CN112380579A - Lattice-based forward security certificateless digital signature scheme - Google Patents

Lattice-based forward security certificateless digital signature scheme Download PDF

Info

Publication number
CN112380579A
CN112380579A CN202011314124.9A CN202011314124A CN112380579A CN 112380579 A CN112380579 A CN 112380579A CN 202011314124 A CN202011314124 A CN 202011314124A CN 112380579 A CN112380579 A CN 112380579A
Authority
CN
China
Prior art keywords
key
user
lattice
security
signature
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202011314124.9A
Other languages
Chinese (zh)
Inventor
徐潜
章庆
贺伟
严永峰
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tianyi Electronic Commerce Co Ltd
Original Assignee
Tianyi Electronic Commerce Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tianyi Electronic Commerce Co Ltd filed Critical Tianyi Electronic Commerce Co Ltd
Priority to CN202011314124.9A priority Critical patent/CN112380579A/en
Publication of CN112380579A publication Critical patent/CN112380579A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

The invention discloses a lattice-based forward security certificateless digital signature scheme, which solves the problems of key escrow and certificate management in the traditional public key cryptosystem, but is still based on the absolute security of a user key. The invention provides a forward security certificateless lattice digital signature scheme for the first time by using a lattice delegation technology, the scheme is realized based on a standard security model, and meanwhile, the SIS problem is solved by using small integers of random lattices, so that the identity selection of external enemies and internal malicious KGC attackers is met, and the forward security of unforgeability and key leakage existing in message attack and the forward security of the message attack are adaptively selected.

