CN119449322A

CN119449322A - A threshold signcryption method on a lattice capable of realizing equal value detection function

Info

Publication number: CN119449322A
Application number: CN202411552686.5A
Authority: CN
Inventors: 赵梦舒; 王保仓
Original assignee: Xidian University
Current assignee: Xidian University
Priority date: 2024-11-01
Filing date: 2024-11-01
Publication date: 2025-02-14
Anticipated expiration: 2044-11-01

Abstract

The invention provides a grid threshold signcryption method capable of realizing an equivalent detection function, wherein an improved threshold signcryption algorithm is adopted to generate a final ciphertext, the algorithm maintains the existing safety standard, meanwhile, the overall efficiency is improved through optimizing calculation steps and reducing the number of required participants, the algorithm also ensures that the calculation complexity is not obviously increased when equivalent detection is introduced in the signing process, in addition, the algorithm adopts an efficient signature generation and verification mechanism, signature can be quickly generated and verified under the condition of minimizing communication and calculation resource consumption, and particularly obvious time advantage is shown in a multi-participant threshold environment.

Description

Grid threshold signcryption method capable of realizing equivalent detection function

Technical Field

The invention belongs to the technical field of network security, and particularly relates to an on-grid threshold signcryption method capable of realizing an equivalent detection function.

Background

The signcryption technology is a technology for simultaneously completing data encryption and digital signature, and combines the traditional encryption and digital signature step by step. Specifically, the signing technology can realize various security assurance measures such as encryption, authentication, integrity verification, non-repudiation and the like of data by combining a digital signature and an encryption algorithm in one operation. Compared with the traditional encryption and signature stepwise operation, the advantages of the signature technology are that the computing total amount and the communication cost can be reduced, meanwhile, the integrity and the safety of the algorithm can be ensured, and information leakage and tampering are prevented.

Early threshold signcryption schemes were based on bilinear pairs, which were inefficient. The formatted security certification based on the threshold signcryption scheme, li et al propose the threshold signcryption scheme based on identity, under the random order model, prove that it meets confidentiality and existence and can not be forged, and the scheme does not need to store a public key dictionary and process a public key certificate, so that the storage cost is reduced. In addition, zheng et al propose a threshold signcryption scheme based on attributes, which uses DBDH and CBDH difficult assumptions for verification under standard model to prove its security. The certification-free threshold signcryption scheme proposed by Yu and Wang not only solves the key escrow problem and the certificate management problem, but also has high flexibility and expandability. In this scheme, the signer can generate the secret key by itself and split the secret key into a plurality of shares, and then distribute the shares to a plurality of trusted parties, and the trusted parties can finish the signer and decryption operations together under the condition of no mutual trust, so that compared with the traditional certificate signing scheme, the certification-free threshold signer scheme proposed by Yu and Wang has higher efficiency and stronger security. None of the above proposed solutions are resistant to quantum computing attacks.

Most of the threshold schemes proposed at present have the following drawbacks:

(1) Time consuming-the existing scheme may involve cumbersome steps and multiple communications in the signature generation and verification process, resulting in a longer overall process time consuming. This is a significant disadvantage for application scenarios requiring fast response;

(2) The security is insufficient, and part of the prior art can not provide enough security under certain attack scenes, especially when facing advanced cryptoanalysis and attack;

(3) The flexibility is poor, the existing scheme is possibly inflexible when adapting to different application scenes or user requirements, and the requirement change under specific conditions, such as insufficient requirement of peer-to-peer value detection, cannot be met.

Disclosure of Invention

In order to solve the problems in the prior art, the invention provides a lattice threshold signcryption method capable of realizing an equivalent detection function. The technical problems to be solved by the invention are realized by the following technical scheme:

An on-grid threshold signcryption method capable of realizing an equivalent detection function comprises the following steps:

step1, inputting security parameters, and operating an initialization algorithm to output a public parameter set;

Step 2, each user side inputs the public parameter set and generates own public and private key pair by utilizing a key generation algorithm, wherein the user side comprises a message sender and a message receiver;

step 3, each user terminal generates a secret sharing value of the user terminal by utilizing a sharing algorithm according to the public and private keys of the user terminal and the secret sharing value of other user terminals;

step 4, the message sender calculates the final ciphertext of the message to be sent by using a threshold signcryption algorithm and a secret sharing value of the message sender, and sends the final ciphertext to the message receiver;

step 5, the message receiver verifies whether the final ciphertext is valid or not by using a decryption algorithm, and decrypts the message value from the valid final ciphertext;

And 6, the message receiver performs equivalence test on the received final ciphertext by using the self tag.

