CN112383394A - Novel incremental signature method based on ideal lattice - Google Patents
Novel incremental signature method based on ideal lattice Download PDFInfo
- Publication number
- CN112383394A CN112383394A CN202011319580.2A CN202011319580A CN112383394A CN 112383394 A CN112383394 A CN 112383394A CN 202011319580 A CN202011319580 A CN 202011319580A CN 112383394 A CN112383394 A CN 112383394A
- Authority
- CN
- China
- Prior art keywords
- signature
- generating
- message
- ring
- public key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0852—Quantum cryptography
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Physics & Mathematics (AREA)
- Electromagnetism (AREA)
- Theoretical Computer Science (AREA)
- Storage Device Security (AREA)
Abstract
The invention discloses a novel incremental signature method based on ideal lattices, and particularly relates to the technical field of lattice cryptography. A novel incremental signature method based on ideal lattices comprises the following steps: initializing system parameters and generating a public key and a private key; whether a signature generated by a standard signature scheme exists; acquiring an original signature sigma and a corresponding message under a standard signature, generating a corresponding new signature sigma' for the new message mu through an increment scheme, executing a verification algorithm Verify (PK, mu and sigma) for the message and the generated signature, and judging whether the output is 1. The technical scheme of the invention solves the problem that the traditional computer can not resist the attack of the quantum computer, and can be used for high-efficiency encrypted signature in the existing computer.
Description
Technical Field
The invention relates to the technical field of lattice cryptography, in particular to a novel incremental signature method based on ideal lattices.
Background
With the rapid development of quantum computers, quantum algorithms are a corresponding breakthrough. Under a quantum computing model, a cryptosystem assumed by classical number theory (such as large integer decomposition, discrete logarithm problem on a computational finite field/elliptic curve and the like) has a quantum algorithm of polynomial time (PPT), in other words, the classical number theory cryptosystem is greatly impacted and can possibly become tears of the old era. Therefore, the password capable of resisting quantum computer attack- "post quantum" or "anti quantum" password is produced at the same time, and lattice passwords are a class of concerned public key cryptosystems resisting quantum computer attack.
Lattice cryptography has developed significantly over the past few decades, and lattice digital signatures have become one of the hot spots of academic interest in recent years, because of the significant efficiency gains achieved with cryptographic schemes using lattices with algebraic structures, and the power and diversity of the lattice classical difficulty problem, the error learning problem (LWE) and the small integer solution problem (SIS). Theoretically, any one-way function can be used for constructing the digital signature, so that a large number of digital signature schemes based on the lattice difficulty problem are derived directly on the basis of the pioneering work of Ajtai. However, the general structure brings serious inefficiency, and the parameters of the lattice code scheme usually comprise several parametersA dimension vector. If a general digital signature construct is used, it requires many one-way functions, which results in the generation of a need when using algebraic latticesHuge digital signatures of storage spaces. Therefore, finding a practical construction of a "short" signature based on the lattice difficulty problem, such as a lattice signature consisting of a single lattice vector, has been a very critical problem since the advent of lattice cryptography.
An ideal lattice is a class of lattices that consists of an ideal of lattices. For convenience of introducing the ideal lattice, we cut in from two common lattice difficulties, namely the LWE problem and the SIS problem. An example of the LWE problem is defined by a random n × m integer matrix a and a vector b, where b ═ aTs + e mod q, where s is a secret vector and e is a small noise vector, the difficult problem is to find this vector s. As a "dual" problem for LWE, an example of a SIS problem is defined by the same random matrix a, which requires finding a short vector x such that Ax is 0 mod q. Ring-LWE and Ring-SIS are "Ring" up versions of LWE and SIS, respectively, specific examples of LWE and SIS, respectively, defined for certain structured matrices A, which are detailedThe introduction of which is as follows:
in an ideal lattice or so-called "ring setup", the above matrix a needs some additional algebraic structure. A common example is to interpret each column of A as a coefficient of a polynomial p (x) of degree (n-1), and require that xp (x) mod (x) be included in some columns of A as welln+1)). In this case, the matrix multiplication of a is equivalent to polynomial multiplication. Thus, we can consider each vector v as a ringAnd each n × n sub-matrix of A is regarded asA ring element ofi。
Due to the algebraic structure of ideal lattices, the cryptosystem based on ideal lattices (security based on Ring-LWE or Ring-SIS difficulty assumptions) is more efficient than that in general lattices, as shown in:
1. since each nxn sub-matrix is now represented as a ring element, the size of some of the parameters that would otherwise be matrices is reduced by a factor n;
2.the multiplication of the ring elements can be implemented in hardware by FFT (fast fourier transform).
Thus, the use of ideal lattices is an important approach to the construction of highly efficient cryptographic schemes on lattices.
