CN108494561B - Aggregation electronic signature method with fixed signature length - Google Patents

Abstract

The invention discloses a method for aggregating electronic signatures with fixed signature length, which comprises the following steps: 1. generating cryptographic system parameters; 2. generating a key for the data owner; 3. generating a private key and a public key of a data owner; 4. the data owner electronically signs the message; 5. the data owner aggregates the electronic signature; 6. the data owner sends the message set and the aggregated electronic signature to the user respectively; 7. judging whether a signature verification equation is established or not, and receiving or giving up the message by the user; 8. and finishing the signature. The invention adopts the hash function to process the sensitive information, so that the information received by the user is correct. By processing the electronic signatures of all messages in an aggregation mode, the calculation of temporary variables is reduced in the signature process, the verification efficiency of the electronic signatures by users is improved, and the method can be applied to the field of cloud computing.

Description

Aggregated electronic signature method with fixed signature length

technical field

The invention belongs to the technical field of communication, and further relates to a method for aggregated electronic signature with fixed signature length in the technical field of data communication. The present invention can be used in a large data storage environment in cloud computing, the data owner electronically signs all the stored data when storing the data, and then sends all the data and the electronic signature to the user. The user who uses the data can detect whether the received data has been tampered with by the attacker during the data transmission process by verifying the electronic signature.

Background technique

Aggregated signatures can be used in cloud computing. For example, in a large-scale data storage environment, the data owner electronically signs all the stored data when storing data, and then the aggregator aggregates all the electronic signatures into one electronic signature and sends it to user. Users who use the data only need to verify the aggregated electronic signature to detect whether all the received data has been tampered with by the attacker during the data transmission process. The existing aggregated electronic signature scheme obtains two parts after electronically signing the data. During aggregation, only the first part of the electronic signature can be aggregated, and then the aggregated signature of the first part of the electronic signature and all the second parts are sent to users, thus increasing the requirements for transmission bandwidth and increasing the cost of users in electronic signature verification.

Cheng et al. proposed a certificateless aggregate electronic signature method in their paper "Cryptanalysis and improvement of acertification aggregate signature scheme." (Journal Information Sciences 295(2015) 337-346, 2014.10.19). The main steps of the method are: (1) The key generation center KGC (Key Generation Center) uses the security parameters to calculate the master key and master public key of the system. (2) KGC uses the identity information of the data owner to calculate part of the private key of the data owner, and sends part of the private key to the data owner. (3) The data owner randomly selects a key and calculates the corresponding public key. (4) When signing electronically, the data owner first selects a random number and multiplies his own public key to obtain the first part of the electronic signature; obtains the first part of the electronic signature with the random number, part of the public key, key and all the data that needs to be signed by himself. The second part of the corresponding electronic signature; (4) The data owner aggregates the first part of all electronic signatures to obtain an electronic signature, and then aggregates the electronic signature obtained by aggregation, the second part of all electronic signatures, and all the electronic signatures that need to be signed. data is sent to the user. (5) The user can detect whether the received data has been tampered with by the attacker during the data transmission process by calculating the aggregated electronic signature, the second part of all electronic signatures, and all the data that needs to be signed. The disadvantage of this method is that the method sends the second part of all electronic signatures to the user, and the user verifies the second part of all electronic signatures, which seriously affects the user's verification efficiency of the electronic signature.

Qingdao University disclosed an aggregated electronic signature method in its patent document "An Identity-Based Aggregate Signature Method with Parallel Key Isolation" (application date: 2013.08.29, application number 201310384259.6, application publication number CN103414731A). The main steps of the method are: (1) Each data owner participating in the aggregated signature method first selects a different message, signs the message to obtain a corresponding electronic signature, and sends all the electronic signatures to the aggregated party . (2) The aggregator performs aggregation operations on all electronic signatures, and sends the aggregated electronic signatures to the user. (3) The user first calculates some temporary variables, and then uses the temporary variables to verify the aggregated electronic signature to ensure that the generated aggregated signature is from the specified data owner. (4) The key of each data owner will be updated periodically. In each time period, two facilitators alternately help the data owner to update the key, and the leakage of the data owner's key in a time period will not It will affect the security of the system in other time periods. The shortcomings of this method are: first, in the process of electronic signature, because the attacker can steal some sensitive information, the attacker can tamper with the message sent by the data owner to the user, and the user will not be able to correctly receive the message sent by the data owner. Second, in the verification process of this method, multiple temporary variables need to be used to verify the aggregated electronic signature, so multiple temporary variables need to be calculated, which seriously affects the user's verification efficiency of the electronic signature.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide an aggregated electronic signature method with a fixed signature length in view of the problem that the length of the electronic signature is not fixed when the aggregated signature is performed in the prior art.

