Collaborative signature method and system based on coding

Abstract

The invention provides a coding-based collaborative signature method and system, and the method comprises the steps: an initialization center generates and distributes a global public key and a private key component according to a cryptographic parameter, and after receiving a to-be-signed message, each signature participant carries out the coding of the to-be-signed message according to the to-be-signed message, the global public key and the private key component based on a chameleon hash function; generating signature information of each signature participant, performing aggregation processing on the signature information of each signature participant by a signature aggregation party to obtain a signature set, generating a to-be-verified signature set according to the global public key, the signature set and the identity information of the signature verification party, and verifying the to-be-verified signature set according to the to-be-verified signature set. And the signature verification party performs verification processing according to the identity information of the signature verification party, the global public key, the to-be-signed message and the to-be-verified signature set, and determines whether to receive the signature set according to a verification result. According to the method, the interaction times of participants in the collaborative signature process can be reduced, the signature size can be greatly reduced, the multi-party communication burden is reduced, and the overall signature efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a coding-based collaborative signature method and system. Background Technology

[0002] Collaborative signature technology eliminates the risk of single-point private key leakage by generating signatures jointly by multiple parties and is widely used in scenarios such as financial transactions and electronic voting. However, traditional solutions rely on classical number theory problems and face the threat of being cracked by quantum computing.

[0003] Existing quantum-resistant collaborative signature technologies are mainly based on lattice cryptography. They combine the quantum-resistant properties of lattice-hard problems with a multi-party collaborative signature cryptographic scheme to resist quantum computing from breaking traditional signatures.

[0004] However, quantum-resistant collaborative signature schemes based on lattice cryptography suffer from drawbacks such as low signature efficiency, large key size, and heavy communication burden. Summary of the Invention

[0005] The purpose of this application is to provide a coding-based collaborative signature method and system to address the shortcomings of the prior art, thereby solving the problems of low signature efficiency, large key size, and heavy communication burden in the existing quantum-resistant collaborative signature schemes based on lattice cryptography.

[0006] To achieve the above objectives, the technical solution adopted in this application is as follows: Firstly, this application provides a coding-based collaborative signature method applied to a coding-based collaborative signature system, the system comprising: an initialization center, multiple signing participants, and a signature verifier; the method comprising: The initialization center generates a global public key and a private key component based on cryptographic parameters, distributes the global public key to each of the signing participants and the signature verifier, and distributes the private key component to each of the signing participants. After receiving the message to be signed, each of the signing participants generates signature information for each of the signing participants based on the Chameleon hash function according to the message to be signed, the global public key, and the private key component, and sends the signature information to the signature aggregator among the multiple signing participants; The signature aggregator aggregates the signature information of each of the signature participants to obtain a signature set. Based on the global public key, the signature set, and the identity information of the signature verifier, it generates a signature set to be verified and sends the signature set and the signature set to be verified to the signature verifier. The signature verification party performs verification based on its own identity information, the global public key, the message to be signed, and the set of signatures to be verified, and determines whether to accept the signature set based on the verification result.

[0007] Optionally, the initialization center generates a global public key and a private key component based on cryptographic parameters, including: The initialization center generates a first public key based on the cryptographic parameters; The initialization center constructs a chameleon hash function based on the cryptographic parameters and the first public key, and generates a second public key based on the chameleon hash function, a random raw vector, and a random raw message. The initialization center determines multiple invertible matrices based on the cryptographic parameters and generates a second private key based on the multiple invertible matrices; The initialization center uses the second private key, the random raw vector, and the random raw message as the private key components.

[0008] Optionally, the cryptographic parameters include: a finite field and a matrix order; The initialization center determines multiple invertible matrices based on the cryptographic parameters and generates a second private key based on the multiple invertible matrices, including: The range of matrix generation is determined based on the finite field and the matrix order; Within the range of matrix generation, multiple initial matrices of order equal to the order of the matrix are randomly generated; Perform an invertibility test on each of the initial matrices. If the invertibility result of the initial matrix is ​​invertible, then the initial matrix is ​​regarded as an invertible matrix.

