Device and method for generating a blind signature for a message

Abstract

The invention relates to a method for generating a blind signature for a message based on a cryptographic protocol implemented in a Euclidean network comprising a public key formed of at least one matrix A composed of elements of a set and a secret key linked to the public key and known exclusively to a signatory entity, the method comprising: generating a first ring vector r; determining a second vector c equal to A.r +f(m); the signatory entity generating a third ring vector s such that c= A.s, with s complying with at least one constraint relating to its norm; generating the intermediate signature comprising an aggregation vector resulting from a combination of the first and third vectors; decomposing the aggregation vector into a first part and a second part; generating a blind signature composed of the first part and of a proof of knowledge of the matrix and of the second part.

Description

Device and method for generating a blind signature of a message

[0001] The invention relates to the general field of cryptography and more particularly concerns methods and devices for digital authentication by electronic signature.

[0002] As a reminder, electronic signatures are used to verify the authenticity of a document or to confirm the veracity of information.

[0003] Typically, an authorized body, called the issuer, provides an electronic signature to a user to attest to the veracity of information, such as personal data or user rights. The electronic signature is generated using a secret key associated with a public key. This information can then be authenticated during a check of the electronic signature by a third party called the verifier.

[0004] However, even though authentication methods using electronic signatures have proven their effectiveness and reliability, they still have drawbacks.

[0005] The main drawback of these methods lies in the information disclosed during a check by a third-party verifier, namely that the check of a digital signature often reveals much more information than necessary.

[0006] In addition, the issuer who issued the electronic signature is able to recognize a signature that it produced when it is presented, which allows it to trace a user in their digital activities.

[0007] These problems have become more prominent in recent years due to stricter regulations on the processing of personal data (GDPR) but also due to difficulties encountered by certain government attempts, such as those establishing age verification for internet users accessing sites reserved for certain age groups.

[0008] To solve these problems, new forms of electronic signatures have been developed and are now the subject of several standards.

[0009] In particular, the use of so-called "blind signatures", also known as "blank signatures", makes it possible to disclose only the necessary information while preventing the issuer from tracing the use of the signatures.

[0010] In practical terms, a blind signature can allow a user to prove that they are of legal age to a betting site, for example, without the identity provider knowing that the request for authentication of the user's age has been used with a betting site.

[0011] The blind signature protocols used are standardized and have been the subject of the ISO / IEC 18370 standard since 2016.

[0012] However, the development of quantum computers poses a significant risk to the security of current cryptographic methods. Indeed, the emergence of these quantum computers is likely to break the vast majority of cryptographic algorithms currently in use, particularly those mentioned in the ISO / IEC 18370 standard.

[0013] With such an emergence in mind, solutions involving blind signatures have been developed.

[0014] One notable example is the article by Pino, R., Katsumata, S. (2022). “A New Framework for More Efficient Round-Optimal Lattice-Based (Partially) Blind Signature via Trapdoor Sampling”, Dodis, Y., Shrimpton, T. (eds) Advances in Cryptology – CRYPTO 2022. CRYPTO 2022. Lecture Notes in Computer Science, vol 13508. Springer, Cham. https: / / doi.org / 10.1007 / 978-3-031-15979-4_11, which describes a method for constructing a blind signature based on Euclidean lattices. However, the signatures constructed using this method are particularly large, on the order of 100 KB, which significantly impacts the efficiency of the protocols.

[0015] Finally, even if the method described in the article by Beullens, W., Lyubashevsky V., Nguyen N. Seiler, G. (2023)Lattice-Based Blind Signatures: Short, Efficient, and Round-OptimalACM CCS 2023 https: / dl.acm.org / doi / 10.1145 / 3576915.3616613 makes it possible to reduce the size of the signatures and thus overcome the disadvantages of Pino, R., Katsumata, S. (2022). “A New Framework for More Efficient Round-Optimal Lattice-Based (Partially) Blind Signature via Trapdoor Sampling”, Dodis, Y., Shrimpton, T. (eds) Advances in Cryptology – CRYPTO 2022. CRYPTO 2022. Lecture Notes in Computer Science, vol 13508. Springer, Cham. https: / doi.org / 10.1007 / 978-3-031-15979-4_11, the method requires the implementation of an extremely complex emission procedure whose duration is estimated at several tens of seconds, making it unusable in practice.

