Non-interactive generic specified verifier signature certification method based on SM2 digital signature

Abstract

The invention relates to a non-interactive generic specified verifier signature certification method based on an SM2 digital signature, and the method comprises the steps: S1, a system administrator module initializes system parameters, so as to determine a system main public key and a system main private key; s2, the signer module generates a user private key according to the system main public key, the system main private key and the user information, and generates a signature of the message m by using the user private key; s3, the signature owner module verifies the validity of the message and the signature according to the system main public key and the user information; s4, the specified verifier module calls a specified verifier key to generate a private key and a public key of a specified verifier; and S5, inputting a signature by using a signature owner module, and inputting a private key of a specified verifier by using a specified verifier module to execute a DVerf protocol to complete a certification process. According to the technical scheme, it is guaranteed that the UDVSP scheme has the advantages of being high in safety, high in performance, low in power consumption and the like.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a non-interactive, generically designated verifier signature proof method based on SM2 digital signatures. Background Technology

[0002] Universal Designated Verifier Signature Proof (UDVSP) allows a signature owner to convince a designated verifier of their signature without providing the signature itself, but the designated verifier cannot convince others of their signature. UDVSP is widely used for privacy protection in areas such as medical data, electronic voting, anonymous certificates, and electronic revenue aggregation. For example, in the medical field, suppose the signature owner (patient Alice) receives a new electronic medical record from the signer (doctor D1). Patient Alice can convince a designated verifier (doctor D2) of the electronic medical record's content without providing a signature, and doctor D2 cannot convince others of the electronic medical record's content.

[0003] The existing UDVSP scheme based on SM2 digital signature requires three rounds of interaction between the signature owner and a designated verifier. The communication costs incurred during these interactions reduce the communication efficiency of the UDVSP scheme, and information that may be leaked during the interactions can compromise its security. Summary of the Invention

[0004] In view of this, the present invention provides a non-interactive universally designated verifier signature proof method based on SM2 digital signature, which aims to solve the problems of multiple communication steps and low security in the existing UDVSP scheme based on SM2 digital signature.

[0005] To achieve the above objectives, the present invention mainly provides the following technical solutions:

[0006] Embodiments of the present invention provide a non-interactive wildcard validator signature proof method based on SM2 digital signatures. The method is characterized by providing a system comprising a system administrator module, a signer module, a signature owner module, and a designated validator module, specifically including the following steps:

[0007] Step S1: The system administrator module initializes system parameters to determine the system master public key and system master private key;

[0008] Step S2: The signer module generates a user private key based on the system master public key, the system master private key, and user information, and uses the user private key to generate a signature for message m. ;

[0009] Step S3: The signature owner module verifies the message based on the system master public key and the user information. and the signature Validity;

[0010] Step S4: The specified validator module calls the specified validator key to generate the specified validator's private key and public key;

[0011] Step S5: Input the signature using the signature owner module. The system then uses the designated verifier module to input the private key of the designated verifier and executes the DVerf protocol to complete the proof process.

[0012] In some implementations, in step S1, the system administrator module initializes system parameters using an initialization algorithm to determine the system master public key and the system master private key, specifically including:

[0013] Step S11: Obtain security parameters Randomly select large prime numbers Determine non-singular elliptic curves ,in, ;

[0014] Step S12: In Selecting prime numbers from all points including the point at infinity Cyclic group And the generator P, where, ;

[0015] Step S13: Select a secure hash function , , and ,in, , , , ;

[0016] Step S14: Randomly select and calculate ,in, ;

[0017] Step S15: Output the system master public key and system master private key ,in, ; .

[0018] In some implementations, in step S2, the signer module uses a key parsing algorithm to generate a user private key based on the system master public key, the system master private key, and user information, specifically including:

[0019] Step S21: Obtain the system master public key System Master Private Key and user information ;

[0020] Step S22: Randomly select ,calculate ;

[0021] ;

[0022] ;

[0023] Step S23: Output the user's private key ,in, .

