CN102006170B - Ring signature method for anonymizing information based on MQ problem in finite field - Google Patents

Abstract

The invention discloses a ring signature method for anonymizing information based on MQ problem in the finite field, comprising the following steps: generating system parameters, generating a secret key, generating the ring signature and verifying the ring signature. The ring signature method based on the traditional cryptosystem is subjected to security threat under the quantum computer while the ring signature method based on the multivariate public key cryptosystem solves the problem that the existing ring signature systems are insecure under the quantum computation. The method has the advantages of security and high computing efficiency.

Description

Based on the method for MQ problem on the finite field to the anonymous ring signature of message

Technical field

The invention belongs to field of information security technology, relate to a kind of based on the method for MQ problem on the finite field to the anonymous ring signature of message.

Background technology

Calendar year 2001, how the people such as Rivest have proposed a kind of novel signature technology under the anonymous background that betrays a secret, are called ring signature (Ring Signature).Ring signature can be regarded as a kind of special group's signature, and it does not have trusted party, does not have group's the process of setting up, and the group here refers to the set that is comprised of a plurality of possible signers be also referred to as ring.The foundation of this ring has spontaneity, and namely ring is by a signer in the situation that do not need to discuss with other people and set up.Ring signature to electronic document is signed by members in the signer representative ring, but signer is fully anonymous for the signature verifier.The ingenious method that the ring signature provides a kind of anonymity to betray the pot to the roses.This Unconditional anonymity of ring signature is very useful in some particular surroundingss to the long-term protection of informational needs.The ring signature can be realized unconditional anonymity, namely can't follow the trail of signer's identity.This Unconditional anonymity of ring signature is applicable to some particular surroundingss of the long-term protection of informational needs.The ring signature attracts wide attention, and has proposed various ring signature schemes.2002, the people such as Abe proposed first ring signature scheme based on discrete logarithm on the finite field.Recently, bilinearity is to being used to design ring signature scheme, yet the right operation efficiency of bilinearity is very low.

The ring signature is because of its distinctive character, such as spontaneity, anonymity etc., so that it can be widely used in anonymity leakage, E-Government, the ecommerce of anonymous electronic voting, confidential information, issue of anonymity and the approval of the anonymity in the wireless sensor network of highlight.The below briefly introduces several application:

1) is used for anonymous leakage information.The Official corruption that for example reports an offender anonymously, in order to prevent official's reprisal, protection informant's privacy, the informant can encircle signature to the report electronic document.Anti-Corruption Bureau can also not expose informant's true identity in the authenticity that obtains report information.At this moment just can use the ring signature scheme;

2) be used for the anonymous authentication of ad-hoc, wireless sensor network.A lot of similarities that are configured with without the characteristics such as center, self-organizing and ring signature of ad-hoc and wireless sensor network.So for the problems in the ad-hoc network, as: member's anonymous authentications etc., often a side of requirement participation entity can keep the privacy of own identity in application process, can use the ring signature and solve.

Along with the appearance of quantum computer, utilize quantum computer can in polynomial time, solve Factorization and discrete logarithm problem, and then serious threat is to the fail safe that has now based on this analogous ring signature of conventional cipher system.Construct new public-key cryptosystem, can substitute the cryptographic system based on number theory, resist following extremely urgent based on the attack of quantum computer.The multivariate public key cryptography system can be resisted the attack of quantum computer, and more effective on calculating than the scheme based on number theory, and therefore, the research that multivariate public key cryptography is learned becomes very active problem in the cryptography development.

The multivariate public key cryptography system has experienced the development course in 20 years so far, the systems such as MIA family, OV family, HFE family, TTM family, MFE family, lIC family occurred.Because fail safe and the efficient of multivariate public key cryptography system are higher, so obtained recently people's extensive concern.

The research that develops into the ring signature of multivariable cryptographic system provides new thinking, because until at present, do not find that also quantum computer has any advantage to the secondary multivariate solving equations.

Up to the present, proposed various ring signature schemes, but these schemes all are based on the conventional cipher system, such as RSA etc.In the face of the appearance of quantum computer, the conventional cipher system is on the hazard, and therefore, existing ring signature system will be no longer safe under quantum calculation.

