CN117955644A - SM 9-based linkable ring signature method - Google Patents

Abstract

The invention relates to a method for signing a linkable ring based on SM9, which provides a method for signing a linkable ring based on SM9, wherein a signer can generate a label related to a private key and a participation signing event, an output signature can comprise the signature label, and when the labels of the two signatures are identical, the two signatures are linked together, so that the linkable property of the signatures is ensured. In the invention, the chainability is based on an event, two signatures generated by the same signer can be chained together under the same event, and two signatures generated by the same signer can not be chained under different events. Some practical problems can be solved in some specific application scenarios.

Description

SM 9-based linkable ring signature method

Technical Field

The invention relates to the field of information security, in particular to a linkable ring signature method based on SM 9.

Background

Digital signatures are fundamental tools of cryptography for authenticating digital information, applications of asymmetric key encryption techniques and digital digest techniques. Rivest et al in 2001 proposed a digital signature that was obscured by the signer, called a ring signature. The ring signature can complete the signature without cooperation of ring members, can ensure anonymity of signers, and has wide application scenes. The ring signature with single function can only additionally ensure anonymity of signers, and cannot solve some practical problems in some specific application scenes.

The linkable ring signature can enable anyone to determine whether two ring signatures are generated by the same signer, and is very practical in application scenes such as voting.

Disclosure of Invention

The technical problem to be solved by the invention is to provide a linkable ring signature method based on SM9 in consideration of the above problems.

The invention adopts the following technical scheme:

a SM 9-based linkable ring signature method comprising the steps of:

Step 1, initializing a system:

Step 2, a key generation center generates a user private key D _u;

step 3, signature: user input system parameters params, private key D _u, message m, event, public key set After that, the following steps are performed;

Step 3.1, calculate e=h ₃ (event), tag t=e (D _u, E);

step 3.2, randomly selecting random numbers Calculating r=r·p ₁; randomly selecting random number/>i＝1,2,3,...,u-1,u+1,...,n；

Step 3.3, calculatingCalculation/> Calculation/>Calculation ofV＝R-c_u·D_u,W＝R-(Q_uc_ur)·P₁；

Step 3.4, outputting signature σ= (T, R, V, W, c ₁,c₂,...,c_n);

step 4, verification: verifier inputs system parameters params, message m, event, public key set After signing σ, the following steps are performed:

Step 4.1, calculate e=h ₃ (event), Calculation/>

Step 4.2, verificationIf the two are equal to h, if the two are equal to each other, the verification is passed, otherwise, the verification is not passed.

Step 5, linking: inputting two signatures σ₁＝(T,R,V,W,c₁,c₂,...,c_n),σ₂＝(T′,R′,V′,W′,c′₁,c′₂,...,c′_n), if t=t', then the two signatures are linked; if T is not equal to T', the two signatures are not linkable;

in the above steps, the meanings of the parameters are as follows:

"·", wherein k·p represents a k times point of the point P on the elliptic curve, and k is a positive integer;

a set of integers consisting of 1,2, …, q-1;

h ₁,H₂: a cryptographic hash function is used to determine the cryptographic function,

H ₃: a cryptographic hash function is used to determine the cryptographic function,

S: a system master private key that is held in secret by the key generation center;

m: a message;

sigma: signing;

Qi: hash value of ith user identity mark of public key list;

D _i: a private key of user i;

A list of public keys, i.e., { ID ₁,ID₂,...,ID_n };

event: the user participates in the signed event.

Further, the step 1 specifically includes the following steps:

Step 1.1, setting a safety parameter 1 ^λ, selecting an addition circulation group with the order of q The generator is P ₁,P₂, from/>To/>Bilinear pair mapping e, cryptographic hash function/>

Step 1.2, randomly selectingThe key generation center calculates a master public key: p _pub＝s·P₂.