[0016] Thus, in general, currently used solutions suffer from a lack of resistance to quantum computers. Furthermore, there is currently no method to overcome this drawback while simultaneously guaranteeing security, ease of implementation, and a reasonable and controlled size of the blind signature.

[0017] There is therefore a real need for a cryptographic solution that is free, at least in part, from the aforementioned drawbacks.

[0018] The invention aims to address all or part of the aforementioned drawbacks.

[0019] The invention relates to a method for generating an intermediate signature by a user entity in order to generate a blind signature of a message m from a cryptographic protocol implemented in a Euclidean network comprising a public key formed of at least one matrix A composed of elements of a set R and a secret key linked to the public key known exclusively to a signing entity, said generation method comprising:- generation of a first vector r composed of elements of the set R;- determination of a second vector c equal to Ar +f(m) with f an arbitrary function;- reception of a third vector s composed of elements of the set R produced by the signing entity from the private key such that c = As, with s respecting at least one constraint relating to its norm;- generation of the intermediate signature comprising an aggregation vector w resulting from a combination of the first and third vectors.

[0020] The invention also relates to a method of generating a blind signature of a message by a user entity from an intermediate signature generated according to the invention, comprising: - decomposition of the aggregation vector into a first part w1 and a second part w2 such that there exists a function F such that w=w1+F(w2); - generation of the blind signature composed of said first part and a proof of knowledge of said second part and at least one element enabling the reconstitution of the matrix A.

[0021] Correspondingly, the invention relates to a user entity for generating an intermediate signature intended to enable the generation of a blind signature of a message m from an intermediate signature by means of a cryptographic protocol implemented in a Euclidean network comprising a public key formed of at least one matrix composed of elements of a set and a secret key linked to the public key known exclusively to a signing entity comprising: - a generation module configured to generate a first vector composed of elements of the set R; - a determination module configured to determine a second vector equal to Ar + f(m) with f an arbitrary function; - a transmission module configured to transmit said second vector to the signing entity; - a reception module configured to receive a third vector, composed of elements of the set R, produced by the signing entity from the secret key such that c = A.s, with s respecting at least one constraint relating to its standard; - a generation module configured to generate the intermediate signature comprising an aggregation vector resulting from a combination of the first and third vectors; - optionally, a storage module configured to store said intermediate signature for the message.

[0022] The user entity may also include: - a decomposition module configured to decompose the aggregation vector into a first part and a second part such that there exists a function F such that w = w1 + F(w2); - a generation module configured to generate the blind signature composed of said first part and a proof of knowledge of said second part and at least one element enabling the reconstruction of matrix A; - a transmission module configured to transmit said blind signature to a verifying entity.

[0023] Thus, and in general, the invention proposes a method for generating cryptographic signatures having improved resistance to quantum computers, in particular due to its ability to be implemented in a Euclidean network.

[0024] Furthermore, the invention can advantageously enable the generation of relatively small blind signatures, particularly through the combination of the first and third vectors. Indeed, transmitting a proof of knowledge of two elements instead of three reduces the size of the signature. Moreover, the resulting combination of the first and third vectors allows the aggregation vector to be decomposed, and in particular, a first part w1 to be transmitted directly, thereby limiting the size of the elements to be concealed in the proof of knowledge and thus the size of the blind signature.

[0025] Finally, the method according to the invention can be particularly efficient, in terms of computation time, and simple to implement.

