KR101523053B1 - System and method for verifiably encrypted signatures from lattices - Google Patents

Abstract

A lattice-based verifiably encrypted signature system according to an embodiment of the present invention comprises: a verifier key generation unit to generate a public key and a private key of a verifier using a public parameter group containing a system parameter outputted according to a security level input; a signer key generation unit to generate a public key and a private key of a signer using the public parameter group and the public key of the verifier; a judge key generation unit to generate a public key and a private key of a judge using the public parameter group if the signer′s signature is verified as a valid signature with respect to the public key of the signer and a message; and a verifiably encrypted signature generation unit to generate a verifiably encrypted signature with respect to the message using the public key of the signer and the public key of the judge.

Description

TECHNICAL FIELD [0001] The present invention relates to a lattice-based provable password signing system and method,

Embodiments of the present invention relate to digital signatures widely used in the field of cryptography, and more particularly to a provable cryptographic signature technique that can be used in electronic commerce and the like.

Verifiable cryptographic signature technology differs from common signature technology in that a signer creates a signature for a message and sends it to the verifier to verify it. Instead of encrypting it, the signature generated by the trusted third party's public key is encrypted . The verifier that receives the ciphertext can verify that the ciphertext encrypts the legitimate signature for the given message, unlike the general cryptographic technique that does not expose any information about plaintext. In addition, the referee can restore the signatures generated by the signer in the corresponding ciphertext. This signature technique can be used in electronic commerce.

Users A and B wish to exchange signature values for specific documents (messages). However, when using the generic signature technique, it is impossible to prevent A from exposing its own signature value and not receiving the signature value of B. In this circumstance, when using the provable password signature technique, A and B first generate a provable cryptographic signature value for their signature value and then exchange it. After confirming the legitimacy of this, they will exchange their signature values. In this process, if one party does not disclose its signature value, the common signature value can be extracted from the pre-exchanged provable password signature value through the referee.

The proposed proof - of - concept cryptographic signature technique is designed based on factorization, discrete algebra, and pairing. However, these problems, which are considered to be difficult to solve, can not guarantee the reliability of the safety due to the recent development of the quantum algorithm, and a technique of solving the factorization problem using the actual quantum algorithm has been proposed.

In this environment, interest in lattices is increasing. The existing lattice-based cryptosystem has many problems due to lack of safety proof, but recently, a lattice-based cryptosystem proved based on the worst-case problem is emerging. It can be seen that the existing cryptosystem provides very high safety in view of the fact that it is designed based on the average-case problem.

이지만, 래티스에서의 연산 복잡도는

으로 훨씬 효율적이다. 또한, 래티스 암호 시스템은 양자 알고리즘에 안전하다. 이러한 다양한 이유 때문에 최근 래티스 환경에서 다양한 암호 시스템이 설계되고 있으며, 이러한 작업은 매우 의미 있는 일로 여겨지고 있다.In addition, the Lattice cryptosystem is more efficient than the existing techniques. The computational complexity, such as factoring, discrete algebra, and pairing,

, But the computational complexity in Lattice is

Is much more efficient. In addition, the lattice cryptosystem is safe for quantum algorithms. Due to these various reasons, various cryptographic systems are being designed in the recent Lattice environment, and this work is considered to be very meaningful.

Related prior art is Korean Patent Laid-Open Publication No. 2012-0071884 entitled " Lattice-based ring signing method, public date: July 03, 2012 ".

An embodiment of the present invention provides a lattice-based provable password signing system and method that can demonstrate computational efficiency, high security, immunity to quantum computer analysis, etc., of a lattice-based cryptosystem by designing a provable cryptographic signature technique based on lattice .

The problems to be solved by the present invention are not limited to the above-mentioned problem (s), and another problem (s) not mentioned can be clearly understood by those skilled in the art from the following description.

A lattice-based provable cryptographic signature system according to an exemplary embodiment of the present invention uses a public parameter set including system parameters output according to a security level input to generate a public key and a private key of a verifier A key generation unit; A signer key generator for generating a public key and a secret key of the signer using the public parameter set and the public key of the verifier; A referee key generating unit for generating a public key and a secret key of the referee using the public parameter set if it is determined that the signature of the signer is a public key of the signer and a valid signature for the message; And a verifiable cryptographic signature generator for generating a verifiable cryptographic signature for the message using the signer's private key and the judge's public key.

The verifier key generation unit generates a uniform key in a range of -q / 2 to q / 2 by using a base generation algorithm that uses a security parameter n, a dimension m = O (n log q), and a positive integer q as input parameters. N * m matrix B having a random value having a distribution value as a matrix value and a basis T _B corresponding to the n * m matrix B as a public key and a secret key of the verifier, respectively.

The signer key generation unit generates a signer key using a modified trap door generation algorithm using the security parameter n, the dimension m = O (n log q), the positive integer q, and the public key B of the verifier as input parameters, An n * m matrix A having a random value having a uniform distribution in a range of 1/2 and a base T _A corresponding to the n * m matrix A as public keys and secret keys of the signer, respectively .

The general signature generation unit may generate the signature using the private key of the signer, and the generic signature generator may generate the signature using the random number r, and generates a random number s ₁ consisting of a vector of the m-dimensional, and the hash function to a combination of the random number r value and the random number s ₁ in the message as the input result of the H _2, the public key of the signer a, the signer Generates a m-dimensional vector d using a PPT (Probabilistic Polynomial Time) algorithm in which a secret key T _A and a length adjustment function? ₄ are input parameters, and outputs the random numbers r, s ₁ , Can be output as a signature value.

The lattice-based provable cryptographic signature system according to an embodiment of the present invention further includes a generic signature verification unit for determining a validity of the signature on the signer's public key and the message, If it is determined that the signature is valid for the public key of the signer and the message,

Ad = H ₂ (m? R, s ₁ ) modq

In the above equation, m represents the message, and q may represent a positive integer.