[0009] Optionally, the signing participants generate signature information for each participant based on the chameleon hash function according to the message to be signed, the global public key, and the private key component, including: The signing participants generate their own signature messages; The signing participants use the signing message, the message to be signed, the private key component, and the first public key in the global public key as input parameters to the chameleon hash function, so as to generate the signing information of the signing participants through the chameleon hash function; The hash value generated by combining the signature information and the signature message is equal to the hash value corresponding to the private key component.

[0010] Optionally, the hash value corresponding to the private key component is the hash value generated by combining the random original vector and the random original message.

[0011] Optionally, the signature aggregator aggregates the signature information of each of the signing participants to obtain a signature set, including: The signature aggregator verifies whether the number of signature information is the same as the preset number of participants; If they are the same, the signature information of each of the signing participants is aggregated to obtain the signature set.

[0012] Optionally, the process by which the signature aggregator generates the signature set to be verified based on the global public key, the signature set, and the identity information of the signature verifier includes: The identity code is determined based on the cryptographic parameters; The signature verification party's identity code and the signature set are XORed to obtain the signature set to be verified.

[0013] Optionally, the signature verifier performs verification processing based on its own identity information, the global public key, the message to be signed, and the set of signatures to be verified, to obtain a verification result, including: The signature set to be verified is restored based on the identity code of the signature verification party to obtain the signature information of each signature participant; The verification result is determined based on the signature information of each signing participant, the message to be signed, and the global public key.

[0014] Optionally, determining the verification result based on the signature information of each signing participant, the message to be signed, and the global public key includes: Based on the global public key, the message to be signed, and each of the signature information, generate a hash component for each signature information; If the hash component of each signature is the same as the hash component of the second public key, the verification result is determined to be successful. If at least one hash component of a signature is different from the hash component of the second public key, the verification result is determined to be unsuccessful.

[0015] Secondly, this application provides a coding-based collaborative signature system, the system comprising: an initialization center, multiple signing participants, and a signature verification party, wherein the system is used to execute the coding-based collaborative signature method as described in the first aspect.

[0016] The beneficial effects of this application are as follows: Each signing participant can generate signature information based on the same private key component using a collision mechanism of the chameleon hash function. On the one hand, this avoids spending significant time interacting during private key generation and eliminates the need for repeated sampling and rejection processes. Even if any participant's signature is abnormal, it will not affect the signing process of other participants, thus improving overall signing efficiency. On the other hand, calculating signature information using the chameleon hash function and cryptography reduces key size and the burden of multi-party communication. Simultaneously, the signature verifier can quickly verify the signature based on the collision mechanism of the chameleon hash function. Only the signature verifier holding the global public key and whose identity information has been verified can perform verification, improving signature verification security while reducing its complexity.

[0017] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A schematic diagram of the architecture of a coding-based collaborative signature system provided in an embodiment of this application is shown; Figure 2 A flowchart of a coding-based collaborative signature method provided in an embodiment of this application is shown; Figure 3 This document illustrates a flowchart of a method for generating a private key component according to an embodiment of this application. Figure 4 This document illustrates a flowchart of a method for generating an invertible matrix according to an embodiment of this application. Figure 5 This document illustrates a flowchart of a signature information generation method provided in an embodiment of this application. Figure 6 This document illustrates a flowchart of an embodiment of the present application for aggregating signature information. Figure 7 A flowchart illustrating an aggregation process provided in an embodiment of this application is shown; Figure 8 This document illustrates a flowchart of a signature information verification method provided in an embodiment of this application. Figure 9A schematic diagram of the structure of a coding-based collaborative signature system provided in an embodiment of this application is shown. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0021] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.

[0022] Existing quantum-resistant collaborative signature technologies are mainly based on lattice cryptography. They combine the quantum-resistant properties of lattice-hard problems with a multi-party collaborative signature cryptographic scheme to resist quantum computing from breaking traditional signatures.

[0023] Specifically, lattice-based collaborative signature technology requires initially splitting the private key into multiple shares using the mathematical structure of lattice cryptography, and distributing each share to the signing participants. Only when a predetermined number of signing participants collaborate can the complete private key be recovered and a signature generated. This method ensures distributed control during the signing process. Generating the public-private key pair requires multiple rounds of interaction among the parties, thereby generating a private key trapdoor based on a lattice-hard problem.