[0024] In some implementations, in step S2, the signer module uses a signature algorithm to generate a message using the user's private key. signature Specifically, it includes:

[0025] Step S24: Obtain the system master public key The user's private key and the message ;

[0026] Step S25: Calculation and e, where,

[0027] ;

[0028] ;

[0029] yes The length of the bit string, yes The x and y coordinates, yes The horizontal and vertical coordinates;

[0030] Step S26: Randomly select Calculate K and r, where,

[0031] ;

[0032] ;

[0033] Among them, if or Then select again. Calculate again, otherwise calculate

[0034] ;

[0035] like Then output message m and signature. ,in,

[0036] .

[0037] In some implementations, in step S3, the signature owner module uses a verification algorithm to verify the message based on the system master public key and the user information. and the signature The validity of this includes, specifically:

[0038] Step S31: Obtain the system master public key User information ,information and the signature to be verified , ;

[0039] Step S32:

[0040] like Then output Signal, otherwise calculate ;

[0041] like Then output Signal, otherwise calculate , , , and ;

[0042] ;

[0043] ;

[0044] ;

[0045] ;

[0046] ;

[0047] like If the signature is valid, output a valid signature signal; otherwise, output a valid signature signal. Signal.

[0048] In some implementations, in step S4, the designated verifier module uses a designated verifier key generation algorithm to call the designated verifier key to generate the designated verifier's private and public keys, which specifically includes:

[0049] Step S41: Obtain the system master public key Random selection ,calculate ,in, ;

[0050] Step S42: Output the private key of the specified validator V. and public key ;in, Announcement Retained by verifier V.

[0051] In some implementations, executing the DVerf protocol in step S5 specifically includes:

[0052] Step S51: The signature owner module P first calculates K. Then randomly select , and ,in, , and all , ,calculate and ;

[0053] ;

[0054] ;

[0055] Step S52: The signature owner module P obtains c, where,

[0056] ;

[0057] Step S53: Specify the signature owner module P and ,in,

[0058] ;

[0059] ;

[0060] calculate , , and ,in,

[0061] ;

[0062] ;

[0063] ;

[0064] Subsequently, the signature owner module P will... Send to the designated verifier V;

[0065] Step S54: Specify the verifier V to calculate , and c, where,

[0066] ;

[0067] ;

[0068] ;

[0069] like , and If the signal is received, a receive signal will be output; otherwise, a rejection signal will be output.

[0070] By employing the above technical solution, the non-interactive wildcard validator signature proof method based on SM2 digital signature of the present invention has at least the following beneficial effects:

[0071] Compared to existing UDVSP schemes based on SM2 digital identifier signatures, which involve a three-round interaction protocol with high communication costs and low security under ordinary zero-knowledge proofs, this invention, through steps S1-S5, utilizes the OR protocol in zero-knowledge proofs to design a new non-interactive UDVSP scheme. This scheme not only satisfies the two security requirements of Adaptive Choice Attack Unforgeability (UF-CMA) and Anti-Impersonation Attack (R-IM), but also eliminates the need for a three-round interaction between the signature owner and the designated verifier. This ensures that the UDVSP scheme of this invention has the characteristics of high security, high performance, and low power consumption.

[0072] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, the preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings. Attached Figure Description

[0073] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0074] Figure 1 This is a schematic diagram of a method flow according to an embodiment of the present invention. Detailed Implementation

[0075] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0076] It should be noted that if the embodiments of the present invention involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0077] Furthermore, if the embodiments of this invention involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0078] like Figure 1 As shown, an embodiment of the present invention proposes a non-interactive, wildcard designated verifier signature proof method based on SM2 digital signatures. It provides a system including a system administrator module, a signer module, a signature owner module, and a designated verifier module, specifically including the following steps:

[0079] Step S1: The system administrator module initializes system parameters to determine the system master public key and system master private key.