The judging panel key generating section generates a random key having a uniform distribution in a range of -q / 2 to q / 2 using a security parameter n, a dimension m = 0 (n log q), and a positive integer q as input parameters. And the base T _C corresponding to the n * m matrix C as the public key and the secret key of the referee, respectively.

The provable cryptographic signature generator generates a random number r composed of n strings, a random number x composed of an m-dimensional vector, a random number s ₂ composed of an n-dimensional vector, and inputs a value obtained by combining the random number r with the message Generating a matrix B 'by transforming the public key of the verifier by using a result value R of the hash function H _{1 that} performs a hash function H ₁ on the basis of the transpose matrix of the matrix B', the random number s _2, v to generate a proof value π for proving that the vector v includes the random number x, generating a public key and secret key of the signer, a length adjustment function δ ₁ , combining the message with the random number r a hash function to the value of the input H _2, wherein R of the pre-function R ^T, and produce a vector e of the m-dimensional using a PPT algorithm as the input parameter to the random number x, said verification of the public key and a private , Wherein R, and length adjustable function by using the base delegate algorithm for the δ ₂ as the input parameters to generate a "base matrix T _B corresponding _to" value, the matrix B, the matrix B ', the base matrix T _B', M matrix K using a matrix transformation algorithm using the public key C of the referee and the length adjustment function? ₃ as input parameters, and generates the m * m matrix K by multiplying the random number r, the vector v, the proof value? And output the matrix k value as a provable cryptographic signature value for the message.

A lattice-based provable cryptographic signature system according to an embodiment of the present invention includes: a verifiable cryptographic signature verifier for determining the validity of the verifiable cryptographic signature for the message; And a generic signature restoring unit for restoring the signature of the signer from the provable cryptographic signature using the secret key of the judge if it is determined that the verifiable cryptographic signature is a valid signature for the message.

The verifiable cryptographic signature verifier may determine that the verifiable cryptographic signature is a valid signature for the message if the following equation is satisfied.

,

,

,

,

,

,

A (e + R ^T v) = H ₂ (m? R, s ₁ ) modq

, 상기

의 역행렬, 및 행렬 K의 전치행렬과 난수 x를 곱한 값 K^Tx를 이용하여 수학식

에서 연립방정식을 이용하여 s 값을 복원하고, 상기 s 값을 이용하여 x 값을 복원(

)하며, 상기 x 값을 이용하여 σ=(r,s₁,d=e+R^Tx)을 상기 메시지 m에 대한 일반 서명 값으로 출력할 수 있다.The common signature restoration unit may include a signature restoring unit

, remind

And a value K ^T x obtained by multiplying the transpose matrix of the matrix K by the random number x,

, Restoring the s value using the simultaneous equations and restoring the x value using the s value (

), And outputs σ = (r, s ₁ , d = e + R ^T x) as a general signature value for the message m using the x value.

The lattice-based provable cryptographic signature method according to an embodiment of the present invention includes generating a public key and a secret key of a verifier using a set of public parameters including system parameters output according to a security level input ; Generating a public key and a private key of the signer using the public parameter set and the public key of the verifier; Generating a public key and a secret key of the referee using the public parameter set if it is determined that the signature of the signer is a public key of the signer and a valid signature for the message; And generating a provable cryptographic signature for the message using the signer's private key and the referee's public key.

Wherein the step of generating a provable cryptographic signature for the message comprises generating a random number r of n strings, and a random number s ₂ of a random number x, an n dimensional vector of m dimensional vectors; Generating a matrix B 'by transforming the public key of the verifier using the result R of the hash function H ₁ whose value is obtained by combining the message with the random number r; Generating a vector v using the transposed matrix of the generated matrix B ', the random number s _2, and the random number x; Generating a proof value? For proving that the vector v includes the random number x; A public key and a secret of the signer's key, the length adjustment function δ _1, the hash function to the value of a combination of the random number r to the message as an input H _2, to the pre-function R ^T, and the random number x in the above R as an input parameter Generating an m-dimensional vector e using an algorithm; Generating a base matrix T _{B '} value corresponding to the matrix B' using an algorithm that uses the public key and secret key of the verifier, the R, and the length adjustment function? ₂ as input parameters; Generating an m * m matrix K value using an algorithm with the matrix B ', the basis matrix T _B' , the referee's public key C, and the length adjustment function δ ₃ as input parameters; And outputting the random number r, the vector v, the proof value?, The vector e, and the matrix k as provable cryptographic signature values for the message.

A lattice-based provable cryptographic signature method according to an embodiment of the present invention includes: determining validity of the verifiable cryptographic signature for the message; And restoring the signer's signature from the provable cryptographic signature using the referee's private key if it is determined that the verifiable cryptographic signature is a valid signature for the message.

Determining the validity of the verifiable cryptographic signature may include determining that the verifiable cryptographic signature is a valid signature for the message if the following equation is satisfied.

,

,

,

,

,

,

A (e + R ^T v) = H ₂ (m? R, s ₁ ) modq

, 상기

의 역행렬, 및 행렬 K의 전치행렬과 난수 x를 곱한 값 K^Tx를 이용하여 수학식

에서 연립방정식을 이용하여 s 값을 복원하는 단계; 상기 s 값을 이용하여 x 값을 복원(

)하는 단계; 및 상기 x 값을 이용하여 σ=(r,s₁,d=e+R^Tx)을 상기 메시지 m에 대한 일반 서명 값으로 출력하는 단계를 포함할 수 있다.
Wherein the step of restoring the signature of the signer comprises the steps of:

, remind

And a value K ^T x obtained by multiplying the transpose matrix of the matrix K by the random number x,

Recovering the s value using a simultaneous equations; The x value is restored using the s value (

); And outputting, as a general signature value for the message m, σ = (r, s ₁ , d = e + R ^T x) using the x value.

