Linkable dual-ring signature method and apparatus based on NTRU lattice, and device and medium

Abstract

The present application relates to a linkable dual-ring signature method and apparatus based on an NTRU lattice, and a device and a medium. The method comprises: when a ring member user π signs a message m, a server side generating a signature link tag Iπ on the basis of a user identity idπ corresponding to the ring member user π, and generating a signature sigπ on the basis of a user secret key skπ, a master public key mpk, an identity set ID of all users in a ring member list, and a system global parameter pp; on the basis of the message m, the identity set ID of all the users in the ring member list, and the system global parameter pp, the server side verifying the signature sigπ; and the server side acquiring a first signature and a second signature of different messages, and determining on the basis of a link tag of the first signature and a link tag of the second signature that the first signature and the second signature are from a same user, so as to complete a linkable dual-ring signature based on an NTRU lattice. The present application can reduce the storage overheads and time overheads of a server during computation, thereby improving practicability.

Description

A linkable dual-ring signature method, apparatus, device, and medium based on NTRU lattice. Technical Field

[0001] This application relates to the field of data encryption, and in particular to a linkable double-ring signature method based on NTRU lattice, a corresponding device, electronic device, and computer-readable storage medium. Background Technology

[0002] A ring signature is a special type of digital signature that provides anonymity protection for the signer. It allows the signer to independently collect the public keys of ring members to form a ring without the permission or assistance of other ring members. The signer is included in the set of ring members and signs on their behalf. The verifier can only determine that the signer comes from a ring, but not which ring member they are.

[0003] Ring signatures, due to their anonymity, are widely used in areas such as electronic voting, electronic cash, and anonymous whistleblowing. While anonymity is crucial and should be preserved in most cases, it can become a problem in some applications where dishonest users overuse it for personal gain. For example, in electronic voting scenarios, dishonest users might exploit anonymity to attempt to vote again after casting a ballot once. To prevent such dishonest behavior, linkable ring signature technology has emerged.

[0004] Identity-based cryptography uses the user's identifier as the public key, while the user's private key is calculated by the key generation center based on the system master key and the user's identifier. Since the user's public key is uniquely identified by the user's identifier, the user does not require a third party to guarantee the authenticity of their public key. This allows communicating parties to securely generate and verify signatures without the need for a trusted third party.

[0005] In the post-quantum era, cryptographic schemes based on traditional number theory problems such as large integer factorization and discrete logarithms are no longer secure. Lattice public-key cryptography, due to its quantum resistance and the existence of a reduction from worst-case to ordinary instances, has become the best candidate for cryptographic standards in the post-quantum era. However, existing lattice-based digital signature technologies generate keys and signatures that occupy large amounts of space and take a long time to generate, thus limiting their practicality. Currently, no scholars have proposed a satisfactory solution to this problem.

[0006] Currently, existing linkable ring signature technology has the following technical drawbacks:

[0007] First, the generated user keys and signatures require significant storage space, and signature generation is slow. In real-world scenarios, there are typically many ring users, and these users frequently generate signatures, resulting in substantial storage and time overhead on the server, making it impractical.

[0008] Secondly, there is currently no work on identity-based digital signatures that combine dual-ring and NTRU lattice structures.

[0009] Third, most linkable ring signature methods are currently single-ring signatures, which generate multiple response values ​​and a challenge value as part of the signature. In contrast, lattice-based signature systems have larger response values ​​and smaller challenge values, resulting in poor compatibility between the two.

[0010] In summary, existing linkable ring signature technologies have problems such as large storage requirements for user keys and signatures, slow signature generation, and high storage and time costs on servers, resulting in low practicality. The applicant has made corresponding explorations to solve these problems. Summary of the Invention

[0011] The purpose of this application is to solve the above-mentioned problems by providing a linkable dual-ring signature method, corresponding apparatus, electronic device and computer-readable storage medium based on NTRU lattice.

[0012] To achieve the various objectives of this application, the following technical solution is adopted:

[0013] A linkable double-ring signature method based on NTRU lattice, proposed to suit one of the purposes of this application, includes:

[0014] The server obtains the security parameter λ and the number of ring member users N. Based on the security parameter λ and the number of ring member users N, it generates the system global parameter pp, the master public key mpk, and the master private key msk, which include:

[0015] The server determines the polynomial vector length n based on the security parameter λ and the number of ring member users N, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, and G based on the polynomial vector length n. The four polynomial vectors f, g, F, and G are used as the master private key msk.

[0016] The server determines an integer q based on the security parameter λ, and calculates the master public key mpk = g·f -1 mod q;

[0017] The server determines a variance σ based on the security parameter λ, selects two hash functions H1 and H2, and uses the master public key mpk, the polynomial vector length n, the integer q, and the variance σ as the system global parameter pp.