[0026] The invention also relates to a method of blindly signing a message by a signing entity using a cryptographic protocol implemented in a Euclidean network comprising a public key formed of at least one matrix A composed of elements of a set R and a secret key linked to the public key known exclusively to said signing entity, said signing method comprising: - receiving a second vector c calculated from a first vector r composed of elements of the set R, of the matrix A, and masking the message, the first and second vectors being respectively generated and transmitted by a user entity; - generating a third vector s composed of elements of the set R such that c = A.s, by means of the secret key, with s respecting at least one constraint relating to its norm; - transmission of the third vector to the user entity so as to allow the generation of a blind signature determined from the first and third vectors.

[0027] Correspondingly, the invention relates to a signing entity to enable the blind signing of a message from a cryptographic protocol implemented in a Euclidean network comprising a public key formed of at least one matrix A composed of elements of a set R and a secret key linked to the public key known exclusively to said signing entity, comprising: - a receiving module configured to receive a second vector c calculated by a user entity from a first vector r composed of elements of the set, of the matrix, and masking the message; - a generating module configured to generate, by means of the secret key, a third vector s such that c = As, with s respecting at least one constraint relating to its norm; - a transmission module configured to transmit said third vector s to the user entity so as to enable the generation of a blind signature determined from the first and third vectors.

[0028] In general, the invention relates to a method of signing a message m from a cryptographic protocol implemented in a Euclidean network comprising a public key formed of at least one matrix A composed of elements of a set R and a secret key linked to the public key known exclusively to a signing entity, comprising:- generation of a first vector r composed of elements of the set R by a user entity;- determination of a second vector c equal to A.r+f(m), with f an arbitrary function, by a user entity;- generation of a third vector s composed of elements of the set produced by the signing entity from the secret key such that c=A.s, with s respecting at least one constraint relating to its norm; - generation, by a user entity, of the intermediate signature comprising an aggregation vector w resulting from a combination of the first and third vectors; - decomposition of the aggregation vector into a first part w1 and a second part w2 such that there exists a function F such that w = w1 + F(w2); - generation of a blind signature composed of said first part and a proof of knowledge of said second part and at least one element allowing the reconstitution of the matrix A; - transmission of said blind signature by the user entity to a verifying entity; - verification of said blind signature by the verifying entity.

[0029] Correspondingly, the invention relates to a signature system comprising: - a signing entity (E), - a user entity (U), - a verifying entity (V), configured to implement a signature process according to the invention.

[0030] In some embodiments of the processes described above, the public key is a family of matrices dependent on a parameter, said matrix being a matrix from the family of matrices defined by a value for said parameter. Advantageously, said parameter is known only to the signatory and user entities during the generation of the intermediate signature.

[0031] The said matrix can be obtained by the user entity by transmission of said matrix or of the parameter value from the signing entity to the user entity.

[0032] If the public key is a family of matrices dependent on a parameter, said matrix being then a matrix of the family of matrices defined by a value for said parameter, then the process of blindly signing a message by a signing entity may include a prior step of selecting a value for the parameter and transmitting said parameter and / or said matrix to the user entity.

[0033] Matrix A is advantageously selected by the signing entity through the selection of the parameter value. Preferably, matrix A is known, at the time of the parameter value selection, only to the signing entity. Knowing the parameter value allows matrix A to be defined. The signing entity can transmit either the parameter value or the matrix to the user entity so as to enable the generation of the second vector with this matrix A, thus linking the first and third vectors.

[0034] The proof of knowledge can advantageously be a proof of knowledge of the parameter value and of the said second part.

[0035] The size of the proof of knowledge can then be further reduced.

[0036] In particular, the invention makes it possible to disclose part of the aggregation vector without compromising the security of the cryptographic system.

[0037] In particular embodiments, the proof of knowledge is generated so as to demonstrate that the relation A.w1+AF(w2) = f(m) is satisfied.

[0038] In particular embodiments, the combination of the first and third vectors is carried out such that the norm of said combination is less than the sum of the norms of the first and third vectors.