Description

Lattice-based forward security certificateless digital signature scheme
Technical Field
The invention relates to the field of keys, in particular to a lattice-based forward security certificateless digital signature scheme.
Background
There are two disadvantages in the conventional public key cryptography scheme, and firstly, if the scheme is certificate-based, the management overhead of the certificate and the like will reduce the operating efficiency of the system. To eliminate the overhead of certificate management, Shamir introduced the idea of identity-based encryption in 1984, in which a public identity is used as a user public key, and a key generation center KGC generates a user private key. There are many efficient identity-based signature schemes, however, if this identity-based encryption concept is adopted, the KGC will have the ability to generate a complete user key, and once the KGC is contaminated, the user will not be secure in the whole system, which is a so-called key escrow problem.
Al-Riyami introduced for the first time in 2003 the concept of certificateless public key cryptography to solve the key escrow problem and eliminate certificate management overhead. The core idea of certificateless cryptography is as follows: the KGC distributes partial keys for the users, and the users are responsible for generating the rest keys. Because KGC can not obtain all keys of the user, potential safety hazards caused by malicious KGC are eliminated. Based on the idea of Al-Riyami, many certificateless digital signature schemes are proposed in succession. However, the security of these schemes is based on traditional number theory challenges such as large integer decomposition and discrete logarithm over finite fields. With the development of quantum computers, the security of cryptographic schemes based on traditional number theory challenges is challenged. In fact, as early as 1994, Shor proposed a quantum algorithm that solved the discrete logarithm and large integer prime decompositions in polynomial time. Moreover, the signature scheme based on bilinear pairings involves a large number of exponential operations, and the disadvantage in the aspect of time complexity restricts the application of the scheme in the mobile field.
The security of many cryptographic schemes is based on the absolute security of the user key. However, in a mobile environment, especially with the heavy use of mobile terminals such as mobile phones, due to the insecure behavior of users, once a mobile device is attacked, a user signature private key stored in the device can be easily stolen, which introduces a forward security problem regarding key leakage.
The forward security of key leakage refers to that the leakage of the user key at a certain moment does not endanger the security of the scheme at any moment in time. In the field of digital signatures, a plurality of schemes aiming at the problem of forward security of key leakage are provided at present, and the basic idea is to realize forward security by constructing an irreversible key updating algorithm. Like many certificateless cryptographic schemes, these forward secure signature schemes are still based on bilinear peer-to-peer mathematical problems, and therefore there is a strong need for a forward secure certificateless signature scheme that can satisfy post-quantum security.
Disclosure of Invention
The technical problem to be solved by the invention is to overcome the defects of the prior art and provide a lattice-based forward security certificateless digital signature scheme, 1, a certificateless digital signature scheme which can prove security under a standard model is provided based on random lattices; combining the certificateless signature with forward security based on random lattices to construct a lattice-based forward security certificateless signature scheme; on the premise of not introducing a third-party agent, the problems of key leakage and key escrow are solved simultaneously based on the random lattice; the method comprises the steps of utilizing a small integer solution SIS hypothesis to realize a certificateless digital signature scheme aiming at adaptive selection information under a standard model and selecting strong forward security and unforgeability under identity attack; two types of adversaries, namely a malicious key generation center and dishonest signature users, are considered in the lattice-based forward security certificate-free signature scheme, and the proposed signature scheme is proved to be strong and unforgeable to the two types of adversaries under a standard model.
In order to solve the technical problems, the invention provides the following technical scheme:
the invention relates to a lattice-based forward security certificateless digital signature scheme, which is composed of five polynomial time algorithms:
s1, the system establishes Setup
Setting the safety parameter as n, real number M > 0, alpha > 0, positive integer k, b, d, l, T, prime number q > 3, M > 5nlogq, upper bound
Figure BDA0002790781430000021
Take two collision-resistant Hash functions:
H1：{0，1}*→{0，1}d；H2：{0，1}*×{0，1}*→{0，1}l(ii) a Let 2Td matrices
Figure BDA0002790781430000022
Wherein Dm×mIs ZqThe small norm invertible array set of (i ∈ [0, d-1 ]), i ∈ []，j∈[1，T]，b∈{0，1}；