[0024] However, this interactive method requires repeated sampling and rejection processes during collaborative signature signing. If any participant in the collaboration triggers a restart mechanism, it will affect the overall signature efficiency. Furthermore, lattice-based collaborative signature methods often have key sizes in the kilobyte range, which also increases the communication burden among multiple parties.

[0025] Based on this, this application proposes an encoding-based collaborative signature method by integrating the chameleon hash function with encoding-based cryptography. This method can not only reduce the number of interactions among participants in the collaborative signature process, but also greatly reduce the signature size, reduce the communication burden among multiple parties, and improve the overall signature efficiency.

[0026] To facilitate understanding, the chameleon hash function and encoding-based cryptography involved in the method of this application will be explained first.

[0027] The Chameleon hash function is a keyed, collision-resistant variant of hashing, encompassing key generation, hash generation, hash verification, and hash collision algorithms. When generating keys using the Chameleon hash function, only the key holder can efficiently generate hash collisions; non-holders cannot.

[0028] The input parameters for the key generation algorithm are security parameters. The algorithm can output the public key. and private key .

[0029] The input parameters for the hash generation algorithm include the public key. Random numbers and any message The algorithm can generate hash values. and random numbers .

[0030] The input parameters of the hash verification algorithm include the public key. ,information Hash value and random numbers ,like If the hash value is correct, the algorithm outputs 1; otherwise, it outputs 0.

[0031] The input parameters for the hash collision algorithm include the private key. ,information New Messages and hash value Random numbers The output parameters include a new random number. , making That is, the two messages correspond to the same hash value.

[0032] Encoding-based cryptography, as a core branch of post-quantum cryptography, relies on the decoding complexity of error-correcting codes for security, effectively resisting quantum algorithm attacks. After defining cryptographic parameters, encoding and decoding operations can be efficiently implemented through matrix multiplication and finite field operations, with quantum resistance guarantees, and can effectively reduce ciphertext expansion rate.

[0033] The method described in this application can be applied to scenarios involving multi-party collaborative signatures, such as blockchain multi-signature wallets and multi-level approval of important documents. Figure 1 The diagram shown is an architectural schematic of a coding-based collaborative signature system. Figure 1 The system includes: an initialization center, multiple signing participants, and a signature verification party. Among the multiple signing participants is a signature aggregator.

[0034] Taking a cross-chain multi-signature wallet scenario as an example, the signing participants can be authorized users of the multi-signature wallet, and the signature verification party can be the blockchain network or the wallet verification module. After each signing participant authorizes and signs the transaction content, a signature aggregator integrates the signatures of all participants and sends the integrated signature to the verification party for verification. The signature aggregator can be any of the signing participants, or other users distinct from both the signing participants and the signature verification party; this application does not impose any restrictions on this.

[0035] Next, combine Figure 2 The overall process of the coding-based collaborative signature method of this application is described, such as... Figure 2 As shown, the method includes: S201. The initialization center generates a global public key and a private key component based on cryptographic parameters, distributes the global public key to each signing participant and signature verifier, and distributes the private key component to each signing participant.

[0036] Before generating the global public and private key components, cryptographic parameters can be predefined in the initialization center, and a chameleon hash function can be predefined based on the cryptographic parameters.

[0037] Cryptographic parameters include basic positive integers , prime number Threshold between 0 and 1 , rank is of matrix random matrix linear code subset , Representing a finite field In Dimensional column vector.

[0038] Where N is the number of columns in the constraint matrix H, K is the number of rows in the constraint matrix H, k represents the number of rows in the generating matrix G, n represents the number of columns in the generating matrix G, and m represents the finite field. The number of expansion operations, where d represents the set of subsequent weight constraint vectors. The core threshold, l, is used to reserve a dimension for the weight range of subsequent signature components. Used to define the legal weight range of signature components. Matrix The generator matrix represents the error-correcting code.

[0039] Alternatively, a set of vectors with weight d can be defined based on cryptographic parameters. The weight is and The vector set between ,based on Chameleon hash function (hidden field equations, post-quantum cryptography primitives) The specific expression is .