[0018] The server-side uses the master private key msk and the user ID of ring member user π. π Generate the user private key sk of the ring member user π. π ;

[0019] When the ring member user π signs a message m, the server bases the signature on the user identity ID corresponding to π. π Generate signature link tag I π And based on the user's private key sk π The signature sig is generated using the master public key mpk, the identity set IDs of all users in the ring member list, and the system global parameter pp. π ;

[0020] The server verifies the signature sig based on the message m, the identity set IDs of all users in the ring member list, and the system global parameter pp. π ;

[0021] The server obtains the first and second signatures of different messages, and determines that the first and second signatures come from the same user based on the link tags of the first and second signatures, thus completing a linkable double-ring signature based on the NTRU lattice.

[0022] Optionally, the server can use the master private key msk and the user ID of the ring member user π as the basis for its actions. π Generate the user private key sk of the ring member user π. π The steps include:

[0023] Based on the user identity ID of the ring member user π π The two polynomial vectors s are determined by using a grid-based filtering algorithm. 1π and s 2π Output the private key sk of the ring member user π. π =(s 1π ,s 2π ).

[0024] Optionally, when the ring member user π signs a message m, it is based on the user identity ID corresponding to the ring member user π. π Generate signature link tag I π And based on the user's private key sk π The signature sig is generated using the master public key mpk, the identity set IDs of all users in the ring member list, and the system global parameter pp. π The steps include:

[0025] Two polynomial vectors y1 and y2 of length n are randomly selected from a normal distribution D with variance σ. and n-1 short vectors c i ←{0,1} n Where i∈{1,2,…,N} and i≠π;

[0026] Calculation determined

[0027] Call hash function H1 to calculate and determine signature link tag I π =H1(id) π );

[0028] Call the hash function H2 to calculate and determine the challenge c = H2(m, ID, R);

[0029] Calculate and determine a short vector

[0030] Calculate and determine the first commitment z1 = c π ·s 1π +y1, using the rejection sampling algorithm to The probability of rejecting the first commitment z1 is M, where M is a large integer;

[0031] Calculate and determine the second commitment z2 = c π ·s 2π +y2, using the rejection sampling algorithm to The probability of rejecting the second commitment z2 is denoted by M, where M is a large integer.

[0032] Output signature sig π =((c1,c2,…,c N ),(z1,z2),I π ).

[0033] Optionally, the signature sig is verified based on the message m, the identity set IDs of all users in the ring member list, and the system global parameter pp. π The steps include:

[0034] Verify whether the Euclidean length between the first commitment z1 and the second commitment z2 is less than 1 / 2. If the Euclidean length is less than Then the calculation determines

[0035] Calculate the challenge Verify whether the challenge c is equal to H2(m,ID,R'). If the output result is 1, it means that the signature is successful.

[0036] Optionally, the step of obtaining a first signature and a second signature of different messages, and determining that the first signature and the second signature come from the same user based on the link tags of the first signature and the link tags of the second signature, includes:

[0037] Obtain the first signature sig1 and the second signature sig2 of different messages, and extract the signature link tag I1 of the first signature sig1 and the signature link tag I2 of the second signature sig2 from the first signature sig1 and the second signature sig2.

[0038] Determine whether the signature link tag I1 of the first signature sig1 is equal to the signature link tag I2 of the second signature sig2. If the signature link tag I1 is equal to the signature link tag I2, the output result is 1, indicating that the first signature sig1 and the second signature sig2 come from the same user.

[0039] Optionally, the ring member list includes multiple ring member nodes, and the ring member user corresponds to one or more ring member nodes.

[0040] Optionally, the server-side can be a third-party trusted center.

[0041] A linkable dual-ring signature device based on an NTRU lattice, provided for another purpose of this application, includes:

[0042] The system parameter generation module is configured to obtain the security parameter λ and the number of ring member users N on the server side, and generate the system global parameter pp, the master public key mpk, and the master private key msk based on the security parameter λ and the number of ring member users N, which include:

[0043] The server determines the polynomial vector length n based on the security parameter λ, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, and G based on the polynomial vector length n. The four polynomial vectors f, g, F, and G are used as the master private key msk.

[0044] The server determines an integer q based on the security parameter λ, and calculates the master public key mpk = g·f -1 mod q;

[0045] The server determines a variance σ based on the security parameter λ, selects two hash functions H1 and H2, and uses the master public key mpk, the polynomial vector length n, the integer q, and the variance σ as the system global parameter pp.

[0046] The user private key generation module is configured to be based on the master private key msk and the user identity ID of ring member user π on the server side. π Generate the user private key sk of the ring member user π. π ;

[0047] The message signature generation module is configured so that when the ring member user π signs a message m, the server-side signature is based on the user identity ID corresponding to the ring member user π. π Generate signature link tag I π And based on the user's private key sk π The signature sig is generated using the master public key mpk, the identity set IDs of all users in the ring member list, and the system global parameter pp. π ;

[0048] The message signature verification module, on the server side, verifies the signature sig based on the message m, the identity set IDs of all users in the ring member list, and the system global parameter pp. π ;

[0049] The linkable dual-ring signature module is configured to obtain the first and second signatures of different messages on the server side, and determine that the first and second signatures come from the same user based on the link tags of the first and second signatures, so as to complete the linkable dual-ring signature based on the NTRU lattice.