Step 1.3, outputting common parameters:

In the above steps, the meanings of the parameters are as follows:

q: a large prime number;

e: from the slave To/>Is a bilinear pair mapping of (1);

A set of integers consisting of 1,2, …, q-1;

An addition loop group of order q;

A multiplication loop group of order q;

p ₁,P₂: respectively as groups And/>Is a generator of (1).

Further, the step 2 specifically includes the following steps:

Step 2.1, the user sends the identity ID _u to a key generation center;

Step 2.1, the key generation center calculates the hash value Q _u＝H₁(ID_u of the user, and then calculates the private key D _u＝[s·(H₁(ID_u)+s)^-1]·P₁ of the user;

And 2.3, the key generation center sends the private key D _u of the user to the user.

The beneficial effects of the invention are as follows: the invention provides a SM 9-based linkable ring signature method, a signer can generate a label related to a private key and a participation signature event, the output signature can contain the signature label, and when the labels of the two signatures are identical, the two signatures are linked together, so that the linkable property of the signatures is ensured. In the invention, the chainability is based on an event, two signatures generated by the same signer can be chained together under the same event, and two signatures generated by the same signer can not be chained under different events. Can solve some practical problems in some specific application scenes

Drawings

FIG. 1 is a schematic flow chart of the present invention;

Fig. 2 is a schematic diagram of the present invention.

Detailed Description

The principles and features of the present invention are described below with reference to the drawings, the examples are illustrated for the purpose of illustrating the invention and are not to be construed as limiting the scope of the invention.

The parameters designed by the invention are defined as follows:

q: a large prime number.

An integer set consisting of 1,2, …, q-1.

The addition loop group with order q.

The multiplication loop group with the order q.

P ₁,P₂: respectively as groupsAnd/>Is a generator of (1).

K.P, which is a positive integer, is the k times point of the point P on the elliptic curve.

E: from the slaveTo/>Is a bilinear pair mapping of (1).

H ₁,H₂: a cryptographic hash function is used to determine the cryptographic function,

H ₃: a cryptographic hash function is used to determine the cryptographic function,

S: a system master private key held by KGC secrets.

M: a message.

Sigma: and (5) signing.

Q _i: the hash value of the ith user identity of the public key list.

D _i: user i's private key.

A list of public keys, i.e., { ID ₁,ID₂,...,ID_n }.

KGC: a key generation center.

Event: the user participates in the signed event.

As shown in fig. 1-2, the present invention proposes a solution of a linkable ring signature method based on SM9, and the specific solution flow is as follows: the scheme comprises five stages: system initialization, user key generation, signature, verification and linking;

1) Initializing a system: given security parameters 1 ^λ, the following steps are performed:

① Selecting an addition cyclic group of order q The generator is P ₁,P₂, from/>To/>Bilinear pair mapping e, cryptographic hash function/>

② KGC master private key: randomly selectCalculating a main public key: p _pub＝s·P₂.

③ Outputting common parameters:

2) User key generation:

① The user sends an identification ID _u to KGC.

② KGC calculates the hash value Q _u＝H₁(ID_u of the user and then calculates the user private key D _u＝[s·(H₁(ID_u)+s)^-1]·P₁.

③ KGC sends the user's private key D _u to the user.

3) Signature: user input system parameters params, private key D _u, message m, event, public key set

① Calculate e=h ₃ (event), tag t=e (D _u, E);

② Randomly selecting random numbers Calculating r=r·p ₁;

③ Randomly selecting random numbers i＝1,2,3,...,u-1,u+1,...,n；

④ Calculation of

⑤ Calculation of

⑥ Calculation of

⑦ Calculation ofV＝R-c_u·D_u,W＝R-(Q_uc_ur)·P₁；

⑧ Output signature σ= (T, R, V, W, c ₁,c₂,...,c_n).

4) And (3) verification: verifier inputs system parameters params, message m, event, public key setSignature sigma.