The idea of realizing the purpose of this method is as follows: when the data owner signs the message electronically, the hash function is used to process the sensitive information. Since the attacker can query the sensitive information in the sending process, the use of the hash function can To ensure that sensitive information is not stolen by attackers, so as to ensure that the sent messages are not tampered with by attackers; after the data owner electronically signs all messages, the electronic signatures of all messages are aggregated, so that the length of the electronic signature is fixed. The data owner only needs to send a fixed-length electronic signature to the user, and the user verifies the aggregated electronic signature. Therefore, the method makes the length of the electronic signature sent by the data owner to the user to be fixed, and improves the efficiency of the user's signature verification.

According to the above ideas, the specific implementation steps of the present invention include the following:

(1) Generate password system parameters:

(1a) The key generation center selects a large prime number i according to the security parameter z of the cryptographic system, wherein ^z < ²⁶⁴ and i>2z;

(1b) The key generation center constructs two additive cyclic groups G ₁ and G ₂ of order i, and randomly selects a generator in G ₁ ;

(1c) The key generation center respectively constructs the first hash function H ₁ : {0,1} ^* →G ₁ ; the second hash function H ₂ : {0,1} ^* →G ₁ ; the third hash function H 2 : {0,1}*→G 1 ; Hash function H ₃ : {0,1} ^* →Z _q ^* ; the fourth hash function H ₄ : {0,1} ^l →G ₁ ;

(1d) The key generation center randomly selects the master key of a cryptosystem in the remaining class Z _q of order q;

(1e) Use the product of the master key of the cryptosystem and the generator of the additive cyclic group as the master public key of the cryptosystem;

(1f) The data owner selects the set of messages to be electronically signed in the cryptographic system information database;

(2) Generate the key of the data owner:

(2a) The data owner submits the identity information ID to the key generation center;

(2b) using the key calculation formula, the key generation center generates the key of the data owner;

(2c) Through the secure channel, the key generation center sends the data owner's key to the data owner;

(3) Generate the private key and public key of the data owner:

(3a) The data owner selects a random number from the remaining group Z _q of order q as the private key;

(3b) The product of multiplying the private key by the generator of the additive cyclic group G ₁ is taken as the public key of the data owner;

(4) The data owner electronically signs each message to be electronically signed:

(4a) The data owner randomly selects a message in the message set;

(4b) The data owner selects a random number from the remaining group Z _q of order q;

(4c) The product of multiplying the random number by the generator of the additive cyclic group G ₁ is used as the first part of the electronic signature;

(4d) The data owner uses the second hash function constructed by the key generation center to perform a hash operation on the master public key, and uses the hash value as the second part of the electronic signature;

(4e) The data owner uses the third hash function constructed by the key generation center to perform a hash operation on the selected sensitive message, and use the hash value as the third part of the electronic signature;

(4f) Calculate the fourth part of the electronic signature by using the electronic signature calculation formula;

(4g) judge whether to select all messages in the message set, if so, execute step (5), otherwise, execute step (4a);

(5) The data owner aggregates the electronic signature:

(5a) The sum of the first parts of the electronic signatures of all messages in the message set is taken as the first electronic signature;

(5b) The sum of the fourth parts of the electronic signatures of all messages in the message set is added as the second electronic signature;

(6) The data owner sends the message set, the first electronic signature of fixed length, and the second electronic signature of fixed length to the user respectively;

(7) judge whether the verification signature equation is established, if yes, then execute step (8), otherwise, execute step (9);

(8) Step (10) is performed after the user stores the received message set;

(9) Step (10) is performed after the user abandons the received message set;

(10) End signature.

Compared with the prior art, the present invention has the following advantages:

First, because the present invention processes some sensitive information through a hash function in the process of the data owner's electronic signature, the privacy of the sensitive information in the transmission process is guaranteed, and the problem that the attacker can obtain the electronic signature in the prior art is overcome. Sensitive information, so that the attacker can tamper with the message sent by the data owner to the user, so that the present invention realizes that the attacker cannot tamper with the message sent by the data owner to the user, and ensures that the message received by the user is correct.

