CN106789019B - A certificateless partial blind signature method and device - Google Patents

Abstract

The invention is applicable to the technical field of information security, and provides a certificateless partial blind signature method, which includes establishing a public system parameter params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub }; the signer extracts its private key as

Extract the public key as

Signers randomly selected

And calculate z=H ₀ (c) and R=rP, and send R to the signature requester; after the signature requester receives R, it randomly selects the blinding factor

And calculate z=H ₀ (c), R′=αR,

h'=H ₂ (m,z,y),h=α ^-1 (β-h'), and send h to the signer; after the signer receives h, calculate And send S to the signature requester; the signature requester performs deblinding work, calculates S'=αS, and obtains the signature of message m and negotiated message c as σ=(y, h', S'); the verifier performs signature verification. The invention effectively solves the security problem caused by negotiating public information tampering in the certificateless partial blind signature.

Description

A certificateless partial blind signature method and device

technical field

The invention belongs to the technical field of information security, and in particular relates to a method and device for partial blind signature without a certificate.

Background technique

Blind signature is a type of signature completed by the signer without knowing the content of the message requested by the signature requester. This feature is called blindness. Blind signature not only has the properties of content integrity, non-repudiation of transaction and authenticity of identities of both parties, but also can protect user privacy by using blindness. In blind signatures, the signer knows nothing about the signed message, which can easily cause the signature to be illegally used by malicious requesters. Subsequently, the concept of partial blind signature was proposed, which divides the message into a blind part and a public part. Therefore, the partial blind signature can ensure user privacy while partially controlling the content of the signature.

In the identity-based cryptosystem, the Key Generation Center (KGC) knows the private keys of all users and can forge any user's signature. This problem is called the key escrow problem. To solve this problem, Al-Riyam and Paterson proposed the concept of Certificateless Public Key Cryptography (CL-PKC) in 2003. For details, please refer to the document: Al-Riyami S S, Paterson KG. Certificateless Public Key Cryptography [J]. Lecture Notes in Computer Science, 2003, 2894(2): 452-473. Hereinafter referred to as document 1. In CL-PKC, the key generation center generates part of the private key for the user, and the user's private key is composed of part of the private key and a secret value randomly selected by himself, thus solving the problem of key escrow. The combination of certificateless public key cryptography and blind signature is called certificateless blind signature (CL-BS). The use of CL-BS in e-commerce can not only protect the privacy of users, but also avoid PKI. Certificate management and key escrow issues in ID-PKC. In order to better apply to the electronic cash system, the combination of certificateless public key cryptography and partial blind signature is called certificateless partial blind signature (CL-PBS).

There are existing literatures on certificateless partial blind signatures, such as:

Cheng L,Wen Q.Cryptanalysis and improvement of a certificateless partially blind signature[J].IET Information Security,2015,9(6):380-386. Hereinafter referred to as document 2.

Zhang L, Zhang F, Qin B, et al. Corrigendum: "Provably-secure electroniccash based on certificateless partially-blind signatures" [J]. Electronic Commerce Research & applications, 2011, 10(1): 545-552. 3.

Reference 2 points out that the CL-PBS scheme proposed in Reference 3 cannot resist malicious users replacing the signer's public key and proposes an improved scheme. However, through the analysis of the improved scheme, it is found that it cannot prevent malicious users from tampering and negotiating public information attacks.

SUMMARY OF THE INVENTION

The embodiment of the present invention provides a certificateless partial blind signature method, aiming to solve the problem of low security of negotiated public information in the existing certificateless partial blind signature.

The embodiment of the present invention is implemented in this way, a certificateless partial blind signature method includes:

H₁:{0,1}^*→G₁，KGC选取s为主密钥，P_pub＝sP为公钥；Establish a public system parameter params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub }; where l is a security parameter and satisfies the prime number q>2 ^l , {G ₁ ,+} is a cyclic additive group of order q, P is any generator in the group G ₁ ; {G ₂ ,·} is a cyclic multiplication group of order q, g is a generator; bilinear pair mapping e : G ₁ ×G ₁ →G ₂ , g=e(P,P)∈G ₂ ; hash function:

H ₁ :{0,1} ^* →G ₁ , KGC selects s as the primary key, and P _pub = sP as the public key;

公钥为 The signer extracts its private key as

The public key is

并计算z＝H₀(c)和R＝rP，并把R发送给签名请求者；Signers randomly selected

And calculate z=H ₀ (c) and R=rP, and send R to the signature requester;

并计算z＝H₀(c)、

h′＝H₂(m,z,y),h＝α^-1(β-h′)，并把h发送给签名者；After the signature requester receives R, the blinding factor is randomly selected

and calculate z=H ₀ (c),

h'=H ₂ (m,z,y),h=α ^-1 (β-h'), and send h to the signer;

并把S发送给签名请求者；After the signer receives h, calculate

And send S to the signature requester;

The signature requester performs deblinding work, calculates S′=αS, and obtains the signatures of message m and negotiated message c as σ=(y,h′,S′);

The verifier performs signature verification.

