Safe and efficient identity hiding proxy signature method
By generating temporary public and private keys to hide the identity of the proxy signature method, the problem of the proxy identity being impossible to hide is solved, and efficient and flexible signature operation and legitimacy protection are achieved, adapting to the rapidly changing network environment.
Patent Information
- Application Number
- CN202410519156.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-04-28
- Publication Date
- 2025-10-28
AI Technical Summary
Existing proxy signature schemes cannot effectively hide the identity of the proxy, lack flexibility and signature verification efficiency, and are difficult to adapt to the rapidly changing network environment and ever-increasing security requirements.
A secure and efficient identity-hiding proxy signature method is adopted. The temporary public key and temporary private key are generated by the proxy j, and the proxy signature is generated by combining the public key and identity encryption key of the principal i. This ensures the legitimacy and privacy of the signature, and the principal can identify the proxy identity when needed.
It achieves more effective proxy identity hiding, improves the level of privacy protection, ensures the legitimacy of signatures, has flexible and efficient signature operations, and reduces dependence on confidential channels.
Smart Images
Figure CN120856337A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of cryptography and network security technology, and in particular to a secure and efficient method for identity-hiding proxy signatures. Background Technology
[0002] With the rapid development of information technology, digital signature technology has become a key tool for ensuring the security of information transmission. Traditional digital signature methods, such as RSA and elliptic curve digital signature algorithms, provide a solid foundation for information integrity, non-repudiation, and authentication. However, these schemes often fail to fully consider scenarios involving proxy signing, i.e., when the principal cannot directly sign documents or perform operations, a trusted proxy is needed to sign.
[0003] In many practical applications, such as online transactions, telemedicine consultations, and authorized signing of legal documents, principals may need to authorize agents to sign on their behalf. While existing proxy signature schemes allow this, they typically fail to effectively conceal the agent's identity, posing a significant drawback in applications requiring agent privacy protection. Furthermore, these schemes lack sufficient flexibility and verification efficiency, making them ill-suited to rapidly changing network environments and ever-increasing security demands. Existing proxy signature algorithms lack a method that can effectively conceal the identity of the proxy signer while ensuring signature legitimacy and improving verification efficiency. Summary of the Invention
[0004] Based on the above analysis, the present invention aims to provide a secure and efficient identity-hiding proxy signature method to solve the technical problem that existing proxy signature algorithms lack a proxy signature method that can effectively hide the identity of the proxy signer, allow the principal to identify the identity of the signing proxy when necessary, and ensure the legality of the signature and the efficiency of the verification.
[0005] This invention provides a secure and efficient method for identity-hiding proxy signatures, comprising the following steps:
[0006] Agent j generates second information (π,θ,tpk) based on the first information (ρ,ω,v) generated by principal i. j ); where ρ is the digital signature generated by principal i, ω is the signable message space, v is a random number; π and θ are the first and second digital signatures generated by agent j, respectively, and tpk j This is the temporary public key for agent j;
[0007] The principal i generates delegation information (u, τ) based on the second information; where u is generated by the principal i based on the identity encryption key ak. i Calculate Enc(ak) i ,id jv) Receive; τ is the delegate signature message generated by the delegate i; id j The identifier for agent j;
[0008] Agent j receives the delegation information and verifies the validity of the delegation information based on the public key of the delegator i. If valid, agent j calculates and obtains the agent signing private key and uses the agent signing private key to sign the message.
[0009] After the proxy signature is completed, the verifier verifies whether the proxy signature is a valid proxy signature for the message by an authorized proxy; if necessary, the principal can use the identity encryption key ak. i The agent's identity is identified, but others cannot identify the agent's identity.
[0010] Furthermore, the principal i obtains the identity identifier id of the agent j. j Based on its own private key sk i Public key pk i , public key pk of proxy j j Given a signatureable message space ω and a random number v, generate a digital signature ρ, where ρ = Sig(sk i ,0||pk i ||id j ||pk j ||ω||v);
[0011] The digital signature ρ, the signable message space ω, and the random number v constitute the first message (ρ, ω, v) and are sent to the agent j.
[0012] Furthermore, the agent j receives the first message (ρ,ω,v);
[0013] The validity of the delegation is determined based on the public key of the delegator i.