The incremental signature scheme is a good method for quickly generating the signature. Suppose we need to generate signatures for many messages, usually we should sign them separately. That is, if the signature time of one message is T, then the total signature time of k messages should be k × T, which means that the efficiency is obviously very low in some practical scenarios, such as large-scale software authentication and large data verification, where there are many messages and each message is long, and it obviously takes time to generate a signature. Note that the messages in the above scenario are generally similar. For example, software may be updated frequently to correct errors with the goal of improving quality, so there is often a lot of overlap between the previous software and the updated software. Therefore, to speed up the signature generation process, using a delta signature scheme is a more preferred option with only small differences between messages.
Bellare et al first proposed the concept of an incremental cryptosystem. In order to reflect the unique advantages of the method in pioneering work, the method also provides an incremental signature scheme, and the main ideas are as follows: when the signer obtains the signature σ for the message μ, then the signer does not need to generate the signature σ for the updated message μ' of μ again. Since it takes some time for him to extract σ from (μ, σ, μ'), which ideally is proportional to the total message modification of μ; thus, the delta signature scheme takes less time than the generic signature scheme for k similar messages.
Incremental cryptographic techniques have gained widespread attention in the cryptographic community in recent years, driven by real-world applications. Based on the pioneering work of Bellare et al, many researchers have proposed many new incremental cryptographic schemes, and the traditional difficult assumptions ensure the security of the schemes, which will be threatened by quantum computers.
Disclosure of Invention
The invention provides a novel incremental signature method based on an ideal lattice, aiming at the problem of how to set an efficient cryptographic signature to resist quantum computer attack in a traditional computer.
In order to achieve the purpose, the technical scheme of the invention is as follows: a novel incremental signature method based on ideal lattices comprises the following steps:
s1: setup (n), system parameter setting: setting a security parameter n, giving two fixed public large integer parameters p, q and an integer b, and then generating other parameters according to the following operations:
s1-2: performing the trap-gate-on-Ring Generation Algorithm, ringGenTrap (A', H, s)R);
S1-3: generating public key PK ═ (a, C)0,C1,...,Cl) And the private key SK ═ R;
s2: sign (PK, SK, μ), standard signature generation: for a given ciphertext mu ═ v1,v2,...,vl]∈{0,1}d×lUsing the public key PK and the private key R, a signature is generated according to the following steps:
S3: IncSig (PK, SK, mu, sigma, mu') incremental signature generates a given message mu e {0, 1}d×lThe corresponding signature μ e {0, 1}d×lAnd a modified message mu '═ v'1,v′2,...,v′l]∈{0,1}d×lMu' and mu satisfy the same condition except for column j; generating a delta signature using the public key PK and the private key R by:
S4: verify (PK, μ, σ), complete the verification. According to the public key PK, the message mu-v1,v2,...,vl]∈{0,1}d×lAnd signaturesOutput 1 if the following conditions are met:
compared with the prior art, the beneficial effect of this scheme:
compared with the existing incremental signature scheme, the scheme is constructed based on the difficult problem of ideal lattices, parameters in the scheme are all obtained from a ring, and the algebraic characteristics of the ideal lattices are fully utilized, so that the sizes of the public and private keys and the generated signature are almost reduced by O (n). At the same time, due to the ringThe multiplication between the elements in (1) can be accelerated in hardware using FFT (fast Fourier transform), so the present invention is in memory complexity toAnd the calculation efficiency is obviously superior to that of the existing scheme, and the method has great use and practical value.
Drawings
Fig. 1 is a flow chart of a novel incremental signature method based on ideal lattices in the invention.
Detailed Description
The present invention will be described in further detail below by way of specific embodiments:
examples
The following description will be made with reference to the following examples:represents a ring of modulo q, where q ≧ 2.Representing a set of n x m matrices, in which the entries areIn (1). s1(A)=maxuAu | | represents the maximum singular value of the matrix a, where u represents the identity matrix and | | · | | representsA paradigm. When S refers to a collection, x ← S denotes uniform random retrieval of x from the collection S. When in useWhen referring to a distribution of the plurality of clusters,represents x according to distributionAnd (6) obtaining.Andrespectively representing polynomials with coefficients being integers and real numbers,indicating ringAnd assume that all operations in the scheme are done on the ring.Is a polynomial ring of modulo f (x) and has a coefficient range ofThe above is obtained.Refers to a ring polynomial of length m.Represents an elementAs a ring polynomial vectorThe coefficient of (a).
Incremental signature definition: an incremental signature scheme consists of four Probabilistic Polynomial Time (PPT) algorithms, namely the system Setup algorithm Setup, the standard signature algorithm Sign, the incremental signature algorithm incusig, and the verification algorithm Verify.
Setup (n): given a security parameter n, the algorithm outputs a system security parameter PP and a private key SK.