[0050] An electronic device provided for another purpose of this application includes a central processing unit and a memory, the central processing unit being configured to invoke and run a computer program stored in the memory to perform the steps of the linkable dual-ring signature method based on NTRU lattice described in this application.

[0051] A computer-readable storage medium is provided for another purpose of this application, which stores, in the form of computer-readable instructions, a computer program implemented according to the NTRU-based linkable double-ring signature method, which, when invoked by a computer, executes the steps included in the corresponding method.

[0052] Compared to existing technologies, the user keys and signatures generated by the linkable ring signature technology in this application require significant storage space and are generated slowly, resulting in substantial storage and time overhead on the server and limited practicality. This application offers the following advantages, including but not limited to:

[0053] Firstly, when building a ring signature system, users often consider economic factors. To reduce costs, they usually choose as few servers as possible for computation and storage. This application, combined with an identity-based digital signature system, can quickly and securely generate and verify signatures without exchanging public key certificates or storing key directories.

[0054] Secondly, in response to the problem that signatures generated by lattice-based digital signature systems are too large and too slow, this application proposes to use dual-ring digital signature technology to provide users with a more practical lattice-based linkable ring signature technology.

[0055] Thirdly, addressing the issues of excessively large user private keys and slow generation in lattice-based linkable ring signature systems, this application proposes an identity-based linkable dual-ring signature scheme on an NTRU lattice. This scheme uses polynomial vectors instead of matrices as user private keys, significantly reducing their size and enabling better performance when combined with dual-ring digital signature technology.

[0056] Fourth, this application uses identity-based digital signature technology, eliminating the need for signers to exchange public key certificates or store key directories. This allows for fast and secure signature generation and verification, reducing server overhead. The use of dual-ring digital signature technology and NTRU lattice addresses issues such as slow key and signature generation speeds and large signature lengths, effectively reducing bandwidth consumption and making the solution easy to deploy, manage, and implement.

[0057] Fifth, this application implements a novel identity-based chainable dual-ring signature scheme on an NTRU lattice. Ring users do not need to exchange public key certificates or store key directories when generating signatures. Furthermore, the use of an NTRU lattice and a dual-ring structure enables the invention to generate and verify signatures quickly and securely. It satisfies the unconditional anonymity, unforgeability, and chainability requirements of the random oracle model, thus achieving security against adversary key forgery attacks, signature forgery attacks, and double-signature attacks. Using polynomial vectors as keys and signatures reduces server storage and time overhead during computation compared to traditional lattices, improving practicality. Attached Figure Description

[0058] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0059] Figure 1 shows an exemplary network architecture used in the linkable dual-ring signature system based on the NTRU lattice in this application embodiment;

[0060] Figure 2 is a flowchart illustrating the linkable dual-ring signature method based on the NTRU lattice in an embodiment of this application;

[0061] Figure 3 is a schematic diagram of the linkable dual-ring signature device based on NTRU lattice in an embodiment of this application;

[0062] Figure 4 is a schematic diagram of the structure of the computer device in the embodiment of this application. Detailed Implementation

[0063] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application.

[0064] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this application means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is “connected” or “coupled” to another element, it can be directly connected or coupled to the other element, or there may be intermediate elements. Furthermore, “connected” or “coupled” as used herein can include wireless connections or wireless coupling. The term “and / or” as used herein includes all or any units and all combinations of one or more associated listed items.

[0065] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. It should also be understood that terms such as those defined in general dictionaries should be understood to have the same meaning as in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless specifically defined as herein.

[0066] Those skilled in the art will understand that the terms "client," "terminal," and "terminal device" as used herein include both devices that receive wireless signals, devices that only possess wireless signal receiver capabilities without transmission capabilities, and devices with receiving and transmitting hardware, devices that have receiving and transmitting hardware capable of bidirectional communication over a bidirectional communication link. Such devices may include: cellular or other communication devices such as personal computers or tablets, having single-line displays, multi-line displays, or cellular or other communication devices without multi-line displays; PCS (Personal Communications Service) that can combine voice, data processing, fax, and / or data communication capabilities; PDA (Personal Digital Assistant) that may include a radio frequency receiver, pager, internet / intranet access, web browser, notepad, calendar, and / or GPS (Global Positioning System) receiver; and conventional laptop and / or handheld computers or other devices that have and / or include radio frequency receivers. As used herein, "client," "terminal," and "terminal device" can be portable, transportable, installed in a means of transportation (air, sea, and / or land), or suitable and / or configured to operate locally and / or in a distributed manner, operating in any other location on Earth and / or in space. "Client," "terminal," and "terminal device" as used herein can also be a communication terminal, an internet access terminal, or a music / video playback terminal, such as a PDA, a MID (Mobile Internet Device), and / or a mobile phone with music / video playback capabilities, or a smart TV, set-top box, etc.