The key generation center KGC runs a polynomial time algorithm TrapGen (n, q, m) to obtainApproximate random matrix
Figure BDA0002790781430000031
And integer lattice Λ⊥(A) Group T ofA∈Zm×m，
Figure BDA0002790781430000032
And | | | TALess than or equal to O (nlogq); let Gaussian parameter
Figure BDA0002790781430000033
Parameter sequence [ sigma ]0，σ1，...，σTIn which σ is0＝O(logm)，σi≥m3i/2ωilog2i+1m; setting discrete normal distribution parameters
Figure BDA0002790781430000034
Setting random uniform small norm matrix
Figure BDA0002790781430000035
Common parameter
Figure BDA0002790781430000036
Master key MSK ═ TA}；
S2, Key extraction KeyExtract
Given PP, ID, hypothesis t0Taking 1 as starting time, KGC runs H H1(ID|t0)，
Figure BDA0002790781430000037
KGC is calculable from master key
Figure BDA00027907814300000318
To obtain
Figure BDA00027907814300000320
Short radicals of
Figure BDA00027907814300000319
To obtain
Figure BDA0002790781430000038
And is
Figure BDA0002790781430000039
Will be provided with
Figure BDA00027907814300000310
Sending to the user as a partial key;
user authentication
Figure BDA00027907814300000311
And is
Figure BDA00027907814300000312
Then, an approximate random matrix is obtained from TrapGen (n, q, m)
Figure BDA00027907814300000313
And integer lattice Λ⊥(B) Group T ofB∈Zm×m(ii) a Computing
Figure BDA00027907814300000314
Thereby composed of
Figure BDA00027907814300000321
To obtain
Figure BDA00027907814300000315
Base of corresponding integer lattice
Figure BDA00027907814300000316
As a secret value; private key of user
Figure BDA00027907814300000317
Deleting root matrix B and base TB；
S3, updating KeyUpdate
Let the user own the time tjCorresponding public and private keys, which the user wishes to update to tiKey of time, ti＞tj(ii) a First, KGC calculates H ═ H1(ID|ti) And
Figure BDA0002790781430000041
then obtained by the ExtBasis and SamplePre algorithms
Figure BDA0002790781430000042
As part of the private key to the user;
Figure BDA0002790781430000043
s4, signature Algorithm Sign
Inputting user public key
Figure BDA0002790781430000044
Private key
Figure BDA0002790781430000045
Message to be signed mue 0, 1*；
User randomly selects vectors
Figure BDA0002790781430000046
Wherein r is2∈Zk(ii) a Let v be H2(ID，t，μ)，
Figure BDA0002790781430000047
User computing
Figure BDA0002790781430000048
Order to
Figure BDA0002790781430000049
By probability
Figure BDA00027907814300000410
Outputting the signature (e, r);
s5, verifying algorithm Verify
Inputs (Id, (e, r), μ, t), algorithm outputs Accept if and only if:
1)
Figure BDA00027907814300000411
2) verifier calculates C at (Id, μ, t) inputID|tAnd
Figure BDA00027907814300000412
Figure BDA0002790781430000051
correctness: first, signature statistics are indistinguishable from distribution
Figure BDA0002790781430000052
Thereby to obtain
Figure BDA0002790781430000053
Overwhelming probability holds according to
Figure BDA0002790781430000054
And
Figure BDA0002790781430000055
can be substituted into Verify 2).
Compared with the prior art, the invention has the following beneficial effects:
1. a certificateless digital signature scheme which can prove safety under a standard model is provided based on a random lattice;
2, combining the certificateless signature with the forward security based on the random lattice to construct a lattice-based forward security certificateless signature scheme;
3, on the premise of not introducing a third-party agent, the problems of key leakage and key escrow are solved simultaneously based on the random lattice;
4, a certificateless digital signature scheme aiming at the adaptability selection information under a standard model and selecting the strong forward security and the unforgeability under the identity attack is realized by using the small integer solution SIS hypothesis;
and 5, two types of adversaries, namely a malicious key generation center and a dishonest signing user, are considered in the lattice-based forward security certificate-free signature scheme, and the proposed signature scheme is proved to be strong and unforgeable to the two types of adversaries under a standard model.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the principles of the invention and not to limit the invention. In the drawings:
FIG. 1 is a schematic view of the overall structure of the present invention;
fig. 2 is a schematic diagram of an embodiment of the present invention.
Detailed Description
The preferred embodiments of the present invention will be described in conjunction with the accompanying drawings, and it will be understood that they are described herein for the purpose of illustration and explanation and not limitation.
Example 1
As shown in fig. 1-2, the present invention provides a lattice-based forward secure certificateless digital signature scheme, which is composed of five polynomial time algorithms:
s1, the system establishes Setup
Setting the safety parameter as n, real number M > 0, alpha > 0, positive integer k, b, d, l, T, prime number q > 3, M > 5nlogq, upper bound
Figure BDA0002790781430000061
Take two collision-resistant Hash functions:
H1：{0，1}*→{0，1}d；H2：{0，1}*×{0，1}*→{0，1}l(ii) a Let 2Td matrices
Figure BDA0002790781430000062
Wherein Dm×mIs ZqThe small norm invertible array set of (i ∈ [0, d-1 ]), i ∈ []，j∈[1，T]，b∈{0，1}；