Sign (PP, SK, μ): given the public parameter PP, the private key SK and the message μ, the algorithm outputs a signature σ for μ.
Incusig (PP, SK, μ, σ, μ'): given the public parameter PP, the private key SK, a set of message-signatures (μ, σ), and a new message μ ', the algorithm outputs a delta signature σ ' for μ '.
Vetify (PP, μ, σ): given the common parameters PP, one message mu and one signature sigma, the algorithm outputs 1 with an overwhelming probability if sigma is a valid signature of the message mu, and 0 otherwise.
Correctness: we require that the delta signature must satisfy the following correctness: for all n and messages μ, μ ', if (PP, SK) ═ setup (n), σ ═ Sign (PP, SK, μ) and σ ' ═ incusig (PP, SK, μ, σ, μ '), then Verify (PP, μ, σ) ═ 1 and Verify (PP, μ ', σ ') -1 must hold with an overwhelming probability.
As shown in fig. 1, a novel incremental signature method based on ideal lattices includes the following steps:
s1: setup (n), system parameter setting. Setting the safety parameter n to be more than or equal to 4 and the power of 2. Given two fixed large integer common parameters p and q, satisfying p.q ═ 3tAnd one integer b satisfies qb ═ 1(mod p). Determining a ring from the above parametersWherein phi2n(x)=Xn+1 is a cyclotomic polynomial of order n. Other parameters are then generated according to the following operations:
S1-2: performing the trap-gate-on-Ring Generation Algorithm, ringGenTrap (A', H, s)R) WhereinMark matrixObtaining a matrixAnd a matrix with a marking matrix HG-trap door
S1-3: generating public key PK ═ (a, C)0,C1,...,Cl) And the private key SK ═ R.
S2: sign (PK, SK, μ), standard signature generation: for a given ciphertext mu ═ v1,v2,...,vl]∈{0,1}d×lUsing the public key PK and the private key R, a signature is generated according to the following steps:
S3: incusig (PK, SK, μ, σ, μ'), incremental signature generation: given a message μ e {0, 1}d×lThe corresponding signature μ e {0, 1}d×lAnd a modified message mu '═ v'1,v′2,...,v′l]∈{0,1}d×lMu' andmu satisfies the same condition except for the j-th column. Generating a delta signature using the public key PK and the private key R by:
S3-3: performing an on-Ring proto-image sampling algorithm, ringSampleD (A, R, qb u', s) acquisition
S4: verify (PK, μ, σ), signature verification. According to the public key PK, the message mu-v1,v2,...,vl]∈{0,1}d×lAnd signaturesOutput 1 if the following conditions are met:
the table for comparing the efficiency of the signature method with the efficiency of the general incremental signature method is shown in the following table 1:
table 1:
the foregoing are merely examples of the present invention and common general knowledge of known specific structures and/or features of the schemes has not been described herein in any greater detail. It should be noted that, for those skilled in the art, without departing from the structure of the present invention, several changes and modifications can be made, which should also be regarded as the protection scope of the present invention, and these will not affect the effect of the implementation of the present invention and the practicability of the patent. The scope of the claims of the present application shall be determined by the contents of the claims, and the description of the embodiments and the like in the specification shall be used to explain the contents of the claims.
Claims (1)
1. A novel incremental signature method based on ideal lattices is characterized in that: the method comprises the following steps:
s1: setup (n), system parameter setting: setting a security parameter n, giving two fixed public large integer parameters p, q and an integer b, and then generating other parameters according to the following operations:
s1-2: performing the trap-gate-on-Ring Generation Algorithm, ringGenTrap (A', H, s)R);
S1-3: generating public key PK ═ (a, C)0,C1,...,Cl) And the private key SK ═ R;
s2: sign (PK, SK, μ), standard signature generation: for a given ciphertext mu ═ v1,v2,...,vl]∈{0,1}d×lUsing the public key PK and the private key R, a signature is generated according to the following steps:
S3: IncSig (PK, SK, mu, sigma, mu') incremental signature generates a given message mu e {0, 1}d×lThe corresponding signature μ e {0, 1}d×lAnd a modified message mu '═ v'1,v′2,...,v′l]∈{0,1}d×lMu' and mu satisfy the same condition except for column j; generating a delta signature using the public key PK and the private key R by:
S4: verify (PK, μ, σ), complete the verification. According to the public key PK, the message mu-v1,v2,...,vl]∈{0,1}d×lAnd signaturesOutput 1 if the following conditions are met:
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202011319580.2A CN112383394A (en) | 2020-11-23 | 2020-11-23 | Novel incremental signature method based on ideal lattice |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202011319580.2A CN112383394A (en) | 2020-11-23 | 2020-11-23 | Novel incremental signature method based on ideal lattice |