The beneficial effects are that:

1. The invention provides a lattice threshold signcryption method capable of realizing an equivalent detection function, wherein an improved threshold signcryption algorithm is adopted in the method to generate a final ciphertext, and the algorithm improves the overall efficiency by optimizing calculation steps and reducing the number of required participants while keeping the existing safety standard. In addition, the algorithm also ensures that the computational complexity is not increased significantly when equivalent detection is introduced in the signing process;

2. The invention designs a decryption algorithm which adopts a high-efficiency signature generation and verification mechanism, can quickly generate and verify the signature under the condition of minimizing communication and calculation resource consumption, and particularly shows obvious time advantage in a multi-participant threshold environment.

3. The invention introduces the equivalence detection attribute in the traditional threshold signcryption scheme, and the attribute allows whether equivalence exists between different ciphertexts or not to be effectively detected in the signature verification process, thereby improving the safety and flexibility of the system.

The present invention will be described in further detail with reference to the accompanying drawings and examples.

Drawings

FIG. 1 is a flow chart of a method for on-grid threshold signcryption, which can realize the equivalent detection function.

Detailed Description

The present invention will be described in further detail with reference to specific examples, but embodiments of the present invention are not limited thereto.

Aiming at the defects of the prior art, the invention provides a lattice threshold signcryption method capable of realizing the equivalent detection function, which can improve the efficiency of encryption and signature integration, the invention also provides an equivalent detection function, and can flexibly adapt to various application requirements, and particularly provides stronger adaptability and practicability in a scene where signature verification is required according to different conditions or data. And the unidirectional OW-CCA, the confidentiality IND-CCA2 and the non-counterfeitability UF-CMA are met, and the safety of the scheme is greatly improved.

The invention mainly solves the following technical problems:

The threshold signcryption scheme provided by the invention is designed for the interaction scene between the message sender U _s and the message receiver U _r, and mainly comprises five algorithm stages, namely an initialization algorithm, a secret key generation algorithm, a secret sharing algorithm, a threshold signcryption algorithm, a decryption algorithm and the like.

As shown in FIG. 1, the invention provides a lattice threshold signcryption method capable of realizing an equivalent detection function, which comprises the following steps:

specifically, step 1 includes:

Step 11, inputting a safety parameter n, a prime number q more than or equal to 3, a positive integer m more than or equal to 5nlogq and a Gaussian parameter And p complexity

Step 12, setting a collision-resistant hash function, wherein the collision-resistant hash function comprises a one-way collision-resistant hash function H= {0,1} ^*→{0,1}^k, a collision-resistant hash function H' = {0,1} ^*→{-1,1}^p and a hash functionWhere k is the message length;

Step 13, setting a signcryption user set u= { U ₁,…,U_l }, where l is the set size, t is the threshold value, the identity of the user terminal U _i is ID _i, the identity of the message sender U _s e U is ID _s, and the message receiver The identity of (a) is ID _r, i=1.. l;

step 14, setting the common parameter params= { q, m, n, σ, ω, k, H', H ₁, l, t }.

specifically, step 2 includes:

Step 21, inputting common parameter params and selecting p+1 uniform random matrices And publishing;

Step 22, running trapdoor generation method TrapGen (q, n, m) generates a _i、T_i、A′_i and T _i 'for user terminal U _i (i=1,.,. L), and uses (a _i,A′_i,A¹,…,A^p, B) as public key of user terminal U _i and (T _i,T_i') as private key of user terminal U _i;

Step 23, running trapdoor generation algorithm TrapGen (q, n, m) generates a _r、T_r、A′_r and T' _r for message recipient U _r, and takes (a _r,A′_r,A¹,…,A^p, B) as the public key of message recipient U _r and (T _r,T′_r) as the private key of message recipient U _r.

specifically, step 3 includes:

Step 31, the user terminal U _i generates respective secret sharing values s _i and randomly selects vectors Let a _i0 =0, generate l t-1 order polynomials: f _i(ξ)＝a_i(t-1)ξ^t-1+…+a_i1ξ+a_i0;

Step 32, the user ends U _i and U _j perform interactive computation s _ij＝f_i(ID_j), where j=1.