The details of other embodiments are included in the detailed description and the accompanying drawings.

According to one embodiment of the present invention, there is an effect that the lattice-based design has advantages of arithmetic efficiency, high security, and immunity to quantum computer analysis of a lattice-based cryptosystem.

According to an embodiment of the present invention, it is possible to solve the disadvantage that the size of a public parameter (public key or the like) is ineffective and the number of times of signature generation that the signer can generate is limited.

According to an embodiment of the present invention, a new design paradigm can be presented to the related research field because it is a signature technology that designs the lattice-based design unlike the existing digital signature technology.

1 and 2 are diagrams illustrating a lattice-based provable cryptographic signature system in accordance with an embodiment of the present invention.
3 to 6 are flowcharts illustrating a lattice-based provable cryptographic signature method according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and / or features of the present invention, and how to accomplish them, will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. It should be understood, however, that the invention is not limited to the disclosed embodiments, but is capable of many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Before describing the embodiments of the present invention, the lattices that are the basis of the present invention will be described, and the algorithms used in an embodiment of the present invention will be described in detail.

- lattices

차원의 풀-랭크(full-rank) 정수 래티스를 사용하며, 이것은 유한개의 지수(finite index)를 가지는

의 이산 가산 서브그룹(discrete additive subgroup)이다. 즉, 쿼션트 그룹(quotient group)

이 유한하다. 하나의 래티스

은

개의 선형 독립 기저(basis) 벡터

의 모든 정수 선형 결합의 집합과 동일하게 정의된다.In the present invention,

Dimensional full-rank integer lattice, which has a finite index < RTI ID = 0.0 >

Lt; RTI ID = 0.0 > a < / RTI > discrete additive subgroup. That is, a quotient group

This is finite. One Lattice

silver

The linear independent basis vectors

Is defined as the set of all integer linear combinations of.

일 경우, 동일한 래티스를 생성하는 기저들은 무수히 많다.here

, There are a myriad of bases for generating the same lattice.

- Hard Lattice, SIS, LWE Problems

과

는 정수이며, 차원

은 본 발명에서 사용되는 보안 파라미터이고, 모든 다른 파라미터들은

의 함수들로 내포되었다고 가정한다. 여기서

차원 하드 래티스는 패리티 검사 행렬(parity check matrix)

에 의해 생성되며, 다음과 같이 정의된다.In the present invention, a specific form of the following integer lattice is used. here

and

Is an integer, and dimension

Is a security parameter used in the present invention, and all other parameters

Are implied as functions of. here

Dimensional hard lattice is a parity check matrix.

And is defined as follows.

에 대해서, 패리티 검사 행렬

에 의해 생성되는 코셋(coset)은 다음과 같이 정의된다.And any

, A parity check matrix

Is defined as follows: cos (cos?

과 어떤

에 대해, 균등하게 랜덤한(uniformly random)

의 열 벡터는

상의 모두를 (

확률을 제외하고) 생성할 수 있다. 따라서 본 발명에서는 균등하게 랜덤한

를 사용한다.Some fixed constants

And any

Uniformly random < RTI ID = 0.0 >

The column vector of

All of the above (

(Except for probability). Therefore, in the present invention,

Lt; / RTI >

(Short Integer Solution) 문제에 대해서 살펴보자. 이 문제는 평균적인 경우에 어려운 문제(average-case hardness problems)에 속해 있으며, 이 문제를 최악의 경우에 어려운 문제(worst-case hardness problems)로 커넥션(connection)하는 방법에 대해서도 공지된 바 있다.Next to Hard Lattice

(Short Integer Solution). This problem belongs to the average-case hardness problems, and it has been known how to connect the problem to worst-case hardness problems in the worst case.

문제는 어떤

에 대해 균등하게 랜덤한 행렬

를 입력으로 받아

와

(즉,

)을 만족하는 영이 아닌(nonzero) 정수 벡터

를 찾는 것이다.

문제에서 알고리즘

의 성공 확률은

로 나타낸다.Note that,

The problem is

A uniformly random matrix < RTI ID = 0.0 >

As input

Wow

(In other words,

) Nonzero integer vector satisfying

.

Algorithms in Problems

The probability of success is

Respectively.

와

상의 특정 분포

에 대해,

문제는 주어진 다수의

에서 벡터

를 찾는 것으로 정의된다.Also, the LWE problem is an integer

Wow

Specific distribution of

About,

The problem is that a given number of

In vector

.

가 분포

을 따르는 경우, 이 역시 SIS 문제와 마찬가지로 최악의 경우에 어려운 문제(worst-case hardness problems)로 커넥션(connection)할 수 있다. 여기서 분포

란

, 소수

에 대해

가 평균

, 표준편차

을 따르는 정규분포라고 할 때,

에 가장 가까운 정수를 나타내는 확률변수를 의미한다.In particular, in the LWE problem

Distribution

, This can also be a connection to the worst-case hardness problems as in the SIS problem. Here distribution

Ran

, Minority

About

Average

, Standard Deviation

Is a normal distribution that follows < RTI ID = 0.0 >

Is a random variable that represents the integer closest to the target.

- Gaussian distribution in Lattice

과 차원

에 대해, 가우시안 함수(Gaussian function)

는

로 정의된다. 어떤 코셋

에 대해, 코셋 상의 (중심이

인) 이산 가우시안 분포(discrete Gaussian distribution)

는 각각의

에서

에 비례하는 확률을 가진다.The Gaussian distribution in the lattices will be described based on the contents proposed in the present invention. which

And dimension

Gaussian function < RTI ID = 0.0 >

The

. Any coset

(The center of gravity)

(Discrete Gaussian distribution)

Respectively,

in

.

