Summary of the invention
To the technical problem of above-mentioned existence, the purpose of this invention is to provide a kind of lightweight new digital endorsement method, it is characterized in that based on the difficulty of matrix decomposition and the new digital endorsement method that combines the hash function authentication techniques to construct.
For achieving the above object, the present invention adopts following technical scheme:
(I) system sets up: the standard hash function H () and finite field gf (q), the wherein q=2 that select at least 160 of outputs
k, integer k is less than the output valve length of hash function H ();
Specify value (0<δ, the r<n) of numeric parameter n, δ and r according to the user security sexual demand;
N on the picked at random GF (q) ties up affine dijection conversion T;
Structure is based on the reversible compressed transform L of hash function H (): (z
1..., z
n) ← (x
1..., x
n, x
N+1..., x
N+ δ),
Wherein but A is n-δ dimension inverse square matrix, coefficient gamma
i≠ 0 (1≤i≤2 δ), and coefficient a
Ij(1≤i≤δ, 1≤j≤n-1) and constant term α
i(1≤i≤n) for selecting at random; x
N+i(1≤i≤δ) is an expansion variable, and it is vector (x
1..., x
n) preceding (cryptographic hash of individual component of n-δ+i-1), promptly
x
n+i=H
k(x
1||x
2||…||x
n-δ+i-1),1≤i≤δ
H wherein
kThe preceding k position of H () output valve is taken out in () expression successively, and " || " expression couples together two Bit Strings;
Make T
-The capable conversion that constitutes of n-r that T is taken out in expression successively,
The PKI of system is above-mentioned two mapping T
-Compound with L, G=T
-ο L, PKI G are the Linear Indeterminate Equation Group that finite field gf (q) is gone up a n+ δ input variable, a n-r output; Private key is formed D={T for the inverse transformation of mapping T and L
-1, L
-1; Wherein, inverse transformation L
-1By A
-1, B, α
i(1≤i≤n),
And γ
i(δ+1≤j≤2 δ) forms.
(II) signature process is: suppose the message vector (y of user A to user B
1..., y
N-r) sign, then the signature process of user A is divided following two steps:
1. picked at random r variable y
N-r+i(1≤i≤r) cascade up with the message vector constitutes the n-dimensional vector (y on the GF (q) to ∈ GF (q)
1..., y
n), and use private key T
-1Calculate (z
1, z
n)=T
-1(y
1, y
n);
2. use private key L
-1Calculate and just can obtain corresponding signature (x
1, x
N+ δ)=L
-1(z
1..., z
n);
(III) certifying signature process: after user B receives the signature of user A to message, divide following two steps:
1. with hash function to the signature (x
1..., x
N+ δ) carry out authentication, promptly each component will satisfy:
x
n+i=H
k(x
1||x
2||…||x
n-δ+i-1),1≤i≤δ
Otherwise refusal signature;
2. if step 1. authentication pass through, then continue to verify, promptly with the PKI G of user A
If following formula equation the right and left equates, then accept signature, otherwise the refusal signature.
Said hash function H () can select standard hash functions such as MD5, SHA-1, SHA-2, SHA-3 for use respectively.
The present invention has the following advantages and good effect:
1) the present invention is the very high digital signature scheme of a kind of fail safe.Its fail safe performance mainly depends on employed hash function, and present widely used hash function all is to adopt a large amount of logical operation structures, has very high fail safe, can resist the attack of quantum computer;
2) the present invention is a kind of digital signature scheme of efficient lightweight; Its computing is mainly the multiplying on cryptographic hash computing and the finite field; Present widely used hash function all is to adopt a large amount of logical operation structures; Therefore has lower computational complexity, if we select less field parameter such as GF (2
8), then multiplication can adopt and table look-up, and efficient is higher, and this programme can be widely used in the limited embedded device of computing capability;
3) endorsement method of the present invention has very big flexibility, and hash function can freely be selected.
Embodiment
With specific embodiment the present invention is described further below:
The fail safe of digital signature scheme of the present invention is based on the difficulty of matrix decomposition, also promptly from PKI G=T
-Successfully decompositing private key information T and L among the ο L is that calculating is gone up infeasible.And L is a non-linear inverible transform based on hash function in essence, and linear transformation T works to hide L, and the therefore chemical combination through two conversion is converted into the fail safe that depends on hash function with the fail safe of system.
In order to make much of signature scheme of the present invention, we provide the instantiation that a level of security is about
:
(I) system sets up: choice criteria hash function SHA-1 is as H (), system parameters n=31, δ=12, r=10 and k=8.Picked at random finite field gf (2
8) on 31 the dimension affine dijection conversion T;
Structure is based on the reversible compressed transform L of SHA-1: (z
1..., z
31) ← (x
1..., x
31, x
32..., x
43),
Wherein but A is 19 dimension inverse square matrixs, coefficient gamma
i≠ 0 (1≤i≤24), and coefficient a
Ij(1≤i≤12,1≤j≤30) and constant term α
i(1≤i≤31) are for select at random; x
N+i(1≤i≤12) are expansion variable, and it is vector (x
1..., x
31) cryptographic hash of preceding (18+i) individual component, promptly
x
31+i=H
8(x
1||x
2||…||x
18+i),1≤i≤12
H wherein
8Preceding 8 of H () output valve are taken out in () expression successively, and " || " expression couples together two Bit Strings;
Make T
-The 21 capable conversion that constituted of T are taken out in expression successively.
The PKI of system is above-mentioned two mapping T
-Compound with L, G=T
-ο L, PKI G are finite field gfs (2
8) Linear Indeterminate Equation Group of last 43 input variables, 21 outputs;
System's private key is formed D={T for the inverse transformation of mapping T and L
-1, L
-1; Wherein, inverse transformation L
-1By A
-1, B, α
i(1≤i≤31),
And γ
i(13≤j≤24) are formed.Can get its inverse transformation L according to above-mentioned inverible transform L based on SHA-1
-1: (x
1..., x
31, x
32..., x
43) ← (z
1..., z
31),
(II) signature process is: suppose the message vector (y of user A to user B
1..., y
21) sign, then the signature process of user A is divided following two steps:
1. 10 variable y of picked at random
21+i∈ GF (2
8) (1≤i≤10) and message vector cascade up, and constitutes GF (2
8) on 31 dimensional vector (y
1..., y
31), and use private key T
-1Calculate (z
1, z
31)=T
-1(y
1, y
31);
2. use private key L
-1Calculate and just can obtain corresponding signature (x
1, x
43)=L
-1(z
1..., z
31);
(III) certifying signature process: after user B receives the signature of user A to message, divide following two steps:
1. with hash function to the signature (x
1..., x
43) carry out authentication, promptly each component will satisfy:
x
31+i=H
8(x
1||x
2||…||x
18+i),1≤i≤12
Otherwise refusal signature;
2. if step 1. authentication pass through, then continue to verify, promptly with the PKI G of user A
When system parameters n=31, δ=12, r=10 and k=8, then the public key size of system is about 0.88Kbyte, public key size is about 1.65Kbyte, and level of security is about
And main computing is a finite field gf (2
8) on multiplying can the pre-computation and the storage of making a list because finite field is less, so multiplying can be converted into the computing of tabling look-up; Secondly about 10 SHA-1 computings.Therefore implementation efficiency is high, is fit to software and hardware and realizes.