Disclosure of Invention
In view of this, the present invention aims to provide a broadly specified verifier signature certification system based on SM2 digital signatures, which solves the problem that the existing UDVSP schemes based on BLS signatures and BBS signatures both involve global hash function calculation of bilinear pairwise operations, which is time-consuming and results in low efficiency of these schemes.
In order to achieve the purpose, the invention adopts the following technical scheme:
a universal designated verifier signature certification system based on SM2 digital signature comprises four units of an administrator, a signer, a signature owner and a designated verifier;
the system administrator is used for calling an initialized Setup algorithm to determine system parameters and sharing the system parameters to other units;
the signer is used for calling the KGen algorithm to generate a public key and a private key and utilizing the private key to call the Sign algorithm to calculate the signature of the message
The signature owner is used for obtaining the message m and the signature sigma from the signer, calling a verification algorithm Verf to verify the validity of the message m and the signature sigma, and calling a conversion algorithm Tran to obtain a conversion signature
And a conversion key tk;
and the designated verifier is used for executing the IVerf protocol.
Further, the initializing Setup algorithm specifically includes: inputting a safety parameter lambda by an algorithm, randomly selecting a large prime number q, and determining a nonsingular elliptic curve E: y
2=x
3+ ax + b (mod q), wherein,
all points E contain infinity points) to select a prime n-th order cyclic group
And a generator
Selecting secure hash functions
Algorithm output system parameters
Further, the KGen algorithm specifically includes: inputting system parameter pp by algorithm, and randomly selecting
And calculating P (dG), and outputting a private key sk (d) and a public key pk (P) of the user by the algorithm.
Further, the Sign algorithm specifically includes: the algorithm inputs a system parameter pp, a user private key sk ═ d and a message m. Random selection
Calculating K ═ kP ═ (x)
K,y
K)、
And r ═ e + x
K) (mod n); if r is 0 or r + k is n, k is selected again for calculation, otherwise s is (1+ d)
-1(k-rd) (mod n). If s ≠ 0, the output message m and the signature σ are (r, s).
Further, the Verify algorithm specifically includes: inputting system parameter pp, user public key pk ═ P, message m and signature σ to be verified ═ r, s, if
0 is output, otherwise t ═ r + s (mod n) is calculated. If t is 0, then 0 is output, otherwise the calculation is performed
K′=sG+tP=(x′
K,y′
K) And r ' (e ' + x) '
K) (mod n); if r ═ r, then output 1 indicates that the signature is valid, otherwise output 0 indicates invalid.
Further, the Tran algorithm specifically includes: inputting system parameters pp, public key pk ═ P, message m and signature σ ═ r, s by algorithm, and randomly selecting
And calculate
Outputting a transition signature
And the conversion key tk ═ (a, b).
Further, the IVerf protocol, specifically, the signature owner P and the designated verifier V perform the following interaction:
1) p first calculates K ═ sG + (r + s) P, then randomly selects
Calculating D ═ R + α G + α P + β P; finally, P sends D to V;
2) v random selection
And returns c to P;
3) p calculation of ZK=R-cK,za=α-c·a(mod n),zbβ -c.b (mod n), and (Z)K,za,zb) Sending the data to V;
4) v calculation
If D' ═ D, output 1 indicates acceptance, otherwise output 0.
Compared with the prior art, the invention has the following beneficial effects:
the invention not only can satisfy two types of security of self-adaptive selection attack non-forgery-inhibited (UF-CMA) and anti-spoofing attack (R-IM), but also avoids high-time-consuming bilinear pairing operation and global hash function calculation, effectively improves the security, reduces the operation time and improves the efficiency.
Detailed Description
The invention is further explained below with reference to the drawings and the embodiments.