The key generation center KGC runs a polynomial time algorithm TrapGen (n, q, m) to obtain an approximate random matrix
Figure BDA0002790781430000063
And integer lattice Λ⊥(A) Group T ofA∈Zm×m，
Figure BDA0002790781430000064
And | | | TALess than or equal to O (nlogq); let Gaussian parameter
Figure BDA0002790781430000065
Parameter sequence [ sigma ]0，σ1，...，σTIn which σ is0＝O(logm)，σi≥m3i/2ωilog2i+ 1m; setting discrete normal distribution parameters
Figure BDA0002790781430000066
Setting random uniform small norm matrix
Figure BDA0002790781430000067
Common parameter
Figure BDA0002790781430000068
Master key MSK ═ TA}；
S2, Key extraction KeyExtract
Given PP, ID, hypothesis t0Taking 1 as starting time, KGC runs H H1(ID|t0)，
Figure BDA0002790781430000069
KGC is calculable from master key
Figure BDA00027907814300000610
To obtain
Figure BDA00027907814300000611
Short radicals of
Figure BDA00027907814300000612
To obtain
Figure BDA00027907814300000613
And is
Figure BDA0002790781430000071
Will be provided with
Figure BDA0002790781430000072
Sending to the user as a partial key;
user authentication
Figure BDA0002790781430000073
And is
Figure BDA0002790781430000074
Then, an approximate random matrix is obtained from TrapGen (n, q, m)
Figure BDA0002790781430000075
And integer lattice Λ⊥(B) Group T ofB∈Zm×m(ii) a Computing
Figure BDA0002790781430000076
Thereby composed of
Figure BDA0002790781430000077
To obtain
Figure BDA0002790781430000078
Base of corresponding integer lattice
Figure BDA0002790781430000079
As a secret value; private key of user
Figure BDA00027907814300000710
Deleting root matrix B and base TB；
S3, updating KeyUpdate
Let the user own the time tjCorresponding public and private keys, which the user wishes to update to tiKey of time, ti＞tj(ii) a First, KGC calculates H ═ H1(ID|ti) And
Figure BDA00027907814300000711
then obtained by the ExtBasis and SamplePre algorithms
Figure BDA00027907814300000712
As part of the private key to the user;
Figure BDA00027907814300000713
s4, signature Algorithm Sign
Inputting user public key
Figure BDA00027907814300000714
Private key
Figure BDA00027907814300000715
Message to be signed mue 0, 1*；
User randomly selects vectors
Figure BDA00027907814300000716
Wherein r is2∈Zk(ii) a Let v be H2(ID，t，μ)，
Figure BDA00027907814300000717
User computing
Figure BDA00027907814300000718
Order to
Figure BDA0002790781430000081
By probability
Figure BDA0002790781430000082
Outputting the signature (e, r);
s5, verifying algorithm Verify
Inputs (Id, (e, r), μ, t), algorithm outputs Accept if and only if:
1)
Figure BDA0002790781430000083
2) verifier calculates C at (Id, μ, t) inputID|tAnd
Figure BDA0002790781430000084
Figure BDA0002790781430000085
correctness: first, signature statistics are indistinguishable from distribution
Figure BDA0002790781430000086
Thereby to obtain
Figure BDA0002790781430000087
Overwhelming probability holds according to
Figure BDA0002790781430000088
And
Figure BDA0002790781430000089
can be substituted into Verify 2).
Security analysis
This section demonstrates the forward security and presence of unforgeability of the proposed solution under the standard model based on SIS assumptions. And setting a first strong enemy to act as an external attacker and a second strong enemy to act as a malicious KGC key generation center for malicious forged signatures.
The impossibility of the signature scheme proposed by the invention to the presence of strong enemies of the first kind is based on
Figure BDA00027907814300000810
It is assumed. If there is a strong enemy of the first kind
Figure BDA00027907814300000811
Can be in polynomial time
Figure BDA00027907814300000812
The signature of the scheme is forged by the probability which is not negligible, and a polynomial algorithm is adopted
Figure BDA00027907814300000813
At most
Figure BDA00027907814300000814
With a probability e ∈ (1-2) in time-ωlogm) /TQ solution
Figure BDA00027907814300000815
And (5) problems are solved.
The impossibility of the signature scheme proposed by the invention to the existence of strong enemies of the second class is based on
Figure BDA0002790781430000091
It is assumed. If there is the second kind of strong enemy hand
Figure BDA0002790781430000092
Can be in polynomial time
Figure BDA0002790781430000093
The signature of the scheme is forged by the probability which is not negligible, and a polynomial algorithm is adopted
Figure BDA0002790781430000094
At most
Figure BDA0002790781430000095
With a probability e ∈ (1-2) in time-ωlogm) /TQ solution
Figure BDA0002790781430000096
And (5) problems are solved.
In addition, the signature scheme proposed by the present invention is forward-secure under a standard model. This is because: as can be seen from the specific implementation of the signature scheme, the public key and the private key of the user are completed by the KGC and the user together. Part of the private key generated by KGC depends on the master key TAAnd H at the current time t1(ID | t) value of H1The collision resistance of (2) is known to be at unknown TAIn the case of (2), the external adversary obtains partial privacy at time t' < tKey with a key body
Figure BDA0002790781430000097
Is not less difficult than cracking
Figure BDA0002790781430000098
