Auditable aggregate signature discloses a keyless verification method, system, device and storage medium

Abstract

The application discloses an auditable aggregation signature disclosure and keyless verification method, system, device and storage medium, and the method comprises the following steps: a coordinator selects one from three preset public modes, and determines the signature quantity target to be disclosed in plaintext; each signer samples a commitment vector and signs a binding string, the coordinator encapsulates a symmetric key, calculates the rule vector ciphertext element of each signature, and accumulates an aggregation anchor value; a set of forced public index sets uncontrollable by the coordinator is derived through a hash function; the forced public index sets are combined with the actively specified public index sets to remove the duplicate, the remaining ciphertext is reserved, and an evidence package is assembled; an audit party does not hold a private key, and five structural verifications are performed on the evidence package; an arbitration party unseals the symmetric key, restores the commitment information, reconstructs the binding string, and calls a verification function to verify the real signature. The application makes the public subset composed of the autonomous subset of the coordinator and the cryptographic forced derived subset, and the coordinator cannot implement selective disclosure cheating.

Description

Technical Field

[0001] This invention belongs to the fields of post-quantum aggregation cryptography and regulatory auditing technology, and relates to an auditable aggregation signature disclosure and keyless verification method, system, device and storage medium. Background Technology

[0002] In post-quantum aggregated signature scenarios, after the coordinator aggregates multiple signatures into a single evidence package and publishes it to a public link, integrity verification is required by third parties who do not hold the arbitration private key, such as regulators, external auditors, and notaries. In implementing this invention, the inventors discovered at least the following problems in the prior art:

[0003] (1) Existing Verifiable Encryption Signature (VES) schemes require the auditor to have the decryption key to verify, which undermines the confidentiality premise of KEM packets.

[0004] (2) Although Fiat-Shamir transformation (FSwBC) achieves keyless verification, its challenge-derived inputs are only bound to a portion of the context and do not include all public fields (messages, algorithm tags, KEM ciphertext, public mode parameters, etc.), leaving room for replay and context tampering.

[0005] (3) Existing selective disclosure schemes (such as Bulletproofs range proofs, Anonymous Credentials, etc.) allow the aggregate initiator to choose the disclosure subset entirely at its own discretion, which may lead to the coordinator making selective disclosures to conceal unfavorable evidence.

[0006] Representative prior art of selective disclosure and editable disclosure includes: redactable signature (which allows arbitrary substrings of a signed document to be deleted without interaction with the original signer) proposed by Johnson, Molnar, Song, and Wagner at CT-RSA 2002; sanitizable signature (which allows a semi-trusted sanitizer to modify parts of the signed message with restrictions) proposed by Ateniese, Chou, de Medeiros, and Tsudik at ESORICS 2005 (LNCS 3679); and Bulletproofs concise zero-knowledge scope proof (CryptologyePrint Archive 2017 / 1066) proposed by Bünz, Bootle, Boneh, Poelstra, Wuille, and Maxwell at IEEE S&P 2018. While the above schemes support selective disclosure or scope proof of signature content, the disclosure subset is entirely chosen by the disclosing party (signer, cleanser, or prover), and there is no mechanism to force them to disclose parts that are unfavorable to themselves. Therefore, there is room for the disclosing party to cheat by selectively disclosing in order to conceal unfavorable evidence. Furthermore, its verification usually requires specific commitments or public parameters, and it does not provide an interface for third parties to verify the structural integrity of aggregated evidence packages without holding any private keys.

[0007] Therefore, there is an urgent need for an auditable aggregate signature reveal and keyless verification method. Summary of the Invention

[0008] To address the aforementioned issues, this invention provides an auditable aggregate signature disclosure and keyless verification method. Based on aggregate signatures, an auditable disclosure protocol is introduced, dividing the public subset into the union of the coordinator's self-disclosed subset and the subset forcibly derived by FS-CCB, thus preventing the coordinator from engaging in selective disclosure fraud.

[0009] Another objective of this invention is to provide an auditable aggregate signature disclosure and keyless verification system.

[0010] A third objective of this invention is to provide a computer device.

[0011] A fourth objective of this invention is to provide a computer-readable storage medium.

[0012] The technical solution adopted in this invention is an auditable aggregate signature disclosure and keyless verification method, comprising the following steps:

[0013] S1, the coordinator selects one of the three preset disclosure modes to determine the target number of signatures that need to be disclosed in plaintext in this aggregation;

[0014] S2, each signer samples a commitment vector in the rule vector space, concatenates the hash value of the commitment vector with their own message to be signed to form a binding string, and calls their respective post-quantum signature algorithm to sign the binding string to obtain the real signature; the coordinator performs key encapsulation on the arbitrator's public key to obtain the key encapsulation ciphertext and symmetric key, derives a random vector for each signer using the symmetric key as a seed, performs block circular convolution operation on each signer's commitment vector and their random vector to obtain the rule vector ciphertext element corresponding to the signer, and accumulates all rule vector ciphertext elements according to the block circular convolution operation to obtain the aggregate anchor value;

[0015] S3, the coordinator inputs the public context of the evidence package into the hash function in a fixed order, outputs a random byte string, and deterministically derives a set of mandatory public indexes that are uncontrollable by the coordinator.

[0016] S4, the coordinating party merges the actively designated public index set with the forced public index set to form a final public set, includes the plaintext signatures belonging to this set in the public record, and does not include the remaining indexes in the plaintext signatures but retains the ciphertext elements of the rule vector, and assembles the evidence package;

[0017] S5, the auditor does not hold the private key and performs structural checks on the evidence package, including verifying the consistency of mandatory public index derivation, the consistency between the final public set and the public records, the legality of the public signature field format, and the legality of the ciphertext structure. If all of them pass, the structure is legal.

[0018] S6, the arbitrator uses the private key to unblock the symmetric key, restores the commitment information of each signature in the public record item by item, reconstructs the binding string, and calls the corresponding verification function according to the algorithm label to verify the real signature;

[0019] In particular, the format validity verification in S5 and the call to the verification function in S6 are based on the preset algorithm registry. This registry uses the algorithm tag as the key to record the public key byte size, signature byte size, key pair generation function, signature function and verification function of each signature algorithm, so as to support the unified scheduling and verification of heterogeneous signature algorithms.

[0020] Furthermore, in S1, the three preset disclosure modes include:

[0021] The compact encryption mode means that no single signature is published in plaintext, and all signatures are stored in ciphertext. In this mode, the target number of signatures is zero, and both the forced public index set and the final public set are empty sets.

[0022] In the partial public mode, the public subset consists of a list of signature indexes that must be published in plaintext, which is actively specified by the coordinator, and a list of cryptographically derived indexes. In this mode, the target number of signatures is greater than zero and less than the total number of signers.

[0023] In the fully public mode, all signatures are attached to the evidence package in plaintext form. In this case, the final public set is a set consisting of all signature indexes.

[0024] Furthermore, in S3, the public context of the evidence package is arranged in the following fixed order, consisting of nine segments: a fixed-domain separation prefix string, the arbitrator's public key, all message content to be aggregated, the algorithm label used by each signer, the digest of each signer's public key, the key encapsulation ciphertext, the aggregation anchor value, the total number of signers and the target number of publicly disclosed signatures, and the public index list actively specified by the coordinator; wherein the fixed-domain separation prefix string is used to distinguish this derivation from hash calls for other purposes.

[0025] Furthermore, in S3, the specific method for deriving the mandatory public index set is as follows:

[0026] The list of publicly available indexes proactively specified by the coordinator is recorded as the used set;

[0027] The random byte string output by the hash function is sliced ​​into fixed-length segments and converted into integers. The candidate index is obtained by taking the modulo of the total number of signers. The value of the candidate index ranges from 0 to the total number of signers minus one. If the candidate index is not in the used set, it is selected into the forced public set and simultaneously added to the used set. This process is repeated until the number of elements in the forced public set equals the target number of signatures. The final number of elements in the public set is the sum of the target number of signatures and the number of signatures actively disclosed by the coordinator.

[0028] Furthermore, in S2, the block circular convolution operation is defined on the rule vector space and has invertibility. Each rule vector participating in the operation has a unique inverse element, which enables the arbitrator holding the symmetric key to accurately reconstruct the corresponding commitment vector from the ciphertext elements of the individual rule vector without approximate or fault-tolerant decoding; while the auditor who does not hold the symmetric key cannot obtain any commitment vector information from the ciphertext elements of the rule vector.

[0029] The number of rule vector ciphertext elements in the evidence package is the same as the total number of signers and corresponds one-to-one with each signer; the rule vector ciphertext elements are different from the key-encapsulated ciphertext, which is a single ciphertext data block generated by encrypting the symmetric key using a key encapsulation mechanism, and is used to securely transmit the symmetric key to the arbitrator.

[0030] Furthermore, in S5, the structural verification specifically includes the following five items:

[0031] The first step is to recalculate the mandatory public index set in the manner of S3 and compare it with the set declared in the evidence package;

[0032] The second step is to verify that the final public index set matches the actual index set contained in the public records.

[0033] Thirdly, for each publicly signed record, verify that the signer's public key and the byte length of the actual signature value are consistent with the declaration of the corresponding entry in the algorithm registry;

[0034] The fourth step is to verify that each rule vector ciphertext element conforms to the preset block structure, that is, each block contains one and only one non-zero element.

[0035] The fifth item is to verify the validity of the length of each top-level ciphertext field and binding string in the evidence package. The binding string is a concatenation string of the message and commitment hash corresponding to each signature.