① Calculate e=h ₃ (event),

② Calculation of

③ VerificationIf the two are equal to h, if the two are equal to each other, the verification is passed, otherwise, the verification is not passed.

5) Linking: inputting two signatures σ₁＝(T,R,V,W,c₁,c₂,...,c_n),σ₂＝(T′,R′,V′,W′,c′₁,c′₂,...,c′_n), if t=t', then the two signatures are linked; if T+.T', the two signatures are not linkable.

The foregoing is illustrative of the best mode of carrying out the invention, and is not presented in any detail as is known to those of ordinary skill in the art. The protection scope of the invention is defined by the claims, and any equivalent transformation based on the technical teaching of the invention is also within the protection scope of the invention.

Claims (3)

1. A method for interlinkable ring signature based on SM9, comprising the steps of:

Step 1, initializing a system:

Step 2, a key generation center generates a user private key D _u;

step 3, signature: user input system parameters params, private key D _u, message m, event, public key set After that, the following steps are performed;

Step 3.1, calculate e=h ₃ (event), tag t=e (D _u, E);

step 3.2, randomly selecting random numbers Calculating r=r·p ₁; randomly selecting random number/>

Step 3.3, calculatingCalculation/> Calculation/>Calculation ofV＝R-c_u·D_u,W＝R-(Q_uc_ur)·P₁；

Step 3.4, outputting signature σ= (T, R, V, W, c ₁,c₂,...,c_n);

step 4, verification: verifier inputs system parameters params, message m, event, public key set After signing σ, the following steps are performed:

Step 4.1, calculate e=h ₃ (event), Calculation/>

Step 4.2, verificationIf the two types of the data are equal to h, if the two types of the data are equal to each other, the verification is passed, otherwise, the verification is not passed;

step 5, linking: inputting two signatures σ₁＝(T,R,V,W,c₁,c₂,...,c_n),σ₂＝(T′,R′,V′,W′,c′₁,c′₂,...,c′_n), if t=t', then the two signatures are linked; if T is not equal to T', the two signatures are not linkable;

in the above steps, the meanings of the parameters are as follows:

"·", wherein k·p represents a k times point of the point P on the elliptic curve, and k is a positive integer;

a set of integers consisting of 1,2, …, q-1;

h ₁,H₂: a cryptographic hash function is used to determine the cryptographic function,

H ₃: a cryptographic hash function is used to determine the cryptographic function,

S: a system master private key that is held in secret by the key generation center;

m: a message;

sigma: signing;

q _i: hash value of ith user identity mark of public key list;

D _i: a private key of user i;

A list of public keys, i.e., { ID ₁,ID₂,...,ID_n };

event: the user participates in the signed event.

2. The SM 9-based linkable ring signature method of claim 1, wherein step 1 specifically comprises the steps of:

Step 1.1, setting a safety parameter 1 ^λ, selecting an addition circulation group with the order of q The generating elements are P ₁,P₂ respectively, fromTo/>Bilinear pair mapping e, cryptographic hash function/>

Step 1.2, randomly selectingThe key generation center calculates a master public key: p _pub＝s·P₂;

step 1.3, outputting common parameters:

In the above steps, the meanings of the parameters are as follows:

q: a large prime number;

e: from the slave To/>Is a bilinear pair mapping of (1);

A set of integers consisting of 1,2, …, q-1;

An addition loop group of order q;

A multiplication loop group of order q;

p ₁,P₂: respectively as groups And/>Is a generator of (1).

3. The SM 9-based linkable ring signature method of claim 1, wherein step 2 specifically comprises the steps of:

Step 2.1, the user sends the identity ID _u to a key generation center;

Step 2.1, the key generation center calculates the hash value Q _u＝H₁(ID_u of the user, and then calculates the private key D _u＝[s·(H₁(ID_u)+s)^-1]·P₁ of the user;

And 2.3, the key generation center sends the private key D _u of the user to the user.