[0014] If Ver(pk) i ,0||pk i ||id j ||pk j If ||ω||v,ρ)=0, then it is invalid, and the entrustment is terminated;
[0015] Otherwise, the agent j generates a temporary public key and a temporary private key, as follows:
[0016]
[0017] Among them, Z n * Let G be an integer from 1 to n-1, G be the base point of the elliptic curve, n be the order of G, and · be the dot product;
[0018] And generate the first and second digital signatures π and θ respectively:
[0019] π = Sig(tsk) j ,0||pk i ||id j ||pk j ||ω||v||tpk j ), θ=Sig(sk j ,0||pk i ||id j ||pk j ||ω||v||tpk j ||π);
[0020] Based on the first and second digital signatures π and θ, and the temporary public key, the agent j generates the second information (π, θ, tpk). j ) is sent to the principal i.
[0021] Furthermore, the principal i receives the second information (π, θ, tpk). j ), to verify;
[0022] If Ver(tpk) j ,0||pk i ||id j ||pk j ||ω||v||tpk j ,π)=0
[0023] Or Ver(pk) j ,0||pk i ||id j ||pk j ||ω||v||tpk j If ||τ,θ)=0, then the entrustment is terminated;
[0024] Otherwise, generate (u,v) = Enc(ak) i ,id j ;v);
[0025] The principal i uses its own public key, the signable message space ω, the public key of the authorized agent j, the temporary public key of the authorized agent j, and the identity-based encryption key ak. i Calculate Enc(ak) i ,id j ;v) Given u and random number v, generate a delegated signature message τ = Sig(sk i ,0||pk i ||tpk j ||ω||u||v);
[0026] The delegation information (u, τ) consisting of u and the delegation signature message τ is sent to the agent j.
[0027] Furthermore, the agent j receives the delegation information (u,τ) and verifies the delegation information based on the public key of the delegator i;
[0028] If Ver(pk) i ,0||pk i ||tpk j If ||ω||u||v,τ)=0, then the entrustment is terminated;
[0029] Otherwise, based on the public key of the principal i, the temporary public key of the agent j, the signable message space, and the identity-based encryption key ak i Calculate Enc(ak) i ,id j ;v) Given u, random number v, delegated signature message τ, and the temporary private key of agent j, calculate the agent signature private key skp of agent j, where skp = (pk i ||tpk j ||ω||u||v||τ,tsk j ).
[0030] Furthermore, before performing the proxy signature, the agent j also determines whether the message is within the signable message space;
[0031] If so, then the proxy j, based on the proxy signature private key skp, uses the proxy signature algorithm to perform proxy signature on the message, obtaining the proxy signature γ: γ = tpk j ||ω||u||v||τ||β;
[0032] Where β=Sig(tsk) j ,1||pk i ||tpk j ||ω||u||v||τ||mess); message is the message.
[0033] Furthermore, the verifier uses a proxy signature algorithm to verify whether the proxy signature γ is a valid proxy signature for the message authorized by the principal i; the proxy signature verification algorithm is PVer(pk i ,mess,γ).
[0034] Furthermore, the verification process includes:
[0035] If γ = ⊥, then return 0; where ⊥ is an error symbol.
[0036] If parsing proxy signature γ = tpk j If ||ω||u||v||τ||β fails, return 0;
[0037] like Then it returns 0;
[0038] If Ver(pk) i ,0||pk i ||tpk j If ||ω||u||v,τ)=0, then return 0.
[0039] If Ver(tpk) j ,1||pk i ||tpk j ||ω||u||v||τ||mess,β)=0, then 0 is returned;
[0040] Otherwise, return 1;
[0041] Where 1 represents a valid proxy signature and 0 represents an invalid proxy signature.
[0042] Furthermore, based on the validity of the proxy signature, the principal i can use the public key pk i and identity encryption key ak i The identity of the proxy that generates the proxy signature γ is identified using a proxy identification algorithm.
[0043] The proxy identification algorithm is PIde(pk) i ,ak i ,γ).
[0044] Further, the proxy identification algorithm PIde(pk) is executed. i ,ak i ,γ) includes:
[0045] If the analysis γ = tpk j If ||ω||u||v||τ||β fails, return ⊥;
[0046] If Ver(pk) i ,0||pk i ||tpk j If ||ω||u||v,τ)=0, then return ⊥;
[0047] Otherwise, return the identity identifier id of the authorized agent j. j id j =Dec(ak) i ,u;v), where Dec(.) is the decryption algorithm.
