Device and method for generating a blind signature of a message

Abstract

Device and method for generating a blind signature of a message. Method for generating a blind signature of a message from a cryptographic protocol implemented in a Euclidean network comprising a public key formed of at least one matrix A composed of elements of a set and a secret key linked to the public key known exclusively to a signing entity, said method comprising: generation of a first vector r of the ring; determination of a second vector c equal to Ar +f(m); generation of a third vector s of the ring by the signing entity such that c= A.s, with s respecting at least one constraint relative to its norm; generation of the intermediate signature comprising an aggregation vector resulting from a combination of the first and third vectors; decomposition of the aggregation vector into a first part and a second part; generation of a blind signature composed of said first part and a proof of knowledge of the matrix and said second part. Fig. 1.

Description

Title of the invention: Device and method for generating a blind signature of a message technical field

[0001] The invention relates to the general field of cryptography and more particularly to methods and devices of digital authentication by electronic signature. Previous technique

[0002] As a reminder, electronic signatures are used to control the authenticity of a document or to confirm the veracity of information.

[0003] Traditionally, an authorized body, called the issuer, issues an electronic signature to a user to attest to the veracity of information, for example, relating to personal data or the user's rights. The electronic signature is generated from a secret key associated with a public key. This information can then be authenticated during a check of the electronic signature by a third party called the verifier.

[0004] However, even though authentication methods using electronic signatures have shown their effectiveness and reliability, they still have some drawbacks.

[0005] The main drawback of these methods lies in the information disclosed during a check by a third-party verifier, namely that the check of a digital signature often reveals much more information than necessary.

[0006] In addition, the issuer who issued the electronic signature is able to recognize a signature that he produced when it is presented, which allows him to trace a user in his digital activities.

[0007] These problems have become prominent in recent years due to more stringent regulations on the processing of personal data (GDPR) but also due to difficulties encountered by certain government attempts, such as those establishing age control for internet users accessing sites reserved for certain age groups.

[0008] To solve these problems, new forms of electronic signatures have been developed and are now the subject of several standards.

[0009] In particular, the use of so-called "blind signatures", also called "blank signatures", makes it possible to disclose only the necessary information while preventing the issuer from tracing the use of the signatures.

[0010] In practice, a blind signature can allow a user to prove that he is of legal age to a betting site for example without the identity provider knowing that the request for authentication of the user's age has been used with a betting site.

[0011] The blind signature protocols used are standardized and have been the subject of the ISO / IEC 18370 standard since 2016.

[0012] However, the development of quantum computers poses a significant risk to the security of current cryptographic methods. Indeed, the emergence of these quantum computers is likely to break the vast majority of cryptographic algorithms currently in use, and in particular those mentioned in the ISO / IEC 18370 standard.

[0013] With a view to such an emergence, solutions relating to blind signatures have been developed.

[0014] One can notably cite the article by Pino, R., Katsumata, S. (2022). “A New Framework for More Efficient Round-Optimal Lattice-Based (Partially) Blind Signature via Trapdoor Sampling”, Dodis, Y., Shrimpton, T. (eds) Advances in Cryptology - CRYPTO 2022. CRYPTO 2022. Lecture Notes in Computer Science, vol 13508. Springer, Cham. https: / / doi.org / 10.1007 / 978-3-031-15979-4_ll which describes a method for constructing a blind signature based on Euclidean lattices. However, the signatures constructed by this method are particularly large, on the order of 100 KB, which significantly impairs the efficiency of the protocols.

[0015] Finally, even if the method described in the article by Beullens, W., Lyubashevsky V., Nguyen N. Seiler, G. (2023) Lattice-Based Blind Signatures: Short, Efficient, and Round-Optimal ACM CCS 2023 https: / / dl.acm.org / doi / 10.1145 / 3576915.3616613 allows us to reduce the size of the signatures and thus overcome the disadvantages of Pino, R., Katsumata, S. (2022). "A New Framework for More Efficient Round-Optimal Lattice-Based (Partially) Blind Signature via Trapdoor Sampling", Dodis, Y., Shrimpton, T. (eds) Advances in Cryptology - CRYPTO 2022. CRYPTO 2022. Lecture Notes in Computer Science, vol 13508. Springer, Cham. https: / / doi.org / 10.1007 / 978-3-031-15979-4_11, the method requires the implementation of an extremely complex emission procedure whose duration is estimated at several tens of seconds, making it unusable in practice.