[0067] The hardware referred to by the names "server," "client," and "service node" in this application is essentially an electronic device with the equivalent capabilities of a personal computer. It is a hardware device with the necessary components revealed by the von Neumann architecture, such as a central processing unit (including an arithmetic logic unit and a control unit), memory, input devices, and output devices. The computer program is stored in its memory, and the central processing unit loads the program stored in the secondary storage into the main memory to run it, execute the instructions in the program, and interact with the input and output devices to complete specific functions.

[0068] It should be noted that the concept of "server" used in this application can also be extended to the case of server clusters. Based on the network deployment principles understood by those skilled in the art, the servers should be logically divided. Physically, these servers can be independent of each other but accessible through interfaces, or they can be integrated into a single physical computer or a computer cluster. Those skilled in the art should understand this flexibility and should not use it to constrain the implementation of the network deployment method in this application.

[0069] Unless otherwise expressly specified, one or more technical features of this application may be deployed on a server and accessed by a client through remote invocation of the online service interface provided by the server, or they may be directly deployed and run on a client for access.

[0070] Unless otherwise specified, the neural network models referenced or potentially referenced in this application may be deployed on a remote server and invoked remotely on the client, or deployed on a client with the capability to invoke directly. In some embodiments, when running on the client, the corresponding intelligence may be acquired through transfer learning in order to reduce the requirements on the client's hardware resources and avoid excessive consumption of the client's hardware resources.

[0071] Unless otherwise specified, all data involved in this application may be stored remotely on a server or on a local terminal device, as long as it is suitable for use by the technical solution of this application.

[0072] Those skilled in the art will understand that although the various methods in this application are described based on the same concept and thus present commonality among them, they can be performed independently unless otherwise specified. Similarly, the various embodiments disclosed in this application are all based on the same inventive concept; therefore, concepts expressed in the same way, as well as concepts that are appropriately changed for convenience but are expressed differently, should be understood equivalently.

[0073] Unless otherwise expressly stated, the various embodiments disclosed in this application can be combined in a cross-cutting manner to flexibly construct new embodiments, as long as such combination does not depart from the inventive spirit of this application and can meet the needs of the prior art or solve a certain deficiency in the prior art. Those skilled in the art should be aware of such modifications.

[0074] A ring signature is a special type of digital signature that provides anonymity protection for the signer. It allows the signer to independently collect the public keys of ring members to form a ring without the permission or assistance of other ring members. The signer is included in the set of ring members and signs on their behalf. The verifier can only determine that the signer comes from a ring, but not which ring member they are.

[0075] Ring signatures, due to their anonymity, are widely used in areas such as electronic voting, electronic cash, and anonymous whistleblowing. While anonymity is crucial and should be preserved in most cases, it can become a problem in some applications where dishonest users overuse it for personal gain. For example, in electronic voting scenarios, dishonest users might exploit anonymity to attempt to vote again after casting a ballot once. To prevent such dishonest behavior, linkable ring signature technology has emerged.

[0076] Identity-based cryptography uses the user's identifier as the public key, while the user's private key is calculated by the key generation center based on the system master key and the user's identifier. Since the user's public key is uniquely identified by the user's identifier, the user does not require a third party to guarantee the authenticity of their public key. This allows communicating parties to securely generate and verify signatures without the need for a trusted third party.

[0077] In the post-quantum era, cryptographic schemes based on traditional number theory problems such as large integer factorization and discrete logarithms are no longer secure. Lattice public-key cryptography, due to its quantum resistance and the existence of reductions from worst-case to ordinary instances, has become the best candidate for cryptographic standards in the post-quantum era. However, existing lattice-based digital signature technologies generate keys and signatures that occupy large amounts of space and take a long time to generate, thus limiting their practicality. Currently, no scholars have proposed a good solution to this problem, and this application explores the following aspects.

[0078] Based on the above exemplary scenarios, and referring to Figures 1 and 2, the NTRU-based chainable dual-ring signature method of this application, in one embodiment, includes:

[0079] Step S10: The server obtains the security parameter λ and the number of ring member users N. Based on the security parameter λ and the number of ring member users N, it generates the system global parameter pp, the master public key mpk, and the master private key msk, which include:

[0080] Step S101: The server determines the polynomial vector length n based on the security parameter λ and the number of ring member users N, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, and G based on the polynomial vector length n, and uses the four polynomial vectors f, g, F, and G as the master private key msk.