[0040] in , and It is a random invertible matrix, operators The calculation method is defined as follows: if Vector expansion mapping Will Middle elements Mapped to The middle element, then Error vector transformation mapping Defined as ,in , This is a matrix operation operator. This is a mapping compound operator. For a permutation map or a specific linear transformation.

[0041] The initialization center can generate a first public key, a first private key, a second public key, and a second private key based on cryptographic parameters and the chameleon hash function. The first public key and the second public key are used as the global public key, and the second private key, the random raw vector, and the random raw message are used as the private key components.

[0042] Optionally, after generating the global public key and private key components, the global public key can be broadcast to each signing participant and signature verifier, and a secure transmission channel can be established between the initialization center and each signing participant to distribute the private key components to each signing participant through the secure transmission channel.

[0043] By generating a global public key and a private key component through an initialization center, distributing the global public key to all signing participants and signature verifiers, and distributing the private key component to all signing participants through a secure transmission channel, the time required for generating the public and private keys can be saved.

[0044] S202. After receiving the message to be signed, each signing participant generates signature information for each signing participant based on the message to be signed, the global public key, and the private key component using the Chameleon hash function, and sends the signature information to the signature aggregator among the multiple signing participants.

[0045] The message to be signed can be anything that requires confirmation from all parties, such as transaction content in a blockchain multisignature wallet or documents requiring multi-level approval. The signature information of the signing participants can be their confirmation information, authorization information, or their signature content regarding the message to be signed.

[0046] In one possible implementation, the initialization center or the signature aggregator can send the message to be signed to each signing participant. Each signing participant can generate its own signature information based on the message to be signed, the global public key, and the private key components, and then send the signature information to the signature aggregator.

[0047] Optionally, the signature aggregator can be any of the signing participants, or other users who do not participate in signing and are not signature verifiers.

[0048] If the collaborative signature scenario is a distributed signature scenario, the message to be signed can be distributed to each signing participant, and each signing participant can send the signature information to the signature aggregator after generating the signature information.

[0049] If the collaborative signature scenario involves hierarchical approval, and the signing participants are arranged according to the hierarchical approval relationship and pass the message to be signed layer by layer, the message to be signed can be sent to the first signing participant in the hierarchy. The first signing participant generates its own signature information based on the message to be signed, the global public key, and the private key components, and sends the signature information to the signature aggregator. Then, the message to be signed is sent to the signing participant at the next higher level, and so on, sending the message to each signing participant layer by layer, until the signing participant at the last level also generates and sends the signature information to the signature aggregator.

[0050] S203. The signature aggregator aggregates the signature information of each signing participant to obtain a signature set. Based on the global public key, the signature set, and the identity information of the signature verifier, it generates a signature set to be verified and sends the signature set and the signature set to be verified to the signature verifier.

[0051] In one possible implementation, the signature aggregator can collect the signature information of each signing participant based on the signature information required for the message to be signed. For example, it can save the identification information of the signing participants required for the message to be signed, and after receiving the signature information of each signing participant, it can confirm each signature information based on the saved identification information. After completing the collection of all signature information, it can aggregate all signature information to obtain a signature set.

[0052] The signature set can be a set obtained by concatenating the signature information.

[0053] The set of signatures to be verified can be a set of signatures bound to the identity information of the signature verifier. By binding the identity information of the signature verifier to the signature set, it can be ensured that only the signature verifier can verify the set of signatures to be verified.

[0054] S204. The signature verifier performs verification based on its own identity information, global public key, message to be signed, and signature set to be verified, and determines whether to accept the signature set based on the verification result.

[0055] Optionally, the signature verifier can determine whether it can verify the set of signatures to be verified based on its own identity information. If the identity information of the signature verifier is consistent with the identity information bound to the set of signatures to be verified, it can perform verification processing on the set of signatures to be verified based on the global public key and the message to be signed.

[0056] The verification result indicates whether the set of signatures to be verified is a valid signature set, i.e., whether the set of signatures to be verified has been tampered with, and whether the set of signatures to be verified is the signature required for the message to be signed. If the set of signatures to be verified is a valid signature set, the signature verifier accepts the signature set; otherwise, the signature verifier rejects the signature set.