Summary of the invention

The purpose of this invention is to provide a kind of method of the anonymous ring of message being signed based on MQ problem on the finite field, solve existing ring signature system unsafe defective under quantum calculation.

The technical solution adopted in the present invention is that based on the method for MQ problem on the finite field to the anonymous ring signature of message, the method is implemented according to following steps:

Step 1. generation system parameter

1) k=GF (q) being set is the finite field that is characterized as p, wherein q=p ^l, l is a positive integer;

2) order Be n the expansion of finite field k, n is a positive integer here, and g (x) is n irreducible function on the finite field k;

3) make that m is the number of equation in the multivariable equation group, n is the number of variable;

4) select H:{0,1} ^*→ k ^mBe the unidirectional irreversible hash function of the anti-collision of cryptography safety, system parameters is (k, q, p, l, m, n, H);

Step 2. key generates

1) supposes in the ring t user arranged, be made as U={u ₀, u ₁..., u _T-1;

2) according to the multivariate public key cryptography system, each user u _i(0≤i≤t-1) selects F _iFrom k ⁿTo k ^mInvertible mapping, F _iSatisfy:

A) F _i(x ₁..., x _n)=(f _I1..., f _Im), f wherein _Ij∈ k[x ₁..., x _n], j=1 ..., m;

B) any equation

$F_i(x_1,\·\·\·,x_n)=(y_1^{\′},\·\·\·,y_m^{\′})$

All be easy to find the solution;

3) each user u _i(0≤i≤t-1) selects L at random _1iFrom k ^mTo k ^mA reversible affine transformation

L _1i(x ₁，…，x _m)＝M _1i(x ₁，…，x _m) ^T+a _1i，

M wherein _1iThe invertible matrix of a m * m on the finite field k, a _1iThe column vector of m * 1 on the finite field k;

4) each user u _i(0≤i≤t-1) selects L _2iFrom k ⁿTo k ⁿA reversible affine transformation of random selection

L _2i(x ₁，…，x _n)＝M _2i(x ₁，…，x _n) ^T+a _2i，

M wherein _2iThe invertible matrix of a n * n on the finite field k, a _2iThe column vector of n * 1 on the finite field k;

5) each user u _i(0≤i≤t-1) announces its PKI

${\stackrel{\‾}{F}}_i(x_1,\·\·\·,x_n)=({\stackrel{\‾}{f}}_{i1},\·\·\·,{\stackrel{\‾}{f}}_{\mathrm{im}})$

Wherein each All be k[x ₁..., x _n] in multinomial;

6) each user u _i(its private key SK that maintains secrecy of 0≤i≤t-1) _i={ L _1i, F _i, L _2i;

7) public key sets of t user in the ring is designated as

Step 3. ring signature generates

If suppose member u _π(0≤π≤t-1) represents all member U={u in the ring members ₀, u ₁..., u _T-1To message M ∈ { 0,1} ^*Sign, the user's of the t in the ring public key sets is designated as

u _πPKI be Private key is SK _i={ L _1i, F _i, L _2i, signer u _πThe step of ring signature is as follows:

1) to i=π+1 ..., t-1,0 ..., π-1 selects A at random _i∈ k ⁿ, c _i∈ k ^m, and calculate

$R_i=c_i+{\stackrel{\‾}{F}}_i\left(A_i\right)\∈k^m;$

2) select at random R _π∈ k ^m(i=0 ..., t-1), and calculate

c＝H(L，M，R ₀，…R _t-1))∈k ^m

c _π＝c-(c ₀+…+c _π-1+c _π+1+…+c _t-1)∈k ^m

$A_{\mathrm{\π}}=L_{2\mathrm{\π}}^{-1}{F}_{\mathrm{\π}}^{-1}{L}_{1\mathrm{\π}}^{-1}(R_{\mathrm{\π}}-c_{\mathrm{\π}})\∈k^n$

If A _πWith certain A _iIdentical, then return (2), again choose R _π∈ k ^m

3) output message M is about ring Ring signature sigma=(A ₀, c ₀..., A _T-1, c _T-1);

The checking of step 4. ring signature

Given message M is about ring

Ring signature sigma=(A ₀, c ₀..., A _T-1, c _T-1), any verifier's checking:

$c_0+\·\·\·+c_{t-1}=H(L,M,c_0+{\stackrel{\‾}{F}}_0\left(A_0\right),\·\·\·,c_{t-1}+{\stackrel{\‾}{F}}_{t-1}\left(A_{t-1}\right))$

Whether set up, if equation is set up, then accept the ring signature, otherwise refuse this ring signature.