[0080] Step S2: The signer module generates a user private key based on the system master public key, the system master private key, and user information, and uses the user private key to generate a signature σ for message m.

[0081] Step S3: The signature owner module verifies the message based on the system master public key and user information. and signature The effectiveness.

[0082] Step S4: The specified validator module calls the specified validator key to generate the specified validator's private key and public key.

[0083] Step S5: Input the signature using the signature owner module. The DVerf protocol is executed by inputting the private key of the specified verifier into the specified verifier module to complete the proof process.

[0084] Compared to existing UDVSP schemes based on SM2 digital identifier signatures, which involve a three-round interaction protocol with high communication costs and low security under ordinary zero-knowledge proofs, this invention, through steps S1-S5 above, utilizes the OR protocol in zero-knowledge proofs to design a new non-interactive UDVSP scheme. This scheme not only satisfies two types of security: Unforgeable Adaptive Choice Attack (UF-CMA) and Resistant Impersonation Attack (R-IM), but also eliminates the need for a three-round interaction between the signature owner and the designated verifier. Thus, this invention's UDVSP scheme features high security, high performance, and low power consumption.

[0085] in, Figure 1 This diagram illustrates an embodiment of the present invention, providing a system comprising four entities: a system administrator module, a signer module, a signature owner module, and a designated verifier module. First, the system administrator module invokes the Setup algorithm to determine the system master public key and shares it with other entities. Then, the signer module uses the system master private key to call Extract to generate a user private key and uses the user private key to call Sign to calculate the message signature. Next, the signature owner module obtains the message, signature, and user information from the signer and calls Verf to verify the validity of the message and signature. The designated verifier module calls the Designated Verifier Key Generator (DGenr) to generate the designated verifier's private and public keys and publishes the public key. Finally, the signature owner module uses the signature and the designated verifier module to execute the DVerf protocol, completing the proof process.

[0086] To implement the aforementioned step S1, in some embodiments, in step S1, the system administrator module initializes system parameters using an initialization algorithm to determine the system master public key and the system master private key, specifically including:

[0087] Step S11: Obtain security parameters Randomly select large prime numbers Determine non-singular elliptic curves ,in, .

[0088] Step S12: In Selecting prime numbers from all points including the point at infinity Cyclic group And the generator P, where, .

[0089] Step S13: Select a secure hash function , , and ,in,

[0090]

[0091]

[0092]

[0093] .

[0094] Step S14: Randomly select and calculate ,in, .

[0095] Step S15: Output the system master public key and system master private key ,in,

[0096] ;

[0097] .

[0098] For step S2 mentioned above, in some implementations, in step S2, the signer module uses a key parsing algorithm to generate a user private key based on the system master public key, the system master private key, and user information. Specifically, this includes:

[0099] Step S21: Obtain the system master public key System Master Private Key and user information .

[0100] Step S22: Randomly select ,calculate ;

[0101] ;

[0102] .

[0103] Step S23: Output the user's private key ,in, .

[0104] In some implementations, in step S2, the signer module uses a signature algorithm to generate a message using the user's private key. signature Specifically, it includes:

[0105] Step S24: Obtain the system master public key The user's private key and the message .

[0106] Step S25: Calculation and e, where,

[0107] ;

[0108] ;

[0109] yes The length of the bit string, yes The x and y coordinates, yes The horizontal and vertical coordinates.

[0110] Step S26: Randomly select Calculate K and r, where,

[0111] ;

[0112] ;

[0113] Among them, if or Then select again. Calculate again, otherwise calculate

[0114] ;

[0115] like Then output message m and signature. ,in,

[0116] .

[0117] For the aforementioned step S3, in some implementations, in step S3, the signature owner module uses a verification algorithm to verify the message based on the system master public key and user information. and signature The validity of this includes, specifically:

[0118] Step S31: Obtain the system master public key User information ,information and the signature to be verified , .