는 어떤

에 대한

의 기저를 말하며,

이다.Next, properties related to the Gaussian distribution in the lattices used in the present invention will be described. From here

Is any

For

, And,

to be.

통계적인 거리를 가지는)

로부터 샘플링을 할 수 있는 PPT(probabilistic polynomial time) 알고리즘 SamplePre

이 존재한다.(

With statistical distances)

A probabilistic polynomial time (PPT) algorithm SamplePre

Lt; / RTI >

- Base and trap doors

와 이러한 매트릭스로 생성되는 래티스

의 짧은 기저

를 생성하는 알고리즘

GenBasis

을 사용한다. 위의 알고리즘에서 파라미터들은

을 만족하며, 기저

의 길이는

만큼 짧다. 임의의 래티스의 짧은 기저를 찾는 문제는 결국

문제이기 때문에 알고리즘

은 임의의 래티스와 그것의 트랩도어(

문제에 대한) 즉, 짧은 기저를 생성하게 된다.In the present invention, a matrix arbitrarily selected from an even distribution

And the lattice created by this matrix

Short base of

Algorithm to generate

GenBasis

Lt; / RTI > In the above algorithm,

, And the base

The length of

. The problem of finding the short bases of arbitrary lattices is ultimately

Because of the problem,

Is an arbitrary lattice and its trap door (

That is, a short base for the problem).

- Base and trap door with special properties

알고리즘을 사용한다. 해당 알고리즘은 위의 GenBasis의 입력값에 추가적으로 매트릭스

를 입력받아 위의 알고리즘과 동일한 분포의 결과값 즉, 래티스 및 그것의 짧은 기저 쌍

을 출력한다.In the present invention, a modified trap door generation algorithm satisfying the special properties of the above-described trap door generation algorithm is proposed.

Algorithm. In addition to the input values of the above GenBasis,

And outputs the result of the same distribution as the above algorithm, that is, the lattice and its short base pair

.

와 출력 매트릭스인

사이에는

을 만족한다는 것이다. SuperSamp의 입력 파라미터는 수식

을 만족해야 한다.The important property here is that the matrix

And output matrix

Between

. The input parameters of the SuperSamp are expressed as Equation

.

- delegation method

을 정의한다.

의 열벡터의 분포는 가우시안 분포

를 따른다.In the present invention, BasisDel algorithm, which is a technique for delegating short base of lattice, is used. First, a matrix having a short length vector as a column vector

.

The distribution of the column vectors of the Gaussian distribution

.

알고리즘은 매트릭스

, 래티스

의 짧은 기저

, 위에서 정의한 짧은 매트릭스

그리고 파라미터

을 입력값으로 받아, 매트릭스

와 이로 생성되는 래티스

의 짧은 기저

을 출력한다. 특히, 생성된 기저의 길이는

만큼 증가 비율을 갖는다.BasisDel

The algorithm

, Lattice

Short base of

, The short matrix defined above

And the parameters

As an input value,

And the resulting lattice

Short base of

. In particular, the generated base length is

.

- Matrix transformation method

은 매트릭스

, 래티스

의 짧은 기저

, 그리고 파라미터

을 입력값으로 받아, 위에서 정의한 짧은 매트릭스 분포

을 따르는 매트릭스

을 출력한다.The present invention proposes the following matrix (lattice) transformation algorithm and Transform algorithm. Transform the corresponding algorithm

The matrix

, Lattice

Short base of

, And parameters

As an input value, the short matrix distribution defined above

≪ / RTI >

.

는 수식

을 만족한다. 해당 알고리즘을 설계하는 방법은

를 각각 매트릭스

의

번째 열이라고 했을 때,

SamplePre

을 이용하여 생성할 수 있다. 해당 방법을

번 사용하면 매트릭스를 완성할 수 있으며, SamplePre의 성질에 따라

임을 확인할 수 있다.
The output matrix

The equation

. How to design the algorithm

Respectively,

of

When we say the third column,

SamplePre

. ≪ / RTI > How to

Use it once to complete the matrix, depending on the nature of the SamplePre

.

Hereinafter, a lattice-based provable cryptographic signature system according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 and 2 are diagrams illustrating a lattice-based provable cryptographic signature system in accordance with an embodiment of the present invention.

1 and 2, a lattice-based provable cryptographic signature system 200 according to an embodiment of the present invention includes a verifier key generation unit 210, a signer key generation unit 220, a generic signature generation unit 230, a general signature verifying unit 240, a judging key generating unit 250, a verifiable cryptographic signature generating unit 260, a verifiable cryptographic signature verifying unit 270, a generic signature restoring unit 280, 290).

The verifier key generating unit 210 generates a public key and a secret key of the verifier 120 using a set of public parameters including system parameters output according to a security level input.

That is, the verifier key generation unit 210 generates the verifier key using the base generation algorithm GenBasis using the security parameter n, the dimension m = O (n log q), and the positive integer q as the input parameters, M matrix B having a random value having a uniform distribution in a range of 2 to 2 and a base T _B corresponding to the n * m matrix B as a public key and a secret key of the verifier 120, respectively, As shown in FIG.

The signer key generation unit 220 generates a public key and a secret key of the signer 110 using the public parameter set and the public key of the verifier 120.

That is, the signer key generation unit 220 generates a transformed trap door using a security parameter n, a dimension m = O (n log q), a positive integer q, and a public key B of the verifier 120 as input parameters An n * m matrix A in which a random value having a uniform distribution in a range of -q / 2 to 1/2 is used as a matrix value, and a base T _A corresponding to the n * m matrix A are calculated using the algorithm SuperSamp, As a public key and a secret key of the mobile terminal 110.

The generic signature generator 230 generates a signature (generic signature) using the secret key of the signer 110.