[0048] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:
[0049] 1. Compared to traditional proxy signature schemes, this method can more effectively hide the proxy's identity, improving the level of proxy privacy protection. By hiding the identity of the intermediate delegator, the proxy's privacy can be protected even in multi-layered proxy signing scenarios, thus enhancing proxy privacy protection;
[0050] 2. Although the agent's identity is hidden, the principal can still identify the agent when needed, ensuring the legitimacy of the signature. This guarantee of identity identifiability is particularly important in certain scenarios, such as when signature auditing or traceability is required. The identity-hidden agent signature method in this invention provides guarantees of identity identifiability and legitimacy. When necessary, the principal can use the identity encryption key ak. i The agent's identity can be identified, but others cannot identify the agent's identity;
[0051] 3. This method possesses sufficient flexibility and adaptability to adapt to rapidly changing network environments and ever-increasing security demands. It provides an efficient identity-hiding proxy signature algorithm that can handle various complex signature scenarios and security challenges, demonstrating flexibility and adaptability.
[0052] 4. Compared to traditional proxy signature algorithms, this method improves signature efficiency. By calling the basic digital signature algorithm only once, and with the main operation being a single dot multiplication, the computational load for signing is smaller, thus enabling more efficient signature operations and improving signature verification efficiency.
[0053] 5. Compared with existing technologies, this method reduces the requirement for a secure channel between the principal and the agent. Although a secure channel is still required, the reliance on a secure channel is reduced by hiding the agent's identity, thus lowering the difficulty and cost of implementation.
[0054] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description
[0055] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.
[0056] Figure 1 This is a flowchart of a secure and efficient identity-hiding proxy signature method according to an embodiment of the present invention;
[0057] Figure 2 This is a schematic diagram of the identity-hiding proxy signature algorithm in an embodiment of the present invention. Detailed Implementation
[0058] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.
[0059] This invention proposes a Hidden Proxy Signature (HPS) method, which is a strong proxy signature with identity concealment functionality, i.e., hiding the identity of the proxy signer, but still retaining identifiability (identified by the delegator if necessary). It satisfies all other attributes of a strong proxy signature except for strong identifiability, and the proxy signature is an aggregation of proxy signatures for authorization certificates and messages. HPS's identity concealment function differs from existing anonymous proxy signatures, which support multi-layered delegation of signing authority, while this invention hides the identities of all intermediate delegators.
[0060] This invention relates to the HPS (Hidden Identity Proxy Signature Algorithm), such as... Figure 1 As shown, it includes:
[0061] (1) A common digital signature algorithm, which is the part executed by the principal i in the proxy agreement;
[0062] (2) A proxy delegation protocol between users, where principal i delegates to agent j;
[0063] (3) A proxy signature algorithm;
[0064] (4) The proxy signature verification algorithm corresponding to the proxy signature algorithm;
[0065] (5) A proxy identification algorithm that identifies the identity identifier of the proxy signer from the proxy signature.
[0066] like Figure 1 As shown in the figure, a specific embodiment of the present invention discloses a secure and efficient identity-hiding proxy signature method, comprising the following steps:
[0067] Step S1: Agent j generates second information (π, θ, tpk) based on the first information (ρ, ω, v) generated by principal i. j ); where ρ is the digital signature generated by principal i, ω is the signable message space, v is a random number; π and θ are the first and second digital signatures generated by agent j, respectively, and tpk j This is the temporary public key for agent j;
[0068] Step S2: The principal i generates entrustment information (u, τ) based on the second information; where u is the entrustment information generated by the principal i based on the identity encryption key ak. i Calculate Enc(ak) i ,id j v) Receive; τ is the delegate signature message generated by the delegate i; id j The identifier for agent j;
[0069] Step S3: Agent j receives the delegation information and verifies whether the delegation information is valid based on the public key of the delegator i. If valid, the agent calculates and obtains the agent signing private key and uses the agent signing private key to perform agent signing on the message.
[0070] Step S4: After the proxy signature, the verifier verifies whether the proxy signature is a valid proxy signature for the message authorized by the principal i; if necessary, the principal i uses the identity encryption key ak. i Identify the identity of the proxy.
[0071] Step S1 includes steps S11-S12.
[0072] Step S11: Client i generates first information (ρ, ω, v).
[0073] This section is executed by the principal i, as follows:
[0074] The principal i obtains the identity identifier id of the agent j. j Based on its own private key sk i Public key pk i , public key pk of proxy j j Given a signatureable message space ω and a random number v, generate a digital signature ρ, where ρ = Sig(sk i ,0||pk i ||id j ||pk j ||ω||v);
[0075] The digital signature ρ, the signable message space ω, and the random number v constitute the first message (ρ, ω, v) and are sent to the agent j.