[0039] In particular embodiments, the combination of the first and third vectors is carried out such that the dimension and the norm of said combination is less than respectively the sum of the dimensions and the sum of the norms of the first and third vectors.

[0040] For example, combining the first and third vectors involves subtracting those vectors.

[0041] In a particular embodiment, all or part of the steps of a process according to the invention, preferably all the steps, are implemented by computer program instructions.

[0042] Thus, the invention also relates to a computer program comprising code instructions, which when executed by means of a computer enable the implementation of a process according to the invention, as well as a computer-readable recording medium on which is recorded a computer program comprising instructions for the execution of the steps of a process according to the invention.

[0043] The aforementioned features and advantages, as well as others, will become apparent upon reading the detailed description that follows. This detailed description refers to the attached drawings.

[0044] The attached drawings are schematic and are primarily intended to illustrate the principles of the presentation.

[0045] In these drawings, from one figure to another, identical elements (or parts of elements) are identified by the same reference symbols.

[0046] This illustrates the steps of an example of implementing a method for signing a message according to the invention.

[0047] This represents an example of the functional architecture of a user entity according to the invention,

[0048] This represents an example of the functional architecture of a signatory entity according to the invention.

[0049] A schematic representation of a signature system according to the invention,

[0050] Laillustre an example of hardware architecture of a user entity and / or a signatory entity and / or a signature system according to the invention.

[0051] To make the explanation more concrete, an example of an embodiment of a method for signing a message m is described in detail below, with reference to the attached drawings. It should be noted that the invention is not limited to this example.

[0052] The signing process includes steps implemented by a signatory entity E, steps implemented by a user entity U and steps implemented by a verifying entity V.

[0053] The user entity includes means of communication with the signatory and verifying entities.

[0054] The message m is unknown to the signing entity that signs it.

[0055] The signature process relies on a predefined cryptographic protocol. The signature protocol is characterized by a key pair {Kp, Ks}, ​​where Kp is a public key accessible to all entities, and Ks is a private key known exclusively to the signing entity.

[0056] The public key includes at least one matrix A composed of elements from a set R. The set R can be a ring.

[0057] In preferred embodiments of the invention, the public key Kp is a family of matrices A(t) defined by the parameter t. In these preferred embodiments, the matrix A is a matrix from the family of matrices A(t) defined by the parameter value t*. Knowing the value t* for the parameter t is equivalent to knowing the matrix A.

[0058] When matrix A is a matrix from a family of matrices A(t), the signature process 100 includes a step E10 for selecting the value t* for the parameter t, preferably by the signing entity. The signature process further includes a step E12 for obtaining matrix A by the user entity U. Obtaining the matrix by the user entity can be achieved by transmitting the parameter value t* or by transmitting matrix A to the user entity from the signing entity E.

[0059] In particular embodiments, the public key Kp contains only the matrix A; in this case, the matrix is ​​directly accessible to the user entity U.

[0060] The signature process 100 involves the generation of a blind signature S from an intermediate signature S'.

[0061] The signature process includes a step E14 of generation, for example random, of a first vector r composed of elements of the set R.

[0062] Preferably, the first vector r is chosen such that a norm of said vector r is relatively small, that is, such that said norm is less than a predefined value b1. For example, a first vector r can be chosen by uniformly generating each of the elements composing said first vector r over the interval [-b1, b1], where b1 is a predefined value. In another embodiment, the first vector is chosen by successively generating vectors according to a predefined distribution, until the norm of the generated vector is less than the value b1.

[0063] The signature process 100 then includes a step E16 of determining a second vector c composed of elements from the set R.

[0064] The second vector c is determined from the first vector r and the matrix A, and masks the message m.

[0065] In particular, the second vector c can take the following form: c = Ar + f(m) where f is any function with values ​​in the same space as Ar

[0066] The function f is, for example, a hash function.

[0067] The signature process 100 then includes a step E18 of obtaining the second vector c by the signing entity E. This step is carried out by the transmission of the second vector c by the user entity U to the signing entity E.