[0016] Thus, in general, the solutions currently used suffer from a lack of resistance to quantum computers. Furthermore, there is currently no method that overcomes this drawback while simultaneously guaranteeing security, ease of implementation, and a reasonable and controlled size of the blind signature.

[0017] There is therefore a real need for a cryptographic solution that is free, at least in part, from the aforementioned disadvantages.

[0018] The invention aims to address all or part of the aforementioned drawbacks. Description of the invention

[0019] The invention relates to a method for generating an intermediate signature by a user entity in order to generate a blind signature of a message m from a cryptographic protocol implemented in a Euclidean network comprising a public key formed of at least one matrix A composed of elements of a set R and a secret key linked to the public key known exclusively to a signing entity, said generation method comprising: - generation of a first vector r composed of elements from the set R; - determination of a second vector c equal to Ar +f(m) with f an arbitrary function; - reception of a third vector s composed of elements of the set R produced by the signing entity from the private key such that c = As, with s respecting at least one constraint relating to its norm; - generation of the intermediate signature comprising an aggregation vector w resulting from a combination of the first and third vectors.

[0020] The invention also relates to a method for generating a blind signature of a message by a user entity from an intermediate signature generated according to the invention, comprising: - decomposition of the aggregation vector into a first part wl and a second part w2 such that there exists a function F such that w=wl+F(w2); - generation of the blind signature composed of said first part and a proof of knowledge of said second part and at least one element allowing to reconstruct matrix A.

[0021] Correspondingly, the invention relates to a user entity for generating an intermediate signature intended to enable the generation of a blind signature of a message m from an intermediate signature by means of a cryptographic protocol implemented in a Euclidean network comprising a public key formed of at least one matrix composed of elements of a set and a secret key linked to the public key known exclusively to a signing entity comprising: - a generation module configured to generate a first vector composed of elements of the set R; - a determination module configured to determine a second vector equal to Ar + f(m) with f an arbitrary function; - a transmission module configured to transmit said second vector to the signing entity; - a receiving module configured to receive a third vector, composed of elements from the set R, produced by the signing entity from the secret key such that c = As, with s respecting at least one constraint relating to its norm; - a generation module configured to generate the intermediate signature comprising an aggregation vector resulting from a combination of the first and third vectors; - optionally, a storage module configured to store said intermediate signature for the message.

[0022] The user entity may further include: - a decomposition module configured to decompose the aggregation vector into a first part and a second part so that there exists a function F such that w = wl + F(w2); - a generation module configured to generate the blind signature composed of said first part and a proof of knowledge of said second part and at least one element enabling the reconstruction of matrix A; - a transmission module configured to transmit said blind signature to a verifying entity.

[0023] Thus, and in general, the invention proposes a method for generating cryptographic signatures having improved resistance to quantum computers, in particular due to its ability to be implemented in a Euclidean network.

[0024] Furthermore, the invention can advantageously enable the generation of relatively small blind signatures, particularly through the combination of the first and third vectors. Indeed, transmitting a proof of knowledge of two elements rather than three reduces the size of the signature. Moreover, the combination of the first and third vectors thus achieved allows the aggregation vector to be decomposed, and in particular allows a first part wl to be transmitted directly, thereby limiting the size of the elements to be concealed in the proof of knowledge and thus that of the blind signature.

[0025] Finally, the method according to the invention can be particularly efficient, in terms of computation time, and simple to implement.