To this end, the generic signature generator 230 may generate a random number r of n strings and a random number s ₁ of m vectors. The generic signature generation unit 230 generates a public key A of the signer 110, a signer 210 of the signer 110, a result of the hash function H ₂ inputting the random number s ₁ , The m-dimensional vector d can be generated using a PPT (Probabilistic Polynomial Time) algorithm SamplePre using the secret key T _A of the random number generator 110 and the length adjustment function ₄ as an input parameter. The generic signature generator 230 may output the random numbers r, s ₁ , and the m-dimensional vector d as signature values for the message.

The general signature verifying unit 240 judges the public key of the signer 110 and the legitimacy of the signature for the message.

For this, the general signature verifying unit 240 can determine whether the following equation is satisfied, and whether the signature is valid for the public key of the signer 110 and the message according to the determination result It can be judged.

In the present embodiment, when the following equation is satisfied, the general signature verifying unit 240 can determine that the signature is valid for the public key of the signer 110 and the message.

Ad = H2 (m∥r, s ₁ ) modq

In the above equation, m represents the message, and q represents a positive integer.

If it is determined that the signature of the signer 110 is a valid signature of the signer 110 and the public key of the signer 110, the referee key generating unit 250 generates a public key of the signer 110 using the public parameter set, Key and secret key.

That is, the referee key generating unit 250 generates the referee key generating unit 250 using the base generation algorithm GenBasis using the security parameter n, the dimension m = O (n log q), and the positive integer q as the input parameters, An n * m matrix C having a random value having a uniform distribution in the range and a base T _C corresponding to the n * m matrix C as the public key and the secret key of the referee 130, respectively .

The verifiable cryptographic signature generator 260 generates a verifiable cryptographic signature for the message using the secret key of the signer 110 and the public key of the judge 130.

To this end, the provable cryptogram signature generation unit 260 can generate a random number r composed of n strings, a random number x made up of an m-dimensional vector, and a random number s ₂ made up of an n-dimensional vector. The verifiable cryptographic signature generation unit 260 converts the public key of the verifier 120 using the result R of the hash function H ₁ , which is a value obtained by combining the message with the random number r To generate matrix B '.

The provable cryptogram signature generation unit 260 generates a vector v using the transposed matrix of the matrix B ', the random number s _2, and the random number x, and the random number x is included in the vector v The proof value? Can be generated.

The proof-of-ciphering signature generator 260 includes a hash function H ₂ that receives a public key of the signer 110, a secret key, a length adjustment function δ ₁ , a value obtained by combining the random number r with the message, An m-dimensional vector e can be generated using the transpose function R ^{T of} R and the PPT algorithm SamplePre taking the random number x as an input parameter.

The verifiable cryptographic signature generation unit 260 generates the verifiable cryptographic signature using the base delegation algorithm BasisDel using the public key, the secret key, the R, and the length adjustment function? ₂ of the verifier 120 as input parameters, ≪ RTI ID = 0.0 > T _{B '} < / RTI >

The provable cryptographic signature generation unit 260 generates a proof-of-cryptogram signature using a matrix transformation algorithm Transform using the matrix B ', the base matrix T _B' , the public key C of the referee 130 and the length adjustment function δ ₃ as input parameters. Can be used to generate an m * m matrix K value.

Finally, the provable cryptographic signature generator 260 may output the random number r, the vector v, the proof value?, The vector e, and the matrix k value as a provable password signature value for the message have.

The verifiable cryptographic signature verifier 270 determines the validity of the verifiable cryptographic signature for the message.

To this end, the verifiable cryptographic signature verification unit 270 can determine whether the following equation is satisfied, and determine whether the verifiable cryptographic signature is a valid signature for the message according to the determination result have.

In the present embodiment, when the following equation is satisfied, the verifiable cryptographic signature verification unit 270 can determine that the verifiable cryptographic signature is a valid signature for the message.

,

,

,

,

,

,

A (e + R ^T v) = H ₂ (m? R, s ₁ ) modq

If the verifiable cryptographic signature is judged to be a valid signature for the message, the general signature restoring unit 280 obtains the signature (110) of the signer (110) from the verifiable cryptographic signature using the secret key of the judge (130) .

, 상기

의 역행렬

, 및 행렬 K의 전치행렬과 난수 x를 곱한 값

를 이용하여 수학식

에서 연립방정식을 이용하여 s 값을 복원할 수 있다. 그리고, 상기 일반 서명 복원부(280)는 상기 s 값을 이용하여 벡터 v에 관한 수학식 B'^Ts+xmodq로부터 x 값을 복원할 수 있다. 이에 따라, 상기 일반 서명 복원부(280)는 상기 x 값을 이용하여 σ=(r,s₁,d=e+R^Tx)을 상기 메시지 m에 대한 일반 서명 값으로 출력할 수 있다.To this end, the general signature restoring unit 280 restores the secret key of the referee 130

, remind

Inverse of

, And a value obtained by multiplying the transposed matrix of the matrix K by the random number x

Lt; RTI ID = 0.0 >

The s value can be restored by using the simultaneous equations. Then, the general signature restoring unit 280 may restore the x value from the equation B ' ^T s + x mod q related to the vector v using the s value. Accordingly, the general signature restoring unit 280 may output σ = (r, s ₁ , d = e + R ^T x) as a general signature value for the message m using the x value.

The control unit 290 may include a lattice-based provable cryptographic signature system 200 according to an embodiment of the present invention, that is, the verifier key generation unit 210, the signer key generation unit 220, The general signature verifying unit 240, the judging key generating unit 250, the verifiable cryptographic signature generating unit 260, the verifiable cryptographic signature verifying unit 270, 280 and the like can be generally controlled.

Hereinafter, the present invention will be described in more detail with reference to specific examples.

[Example]

을 입력 받아 이를 기반으로 시스템에서 사용될 다양한 파리미터 및 해시 함수를 정의한다. 먼저, 다음과 같은 성질을 만족하는 충돌내성 해쉬 함수(collision-resistant hash function)를 선택한다.1. The corresponding algorithm is a security level from the user.