The difficulty of the problem. Meanwhile, the private value of the user is the base of an integer lattice corresponding to the public key of the user, and the algorithm is used for calculating the private value of the user
Figure BDA00027907814300000913
Generation, from definition 4, of privacy value at time t, even if malicious KGC or outside adversary takes
Figure BDA0002790781430000099
Nor can any time t' < t be obtained
Figure BDA00027907814300000910
At the same time, the adversary is unknown
Figure BDA00027907814300000911
In case of forgery v2Is not less difficult than cracking
Figure BDA00027907814300000912
The difficulty of the problem. Since the probability of breaking the SIS problem is negligible, the scheme satisfies the forward security of key leakage for both external adversaries and malicious KGCs.
Specifically, the patent application closest to the scheme is as follows:
the certificateless signcryption method on the lattice with post-quantum security is disclosed in the patent number: CN201910519022.1
The invention has novelty because the above patent application does not disclose the technical features of certificateless signature, forward security, standard model, small integer solution SIS, key update without third party participation, strong forward security and unforgeability, dishonest signature user, etc.
The present invention differs from the closest comparison documents in that:
comparison scheme: post-quantum secure certificateless signcryption method on lattice, patent No. CN201910519022.1
The scheme constructs a post-quantum secure lattice certificateless signcryption method by using the thought of certificateless signcryption and lattice password. Compared with the certificateless signature method under the assumption of finite field discrete logarithm and elliptic curve discrete logarithm, the certificateless signature method has the advantages that quantum computation attack can be resisted, and the computation efficiency is higher. The scheme overcomes the problems of certificate management and key escrow, has the advantages of quantum computing attack resistance, high operation efficiency and the like, and is applicable to the field of electronic signcryption.
1, the comparison scheme constructs a certificateless signature scheme based on random lattices, and the certificateless signature scheme is constructed based on the random lattices;
2, the scheme does not consider the forward security problem caused by key leakage, and is different from the scheme of the invention;
3, the scheme does not consider the problem of strong non-forgeability of the signature under a standard model, and is different from the scheme;
4, the scheme does not consider two types of adversary models, namely a malicious KGC key generation center and a dishonest signature user, and is different from the scheme.
Description of the invention
There are 3 problems with the current certificateless signature scheme: 1) the existing certificateless signature scheme based on lattice post-quantum security is only based on a random predictive model, and system security in practical application cannot be guaranteed; 2) the existing certificateless signature scheme has security certification mainly considering external adversaries and a malicious key generation center, but has insufficient resistance to threats from dishonest signature users; 3) at present, a certificateless signature scheme cannot solve the problem of key leakage on the premise of not introducing a third-party agent. Aiming at the above 3 main problems, the invention designs a forward security certificateless signature scheme capable of guaranteeing security under a first standard model by utilizing a lattice-based delegation technology and based on a random lattice theory. Specifically, aiming at dishonest users and internal malicious KGC attackers, the signature scheme provided by the invention meets the requirements of forward security and strong unforgeability; the forward security and certificateless scheme is combined based on random lattices, the problems of key leakage and key escrow are solved simultaneously under the condition of not introducing a third-party agent, and the backward quantum security is realized; the scheme of the invention is a certificateless lattice-based signature scheme which can be certified to be safe under the first standard model.
The invention is suitable for mobile environments such as mobile internet, especially for the use of mobile terminals such as mobile phones, and the like in a large amount, and once mobile equipment is attacked, a user signature key stored in the equipment is easy to steal due to unsafe behaviors of users, namely, the problem of key leakage exists. In addition, the scheme can also be applied to scenes such as a heterogeneous network space, a heterogeneous identity alliance, a block chain, cloud storage, an electronic medical record system, an internet of things and the like which relate to identity management services, the problem of identity authentication is solved by using digital signatures, the requirement on post-quantum security is met, and the efficient forward-security lattice-based certificateless signature method is realized. The forward security certificateless digital signature method provided by the invention can also provide identity authentication support supplement for other identity management, data access control or security sharing schemes.