[0026] The invention also relates to a method for blindly signing a message by a signing entity using a cryptographic protocol implemented in a Euclidean network comprising a public key formed from at least one matrix A composed of elements from a set R and a secret key linked to the public key known exclusively to said signing entity, said signing method comprising: - reception of a second vector c calculated from a first vector r composed of elements from the set R, of the matrix A, and masking the message, the first and the second vectors being respectively generated and generated and transmitted by a user entity; - generation of a third vector s composed of elements of the set R such that c = As, using the secret key, with s respecting at least one constraint relating to its norm; - transmission of the third vector to the user entity so as to allow the generation of a blind signature determined from the first and third vectors.

[0027] Correspondingly, the invention relates to a signing entity for enabling the blind signing of a message from a cryptographic protocol implemented in a Euclidean network comprising a public key formed of at least one matrix A composed of elements from a set R and a secret key linked to the public key known exclusively to said signing entity, comprising: - a receiving module configured to receive a second vector c calculated by a user entity from a first vector r composed of elements of the set, the matrix, and masking the message; - a generation module configured to generate, using the secret key, a third vector s such that c = As, with s respecting at least one constraint relating to its norm; - a transmission module configured to transmit said third vector s to the user entity so as to allow the generation of a blind signature determined from the first and third vectors.

[0028] In general, the invention relates to a method for signing a message m using a cryptographic protocol implemented in a Euclidean network comprising a public key formed from at least one matrix A composed of elements from a set R and a secret key linked to the public key known exclusively to a signing entity, comprising: - generation of a first vector r composed of elements from the set R by a user entity; - determination of a second vector c equal to A.r+f(m), with f an arbitrary function, by a user entity; - generation of a third vector s composed of elements of the set produced by the signing entity from the secret key such that c=As, with s respecting at least one constraint relating to its norm; - generation, by a user entity, of the intermediate signature comprising an aggregation vector w resulting from a combination of the first and third vectors; - decomposition of the aggregation vector into a first part wl and a second part w2 such that there exists a function F such that w = wl + F(w2); - generation of a blind signature composed of said first part and proof of knowledge of said second part and at least one element allowing the reconstruction of matrix A; - transmission of said blind signature by the user entity to a verifying entity; - verification of said blind signature by the verifying entity.

[0029] Correspondingly, the invention relates to a signature system comprising: - a signatory entity (E), - a user entity (U), - a verifying entity (V), configured to implement a signature process according to the invention.

[0030] In certain embodiments of the processes described above, the public key is a family of matrices dependent on a parameter, said matrix being a matrix from the family of matrices defined by a value for said parameter. Advantageously, said parameter is known only to the signatory and user entities during the generation of the intermediate signature.

[0031] Said matrix can be obtained by the user entity by transmission of said matrix or of the parameter value by the signatory entity to the user entity.

[0032] If the public key is a family of matrices dependent on a parameter, said matrix being then a matrix of the family of matrices defined by a value for said parameter, then the process of blindly signing a message by a signing entity may include a prior step of selecting a value for the parameter and transmitting said parameter and / or said matrix to the user entity.

[0033] Matrix A is advantageously selected by the signing entity via the selection of said parameter value. Preferably, matrix A is known, at the time of the selection of said value, only to the signing entity. Knowledge of the value for the parameter allows the matrix A to be defined. The signing entity can transmit either the parameter value or the matrix to the user entity so as to allow the generation of the second vector with this matrix A, thus linking the first and third vectors.

[0034] The proof of knowledge may advantageously be a proof of knowledge of the parameter value and of said second part.

[0035] The size of the proof of knowledge can then be further reduced.

[0036] In particular, the invention makes it possible to disclose part of the aggregation vector without compromising the security of the cryptographic system.

[0037] In particular embodiments, the proof of knowledge is generated so as to demonstrate that the relation A.wl+AF(w2) = f(m) is satisfied.

[0038] In particular embodiments, the combination of the first and third vectors is carried out so that the norm of said combination is less than the sum of the norms of the first and third vectors.

[0039] In particular embodiments, the combination of the first and third vectors is carried out so that the dimension and the norm of said combination is less than respectively the sum of the dimensions and the sum of the norms of the first and third vectors.