And defines various parameter and hash functions to be used in the system based on the input. First, we select a collision-resistant hash function that satisfies the following properties.

,

,

는 수식

을 만족하는 상수로 정의한다.We define various public parameters to be used in the whole algorithm as follows. Below

The equation

Is defined as a constant that satisfies

,

,

을 출력한다.Then,

.

2. The algorithm that generates the private key and the public key of the signer and the verifier is calculated as follows.

GenBasis

GenBasis

SuperSamp

즉,

SuperSamp

In other words,

, 검증자의 공개키 및 비밀키 쌍은

으로 설정한다.The signer's public and private key pairs

, The verifier's public and private key pairs

.

를 이용해 메시지

에 대한 일반 서명 값을 생성하는 알고리즘으로 다음과 같은 방법으로 생성한다.3. Signer's private key

Message

This algorithm generates a generic signature value for the user.

, s₁←Z_q ^m (난수 생성)

, s _1? Z _q ^m (random number generation)

생성)d? Z ^m ? SamplePre (A, T _A ,? ₄ , H ₂ ( ^m ? r, s ₁ )

produce)

에 대한 일반 서명 값으로 출력한다.σ = (r, s ₁ , d)

As a general signature value.

: 아래의 수식을 만족하는 경우 검증자는 주어진 일반 서명 σ=(r,s₁,d)이 메시지

과 공개키

대해 정당한 서명이라고 판단한다.4.

: If the following equations are satisfied, the verifier is given a generic signature σ = (r, s ₁ , d)

And public key

It is judged to be a legitimate signature.

Ad = H ₂ (m? R, s ₁ )

5. To generate the judge's public and private key pairs, calculate as follows.

GenBasis

GenBasis

으로 설정한다.The judge's public and private key pairs

.

, 심판관의 공개키

를 이용해 메시지

에 대한 증명가능암호 서명 값을 생성하는 알고리즘으로 다음과 같은 방법으로 생성한다.6. Signer's private key

, The judge's public key

Message

The algorithm generates a cryptographic signature value that can be verified by the following method.

,

, s₂←Z_q ⁿ (난수 생성)

,

, s ₂ ← Z _q ⁿ (random number generation)

,

(

을 이용해 매트릭스

생성)

,

(

Using matrix

produce)

생성) _{^{v∈Z q m = B 'T s}} 2 + xmodq ( Vector

produce)

에 짧은 벡터(

)가 더해져 있음을 증명하는 증명값

생성

Short vector (

) Is added to the verification value

produce

SamplePre

(짧은 벡터

생성)

SamplePre

(Short vector

produce)

BasisDel

(짧은 매트릭스

값 생성)

BasisDel

(Short matrix

Value creation)

Transform

(

을 이용하여

값 생성)

Transform

(

Using

Value creation)

임을 알 수 있으며 따라서

임을 알 수 있다. 이를 통해 위의 식에서 (r,s₁,d=e+R^Tx)가 일반 서명 값이 됨을 확인할 수 있다. 마지막으로 τ=(r,v,π,e,K)을 메시지

에 대한 증명가능암호서명 값으로 출력한다.In the process above

And therefore

. We can confirm that (r, s ₁ , d = e + R ^T x) is a general signature value in the above equation. Finally, τ = (r, v, π, e, K)

And outputs it as a provable password signature value.

에 대해 정당한 서명이라고 판단한다.7. If the following equations are satisfied, the verifier will verify that the given verifiable cryptographic signature τ = (r, v, π, e, K)

It is judged to be a legitimate signature.

,

(

을 이용해 매트릭스

생성)

,

(

Using matrix

produce)

의 정당성 확인 즉,

에 짧은 벡터가 더해져 있음을 확인

In other words,

Confirm that a short vector is added to

,

,

,

,

If the signature value is properly generated, the following operation is possible.

를 이용해 주어진 증명가능암호 서명 τ=(r,v,π,e,K)에서 일반 서명을 복원하는 알고리즘이다.8. The algorithm is the referee's secret key

(R, v, π, e, K), which can be obtained by using the cryptographic signature τ = (r, v, π, e, K).

(심판관의 비밀키

를 이용)

(The referee's secret key

)

(

의 역행렬

를 이용)

(

Inverse of

)

(

를 이용)

(

)

(

에서 연립방정식을 이용하여

값 복원)

(

Using the simultaneous equations in

Value restore)

(

를 이용하여

값 복원)

(

Using

Value restore)

에 대한 일반 서명 값으로 출력한다.
(R, s ₁ , d = e + R ^T x) through the same algorithm as the above equation,

As a general signature value.

Hereinafter, a lattice-based provable cryptographic signature method according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

3 to 6 are flowcharts illustrating a lattice-based provable cryptographic signature method according to an embodiment of the present invention. May be performed by the lattice-based provable cryptographic signature system 200 of FIG.

3, in step 310, the lattice-based provable cryptographic signature system uses a set of public parameters including system parameters output according to a security level input, Key.

Next, in step 320, the lattice-based provable cryptographic signature system generates the public key and secret key of the signer using the public parameter set and the public key of the verifier.

Next, in step 330, the lattice-based provable cryptographic signature system generates a generic signature of the signer using the signer's secret key. The step 330 will be described in detail with reference to FIG.

That is, in step 410, the lattice-based provable cryptographic signature system generates a random number r of n strings and a random number s ₁ of m dimensional vectors.

Thereafter, the lattice-based provable code signing system at step 420 a hash function to the value of the random number s ₁ combines the random number r to the message as an input result of the H _2, the public key of the signer A, the The m-dimensional vector d is generated using the PPT algorithm using the secret key T _A of the signer and the length adjustment function? ₄ as input parameters.