Examples of the applications
As shown in FIG. 1, application scenario 1, digital signature and blockchain (forward security for application of the present invention)
In the block chain, the digital signature technology comprises two operation algorithms of signature and verification. The digital signature can make the file more secure, and the signature is paired with the blockchain system, so that higher-level security can be obtained. The digital signature is used for signature verification when the transaction is sent in a block chain, whether bitcoin, Ethereum, hyperhedgerfibric or other. The digital signature of the block chain is a section of anti-counterfeiting character string generated only at the roll-out side of the block chain transfer. By verifying the string of numbers, it is verified that the transaction was initiated by the transferor on the one hand, and that the transaction information has not been altered in transit on the other hand. The traditional digital signature scheme has the security depending on the security of a user key, once the key is leaked, the security of the signature cannot be ensured, and by utilizing the forward-safe certificateless lattice-based digital signature scheme provided by the invention, the problem of the forward security of the key leakage can be effectively solved, and the security and the reliability of the digital signature scheme in a block chain system are improved.
As shown in fig. 2, application scenario 2, identity authentication and secure digital signature (certificateless using the present invention) in the environment of internet of things
In the environment of the internet of things, in order to authenticate the identity of a user or a node, a node is often required to perform a secure digital signature. If the traditional signature scheme is realized based on certificates, higher requirements are put forward on the management of the certificates, and especially for a dynamic network such as the internet of things, a node certificate in a management system brings higher load; if the implementation is based on the identity-based password, the KGC is responsible for generating the key for the node, and the key escrow problem is also introduced, thereby reducing the overall security of the system.
By utilizing the certificateless password scheme, the two problems can be effectively solved, KGC is responsible for generating part of keys, and the node/user generates the other part, so that KGC is prevented from revealing keys and harming the key security of the node. The scheme of the invention provides a certificateless signature scheme suitable for the environment of the Internet of things, and the forward security of the scheme can also meet the signature security problem caused by node key leakage in the Internet of things besides the characteristic of certificateless. In addition, the scheme construction is carried out by using the random lattice and the small integer SIS, so that the signature scheme can effectively resist quantum attack, and the post-quantum security is realized.
Compared with the prior art, the invention has the following beneficial effects:
the certificateless public key cryptosystem combines the advantages of two public key cryptosystems of a certificate and an identity base: on one hand, the public key can be authenticated without a certificate, and on the other hand, the problem of key escrow does not exist. Although the certificateless public key cryptosystem has obvious advantages, the certificateless public key cryptosystem can be realized only by means of a secret Key Generation Center (KGC) in the process of identity authentication, but different from the identity public key cryptosystem, KGC only provides a part of private keys for users, and the other part of private keys are generated by data information values given by the users, so that the complete private keys are only known by the users. Thus, true non-repudiation can be achieved without the need for key escrow. Specifically, the existing scheme mainly has the problems of quantum attack resistance, secret key leakage resistance, random prediction model base and the like.
Aiming at the problems, the invention provides a certificateless signature scheme meeting the requirement of key leakage forward security based on the lattice-based delegation technology, and provides a specific structure of the scheme under a standard model. The random lattice is used for scheme construction, the rear quantum security is realized, and meanwhile, the scheme can meet the requirements of strong forward security and unforgeability under the attack of adaptive selection messages by selecting identities for two strong enemies under a standard model. The signature scheme under the standard model provided by the invention has good safety and practicability.
Finally, it should be noted that: although the present invention has been described in detail with reference to the foregoing embodiments, it will be apparent to those skilled in the art that changes may be made in the embodiments and/or equivalents thereof without departing from the spirit and scope of the invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims (1)