Referring to fig. 1, the present invention provides a signature certification system for a universally specified verifier based on SM2 digital signature, which includes four units, namely an administrator, a signer, a signature owner, and a specified verifier;
the system administrator is used for calling an initialized Setup algorithm to determine system parameters and sharing the system parameters to other units;
the signer is used for calling the KGen algorithm to generate a public key and a private key and utilizing the private key to call the Sign algorithm to calculate the signature of the message
The signature owner is used for obtaining the message m and the signature sigma from the signer, calling a verification algorithm Verf to verify the validity of the message m and the signature sigma, and calling a conversion algorithm Tran to obtain a conversion signature
And a conversion key tk;
and the designated verifier is used for executing the IVerf protocol.
The invention is designed based on SM2 digital signature, so the same system parameters are used as SM2, and the specific parameter notation is defined as follows:
q: a large prime number;
Fq: a finite field containing q elements;
a,b:Fqthe elements in (1), which define FqAn elliptic curve E above;
E(Fq):Fqa set of all rational points of the upper elliptic curve E (including the infinity point O);
#E(Fq):E(Fq) The number of points, called elliptic curve E (F)q) The order of (1);
o: a special point on the elliptic curve, called the infinity point or the zero point;
a cyclic group including all points of the elliptic curve E and an infinite point;
g: group of
A generator of (2);
n: order of generator G (n is # E (F)q) Prime factor of (2)
A secure cryptographic hash function;
a set of elements of the set {1, 2.. multidata, n } that are co-prime with the element n;
in the embodiment, the Setup algorithm is initialized, specifically: inputting a safety parameter lambda by the algorithm, randomly selecting a large prime number q, and determining a nonsingular elliptic curve E: y is
2=x
3+ ax + b (mod q), wherein,
all points E contain infinity points) to select a prime n-th order cyclic group
And a generator
Selecting secure hash functions
Algorithm output system parameters
In the embodiment, the KGen algorithm specifically includes: inputting system parameter pp by algorithm, and randomly selecting
And calculating P (dG), and outputting a private key sk (d) and a public key pk (P) of the user by the algorithm.
In the embodiment, the Sign algorithm specifically includes: the algorithm inputs a system parameter pp, a user private key sk ═ d and a message m. Random selection
Calculating K ═ kP ═ (x)
K,y
K)、
And r ═ e + x
K) (mod n); if r is 0 or r + k is n, k is selected again for calculation, otherwise s is (1+ d)
-1(k-rd) (mod n). If s ≠ 0, the output message m and the signature σ are (r, s).
In the embodiment, the Verify algorithm specifically includes: inputting system parameter pp, user public key pk ═ P, message m and signature σ to be verified ═ r, s, if
Then 0 is output, otherwise t is calculatedR + s (mod n). If t is 0, then 0 is output, otherwise the calculation is performed
K′=sG+tP=(x′
K,y′
K) And r ' (e ' + x) '
K) (mod n); if r ═ r, then output 1 indicates that the signature is valid, otherwise output 0 indicates invalid.
In the embodiment, the Tran algorithm specifically includes: inputting system parameters pp, public key pk ═ P, message m and signature σ ═ r, s by algorithm, and randomly selecting
And calculate
Outputting a transition signature
And the conversion key tk ═ (a, b).
In an embodiment, the IVerf protocol, specifically, the signature owner P performs the following interactions with the intended verifier V:
1) p first calculates K ═ sG + (r + s) P, then randomly selects
Calculating D ═ R + α G + α P + β P; finally, P sends D to V;
2) v random selection
And returns c to P;
3) p calculation of ZK=R-cK,za=α-c·a(mod n),zbβ -c.b (mod n), and (Z)K,za,zb) Sending the data to V;
4) v calculation
If D' ═ D, output 1 indicates acceptance, otherwise output 0.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The foregoing is directed to preferred embodiments of the present invention, other and further embodiments of the invention may be devised without departing from the basic scope thereof, and the scope thereof is determined by the claims that follow. However, any simple modification, equivalent change and modification of the above embodiments according to the technical essence of the present invention are within the protection scope of the technical solution of the present invention.