Identity-based threshold signature algorithm suitable for block chain supported password reverse firewall

Abstract

The invention relates to a distributed digital signature suitable for a block chain environment, and discloses an identity-based threshold signature algorithm suitable for a block chain to support a password reverse firewall, which can prove that existence unforgeability security under adaptive selection message attack can be satisfied under a random oracle model. The method is characterized in that an identity-based threshold signature mechanism is adopted, so that the overhead of certificate generation, management and revocation in a traditional PKI system is avoided, and the method is suitable for a scene of direct binding of an identity and a key in a block chain. Besides, according to the algorithm, when the signature key and the random number are generated, a Shamir secret sharing technology is combined, so that an effective signature can be synthesized when the number of participating users reaches a preset threshold value, the system security is guaranteed, and fault tolerance and flexibility are enhanced. Meanwhile, a password reverse firewall (CRF) is introduced, privacy information is re-randomized in the signature process, information leakage attacks can be effectively resisted, even if secret keys of part of participants are leaked, the system can still keep overall safety and cannot be counterfeited for signature, and robustness and usability in a complex hostile environment are remarkably improved.

Description

Technical Field

[0001] This invention relates to distributed digital signatures and cryptographic reverse firewalls for blockchain environments. Background Technology

[0002] Distributed signatures allow multiple nodes to participate in generating a valid signature, effectively avoiding single points of failure by distributing signing authority. This technology has various important applications in blockchain, including multi-signature wallet transaction verification, node collaboration authentication in consensus mechanisms, and collaborative consensus among IoT devices, providing reliable identity and transaction security for various decentralized applications. However, in a distributed blockchain network, the types of node devices participating in signing are diverse, and their operating environments are complex. Some nodes may have malicious intent or suffer from information leakage attacks, leading to the theft of private keys and algorithm tampering, seriously threatening the security and reliability of the signing process. Furthermore, traditional PKI systems rely on digital certificates to bind identities and public keys, which incurs significant overhead in certificate management, verification, and revocation in a large-scale, dynamically changing blockchain environment, thus limiting the practical application of distributed signatures to some extent.

[0003] In view of the above-mentioned existing problems, this invention uses identity-based threshold signature to realize distributed digital signature in a blockchain environment, and introduces a cryptographic reverse firewall to resist information leakage attacks. Summary of the Invention

[0004] This invention provides an identity-based threshold signature algorithm suitable for blockchains that supports cryptographic reverse firewalls. It allows at least t out of n signers to collaboratively generate a valid identity-based signature without relying on certificates. Furthermore, the algorithm supports cryptographic reverse firewall mechanisms, effectively resisting attacks such as key leakage and malicious tampering. Even in cases of malicious behavior by some participants or key leakage, the secure execution of the signature protocol can still be guaranteed. Under a random oracle model, this signature algorithm can be proven to satisfy existence-unforgeable security under adaptive chosen message attacks. The signature algorithm includes the following four stages:

[0005] 1. System Setup: The system is initialized by the KGC and its corresponding CRF. It takes security parameters as input and outputs the re-randomized public parameters `params′`.

[0006] 2. Key Extraction: This process is jointly performed by the KGC, the signer, and their corresponding CRFs to extract a portion of the user's private key. Inputs include params′, the signer set SIG, the corresponding CRF set CRFs, and the identity identifier ID. Each signer holds a re-randomized signature private key fragment d′ from each CRF. i .

[0007] 3. Signing: This process is performed jointly by multiple signers to generate a complete signature. It involves params′, the message M to be signed, and d′ held by each signer. i Given the input, output the rerandomized signature σ′.

[0008] 4. Verification: Performed by the signature verifier, this verifies the validity of the signature. It takes params′, ID, M, and σ′ as input. If the signature is valid, it outputs "accept"; otherwise, it outputs "reject". Attached Figure Description

[0009] Figure 1 This is a flowchart of the algorithm of the present invention. Detailed Implementation

[0010] The algorithm described in this invention consists of four stages: system establishment, key extraction, signing, and verification. The specific algorithm flow is as follows:

[0011] System setup:

[0012] 1. Given security parameters, KGC generates bilinear paired tuples. And randomly select The generator P, and two hash functions secret And calculate P pub =sP, send public parameters to its CRF

[0013] 2. KGC's CRF receives messages from KGC and randomly selects... And calculate P′ pub =P pub +s′P, public parameters after rerandomization

[0014] Key extraction:

[0015] 1. n signers together form an organization with the identifier ID. Let the set of signers be SIG = {SIG1, SIG2, ..., SIG}. n The CRF set of each signer is CRF = {CRF1, CRF2, ..., CRF}. n KGC randomly selects a polynomial f. 1,i (y)=α0+α1y+α2y 2 +…+α t-1 y t-1 Where α0 = s, is all SIG i ∈SIG compute F1(i)=f1(i)Q and send it to its CRF, where l∈[0,t-1],Q=H1(ID).