[0036] Furthermore, the post-quantum signature algorithms used by each signer are allowed to be different, and the algorithm registry simultaneously registers at least two signature algorithms selected from ML-DSA, Falcon, and SLH-DSA.

[0037] Furthermore, in S4, for each index belonging to the final public set, the public record includes, in addition to the real signature of the index, the signer's public key of the index, and the algorithm label of the index, the commitment vector and the random vector of the index; in S5, the auditor, without holding any private key or symmetric key, further performs the following for each index belonging to the final public set: verifying that the ciphertext element of the index's rule vector is equal to the block circular convolution of the commitment vector and the random vector; and calling the corresponding verification function according to the algorithm label, using the binding string obtained by concatenating the hash value of the commitment vector with the index message to verify the real signature; thereby completing the cryptographic verification of the published signature without holding the symmetric key.

[0038] Disclosing the random vectors does not compromise the confidentiality of the undisclosed indices: each random vector is derived sequentially by index from the symmetric key using an extensible output function. Disclosing some of these vectors neither reveals the symmetric key nor causes the random vectors of the remaining indices to lose their pseudo-randomness. Therefore, the ciphertext elements of the regular vectors of the undisclosed indices remain indistinguishable from the uniform distribution in the regular vector space, and their commitment vectors are not leaked. Thus, the auditing capability of this embodiment forms two levels: performing five structural checks on all k indices, and further performing the aforementioned cryptographic verification on the disclosed indices. Correspondingly, the arbitrator holding the symmetric key can recover the commitment vectors of all k indices and complete the verification of the genuine signature for the disclosed indices. In the implementation where the evidence package carries the genuine signature ciphertext item by item, the arbitrator's verification scope for the genuine signature is extended to all k indices. This elevates the auditor's verification conclusion from "structurally valid" to "cryptographically valid."

[0039] Furthermore, in S2, the coordinator derives an authentication encryption key from the symmetric key using an extensible output function and a first domain separation prefix, wherein the first domain separation prefix is ​​different from the domain separation prefix used to derive the random vector; the coordinator uses a one-time initial vector encoded with a fixed byte length from the signer index as a random number, and uses the concatenation of the aggregate anchor value, the key-encapsulated ciphertext, the signer's algorithm tag, and the signer index as additional authentication data to perform authentication encryption on the signer's real signature, obtaining the signer's true signature ciphertext; in S4, the evidence packet carries the true signature in each of the signer indices. In S6, after decrypting the symmetric key, the arbitrator derives the authentication encryption key and the one-time initialization vector in the same manner as in S2. For each signer, the arbitrator decrypts and authenticates the true signature ciphertext, obtaining the signer's true signature. The arbitrator then concatenates the hash value of the commitment vector recovered from the ciphertext element of the index's rule vector with the message to be signed at that index to obtain the binding string. The arbitrator then calls the corresponding verification function according to the algorithm label of that index, thereby verifying the true signatures of all k signers one by one. The auditor, who does not hold the symmetric key, cannot decrypt any of the true signature ciphertexts and can only perform a structural verification on its byte length.

[0040] An auditable aggregate signature revealing and keyless verification system, employing the aforementioned auditable aggregate signature revealing and keyless verification method, includes:

[0041] The public mode selection module is used to select one of three preset public modes and determine the target number of signatures that need to be publicly disclosed in plaintext in this aggregation.

[0042] The aggregation and encapsulation module is used to perform key encapsulation on the arbitrator's public key to obtain key encapsulation ciphertext and symmetric key. Using the symmetric key as a seed, a random vector is derived for each signer. The ciphertext elements of the rule vector of each signer are calculated and accumulated to obtain the aggregation anchor value.

[0043] The forced derivation module is used to input the public context of the evidence package into a hash function in a fixed order, and derive a set of forced public indexes that are uncontrollable by the coordinator.

[0044] The evidence package assembly module is used to merge and deduplicate the actively specified public index set and the forced public index set to form a final public set, and assemble the public evidence package accordingly.

[0045] The keyless structure verification module allows the auditor to perform the above five structure verifications on the evidence package without holding any private key, and outputs the verification conclusion and the reason for failure.

[0046] The distribution verification module allows the arbitrator to unseal the symmetric key with their private key when a decision is needed, recover the commitment vector item by item from all signer indices, reconstruct the binding string for each signature in the public record, and schedule the corresponding verification function according to the algorithm label to complete the verification of the real signature; when the evidence package carries the ciphertext of the real signature item by item, this module completes the verification of the real signature for all k signers.

[0047] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the aforementioned auditable aggregate signature disclosure and keyless verification method.

[0048] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described auditable aggregate signature disclosure and keyless verification method.

[0049] The beneficial effects of this invention are:

[0050] 1. This invention proposes three optional interface modes with different granularities of disclosure: COMPACT, PARTIAL, and FULL. In the PARTIAL mode, the space for malicious manipulation of the final disclosed set by the coordinator is compressed to almost zero because the coordinator's actively disclosed list (user_revealed) must be disclosed along with the evidence package, and any adjustments are publicly visible. The index list fs_revealed, however, is cryptographically derived and cannot be predicted or manipulated by the coordinator. In the COMPACT mode, no individual signature is disclosed in plaintext; or all signatures are sealed in the package as certified encrypted ciphertext. The auditor can only perform structural verification of the aggregate anchor value and the ciphertext elements of each rule vector. Without the participation of the arbitrator, the signature content is completely unreadable by the auditor.

[0051] 2. This invention proposes the FS-CCB (Fiat-Shamir Choosable-Context Binding) derivation formula, which incorporates nine segments of public evidence packet context (fixed field separation prefix, arbitrator's public key, message content, algorithm label, signer's public key digest, KEM ciphertext, aggregation anchor, number of signatures, number of signatures to be disclosed in plaintext in the aggregation, and the coordinator's proactive disclosure list) into SHAKE-256, thereby deriving the mandatory disclosure subset fs_revealed. The final disclosure set is the union of this subset and the coordinator's autonomous subset. The mandatory subset is determined by the unidirectional derivation of all public fields by SHAKE-256, and is unpredictable and uncontrollable by the coordinator. This preserves the space for compliant operations while suppressing selective disclosure fraud. The disclosure subset of editable and sanitized signatures is entirely selected by the disclosing party and contains no mandatory disclosure constraints. The FS-CCB input fields can be flexibly expanded (e.g., adding timestamps, chain height, and other regulatory supplementary contexts in the future), while the derivation formula remains unchanged.

[0052] 3. This invention proposes a five-step keyless verification process, allowing regulators / auditors to complete structural integrity verification without holding any KEM private keys. With 13 signers, nine public context segments, and 7 signatures that need to be published in plaintext in the aggregation, the measured FS-CCB derivation latency for demonstration parameters (8,2,3) is approximately 0.051 milliseconds, and the total latency for the five verification steps is approximately 0.106 milliseconds. The corresponding latency for NIST L1 production parameters (160,4,3) is 0.089 milliseconds and 0.861 milliseconds, respectively. The verification overhead increases approximately linearly with the number of signers, while the encoding size of the aggregation anchor value remains constant and is independent of the number of signers.

[0053] 4. This invention introduces a two-layer public subset merging mechanism, which enables the coordinator to both proactively disclose specific indexes according to business strategies and be forced to disclose at least fs_revealed.

[0054] The industrial applicability of this invention lies in the following: It can be applied to regulatory auditing scenarios for post-quantum aggregated signatures, such as compliance audits of daily large-value suspicious transaction reports aggregated signatures from multiple bank nodes on a consortium blockchain by financial regulatory agencies, anti-money laundering compliance audits of cross-chain clearing hubs, and third-party evidence verification through notarization, arbitration, etc. This invention enables third parties (regulators, auditors, and notaries) without any private keys to complete keyless structural integrity verification of aggregated evidence packages while maintaining the privacy of the key encapsulation mechanism, and suppresses selective disclosure cheating by coordinating parties through cryptographically enforced subset disclosure. This invention can be implemented as a software product and deployed on a large scale on general-purpose computer devices such as personal computers, servers, or network equipment, thus possessing excellent industrial applicability. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 This is the interface decision diagram disclosed in the third mode of the present invention.

[0057] Figure 2 This is a sequence diagram of the nine-segment derivation input of FS-CCB according to an embodiment of the present invention.

[0058] Figure 3 This is a flowchart of subset formation disclosed in an embodiment of the present invention.

[0059] Figure 4 This is a flowchart of the five verification procedures in an embodiment of the present invention.

[0060] Figure 5 This is a role relationship diagram of the auditor, coordinator, and arbitrator in an embodiment of the present invention; in the diagram, 10—coordinator; 20—auditor; 30—arbitrator.

[0061] Figure 6 This is a flowchart of an embodiment of the present invention. Detailed Implementation

[0062] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0063] In this embodiment of the invention, the symbol ⊙ refers to the regular vector space R. B,s,q This is a custom block-based circular convolution binary operation in R (abbreviated as R), not any existing standard mathematical operation. The physical meaning of each parameter is as follows:

[0064] B represents the total number of blocks into which the vector is divided;

[0065] s represents the number of slots or window size in each block (i.e., the size of the set of non-zero position values ​​{0,1,…,s-1} corresponding to a single block);

[0066] q represents the space of non-zero elements in each block, and q is required to be a prime number, corresponding to the finite field F. q The rank.

[0067] Representation convention of regular vector space: for any σ∈R B,s,q Composed of B pairs (p) b ,v b ) b∈[B] The complete representation, where [B]={0,1,…,B-1} represents the block index set; p b ∈{0,…,s-1} is the position of the unique non-zero element within the b-th block (a window of length s) of σ; v b ∈{1,…,q-1} is the value of the non-zero element.