[0040] For example, the combination of the first and third vectors consists of a subtraction of said vectors.

[0041] In a particular embodiment, all or part of the steps of a process according to the invention, preferably all the steps, are implemented by computer program instructions.

[0042] Thus, the invention also relates to a computer program comprising code instructions, which when executed by means of a computer enable the implementation of a process according to the invention, as well as a computer-readable recording medium on which is recorded a computer program comprising instructions for the execution of the steps of a process according to the invention.

[0043] The aforementioned features and advantages, as well as others, will become apparent from the detailed description that follows. This detailed description refers to the accompanying drawings. Brief description of the drawings

[0044] The attached drawings are schematic and are intended primarily to illustrate the principles of the exposition.

[0045] On these drawings, from one figure to another, identical elements (or parts of elements) are identified by the same reference signs.

[0046] [Fig-1] Fig. 1 illustrates the steps of an example of the implementation of a process of signing a message according to the invention,

[0047] [Fig.2] Fig.2 represents an example of the functional architecture of an entity user according to the invention,

[0048] [Fig.3] Fig.3 represents an example of the functional architecture of an entity signatory according to the invention,

[0049] [Fig.4] Figure [Fig.4] schematically illustrates a signature system according to the invention,

[0050] [Fig. 5] [Fig. 5] illustrates an example of the hardware architecture of a user entity and / or a signatory entity and / or a signature system according to the invention. Description of the implementation methods

[0051] To make the explanation more concrete, an example of an embodiment of a method for signing a message m is described in detail below, with reference to the accompanying drawings. It should be noted that the invention is not limited to this example.

[0052] The signing process includes steps implemented by a signing entity E, steps implemented by a user entity U and steps implemented by a verifying entity V.

[0053] The user entity includes means of communication with the signatory and verifying entities.

[0054] The message m is unknown to the signing entity that signs it.

[0055] The signature process is based on a predefined cryptographic protocol. The signature protocol is characterized by a key pair {Kp, Ks], Kp being a public key accessible to all entities, and Ks being a private key known exclusively to the signing entity.

[0056] The public key includes at least one matrix A composed of elements from a set R. The set R can be a ring.

[0057] In preferred embodiments of the invention, the public key Kp is a family of matrices A(t) defined by the parameter t. In these preferred embodiments, the matrix A is a matrix from the family of matrices A(t) defined by the parameter value t*. Knowing the value t* for the parameter t is equivalent to knowing the matrix A.

[0058] When matrix A is a matrix from a family of matrices A(t), the signature process 100 includes a step E10 of selecting said value t* for the parameter t, preferably by the signing entity. The signature process further includes a step E12 of obtaining matrix A by the user entity U. Obtaining the matrix by the user entity can be accomplished by transmitting said parameter value t* or by transmitting said matrix A to the user entity by the signing entity E.

[0059] In particular embodiments, the public key Kp contains only the matrix A, in which case the matrix is ​​directly accessible to the user entity U.

[0060] The signature process 100 includes the generation of a blind signature S from an intermediate signature S'.

[0061] The signature process includes a step E14 of generation, for example random, of a first vector r composed of elements of the set R.

[0062] Preferably, the first vector r is chosen such that a norm of said vector r is relatively small, in other words, such that said norm is less than a predefined value b1. For example, a first vector r can be chosen by uniformly generating on the interval [-bl, bl] each of the elements composing said first vector r, bl being a predefined value. In another embodiment, the first vector is chosen by the successive generation of vectors following a predefined distribution, until the norm of the generated vector is less than the value bl.

[0063] The signature process 100 then includes a step E16 of determining a second vector c composed of elements of the set R.

[0064] The second vector c is determined from the first vector r and the matrix A, and masks the message m.

[0065] In particular, the second vector c can take the following form: c = Ar + f(m) where f is any function with values ​​in the same space as Ar

[0066] The function f is, for example, a hash function.

[0067] The signature process 100 then includes a step El8 of obtaining the second vector c by the signing entity E. This step is carried out by the transmission of the second vector c by the user entity U to the signing entity E.