Characteristics of the present invention also are,

Wherein in the step 3, signer calculates

Make message M about ring

Ring signature sigma=(A ₀, c ₀..., A _T-1, c _T-1) consist of a verifiable closed-loop, satisfy $c_0+\·\·\·+c_{t-1}=H(L,M,c_0+{\stackrel{\‾}{F}}_0\left(A_0\right),\·\·\·,c_{t-1}+{\stackrel{\‾}{F}}_{t-1}\left(A_{t-1}\right)).$

Ring endorsement method based on the conventional cipher system, its fail safe is on the hazard under quantum computer, and the MQ problem on the finite field of the present invention is based on is safe to the method for the anonymous ring signature of message under quantum calculation, and method of the present invention had not only had advantages of fail safe but also had computational efficiency high.

Embodiment

The technical solution adopted in the present invention is that based on the method for MQ problem on the finite field to the anonymous ring signature of message, the method is implemented according to following steps:

Step 1. generation system parameter

1) k=GF (q) being set is the finite field that is characterized as p, wherein q=p ^l, l is a positive integer;

2) order

Be n the expansion of finite field k, n is a positive integer here, and g (x) is n irreducible function on the finite field k;

3) make that m is the number of equation in the multivariable equation group, n is the number of variable;

4) select H:{0,1} ^*→ k ^mBe the unidirectional irreversible hash function of the anti-collision of cryptography safety; System parameters is (k, q, p, l, m, n, H).

Step 2. key generates

1) supposes in the ring t user arranged, be made as U={u ₀, u ₁..., u _T-1.

2) according to the multivariate public key cryptography system, each user u _i(0≤i≤t-1) selects F _iFrom k ⁿTo k ^mInvertible mapping, F _iSatisfy:

A) F _i(x ₁..., x _n)=(f _I1..., f _Im), f wherein _Ij∈ k[x ₁..., x _n], j=1 ..., m;

B) any equation

$F_i(x_1,\·\·\·,x_n)=(y_1^{\′},\·\·\·,y_m^{\′})$

All be easy to find the solution;

3) each user u _i(0≤i≤t-1) selects L at random _1iFrom k ^mTo k ^mA reversible affine transformation

L _1i(x ₁，…，x _m)＝M _1i(x ₁，…，x _m) ^T+a _1i

M wherein _1iThe invertible matrix of a m * m on the finite field k, a _1iIt is the column vector of m * 1 on the finite field k.

4) each user u _i(0≤i≤t-1) selects L _2iFrom k ⁿTo k ⁿA reversible affine transformation of random selection

L _2i(x ₁，…，x _n)＝M _2i(x ₁，…，x _n) ^T+a _2i，

M wherein _2iThe invertible matrix of a n * n on the finite field k, a _2iIt is the column vector of n * 1 on the finite field k;

5) each user u _i(0≤i≤t-1) announces its PKI

${\stackrel{\‾}{F}}_i(x_1,\·\·\·,x_n)=({\stackrel{\‾}{f}}_{i1},\·\·\·,{\stackrel{\‾}{f}}_{\mathrm{im}})$

Wherein each

All be k[x ₁..., x _n] in multinomial;

6) each user u _i(its private key SK that maintains secrecy of 0≤i≤t-1) _i={ L _1i, F _i, L _2i;

7) public key sets of t user in the ring is designated as

Step 3. ring signature generates

If suppose member u _π(0≤π≤t-1) represents all member U={u in the ring members ₀, u ₁..., u _T-1To message M ∈ { 0,1} ^*Sign, the user's of the t in the ring public key sets is designated as u _πPKI be

Private key is SK _i={ L _1i, F _i, L _2i.Signer u _πThe step of ring signature is as follows:

1) to i=π+1 ..., t-1,0 ..., π-1 selects A at random _i∈ k ⁿ, c _i∈ k ^m, and calculate