[0119] Step S32:

[0120] like Then output Signal, otherwise calculate ;

[0121] like Then output Signal, otherwise calculate , , , and ;

[0122] ;

[0123] ;

[0124] ;

[0125] ;

[0126] ;

[0127] like If the signature is valid, output a valid signature signal; otherwise, output a valid signature signal. Signal.

[0128] It should be noted here that in step S32 above, an output of 1 can represent a valid signature signal, and an output of 0 can represent... Signal.

[0129] For the aforementioned step S4, in some embodiments, in step S4, the designated verifier module uses a designated verifier key generation algorithm to call the designated verifier key to generate the private key and public key of the designated verifier, which specifically includes:

[0130] Step S41: Obtain the system master public key Random selection ,calculate ,in, .

[0131] Step S42: Output the private key of the specified validator V. and public key ;in, Announcement Retained by verifier V.

[0132] In some implementations, the execution of the DVerf protocol in step S5 specifically includes:

[0133] Step S51: The signature owner module P first calculates K. Then randomly select , and ,in, , and all , ,calculate and ;

[0134] ;

[0135] .

[0136] Step S52: The signature owner module P obtains c, where,

[0137] .

[0138] Step S53: Specify the signature owner module P and ,in,

[0139] ;

[0140] ;

[0141] calculate , , and ,in,

[0142] ;

[0143] ;

[0144] ;

[0145] Subsequently, the signature owner module P will... Send to the designated verifier V.

[0146] Step S54: Specify the verifier V to calculate , and c, where,

[0147] ;

[0148] ;

[0149] ;

[0150] like , and If the signal is received, a receive signal will be output; otherwise, a rejection signal will be output.

[0151] It should be noted that in step S54 above, outputting 1 represents a receive signal and outputting 0 represents a reject signal.

[0152] For ease of understanding, the symbols used in the above algorithms are defined as follows:

[0153] : Large prime number.

[0154] :Include A finite field of n elements.

[0155] : The elements in the text define An elliptic curve on .

[0156] : Upper Elliptic Curve All rational points (including the point at infinity) A set consisting of ).

[0157] : The number of points on the curve is called the elliptic curve. The rank.

[0158] A point on an elliptic curve is called the point at infinity or the zero point.

[0159] : Contains elliptic curves Cyclic group of all points and points at infinity.

[0160] :group The generator.

[0161] : Represents an elliptic curve a point on

[0162] Generator The order ( yes# (Element factor).

[0163] : Secure cryptographic hash function.

[0164] Secure cryptographic hash functions

[0165] Secure cryptographic hash functions

[0166] Secure cryptographic hash functions

[0167] :gather Neutral elements A set of coprime elements.

[0168] The UDVSP scheme of this invention mainly includes six parts: initialization (Setup), key extraction (Extract), signing (Sign), verification (Verf), designated verifier key generation (DGenr), and designated verification (DVerf). It aims to solve the problems of multiple communication steps and low security in existing UDVSP schemes based on SM2 digital identifier signatures, effectively reduce computational overhead and communication costs, thereby reducing system burden and better meeting the data security and privacy protection needs in fields such as medical data, electronic voting, anonymous certificates, and electronic revenue aggregation.

[0169] This invention utilizes the SM2 digital identifier signature to design a novel UDVSP scheme, which not only satisfies two types of security—Adaptive Choice Attack Unforgeability (UF-CMA) and Resistance to Impersonation Attacks (R-IM)—but also avoids the communication costs and security vulnerabilities associated with three-round interaction protocols. Furthermore, it better meets practical application requirements in a typical PC testing environment.

[0170] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0171] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0172] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0173] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0174] The above description is merely a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural transformations made using the contents of the present invention's specification and drawings under the inventive concept of the present invention, or direct / indirect applications in other related technical fields, are included within the patent protection scope of the present invention.