[0068] The signature process 100 further includes a step E20 of determining a third vector s composed of elements of the set R.

[0069] The third vector s is determined from the matrix A such that c = As, with s satisfying at least one constraint on its norm. Solving such an equation, by the signing entity, knowing the matrix A and the second vector c, is possible thanks to knowledge of the secret key Ks.

[0070] Preferably, the third vector s is chosen such that a norm of said vector s is relatively small, that is, such that said norm is less than a predefined value b2, which is the same as or different from the predefined value bl. In other words, the signing entity seeks a vector in the ring R satisfying the conditions: c = As and Ilsll <b2. Une contrainte relative à la norme du troisième vecteur s peut donc être d’avoir une norme de s inférieure à une valeur prédéfinie b2. Par exemple, un troisième vecteur s peut être déterminé en suivant la méthode décrite dans l’article Micciancio, D., Peikert, C. (2012). Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller. In: Pointcheval, D., Johansson, T. (eds) Advances in Cryptology - EUROCRYPT 2012. EUROCRYPT 2012. Lecture Notes in Computer Science, vol 7237. Springer, Berlin, Heidelberg, https: / / doi.org / 10.1007 / 978-3-642-29011-4_41.

[0071] The signing process then includes a step E22 of obtaining the third vector s by the entity during which the third vector s is transmitted by the signing entity E to the user entity U.

[0072] The user entity U determines, during a step E24 of determining an intermediate signature S', an aggregation vector w from the first and third vectors. For example, the aggregation vector can take the form: w = s - r.

[0073] Since vectors s and r can both be defined from the same matrix A, the combination of the first and third vectors makes it possible to considerably reduce the amount of information to be transmitted, without loss of information.

[0074] Furthermore, when the first and third vectors r and s are chosen such that their respective norm is relatively small, the norm of the combination of these two vectors r and s is also relatively small, making it possible to further limit the size of the intermediate signature and therefore ultimately of the blind signature.

[0075] The intermediate signature S' is determined by the aggregation vector and, where applicable, by the parameter value t*: S'=(w, t*).

[0076] The intermediate signature S' can be stored by the user entity U for the message m.

[0077] From this intermediate signature S', the user entity can generate a blind signature S.

[0078] The signature process includes, for this purpose, a step E26 of decomposition of the aggregation vector w into a first part wl and a second part w2 so that there exists a function F such that w=wl+F(w2).

[0079] In particular embodiments, the elements of the first part wl are the remainders of the Euclidean divisions of the elements constituting the vector w by an integer a, the elements of the second part w2 are the quotients of said Euclidean division and the function F is the function F(x)=ax.

[0080] The signature method includes a step E28 for determining the blind signature S, the blind signature S being composed of said first part wl, and a proof of knowledge P of at least one element allowing the reconstruction of the matrix A, for example the value of parameter t* when the matrix A is a matrix of a family of matrices A(t), and said second part w2. By hiding only a part of the aggregation vector w, the performance can be improved. For example, if we consider that each coefficient composing the aggregation vector w has n bits and that each coefficient of the first vector r has m bits, the invention makes it possible to disclose m-1 bits out of the n. In particular, when the decomposition consists of a Euclidean division of the aggregation vector by an integer, the least significant bits are advantageously disclosed and the most significant bits are advantageously hidden in the proof of knowledge.

[0081] The proof of knowledge P can be generated so as to demonstrate that the relation: A.wl+AF(w2) = f(m) is satisfied.

[0082] The user entity U can then transmit the blind signature S to the verifying entity V.

[0083] The verifying entity V obtains said blind signature S during step E30 and verifies it by classically executing a verification algorithm specific to proof P during a verification step E32.

[0084] The signature process as described above, in all its variants, can be implemented by means of a signature system 1 as represented in [Fig.4] comprising: a user entity U, a signatory entity E and a verifying entity V.

[0085] Figure 1 also illustrates a method 200 for generating an intermediate signature by a user entity U in order to generate a blind signature.