Preferably, the specific steps for establishing a public system parameter params={G ₁ ,G ₂ ,P,l,q,e,H ₁ ,H ₂ ,H ₃ ,P _pub } are:

According to the security requirements, determine the size of the safety factor l and the prime number q, and use the elliptic curve to construct the cyclic addition group {G ₁ ,+} and the cyclic multiplication group {G ₂ that satisfy the bilinear mapping e: G ₁ ×G ₁ →G ₂ , · };

H₁:{0,1}^*→G₁，

Choose a collision-free hash function

H ₁ :{0,1} ^* →G ₁ ,

Randomly select an integer s from the integer multiplication group of mod q as the master key of the private key generation center KGC, and calculate P _pub =sP as its corresponding public key;

Public system parameters {G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub }, and save s as the master key value.

公钥为

的具体步骤为：Preferably, the signer extracts its private key as

The public key is

The specific steps are:

并把部分私钥

发送给签名者；Input system parameters params, signer's identity ID _B , KGC calculation

and put part of the private key

sent to the signer;

作为其秘密值；According to the system parameters params and the identity ID _B of the signer, the signer randomly selects

as its secret value;

和秘密值得到签名者的私钥为

According to the system parameters params, the signer's identity ID _B , part of the private key

and secret value Get the signer's private key as

得到签名者的公钥

According to system parameters params, signer's identity ID _B and secret value

Get the signer's public key

Preferably, the specific steps for the verifier to perform signature verification include:

The verifier receives the signer's message-signature pair (m,c,σ=(y,h',S'));

Calculate z=H ₀ (c),

Verify that the equation h'=H ₂ (m,z,y') holds, and if so, the verifier believes that (m,c,σ=(y,h',S')) is valid by the signer blind signature;

Otherwise invalid.

The embodiment of the present invention also provides a certificateless partial blind signature device, including:

a system parameter establishment unit, used to establish public system parameters params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub };

The extraction unit is used for the signer to extract the private key and the public key;

并计算z＝H₀(c)和R＝rP，并把R发送给签名请求者；Commitment unit, for random selection

And calculate z=H ₀ (c) and R=rP, and send R to the signature requester;

并计算z＝H₀(c)、

h′＝H₂(m,z,y),h＝α^-1(β-h′)，并把h发送给签名者；The blinding unit is used to randomly select the blinding factor after receiving R

and calculate z=H ₀ (c),

h'=H ₂ (m,z,y),h=α ^-1 (β-h'), and send h to the signer;

并把S发送给签名请求者；Partially blind signature unit, used to calculate after receiving h

And send S to the signature requester;

The deblinding unit is used for deblinding work, calculates S′=αS, and obtains the signature of message m and negotiation message c as σ=(y,h′,S′);

Verification unit for signature verification.

Preferably, the system parameter establishment unit includes:

The building blocks are used to determine the size of the safety factor l and the prime number q, and use the elliptic curve to construct the cyclic addition group {G ₁ ,+} and the cyclic multiplication group {G that satisfy the bilinear mapping e: G ₁ ×G ₁ →G _{2 2} , · };

H₁:{0,1}^*→G₁，

Function selection module for selecting collision-free hash functions

H ₁ :{0,1} ^* →G ₁ ,

The key module is used to randomly select an integer s from the integer multiplication group of mod q as the master key of the private key generation center KGC, and calculate P _pub =sP as its corresponding public key, and disclose the system parameters {G ₁ ,G ₂ ,P,e,g,H ₀ ,H ₁ ,H ₂ ,P _pub }, and save s as the master key value.

Preferably, the extraction unit includes:

并把部分私钥

发送给签名者；Part of the private key generation module, which is used to calculate according to the system parameters params, the signer's identity ID _B , and KGC

and put part of the private key

sent to the signer;

作为其秘密值；The secret value generation module is used to randomly select according to the system parameters params and the identity ID _B of the signer

as its secret value;

和秘密值

得到签名者的私钥为

The private key module is used for according to the system parameters params, the signer's identity ID _B , part of the private key

and secret value

Get the signer's private key as

得到签名者的公钥

The public key module, which is used according to the system parameters params, the signer's identity ID _B and the secret value

Get the signer's public key

Preferably, the verification unit includes:

The receiving module is used to receive the message-signature pair (m,c,σ=(y,h',S')) sent by the signature requester;

a calculation module for calculating z=H ₀ (c),

The verification module is used to verify whether the equation h'=H ₂ (m,z,y') holds, and if so, the verifier believes that (m,c,σ=(y,h',S')) is determined by The signer makes a valid blind signature, otherwise it is invalid.

