signature method based on modular hybrid encryption according to claim 1, characterized in that: The specific contents of step S3 include: S31. The public key random seed ρ is expanded into a polynomial vector through the public key seed deterministic pseudo-random expansion algorithm ExpandPK(ρ) and the polynomial matrix S32. Use the encryption public key pk_E to encrypt the identity vector of the group member and generate a ciphertext ct1←K-PKE.Encrypt(pk_E, g i ,r), constituting the second component of the group signature; S33. Enter a rejection sampling loop, calculate the commitment value (w1, w2) = (By1, By1 + Ay2) in the loop, and calculate the challenge value based on the message and the commitment value and Calculate the response value (z1, z2) = (y1 + cx i ,y2+cs i ), determine whether the response value meets the predefined norm limit, if so, accept the response value, otherwise, repeat the rejection sampling cycle process; S34. The received response value (z1, z2) and the challenge value The first component of the group signature is output as 6. A group signature method based on modular hybrid encryption according to claim 1, characterized in that: Step S4: The specific method for verifying the validity of the group signature is: S41. Reconstruct the commitment value w′2=Bz1+Az2-uc using the first component of the group signature and the group public key; S42. Verify that the hash of the reconstructed commitment value matches the hash of the original commitment value And verify whether the norm of the response values in the first component is within the predefined norm bounds ||z1|| ∞ ≤B and ||z2|| ∞ ≤B, if all are satisfied, the signature verification is successful.
7. A group signature method based on modular signature hybrid encryption according to claim 1, characterized in that: Step S5: The specific method of revealing the identity of the signature group members is: S51. For the second component of the group signature, the identity vector g is recovered using the decryption algorithm of the K-PKE encryption scheme and the group tracking key sk_E i and S52. If g i ∈reg and satisfy Then the algorithm returns identity i.
8. A group signature system based on modular signature hybrid encryption, characterized in that: A group signature method based on modular hybrid encryption according to any one of claims 1 to 7, comprising: a system establishment module, a signature key generation module, a signature generation module, a signature verification module, and an identity tracking module; A system establishment module is used to establish the system based on preset public parameters and generate a group public key, a group master key, and a group tracking key. The group public key contains a public key random seed, a public matrix, and an encrypted public key. The group master key contains a private key random seed and a module trapdoor corresponding to the public matrix. The group tracking key contains an encrypted private key. The signature key generation module is used to generate a group member-specific signature key for the group member associated with the identity using the group master key and the trapdoor-based preimage sampling algorithm; a signature generation module, configured to generate a group signature for a message using a signing key and identity specific to the group member, wherein the group signature comprises a first component for verifying the validity of the signature and a second component comprising an encrypted representation of the identity of the group member; a signature verification module for verifying the validity of the group signature by using the group public key through the first component of processing the group signature; The identity tracking module is configured to decrypt the second component of the valid group signature using the group tracking key to obtain the identity of the signing group member.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the group signature method of modular lattice-based signature hybrid encryption is implemented as described in any one of claims 1 to 7.
10. A processing terminal comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor executes the computer program, the group signature method based on modular signature hybrid encryption as described in any one of claims 1 to 7 is implemented.