[0086] Such a method 200 of generating an intermediate signature by a user entity U can advantageously be implemented by means of a user entity U as represented in [Fig.2], comprising at least the modules of the set Ml.

[0087] Figure 1 also illustrates a method 300 for generating a blind signature by a user entity U.

[0088] Such a method 300 of generating a blind signature by a user entity U can advantageously be implemented by means of a user entity U as represented in [Fig.2], comprising at least the modules of set M1 and set M2.

[0089] The user entity U includes modules configured to implement a process 200 for generating an intermediate signature comprising at least one generation module M14 configured to implement a step E14 for generating a first vector r composed of elements from the set R, a determination module M16 configured to implement a step E14 for determining a second vector c equal to Ar + f(m), a transmission module M18 configured to implement a step E18 for transmitting the second vector c to the signing entity E; a reception module M22 configured to implement a step E22 for receiving the third vector s composed of elements from the set R produced by the signing entity E from the secret key Ks such that c = A.s, with s respecting at least one constraint relating to its norm; a generation module M24 configured to implement an E24 generation step of the intermediate signature S' composed of an aggregation vector w resulting from a combination of the first r and third s vectors.

[0090] The user entity may optionally include an M40 storage module configured to store said intermediate signature S' for message m.

[0091] The user entity may optionally include an M12 module configured to implement an E12 step for receiving the parameter value t* or matrix A.

[0092] The user entity may further include decomposition modules M26 and blind signature generation modules M28 to implement a method for generating a blind signature from said intermediate signature, the decomposition module 26 being configured to implement a decomposition step E26 of the aggregation vector w into a first part wl and a second part w2 such that there exists a function F such that w = wl + F(w2), and the generation module M28 being configured to implement a blind signature generation step E28 S consisting of said first part wl and a proof of knowledge P of at least one element enabling the reconstruction of matrix A and said second part w2.

[0093] The user entity U may further include a transmission module configured to implement a step E30 of transmission of said blind signature S to a verifying entity V.

[0094] Figure 1 also illustrates a method 400 for blindly signing a message by the signing entity E.

[0095] Such a method 400 of blind signing of a message by a signing entity E can advantageously be implemented by means of a signing entity E as represented in [Fig.3].

[0096] The signing entity E includes a receiving module M18 configured to implement a receiving step El8 of the second vector c calculated by a user entity U from a first vector r composed of elements from the set R, the matrix A, and masking the message m; a generation module M20 configured to implement a generation step E20, using the secret key Ks, of a third vector s composed of elements from the set R such that c = As, with s respecting at least one constraint relating to its norm; a transmission module M22 configured to implement a transmission step E22 of the third vector s to the user entity U so as to allow the generation of a blind signature determined from the first and third vectors.

[0097] The signing entity E may further include a selection module configured to implement a step E10 of selecting a value t* for a parameter t to define the matrix A belonging to a family of matrices A(t) defined by said parameter.

[0098] In a particular embodiment, the different steps of the processes according to the invention are determined by computer program instructions.

[0099] Accordingly, the invention also relates to a computer program on an information medium, this program being capable of being implemented in a user entity, a signatory entity, and / or a signature system according to the invention or more generally in a computer, this program comprising instructions adapted to the implementation of the steps of a process according to the invention as described above.

[0100] Thus, in particular embodiments, the signature system 1 has the hardware architecture of a computer, as shown in [Fig. 5]. It is appropriate It should be noted that some elements of this architecture may be confused with existing devices.

[0101] More specifically, the signature system 1 may include a PC processor, a ROM read-only memory, a RAM random-access memory and communication means.

[0102] The read-only memory of the signature system 1 constitutes a recording medium readable by the processor and on which is recorded a computer program according to the invention, comprising instructions for the execution of the steps of the signature process 100 according to the invention detailed above and in particular illustrated in [Fig.1].

[0103] This computer program equivalently defines functional modules (software) of the signature system 1.