[0076] Where, the random number v ← {0, 1} λ λ is a safety parameter.
[0077] In the identity-hidden proxy signature algorithm HPS, self-delegation is allowed, i.e., i = j.
[0078] Sig(.) is a signature algorithm, given the message 0||pk. i ||id j ||pkj ||ω||v, and the private key sk i Generate the digital signature ρ generated by the principal i. The signature algorithm is probabilistic.
[0079] Step S12: Agent j generates second information (π,θ,tpk) based on the first information (ρ,ω,v) generated by principal i. j ).
[0080] This section is executed by proxy j, as follows:
[0081] The agent j receives the first message (ρ,ω,v);
[0082] The validity of the delegation is determined based on the public key of the delegator i.
[0083] If Ver(pk) i ,0||pk i ||id j ||pk j If ||ω||v,ρ)=0, then it is invalid, and the entrustment is terminated;
[0084] Otherwise, the agent j generates a temporary public key and a temporary private key, as follows:
[0085]
[0086] Among them, Z n * Let G be an integer from 1 to n-1, G be the base point of the elliptic curve, n be the order of G, and · be the dot product;
[0087] And generate the first and second digital signatures π and θ respectively:
[0088] π = Sig(tsk) j ,0||pk i ||id j ||pk j ||ω||v||tpk j ), θ=Sig(sk j ,0||pk i ||id j ||pk j ||ω||v||tpk j ||π);
[0089] Based on the first and second digital signatures π and θ, and the temporary public key, the agent j generates the second information (π, θ, tpk). j ) is sent to the principal i.
[0090] Step S2: The principal i generates entrustment information (u, τ) based on the second information; where u is the entrustment information generated by the principal i based on the identity encryption key ak. i Calculate Enc(ak) i ,id j v) Receive; τ is the delegate signature message generated by the delegate i.
[0091] This section is executed by the principal i, as follows:
[0092] The principal i receives the second information (π, θ, tpk). j ), to verify;
[0093] If Ver(tpk) j ,0||pk i ||id j ||pk j ||ω||v||tpk j ,π)=0
[0094] Or Ver(pk) j ,0||pk i ||id j ||pk j ||ω||v||tpk j If ||τ,θ)=0, then the entrustment is terminated;
[0095] Otherwise, generate (u,v) = Enc(ak) i ,id j ;v);
[0096] The principal i uses its own public key, the signable message space ω, the public key of the authorized agent j, the temporary public key of the authorized agent j, and the identity-based encryption key ak. i Calculate Enc(ak) i ,id j ;v) Given u and random number v, generate a delegated signature message τ = Sig(sk i ,0||pk i ||tpk j ||ω||u||v);
[0097] The delegation information (u, τ) consisting of u and delegation signature information τ is sent to the agent j.
[0098] Where Ver(.) is an improvement and optimization of the Ver algorithm in DS=(ParGen,KeyGen,Sig,Ver) of the elliptic curve signature algorithm.
[0099] Where Enc(.) is the encryption algorithm, u is the output ciphertext, and Enc is a deterministic algorithm.
[0100] Step S3 includes S31-S32.
[0101] Step S31: Agent j receives the delegation information (u, τ) and verifies whether the delegation information is valid based on the public key of the delegator i; if valid, the agent j calculates and obtains the agent signature private key skp.
[0102] This section is executed by proxy j, as follows:
[0103] The agent j receives the delegation information (u,τ) and verifies the delegation information based on the public key of the delegator i;
[0104] If Ver(pk) i ,0||pk i ||tpk j If ||ω||u||v,τ)=0, then the entrustment is terminated;
[0105] Otherwise, based on the public key of the principal i, the temporary public key of the agent j, the signable message space, and the identity-based encryption key ak i Calculate Enc(ak) i ,id j ;v) Given u, random number v, delegated signature message τ, and the temporary private key of agent j, calculate the signing private key skp of agent j, where skp = (pk i ||tpk j ||ω||u||v||τ,tsk j ).
[0106] Steps S11 and S12, S2, up to step S31 in step S1 constitute the principal-agent agreement between principal i and agent j.
[0107] Agency Agreement (D(pk)) i ,sk i ,id j ,pk j ,ak i ,ω),P(pk j ,sk j ,id j ,pk i )), where pk i pk is the public key of the delegator i. j sk is the public key of proxy j. i sk is the private key of the principal i. j For proxy j's private key, id j ak is the identity identifier for agent j. iω is the encryption key for the identity of principal i, and ω is the descriptor of the signatureable message space entrusted by principal i to agent j.