$R_i=c_i+{\stackrel{\‾}{F}}_i\left(A_i\right)\∈k^m;$

2) select at random R _π∈ k ^m(i=0 ..., t-1), and calculate

c＝H(L，M，R ₀，…R _t-1))∈k ^m

c _π＝c-(c ₀+…+c _π-1+c _π+1+…+c _t-1)∈k ^m

$A_{\mathrm{\π}}=L_{2\mathrm{\π}}^{-1}{F}_{\mathrm{\π}}^{-1}{L}_{1\mathrm{\π}}^{-1}(R_{\mathrm{\π}}-c_{\mathrm{\π}})\∈k^n$

If A _πWith certain A _iIdentical, then return (2), again choose R _π∈ k ^m

3) output message M is about ring

Ring signature sigma=(A ₀, c ₀..., A _T-1, c _T-1);

Wherein signer calculates

Make message M about ring

Ring signature sigma=(A ₀, c ₀..., A _T-1, c _T-1) consist of a verifiable closed-loop, satisfy $c_0+\·\·\·+c_{t-1}=H(L,M,c_0+{\stackrel{\‾}{F}}_0\left(A_0\right),\·\·\·,c_{t-1}+{\stackrel{\‾}{F}}_{t-1}\left(A_{t-1}\right)).$

The checking of step 4. ring signature

Give fixed ring

The ring signature sigma about message M=(A ₀, c ₀..., A _T-1, c _T-1), any verifier's checking:

$c_0+\·\·\·+c_{t-1}=H(L,M,c_0+{\stackrel{\‾}{F}}_0\left(A_0\right),\·\·\·,c_{t-1}+{\stackrel{\‾}{F}}_{t-1}\left(A_{t-1}\right))$

Whether set up.If equation is set up, then accept the ring signature, otherwise refuse this ring signature.

The below analyzes completeness, anonymity and unforgeable of signing based on the ring of multivariate public key cryptography system of the present invention respectively:

● correctness

Proposed by the invention is correct based on multivariable ring signature.

If the recipient receive message M about the ring Signature sigma=(A ₀, c ₀..., A _T-1, c _T-1), if this signature is to be undertaken by as above step, and in the process of transmission, do not change, then verification expression

$c_0+\·\·\·+c_{t-1}=H(L,M,c_0+{\stackrel{\‾}{F}}_0\left(A_0\right),\·\·\·,c_{t-1}+{\stackrel{\‾}{F}}_{t-1}\left(A_{t-1}\right))$

Set up.

By $A_{\mathrm{\π}}=L_{2\mathrm{\π}}^{-1}{F}_{\mathrm{\π}}^{-1}{L}_{1\mathrm{\π}}^{-1}(R_{\mathrm{\π}}-c_{\mathrm{\π}})\∈k^n,$

Obtain ${\stackrel{\‾}{F}}_{\mathrm{\π}}\left(A_{\mathrm{\π}}\right)=R_{\mathrm{\π}}-c_{\mathrm{\π}},$

So $R_i=c_i+{\stackrel{\‾}{F}}_i\left(A_i\right)\∈k^m,(0\≤i\≤t-1),$

Substitution c=H (L, M, R ₀... R _T-1),

Obtain

$c_0=H(L,M,c_0+{\stackrel{\‾}{F}}_0\left(A_0\right),\·\·\·,c_{t-1}+{\stackrel{\‾}{F}}_{t-1}\left(A_{t-1}\right)),$

Because c=is (c ₀+ ... c _π-1+ c _π+ c _π+1+ ... + c _T-1),

Namely $c_0+\·\·\·+c_{t-1}=H(L,M,c_0+{\stackrel{\‾}{F}}_0\left(A_0\right),\·\·\·,c_{t-1}+{\stackrel{\‾}{F}}_{t-1}\left(A_{t-1}\right))).$

● the signer anonymity

Proposed by the invention satisfies signer's Unconditional anonymity based on multivariable ring signature.