Publications (1)
Publication Number | Publication Date |
---|---|
CN112383394A true CN112383394A (en) | 2021-02-19 |
Family
ID=74587686
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202011319580.2A Pending CN112383394A (en) | 2020-11-23 | 2020-11-23 | Novel incremental signature method based on ideal lattice |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN112383394A (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN113139213A (en) * | 2021-05-13 | 2021-07-20 | 中国工商银行股份有限公司 | Multi-version data integrity cloud auditing method and system |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101051348A (en) * | 2007-03-23 | 2007-10-10 | 重庆大学 | Signature identifying method |
CN102457380A (en) * | 2010-10-15 | 2012-05-16 | 英飞凌科技股份有限公司 | Data transmitter with a secure and efficient signature |
CN107332665A (en) * | 2017-07-06 | 2017-11-07 | 河南理工大学 | A kind of Partial Blind Signature method of identity-based on lattice |
CN110175473A (en) * | 2019-05-22 | 2019-08-27 | 西安电子科技大学 | Digital signature method based on difficult problem on lattice |
CN110505067A (en) * | 2019-09-11 | 2019-11-26 | 北京邮电大学 | Processing method, device, equipment and the readable storage medium storing program for executing of block chain |
-
2020
- 2020-11-23 CN CN202011319580.2A patent/CN112383394A/en active Pending
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101051348A (en) * | 2007-03-23 | 2007-10-10 | 重庆大学 | Signature identifying method |
CN102457380A (en) * | 2010-10-15 | 2012-05-16 | 英飞凌科技股份有限公司 | Data transmitter with a secure and efficient signature |
CN107332665A (en) * | 2017-07-06 | 2017-11-07 | 河南理工大学 | A kind of Partial Blind Signature method of identity-based on lattice |
CN110175473A (en) * | 2019-05-22 | 2019-08-27 | 西安电子科技大学 | Digital signature method based on difficult problem on lattice |
CN110505067A (en) * | 2019-09-11 | 2019-11-26 | 北京邮电大学 | Processing method, device, equipment and the readable storage medium storing program for executing of block chain |
Non-Patent Citations (2)
Title |
---|
RUSSELL W.F. LAI: ""Trapdoors for ideal lattices with applications"", 《INTERNATIONAL CONFERENCE ON INFORMATION SECURITY AND CRYPTOLOGY》 * |
孙意如等: "理想格上基于身份的环签名方案", 《计算机应用》 * |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN113139213A (en) * | 2021-05-13 | 2021-07-20 | 中国工商银行股份有限公司 | Multi-version data integrity cloud auditing method and system |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN101867474B (en) | Digital signature method | |
Scholl et al. | Improved key generation for Gentry’s fully homomorphic encryption scheme | |
Li et al. | Keyed hash function based on a dynamic lookup table of functions | |
CN115514471A (en) | Method and system for digital signature using multiplicative half-clusters | |
CN117527223B (en) | Distributed decryption method and system for quantum-password-resistant grid | |
CN118070338A (en) | Smart grid-oriented privacy aggregation method, system, equipment and medium | |
CN112383394A (en) | Novel incremental signature method based on ideal lattice | |
Tran et al. | Efficient verifiable computation of linear and quadratic functions over encrypted data | |
CN116684062B (en) | Cloud computing outsourcing and data dynamic sharing method and system based on proxy re-encryption | |
Belfedhal et al. | Building secure and fast cryptographic hash functions using programmable cellular automata | |
Li et al. | Privacy-preserving large-scale systems of linear equations in outsourcing storage and computation | |
CN107947944B (en) | Incremental signature method based on lattice | |
CN116582268A (en) | Sampling method for high-precision variance distribution of lattice password | |
CN114244496B (en) | SM4 encryption and decryption algorithm parallelization realization method based on tower domain optimization S box | |
CN112217629B (en) | Cloud storage public auditing method | |
KR102364047B1 (en) | Method and apparatus for public-key cryptography based on structured matrices | |
Sun et al. | Confidentiality‐Preserving Publicly Verifiable Computation Schemes for Polynomial Evaluation and Matrix‐Vector Multiplication | |
Belfedhal et al. | Fast and efficient design of a pca-based hash function | |
Kong et al. | Cloud outsourcing computing security protocol of matrix multiplication computation based on similarity transformation | |
Nie et al. | Breaking a new instance of TTM cryptosystems | |
EP2356646B1 (en) | Collision-resistant elliptic curve hash functions | |
Tao | A Method to Reduce the Key Size of UOV Signature Scheme | |
Nie et al. | Security analysis of an improved MFE public key cryptosystem | |
Zheng et al. | Proxy Signature for Sensor Networks against Cyber Attack. | |
Lingeshwaran et al. | Performance Evaluation of Classic McEliece Post Quantum Cryptography |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20210219 |
|
WD01 | Invention patent application deemed withdrawn after publication |