[0108] Step S32: Use the proxy signing private key skp to perform proxy signing on the message.
[0109] Before performing the proxy signature, the agent j also includes determining whether the message is within the signable message space;
[0110] If so, then the proxy j, based on the proxy signature private key skp, uses the proxy signature algorithm to perform proxy signature on the message, obtaining the proxy signature γ: γ = tpk j ||ω||u||v||τ||β;
[0111] Where β=Sig(tsk) j ,1||pk i ||tpk j ||ω||u||v||τ||mess), where mess is the message.
[0112] like Then it returns ⊥. Where ⊥ is the error symbol.
[0113] This step returns the proxy signature γ.
[0114] Step S4 includes S41-S42.
[0115] Step S41: After the proxy signature is completed, the verifier verifies whether the proxy signature is a valid proxy signature of the authorized proxy (based on the principal i) for the message.
[0116] The verifier uses a proxy signature algorithm to verify whether the proxy signature γ is a valid proxy signature for the message by an authorized proxy; the proxy signature verification algorithm is PVer(pk). i ,mess,γ);
[0117] The verification of signatures includes:
[0118] If γ = ⊥, then return 0; where ⊥ is an error symbol.
[0119] If parsing proxy signature γ = tpk j If ||ω||u||v||τ||β fails, return 0;
[0120] like Then it returns 0;
[0121] If Ver(pk) i ,0||pk i ||tpk j If ||ω||u||v,τ)=0, then return 0.
[0122] If Ver(tpk) j ,1||pk i ||tpk j ||ω||u||v||τ||mess,β)=0, then 0 is returned;
[0123] Otherwise, return 1;
[0124] Where 1 represents a valid proxy signature and 0 represents an invalid proxy signature.
[0125] For the proxy signature verification algorithm PVer, anyone can run PVer as a verification method.
[0126] The input is (pk) i ,mess,pσ);
[0127] The output is 1 or 0.
[0128] PVer checks whether γ_mess corresponds to the public key pk of principal i. i The valid signatures are denoted as follows:
[0129] PVer(pk i ,mess,γ)=1 (valid proxy signature);
[0130] PVer(pk i ,mess,γ)=0 (invalid proxy signature).
[0131] The proxy signature verification algorithm is deterministic.
[0132] The Ver(.) algorithm is deterministic; a result of 0 indicates invalidity, and a result of 1 indicates validity.
[0133] Step S42: If the proxy signature is valid, the principal i can further identify the proxy's identity.
[0134] Based on the validity of the proxy signature, the delegator i uses the public key pk i and identity encryption key ak i The proxy identification algorithm is used to identify the identity of the proxy that generates the proxy signature γ, and it is determined whether the identity identifier of the proxy matches the identity identifier id of the authorized proxy j. j Consistent;
[0135] The proxy identification algorithm is PIde(pk) i ,ak i ,γ).
[0136] The proxy identification algorithm PIde is run by the principal i;
[0137] Input: Principal i's public key, Principal i's identity encryption key ak i and proxy signature γ;
[0138] Output: Agent j's identity identifier (ID) j Or ⊥, where ⊥ is a symbol indicating an error.
[0139] The proxy identification algorithm is deterministic.
[0140] Execute the proxy identification algorithm PIde(pk) i ,ak i ,γ) includes:
[0141] If the analysis γ = tpk j If ||ω||u||v||τ||β fails, return ⊥;
[0142] If Ver(pk) i ,0||pk i ||tpk j If ||ω||u||v,τ)=0, then return ⊥;
[0143] Otherwise, return the identity identifier id of the authorized agent j. j id j =Dec(ak) i ,u;v), where Dec(.) is the decryption algorithm.
[0144] For the decryption algorithm Dec(.), the decryption algorithm is deterministic.
[0145] Input: Principal i's identity encryption key ak i The client i is based on ak i Calculate Enc(ak) i ,id j The obtained u and random number v are (v);
[0146] Output, two cases:
[0147] (1) Represents the identity identifier id of the authorized agent j. j id j =Dec(ak) i ,u;v);
[0148] (2)⊥;⊥=Dec(ak i ,u;v).
[0149] If the identification is successful, this step returns the identity identifier (id) of agent j. j If identity verification fails, return ⊥.
[0150] The purpose of this section is to identify whether the identity identifier of the generated proxy signature γ is consistent with the identity identifier of the authorized proxy j.