Second, because the present invention processes the electronic signatures of all messages by using the aggregation method, the data owner sends the aggregated electronic signatures to the user, and the user verifies the aggregated electronic signatures, which reduces the calculation of temporary variables and overcomes the problem of current The problem of low verification efficiency caused by the need to calculate temporary variables in the prior art makes the present invention improve the verification efficiency of electronic signatures.

Description of drawings

Figure 1 is a flow chart of the present invention.

Detailed ways

The present invention will be further described below in conjunction with FIG. 1 .

Step 1, generate password system parameters.

The key generation center selects a large prime number i according to the security parameter z of the cryptographic system, where z<2 ⁶⁴ and i>2 ^z .

The key generation center constructs two additive cyclic groups G ₁ and G ₂ of order i, and randomly selects a generator in G ₁ .

The key generation center respectively constructs the first hash function H ₁ : {0,1} ^* →G ₁ ; the second hash function H ₂ : {0,1} ^* →G ₁ ; the third hash function H ₃ : {0,1} ^* →Z _q ^* ; the fourth hash function H ₄ : {0,1} ^l →G ₁ .

The key generation center randomly selects the master key of a cryptosystem in the remaining class Z _q of order q.

The product of the master key of the cryptosystem and the generator of the additive cyclic group is taken as the master public key of the cryptosystem.

The data owner selects a set of messages to be electronically signed in the cryptographic system information base.

Step 2, generate the key of the data owner.

The data owner submits the identity information ID to the key generation center.

Using the following formula, the key generation center generates the key of the data owner:

t=s*H ₁ (ID)

Among them, t represents the key of the data owner, s represents the master key of the cryptographic system, * represents the multiplication operation, ID represents the identity information of the data owner, and H ₁ (·) represents the first one constructed by the key generation center. hash function.

The key generation center sends the data owner's key to the data owner through a secure channel.

Step 3, generate the private key and public key of the data owner.

The data owner randomly selects a private key among the remaining groups of order q.

The private key of the data owner is multiplied by the generator of the additive cyclic group G ₁ , and the product is used as the public key of the data owner.

Step 4, the data owner electronically signs each message to be electronically signed.

The data owner randomly selects a message in the message set.

The data owner selects a random number among the remaining groups Z _q of order q.

The product of multiplying the random number by the generator of the additive cyclic group G ₁ is used as the first part of the electronic signature.

The data owner uses the second hash function constructed by the key generation center to perform a hash operation on the master public key, and uses the hash value as the second part of the electronic signature.

The data owner uses the third hash function constructed by the key generation center to perform a hash operation on the selected sensitive message, and uses the hash value as the third part of the electronic signature.

Calculate the fourth part of the electronic signature using the following formula:

V=t+r*f+h*x*(H ₄ (Q)+W)+r*H ₄ (Q)

Among them, V represents the fourth part of the electronic signature, t represents the key of the data owner, + represents the addition operation, r represents the random number selected by the data owner, * represents the multiplication operation, and f represents the public key of the data owner , h represents the third part of the electronic signature, x represents the private key of the data owner, Q represents the random selection of a bit string of length l by the key generation center, and H ₄ (·) represents the fourth part constructed by the key generation center Hash function, W represents the second part of the electronic signature.

It is judged whether all the messages in the message set have been selected, if so, go to step 5, otherwise, go to step 4.

Step 5, the data owner aggregates the electronic signature.

Add the sum of the first parts of the electronic signatures of all messages in the message set as the first electronic signature;

Add the fourth part of the electronic signatures of all messages in the message collection as the second electronic signature;

Step 6: The data owner sends the message set, the first electronic signature with a fixed length, and the second electronic signature with a fixed length to the user, respectively.

Step 7, determine whether the following formula is established, if so, go to step 8, otherwise, go to step 9:

表示求和操作，Q_ID表示数据拥有者身份信息的哈希值，P_pub表示密码系统的主公钥，*表示相乘操作，h表示电子签名的第三部分，f表示数据拥有者的公钥，Q表示密钥生成中心随机选取的比特串，W表示电子签名的第二部分。Among them, e( ) represents the bilinear map, T represents the second electronic signature, P represents the generator of the additive cyclic group, U represents the first electronic signature, + represents the addition operation, and n represents the number of messages in the message set. number,

Represents the sum operation, Q _ID represents the hash value of the identity information of the data owner, P _pub represents the master public key of the cryptographic system, * represents the multiplication operation, h represents the third part of the electronic signature, and f represents the public key of the data owner. key, Q represents the bit string randomly selected by the key generation center, and W represents the second part of the electronic signature.