[0081] Step S102: The server determines an integer q based on the security parameter λ, and calculates the master public key mpk = g·f -1 mod q;

[0082] Step S103: The server determines a variance σ based on the security parameter λ, selects two hash functions H1 and H2, and uses the master public key mpk, the polynomial vector length n, the integer q, and the variance σ as the system global parameter pp;

[0083] The linkable dual-ring signature method based on the NTRU lattice of this application can be implemented in the linkable dual-ring signature system based on the NTRU lattice shown in Figure 1. The ring member list includes multiple ring member nodes, and each ring member user corresponds to one or more ring member nodes. The server can be a third-party trusted center. The server obtains the security parameter λ and the number of ring member users N. Based on the security parameter λ and the number of ring member users N, it generates the system global parameter pp, the master public key mpk, and the master private key msk. Specifically, the server determines the polynomial vector length n according to the security parameter λ and the number of ring member users N, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, and G according to the polynomial vector length n. The four polynomial vectors f, g, F, and G are used as the master private key msk. The server determines an integer q according to the security parameter λ and calculates the master public key mpk = g·f. -1 mod q; The server determines a variance σ based on the security parameter λ, selects two hash functions H1 and H2, and uses the master public key mpk, the polynomial vector length n, the integer q, and the variance σ as the system global parameter pp.

[0084] In some embodiments, the NTRU encryption algorithm, NTRU (N-th degree Truncated Polynomial Ring), is a lattice-based public-key encryption algorithm first proposed by Christoph Paillier and other researchers in 1996. The main characteristics of the NTRU encryption algorithm are high computational efficiency and security, making it suitable for resisting quantum computer attacks. It aims to provide an alternative to traditional public-key encryption methods (such as RSA and ECC), especially in the context of the widespread adoption of quantum computing. With further research, NTRU has been incorporated into several quantum security standardization processes.

[0085] In some embodiments, the Linkable Ring Signature is a cryptographic signature scheme that combines the privacy-preserving features of ring signatures with the requirement for linkability. Ring signatures allow a user to generate signatures within a group while maintaining the privacy of their identity; while linkability means that the same signer can generate identifiable signatures at different times (or on different messages), allowing specific verifiers to associate signatures with the same user.

[0086] Ring signatures are a cryptographic signature technique that allows a member to sign a message without revealing their identity. The signer can choose a set of public keys as a "ring," within which the identity of any member is unidentifiable; only users who can verify the signature can confirm its validity. Regarding linkability, in linkable double-ring signatures, although the identity of the signer remains private, when the same signer generates signatures on different messages, these signatures can be linked together in some way, making it easier for verifiers to confirm that they come from the same signer.

[0087] Step S20: The server uses the master private key msk and the user identity ID of the ring member user π. π Generate the user private key sk of the ring member user π. π ;

[0088] Based on the security parameter λ and the number of ring member users N, after generating the system global parameter pp, the master public key mpk, and the master private key msk, the server then uses the master private key msk and the user identity ID of the ring member user π. π Generate the user private key sk of the ring member user π. π ;

[0089] Specifically, the server-side uses the master private key msk and the user identity ID of ring member user π. π Generate the user private key sk of the ring member user π. π The steps include:

[0090] Based on the user identity ID of the ring member user π π The two polynomial vectors s are determined by using a grid-based filtering algorithm. 1π and s 2π Output the private key sk of the ring member user π. π =(s 1π ,s 2π ).

[0091] In some embodiments, the lattice reduction algorithm is a class of algorithms used to optimize and solve lattice problems, widely applied in cryptography, computational geometry, signal processing, and other fields. Their main purpose is to simplify the lattice structure, making it more efficient to find specific solutions (such as integer solutions, minimum vectors, etc.) within a given lattice.

[0092] Furthermore, the grid selection algorithm includes the LLL algorithm (Lenstra–Lenstra–Lovász algorithm) and the BKZ algorithm (Block Korkine-Zolotarev algorithm), etc., and this application can choose one of the above grid selection algorithms.

[0093] Step S30: When the ring member user π signs a message m, the server uses the user identity ID corresponding to the ring member user π. π Generate signature link tag I π And based on the user's private key sk π The signature sig is generated using the master public key mpk, the identity set IDs of all users in the ring member list, and the system global parameter pp. π ;

[0094] Generate the private key sk of the ring member user π π Subsequently, when the ring member user π signs a message m, the server uses the user identity ID corresponding to the ring member user π. π Generate signature link tag I π And based on the user's private key sk π The signature sig is generated using the master public key mpk, the identity set IDs of all users in the ring member list, and the system global parameter pp. π ;

[0095] Specifically, when the ring member user π signs a message m, it is based on the user identity ID corresponding to the ring member user π. π Generate signature link tag I π And based on the user's private key sk π The signature sig is generated using the master public key mpk, the identity set IDs of all users in the ring member list, and the system global parameter pp. π The steps include:

[0096] Step S301: Randomly select two polynomial vectors y1 from the normal distribution D with variance σ. and n-1 short vectors c i ←{0,1} nWhere i∈{1,2,…,N} and i≠π;

[0097] Step S302: Calculation and Determination

[0098] Step S303: Call hash function H1 to calculate and determine signature link tag I. π =H1(id) π );

[0099] Step S304: Call the hash function H2 to calculate and determine the challenge c = H2(m, ID, R);

[0100] Step S305: Calculate and determine a short vector

[0101] Step S306: Calculate and determine the first commitment z1 = c π ·s 1π +y1, using the rejection sampling algorithm to The probability of rejecting the first commitment z1 is determined by the following:

[0102] Step S307: Calculate and determine the second commitment z2 = c π ·s 2π +y2, using the rejection sampling algorithm to The probability of rejecting the second commitment z2 is , where M is a large integer;

[0103] Step S308: Output signature sig π =((c1,c2,…,c N ),(z1,z2),I π ).