Thereafter, in step 430, the lattice-based provable cryptographic signature system outputs the random numbers r, s ₁ , and the m-dimensional vector d as signature values for the message.

Referring again to FIG. 3, in step 340, the lattice-based provable cryptographic signature system determines the legitimacy of the signer's public key and the generic signature for the message.

If it is determined in step 350 that the generic signature is a public key of the signer and a legitimate signature for the message (direction of "Yes " 340), then the lattice- To generate the public key and secret key of the judge.

Next, in step 360, the lattice-based provable cryptographic signature system generates a verifiable cryptographic signature for the message using the signer's private key and the referee's public key. The step (360) will be described in detail with reference to FIG. 5 as follows.

That is, in step 510, the lattice-based provable cryptographic signature system generates a random number r of n strings, and a random number s ₂ of a random number x, an n-dimensional vector of m dimensions.

Thereafter, in step 520, the lattice-based provable cryptographic signature system transforms the public key of the verifier using the result R of the hash function H ₁ with the value of the message combined with the random number r as input, B '.

Thereafter, in step 530, the lattice-based provable cryptographic signature system generates a vector v using the transpose matrix of the generated matrix B ', the random number s _2, and the random number x.

Thereafter, in step 540, the lattice-based provable cryptographic signature system generates a proof value [pi] to prove that the vector v contains the random number x.

Thereafter, in step 550, the lattice-based provable cryptographic signature system includes a hash function H ₂ with a public key of the signer, a secret key, a length adjustment function δ ₁ , a value obtained by combining the random number r with the message, An m-dimensional vector e is generated using the transpose function R ^{T of} R, and an algorithm using the random number x as an input parameter.

Thereafter, in step 560, the lattice-based provable cryptographic signature system uses the public key of the verifier, the secret key, the R, and the length adjustment function [delta] ₂ as an input parameter, Thereby generating a basis matrix T _{B '} value.

Thereafter, in step 570, the lattice-based provable cryptographic signature system uses an algorithm with the matrix B ', the basis matrix T _B' , the public key C of the judge, and the length adjustment function δ ₃ as input parameters m * m matrix K value.

Thereafter, in step 580, the lattice-based provable cryptographic signature system outputs the random number r, the vector v, the proof value?, The vector e, and the matrix k value as a provable cryptographic signature value for the message do.

Referring again to FIG. 3, in step 370, the lattice-based provable cryptographic signature system determines the validity of the provable cryptographic signature for the message.

As a result of the determination, if the verifiable cryptographic signature is a valid signature for the message ("Yes" direction 370), then in step 380, the lattice-based verifiable cryptographic signature system uses the secret key of the judge And restores the signature of the signer from the provable cryptographic signature. The step 380 will be described in detail with reference to FIG.

, 상기

의 역행렬, 및 행렬 K의 전치행렬과 난수 x를 곱한 값 K^Tx를 이용하여 수학식

에서 연립방정식을 이용하여 s 값을 복원한다.That is, in step 610, the lattice-based provable cryptographic signature system determines whether the referee's secret key

, remind

And a value K ^T x obtained by multiplying the transpose matrix of the matrix K by the random number x,

And the s value is restored by using the simultaneous equations.

).Thereafter, in step 620, the lattice-based provable cryptographic signature system recovers x from the equation B ' ^T s + x mod q for the vector v using the s value (

).

Then, in step 630, the lattice-based provable cryptographic signature system outputs σ = (r, s ₁ , d = e + R ^T x) as a generic signature value for the message m using the x value .

Embodiments of the present invention include computer readable media including program instructions for performing various computer implemented operations. The computer-readable medium may include program instructions, local data files, local data structures, etc., alone or in combination. The media may be those specially designed and constructed for the present invention or may be those known to those skilled in the computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floppy disks, and ROMs, And hardware devices specifically configured to store and execute the same program instructions. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the scope of the appended claims and equivalents thereof.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, Modification is possible. Accordingly, the spirit of the present invention should be understood only in accordance with the following claims, and all equivalents or equivalent variations thereof are included in the scope of the present invention.

110: Signer
120: Verifier
130: Judge
210: a verifier key generation unit
220: signer key generation unit
230: Generic signature generator
240: General signature verification unit
250: Judge key generation unit
260: Proofable password signature generator
270: Proofable Password Signature Verification Unit
280: General signature restoring unit
290:

Claims (15)

A verifier key generating unit for generating a public key and a secret key of a verifier using a set of public parameters including system parameters output according to a security level input;
A signer key generator for generating a public key and a secret key of the signer using the public parameter set and the public key of the verifier;
A referee key generating unit for generating a public key and a secret key of the referee using the public parameter set if it is determined that the signature of the signer is a valid signature for the public key and the message of the signer; And
A verifiable cryptographic signature generator for generating a verifiable cryptographic signature for the message using the signer's private key and the judge's public key,
Based on the authentication information,
The method according to claim 1,
The verifier key generation unit
A random value having a uniform distribution in the range of -q / 2 to q / 2 is calculated by using a base generation algorithm which has a security parameter n, a dimension m = O (n log q) and a positive integer q as input parameters M matrix B as a matrix value and a basis T _B corresponding to the n * m matrix B as a public key and a secret key of the verifier, respectively.
The method according to claim 1,
The signer key generation unit
A variation trap door generation algorithm using the security parameter n, the dimension m = 0 (n log q), the positive integer q, and the public key B of the verifier as input parameters, Generating an n * m matrix A having a random value having a uniform distribution as a matrix value and a basis T _A corresponding to the n * m matrix A as a public key and a secret key of the signer, respectively
Based on the authentication information,
The method according to claim 1,
A signature generating unit for generating the signature using the secret key of the signer,
Further comprising:
The generic signature generator
a random number r made up of n strings, and a random number s ₁ made up of an m-dimensional vector, the result of the hash function H ₂ having a value obtained by combining the random number r with the message and the random number s ₁ , Dimensional vector d is generated using a PPT (Probabilistic Polynomial Time) algorithm with the public key A of the signer, the secret key T _A of the signer, and the length adjustment function? ₄ as input parameters, and the random numbers r, s ₁ , And outputting the m-dimensional vector d as a signature value for the message.
5. The method of claim 4,
A common signature verification unit for determining the signature of the signer and the legitimacy of the signature for the message;
Further comprising:
The generic signature verification unit
If it satisfies the following equation, judges that the signature is valid for the public key of the signer and the message,