[0016] 2. KGC's CRF receives messages from KGC, calculates F′1(i) = F1(i) + s′, and sends it to each CRF. i ∈CRF. Each CRF i Forward the message to the corresponding SIG i Each SIG i ∈SIG will use the received F′1(i) as the signature key fragment d′ i .

[0017] sign:

[0018] 1. Each SIG i ∈SIG random selection secret and polynomial f 2,i (y)=β i,0 +β i,1 y+β i,2 y 2 +…+β i,t-1 y t-1 For all SIG j ∈SIG\SIG i Calculate f 2,i (j) and P 1,i Promise B i,l =β i,l P is sent together to CRF i , where l∈[0,t-1].

[0019] 2. Each CRF i ∈CRF receives from SIG i Information verification If it is not true, then let P′ be true. 1,j =P 1,j Otherwise, select randomly. calculate Randomly select secret calculate and

[0020]

[0021] And send it to the corresponding CRF. j ∈CRF\CRF i .

[0022] 3. Each CRF i ∈CRF receive from CRF j ∈CRF\CRF i Verify all information. Whether it holds true depends on the SIG that has passed the verification. j Random selection calculate

[0023]

[0024] and send it to SIG i .

[0025] 4. Each SIG i ∈ SIG receives information from CRF i . For all SIG j ∈ SIG \ SIG i , verify whether it holds, and issue an accusation against SIG j for those j that fail the verification. A SIG j that receives at least t accusations is considered a malicious participant and will be removed from SIG. If |SIG| < t, abort the protocol and output the set of malicious participants; otherwise, each SIG i ∈ SIG calculates and R = e(P1, K ′ ), and broadcasts P1 and R to check for consistency. At this time, each CRF i ∈ CRF directly forwards the information from SIG i . Each CRF i ∈ CRF receives information from CRF j ∈ CRF \ CRF i , verifies whether all hold, randomly selects from the verified SIG j to calculate and sends it to SIG i

[0026]

[0027] i .

[0028] 5. Given the message M to be signed, each SIG i ∈ SIG calculates the hash values V = H2(M, R) and U i = V·d′ i + k′ i P1, and sends σ i = (U i , V) to CRF i . Each CRF i ∈ CRF receives information from SIG i , calculates and broadcasts σ′ i = (U′ i , V).

[0029] Verification:

[0030] The verifier (VER) receives data from each CRF. i σ′ ∈CRF i Calculate U′=∑ SIG λ i,SIG ·U′ i and verify If the signature is valid, output "accept"; otherwise, output "reject". Where λ... i,SIG For SIG i The Lagrange coefficient.

[0031] The identity-based threshold signature scheme described in this invention possesses provable security. Under the random oracle model, based on the computational Diffie-Hellman (CDH) difficulty assumption, this scheme resists adaptive chosen-message attacks and satisfies the existence-unforgeable (EUF-CMA) security requirement. Specifically, the core construction of the scheme is based on a proven secure one-party identity-based signature scheme, and distributed key generation and signing are achieved through Shamir secret sharing, ensuring the scheme's imitability. Therefore, according to the imitability theorem of identity-based threshold signatures, this threshold construction maintains the same EUF-CMA security as the underlying signature scheme. Furthermore, even after introducing CRF, due to the uniform random distribution of the rerandomization factor, adversaries cannot distinguish between the original parameters and the randomized parameters; therefore, EUF-CMA security is still satisfied after rerandomization.

Claims

1. An identity-based threshold signature algorithm suitable for blockchain-supported cryptographic reverse firewalls, characterized in that: (1) The proposed identity-based threshold signature algorithm solves the certificate management problem in traditional PKI-based public-key cryptosystems. It adopts a distributed key generation mechanism, in which users collaboratively generate signature keys, eliminating the need for a centralized KGC and the binding of users and public keys with digital certificates. This completely avoids the overhead of certificate generation, management, and revocation. Under the random oracle model, this scheme can be proven to satisfy existence-unforgeable security under adaptive chosen message attacks. (2) The proposed signature algorithm has a threshold mechanism, which can tolerate a certain number of malicious signers and has a certain degree of robustness and practicality. When generating the signature key and the signature random number, KGC and the signer respectively use Shamir secret sharing technology to generate the information required for the signature. Therefore, the algorithm can synthesize a complete signature when the number of users participating in the signature reaches a preset threshold, thereby enhancing flexibility and fault tolerance while ensuring system security. (3) The proposed scheme supports the Cryptographic Reverse Firewall (CRF) function, which can resist information leakage attacks launched by malicious insiders or external attackers. The Cryptographic Reverse Firewall can rerandomize privacy information during the signing process, ensuring that even if the keys of some participants are leaked, the system can still maintain overall security and cannot forge valid signatures, further enhancing the robustness and availability of the protocol.