[0104] This program may use any programming language, and be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0105] Equivalently, in particular embodiments, the user entity U and / or the signatory entity have the hardware architecture of a computer, as represented in [Fig. 5]. It should be noted that certain elements of this / these architectures may be confused with existing devices.

[0106] The invention also relates to a computer-readable information or recording medium, comprising instructions for a computer program as mentioned above.

[0107] The information or recording medium can be any entity or device capable of storing the program. For example, the medium can include a storage means, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a floppy disk or a hard disk.

[0108] On the other hand, the information or recording medium can be a transmissible medium such as an electrical or optical signal, which can be transmitted via an electrical or optical cable, by radio, or by other means. The program according to the invention can, in particular, be downloaded onto an Internet-type network.

[0109] Alternatively, the information or recording medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the process in question.

[0110] Although the present invention has been described with reference to specific embodiments, it is evident that modifications and changes can be made to these examples without departing from the general scope of the invention as defined by the claims. In particular, individual features of the The various embodiments illustrated / mentioned can be combined in additional embodiments. Therefore, the description and drawings should be considered in an illustrative rather than restrictive sense.

[0111] All the characteristics described with reference to a process are transposable, alone or in combination, to a device, and conversely, all the characteristics described with reference to a device are transposable, alone or in combination, to a process.

Claims

Demands

1. A method for generating an intermediate signature (S') by a user entity (U) in order to generate a blind signature (S) of a message (m) from a cryptographic protocol implemented in a Euclidean network comprising a public key (Kp) formed of at least one matrix (A) composed of elements of a set (R) and a secret key (Ks) linked to the public key known exclusively to a signing entity (E), said generation method comprising: - generation of a first vector (r) composed of elements of the set (R); - determination of a second vector (c) equal to Ar +f(m) with f an arbitrary function; - reception of a third vector (s) composed of elements of the set (R) produced by the signing entity (E) from the private key (Ks) such that c= A.s, with s respecting at least one constraint relating to its norm; - generation of the intermediate signature (S') comprising an aggregation vector (w) resulting from a combination of the first (r) and third (s) vectors.

2. A generation method according to claim 1 wherein the public key (Kp) is a family of matrices (A(t)) dependent on a parameter (t), said matrix (A) being a matrix of the family of matrices defined by a value (t*) for said parameter (t).

3. Generation method according to claim 2, said matrix (A) being obtained by transmission of said matrix or of the parameter value (t*) by the signatory entity to the user entity.

4. A generation method according to any one of claims 1 or 2 wherein the combination of the first and third vectors is carried out such that the dimension and the norm of said combination is respectively less than the sum of the dimensions and the sum of the norms of the first and third vectors.

5. A method for generating a blind signature (S) of a message (m) by a user entity (U) from an intermediate signature (S') generated according to any one of claims 1 to 4, comprising: - decomposition of the aggregation vector into a first part (wl) and a second part (w2) such that there exists a function F such that w=wl+F(w2); - generation of the blind signature (S) composed of said first part (wl) and a proof of knowledge (P) of at least one element allowing to reconstruct the matrix (A) and said second part (w2).

6. Generation method according to claim 5 dependent on claim 2, proof of knowledge being proof of knowledge of the parameter value (t*) and of said second part (w2).

7. A generation method according to any one of claims 5 or 6, the proof of knowledge being generated so as to satisfy the relation A.wl+AF(w2) = f(m).

8. A method for blindly signing (S) a message (m) by a signing entity (R) using a cryptographic protocol implemented in a Euclidean network comprising a public key (Kp) formed from at least one matrix (A) composed of elements of a set (R) and a secret key (Ks) linked to the public key known exclusively to said signing entity (E), said signing method comprising: - receiving a second vector (c) calculated from a first vector (r) composed of elements of the set (R), of the matrix (A), and masking the message (m), the first and second vectors being respectively generated and transmitted by a user entity (U); - generating a third vector (s) composed of elements of the set (R) such that c = A.s, by means of the secret key (Ks), with s respecting at least one constraint relating to its norm; - transmission of the third vector (s) to the user entity (U) so as to allow the generation of a blind signature determined from the first and third vectors.