If message M is about ring Ring signature sigma=(A ₀, c ₀..., A _T-1, c _T-1) be an effectively signature, according to the generative process of signature, all u _iA member in the ring, u _iBy the process that generates the ring signature message M is encircled signature, according to the generative process of signature, all A _i, c _i(i=0 ..., π-1, π+1 ..., t-1) all choose at random, and R _π∈ k ^mAlso choose at random, therefore

Also be k ^mOn a random value because c _π=c-(c ₀+ ... + c _π-1+ c _π+1+ ... + c _T-1) ∈ k ^mK ^mTherefore a value of upper completely random encircles signature sigma=(A ₀, c ₀..., A _T-1, c _T-1) middle A _i, c _i(i=0 ..., t-1) all these are worth the probability selection of signed generating algorithm to equate, and irrelevant with signer.So even if external attacker has illegally obtained the private key of all signers, element is t element among the group, and the probability that it can determine real signer is

Therefore without any advantage, the signer is unconditional anonymous.

● ring signature unforgeable

The present invention propose based on the ring signature scheme of multivariable polynomial about multivariate public key cryptography system (MPKC) known attack can not forge, if in MPKC under the known attack, selected multivariable signature system is safe in the ring signature scheme.Here known attack comprises Algebraic Attacks among the MPKC, and linearisation is attacked, order attack and differential attack etc.

Proof: suppose by the key of generating algorithm generation pair

And public key sets

Send to assailant A.A can utilize known attack among the MPKC, and such as Algebraic Attacks, linearisation is attacked, and order is attacked, differential attack etc.A exports (R ^*, M ^*, σ ^*), if Set up success attack.In this process, A can not inquire (*, M ^*, σ ^*), and

We analyze the ring signature (R that A output is forged now ^*, M ^*, σ ^*) computation complexity.We are hypothesize attack person A imitation signer u _πForgery is about ring R ^*Ring signature (R ^*, M ^*, σ ^*), not general, suppose

Step 1 during assailant A generates according to the ring signature), 2) calculate, but in order to forge the signature of certain message M, need to be by trying to achieve A _π, satisfy

${\stackrel{\‾}{F}}_{\mathrm{\π}}\left(A_{\mathrm{\π}}\right)=R_{\mathrm{\π}}-c_{\mathrm{\π}}$

Forge ring signature sigma=(A ₀, c ₀..., A _T-1, c _T-1).Finding the solution of this problem belongs to multivariable quadratic polynomial solving equations problem on the finite field, also be the multivariate public key cryptography system based on difficult problem.At present the attack of multivariate public key cryptography system there is following method:

1) direct Algebraic Attacks: the Algebraic Attacks for the multivariate public key cryptography system refers in the situation that do not know that private key is directly from quadratic equation In find the solution ciphertext A _π

Base algorithm and XL algorithm are the most effective direct Algebraic Attacks methods.If actual multivariate public key cryptography system selected in this programme can be resisted direct Algebraic Attacks, the ring signature among the present invention also can be resisted direct Algebraic Attacks.

2) lienarized equation is attacked: a lienarized equation refers to given PKI

Have following equation to set up:

$\underset{i,j}{\mathrm{\Σ}}{a}_{\mathrm{ij}}{A}_{\mathrm{\π},i}{v}_{\mathrm{\π},j}+\underset{i}{\mathrm{\Σ}}{b}_i{A}_{\mathrm{\π},i}+\underset{j}{\mathrm{\Σ}}{c}_j{v}_{\mathrm{\π},j}+d=0$

V _π=R _π-c _π∈ k ^mOccurrence substitution following formula, we obtain A _πAnd v _πOne affine (linearity) relation.If selected actual multivariate public key cryptography system can be resisted and be utilized lienarized equation to attack attacking in this programme, the ring signature among the present invention also can be resisted lienarized equation and attack.

3) order is attacked: Goubin and Courtois point out that minimum order is attacked and are applicable to triangle-Jia-subtract system.The complexity that order is attacked is about

Wherein k is F _πMinimum order is the number of the linear combination of r in the component.

If selected actual multivariate public key cryptography system can be resisted and be utilized minimum order to attack in this programme, then the signature of the ring among the present invention also can be resisted minimum order attack.