Ad = H ₂ (m? R, s ₁ ) modq
Where m represents the message and q represents a positive integer. ≪ Desc / Clms Page number 20 >
The method according to claim 1,
The referee key generating unit
A random value having a uniform distribution in the range of -q / 2 to q / 2 is transformed into a matrix value using a base generation algorithm in which a security parameter n, a dimension m = O (n log q), and a positive integer q are input parameters. And a base T _C corresponding to the n * m matrix C as the public key and the secret key of the referee, respectively.
The method according to claim 1,
Wherein the provable password signature generator
a random number r made up of n strings, and a random number x made up of an m-dimensional vector, a random number s ₂ made up of an n-dimensional vector, and a result of the hash function H ₁ Generates a matrix B 'by transforming the public key of the verifier using the value R, generates a vector v using the transposed matrix of the matrix B', the random number s _2, and the random number x, generating a proof value π for proving that the random number x is included in the hash function v, inputting a public key of the signer, a secret key, a length adjustment function δ ₁ , and a value obtained by combining the message with the random number r, Dimensional vector e using the PPT algorithm with H ₂ , the transpose function R ^T of the R, and the random number x as input parameters, and generates a m-dimensional vector e using the public key, the R, and the length adjustment function δ ₂ Wherein using the base delegate algorithm as the input parameter matrix B 'base matrix T _B corresponding to _"generate the value, the matrix B', the base matrix T _{B ',} the public key of the judge C, and the length adjustment function, the vector v, the proof value?, the vector e, and the matrix k value for the message, using the matrix transformation algorithm with? ₃ as the input parameter, And outputs it as a provable cryptographic signature value.
The method according to claim 1,
A verifiable cryptographic signature verifying unit for verifying the validity of the verifiable cryptographic signature for the message; And
And restoring the signature of the signer from the provable cryptographic signature using the secret key of the judge if it is determined that the verifiable cryptographic signature is a valid signature for the message,
Further comprising: means for determining whether the lattice-based provable cryptographic signature system is valid.
9. The method of claim 8,
The provable password signature verification unit
If the following equation is satisfied, then the verifiable cryptographic signature is judged to be a valid signature for the message.

,

,

,

A (e + R ^T v) = H ₂ (m? R, s ₁ ) modq
9. The method of claim 8,
The general signature restoration unit
Of the referee's secret key

, remind

And a value K ^T x obtained by multiplying the transpose matrix of the matrix K by the random number x,

, Restoring the s value using the simultaneous equations and restoring the x value using the s value (

), And outputs σ = (r, s ₁ , d = e + R ^T x) as a general signature value for the message m using the x value.
Generating a public key and a private key of a verifier using a public parameter set including system parameters output according to an input of a security level;
Generating a public key and a private key of the signer using the public parameter set and the public key of the verifier;
Generating a public key and a secret key of the judge using the public parameter set if it is determined that the signature of the signer is a legitimate signature for the public key and the message of the signer; And
Generating a provable password signature for the message using the signer's private key and the referee's public key
Gt; A method as recited in claim 1,
12. The method of claim 11,
The step of generating a verifiable cryptographic signature for the message
generating a random number r composed of n strings, a random number x made up of an m-dimensional vector, and a random number s ₂ made up of an n-dimensional vector;
Generating a matrix B 'by transforming the public key of the verifier using the result R of the hash function H ₁ whose value is obtained by combining the message with the random number r;
Generating a vector v using the transposed matrix of the generated matrix B ', the random number s _2, and the random number x;
Generating a proof value? For proving that the vector v includes the random number x;
A public key and a secret of the signer's key, the length adjustment function δ _1, the hash function to the value of a combination of the random number r to the message as an input H _2, to the pre-function R ^T, and the random number x in the above R as an input parameter Generating an m-dimensional vector e using an algorithm;
Generating a base matrix T _{B '} value corresponding to the matrix B' using an algorithm that uses the public key and secret key of the verifier, the R, and the length adjustment function? ₂ as input parameters;
Generating an m * m matrix K value using an algorithm with the matrix B ', the basis matrix T _B' , the referee's public key C, and the length adjustment function δ ₃ as input parameters; And
Outputting the random number r, the vector v, the proof value?, The vector e, and the matrix k as provable cryptographic signature values for the message
Gt; A method as recited in claim 1,
12. The method of claim 11,
Determining a validity of the verifiable cryptographic signature for the message; And
If the verifiable cryptographic signature is determined to be a valid signature for the message, restoring the signature of the signer from the verifiable cryptographic signature using the referee's private key
Further comprising the steps of: (a) providing a first password;
14. The method of claim 13,
Wherein the step of determining the legitimacy of the verifiable encrypted signature
Determining that the provable cryptographic signature is a valid signature for the message if the following equation is satisfied:
Gt; A method as recited in claim 1,

,

,

,

A (e + R ^T v) = H ₂ (m? R, s ₁ ) modq
15. The method of claim 14,
The step of restoring the signature of the signer
Of the referee's secret key

, remind

And a value K ^T x obtained by multiplying the transpose matrix of the matrix K by the random number x,

Recovering the s value using a simultaneous equations;
The x value is restored using the s value (

); And
(R, s ₁ , d = e + R ^T x) using the x value as a general signature value for the message m
Gt; A method as recited in claim 1,

Images