[0151] In this invention, for the public key pk of the delegator i i Private key sk i ; public key pk of proxy j j Private key sk j ; and the encryption key ak for the identity of the principal i. i The calculation is as follows:
[0152] The common parameters pp are generated using the ParGen algorithm for generating common parameters of elliptic curves, where pp ← ParGen(1). λ ), where λ is the safety parameter;
[0153] Based on the public parameter pp, the private key sk of the delegator i is generated using the key generation algorithm KeyGen(pp). i and the private key sk of the authorized agent j j ;
[0154] The private key sk of the principal i i The private key sk of the authorized agent j j By performing dot products with the base point G of the elliptic curve, the public key pk of the delegator i can be obtained. i PK with proxy j's public key j As shown below:
[0155] (pk i ,sk i )←KeyGen(pp),(pk j ,sk j )←KeyGen(pp)
[0156] Using the identity encryption key generation algorithm IdeHidKeyGen(1) λ Generate the encryption key ak for the identity of the principal i. i ←IdeHidKeyGen(1 λ ).
[0157] (1) First, the common parameter pp is generated using the elliptic curve common parameter generation algorithm ParGen, where pp ← ParGen(1 λ ), where pp is the common parameter of the elliptic curve cryptography algorithm, λ is the security parameter; the parameter generation algorithm ParGen(.) is probabilistic;
[0158] (2) Generate the private keys of the principal i and the authorized agent j using the key generation algorithm KeyGen(pp); the input and output of the key generation algorithm are as follows:
[0159] Input: Common parameter pp;
[0160] Output: The public and private keys of the principal i and the authorized agent j.
[0161] (pk i ,sk i )←KeyGen(pp),(pk j ,sk j )←KeyGen(pp);
[0162] Randomly select a private key, the private key sk of the delegator i. i ←Z n * The private key sk of authorized agent j j ←Z n * Among them, Z n * Integers from 1 to n-1; n is a prime number;
[0163] The public key is obtained by multiplying the private key and G, and the public key pk of the delegator i is also calculated. i =sk i ·G, the public key pk of authorized agent j j =sk j ·G, where G is the base point on the elliptic curve and its order is n.
[0164] G is the base point on the elliptic curve, a fixed point used to generate keys and perform encryption operations. In key generation algorithms, the base point G is usually used to generate the public key, which is obtained by multiplying the private key by the base point G.
[0165] Among them, the key generation algorithm KeyGen(pp) is the KeyGen algorithm in the elliptic curve signature algorithm DS=(ParGen,KeyGen,Sig,Ver).
[0166] The key generation algorithm KeyGen(.) is probabilistic.
[0167] (3) Using the identity encryption key generation algorithm IdeHidKeyGen(1 λ Generate the encryption key ak for the identity of the principal i. i ;
[0168] Input: 1 λ λ is a safety parameter;
[0169] Output: Identity encryption key ak i .
[0170] The IdeHidKeyGen algorithm operates in polynomial time.
[0171] The correctness verification of the identity-masking proxy signature algorithm HPS of this invention is easily proven by the correctness of DS = (ParGen, KeyGen, Sig, Ver) in the elliptic curve signature algorithm:
[0172] When ρ = Sig(sk) i ,0||pk i ||id j ||pk j ||ω||v),π=Sig(tsk) j ,0||pk i ||id j ||pk j ||ω||tpk j ), θ = Sig(sk) j ,0||pk i ||id j ||pk j ||ω||tpk j ||π), τ=Sig(sk) i ,0||pk i ||tpk j ||ω) and β=Sig(sk j ,1||pk i ||tpk j When ||ω||τ||mess), we always have:
[0173] Ver(pk i ,0||pk i ||id j ||pk j ||ω||v,ρ)=1;
[0174] Ver(tpk j ,0||pk i ||id j ||pk j ||ω||tpk j (π) = 1;
[0175] Ver(pk j ,0||pk i ||id j ||pk j ||ω||tpk j ||τ,θ)=1;
[0176] Ver(pk i ,0||pk i ||tpk j ||ω,τ)=1;
[0177] Ver(tpk j ,1||pk i ||tpk j ||ω||τ||mess,β)=1.
[0178] In this invention, the correctness of the identity-masking proxy signature algorithm HPS is verified by proving the correctness of the digital signature algorithm DS = (ParGen, KeyGen, Sig, Ver).
[0179] The confidentiality requirements for proxy delegation are as follows:
[0180] This invention requires that the principal i and agent j execute the delegation agreement (D,P) through a secure channel. To conceal the identity of agent j, (ρ,ω,v) and (π,θ,tpk) need to be transmitted on the channel during delegation. j () and (u,τ) are kept secret.