中，其中z＝H₀(c)，通过证明签名方案的正确性时，签名者插入协商信息z＝H₀(c)不仅对应到签名请求者C进行盲化签名插入的协商信息同时也与验证等式中用到的插入协商协商信息

相对应，因此，本发明的方案在协商信息篡改攻击下是安全的，有效解决了无证书部分盲签名中因协商公共信息篡改而带来的安全性问题。The technical solution of the present invention is due to the fact that the signer inserts the negotiation information into the calculation

, where z=H ₀ (c), by proving the correctness of the signature scheme, the signer inserts negotiation information z=H ₀ (c) not only corresponds to the negotiation information that the signature requester C performs blind signature insertion It also negotiates with the insertion negotiation information used in the verification equation.

Correspondingly, therefore, the solution of the present invention is safe under negotiation information tampering attacks, and effectively solves the security problem caused by negotiating public information tampering in a certificateless partial blind signature.

Description of drawings

1 is a schematic flowchart of a method for partial blind signature without a certificate provided by an embodiment of the present invention;

2 is a schematic flowchart of a method for partially blind signature without a certificate provided by an embodiment of the present invention;

3 is a structural block diagram of a certificateless partial blind signature device provided by an embodiment of the present invention;

Fig. 4 is the structural block diagram of the system parameter establishment unit of the present invention;

Fig. 5 is the structural block diagram of the extraction unit of the present invention;

FIG. 6 is a structural block diagram of the verification unit of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

In order to understand the technical solution of the present invention more effectively, we briefly describe the process of partial blind signature in the above-mentioned document 2:

First establish a public system parameter params={G ₁ , G ₂ , P, l, q, e, H ₀ , H ₁ , H ₂ , P _pub }.

KGC选取s为主密钥，P_pub＝sP为公钥，系统参数params＝{G₁,G₂,P,l,q,e,H₀,H₁,H₂,P_pub}。Given a security parameter l, and the prime number q>2 ^l , {G ₁ ,+} is a cyclic addition group of order q, P is an arbitrary generator in the group G ₁ ; {G ₂ ,·} is a cyclic addition group of order q The cyclic multiplicative group of , g is the generator; bilinear pair mapping e:G ₁ ×G ₁ →G ₂ , g=e(P,P)∈G ₂ ; hash function:

KGC selects s as the master key, P _pub =sP as the public key, and system parameters params={G ₁ ,G ₂ ,P,l,q,e,H ₀ ,H ₁ ,H ₂ ,P _pub }.

Then perform the key extraction algorithm:

并把部分私钥发送给签名者。Part of the private key generation algorithm: input system parameters params, signer's identity ID _B , KGC calculation

and put part of the private key Sent to signer.

作为其秘密值。Set the secret value algorithm: enter the system parameters params and the signer's identity ID _B , the signer randomly selects

as its secret value.

和秘密值

输出签名者的私钥为

Set private key algorithm: algorithm input system parameters, signer's identity ID _B , part of the private key

and secret value

The private key of the output signer is

Set up the public key algorithm: the algorithm inputs the system parameters, the signer's identity ID _B and the secret value Enter the signer's public key

Then perform a partial blind signature generation algorithm:

和公钥

与签名请求者进行消息m和公共协商信息c签名。具体过程如下：Suppose m is the information requested by the signature requester, c is the public information negotiated between the signer and the signature requester, and the signer uses its private key

and public key

Sign the message m and the public negotiation information c with the signature requester. The specific process is as follows:

并计算z＝H₀(c)和R＝rzP,并将R发送签名请求者。a) Commitment. Signers randomly selected

And calculate z = H ₀ (c) and R = rzP, and send R to the signature requester.

h＝γ^-1(β-h′)，并把h发送给签名者。b) Blinding. After the signature requester receives R, the blinding factor is randomly selected and calculate z=H ₀ (c), R′=γR,

h=γ ^-1 (β-h'), and send h to the signer.

并把S发送签名请求者。c) Partially blind signature. After receiving h, the signer only needs to calculate

And send S to the signature requester.

d) Deblindness. The signature requester computes S'=γS+ _αPpub .

After this series of interactions, the signature requester obtains the signature for message m and negotiation information c as σ=(R', h', S').