[0068] The signature process 100 further includes a step E20 of determining a third vector s composed of elements of the set R.

[0069] The third vector s is determined from the matrix A such that c = As, with s satisfying at least one constraint on its norm. Solving such an equation, by the signing entity, knowing the matrix A and the second vector c, is possible thanks to knowledge of the secret key Ks.

[0070] Preferably, the third vector s is chosen such that a norm of said vector s is relatively small, that is, such that said norm is less than a predefined value b2, which is the same as or different from the predefined value b1. In other words, the signing entity seeks a vector in the ring R satisfying the conditions: c = As and ||s|| <b2. Une contrainte relative à la norme du troisième vecteur s peut donc être d’avoir une norme de s inférieure à une valeur prédéfinie b2. Par exemple, un troisième vecteur s peut être déterminé en suivant la méthode décrite dans l’article Micciancio, D., Peikert, C. (2012). Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller. In: Pointcheval, D., Johansson, T. (eds) Advances in Cryptology – EUROCRYPT 2012. EUROCRYPT 2012. Lecture Notes in Computer Science, vol 7237. Springer, Berlin, Heidelberg. https: / doi.org / 10.1007 / 978-3-642-29011-4_41.

[0071] The signing process then includes a step E22 of obtaining the third vector s by the entity during which the third vector s is transmitted by the signing entity E to the user entity U.

[0072] During a step E24 for determining an intermediate signature S', the user entity U determines an aggregation vector w from the first and third vectors. For example, the aggregation vector can take the form: w = s – r.

[0073] Since vectors s and r can both be defined from the same matrix A, combining the first and third vectors makes it possible to considerably reduce the amount of information to be transmitted, without loss of information.

[0074] Furthermore, when the first and third vectors r and s are chosen such that their respective norms are relatively small, the norm of the combination of these two vectors r and s is also relatively small, allowing the size of the intermediate signature and therefore the blind signature to be limited even further.

[0075] The intermediate signature S' is determined by the aggregation vector and, where applicable, by the parameter value t*: S'=(w, t*).

[0076] The intermediate signature S' can be stored by the user entity U for the message m.

[0077] From this intermediate signature S', the user entity can generate a blind signature S.

[0078] The signature process includes, for this purpose, a step E26 of decomposition of the aggregation vector w into a first part w1 and a second part w2 so that there exists a function F such that w=w1+F(w2).

[0079] In particular embodiments, the elements of the first part w1 are the remainders of the Euclidean divisions of the elements constituting the vector w by an integer α, the elements of the second part w2 are the quotients of said Euclidean division and the function F is the function F(x)=αx.

[0080] The signature method includes a step E28 for determining the blind signature S, the blind signature S being composed of said first part w1, and a proof of knowledge P of at least one element allowing the reconstruction of the matrix A, for example the value of parameter t* when the matrix A is a matrix of a family of matrices A(t), and said second part w2. By hiding only a part of the aggregation vector w, the performance can be improved. For example, if we consider that each coefficient composing the aggregation vector w has n bits and that each coefficient of the first vector r has m bits, the invention makes it possible to disclose m-1 bits out of the n. In particular, when the decomposition consists of a Euclidean division of the aggregation vector by an integer, the least significant bits are advantageously disclosed and the most significant bits are advantageously hidden in the proof of knowledge.

[0081] The proof of knowledge P can be generated in such a way as to demonstrate that the relation: A.w1+AF(w2) = f(m) is satisfied.

[0082] The user entity U can then transmit the blind signature S to the verifying entity V.

[0083] The verifying entity V obtains said blind signature S during step E30 and verifies it by classically executing a verification algorithm specific to proof P during a verification step E32.

[0084] The signature process as described above, in all its variants, can be implemented by means of a signature system 1 as represented in the diagram comprising: a user entity U, a signatory entity E and a verifying entity V.

[0085] A method 200 for generating an intermediate signature by a user entity U in order to generate a blind signature is also illustrated.