Step 33, the user U _j outputs a secret sharing value

specifically, step 4 includes:

step 41, the message sender U _s selects a message M e {0,1} ^k from the message space, where k is the message length, calculates f=h ₁(ID_s,ID_r, M);

Step 42, the message sender U _s sends the selected message M to the user end U _i;

Step 43, the user terminal U _i runs the original sampling algorithm SAMPLEPRE (a _i,T_i,σ,f+s_i) to obtain the signature e _i of the message M and send the signature e _i to the message sender U _s;

Step 44, if the number of signatures e _i received by the message sender U _s is greater than or equal to the threshold t, the message sender U _s runs the general primitive sampling algorithm SAMPLEMAT (A _s,T_s,σ,A_i) to obtain C _i, and calculates Wherein the method comprises the steps ofD=(l!)²,

Step 45, message sender U _s selects uniform random vectorsRandomly selectCalculation ofAnd calculate to obtain partial ciphertext value

At step 46, the message sender U _s calculates b=h' (c ₁‖c₂)∈{-1,1}^p,

Step 47, selecting p uniform random matrices R _i∈{-1,1}^m×m, where i=1,..p, and defining

Step 48, message sender U _s randomly selectsThe calculation of z ₁＝R^Ty₁ is carried out,

In step 49, the message sender U _s sends the final ciphertext c= (e, C ₁,c₂,c₃,c₄) to the message receiver U _r.

specifically, step 5 includes:

In step 51, the message recipient U _r calculates b=h' (c ₁‖c₂)∈{-1,1}^p) and runs the left sampling algorithm Obtaining

Step 52, message recipient U _r calculates

Step 53, message recipient U _r compares w _i with k for each i=1If so, outputting M _i =1, otherwise outputting M _i =0 to obtain M;

Step 54, message recipient U _r runs a left sampling algorithm Obtaining

Step 55, message recipient I _r calculation

Step 56, message recipient U _r compares w _i' with k for each i=1If the two pieces are close, outputting h _i =1, otherwise outputting h _i =0 to obtain h;

The approach of the invention means that the difference value between the two is within a tolerance range, the approach of the two is determined, otherwise, the approach is not considered, the tolerance range is a preset range, and the adjustment can be carried out according to actual conditions.

In step 57, if a _s e=df, |e|β+|β and h=h (M) are all true, the message receiver U _r solves the message value M from the final ciphertext c= (e, C ₁,c₂,c₃,c₄), otherwise, outputs Σ.

Specifically, step 6 includes:

Step 61, setting a tag value of the message receiver U _r;

This step takes part of the private key of the message receiver U _r (T _r,T′_r) as the tag value, denoted T _r＝T′_r.

And step 62, each message receiver performs equivalence test on the final ciphertext received by the message receiver by using the tag value of the message receiver.

Specifically, step 62 includes:

Step 621, determining any two message receivers, one is a message receiver U _ri and the other is a message receiver U _rj, wherein the label t _ri＝T′_ri of the message receiver U _ri and a received final ciphertext C _i;

In step 622, the message receiver U _ri performs the following operations:

First calculate b _i＝H′(c_i1‖c_i2)＝(b_i1,…,b_ip), run left sampling algorithm The preparation method of the catalyst comprises the steps of obtaining g _i,Second calculateFinally for each d=1..k, w _id is compared toIf approaching, outputting h _id =1, otherwise outputting h _id =0 to obtain h _i;

In step 623, the message recipient U _rj performs the following operations:

Calculation b _j＝H′(c_i1‖c_i2)＝(b_j1,…,b_jp), running a left sampling algorithm The preparation method of the catalyst comprises the steps of obtaining g _j,Second calculateFinally for each d=1..k, w _jd is compared toIf approaching, outputting h _jd =1, otherwise outputting h _jd =0 to obtain h _j;

Step 624, if h _i＝h_j, output an output value of 1 indicating that the final ciphertext equivalent test was successful, otherwise output 0.