9. Signature method according to claim 8 wherein the intermediate signature is generated from a method according to claim 2, comprising a prior step of selecting said value for the parameter and transmitting said parameter and / or said matrix to the user entity (U).

10. A method for signing a message (m) using a cryptographic protocol implemented in a Euclidean network comprising a public key (Kp) formed of at least one matrix (A) composed of elements of a set (R) and a secret key (Ks) linked to the public key known exclusively to a signing entity (E), comprising: - generation of a first vector (r) composed of elements of the set (R) by a user entity (U); - determination of a second vector (c) equal to A.r+f(m), with f an arbitrary function, by a user entity (U); - generation of a third vector (s) composed of elements of the set (R) produced by the signing entity (E) from the secret key (Ks) such that c=A.s, with s respecting at least one constraint relating to its norm; - generation, by a user entity (U), of the intermediate signature (S') comprising an aggregation vector (w) resulting from a combination of the first (r) and third (s) vectors; - decomposition of the aggregation vector (w) into a first part (wl) and a second part (w2) such that there exists a function F such that w = wl + F(w2); - generation of a blind signature (S) composed of said first part (wl) and a proof of knowledge (P) of at least one element allowing the reconstruction of the matrix (A) and said second part (w2); - transmission of said blind signature (S) by the user entity (U) to a verifying entity (V); - verification of said blind signature (S) by the verifying entity (V).

11. User entity (U) for generating an intermediate signature (S') intended to enable the generation of a blind signature (S) of a message (m) from an intermediate signature (S') by means of a cryptographic protocol implemented in a Euclidean network comprising a public key (Kp) formed of at least one matrix (A) composed of elements of a set (R) and a secret key (Ks) linked to the public key known exclusively to a signing entity (E) comprising: - a generation module configured to generate a first vector (r) composed of elements of the set (R);

12.

13. - a determination module configured to determine a second vector (c) equal to Ar + f(m) with f an arbitrary function, - a transmission module configured to transmit said second vector (c) to the signing entity (E); - a receiving module configured to receive a third vector (s) composed of elements of the set (R) produced by the signing entity (E) from the secret key (Ks) such that c = As, with s respecting at least one constraint relating to its norm; - a generation module configured to generate the intermediate signature (S') comprising an aggregation vector (w) resulting from a combination of the first (r) and third (s) vectors. User entity (U) according to claim 11 further comprising: - a decomposition module configured to decompose the aggregation vector (w) into a first part (wl) and a second part (w2) such that there exists a function F such that w = wl + F(w2); - a generation module configured to generate the blind signature (S) composed of said first part (wl) and a proof of knowledge (P) of at least one element enabling the reconstruction of the matrix (A) and said second part (w2); - a transmission module configured to transmit said blind signature (S) to a verifying entity (V). Signing entity (E) to enable the blind signing (S) of a message (m) from a cryptographic protocol implemented in a Euclidean network comprising a public key (Kp) formed from at least one matrix (A) composed of elements from a set (R) and a secret key (Ks) linked to the public key known exclusively to said signing entity (E), comprising: - a receiving module configured to receive a second vector (c) calculated by a user entity (U) from a first vector (r) composed of elements of the set (R), of the matrix (A), and masking the message (m); - a generation module configured to generate, using the secret key (Ks), a third vector (s) of the ring (R) such that c = As, with s satisfying at least one constraint related to its norm; - a transmission module configured to transmit said third vector (s) to the user entity (U) so as to allow the generation of a blind signature determined from the first and third vectors.

14. Signature system comprising: - a signing entity (E), - a user entity (U), - a verifying entity (V), configured to implement a signature process according to claim 10.

15. Computer program comprising instructions for carrying out the steps of the process according to any one of claims 1 to 10 when said program is executed by a computer.

16. Computer-readable recording medium on which is recorded a computer program comprising instructions for carrying out the steps of the process according to any one of claims 1 to 10.

Images