[0057] In this embodiment, each signing participant can generate signature information based on the same private key component using a collision mechanism of a chameleon hash function. This eliminates the need for extensive interaction during private key generation and avoids repeated sampling and rejection processes. Even if one participant's signature is abnormal, it will not affect the signing process of other participants, improving overall signing efficiency. Furthermore, using a chameleon hash function and cryptography to calculate signature information reduces key size and the burden of multi-party communication. Simultaneously, the signature verifier can quickly verify the signature using the collision mechanism of the chameleon hash function. Only the signature verifier holding the global public key and whose identity information has been verified can perform verification, improving signature verification security while reducing its complexity.

[0058] The process by which the initialization center generates the global public key and private key components based on cryptographic parameters, as described above, is as follows: Figure 3 As shown, it includes: S301. The initialization center generates the first public key based on the cryptographic parameters.

[0059] Optionally, a subset J in the cryptographic parameters can be combined with the matrix G bytes to obtain a first private key, and a first public key can be calculated based on the first private key.

[0060] The first public key can be calculated as follows: Record the first private key... for ,calculate ,That From the original The column number appears in the set The first public key is composed of the columns in the table. for .

[0061] S302. The initialization center constructs a chameleon hash function based on cryptographic parameters and the first public key, and generates a second public key based on the chameleon hash function, a random raw vector, and a random raw message.

[0062] Wherein, the random original vector can be from A vector randomly selected from the source; the original random message can be from... A vector randomly selected from the data.

[0063] Optionally, the second public key can be generated using the hash generation algorithm in the Chameleon hash function. The first public key, the random original vector, and the random original message are input into the hash generation algorithm. The hash generation algorithm executes a predefined trapdoor function, which is constructed based on the hidden field equation or discrete logarithm. Through a series of calculations in a finite field, it finally outputs a hash value h of fixed length and a random number p. The hash value h and the random number p are then combined to obtain the second public key.

[0064] S303. The initialization center determines multiple invertible matrices based on cryptographic parameters and generates a second private key based on the multiple invertible matrices.

[0065] Optionally, the range of invertible matrices to be generated can be determined based on cryptographic parameters, and multiple invertible matrices can be randomly determined within the range of generation. The second private key can be obtained by combining the invertible matrices.

[0066] S304. The initialization center uses the second private key, the random raw vector, and the random raw message as private key components.

[0067] Optionally, the second private key, the random original vector, and the random original message can be used as private key components, and the private key components can be sent to each signing participant through a secure transmission channel.

[0068] Optionally, cryptographic parameters include: finite field, matrix order.

[0069] like Figure 4 As shown, the process by which the initialization center determines multiple invertible matrices based on cryptographic parameters and generates a second private key based on these matrices includes: S401. Determine the range of matrix generation based on the finite field and the matrix order.

[0070] The range of matrix generation can be a finite field. n-order general linear group .

[0071] S402. Within the range of matrix generation, randomly generate multiple initial matrices of order equal to the order of the matrix.

[0072] S403. Perform an invertibility test on each initial matrix. If the invertibility result of the initial matrix is ​​invertible, then the initial matrix is ​​regarded as an invertible matrix.

[0073] Within the scope of matrix generation, an n-order square matrix can be randomly selected as the initial matrix using a cryptographically secure random number generator.

[0074] For example, the determinant of the candidate matrix can be calculated. If the determinant is not equal to 0, the matrix is ​​retained as an invertible matrix. If the determinant is equal to 0, the candidate matrix is ​​regenerated and verified until an invertible matrix is ​​obtained.

[0075] The following is a further explanation of how the signing participants generate their signature information based on the chameleon hash function, the message to be signed, the global public key, and the private key components. Figure 5 As shown, the above step S202 includes: S501, The signing participants generate their own signature messages.

[0076] S501, The signing participants take the signing message, the message to be signed, the private key component, and the first public key in the global public key as input parameters of the Chameleon hash function, so as to generate the signing information of the signing participants through the Chameleon hash function.

[0077] Specifically, the hash value generated by combining the signature information and the signature message is equal to the hash value corresponding to the private key component. The hash value corresponding to the private key component is the hash value generated by combining a random raw vector and a random raw message.