Step 8, the user executes Step 10 after storing the received message set.

Step 9: Step 10 is executed after the user abandons the received message set.

Step 10, end signing.

Claims (2)

1. the aggregation electronic signature method of a fixed signature length, is characterized in that, adopts hash function to process some sensitive information in the electronic signature process, adopts aggregation mode to fix the length of electronic signature, and the concrete steps of this method comprise as follows: (1) Generate password system parameters: (1a) The key generation center selects a large prime number i according to the security parameter z of the cryptographic system, wherein ^z < ²⁶⁴ and i>2z; (1b) The key generation center constructs two additive cyclic groups G ₁ and G ₂ of order i, and randomly selects a generator in G ₁ ; (1c) The key generation center respectively constructs the first hash function H ₁ : {0,1} ^* →G ₁ ; the second hash function H ₂ : {0,1} ^* →G ₁ ; the third hash function H 2 : {0,1}*→G 1 ; Hash function H ₃ : {0,1} ^* →Z _q ^* ; the fourth hash function H ₄ : {0,1} ^l →G ₁ ; (1d) The key generation center randomly selects the master key of a cryptosystem in the remaining class Z _q of order q; (1e) Use the product of the master key of the cryptosystem and the generator of the additive cyclic group as the master public key of the cryptosystem; (1f) The data owner selects the set of messages to be electronically signed in the cryptographic system information database; (2) Generate the key of the data owner: (2a) The data owner submits the identity information ID to the key generation center; (2b) using the key calculation formula, the key generation center generates the key of the data owner; (2c) Through the secure channel, the key generation center sends the data owner's key to the data owner; (3) Generate the private key and public key of the data owner: (3a) The data owner selects a random number from the remaining group Z _q of order q as the private key; (3b) The product of multiplying the private key by the generator of the additive cyclic group G ₁ is taken as the public key of the data owner; (4) The data owner electronically signs each message to be electronically signed: (4a) The data owner randomly selects a message in the message set; (4b) The data owner selects a random number from the remaining group Z _q of order q; (4c) The product of multiplying the random number by the generator of the additive cyclic group G ₁ is used as the first part of the electronic signature; (4d) The data owner uses the second hash function constructed by the key generation center to perform a hash operation on the master public key, and uses the hash value as the second part of the electronic signature; (4e) The data owner uses the third hash function constructed by the key generation center to perform a hash operation on the selected sensitive message, and use the hash value as the third part of the electronic signature; (4f) Calculate the fourth part of the electronic signature using the following electronic signature calculation formula: V=t+r*f+h*x*(H ₄ (Q)+W)+r*H ₄ (Q) Among them, V represents the fourth part of the electronic signature, t represents the key of the data owner, + represents the addition operation, r represents the random number selected by the data owner, * represents the multiplication operation, and f represents the public key of the data owner , h represents the third part of the electronic signature, x represents the private key of the data owner, Q represents the random selection of a bit string of length l by the key generation center, and H ₄ (·) represents the fourth part constructed by the key generation center Hash function, W represents the second part of the electronic signature; (4g) judge whether to select all messages in the message set, if so, execute step (5), otherwise, execute step (4a); (5) The data owner aggregates the electronic signature: (5a) The sum of the first parts of the electronic signatures of all messages in the message set is taken as the first electronic signature; (5b) The sum of the fourth parts of the electronic signatures of all messages in the message set is added as the second electronic signature; (6) The data owner sends the message set, the first electronic signature of fixed length, and the second electronic signature of fixed length to the user respectively; (7) judge whether the verification signature equation is established, if yes, then execute step (8), otherwise, execute step (9); The described verification signature equation is as follows:

Among them, e( ) represents the bilinear map, T represents the second electronic signature, P represents the generator of the additive cyclic group, U represents the first electronic signature, and n represents the number of messages in the message set,

Represents the sum operation, Q _ID represents the hash value of the data owner's identity information, and P _pub represents the master public key of the cryptographic system; (8) Step (10) is performed after the user stores the received message set; (9) Step (10) is performed after the user abandons the received message set; (10) End signature. 2. the aggregated electronic signature method of fixed signature length according to claim 1, is characterized in that: the key calculation formula described in the step (2b) is as follows: t=s*H ₁ (ID) Among them, t represents the key of the data owner, s represents the master key of the cryptosystem, ID represents the identity information of the data owner, and H ₁ (·) represents the first hash function constructed by the key generation center.

Images