Claims

1. A non-interactive, wildcard validator signature proof method based on SM2 digital signatures, characterized in that, The system provides a module including a system administrator module, a signer module, a signature owner module, and a designated verifier module, specifically including the following steps: Step S1: The system administrator module initializes system parameters to determine the system master public key and system master private key; Step S2: The signer module generates a user private key based on the system master public key, the system master private key, and user information, and uses the user private key to generate a signature for message m. ; Step S3: The signature owner module verifies the message based on the system master public key and the user information. and the signature Validity; Step S4: The specified validator module calls the specified validator key to generate the specified validator's private key and public key; Step S5: Input the signature using the signature owner module. The system then uses the designated verifier module to input the private key of the designated verifier and executes the DVerf protocol to complete the proof process.

2. The non-interactive generically designated verifier signature proof method based on SM2 digital signatures as described in claim 1, characterized in that, In step S1, the system administrator module initializes system parameters using an initialization algorithm to determine the system master public key and system master private key, specifically including: Step S11: Obtain security parameters Randomly select large prime numbers Determine non-singular elliptic curves ,in, ; Step S12: In Selecting prime numbers from all points including the point at infinity Cyclic group And the generator P, where, ; Step S13: Select a secure hash function , , and ,in, ， ， ， ； Step S14: Randomly select and calculate ,in, ; Step S15: Output the system master public key and system master private key ,in, ； 。 3. The non-interactive wildcard validator signature proof method based on SM2 digital signatures as described in claim 1, characterized in that, In step S2, the signer module uses a key parsing algorithm to generate a user private key based on the system master public key, the system master private key, and user information. Specifically, this includes: Step S21: Obtain the system master public key System Master Private Key and user information ; Step S22: Randomly select ,calculate ; ； ； Step S23: Output the user's private key ,in, .

4. The non-interactive generically designated verifier signature proof method based on SM2 digital signatures as described in claim 1, characterized in that, In step S2, the signer module uses a signature algorithm to generate a message using the user's private key. signature Specifically, it includes: Step S24: Obtain the system master public key The user's private key and the message ; Step S25: Calculation and e, where, ； ； yes The length of the bit string, yes The x and y coordinates, yes The horizontal and vertical coordinates; Step S26: Randomly select Calculate K and r, where, ； ； Among them, if or Then select again. Calculate again, otherwise calculate , ； like Then output message m and signature. ,in, 。 5. The non-interactive generically designated verifier signature proof method based on SM2 digital signatures as described in claim 1, characterized in that, In step S3, the signature owner module uses a verification algorithm to verify the message based on the system master public key and the user information. and the signature The validity of this includes, specifically: Step S31: Obtain the system master public key User information ,information and the signature to be verified , ; Step S32: like Then output Signal, otherwise calculate ; like Then output Signal, otherwise calculate , , , and ; ； ； ； ； ； like If the signature is valid, output a valid signature signal; otherwise, output a valid signature signal. Signal.

6. The non-interactive generically designated verifier signature proof method based on SM2 digital signatures as described in claim 1, characterized in that, In step S4, the designated validator module uses the designated validator key generation algorithm to call the designated validator key to generate the private and public keys of the designated validator, which specifically includes: Step S41: Obtain the system master public key Random selection ,calculate ,in, ; Step S42: Output the private key of the specified validator V. and public key ;in, Announcement Retained by verifier V.

7. The non-interactive generically designated verifier signature proof method based on SM2 digital signatures as described in claim 1, characterized in that, Step S5, executing the DVerf protocol, specifically includes: Step S51: The signature owner module P first calculates K. Then randomly select , and ,in, , and all , ,calculate and ; ； ； Step S52: The signature owner module P obtains c, where, ； Step S53: Specify the signature owner module P and ,in, ； ； calculate , , and ,in, ； ； ； Subsequently, the signature owner module P will... Send to the designated verifier V; Step S54: Specify the verifier V to calculate , and c, where, ； ； ； like , and If the signal is received, a receive signal will be output; otherwise, a rejection signal will be output.

Images