[0078] Optionally, the signature message can be the signature of the signing participants. The signing participants can pre-generate and save their own signature messages. When they receive a message to be signed, they call their own signature messages and combine them with the message to be signed, the private key component, and the global public key to generate the signature information of the signing participants.

[0079] Signature information is the confirmation information, authorization information, or signature content of the signer regarding the signed message.

[0080] Alternatively, the private key component, the message to be signed, and the signing message can be input into the hash collision algorithm in the Chameleon hash function. The random number output by the algorithm is used as the signature information of the signing participants. The hash value generated by combining the signature information and the signature message is equal to the hash value generated by combining the random original vector and the random original message. And signature information Restricted to a set middle.

[0081] In this embodiment, the trapdoor property of the Chameleon hash function ensures that only legitimate participants who possess the private key can generate a valid signature, thus preventing unauthorized forgery. At the same time, it allows each signing participant to generate signature information independently, avoiding multiple rounds of interaction and improving collaboration efficiency.

[0082] The following section further explains the steps taken by the aforementioned signature aggregator to aggregate the signature information of each participating party and obtain the signature set. Figure 6 As shown, step S203 above includes: S601. The signature aggregator verifies whether the number of signature information is the same as the preset number of participants.

[0083] S602. If they are the same, the signature information of each signing participant is aggregated to obtain a signature set.

[0084] Optionally, a minimum number of signatures required for the message to be signed can be preset, or the identification information of the signing participants to be obtained can be preset. The signature information includes the identification information of the signing participants. After receiving the signature information, the signature aggregator can first compare the identification information in the signature information with the preset identification information of the participants. If they match, the signature information can be considered as valid signature information, and the count value of the signature information can be incremented by 1. When the count value equals the preset number of participants, the signature information of each signing participant can be aggregated to obtain a signature set.

[0085] For example, assuming the message to be signed requires signature information from signer 1, signer 2, and signer 3, the message to be signed can be sent to signer 1, signer 2, and signer 3, and the signature information 1, signature information 2, and signature information 3 returned by signer 1, signer 2, and signer 3 can be received. The signature information includes the identification information of the signer. After receiving the signature information, the signature aggregator can compare the identification information contained in the signature information with the pre-saved identification information of signer 1, signer 2, and signer 3. If the comparison is consistent, the count value is incremented by 1. When the count value is equal to 3, the received signature information 1, signature information 2, and signature information 3 are aggregated to obtain a signature set.

[0086] In this embodiment, the signature aggregator verifies the signature information before performing the aggregation process, which ensures the integrity of the signature information and improves the reliability of collaborative signatures.

[0087] The following is a further explanation of the process by which the aforementioned signature aggregator generates a set of signatures to be verified based on the global public key, the signature set, and the identity information of the signature verifier. Figure 7 As shown, step S203 above includes: S701. Determine the identity code based on cryptographic parameters.

[0088] S702. Perform an XOR operation on the identity code of the signature verification party and the signature set to obtain the signature set to be verified.

[0089] Optionally, the identity code is a mathematical code used to uniquely represent the identity of the signature verifier, and can be found in a set. The identity code of the signature verification party is predetermined in the middle. and calculate , The XOR operator is used to perform an XOR operation on the identity code of the signature verifier and all signature information one by one, generating individual signature information bound to the identity information. These signatures are then combined into a single set to obtain the signature set to be verified. .

[0090] In this embodiment, by binding the identity code, the signature can only be restored and verified by the target verifier, preventing the signature from being stolen or tampered with by other unauthorized verifiers. Furthermore, the XOR operation is a lightweight logical operation, requiring no complex matrix or modulo operations, and does not increase the data size of the signature set.

[0091] The following is a further explanation of how the aforementioned signature verifier performs verification based on its own identity information, global public key, message to be signed, and set of signatures to be verified, and obtains the verification result. Figure 8 As shown, step S204 above includes: S801. Based on the identity code of the signature verification party, restore the set of signatures to be verified to obtain the signature information of each signature participant.

[0092] Optionally, the signature verifier can perform an XOR operation on the identity code and each signature information in the signature set to be verified to obtain the signature information of each signing participant.