[0181] Regarding the extension of the agency agreement, the following is an example:
[0182] The proxy delegation protocol described in the aforementioned scheme of this invention generates a proxy signature private key skp = (pk) each time. i ||tpk j ||ω||u||v||τ,tsk j This can extend the proxy protocol to generate multiple proxy signing private keys each time (i.e., multiple independently and randomly generated (tpk) keys). j ||u||v||τ,tsk j )).
[0183] If the same proxy signing private key is used multiple times for proxy signing, although the specific proxy signer is unknown, it is known that the signing operation was performed by the same proxy j. In other words, proxy signatures using the same proxy signing private key are chainable. Therefore, if stronger proxy signing anonymity is required, a different proxy signing private key should be used for each proxy signing. If necessary, the proxy delegation protocol should be run again to generate a new proxy signing private key, thus ensuring that a different proxy signing private key is used each time.
[0184] The Identity-Hidden Proxy Signature Algorithm (HPS) of this invention is a strong proxy signature with identity concealment functionality, i.e., hiding the identity of the proxy, while also maintaining identity identifiability (identified by the principal i if necessary). It satisfies all other attributes of a strong proxy signature except for strong identifiability, and the proxy signature is an aggregation of the proxy signatures of the authorization certificate and the message. HPS's identity concealment function differs from existing anonymous proxy signatures, which support multi-layered signature authority delegation, while this invention hides the identities of all intermediate principals.
[0185] In summary, the secure and efficient identity-hiding proxy signature method of this invention has the following beneficial effects:
[0186] 1. Compared to traditional proxy signature schemes, this method can more effectively hide the proxy's identity, improving the level of proxy privacy protection. By hiding the identity of the intermediate delegator, the proxy's privacy can be protected even in multi-layered proxy signing scenarios, thus enhancing proxy privacy protection;
[0187] 2. Although the agent's identity is hidden, the principal can still identify the agent when needed to ensure the legitimacy of the signature. This guarantee of identity identifiability is particularly important in certain scenarios, such as when signature auditing or traceability is required; with guarantees of identity identifiability and legitimacy, the principal can use the identity encryption key ak when necessary. i The agent's identity can be identified, but others cannot identify the agent's identity;
[0188] 3. This method possesses sufficient flexibility and adaptability to adapt to rapidly changing network environments and ever-increasing security demands. It provides an efficient identity-hiding proxy signature algorithm that can handle various complex signature scenarios and security challenges; it is flexible and adaptable.
[0189] 4. Compared to traditional proxy signature algorithms, this method improves signature efficiency. By calling the basic digital signature algorithm only once, and with the main operation being a single dot multiplication, the computational load for signing is smaller, thus enabling more efficient signature operations and improving signature verification efficiency.
[0190] 5. Compared with existing technologies, this method reduces the requirement for a secure channel between the principal and the agent. Although a secure channel is still required, the reliance on a secure channel is reduced by hiding the agent's identity, thus lowering the difficulty and cost of implementation.
[0191] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.
Claims
1. A secure and efficient method for identity-hiding proxy signatures, characterized in that, Includes the following steps: Agent j generates second information (π,θ,tpk) based on the first information (ρ,ω,v) generated by principal i. j ); where ρ is the digital signature generated by principal i, ω is the signable message space, v is a random number; π and θ are the first and second digital signatures generated by agent j, respectively, and tpk j This is the temporary public key for agent j; The principal i generates delegation information (u, τ) based on the second information; where u is generated by the principal i based on the identity encryption key ak. i Calculate Enc(ak) i ,id j v) Receive; τ is the delegate signature message generated by the delegate i; id j The identifier for agent j; Agent j receives the delegation information and verifies the validity of the delegation information based on the public key of the delegator i. If valid, agent j calculates and obtains the agent signing private key and uses the agent signing private key to sign the message. After the proxy signature is completed, the verifier verifies whether the proxy signature is a valid proxy signature for the message by the proxy authorized by the principal i; if necessary, the principal i uses the identity encryption key ak. i Identify the identity of the proxy.
2. The method according to claim 1, characterized in that, The principal i obtains the identity identifier id of the agent j. j Based on its own private key sk i Public key pk i , public key pk of proxy j j Given a signatureable message space ω and a random number v, generate a digital signature ρ, where ρ = Sig(sk i ,0||pk i ||id j ||pk j ||ω||v); The digital signature ρ, the signable message space ω, and the random number v constitute the first message (ρ, ω, v) and are sent to the agent j.