4) differential attack: the PKI that provides a multivariate public key cryptography system

One group of quadratic polynomial, its difference

Be defined as $D{\stackrel{\‾}{F}}_{\mathrm{\π}}(x,c)={\stackrel{\‾}{F}}_{\mathrm{\π}}(x+c)-{\stackrel{\‾}{F}}_{\mathrm{\π}}\left(x\right)-{\stackrel{\‾}{F}}_{\mathrm{\π}}\left(c\right)+{\stackrel{\‾}{F}}_{\mathrm{\π}}\left(0\right),$ This be one group about x ∈ k ⁿFunction.Key is to utilize the concealed structure in the difference to attack the multivariate public key cryptography system.If actual multivariate public key cryptography system selected in this programme can be resisted differential attack, then the signature of the ring among the present invention also can be resisted differential attack.

Known by above proof, if our selected multivariate public key cryptography system existing be safe under MPKC is attacked, then ring signature of the present invention existing also be safe under MPKC is attacked.

Embodiment

Anonymity ring signature scheme based on multivariate public key cryptography TTS (20,28) system

Step 1. generation system parameter

1) k=GF (q is set ^l)=GF (2 ⁸) be the finite field that is characterized as p=2;

2) make that m=20 is the number of equation in the multivariable equation group, n=28 is the number of variable;

3) select H:{0,1} ^*→ k ^mBe the unidirectional irreversible hash function of the anti-collision of cryptography safety, system parameters is (k, q, p, l, m, n, H).

Step 2. key generates

1) supposes in the ring t user arranged, be made as U={u ₀, u ₁..., u _T-1;

2) according to the multivariate public key cryptography system, each user u _i(0≤i≤t-1) selection F is from k ⁿTo k ^mInvertible mapping, F is the mappings of following central authorities

$y_i=x_i+{\mathrm{\Σ}}_{j=1}^7{p}_{i,j}{x}_j{x}_{8+(i+j\mathrm{mod}9)},i=8\·\·\·16;$

y ₁₇＝x ₁₇+p _17，1x ₁x ₆+p _17，2x ₂x ₅+p _17，3x ₃x ₄+p _17，4x ₉x ₁₆+p _17，5x ₁₀x ₁₅+p _17，6x ₁₁x ₁₄+p _17，7x ₁₂x ₁₃；

y ₁₈＝x ₁₈+p _18，1x ₂x ₇+p _18，2x ₃x ₆+p _18，3x ₄x ₅+p _18，4x ₁₀x ₁₇+p _18，5x ₁₁x ₁₆+p _18，6x ₁₂x ₁₅+p _18，7x ₁₃x ₁₄；

$y_i=x_i+p_{i,0}{x}_{i-11}{x}_{i-9}+{\mathrm{\Σ}}_{j=19}^i{p}_{i,j-18}{x}_{2(i-j)}{x}_j+{\mathrm{\Σ}}_{j=i+1}^{27}{p}_{i,j-18}{x}_{i-j+19}{x}_j,i=19\·\·\·27.$

Here F is called as central authorities' mapping of TTS (20,28);

3) each user u _i(0≤i≤t-1) selects L at random ₁From k ^mTo k ^mA reversible affine transformation

L _1i(x ₁，…，x _m)＝M _1i(x ₁，…，x _m) ^T+a _1i，

M wherein _1iThe invertible matrix of a m * m on the finite field k, a _1iThe column vector of m * 1 on the finite field k;

4) each user u _i(0≤i≤t-1) selects L _2iFrom k ⁿTo k ⁿA reversible affine transformation of random selection

L _2i(x ₁，…，x _n)＝M _2i(x ₁，…，x _n) ^T+a _2i，

M wherein _2iThe invertible matrix of a n * n on the finite field k, a _2iThe column vector of n * 1 on the finite field k, a _2iChoose so that There is not constant component;

5) each user u _i(0≤i≤t-1) announces its PKI

${\stackrel{\‾}{F}}_i(x_1,\·\·\·,x_n)=({\stackrel{\‾}{f}}_{i1},\·\·\·,{\stackrel{\‾}{f}}_{\mathrm{im}})$

Wherein each

All be k[x ₁..., x _n] in multinomial;

6) each user u _i(its private key SK that maintains secrecy of 0≤i≤t-1) _i={ L _1i, F _i, L _2i;