[0093] S802. Determine the verification result based on the signature information of each signing participant, the message to be signed, and the global public key.

[0094] The signature verifier can verify the signature information based on the hash verification algorithm in the Chameleon hash function. The signature information of each signing participant, the message to be signed, and the first public key are used to calculate the hash value. The calculated hash value is then compared with the hash value of the second public key. If they are the same, the verification is successful.

[0095] Furthermore, the process of determining the verification result based on the signature information of each signing participant, the message to be signed, and the global public key includes: Based on the global public key, the message to be signed, and each signature information, generate the hash component of each signature information.

[0096] If the hash component of each signature is the same as the hash component of the second public key, the verification result is determined to be successful. If at least one hash component of a signature is different from the hash component of the second public key, the verification result is determined to be unsuccessful.

[0097] Optionally, it can be based on The hash components of each signature are calculated.

[0098] If the generated hash component is the same as the hash component of the second public key, the verification passes and the signature verifier can receive the signature set. If at least one hash component of the signature information is different from the hash component of the second public key, the verification fails and the signature verifier refuses to receive the signature set.

[0099] Based on the same inventive concept, this application also provides an encoding-based collaborative signature system corresponding to the encoding-based collaborative signature method. Since the principle of the system in this application is similar to the encoding-based collaborative signature method described above, the implementation of the system can refer to the implementation of the method, and the repeated parts will not be described again.

[0100] like Figure 9 The diagram shown is a schematic representation of the overall architecture of a coding-based collaborative signature system. Figure 9 The system includes: an initialization module, a collaborative signature module, a verification module, and a key management module.

[0101] The system comprises the following modules: An initialization module, deployed at the initialization center, generates a global public key and private key components. A collaborative signature module, distributed across all signing participants, calculates partial signatures based on the private key and a chameleon hash collision algorithm. The signature aggregator can also merge signatures and embed the identity of the signature verifier. A verification module, deployed at the signature verifier, checks the consistency between the verifier's identity and the collaborative signature. A key management module can be deployed at the initialization center, all signing participants, and the signature verifier. The key management module at the initialization center stores and distributes private key components, managing the lifecycle of fragmented keys. Key management modules at each signing participant and signature verifier store and manage the lifecycle of fragmented keys.

[0102] The initialization module includes a parameter configuration interface, a key generation interface, and a hash initialization interface. The parameter configuration interface is used to define cryptographic parameters, the key generation interface is used to generate the global public key and private key components, and the hash initialization interface is used to define the chameleon hash function.

[0103] The collaborative signature module includes partial signature interfaces, signature aggregation interfaces, and verifier binding interfaces. Signature participants can call partial signature interfaces to generate signature information, signature aggregators can call signature aggregation interfaces to complete signature aggregation processing, and signature aggregators can call verifier binding interfaces to achieve pre-binding of signature verifiers.

[0104] The verification module includes an identity verification interface, a hash comparison interface, and a rejection trigger interface. The signature verifier can call the identity verification interface to verify the identity of the set of signatures to be verified, call the hash comparison interface to perform the above S802 steps to perform hash comparison, and call the rejection trigger interface when the comparison fails.

[0105] The key management module includes a private key storage component, a distribution control interface, and a lifecycle interface. Each signing participant can store their private key components through the private key storage component. The initialization center can call the distribution control interface to distribute the global public key and its components. Each signing participant and signature verifier can manage the lifecycle of the global public key and its components by calling the lifecycle interface.

[0106] In this embodiment, each signing participant can generate signature information based on the same private key component using a collision mechanism of a chameleon hash function. This eliminates the need for extensive interaction during private key generation and avoids repeated sampling and rejection processes. Even if one participant's signature is abnormal, it will not affect the signing process of other participants, improving overall signing efficiency. Furthermore, using a chameleon hash function and cryptography to calculate signature information reduces key size and the burden of multi-party communication. Simultaneously, the signature verifier can quickly verify the signature using the collision mechanism of the chameleon hash function. Only the signature verifier holding the global public key and whose identity information has been verified can perform verification, improving signature verification security while reducing its complexity.