[0068] σ is a general wildcard element of the regular vector space R, used to define group operations.

[0069] For any σ=(p b σ , v b σ ) b∈[B] ∈R and e=(p b e , v b e ) b∈[B] ∈R, the output σ⊙e∈R of its ⊙ operation is defined block by block by the following formula:

[0070]

[0071] Where: superscripts σ and e are used to distinguish the block positions / values ​​of two operands themselves, p b σ Let σ be the position of the b-th block, and v be the position of the b-th block. b σ p is the non-zero value of the b-th block of σ. b e Let e ​​be the position of the b-th block, v b eThe non-zero value of the b-th block of e; the subscript block b indicates the b-th block of the output vector; mods and modq are the values ​​at positions Z and Z, respectively. s The summation is performed in the cyclic group of integer addition modulo s, where the sum is in the finite field F. q Modulo operation of multiplication in a finite field of q elements, taking prime numbers q.

[0072] The operation involves partitioning the data at position Z. s The summation and block values ​​in F q Block-wise joint operation of multiplication.

[0073] (R, ⊙) mathematically constitute a finite commutative group, possessing the following five algebraic properties, upon which the proof of the decodability of this embodiment relies:

[0074] (i) Closure: σ⊙e∈R (its position is still in [0,s] and its value is still nonzero, so it is still a valid regular vector).

[0075] (ii) Associative law: (a⊙b)⊙c = a⊙(b⊙c);

[0076] (iii) Commutative law: a⊙b = b⊙a;

[0077] (iv) Unit: 1 R =((0,1),(0,1),…,(0,1)), is composed of B (0,1) pairs;

[0078] (v) Inverse: any σ = (p b , v b ) b∈[B] The inverse σ -1 From the block binary ((-p) b )mods, v b q-2 modq) is given, where v b q-2 modq is v b In F q The inverse of multiplication on (by Fermat's Little Theorem, since q is a prime number).

[0079] Property (i) guarantees that the result of accumulating any number of R elements is still an R element, and the encoding size is constant; Property (v) guarantees that the arbitrator, given e... i In the case of c i =σ PRC ⊙e i Precise recovery of σ PRC , σ PRC =c i ⊙e i -1There is no approximation error.

[0080] The reasons for selecting the above parameters (B, s, q) are as follows: (1) The demonstration parameters (8, 2, 3) and the NIST L1 production parameters (160, 4, 3) are the preferred values ​​after weighing the options: q is the smallest odd prime number 3, so that the finite field multiplication group is exactly a binary cyclic group and the modular multiplication cost is the lowest; s is 2 or 4, so that the positional components are encoded with 1~2 bits and aligned with the byte boundaries; B determines the size of the regular vector space |R|=(s(q-1)) B Let L1 be 160 so that |R| = 8 160 =2 480 (2) Although q=3 and s=2 are common small moduli in lattice ciphers and encoded ciphers, combining them to construct a fixed-length aggregation anchor independent of the number of signers and an auditable revealing structure is not a conventional practice in this field. It is a special design of this invention for post-quantum aggregation auditing scenarios. (3) This combination makes the number of encoded bytes of the aggregation anchor and each rule vector ciphertext element depend only on (B,s,q) and is independent of the number of signers k. Moreover, the ⊙ operation is invertible block by block (given by Fermat's Little Theorem), ensuring that the arbitrator can accurately recover the commitment vector.

[0081] Encoding rules for rule vectors: This specification uses the following bit-packed line format to encode the rule vector σ=(p b ,v b ) b∈[B] The encoding format is used for both the byte representation and hash input of the evidence packet, and is therefore the sole basis for determining the length of each byte. Let pos denote the proportion of the positional component. bits =log2 s, the proportion of non-zero components is val bits =Round up (log2 q); First, write all B positional components in the order b=0,1,…,B-1, then write all B non-zero value components in the same order, that is, positional segments as a whole first, value segments as a whole last, rather than interleaving by blocks; the entire bitstream is loaded into bytes in LSB-first manner, and the total length is rounded up (B×(pos)). bits +val bits (8) bytes. Based on this, demonstrates pos under parameters (8,2,3). bits =1、val bits =2, each block is 3 bits, 8 blocks total 24 bits, or 3 bytes; NIST L1 parameters (160,4,3) pos bits =2、val bits =2, each block is 4 bits, 160 blocks total 640 bits or 80 bytes. Since this length is determined only by (B,s,q), the aggregation anchor value c aggand each rule vector ciphertext element c i have a byte count that is independent of the number k of signers.

[0082] Embodiment 1,

[0083] An auditable aggregate signature disclosure and keyless verification method, as shown in Figure 6 comprises the following steps:

[0084] S1: The aggregation coordinator selects one from three public modes according to the service scenario, to satisfy the demands of both privacy and audit, as shown in Figure 1 , Figure 1 where k_open denotes k open , that is, " " represents a subscript, and "^" represents a superscript.

[0085] COMPACT mode (compact encryption mode): k open =0, user_revealed = empty set, all signatures are stored in an encrypted state, and the auditor only performs structural verification on the aggregated anchor value and each rule vector ciphertext element; k open is the size of the mandatory disclosure subset, that is, the number of signatures (an integer) that are cryptographically derived to be mandatorily disclosed in this aggregation, which is also the aforementioned signature quantity target; the total number of signatures finally disclosed in plaintext is the sum of k open and the number of signatures actively disclosed by the coordinator. When k open =0 and user_revealed is an empty set, no single signature is disclosed in plaintext, and the auditor can only perform structural verification on the evidence package.

[0086] user_revealed represents a signature index list that is actively specified by the coordinator according to the service policy and must be disclosed in plaintext, whose element i is an integer between 0 and k-1 (that is, the index set for which the coordinator explicitly requires these signatures to be disclosed for audit).

[0087] PARTIAL mode (partial disclosure mode): k open =round(k×fs_open_ratio), that is, rounding k×fs_open_ratio to an integer, 0<k open <k, the final disclosure set is formed by ; fs_open_ratio represents a disclosure rate parameter (a real number between 0 and 1). fs_revealed is an index list mandatorily derived by FS-CCB cryptography, whose number of elements is always k open and which does not intersect with user_revealed.

[0088] FULL mode (full disclosure mode): k open=k, all k signatures are made public, where k is the total number of aggregators.

[0089] Aggregated signature disclosure refers to the process by which the coordinating party, when releasing an aggregated signature evidence bundle, reveals some or all of the individual signatures (i, c) within it. i The act of attaching (algo_tag_i, pk_signer_i, σ_real_i) in plaintext to the evidence package. The revealed signature can be directly viewed and verified by a third-party auditor who does not hold any private key. The real signature without a revealed index is not attached to the evidence package in plaintext; or the real signature without a revealed index is sealed in the evidence package in the form of certified encrypted ciphertext, which can only be decrypted and verified by the arbitrator holding the KEM private key during the decision-making stage.

[0090] S2: Each signer generates a commitment vector and a real signature. The coordinator completes key encapsulation, individual ciphertext element calculation, and aggregate anchor value accumulation, providing a locked public context for subsequent derivations.

[0091] Sampling of the commitment vector: Signer i uses a local cryptographically secure pseudo-random number generator as the source and independently samples b=0,1,…,B-1 block by block, with position component p b A non-zero component v takes uniform values ​​on {0,1,…,s-1} b By uniformly selecting values ​​on {1,2,…,q-1}, we obtain σ. PRC,i =(p b , v b ) b∈[B] ∈R B,s,q σ obtained from sampling PRC,i The commitment vector and the corresponding random vector are held locally by the signer; they are only made public along with the public record when the index belongs to the final public set. The commitment vector and random vector of an unpublished index are never made public.

[0092] Construction and signing of the binding string: Signer i calculates the binding. i =μ i ∥H(σ PRC,i ), where σ PRC,i For each signer node, a randomized commitment vector is sampled, μ iThe message to be signed by the signer is represented by ∥, where ∥ indicates byte string concatenation, and H is the commitment hash with a field separation prefix, i.e., H(σ) = SHAKE - 256("M2SEAL:sigma-PRC-bind" ∥ E(σ)), where E(·) is the bit packing encoding mentioned above. This prefix is ​​a fixed string of 21 bytes used to distinguish the commitment hash from hash calls used for other purposes in this scheme. Subsequently, the signature function sign_fn is found in the Signature Registry according to its algorithm tag algo_tag_i, and the binding is performed using the local signature private key. i The signature yields the real signature σ_real_i. Since the commitment vector is involved in the construction of the binding string, any substitution of the commitment vector will cause the real signature verification to fail.

[0093] The output length of the commitment hash is 384 bits (48 bytes). This is based on the fact that, under the quantum random oracle model, for a hash function with an output length of ℓ bits, the upper bound of the advantage of a quantum collision attack is... (Zhandry, 2015), rather than the classic birthday world Where Q represents the number of hash queries performed by the adversary, and is independent of the finite field order q of the regular vector space; in Next hash lookup Only 2 is given -74 The collision advantage is insufficient to support 128-bit security, and Give 2 -202 Since malicious signers can choose their own commitment vector, the security of the binding string depends on the collision resistance of the commitment hash rather than its resistance to second preimages. Therefore, the output length must be selected according to the collision bound.

[0094] The structure of the SignatureRegistry: This registry is a public, read-only table with the algorithm tag `algo_tag` as the key. Each entry contains a seven-tuple (public key size in bytes `pk_size`, signature size in bytes `sig_size`, keypair_fn (keypair generation function), signature function `sign_fn`, verification function `verify_fn`, NIST security level, and cryptographic family identifier). Auditors only need the `pk_size` and `sig_size` entries to verify the byte length, while arbitrators use `verify_fn` for signature verification. Therefore, the same registry can simultaneously support keyless structure verification and multi-algorithm scheduling verification.