1. A lattice-based forward secure certificateless digital signature scheme, characterized by comprising an algorithm of five polynomial times:
s1, the system establishes Setup
Setting the safety parameter as n, real number M > 0, alpha > 0, positive integer k, b, d, l, T, prime number q > 3, M > 5nlogq, upper bound
Figure FDA0002790781420000011
Take two collision-resistant Hash functions:
H1：{0，1}*→{0，1}d；H2：{0，1}*×{0，1}*→{0，1}l(ii) a Let 2Td matrices
Figure FDA0002790781420000012
Wherein Dm×mIs ZqThe small norm invertible array set of (i ∈ [0, d-1 ]), i ∈ []，j∈[1，T]，b∈{0，1}；
The key generation center KGC runs a polynomial time algorithm TrapGen (n, q, m) to obtain an approximate random matrix
Figure FDA0002790781420000013
And integer lattice Λ⊥(A) Group T ofA∈Zm×m，
Figure FDA0002790781420000014
And | | | TALess than or equal to O (nlogq); let Gaussian parameter
Figure FDA0002790781420000015
Parameter sequence [ sigma ]0，σ1，...，σTIn which σ is0＝O(logm)，σi≥m3i/2ωilog2i+1m; setting discrete normal distribution parameters
Figure FDA0002790781420000016
Setting random uniform small norm matrix
Figure FDA0002790781420000017
i∈[1，d]；
Figure FDA0002790781420000018
i∈[1，l](ii) a Common parameter
Figure FDA0002790781420000019
Master key MSK ═ TA}；
S2, Key extraction KeyExtract
Given PP, ID, hypothesis t0Taking 1 as starting time, KGC runs H H1(ID|t0)，
Figure FDA00027907814200000110
KGC is calculable from master key
Figure FDA00027907814200000111
To obtain
Figure FDA00027907814200000112
Short radicals of
Figure FDA00027907814200000113
To obtain
Figure FDA00027907814200000114
And is
Figure FDA00027907814200000115
Will be provided with
Figure FDA00027907814200000116
Sending to the user as a partial key;
user authentication
Figure FDA0002790781420000021
And is
Figure FDA0002790781420000022
Then, an approximate random matrix is obtained from TrapGen (n, q, m)
Figure FDA0002790781420000023
And integer lattice Λ⊥(B) Group T ofB∈Zm×m(ii) a Computing
Figure FDA0002790781420000024
Thereby composed of
Figure FDA0002790781420000025
To obtain
Figure FDA0002790781420000026
Base of corresponding integer lattice
Figure FDA0002790781420000027
As a secret value; private key of user
Figure FDA0002790781420000028
Deleting root matrix B and base TB；
S3, updating KeyUpdate
Let the user own the time tjCorresponding public and private keys, which the user wishes to update to tiKey of time, ti＞tj(ii) a First, KGC calculates H ═ H1(ID|ti) And
Figure FDA0002790781420000029
then obtained by the ExtBasis and SamplePre algorithms
Figure FDA00027907814200000210
As part of the private key to the user;
Figure FDA00027907814200000211
s4, signature Algorithm Sign
Inputting user public key
Figure FDA00027907814200000212
Private key
Figure FDA00027907814200000213
Message to be signed mue 0, 1*；
User randomly selects vectors
Figure FDA00027907814200000214
Wherein r is2∈Zk(ii) a Let v be H2(ID，t，μ)，
Figure FDA00027907814200000215
User computing
Figure FDA00027907814200000216
Order to
Figure FDA0002790781420000031
By probability
Figure FDA0002790781420000032
Outputting the signature (e, r);
s5, verifying algorithm Verify
Inputs (Id, (e, r), μ, t), algorithm outputs Accept if and only if:
1)
Figure FDA0002790781420000033
2) verifier calculates C at (Id, μ, t) inputID|tAnd
Figure FDA0002790781420000034
Figure FDA0002790781420000035
correctness: first, signature statistics are indistinguishable from distribution
Figure FDA0002790781420000036
Thereby to obtain
Figure FDA0002790781420000037
Overwhelming probability holds according to
Figure FDA0002790781420000039
And
Figure FDA0002790781420000038
can be substituted into Verify 2).
CN202011314124.9A 2020-11-20 2020-11-20 Lattice-based forward security certificateless digital signature scheme Pending CN112380579A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202011314124.9A CN112380579A (en) 2020-11-20 2020-11-20 Lattice-based forward security certificateless digital signature scheme