[0104] In some embodiments, the rejection sampling algorithm is a random sampling method for generating samples from complex distributions, especially when we want to draw samples from a target distribution (such as a probability distribution) that is difficult to sample directly. Its basic idea is to generate samples from a simple distribution and decide whether to accept these samples based on a criterion, thereby obtaining samples from the target distribution.

[0105] Step S40: The server verifies the signature sig based on the message m, the identity set IDs of all users in the ring member list, and the system global parameter pp. π ;

[0106] Based on the user's private key sk π The signature sig is generated using the master public key mpk, the identity set IDs of all users in the ring member list, and the system global parameter pp.π Subsequently, the server verifies the signature sig based on the message m, the identity set IDs of all users in the ring member list, and the system global parameter pp. π ;

[0107] Specifically, based on the message m, the identity set IDs of all users in the ring member list, and the system global parameter pp, the signature sig is verified. π The steps include:

[0108] Step S401: Verify whether the Euclidean length between the first commitment z1 and the second commitment z2 is less than 1 / 2. If the Euclidean length is less than Then the calculation determines

[0109] Step S402: Calculate and determine the challenge Verify whether the challenge c is equal to H2(m,ID,R'). If the output result is 1, it means that the signature is successful; if the output result is 0, it means that the signature is unsuccessful.

[0110] Step S50: The server obtains the first signature and the second signature of different messages. Based on the link tag of the first signature and the link tag of the second signature, it determines that the first signature and the second signature come from the same user, so as to complete the linkable double ring signature based on NTRU lattice.

[0111] The server verifies the signature sig based on the message m, the identity set IDs of all users in the ring member list, and the system global parameter pp. π Subsequently, the server obtains the first and second signatures of different messages. Based on the link tags of the first and second signatures, it determines that the first and second signatures come from the same user, thus completing the linkable double-ring signature based on the NTRU lattice.

[0112] Specifically, the steps of obtaining the first and second signatures of different messages, and determining that the first and second signatures come from the same user based on the link tags of the first and second signatures, include:

[0113] Step S501: Obtain the first signature sig1 and the second signature sig2 of different messages, and extract the signature link tag I1 of the first signature sig1 and the signature link tag I2 of the second signature sig2 from the first signature sig1 and the second signature sig2.

[0114] Step S502: Determine whether the signature link tag I1 of the first signature sig1 is equal to the signature link tag I2 of the second signature sig2. If the signature link tag I1 is equal to the signature link tag I2, the output result is 1, indicating that the first signature sig1 and the second signature sig2 come from the same user.

[0115] As can be seen from the above embodiments, compared with the prior art, the user key and signature generated by the linkable ring signature technology in this application occupy a large amount of storage space and the signature generation is slow, resulting in high storage and time overhead on the server and low practicality. This application has the following beneficial effects, including but not limited to:

[0116] Firstly, when building a ring signature system, users often consider economic factors. To reduce costs, they usually choose as few servers as possible for computation and storage. This application, combined with an identity-based digital signature system, can quickly and securely generate and verify signatures without exchanging public key certificates or storing key directories.

[0117] Secondly, in response to the problem that signatures generated by lattice-based digital signature systems are too large and too slow, this application proposes to use dual-ring digital signature technology to provide users with a more practical lattice-based linkable ring signature technology.

[0118] Thirdly, addressing the issues of excessively large user private keys and slow generation in lattice-based linkable ring signature systems, this application proposes an identity-based linkable dual-ring signature scheme on an NTRU lattice. This scheme uses polynomial vectors instead of matrices as user private keys, significantly reducing their size and enabling better performance when combined with dual-ring digital signature technology.

[0119] Fourth, this application uses identity-based digital signature technology, eliminating the need for signers to exchange public key certificates or store key directories. This allows for fast and secure signature generation and verification, reducing server overhead. The use of dual-ring digital signature technology and NTRU lattice addresses issues such as slow key and signature generation speeds and large signature lengths, effectively reducing bandwidth consumption and making the solution easy to deploy, manage, and implement.

[0120] Fifth, this application implements a novel identity-based chainable dual-ring signature scheme on an NTRU lattice. Ring users do not need to exchange public key certificates or store key directories when generating signatures. Furthermore, the use of an NTRU lattice and a dual-ring structure enables the invention to generate and verify signatures quickly and securely. It satisfies the unconditional anonymity, unforgeability, and chainability requirements of the random oracle model, thus achieving security against adversary key forgery attacks, signature forgery attacks, and double-signature attacks. Using polynomial vectors as keys and signatures reduces server storage and time overhead during computation compared to traditional lattices, improving practicality.