It is noted that the terms "first," "second," and "second" are used herein for descriptive purposes only and are not to be construed as indicating or implying a relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defining "a first" or "a second" may explicitly or implicitly include one or more such feature. In the description of the present invention, the meaning of "a plurality" is two or more, unless explicitly defined otherwise.

Although the application is described herein in connection with various embodiments, other variations to the disclosed embodiments can be understood and effected by those skilled in the art in practicing the claimed application, from a study of the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other elements or steps, and the "a" or "an" does not exclude a plurality.

The foregoing is a further detailed description of the invention in connection with the preferred embodiments, and it is not intended that the invention be limited to the specific embodiments described. It will be apparent to those skilled in the art that several simple deductions or substitutions may be made without departing from the spirit of the invention, and these should be considered to be within the scope of the invention.

Claims

1. A threshold signcryption method on a grid capable of realizing an equal value detection function, characterized in that it comprises:

Step 1: Input security parameters and run the initialization algorithm to output a set of public parameters;

Step 2, each user terminal inputs the public parameter set and generates its own public and private key pair using a key generation algorithm; the user terminal includes a message sender and a message receiver;

Step 3: Each client generates its own secret sharing value using a sharing algorithm based on its own public and private keys and the secret sharing values of other clients.

Step 4: The message sender uses the threshold signcryption algorithm and its own secret shared value to calculate the final ciphertext of the message to be sent, and sends it to the message receiver;

Step 5: The message receiver verifies whether the final ciphertext is valid using a decryption algorithm, and decrypts the message value from the valid final ciphertext;

Step 6: The message receiver uses its own tag to perform an equivalence test on the received final ciphertext.

2. The upper threshold signcryption method capable of realizing equal value detection function according to claim 1, characterized in that step 1 comprises:

Step 11: Input security parameter n, prime number q≥3, positive integer m≥5nlogq, Gaussian parameter and the complexity of p

Step 12: Set a collision-resistant hash function, which includes: a one-way collision-resistant hash function H = {0,1} ^* → {0,1} ^k , a collision-resistant hash function H′ = {0,1} ^* → {-1,1} ^p , and a hash function Where k is the message length;

Step 13: Set the signcryption user set U = {U ₁ ,…,U _l }, where l is the set size, t is the threshold value, the identity of the user end U _i is ID _i , the identity of the message sender U _s ∈ U is ID _s , and the identity of the message receiver is The identity is ID _r , i=1,…,l;

Step 14: Set common parameters params = {q, m, n, σ, ω, k, H, H′, H ₁ , l, t}.

3. The upper threshold signcryption method capable of realizing equal value detection function according to claim 2, characterized in that step 2 comprises:

Step 21, input common parameters params and select p+1 uniform random matrices A ¹ ,…,A ^p , and publish;

Step 22, run the trapdoor generation method TrapGen (q, n, m) to generate _ai , _Ti , _A'i and _Ti ' for the user terminal _Ui (i = 1, ..., l), and use ( _Ai , _A'i , ^A1 , ..., ^Ap , B) as the public key of the user terminal _Ui , and use ( _Ti , _Ti ') as the private key of the user terminal _Ui ;

Step 23, run the trapdoor generation algorithm TrapGen(q,n,m) to generate A _r , _Tr , A′ _r and _Tr ′ for the message receiver _Ur , and use (A _r , A′ _r , A ¹ ,…,A ^p , B) as the public key of the message receiver _Ur , and use ( _Tr , _Tr ′) as the private key of the message receiver _Ur .