[0086] Such a process 200 of generating an intermediate signature by a user entity U can advantageously be implemented by means of a user entity U as represented in the, comprising at least the modules of the set M1.

[0087] A method 300 for generating a blind signature by a user entity U is also illustrated.

[0088] Such a method 300 of generating a blind signature by a user entity U can advantageously be implemented by means of a user entity U as represented in the, comprising at least the modules of set M1 and set M2.

[0089] The user entity U includes modules configured to implement a process 200 for generating an intermediate signature comprising at least one generation module M14 configured to implement a step E14 for generating a first vector r composed of elements from the set R, a determination module M16 configured to implement a step E14 for determining a second vector c equal to Ar + f(m), a transmission module M18 configured to implement a step E18 for transmitting the second vector c to the signing entity E; a reception module M22 configured to implement a step E22 for receiving the third vector s composed of elements from the set R produced by the signing entity E from the secret key Ks such that c = A.s, with s respecting at least one constraint relating to its norm; a generation module M24 configured to implement an E24 generation step of the intermediate signature S' composed of an aggregation vector w resulting from a combination of the first r and third s vectors.

[0090] The user entity may optionally include an M40 storage module configured to store said intermediate signature S' for message m.

[0091] The user entity may optionally include an M12 module configured to implement an E12 step of receiving the parameter value t* or matrix A.

[0092] The user entity may further include decomposition modules M26 and blind signature generation modules M28 to implement a process for generating a blind signature from said intermediate signature, the decomposition module 26 being configured to implement a decomposition step E26 of the aggregation vector w into a first part w1 and a second part w2 such that there exists a function F such that w = w1 + F(w2), and the generation module M28 being configured to implement a blind signature generation step E28 composed of said first part w1 and a proof of knowledge P of at least one element enabling the reconstruction of the matrix A and said second part w2.

[0093] The user entity U may further include a transmission module configured to implement an E30 step of transmitting said blind signature S to a verifying entity V.

[0094] A method 400 of blind signing of a message by the signing entity E is also illustrated.

[0095] Such a 400 method of blindly signing a message by a signing entity E can advantageously be implemented by means of a signing entity E as represented in the.

[0096] The signing entity E includes a receiving module M18 configured to implement an E18 step of receiving the second vector c calculated by a user entity U from a first vector r composed of elements from the set R, the matrix A, and masking the message m; a generation module M20 configured to implement an E20 step of generating, using the secret key Ks, a third vector s composed of elements from the set R such that c = As, with s respecting at least one constraint relating to its norm; a transmission module M22 configured to implement an E22 step of transmitting the third vector s to the user entity U so as to allow the generation of a blind signature determined from the first and third vectors.

[0097] The signing entity E may also include a selection module configured to implement an E10 step of selecting a value t* for a parameter t to define the matrix A belonging to a family of matrices A(t) defined by said parameter.

[0098] In a particular embodiment, the different steps of the processes according to the invention are determined by computer program instructions.

[0099] Consequently, the invention also relates to a computer program on an information medium, this program being capable of being implemented in a user entity, a signatory entity, and / or a signature system according to the invention or more generally in a computer, this program comprising instructions adapted to the implementation of the steps of a process according to the invention as described above.

[0100] Thus, in certain embodiments, the signature system 1 has the hardware architecture of a computer, as represented in Figure 1. It should be noted that some elements of this architecture may be confused with existing devices.

[0101] More specifically, the signature system 1 may include a PC processor, a ROM read-only memory, a RAM random-access memory, and means of communication.

[0102] The read-only memory of the signature system 1 constitutes a recording medium readable by the processor and on which is recorded a computer program according to the invention, comprising instructions for the execution of the steps of the signature process 100 according to the invention detailed above and in particular illustrated in the.

[0103] This computer program defines equivalently functional modules (software) of the signature system 1.