[0095] Key encapsulation and random vector derivation: The coordinator calls the encapsulation function of the ML-KEM-768 key encapsulation mechanism on the arbitrator's public key pk_arb to obtain the key-encapsulated ciphertext c. KWith the symmetric key; then, for each signer index i, feed the three input segments into SHAKE-256 in a fixed order: the first segment is a 15-byte fixed-field separated prefix string "M2SEAL:e-derive", the second segment is the symmetric key, and the third segment is an 8-byte little-endian integer of the signer index i; squeeze out a B×4-byte random byte string, and parse it according to the rule that every 4 bytes corresponds to a block: in these 4 bytes, the first byte modulo s gives the position component p of the block. b The second and third bytes are concatenated into a 16-bit integer using little-endian byte order. This integer is then modulo q-1 and added to obtain the non-zero component v of the block. b (Values ​​fall within {1,…,q-1}), the 4th byte is reserved; thus, the random vector e of the signer is obtained. i ∈R B,s,q The derivation process is deterministic; after unsealing the symmetric key, the arbitrator can reproduce the same e for any index. i An auditor who does not hold the symmetric key cannot derive any e on their own. i In some embodiments, the publicly indexed e i Provided by the coordinator along with the public records, e of the unpublished index. i Still unavailable.

[0096] Individual ciphertext elements and aggregate anchor values: The coordinator calculates c for each signer. i =σ PRC,i ⊙e i , because e i Given that c is uniformly distributed on R and ⊙ is a group operation, i For those who do not understand e i One party does not disclose σ PRC,i Any information; then sum all individual ciphertext elements according to the ⊙ operator to obtain the aggregate anchor value c. agg =c1⊙c2⊙…⊙c k Its encoding size depends only on the parameter triple (B, s, q) and is independent of the total number of signers k. Thus, c K With c agg All of these have been confirmed and will be made public with the evidence package. The coordinating party will not be able to modify them after release, thus constituting a locked input derived from S3.

[0097] S3: By using cryptographic derivation to force the revelation of a portion of the index, the coordinator is prevented from selectively choosing a revelation set that is advantageous to them. For example... Figure 2 As shown, the coordinating party inputs the public context of the public evidence package into SHAKE-256 (an extensible output function) in the following order:

[0098] ① Separate the prefix string from the fixed field and take 12 bytes of "M2SEAL:FSCCB";

[0099] ② The arbitrator's public key pk_arb;

[0100] ③ k message contents (μ) i (i=1..k) sequentially (each segment is separated by a 0x00 byte).

[0101] ④ k algorithm tags (algo_tag_i) sequentially (each segment is separated by a 0x01 byte);

[0102] ⑤ The public key digests of k signers (SHA-256(pk_signer_i)[:8]), each segment is separated by a 0x02 byte at the beginning;

[0103] ⑥ KEM ciphertext c K ;

[0104] ⑦ Aggregate anchor c agg ;

[0105] ⑧ k and k open A little-endian 8-byte integer;

[0106] ⑨ Index sequence (4-byte little-endian integer) in the list of information proactively disclosed by the coordinator (user_revealed).

[0107] Output k from SHAKE-256 open A random byte string of 8 + 32 bytes (raw); construct the fs_revealed list (ascending order) according to the following rules, ensuring that it does not repeat user_revealed and that the number of elements is exactly k. open :

[0108] fs_revealed is a set of mandatory public indexes derived from the context of the nine public evidence packages mentioned above via SHAKE-256, and is not controlled by the coordinator; user_revealed is a set of optional public indexes that the coordinator can independently specify according to business policies; final public... .

[0109] If the target number of raw bytes is not reached after all raw bytes are used up, then a linear scan of i∈{0,1,…,k-1} is performed to fill the remaining bytes. Since the length of raw bytes is k... open ×8 + 32 bytes, statistically, exhaustion is almost impossible. The above rules guarantee that all indices in fs_revealed are unique and do not intersect with user_revealed; It is always equal to k open The value of `user_revealed` does not decrease with the value of `user_revealed`, therefore the coordinator cannot reduce the number of mandatory disclosures by increasing `user_revealed`; the final size of the disclosure set | | = |user_revealed| + k open The derivation process is deterministic; given the same input, the same fs_revealed will be obtained.

[0110] S4: As Figure 3 As shown, user_revealed and fs_revealed are merged into the final public set all_revealed, and the public bundle is assembled.

[0111] The coordinator calculates all_revealed = sorted(set(user_revealed)). set(fs_revealed)), for each signature index i ∈ all_revealed, set (i, c i The quintuple (algo_tag_i, pk_signer_i, σ_real_i) is added to the revealed_bundle list. For the remaining i, only the ciphertext element c of the rule vector calculated in S2 is retained. i c i =σ PRC,i ⊙e i , σ PRC,i ⊙e i ∈R is defined by the following block-by-block approach:

[0112]

[0113] in, Indicates that it is located at the th The tuples on each block. and They are respectively and In the Block location parameters; and They are respectively and In the Non-zero value parameters for the blocks.

[0114] The final public evidence bundle structure includes: c K c agg ,k,mode,k open The data sets include user_revealed, fs_revealed, revealed_bundle, encrypted, messages, algo_tags, and signer_pks. Revealed_bundle is a list of public records, with each item being a 5-tuple (i, c). i, algo_tag_i, pk_signer_i, σ_real_i); in some embodiments, this item is expanded to a 7-tuple (i, c i , algo_tag_i, pk_signer_i, σ_real_i, σ PRC_i , e i ); encrypted is a list of unpublished records, each item being a tuple (i, c); i That is, the unrevealed signature index must still carry its rule vector ciphertext elements in the evidence package; otherwise, the auditor cannot complete the fourth verification of all k ciphertext elements, and the arbitrator cannot recover the commitment vectors of these indices afterward. The combined indices of the two are exactly the complete set {0,1,…,k-1}.

[0115] As a further implementation, to ensure that the scope of the arbitrator's verification is not limited by the final public set, the coordinator, in addition to calculating the ciphertext elements of the rule vector in S2, also performs authentication encryption on each signer index i: taking the fixed-field separation prefix [M2SEAL:aead-key] and the symmetric key as input, calls SHAKE-256 to derive a 32-byte authentication encryption key K. aead This prefix is ​​different from the prefix [M2SEAL:e-derive] used in the derived random vector, thus achieving key separation; the 12-byte little-endian integer at index i is used as the one-time initialization vector nonce. i , with aggregate anchor value c agg Key encapsulation of ciphertext c K The byte strings of the algorithm tag algo_tag_i and index i are concatenated to form the additional authentication data AAD. i The authentication encryption algorithm is called to encrypt the real signature σ_real_i, resulting in ct. i =AEAD.Enc(K aead , nonce i AAD i, σ_real_i); In this embodiment, the authentication encryption adopts an encryption-then-authentication construction based on SHAKE-256. The authentication tag length is 32 bytes. Specifically, with the fixed field separation prefix [M2SEAL:aead-enc], the authentication encryption key, and the one-time initialization vector as input, SHAKE-256 is called to extrude a key stream of the same length as the plaintext and XOR it byte by byte with the plaintext to obtain the ciphertext body; then, with the fixed field separation prefix [M2SEAL:aead-mac], the authentication encryption key, the one-time initialization vector, the 8-byte little-endian length and content of the additional authentication data, and the 8-byte little-endian length and content of the ciphertext body as input, SHAKE-256 is called to extrude a 32-byte authentication tag; the concatenation of the ciphertext body and the authentication tag is the true signature ciphertext. The prefix length field of the additional authentication data and the ciphertext body is to eliminate the parsing ambiguity of variable-length concatenation. The SHAKE-256 working mode, instead of a block cipher, is chosen because the mask derivation, binding string hashing, and forced public index derivation in this scheme all use SHAKE-256, thus avoiding the introduction of any new symmetric primitives. The authentication tag in this embodiment is 32 bytes instead of 16 bytes because the forgery advantage increases linearly with the number of decryption queries, and is q. D ·2 -8L (L is the number of tags in bytes): When L=16, in q D =2 30 The following is 2 -98 When L=32, it is 2 -226 The authentication encryption can also be replaced with encryption algorithms that have authentication capabilities, such as AES-256-GCM or ChaCha20-Poly1305; the authentication tag of these two is fixed at 16 bytes, and as shown in the above formula, their forgery advantage lies in q. D =2 30 The following is 2 -98 Setting a limit on the number of decryption failures can only narrow the gap, but cannot make it reach 2. -128 For example, limiting q D ≤2 20 Still 2 -108 However, when L=16, it only occurs at q D It is only equal to 2 in the extreme case where ≤1. -128 To achieve 2 when using this type of algorithm. -128 To achieve the goal, this invention provides a third implementation: an additional 32-byte outer authentication tag, calculated using an independent key, is appended to the complete output of the authentication encryption, making the total length of the authentication tag 48 bytes. Forgery must pass both the inner and outer layers of verification simultaneously. D =2 30 The advantage of forgery is 2 -226 Specifically, it involves separating the fixed-domain prefix [M2SEAL:tag2-key] from the authentication encryption key K. aeadFor input, call SHAKE-256 to derive a 32-byte outer tag key K. tag2 This prefix is ​​distinct from all the previous prefixes, ensuring that the outer tag and inner authentication encryption use independent key materials. Then, using the fixed-field separation prefix [M2SEAL:tag2-mac], the outer tag key, the one-time initialization vector, the 8-byte little-endian length and content of the additional authentication data, and the 8-byte little-endian length and content of the complete output as input, SHAKE-256 is used to extrude a 32-byte outer tag, which is appended to the complete output. The one-time initialization vector and the additional authentication data must participate in the calculation of the outer tag: if the outer tag only covers the ciphertext, an attacker can move the ciphertext at one index along with its outer tag to another index while the outer tag still passes verification, degrading the binding semantics to the strength of the inner algorithm alone. During decryption, the outer tag is verified first, then the inner authentication decryption is performed, ensuring that most forgery attempts are rejected at the first layer. The complete output is still the standard output of the inner algorithm byte by byte, thus only enabling the receiver of the standard algorithm to decrypt normally after removing the last 32 bytes; however, the forgery advantage gained is still inherent to the algorithm. Accordingly, the byte length of the ciphertext of the true signature in the evidence package must be verified according to the tag length of the selected authentication encryption algorithm, and cannot be fixed at 32 bytes; the tag length is one of 16, 32, and 48 bytes, and other values ​​are not accepted during parsing, otherwise the issuing party can declare an excessively short tag, thus invalidating this length verification; in this embodiment of the invention, the tag length is explicitly carried in the evidence package, so that the auditor without the key can perform this verification without prior knowledge of the selected algorithm. The coordinating party will use all k cts iThe fields are arranged in ascending order by index and attached to the evidence package. The algorithm tags are placed in the additional authentication data rather than within the ciphertext because all algorithm tags belong to the nine public contexts described in S3 and must be made public so that the auditor can recalculate and force the public release of the index set. Placing them in the additional authentication data maintains their public nature while binding the ciphertext to the algorithm tags, preventing cross-algorithm ciphertext swapping. Since the symmetric key is generated once for each evidence package by the key encapsulation mechanism, each evidence package is unique, and the nonces of each index within the same evidence package are non-repeating, the requirement for non-reuse of random numbers in authentication encryption is met. Binding the additional authentication data to the aggregate anchor value and the key-encapsulated ciphertext ensures that any modification to either will cause the authentication tag verification of all genuine signature ciphertexts to fail. Actual test data (test environment: Intel Core i9-10885H @2.40GHz, Ubuntu 24.04, median of 200 tests per level): The authentication encryption time for a single signer in this step increases linearly with the length of the genuine signature: 31.9 microseconds for Falcon-512 (|σ|=666 bytes), 157.6 microseconds for ML-DSA-65 (|σ|=3293 bytes), and 809.8 microseconds for SLH-DSA-128f (|σ|=17088 bytes). The decryption and authentication time on the arbitrator's side is comparable, at 32.1, 153.7, and 792.2 microseconds respectively. The byte increment of the evidence packet is a deterministic value: each signer adds exactly the length of an authentication tag, regardless of the signature algorithm used or the signature length. In this embodiment, the SHAKE-256 construction is 32 bytes (32k bytes in total), while AES-256-GCM uses 16 bytes (16k bytes in total), and the aforementioned implementation with an additional outer authentication tag uses 48 bytes (48k bytes in total). Compared to the length of the genuine signature itself (3293 bytes for ML-DSA-65), this increment accounts for approximately one percent.