7) public key sets of t user in the ring is designated as

Step 3. ring signature generates

If suppose member u _π(0≤π≤t-1) represents all member U={u in the ring members ₀, u ₁..., u _T-1To message M ∈ { 0,1} ^*Sign, the user's of the t in the ring public key sets is designated as

u _πPKI be

Private key is SK _π={ L _{π 1}, F _π, L _{π 2}.Signer u _πThe step of ring signature is as follows:

1) to i=π+1 ..., t-1,0 ..., π-1 selects A at random _i∈ k ⁿ, c _i∈ k ^m, and calculate

$R_i=c_i+{\stackrel{\‾}{F}}_i\left(A_i\right)\∈k^m;$

2) select at random R _π∈ k ^m(i=0 ..., t-1), and calculate

c＝H(L，M，R ₀，…R _t-1))∈k ^m

c _π＝c-(c ₀+…+c _π-1+c _π+1+…+c _t-1)∈k ^m

Then calculate

Then calculate a possible x=F ^-1(y) ∈ k ⁿAs follows:

A) assigned at random x ₁..., x ₇∈ k attempts finding the solution x ₈..., x ₁₆Utilize front 9 equations.Because the determinant of this system of linear equations (to x arbitrarily ₂X ₇) be one about x ₁Number of times is 9 multinomial, x ₁There are at most 9/256ths kinds of selections that first systematic is degenerated.If without solution, assigned at random x again ₁..., x ₇∈ k is until we find x ₈..., x ₁₆A solution.

B) the continuous x that finds the solution ₁₇And x ₁₈, use to meet following two equation (y ₁₇And y ₁₈).

C) assign a random x ₀, attempt from last 9 equation solution x ₁₉..., x ₂₇If without solution, random selection x again ₀Until solution x ₁₉..., x ₂₇Found.

D) the above-mentioned institute of note tries to achieve to separate and is x=(x ₀, x ₁..., x ₂₇)=F ^-1(y) ∈ k ⁿ, calculate

$A_{\mathrm{\π}}=L_{2\mathrm{\π}}^{-1}x\∈k^n$

If A _πWith certain A _iIdentical, then return (2), again choose R _π∈ k ^m

3) output ring

The signature sigma about message M=(A ₀, c ₀..., A _T-1, c _T-1).

The checking of step 4. ring signature

Give fixed ring U={u ₀, u ₁..., u _T-1The signature sigma about message M=(A ₀, c ₀..., A _T-1, c _T-1), any verifier can verify the checking of signature correctness:

$c_0+\·\·\·+c_{t-1}=H(L,M,c_0+{\stackrel{\‾}{F}}_0\left(A_0\right),\·\·\·,c_{t-1}+{\stackrel{\‾}{F}}_{t-1}\left(A_{t-1}\right))$

Whether set up.If equation is set up, then accept the ring signature, otherwise refuse this ring signature.

The present invention is directed to the appearance of quantum computer, the conventional cipher system is on the hazard, and utilizes the advantage based on multivariate public key cryptography safety under quantum calculation, and solving existing ring signature system will no longer safe defective under quantum calculation.The ring signature scheme based on the multivariate public key cryptography system of invention satisfies Unconditional anonymity and the unforgeable of signer, is better than the conventional cipher system in efficient.

Method of the present invention provides the number of rings word signature of electronic document, can be used for protecting the integrality of electronic document in issue, storage or transmission, the safeguard protection of authenticity; Simultaneously; can protect again the anonymity of signer; do not expose with the information that guarantees the signature user; in the situation that this signature is by checking; make certain member's signature in the ring that the verifier of signature can be sure of that this signature is comprised of a plurality of users; but the verifier can not confirm this signature on earth by which member's signature, and the probability of each member's signature equates.