[0104] This program can use any programming language, and be in the form of source code, object code, or code somewhere between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0105] Equivalently, in specific embodiments, the user entity U and / or the signing entity have the hardware architecture of a computer, as represented in the figure. It should be noted that some elements of this / these architectures may be confused with existing devices.

[0106] The invention also relates to a computer-readable information or recording medium, and comprising instructions for a computer program as mentioned above.

[0107] The information or recording medium can be any entity or device capable of storing the program. For example, the medium can include a storage means, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a floppy disk or a hard disk drive.

[0108] On the other hand, the information or recording medium can be a transmissible medium such as an electrical or optical signal, which can be transmitted via an electrical or optical cable, by radio, or by other means. The program according to the invention can, in particular, be uploaded to a network such as the Internet.

[0109] Alternatively, the information or recording medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the process in question.

[0110] Although the present invention has been described with reference to specific embodiments, it is evident that modifications and changes can be made to these examples without departing from the general scope of the invention as defined by the claims. In particular, individual features of the various embodiments illustrated / mentioned can be combined in additional embodiments. Therefore, the description and drawings should be considered in an illustrative rather than restrictive sense.

[0111] All the characteristics described with reference to a process are transposable, alone or in combination, to a device, and conversely, all the characteristics described with reference to a device are transposable, alone or in combination, to a process.