[0107] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0108] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0109] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0110] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0111] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0112] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A collaborative signature method based on encoding, characterized in that, An application is made to a coding-based collaborative signature system, the system comprising: an initialization center, multiple signing participants, and a signature verifier; the method comprises: The initialization center generates a global public key and a private key component based on cryptographic parameters, distributes the global public key to each of the signing participants and the signature verifier, and distributes the private key component to each of the signing participants. After receiving the message to be signed, each of the signing participants generates signature information for each of the signing participants based on the Chameleon hash function according to the message to be signed, the global public key, and the private key component, and sends the signature information to the signature aggregator among the multiple signing participants; The signature aggregator aggregates the signature information of each of the signature participants to obtain a signature set. Based on the global public key, the signature set, and the identity information of the signature verifier, it generates a signature set to be verified and sends the signature set and the signature set to be verified to the signature verifier. The signature verification party performs verification based on its own identity information, the global public key, the message to be signed, and the set of signatures to be verified, and determines whether to accept the signature set based on the verification result.

2. The method according to claim 1, characterized in that, The initialization center generates a global public key and a private key component based on cryptographic parameters, including: The initialization center generates a first public key based on the cryptographic parameters; The initialization center constructs a chameleon hash function based on the cryptographic parameters and the first public key, and generates a second public key based on the chameleon hash function, a random raw vector, and a random raw message. The initialization center determines multiple invertible matrices based on the cryptographic parameters and generates a second private key based on the multiple invertible matrices; The initialization center uses the second private key, the random raw vector, and the random raw message as the private key components.

3. The method according to claim 2, characterized in that, The cryptographic parameters include: finite field and matrix order; The initialization center determines multiple invertible matrices based on the cryptographic parameters, including: The range of matrix generation is determined based on the finite field and the matrix order; Within the range of matrix generation, multiple initial matrices of order equal to the order of the matrix are randomly generated; Perform an invertibility test on each of the initial matrices. If the invertibility result of the initial matrix is ​​invertible, then the initial matrix is ​​regarded as an invertible matrix.

4. The method according to claim 1, characterized in that, The signing participants generate signature information for each participant based on the chameleon hash function, according to the message to be signed, the global public key, and the private key components, including: The signing participants generate their own signature messages; The signing participants use the signing message, the message to be signed, the private key component, and the first public key in the global public key as input parameters to the chameleon hash function, so as to generate the signing information of the signing participants through the chameleon hash function; The hash value generated by combining the signature information and the signature message is equal to the hash value corresponding to the private key component.

5. The method according to any one of claims 1-4, characterized in that, The hash value corresponding to the private key component is the hash value generated by combining the random raw vector and the random raw message.

6. The method according to claim 1, characterized in that, The signature aggregator aggregates the signature information of each of the signature participants to obtain a signature set, including: The signature aggregator verifies whether the number of signature information is the same as the preset number of participants; If they are the same, the signature information of each of the signing participants is aggregated to obtain the signature set.

7. The method according to claim 1, characterized in that, The process by which the signature aggregator generates the signature set to be verified based on the global public key, the signature set, and the identity information of the signature verifier includes: The identity code is determined based on the cryptographic parameters; The signature verification party's identity code and the signature set are XORed to obtain the signature set to be verified.

8. The method according to claim 1, characterized in that, The signature verifier performs verification based on its own identity information, the global public key, the message to be signed, and the set of signatures to be verified, and obtains the verification result, including: The signature set to be verified is restored based on the identity code of the signature verification party to obtain the signature information of each signature participant; The verification result is determined based on the signature information of each signing participant, the message to be signed, and the global public key.

9. The method according to claim 7, characterized in that, The step of determining the verification result based on the signature information of each signing participant, the message to be signed, and the global public key includes: Based on the global public key, the message to be signed, and each of the signature information, generate a hash component for each signature information; If the hash component of each signature is the same as the hash component of the second public key, the verification result is determined to be successful. If at least one hash component of a signature is different from the hash component of the second public key, the verification result is determined to be unsuccessful.

10. A collaborative signature system based on encoding, characterized in that, The system includes: an initialization center, multiple signing participants, and a signature verification party. When the system is running, it is used to execute the coding-based collaborative signature method as described in any one of claims 1-9.

Images