[0116] The arbitrator unseales the symmetric key K during the decision-making phase. arb Then, derive K for each index i in the same way. aead Reconstructing nonce i With AAD i Call AEAD.Dec to verify the authentication tag and decrypt it to obtain σ_real_i; then... = ⊙ -1 Restore the commitment vector and reconstruct the binding. i The verification function verify is found in the algorithm registry by searching for algo_tag_i. fnThe signature verification is completed using the i-th public key in `signer_pks`. This allows the arbitrator to perform cryptographic verification on each of the k signers individually, no longer limited by the final public set, and enabling judicial decisions even under compact encryption. The auditor cannot decrypt any `ct` without possessing the symmetric key. i It can only verify that its byte length is equal to the sum of the signature byte size declared in the algorithm registry entry and the authentication tag length declared in the evidence package (32 bytes for SHAKE-256 in this embodiment, 16 bytes for AES-256-GCM, and 48 bytes for the implementation with an additional outer authentication tag). Therefore, the true signature of the undisclosed index remains confidential to the auditor. With this implementation, the verification capability of this embodiment forms a complete three-level system: the auditor performs five structural checks on all k indexes, further performs keyless cryptographic verification on the publicly disclosed indexes, and the arbitrator performs cryptographic verification on all k indexes. The true signature ciphertext sig cts Without adding the derived input of the nine-segment public context described in S3, the nine-segment structure remains unchanged, so as to prevent the set of mandatory public indexes that has been deterministically generated and claimed to be reproducible in each embodiment from becoming invalid.

[0117] Where messages are all k μ i (Regardless of whether it is in the public set), algo_tags are all k algo_tag_i, where algo_tag_i represents the tag of the post-quantum signature algorithm used by the i-th signer (such as M2-DSA-L3, ML-DSA-65, Falcon-512, SLH-DSA-128f, etc.).

[0118] signer_pks is all k pk_signer_i, where pk_signer_i represents the public key of the i-th signer.

[0119] all_revealed represents the final public index set (equal to the union of user_revealed and fs_revealed, sorted in ascending order); sorted represents the ascending sorting function; and set represents the set constructor.

[0120] σ_real_i represents the real digital signature value generated by the i-th signer for the bound string using the signature generation function registered in the SignatureRegistry by the post-quantum signature algorithm to which the signer belongs.

[0121] S5: The auditor does not possess any KEM private key, such as Figure 4 As shown, the following five checks are performed on the received bundle:

[0122] (a) Recompile fs_revealed_check=FS-CCB(bundle public context) derived from FS-CCB (derived by S3) and verify fs_revealed_check=bundle.fs_revealed;

[0123] (b) Verify that sorted(set(user_revealed)∪set(fs_revealed)) is consistent with the actual set of indices contained in revealed_bundle;

[0124] (c) The byte size of the verification (algo_tag_i, σ_real_i, pk_signer_i) for each i∈revealed_bundle conforms to the pk_size and sig_size declared in the SignatureRegistry for that algorithm entry;

[0125] (d) By verifying each c i It is a valid rule vector (i.e., each block has one and only one non-zero element);

[0126] (e) Verification |c K |、|c agg The lengths of top-level fields such as | and |binding| are valid; if any of the above fails, the reason for failure is recorded and the corresponding failure code is returned. If all five items pass, verify_structural (the structured keyless verification function executed by the auditor on the bundle) returns True.

[0127] Analysis against selective disclosure fraud: Under FS-CCB enforcement, the coordinator cannot choose the fs_revealed index that only benefits itself. The coordinator's influence on fs_revealed is limited to the finite selection space of user_revealed, and every adjustment must be publicly disclosed along with the evidence package.

[0128] The analysis is as follows: (a) SHAKE-256 is a cryptographic one-way hash, where the output avalanche over the input, making it unpredictable; (b) derived inputs include c agg c K(c) Fields that have already been accumulated and locked by the key in S2 cannot be modified by the coordinator once the bundle is released; (d) If the coordinator attempts to make the derived result avoid a specific index while user_revealed remains unchanged, it is equivalent to solving the preimage of SHAKE-256, which violates the cryptographic assumption; (e) Therefore, the only way for the coordinator to affect fs_revealed is to change user_revealed, and for each selected user_revealed, fs_revealed is uniformly sampled from the remaining (k-|user_revealed|) indices.

[0129] S6: When a complete decoding (decision) is required, the arbitrator unblocks K. arb It also verifies the real signature in revealed_bundle by distributing it according to algo_tag.

[0130] The specific execution is as follows: Upon receiving the bundle and the dispute resolution request, the arbitrator uses its KEM private key sk_arb to invoke the KEM ciphertext c. K Recover the symmetric key; for each index i in the revealed_bundle list, derive the corresponding rule vector e using the symmetric key as the seed for SHAKE-256. i ; then calculate σ PRC,i =c i ⊙e i -1 , where e i -1 For e i Inverse element under the ⊙ operation; specific calculation formula: if e i =(p b ei ,v b ei ) b∈[B] Then e i -1 =(- p b ei )mods, (v b ei ) q- 2 modq) b∈[B] The second component is v b ei In F q The multiplicative inverse of the above (given by Fermat's Little Theorem) is used to precisely recover the commitment vector. Reconstruct the binding string. i =μ i ∥ H(σ PRC,iThen, based on algo_tag_i, the corresponding verification function is retrieved from the SignatureRegistry, and signature verification is performed on σ_real_i one by one; if all pass, the disputed signature is valid; if a signature verification fails, the index and the reason for failure are recorded and output.

[0131] like Figure 5 As shown, the design of the rights boundaries of the coordinating party 10, the auditing party 20, and the arbitrating party 30 in this embodiment of the invention follows the following principles:

[0132] 1. A single point of failure does not compromise overall security: If the key passively held by any one party is leaked, the other two parties can still work independently;

[0133] 2. Rights must not be overstepped: The three parties have complementary but non-overlapping capabilities, and no single party has complete control.

[0134] 3. Public verification is superior to private trust: The auditor provides post-event keyless structured verification, constituting independent oversight;

[0135] 4. Judicial document validity: The arbitrator holds the K document in case of subsequent disputes between the mediator and the auditor. arb Complete the final cryptographic verification.

[0136] This invention allows third parties to perform structural integrity verification on post-quantum aggregated signature evidence packets without possessing any KEM private keys, and to suppress coordinator's selective disclosure cheating by deriving a mandatory public subset through Fiat-Shamir content binding.