3. The method according to claim 2, characterized in that, The agent j receives the first message (ρ,ω,v); The validity of the delegation is determined based on the public key of the delegator i. If Ver(pk) i ,0||pk i ||id j ||pk j If ||ω||v,ρ)=0, then it is invalid, and the entrustment is terminated; Otherwise, the agent j generates a temporary public key and a temporary private key, as follows: Among them, Z n * Let G be an integer from 1 to n-1, G be the base point of the elliptic curve, n be the order of G, and · be the dot product; And generate the first and second digital signatures π and θ respectively: π=Sig(tsk j ,0||pk i ||id j ||pk j ||ω||v||tpk j ),θ=Sig(sk j ,0||pk i ||id j ||pk j ||ω||v||tpk j ||π); Based on the first and second digital signatures π and θ, and the temporary public key, the agent j generates the second information (π, θ, tpk). j ) is sent to the principal i.
4. The method according to claim 3, characterized in that, The principal i receives the second information (π, θ, tpk). j ), to verify; If Ver(tpk j ,0||pk i ||id j ||pk j ||ω||v||tpk j ,π) = 0 Or Ver(pk) j ,0||pk i ||id j ||pk j ||ω||v||tpk j If ||τ,θ)=0, then the entrustment is terminated; Otherwise, generate (u,v) = Enc(ak) i ,id j ;v); The principal i uses its own public key, the signable message space ω, the public key of the authorized agent j, the temporary public key of the authorized agent j, and the identity-based encryption key ak. i Calculate Enc(ak) i ,id j ;v) Given u and random number v, generate a delegated signature message τ = Sig(sk i ,0||pk i ||tpk j ||ω||u||v); The delegation information (u, τ) consisting of u and the delegation signature message τ is sent to the agent j.
5. The method according to claim 4, characterized in that, The agent j receives the delegation information (u,τ) and verifies the delegation information based on the public key of the delegator i; If Ver(pk) i ,0||pk i ||tpk j If ||ω||u||v,τ)=0, then the entrustment is terminated; Otherwise, based on the public key of the principal i, the temporary public key of the agent j, the signable message space, and the identity-based encryption key ak i Calculate Enc(ak) i ,id j ;v) Given u, random number v, delegated signature message τ, and the temporary private key of agent j, calculate the agent signature private key skp of agent j, where skp = (pk i ||tpk j ||ω||u||v||τ,tsk j ).
6. The method according to claim 5, characterized in that, Before performing the proxy signature, the agent j also includes determining whether the message is within the signable message space; If so, then the proxy j, based on the proxy signature private key skp, uses the proxy signature algorithm to perform proxy signature on the message, obtaining the proxy signature γ: γ = tpk j ||ω||u||v||τ||β; Where β=Sig(tsk) j ,1||pk i ||tpk j ||ω||u||v||τ||mess); message is the message.
7. The method according to claim 6, characterized in that, The verifier uses a proxy signature algorithm to verify whether the proxy signature γ is a valid proxy signature for the message authorized by the principal i; the proxy signature verification algorithm is PVer(pk) i ,mess,γ).
8. The method according to claim 7, characterized in that, The verification of signatures includes: If γ = ⊥, then return 0; where ⊥ is an error symbol. If parsing proxy signature γ = tpk j If ||ω||u||v||τ||β fails, return 0; like Then it returns 0; If γ = tpk j If ||ω||u||v||τ||β, then return 0; If Ver(tpk) j ,1||pk i ||tpk j ||ω||u||v||τ||mess,β)=0, then 0 is returned; Otherwise, return 1; Where 1 represents a valid proxy signature and 0 represents an invalid proxy signature.
9. The method according to claim 8, characterized in that, Based on the validity of the proxy signature, the principal i may, if necessary, use the public key pk. i and identity encryption key ak i The identity of the proxy that generates the proxy signature γ is identified using a proxy identification algorithm. The proxy identification algorithm is PIde(pk) i ,ak i ,γ).
10. The method according to claim 9, characterized in that, Execute the proxy identification algorithm PIde(pk) i ,ak i ,γ) includes: If the analysis γ = tpk j If ||ω||u||v||τ||β fails, return ⊥; If Ver(pk) i ,0||pk i ||tpk j If ||ω||u||v,τ)=0, then return ⊥; Otherwise, return the identity identifier id of the authorized agent j. j id j =Dec(ak) i ,u;v), where Dec(.) is the decryption algorithm.