Claims

Method of generating an intermediate signature (S') by a user entity (U) in order to generate a blind signature (S) of a message (m) from a cryptographic protocol implemented in a Euclidean network comprising a public key (Kp) formed of at least one matrix (A) composed of elements of a set (R) and a secret key (Ks) linked to the public key known exclusively to a signing entity (E), said generation method comprising:- generation of a first vector (r) composed of elements of the set (R);- determination of a second vector (c) equal to Ar +f(m) with f an arbitrary function;- reception of a third vector (s) composed of elements of the set (R) produced by the signing entity (E) from the private key (Ks) such that c= A.s, with s respecting at least one constraint relating to its norm ;- generation of the intermediate signature (S') comprising an aggregation vector (w) resulting from a combination of the first (r) and third (s) vectors. A generation method according to claim 1 in which the public key (Kp) is a family of matrices (A(t)) dependent on a parameter (t), said matrix (A) being a matrix of the family of matrices defined by a value (t*) for said parameter (t). Generation method according to claim 2, said matrix (A) being obtained by transmission of said matrix or of the parameter value (t*) by the signing entity to the user entity. A generation method according to any one of claims 1 or 2 wherein the combination of the first and third vectors is carried out such that the dimension and the norm of said combination is respectively less than the sum of the dimensions and the sum of the norms of the first and third vectors. Method of generating a blind signature (S) of a message (m) by a user entity (U) from an intermediate signature (S') generated according to any one of claims 1 to 4, comprising:- decomposition of the aggregation vector into a first part (w1) and a second part (w2) such that there exists a function F such that w=w1+F(w2);- generation of the blind signature (S) composed of said first part (w1) and a proof of knowledge (P) of at least one element allowing to reconstitute the matrix (A) and of said second part (w2). Generation method according to claim 5 dependent on claim 2, the proof of knowledge being a proof of knowledge of the parameter value (t*) and of said second part (w2). A generation method according to any one of claims 5 or 6, the proof of knowledge being generated so as to satisfy the relation A.w1+AF(w2) = f(m). A method for blindly signing a message (m) by a signing entity (R) using a cryptographic protocol implemented in a Euclidean network comprising a public key (Kp) formed from at least one matrix (A) composed of elements of a set (R) and a secret key (Ks) linked to the public key known exclusively to said signing entity (E), said signing method comprising: - receiving a second vector (c) calculated from a first vector (r) composed of elements of the set (R), of the matrix (A), and masking the message (m), the first and second vectors being respectively generated and transmitted by a user entity (U); - generating a third vector (s) composed of elements of the set (R) such that c = A.s, by means of the secret key (Ks), with s respecting at least one constraint relating to its norm; - transmission of the third vector (s) to the user entity (U) so as to allow the generation of a blind signature determined from the first and third vectors. Signature method according to claim 8 wherein the intermediate signature is generated from a method according to claim 2, comprising a prior step of selecting said value for the parameter and transmitting said parameter and / or said matrix to the user entity (U). Method for signing a message (m) from a cryptographic protocol implemented in a Euclidean network comprising a public key (Kp) formed of at least one matrix (A) composed of elements of a set (R) and a secret key (Ks) linked to the public key known exclusively to a signing entity (E), comprising:- generation of a first vector (r) composed of elements of the set (R) by a user entity (U);- determination of a second vector (c) equal to A.r+f(m), with f an arbitrary function, by a user entity (U);- generation of a third vector (s) composed of elements of the set (R) produced by the signing entity (E) from the secret key (Ks) such that c=A.s, with s respecting at least one constraint relating to its norm; - generation, by a user entity (U), of the intermediate signature (S') comprising an aggregation vector (w) resulting from a combination of the first (r) and third (s) vectors; - decomposition of the aggregation vector (w) into a first part (w1) and a second part (w2) such that there exists a function F such that w = w1 + F(w2); - generation of a blind signature (S) composed of said first part (w1) and a proof of knowledge (P) of at least one element allowing to reconstruct the matrix (A) and of said second part (w2); - transmission of said blind signature (S) by the user entity (U) to a verifying entity (V); - verification of said blind signature (S) by the verifying entity (V). User entity (U) for generating an intermediate signature (S') intended to enable the generation of a blind signature (S) of a message (m) from an intermediate signature (S') by means of a cryptographic protocol implemented in a Euclidean network comprising a public key (Kp) formed of at least one matrix (A) composed of elements of a set (R) and a secret key (Ks) linked to the public key known exclusively to a signing entity (E) comprising: - a generation module configured to generate a first vector (r) composed of elements of the set (R); - a determination module configured to determine a second vector (c) equal to A.r + f(m) with f an arbitrary function,- a transmission module configured to transmit said second vector (c) to the signing entity (E);- a reception module configured to receive a third vector (s) composed of elements of the set (R) produced by the signing entity (E) from the secret key (Ks) such that c = As, with s respecting at least one constraint relating to its norm;- a generation module configured to generate the intermediate signature (S') comprising an aggregation vector (w) resulting from a combination of the first (r) and third (s) vectors. User entity (U) according to claim 11 further comprising: - a decomposition module configured to decompose the aggregation vector (w) into a first part (w1) and a second part (w2) such that there exists a function F such that w = w1 + F(w2); - a generation module configured to generate the blind signature (S) composed of said first part (w1) and a proof of knowledge (P) of at least one element enabling the reconstitution of the matrix (A) and of said second part (w2); - a transmission module configured to transmit said blind signature (S) to a verifying entity (V). Signing entity (E) to enable the blind signing (S) of a message (m) from a cryptographic protocol implemented in a Euclidean network comprising a public key (Kp) formed of at least one matrix (A) composed of elements of a set (R) and a secret key (Ks) linked to the public key known exclusively to said signing entity (E), comprising: - a receiving module configured to receive a second vector (c) calculated by a user entity (U) from a first vector (r) composed of elements of the set (R), of the matrix (A), and masking the message (m); - a generating module configured to generate, by means of the secret key (Ks), a third vector (s) of the ring (R) such that c = A.s, with s respecting at least one constraint relating to its standard; - a transmission module configured to transmit said third vector(s) to the user entity (U) so as to allow the generation of a blind signature determined from the first and third vectors. Signature system comprising: - a signing entity (E), - a user entity (U), - a verifying entity (V), configured to implement a signature process according to claim 10. Computer program comprising instructions for carrying out the steps of the process according to any one of claims 1 to 10 when said program is executed by a computer. Computer-readable recording medium on which is recorded a computer program comprising instructions for carrying out the steps of the process according to any one of claims 1 to 10.

Images