[0121] Please refer to Figure 3. A linkable dual-ring signature device based on an NTRU lattice, provided for one of the purposes of this application, includes a system parameter generation module 1100, a user private key generation module 1200, a message signature generation module 1300, a message signature verification module 1400, and a linkable dual-ring signature module 1500. The system parameter generation module 1100 is configured to obtain a security parameter λ and the number of ring member users N on the server side, and generate system global parameters pp, a master public key mpk, and a master private key msk based on the security parameter λ and the number of ring member users N. This includes: the server side determining the polynomial vector length n according to the security parameter λ, and generating four polynomial vectors f, g, F, and G according to the polynomial vector length n using the NTRU encryption algorithm, and using the four polynomial vectors f, g, F, and G as the master private key msk; the server side determining an integer q according to the security parameter λ, and calculating the master public key mpk = g·f -1 mod q; The server determines a variance σ based on the security parameter λ, selects two hash functions H1 and H2, and uses the master public key mpk, the polynomial vector length n, the integer q, and the variance σ as the system global parameter pp; The user private key generation module 1200 is configured to generate a user private key based on the master private key msk and the user identity ID of the ring member user π. π Generate the user private key sk of the ring member user π. π The message signature generation module 1300 is configured to, when the ring member user π signs a message m, generate a signature based on the user identity ID corresponding to the ring member user π. π Generate signature link tag I π And based on the user's private key sk π The signature sig is generated using the master public key mpk, the identity set IDs of all users in the ring member list, and the system global parameter pp. π The message signature verification module 1400 verifies the signature sig on the server side based on the message m, the identity set IDs of all users in the ring member list, and the system global parameter pp.π The linkable dual-ring signature module 1500 is configured to obtain the first and second signatures of different messages on the server side, and determine that the first and second signatures come from the same user based on the link tags of the first and second signatures, so as to complete the linkable dual-ring signature based on the NTRU lattice.

[0122] Based on any embodiment of this application, referring to Figure 4, another embodiment of this application also provides an electronic device, which can be implemented by a computer device. As shown in Figure 4, this is a schematic diagram of the internal structure of the computer device. The computer device includes a processor, a computer-readable storage medium, a memory, and a network interface connected via a system bus. The computer-readable storage medium stores an operating system, a database, and computer-readable instructions. The database may store a sequence of control information. When the computer-readable instructions are executed by the processor, the processor can implement a linkable double-ring signature method based on the NTRU lattice. The processor of the computer device provides computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor can execute the linkable double-ring signature method based on the NTRU lattice of this application. The network interface of the computer device is used for communication with a terminal. Those skilled in the art will understand that the structure shown in Figure 4 is merely a block diagram of a portion of the structure related to the solution of this application and does not constitute a limitation on the computer device to which the solution of this application is applied. A specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0123] In this embodiment, the processor executes the specific functions of each module and its sub-modules in Figure 3, and the memory stores the program code and various types of data required to execute the above modules or sub-modules. The network interface is used for data transmission between the user terminal and the server. In this embodiment, the memory stores the program code and data required to execute all modules / sub-modules in the NTRU-based linkable dual-ring signature device of this application, and the server can call the server's program code and data to execute the functions of all sub-modules.

[0124] This application also provides a storage medium storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps of the linkable dual-ring signature method based on the NTRU lattice described in any embodiment of this application.

[0125] This application also provides a computer program product, including a computer program / instructions that, when executed by one or more processors, implement the steps of the linkable dual-ring signature method based on the NTRU lattice described in any embodiment of this application.

[0126] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. This computer program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0127] The above description is only a partial embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A chainable dual-ring signature method based on NTRU lattice, characterized in that, Applied to any ring member user π in the ring member list, including: The server obtains the security parameter λ and the number of ring member users N. Based on the security parameter λ and the number of ring member users N, it generates the system global parameter pp, the master public key mpk, and the master private key msk, which include: The server determines the polynomial vector length n based on the security parameter λ and the number of ring member users N, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, and G based on the polynomial vector length n. The four polynomial vectors f, g, F, and G are used as the master private key msk. The server determines an integer q according to the security parameter λ, and calculates the master public key mpk = g · f -1 mod q; The server determines a variance σ based on the security parameter λ, selects two hash functions H1 and H2, and uses the master public key mpk, the polynomial vector length n, the integer q, and the variance σ as the system global parameter pp. The server-side uses the master private key msk and the user ID of ring member user π. π Generate the user private key sk of the ring member user π. π ; When the ring member user π signs a message m, the server bases the signature on the user identity ID corresponding to π. π Generate signature link tag I π And based on the user's private key sk π The signature sig is generated using the master public key mpk, the identity set IDs of all users in the ring member list, and the system global parameter pp. π ; The server verifies the signature sig based on the message m, the identity set IDs of all users in the ring member list, and the system global parameter pp. π ; The server obtains the first and second signatures of different messages, and determines that the first and second signatures come from the same user based on the link tags of the first and second signatures, thus completing a linkable double-ring signature based on the NTRU lattice.