[0137] Figure 3 , Figure 4 and Figure 5 In the middle, c_i represents c i ,Right now" " indicates a subscript, and "^" indicates a superscript.

[0138] Example 2,

[0139] An auditable aggregate signature reveal and keyless verification system includes:

[0140] In the public mode selection module, choose one of COMPACT, PARTIAL, and FULL and confirm k. open ;

[0141] Forced derivation module, sucking in SHAKE-256-derived fs_revealed according to the nine-segment input sequence;

[0142] The evidence package assembly module merges user_revealed and fs_revealed and assembles revealed_bundle to form the final public set, and assembles the public evidence package accordingly;

[0143] The keyless structure verification module is invoked by the auditor without holding any private key. It sequentially performs the five structure verifications described in S5 on the evidence package, outputs the verification conclusion, and the failure items and reasons for failure when they fail.

[0144] The distribution verification module, invoked by the arbitrator when a decision is needed, takes the evidence package and the arbitrator's private key as inputs. Its internal process is as follows: (a) Using ML-KEM.decaps from c K Recovery of symmetric key K arb (b) Derive a random vector e for each index i in revealed_bundle. i (c) By σ PRC,i =c i ⊙e i -1 Recovery of commitment vector σ PRC,i (d) Assemble binding i =μ i ∥H(σ PRC,i (e) Dispatch the algorithm to the corresponding verification function according to algo_tag_i to complete the signature verification; (f) Output the verification results of each index. The SignatureRegistry is a public registry that registers the byte size and function entry of each algorithm. This module uses this registry to implement the one-time scheduling of multiple algorithms.

[0145] Example 3,

[0146] A provincial financial regulatory bureau deployed a post-quantum aggregation audit for daily large suspicious transaction reports from 13 commercial banks within its jurisdiction. Each bank node (B0-B12, index 0-12) holds its own PQ-DSA key pair (nodes 0-2 use M2-DSA-L3, nodes 3-6 use ML-DSA-65, nodes 7-9 use Falcon-512, and nodes 10-12 use SLH-DSA-128f). The financial regulatory bureau acts as the arbitrator, deploying the ML-KEM-768 arbitration public key pk_arb; the provincial banking and insurance regulatory audit center acts as a third-party auditor without holding any private keys, performing only structured verification. This protocol operates in PARTIAL mode, with fs_open_ratio set to 0.55, and k=13, k_open=round(13×0.55)=7.

[0147] Initialization Phase: The Financial Regulatory Bureau distributes the SignatureRegistry (containing 13 entries, covering 4 signature algorithms) to 13 bank nodes + the Audit Center via a dedicated network. The arbitrator's public key pk_arb (approximately 1.2 KB) is publicly released through the Regulatory Center's official website. The Audit Center obtains the three necessary fields—algo_tag, pk_size, and sig_size—for each entry from the SignatureRegistry, which serve as the baseline for subsequent verify_structural verification.

[0148] Signature Phase (triggered daily at 23:00): Each of the 13 bank nodes extracts the string μ_i = "Date|| Bank Number|| SHA-256 of the daily large-amount report digest" from the risk control system. Each node locally calls SignatureRegistry[algo_tag_i].keypair_fn according to its algo_tag to generate a daily signature key pair (valid only for the current day to avoid long-term key exposure), and samples σ block by block according to the method described in S2. PRC,i ∈R 8,2,3 (This example uses demonstration parameters, with each node encoded as 3 bytes; production deployment should use NIST L1 parameter R.) 160,4,3 Each node is encoded in 80 bytes), and the binding is calculated. i =μ i ∥H(σ PRC,i ), call the corresponding sign_fn to get σ_real_i. 13 copies (σ PRC,i The quadruple (σ_real_i, algo_tag_i, pk_signer_i) is submitted via dedicated line to the regulatory center coordination node.

[0149] Aggregation Phase: The coordinating node performs size verification on the output of each node (|pk|=pk_size, |σ_real|=sig_size), and calls ML-KEM-768.encaps(pk_arb) to obtain (c K ,K arb For each i∈{0,…,12}, e is derived from SHAKE-256. i ∈R, calculate c i =σ PRC,i ⊙e i ;Accumulate to get c agg∈R (encoding size depends only on (B,s,q): 3 bytes for demonstration parameter B=8, 80 bytes for NIST L1 parameter B=160). Subsequently, the coordinator specifies user_revealed=[3] according to the business strategy (corresponding to node B3 having a cross-border large-amount report that day that must be audited independently).

[0150] Executing FS-CCB derivation: The nine-segment input is fed into SHAKE-256 in the prescribed order, and 7×8+32=88 bytes are squeezed out. According to the parsing rules, fs_revealed=[1,2,5,7,8,10,12], a total of 7 items; all_revealed=[1,2,3,5,7,8,10,12], a total of |user_revealed|+k. open =1+7=8 items; the remaining 5 indexes {0,4,6,9,11} rule vector ciphertext elements are attached to the evidence package in the form of unpublished records.

[0151] Evidence package release phase: The coordinator assembles bundle_out according to the following byte layout: 4B version number || 32B derived context hash || c K (ML-KEM-768 ciphertext, 1088 bytes) || c agg (Demonstration parameter 3 B) || 4B Total number of signers k=13 || 4B Array length || 13 algo_tag strings || 13 μ i || 13 pk_signer_i digests (8 bytes each) || 8 publicly available records || 5 unavailable records || 13 true signature ciphertexts sig_cts. All 13 μs must be included here. i Instead of just carrying 8 of the 13 pk_signer_i digests, the auditor recalculates the forced public index set according to S3. The "all message content to be aggregated" and "digests of each signer's public key" in the nine public contexts cover all k indices. If only a subset of public keys is carried, the first of the five structure checks cannot be executed. Each public record contains (i, μ) i , c i (Demonstration parameter 3 B), algo_tag_i, σ_real_i, pk_signer_i), each public record further contains (σ PRC,i , e i The remaining 5 unpublished records only contain (i, c) i), σ_real_i and pk_signer_i are not included; sig_cts is the ciphertext of the real signature carried line by line, and the length of each segment is the sum of sig_size of the algorithm used for the index and the 32-bit authentication tag used in this embodiment. The total size of bundle_out is determined by the sum of pk_size and sig_size of each algorithm in the 8 public records (where the single signature of SLH-DSA-128f is 17088 bytes, which is the largest item), while c agg It is always 3 bytes, regardless of the number of signers. After assembly, it is published to the consortium blockchain.

[0152] Audit Phase: After receiving bundle_out, the Provincial Banking and Insurance Regulatory Commission Audit Center calls verify_structural: (a) Recalculate fs_revealed_check and compare it with fs_revealed=[1,2,5,7,8,10,12] declared in the bundle; (b) Verify that the actual index set {1,2,3,5,7,8,10,12} contained in the public records is equal to user_revealed∪fs_revealed; (c) Verify that |σ_real| and |pk_signer| conform to SignatureRegistry[algo_tag].sig_size and pk_size for each of the 8 public records; (d) Verify that all 13 c in the public and unpublic records are true. i Check each block one by one to ensure that it contains exactly one non-zero element; (e) Verify |c K | Consistent with the ciphertext length declared by the key encapsulation mechanism used, |c agg The encoding length is consistent with the parameter triple (B,s,q) (3 B under parameter B=8), and the lengths of each bound string and the remaining top-level fields are valid. All five checks passed, and the audit center confirmed that the bundle_out structure is valid (actual test time: 0.106 milliseconds under the demonstration parameter, 0.861 milliseconds under the NIST L1 parameter). The audit center also output the algo_tag distribution statistics: M2-DSA-L3 accounts for 23%, ML-DSA-65 accounts for 31%, Falcon-512 accounts for 23%, and SLH-DSA-128f accounts for 23%, which are attached to the algorithm distribution report as evidence.

[0153] Decision Phase (triggered only when a dispute arises): Upon receiving a complaint, the Financial Supervisory Authority uses its private key sk_arb to invoke ML-KEM-768.decaps(c K Restore K arbDerive K from all 13 indexes i aead with nonce i Reconstructing AAD i Call AEAD.Dec to decrypt and authenticate ct i Get σ_real_i, then derive e i And calculate σ PRC,i =c i ⊙e i -1 Reconstruct binding i =μ i ∥ H(σ PRC,i The system searches for `verify_fn` in the `SignatureRegistry` according to `algo_tag_i` to verify `σ_real_i` one by one; if 13 / 13 pass, the signatures of the 13 banks are valid. If this implementation method is not used, the above verification can only be performed on 8 publicly available records, and if 8 / 8 pass, the signatures of the 8 banks are valid. The disputed banks have been publicly disclosed by `user_revealed`, and the regulatory authority can directly take further action against them.

[0154] Example 4,

[0155] The financial regulatory authority conducts a regulatory audit on the daily aggregated signatures of the 13 bank nodes on the consortium blockchain.

[0156] Thirteen banks completed the commitment sampling, signing, and aggregation according to S2 of this invention. The coordinator released the evidence package in a partially public mode, with fs_open_ratio=0.2, so k_open=round(13×0.2)=3. Among them, the coordinator specified user_revealed=[3] according to the business rules (node ​​B3 has a large transaction that needs to be disclosed on the same day), and FS-CCB derived fs_revealed=[0,7,10]. Finally, all_revealed=[0,3,7,10], for a total of |user_revealed|+k open =1+3=4 items, corresponding to 4 signatures attached in plaintext form in the evidence package, and the remaining 9 signatures are only sealed in the unpublished record in the form of regular vector ciphertext elements.