Claims (1)

1. based on the method for MQ problem on the finite field to the anonymous ring signature of message, it is characterized in that, the method is implemented according to following steps:

Step 1. generation system parameter

1) k=GF (q) being set is the finite field that is characterized as p, wherein q=p ^l, l is a positive integer;

2) order

Be n the expansion of finite field k, n is a positive integer here, and g (x) is n irreducible function on the finite field k;

3) make that m is the number of equation in the multivariable equation group, n is the number of variable;

4) select H:{0,1} ^*→ k ^mBe the unidirectional irreversible hash function of the anti-collision of cryptography safety, system parameters is (k, q, p, l, m, n, H);

Step 2. key generates

1) supposes in the ring t user arranged, be made as U={u ₀, u ₁..., u _T-1;

2) according to the multivariate public key cryptography system, each user u _i(0≤i≤t-1) selects F _iFrom k ⁿTo k ^mInvertible mapping, F _iSatisfy:

A) F _i(x ₁..., x _n)=(f _I1..., f _Im), f wherein _Ij∈ k[x ₁..., x _n], j=1 ..., m;

B) any equation

F _i(x ₁,…,x _n)＝(y′ ₁,…,y′ _m)

All be easy to find the solution;

3) each user u _i(0≤i≤t-1) selects L at random _1iFrom k ^mTo k ^mA reversible affine transformation

L _1i(x ₁,…,x _m)＝M _1i(x ₁,…,x _m) ^T+a _1i，

M wherein _1iThe invertible matrix of a m * m on the finite field k, a _1iThe column vector of m * 1 on the finite field k;

4) each user u _i(0≤i≤t-1) selects L _2iFrom k ⁿTo k ⁿA reversible affine transformation of random selection

L _2i(x ₁,…,x _n)＝M _2i(x ₁,…,x _n) ^T+a _2i，

M wherein _2iThe invertible matrix of a n * n on the finite field k, a _2iThe column vector of n * 1 on the finite field k;

5) each user u _i(0≤i≤t-1) announces its PKI

${\stackrel{\‾}{F}}_i=(x_1,\·\·\·,x_n)=({\stackrel{\‾}{f}}_{i1},\·\·\·,{\stackrel{\‾}{f}}_{\mathrm{im}})$

Wherein each

All be k[x ₁..., x _n] in multinomial;

6) each user u _i(its private key SK that maintains secrecy of 0≤i≤t-1) _i={ L1 _i, F _i, L _2i;

7) public key sets of t user in the ring is designated as

Step 3. ring signature generates

If suppose member u _π(0≤π≤t-1) represents all member U={u in the ring members ₀, u ₁..., u _T-1To message M ∈ { 0,1} ^*Sign, the user's of the t in the ring public key sets is designated as

u _πPKI be

Private key is SK _i={ L _1i, F _i, L _2i, signer u _πThe step of ring signature is as follows:

1) to i=π+1 ..., t-1,0 ..., π-1 selects A at random _i∈ k ⁿ, c _i∈ k ^m, and calculate

$R_i=c_i+{\stackrel{\‾}{F}}_i\left(A_i\right)\∈k^m;$

2) select at random R _π∈ k ^m(i=0 ..., t-1), and calculate

c＝H(L,M,R ₀,…R _t-1))∈k ^m

c _π＝c-(c ₀+…+c _π-1+c _π+1+…+c _t-1)∈k ^m

$A_{\mathrm{\π}}=L_{2\mathrm{\π}}^{-1}{F}_{\mathrm{\π}}^{-1}{L}_{1\mathrm{\π}}^{-1}(R_{\mathrm{\π}}-c_{\mathrm{\π}})\∈k^n$

If A _πWith certain A _iIdentical, then return (2), again choose R _π∈ k ^m

3) output message M is about ring

Ring signature sigma=(A ₀, c ₀..., A _T-1, c _T-1);

Wherein signer calculates

Make message M about ring

Ring signature sigma=(A ₀, c ₀..., A _T-1, c _T-1) consist of a verifiable closed-loop, satisfy $c_0+\·\·\·+c_{t-1}=H(L,M,c_0+{\stackrel{\‾}{F}}_0\left(A_0\right),\·\·\·,c_{t-1}+{\stackrel{\‾}{F}}_{t-1}\left(A_{t-1}\right));$

The checking of step 4. ring signature

Given message M is about ring

Ring signature sigma=(A ₀, c ₀..., A _T-1, c _T-1), any verifier's checking:

$c_0+\·\·\·+c_{t-1}=H(L,M,c_0+{\stackrel{\‾}{F}}_0\left(A_0\right),\·\·\·,c_{t-1}+{\stackrel{\‾}{F}}_{t-1}\left(A_{t-1}\right))$

Whether set up, if equation is set up, then accept the ring signature, otherwise refuse this ring signature.