2. The linkable dual-ring signature method based on NTRU lattice according to claim 1, characterized in that, The server-side uses the master private key msk and the user ID of ring member user π. π Generate the user private key sk of the ring member user π. π The steps include: Based on the user identity ID of the ring member user π π The two polynomial vectors s are determined by using a grid-based filtering algorithm. 1π and s 2π Output the private key sk of the ring member user π. π =(s 1π ,s 2π ).

3. The linkable dual-ring signature method based on NTRU lattice according to claim 1, characterized in that, When the ring member user π signs a message m, it is based on the user identity ID corresponding to the ring member user π. π Generate signature link tag I π And based on the user's private key sk π The signature sig is generated using the master public key mpk, the identity set IDs of all users in the ring member list, and the system global parameter pp. π The steps include: Two polynomial vectors of length n are randomly selected from a normal distribution D with variance σ. and n-1 short vectors c i ←{0,1} n Where i∈{1,2,…,N} and i≠π; Calculation and determination Call hash function H1 to calculate and determine signature link tag I π =H1(id) π ); Call the hash function H2 to calculate and determine the challenge c = H2(m, ID, R); Calculate and determine a short vector Calculate and determine the first commitment z1 = c π ·s 1π +y1, using the rejection sampling algorithm to The probability of rejecting the first commitment z1 is M, where M is a large integer; Calculate and determine the second commitment z2 = c π ·s 2π +y2, using the rejection sampling algorithm to The probability of rejecting the second commitment z2 is denoted by M, where M is a large integer. Output signature sig π =((c1,c2,…,c N ),(z1,z2),I π ).

4. The linkable dual-ring signature method based on NTRU lattice according to claim 3, characterized in that, Based on the message m, the identity set IDs of all users in the ring member list, and the system global parameter pp, verify the signature sig. π The steps include: Verify whether the Euclidean length between the first commitment z1 and the second commitment z2 is less than 1 / 2. If the Euclidean length is less than Then the calculation determines Calculate the challenge Verify whether the challenge c is equal to H2(m,ID,R'). If the output result is 1, it means that the signature is successful.

5. The linkable dual-ring signature method based on NTRU lattice according to claim 1, characterized in that, The steps of obtaining a first signature and a second signature of different messages, and determining that the first signature and the second signature come from the same user based on the link tags of the first signature and the second signature, include: Obtain the first signature sig1 and the second signature sig2 of different messages, and extract the signature link tag I1 of the first signature sig1 and the signature link tag I2 of the second signature sig2 from the first signature sig1 and the second signature sig2. Determine whether the signature link tag I1 of the first signature sig1 is equal to the signature link tag I2 of the second signature sig2. If the signature link tag I1 is equal to the signature link tag I2, the output result is 1, indicating that the first signature sig1 and the second signature sig2 come from the same user.

6. The linkable dual-ring signature method based on NTRU lattice according to claim 1, characterized in that, The ring member list includes multiple ring member nodes, and each ring member user corresponds to one or more ring member nodes.

7. The linkable dual-ring signature method based on NTRU lattice according to claim 1, characterized in that, The server is a third-party trusted center.

8. A linkable dual-ring signature device based on NTRU lattice, characterized in that, include: The system parameter generation module is configured to obtain the security parameter λ and the number of ring member users N on the server side, and generate the system global parameter pp, the master public key mpk, and the master private key msk based on the security parameter λ and the number of ring member users N, which include: The server determines the polynomial vector length n based on the security parameter λ, and uses the NTRU encryption algorithm to generate four polynomial vectors f, g, F, and G based on the polynomial vector length n. The four polynomial vectors f, g, F, and G are used as the master private key msk. The server determines an integer q based on the security parameter λ, and calculates the master public key mpk = g·f -1 mod q; The server determines a variance σ based on the security parameter λ, selects two hash functions H1 and H2, and uses the master public key mpk, the polynomial vector length n, the integer q, and the variance σ as the system global parameter pp. The user private key generation module is configured to be based on the master private key msk and the user identity ID of ring member user π on the server side. π Generate the user private key sk of the ring member user π. π ; The message signature generation module is configured so that when the ring member user π signs a message m, the server-side signature is based on the user identity ID corresponding to the ring member user π. π Generate signature link tag I π And based on the user's private key sk π The signature sig is generated using the master public key mpk, the identity set IDs of all users in the ring member list, and the system global parameter pp. π ; The message signature verification module, on the server side, verifies the signature sig based on the message m, the identity set IDs of all users in the ring member list, and the system global parameter pp. π ; The linkable dual-ring signature module is configured to obtain the first and second signatures of different messages on the server side, and determine that the first and second signatures come from the same user based on the link tags of the first and second signatures, so as to complete the linkable dual-ring signature based on the NTRU lattice.

9. An electronic device comprising a central processing unit and a memory, characterized in that, The central processing unit is used to invoke and run a computer program stored in the memory to perform the steps of the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores, in the form of computer-readable instructions, a computer program implemented according to any one of claims 1 to 7, which, when invoked by a computer, executes the steps included in the corresponding method.

Images