[0157] After receiving the evidence package, the auditor calls verify_structural: (a) recalculates FS-CCB and verifies that fs_revealed=[0,7,10] is consistent; (b) verifies that the set of public record indexes is consistent with all_revealed; (c) verifies that the byte size (algo_tag, σ_real, pk_signer) of the 4 public records conforms to the SignatureRegistry; (d) verifies all 13 c in the public and unpublic records. i All are valid rule vectors; (e) Verify the length of the top-level field and the bound string. All five checks passed, and the auditor confirmed the evidence package structure was valid.

[0158] Actual test (demonstration parameters (8,2,3)): FS-CCB derivation 0.049 milliseconds, verify_structural five-item verification 0.106 milliseconds. The auditor completed the integrity verification without holding any KEM private key.

[0159] Example 5,

[0160] A cross-chain clearing hub platform deploys the auditable aggregate signature disclosure mechanism of this invention to process an average of 50 large cross-chain transactions per day (k=50); fs_open_ratio is set to 0.3, which means that 30% of the regulatory samples are forcibly disclosed; user_revealed is specified by the clearing hub business rules and contains specific transaction indexes marked by anti-money laundering risk control, which are 3 indexes in this embodiment.

[0161] Evidence package generation phase: The coordinating party invokes S1(k) in a partially public mode. open =round(50×0.3)=15); call S2 to complete commitment sampling, key encapsulation, and various c i Calculation and c agg Accumulate; call S3 to absorb SHAKE-256 in nine-segment order, deriving fs_revealed=[0,2,4,5,9,11,21,23,35,37,38,39,42,44,48], a total of 15 cryptographically derived indices uncontrollable by the coordinator; call S4 to calculate all_revealed=user_revealed∪fs_revealed, since the two are disjoint, |all_revealed|=|user_revealed|+k open =3+15=18; The public evidence package contains 18 plaintext disclosure records and 32 undisclosed records containing only regular vector ciphertext elements.

[0162] Audit Phase: A third-party auditing firm (such as an anti-money laundering compliance supervisor or a cross-border trade arbitration center) holds publicly available copies of pk_arb and SignatureRegistry and invokes S5's five checks: (a) recalculate fs_revealed_check and verify that it equals bundle.fs_revealed; (b) verify that the set of publicly available record indices matches all_revealed; (c) for each i ∈ all_revealed, verify that the byte size of (algo_tag_i, σ_real_i, pk_signer_i) conforms to the SignatureRegistry declaration; (d) verify each c i ∈R B,s,q The rule vector constraint must be satisfied, meaning that each block has exactly one non-zero element (the parameter demonstrated in this example is R). 8,2,3 Production deployment should use R 160,4,3 (e) Verify |c K |、|c agg The length of top-level fields such as | and |binding| is valid.

[0163] Actual measurements (demonstration parameters (8,2,3)): FS-CCB derivation phase 0.225 ms; audit phase five-item verification end-to-end 0.400 ms; NIST L1 production parameters (160,4,3) corresponding to 0.266 ms and 2.96 ms respectively; audit output "pass" or specific failure code (ERR_FS_CCB, ERR_AGG_MISMATCH, etc.). Compared with Examples 3 and 4 with k=13, it can be seen that the overhead of the five-item verification increases approximately linearly with the number of signers, while c agg The encoding size is constant (3 bytes for demonstration parameters, 80 bytes for NIST L1 parameters) and is independent of the number of signers. This embodiment verifies the complete closed loop of the present invention in a three-party collaborative scenario of cross-chain trusted relay, anti-money laundering compliance, and independent third-party audit, where the coordinating party can control partial disclosure, cryptographically mandated partial disclosure, and independent audit without key verification.

[0164] Test environment: Processor: Intel Core i9-10885H @ 2.40GHz, Ubuntu 24.04LTS under WSL2, single-threaded operation; software implementation uses the reference implementation of this invention (Python 3.12 standard library, hash and extensible output functions are taken from hashlib). Timing is performed in batches of 50 calls, for a total of 15 batches, using the median of the average values ​​of each batch to mitigate the impact of timer resolution; the interquartile range of each configuration does not exceed 10% of the median value. The c values ​​given in each embodiment... K The commitment vector and the resulting c agg Both are deterministically generated from a fixed seed, so the values ​​of fs_revealed and all_revealed can be repeatedly reproduced. Since FS-CCB derivation and the five keyless verifications do not involve any calls to post-quantum signature algorithms, their latency is independent of the selected signature algorithm.

[0165] Suppose the coordinator has an incentive to selectively choose `fs_revealed` to conceal an unfavorable signature `i*`. For a given `user_revealed`, `fs_revealed` is a k_open subset uniformly drawn from the remaining k - |user_revealed| indices. Therefore, the probability that a single derivation result does not contain `i*` is (k - |user_revealed| - k) / 2. open When the coordinator needs to conceal m unfavorable indices simultaneously, this probability decreases to the ratio of combinations C(k-|user_revealed|-m, k) / (k-|user_revealed|-m). open ) / C(k-|user_revealed|, k open The value decreases rapidly as m increases. With k=10 and k... open Taking |user_revealed|=0 as an example, the probability of concealing 1 index is 0.5, and the probability of concealing 3 indices drops to approximately 0.083. It should be noted that since |fs_revealed| is always equal to k... open Instead of decreasing as user_revealed increases, the coordinator cannot reduce the number of mandatory disclosures by expanding its own set of proactively disclosed information.

[0166] The only possible cheating method the coordinator can attempt is to repeatedly change user_revealed to re-derive it, but this method is subject to three limitations: firstly, c K With c aggThe evidence package has been encapsulated and locked by the key in S2, and the coordinator cannot modify it after releasing the evidence package. The only enumerable degree of freedom is user_revealed. Secondly, user_revealed itself must be made public along with the evidence package. Every change is visible to the outside world, and the auditor can use this to detect abnormal repeated retransmissions. Thirdly, if it is required that the derived result avoids a specified index while user_revealed remains unchanged, it is equivalent to solving the preimage of SHAKE-256, which is not feasible under the cryptographic assumptions.

[0167] Therefore, by setting a reasonable fs_open_ratio (it is recommended to be no less than 0.3), even if the coordinator repeatedly changes user_revealed, the expected number of attempts to conceal multiple unfavorable indexes will increase exponentially with the number of indexes to be concealed, and each attempt will leave a publicly visible trace, thus effectively preventing malicious selective disclosure in engineering.

[0168] The anti-selective disclosure cheating capability of this invention is provided by the fs_revealed forced disclosure mechanism derived from SHAKE-256. The coordinator's manipulation space of fs_revealed is limited to the one-wayness and collision resistance strength of SHAKE-256: SHAKE-256 provides a 256-bit anti-image and 128-bit collision resistance strength in the classical model, and still no less than 128 bits and 85 bits respectively after Grover and BHT acceleration in the quantum model, both satisfying the NISTL1 requirements for post-quantum security strength. It should be noted that even if an attacker exhaustively enumerates σ... PRC Make c agg The input to SHAKE-256 falls into |R| distinct values ​​(in the demonstration parameters, |R|=65536). Since the input also includes a fixed-field separation prefix, pk_arb, message list, algorithm label, signer's public key digest, KEM ciphertext, and k and k... open There are eight other publicly available context segments, including `user_revealed`. For an attacker to precisely elicit a favorable `fs_revealed` within the joint search space, the complexity is still protected by the one-way lower bound of SHAKE-256, similar to c. agg Its own state space size is independent; production deployment uses NIST L1 parameter R. 160,4,3 When |R|=2 480 This item does not constitute a bottleneck.

[0169] The origin and derivation of the core formula of this invention are as follows: (a) The ⊙ operation originates from the construction of finite commutative groups in algebra. This invention applies it to the block circular convolution of regular vectors and utilizes the existence of its inverse to achieve accurate recovery of the commitment vector; (b) The FS-CCB derived formula originates from the Fiat-Shamir heuristic (Fiat-Shamir 1986). Based on this, this invention incorporates all nine public context segments into SHAKE-256 (NIST FIPS 202) as binding input, binding the derived result to all public fields of the evidence package; (c) k open =round(k×fs_open_ratio) uses rounding to ensure that the size of the forced open subset is an integer.

[0170] This invention needs to overcome the following technical difficulties: First, while allowing the coordinator to partially choose the public set, an uncontrollable mandatory public subset is introduced through a cryptographic derivation mechanism to suppress the coordinator's selective disclosure cheating, without sacrificing the coordinator's compliance operation space; Second, under the premise that the auditor does not hold any private key, five keyless verification items are designed that can cover all key contexts of the evidence package and can be independently recalculated by a third party, so that any field substitution or aggregation algebra tampering will be directly detected; Third, the ingestion order of the nine context segments is designed to be uniquely determined to resist substitution and replay, while maintaining the privacy of the key encapsulation mechanism and providing an interface for external keyless auditing, thus resolving this contradictory requirement; Fourth, under the collaboration of multiple heterogeneous algorithms (M2-DSA / ML-DSA / Falcon / SLH-DSA), the universality and scalability of the algorithm registry byte size consistency verification are guaranteed.

[0171] If the auditable aggregate signature revealing and keyless verification method described in this invention is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the auditable aggregate signature revealing and keyless verification method described in this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, external hard drives, ROM, RAM, magnetic disks, or optical disks.