2. The identity-based threshold signature algorithm for blockchain-supported cryptographic reverse firewalls according to claim 1, wherein the specific steps of the method include: (1) System setup: The system is initialized by KGC and its corresponding CRF. The security parameters are taken as input, and the re-randomized public parameters params′ are output. (2) Key Extraction: This is jointly performed by the KGC, the signer, and the corresponding CRF to extract a portion of the user's private key. The input consists of params′, the signer set SIG, the corresponding CRF set CRF, and the identity identifier ID. Each signer holds a re-randomized signature private key fragment d′ from each CRF. i . (3) Signing: This is performed jointly by multiple signers to generate a complete signature. The signature is represented by params′, the message M to be signed, and d′ held by each signer. i Given the input, output the rerandomized signature σ′. (4) Verification: Performed by the signature verifier to verify whether the signature is valid. Inputs are params′, ID, M, and σ′. If the signature is valid, output "accept"; otherwise, output "reject".

3. The identity-based threshold signature algorithm for blockchain-supported cryptographic reverse firewalls as described in claim 2, wherein the specific algorithm of the method includes: (1) System setup: i. Given security parameters, KGC generates bilinear paired tuples. And randomly select The generator P, and two hash functions secret And calculate P pub =sP, send public parameters to its CRF ii. KGC's CRF receives messages from KGC and randomly selects... And calculate P′ pub =P pub +s′P, public parameters after rerandomization (2) Key extraction: The in signers together constitute an organization with the identifier ID, let the set of signers be SIG = {SIG1, SIG2, ..., SIG3}. n The CRF set of each signer is CRF = {CRF1, CRF2, ..., CRF}. n KGC randomly selects a polynomial f. 1,i (y)=α0+α1y+α2y 2 +…+α t-1 y t-1 Where α0 = s, is all SIG i ∈SIG compute F1(i)=f1(i)Q and send it to its CRF, where l∈[0,t-1],Q=H1(ID). ii. KGC's CRF receives messages from KGC, calculates F′1(i) = F1(i) + s′, and sends it to each CRF. i ∈CRF. Each CRF i Forward the message to the corresponding SIG i Each SIG i ∈SIG will use the received F′1(i) as the signature key fragment d′ i . (3) Signature: i. Each SIG i ∈SIG random selection secret and polynomial f 2,i (y)=β i,0 +β i,1 y+β i,2 y 2 +…+β i,t-1 y t-1 For all SIG j ∈SIG\SIG i Calculate f 2,i (j) and P 1,i Promise B i,l =β i,l P is sent together to CRF i , where l∈[0,t-1]. ii. Each CRF i ∈CRF receives from SIG i Information verification If it is not true, then let P′ be true. 1,j =P 1,j Otherwise, select randomly. calculate Randomly select secret calculate and And send it to the corresponding CRF. j ∈CRF\CRF i . iii. Each CRF i ∈CRF receive from CRF j ∈CRF\CRF i Verify all information. Whether it holds true depends on the SIG that has passed the verification. j Random selection calculate And send to SIG i . iv. Each SIG i ∈ SIG receives information from the CRF i For all SIG j ∈ SIG \ SIG i Verify Whether it holds, and issue an accusation against SIG j for the unpassed verification j. The SIG j that receives at least t accusations is considered a malicious participant and will be removed from the SIG. If |SIG| < t, the protocol is aborted and the set of malicious participants is output; otherwise, each SIG i ∈ SIG calculates And R = e(P1, K′), and broadcasts P1 and R to check consistency. At this time, each CRF i ∈ CRF directly forwards the information from SIG i Each CRF i ∈ CRF receives information from CRF j ∈ CRF \ CRF i Verify whether all holds. Randomly select j from the passed verification SIG Calculate And send to SIG i . v. Given a message M to be signed, each SIG i ∈SIG calculate hash values ​​V = H2(M,R) and U i =V·d′ i +k′ i P1, and σ i =(U i (V) sent to CRF i Each CRF i ∈CRF receives from SIG i Information, calculation And broadcast σ′ i =(U′ i ,V). (4) Verification: The verifier (VER) receives data from each CRF. i σ′ ∈CRF i Calculate U′=∑ SIG λ i,SIG ·U′ i and verify If the signature is valid, output "accept"; otherwise, output "reject". Where λ... i,SIG For SIG i The Lagrange coefficient.

Images