4. The upper threshold signcryption method capable of realizing equal value detection function according to claim 3, characterized in that step 3 comprises:

Step 31: User terminal U _i generates its own secret shared value s _i and randomly selects vector Let a _i0 = 0, generate l t-1 order polynomials: _fi (ξ) = a _i(t-1) ξ ^t-1 +…+a _i1 ξ+a _i0 ;

Step 32, user terminals U _i and U _j interactively calculate s _ij = _fi (ID _j ), where j=1,…,l;

Step 33: User terminal U _j outputs the secret shared value

5. The upper threshold signcryption method capable of realizing equal value detection function according to claim 4, characterized in that step 4 comprises:

Step 41, the message sender U _s selects a message M∈{0,1} ^k from the message space, where k is the message length, and calculates g=H ₁ (ID _s ,ID _r ,M);

Step 42, the message sender U _s sends the selected message M to the user terminal U _i ;

Step 43, the user terminal U _i runs the original image sampling algorithm SamplePre(A _i ,T _i ,σ,f+s _i ) to obtain the signature e _i of the message M and sends it to the message sender U _s ;

Step 44: If the number of signatures e _i received by the message sender U _s is greater than or equal to the threshold value t, the message sender U _s runs the general original image sampling algorithm SampleMat(A _s ,T _s ,σ,A _i ) to obtain C _i , and calculates in D = (l!) ² ,

Step 45, the message sender U _s selects a uniform random vector d ₁ , Randomly select x ₁ , calculate And calculate the partial ciphertext value

Step 46: The message sender U _s calculates b = H′(c ₁ ‖c ₂ )∈{-1,1} ^p ,

Step 47, select p uniform random matrices R _i ∈ {-1, 1} ^m×m , where i = 1, …, p, and define

Step 48, the message sender U _s randomly selects y ₁ , Calculate z ₁ = R ^T y ₁ ,

Step 49: The message sender U _s sends the final ciphertext C=(e, c ₁ , c ₂ , c ₃ , c ₄ ) to the message receiver _Ur .

6. The upper threshold signcryption method capable of realizing equal value detection function according to claim 5, characterized in that step 5 comprises:

Step 51: The message receiver _Ur calculates b = H′(c ₁ ‖c ₂ )∈{-1,1} ^p and runs the left sampling algorithm get

Step 52: The message receiver _Ur calculates

Step 53: The message receiver _Ur compares w _i with Are they close? If they are close, output _Mi = 1, otherwise output _Mi = 0, and get M;

Step 54: The message receiver _Ur runs the left sampling algorithm get

Step 55, the message receiver _Ur calculates

Step 56: The message receiver _Ur compares w _i ′ and Are they close? If they are close, output h _i = 1; otherwise, output h _i = 0, and get h;

Step 57: If _Ase =Df, ‖e‖≤β and h=H(M) all hold, the message receiver _Ur deciphers the message value M from the final ciphertext C=(e, _c1 , _c2 , _c3 , _c4 ), otherwise it outputs ⊥.

7. The upper threshold signcryption method capable of realizing equal value detection function according to claim 6, characterized in that step 6 comprises:

Step 61, setting the tag value of the message receiver _Ur ;

Step 62: Each message receiver uses its own tag value to perform an equivalence test on the final ciphertext it receives.

8. The upper threshold signcryption method capable of realizing equal value detection function according to claim 7, characterized in that step 61 comprises:

A part of the private key ( _Tr , _Tr ') of the message receiver _Ur is used as the tag value, which is expressed as _tr = _Tr '.

9. The upper threshold signcryption method capable of realizing equal value detection function according to claim 8, characterized in that step 62 comprises:

Step 621, determine any two message receivers, one is the message receiver U _ri and the other is the message receiver U _rj ; wherein the label t _ri = Tr _′ _i of the message receiver U _ri and a received final ciphertext C _i ;

Step 622: The message receiver _Uri performs the following operations:

First, calculate _bi =H′( _ci1 _‖ci2 )=( _bi1 ,…, _bip ), and run the left sampling algorithm Get g _i ; where, Second, calculate Finally, for each d＝1,…,k, compare w _id and Are they close? If they are close, output hi _id = 1; otherwise, output hi _id = 0, and get _hi ;

Step 623: The message receiver _Urj performs the following operations:

Calculate b _j =H′(c _i1 ‖c _i2 )=(b _j1 ,…,b _jp ) and run the left sampling algorithm Get g _j ; where, Second, calculate Finally, for each d＝1,…,k, compare w _jd and Are they close? If they are close, output h _jd = 1; otherwise, output h _jd = 0, and get h _j ;

Step 624: if _hi = _hj , output an output value 1 indicating that the final ciphertext equality test is successful; otherwise, output 0.