[0172] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. An auditable aggregate signature reveal and keyless verification method, characterized in that, Includes the following steps: S1, the coordinator selects one of the three preset disclosure modes to determine the target number of signatures that need to be disclosed in plaintext in this aggregation; S2, each signer samples a commitment vector in the rule vector space, concatenates the hash value of the commitment vector with their own message to be signed to form a binding string, and calls their respective post-quantum signature algorithm to sign the binding string to obtain the real signature; the coordinator performs key encapsulation on the arbitrator's public key to obtain the key encapsulation ciphertext and symmetric key, derives a random vector for each signer using the symmetric key as a seed, performs block circular convolution operation on each signer's commitment vector and their random vector to obtain the rule vector ciphertext element corresponding to the signer, and accumulates all rule vector ciphertext elements according to the block circular convolution operation to obtain the aggregate anchor value; S3, the coordinator inputs the public context of the evidence package into the hash function in a fixed order, outputs a random byte string, and deterministically derives a set of mandatory public indexes that are uncontrollable by the coordinator. S4, the coordinating party merges the actively designated public index set with the forced public index set to form a final public set, includes the plaintext signatures belonging to this set in the public record, and does not include the remaining indexes in the plaintext signatures but retains the ciphertext elements of the rule vector, and assembles the evidence package; S5, the auditor does not hold the private key and performs structural checks on the evidence package, including verifying the consistency of mandatory public index derivation, the consistency between the final public set and the public records, the legality of the public signature field format, and the legality of the ciphertext structure. If all of them pass, the structure is legal. S6, the arbitrator uses the private key to unblock the symmetric key, restores the commitment information of each signature in the public record item by item, reconstructs the binding string, and calls the corresponding verification function according to the algorithm label to verify the real signature; In particular, the format validity verification in S5 and the call to the verification function in S6 are based on the preset algorithm registry. This registry uses the algorithm tag as the key to record the public key byte size, signature byte size, key pair generation function, signature function and verification function of each signature algorithm, so as to support the unified scheduling and verification of heterogeneous signature algorithms.

2. The auditable aggregate signature disclosure and keyless verification method according to claim 1, characterized in that, In S1, the three preset disclosure modes include: The compact encryption mode means that no single signature is published in plaintext, and all signatures are stored in ciphertext. In this mode, the target number of signatures is zero, and both the forced public index set and the final public set are empty sets. In the partial public mode, the public subset consists of a list of signature indexes that must be published in plaintext, which is actively specified by the coordinator, and a list of cryptographically derived indexes. In this mode, the target number of signatures is greater than zero and less than the total number of signers. In the fully public mode, all signatures are attached to the evidence package in plaintext form. In this case, the final public set is a set consisting of all signature indexes.

3. The auditable aggregate signature disclosure and keyless verification method according to claim 1, characterized in that, In S3, the public context of the evidence package is arranged in the following fixed order, consisting of nine segments: fixed field separation prefix string, arbitrator's public key, all message content to be aggregated, algorithm label used by each signer, digest of each signer's public key, key encapsulation ciphertext, aggregation anchor value, total number of signers and public signature target, and public index list actively specified by the coordinator. The fixed-field separation prefix string is used to distinguish this derivation from hash calls used for other purposes.

4. The auditable aggregate signature disclosure and keyless verification method according to claim 1, characterized in that, In S3, the specific method for deriving the mandatory public index set is as follows: The list of publicly available indexes proactively specified by the coordinator is recorded as the used set; The random byte string output by the hash function is sliced ​​into fixed-length segments and converted into integers. The candidate index is obtained by taking the modulo of the total number of signers. The value of the candidate index ranges from 0 to the total number of signers minus one. If the candidate index is not in the used set, it is selected into the forced public set and simultaneously added to the used set. This process is repeated until the number of elements in the forced public set equals the target number of signatures. The final number of elements in the public set is the sum of the target number of signatures and the number of signatures actively disclosed by the coordinator.

5. The auditable aggregate signature disclosure and keyless verification method according to claim 1, characterized in that, In S2, the block circular convolution operation is defined on the regular vector space and has invertibility. Each regular vector participating in the operation has a unique inverse element, which enables the arbitrator holding the symmetric key to accurately reconstruct the corresponding commitment vector from the ciphertext elements of the individual regular vector without approximate or fault-tolerant decoding; while the auditor who does not hold the symmetric key cannot obtain any commitment vector information from the ciphertext elements of the regular vector. The number of rule vector ciphertext elements in the evidence package is the same as the total number of signers and corresponds one-to-one with each signer; the rule vector ciphertext elements are different from the key-encapsulated ciphertext, which is a single ciphertext data block generated by encrypting the symmetric key using a key encapsulation mechanism, and is used to securely transmit the symmetric key to the arbitrator.

6. The auditable aggregate signature disclosure and keyless verification method according to claim 5, characterized in that, In S5, the structural verification specifically includes the following five items: The first step is to recalculate the mandatory public index set in the manner of S3 and compare it with the set declared in the evidence package; The second step is to verify that the final public index set matches the actual index set contained in the public records. Thirdly, for each publicly signed record, verify that the signer's public key and the byte length of the actual signature value are consistent with the declaration of the corresponding entry in the algorithm registry; The fourth step is to verify that each rule vector ciphertext element conforms to the preset block structure, that is, each block contains one and only one non-zero element. The fifth item is to verify the validity of the length of each top-level ciphertext field and binding string in the evidence package. The binding string is a concatenation string of the message and commitment hash corresponding to each signature.

7. The auditable aggregate signature disclosure and keyless verification method according to claim 1, characterized in that, Each signer may use a different post-quantum signature algorithm, and the algorithm registry may simultaneously register at least two signature algorithms selected from ML-DSA, Falcon, and SLH-DSA.

8. The auditable aggregate signature disclosure and keyless verification method according to claim 1, characterized in that, In S4, for each index belonging to the final public set, the public record contains, in addition to the real signature of the index, the signer's public key of the index, and the algorithm label of the index, the commitment vector and the random vector of the index; in S5, the auditor, without holding any private key or symmetric key, further performs the following for each index belonging to the final public set: verifying that the ciphertext element of the index's rule vector is equal to the block circular convolution of the commitment vector and the random vector; and calling the corresponding verification function according to the algorithm label, using the binding string obtained by concatenating the hash value of the commitment vector with the index message to verify the real signature; thereby completing the cryptographic verification of the publicly disclosed signature without holding the symmetric key.

9. The auditable aggregate signature disclosure and keyless verification method according to claim 1, characterized in that, In S2, the coordinator further derives an authentication encryption key using the symmetric key via an extensible output function and a first domain separation prefix, wherein the first domain separation prefix is ​​different from the domain separation prefix used to derive the random vector; the coordinator uses a one-time initial vector encoded with the signer index at a fixed byte length as a random number, and uses the concatenation string of the aggregate anchor value, the key-encapsulated ciphertext, the signer's algorithm tag, and the signer index as additional authentication data to perform authentication encryption on the signer's real signature, thereby obtaining the signer's real signature ciphertext; In S4, the evidence package carries the true signature ciphertext for each of the signer indices; in S6, after unsealing the symmetric key, the arbitrator derives the authentication encryption key and the one-time initialization vector in the same way as in S2, decrypts and authenticates the true signature ciphertext for each signer index to obtain the true signature of that signer, and uses the hash value of the commitment vector recovered from the ciphertext element of the rule vector of that index and the binding string obtained by concatenating it with the message to be signed of that index, and calls the corresponding verification function according to the algorithm label of that index, thereby completing the verification of the true signature of all k signers one by one; while the auditor who does not hold the symmetric key cannot decrypt any of the true signature ciphertext, and can only perform structural verification on its byte length.

10. An auditable aggregate signature revealing and keyless verification system, employing the auditable aggregate signature revealing and keyless verification method as described in claim 1, characterized in that, include: The public mode selection module is used to select one of three preset public modes and determine the target number of signatures that need to be publicly disclosed in plaintext in this aggregation. The aggregation and encapsulation module is used to perform key encapsulation on the arbitrator's public key to obtain key encapsulation ciphertext and symmetric key. Using the symmetric key as a seed, a random vector is derived for each signer. The ciphertext elements of the rule vector of each signer are calculated and accumulated to obtain the aggregation anchor value. The forced derivation module is used to input the public context of the evidence package into a hash function in a fixed order, and derive a set of forced public indexes that are uncontrollable by the coordinator. The evidence package assembly module is used to merge and deduplicate the actively specified public index set and the forced public index set to form a final public set, and assemble the public evidence package accordingly. The keyless structure verification module allows the auditor to perform the five structure verifications as described in claim 6 on the evidence package without holding any private key, and outputs the verification conclusion and the reason for failure. The keyless signature verification module allows the auditor to perform two cryptographic verifications as described in claim 8 on each index belonging to the final public set without holding any private key or the symmetric key. Specifically, it verifies that the ciphertext element of the index's rule vector is the same as the block circular convolution result of the index's commitment vector and random vector, calls the corresponding verification function according to the index's algorithm label, and verifies the true signature of the index by concatenating the hash value of the index's commitment vector with the binding string obtained by the message to be signed. When both verifications pass, the signature of the index is determined to be cryptographically valid. The distribution verification module allows the arbitrator to unseal the symmetric key with their private key when a decision is needed, recover the commitment vector item by item from all signer indices, reconstruct the binding string for each signature in the public record, and schedule the corresponding verification function according to the algorithm label to complete the verification of the real signature; when the evidence package carries the ciphertext of the real signature item by item as claimed in claim 9, this module completes the verification of the real signature for all k signers.

11. A computer device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements an auditable aggregate signature disclosure and keyless verification method as described in any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements an auditable aggregate signature disclosure and keyless verification method as described in any one of claims 1 to 9.

Images