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202011314124.9A CN112380579A (en) 2020-11-20 2020-11-20 Lattice-based forward security certificateless digital signature scheme

Publications (1)

Publication Number Publication Date
CN112380579A true CN112380579A (en) 2021-02-19

Family

ID=74587253

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202011314124.9A Pending CN112380579A (en) 2020-11-20 2020-11-20 Lattice-based forward security certificateless digital signature scheme

Country Status (1)

Country Link
CN (1) CN112380579A (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113079024A (en) * 2021-03-31 2021-07-06 西安邮电大学 Certificateless proxy signcryption method on lattice
CN113505396A (en) * 2021-07-09 2021-10-15 安徽大学 Identity-based forward security ring signature method
CN115021889A (en) * 2022-06-18 2022-09-06 曲阜师范大学 Strong forward safety signature method based on identity on lattice

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113079024A (en) * 2021-03-31 2021-07-06 西安邮电大学 Certificateless proxy signcryption method on lattice
CN113505396A (en) * 2021-07-09 2021-10-15 安徽大学 Identity-based forward security ring signature method
CN113505396B (en) * 2021-07-09 2024-02-13 安徽大学 Forward security ring signature method based on identity
CN115021889A (en) * 2022-06-18 2022-09-06 曲阜师范大学 Strong forward safety signature method based on identity on lattice

Similar Documents

Publication Publication Date Title
WO2021042685A1 (en) Transaction method, device, and system employing blockchain
JP4785851B2 (en) Digital signatures, including identity-based aggregate signatures
CN112380579A (en) Lattice-based forward security certificateless digital signature scheme
JP2023500570A (en) Digital signature generation using cold wallet
Tsai et al. TTP based high-efficient multi-key exchange protocol
CN112417489B (en) Digital signature generation method and device and server
Zhou et al. Continuous leakage-resilient certificate-based signcryption scheme and application in cloud computing
CN113132104A (en) Active and safe ECDSA (electronic signature SA) digital signature two-party generation method
Wu et al. Cryptanalysis and enhancements of efficient three‐party password‐based key exchange scheme
Shankar et al. Improved Multisignature Scheme for Authenticity of Digital Document in Digital Forensics Using Edward‐Curve Digital Signature Algorithm
Liu et al. A post quantum secure multi-party collaborative signature with deterability in the Industrial Internet of Things
Liu et al. An efficient fine-grained data access control system with a bounded service number
Ibrahim AATCT: Anonymously authenticated transmission on the cloud with traceability
Farash Cryptanalysis and improvement of ‘an improved authentication with key agreement scheme on elliptic curve cryptosystem for global mobility networks’
CN111191262B (en) Block chain wallet client private key protection method based on two-party signature
CN110740034B (en) Method and system for generating QKD network authentication key based on alliance chain
Yao et al. A unified framework of identity-based sequential aggregate signatures from 2-level HIBE schemes
CN113507366B (en) Grid-based searchable log blind signature scheme
Cao et al. Fuzzy Identity‐Based Ring Signature from Lattices
Xin et al. Identity-based quantum signature based on Bell states
CN109787773B (en) Anti-quantum computation signcryption method and system based on private key pool and Elgamal
WO2022172041A1 (en) Asymmetric cryptographic schemes
CN109787772B (en) Anti-quantum computation signcryption method and system based on symmetric key pool
Khan et al. An ECC-based mutual data access control protocol for next-generation public cloud
Mathews et al. QS-Auth: A Quantum-secure mutual authentication protocol based on PUF and Post-Quantum Signature for Heterogeneous Delay-Tolerant Networks

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
WD01 Invention patent application deemed withdrawn after publication
WD01 Invention patent application deemed withdrawn after publication

Application publication date: 20210219