Finally, the signature verification algorithm is performed:

最后验证等式

是否成立。如果成立，则认为消息-签名对(m,c,σ＝(R′,h′,S′))是签名者合法的签名。否则无效。After the verifier receives the signature of the message m and the negotiation information c from the signer as σ=(R', h', S'), it first calculates z=H ₀ (c),

Finally verify the equation

is established. If so, the message-signature pair (m,c,σ=(R',h',S')) is considered to be a legitimate signature of the signer. Otherwise invalid.

The above solutions will generate security attacks. The specific attack analysis is as follows:

与签名请求者进行消息m和公共协商信息c签名，签名请求者将协商信息c篡改为c′：Because the scheme is to tamper with the negotiation information c into c' attack, the signer uses his private key and public key

Sign the message m and the public negotiation information c with the signature requester, and the signature requester tampered with the negotiation information c to c':

并计算z＝H₀(c)和R＝rzP，并将R发送签名请求者。a) Commitment. Signers randomly selected

And compute z=H ₀ (c) and R=rzP, and send R to the signature requester.

h＝γ^-1(β-h′)和h″＝zz′^-1h，并把h″发送给签名者。b) Blinding. After the signature requester receives R, the blinding factor is randomly selected Calculate z=H ₀ (c), z'=H ₀ (c'), R'=γR, R″=z ^-1 z'R',

h=γ ^-1 (β-h') and h"=zz' ^-1 h, and h" is sent to the signer.

c) Partially blind signature. After receiving h", the signer only needs to calculate And send S to the signature requester.

d) Deblindness. The signature requester computes S'=z ^-1 z'S, S"=γS'+ _αPpub .

After this series of interactions, the signature requester obtains the signature of message m and negotiation information c' as σ=(R", h', S").

z′＝H₀(c′)验证等式

是否成立。如果成立，则为有效的签名，即篡改协商信息c′成功。在这个验证过程中，其实只需要验证等式

是否成立；The signature requester's signature on message m and negotiation information c' is σ=(R", h', S"), which needs to be calculated

z'=H ₀ (c') to verify the equation

is established. If it is established, it is a valid signature, that is, the negotiation information c' is tampered with successfully. In this verification process, it is only necessary to verify the equation

whether it is established;

That is, without the consent of the signer, the signature formed by the signature requester after tampering with the public information can also be verified by the verification equation, so the verifier believes that σ=(R″, h′, S″) is the signer’s right to A valid signature for message m and negotiation message c'.

1 and 2, an embodiment of the present invention provides a certificateless partial blind signature method, including the following steps:

Step S100, establish a public system parameter params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub };

KGC选取s为主密钥，P_pub＝sP为公钥；Among them, l is a security parameter, and the prime number q>2 ^l is satisfied, {G ₁ ,+} is a cyclic addition group of order q, P is an arbitrary generator in the group G ₁ ; {G ₂ ,·} is the order of Circular multiplicative group of q, g is the generator; bilinear pair mapping e:G ₁ ×G ₁ →G ₂ , g=e(P,P)∈G ₂ ; hash function: H ₁ :{0,1} ^* →G ₁ ,

KGC selects s as the primary key, and P _pub = sP as the public key;

公钥为

Step S200, the signer extracts its private key as

The public key is

并计算z＝H₀(c)和R＝rP，并把R发送给签名请求者；Step S300, the signer randomly selects

And calculate z=H ₀ (c) and R=rP, and send R to the signature requester;

并计算z＝H₀(c)，R′＝αR,

h′＝H₂(m,z,y),h＝α^-1(β-h′)，并把h发送给签名者；Step S400, the signature requester randomly selects a blinding factor after receiving R

And calculate z=H ₀ (c), R′=αR,

h'=H ₂ (m,z,y),h=α ^-1 (β-h'), and send h to the signer;

Step S500, after the signer receives h, calculate And send S to the signature requester;

Step S600, the signature requester performs deblinding work, calculates S′=αS, and obtains the signatures of message m and negotiation message c as σ=(y,h′,S′);

In step S700, the verifier performs signature verification.

Preferably, in the step S100, the specific steps of establishing a public system parameter params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub } are:

Step S110, according to security requirements, determine the size of the safety factor l and the prime number q, and use the elliptic curve to construct a cyclic addition group {G ₁ ,+} and a cyclic multiplication group that satisfy the bilinear mapping e: G ₁ ×G ₁ →G ₂ {G ₂ , ·};

Step S120, select a collision-free hash function H ₁ :{0,1} ^* →G ₁ ,

Step S130, randomly select an integer s from the integer multiplication group of mod q as the master key of the private key generation center KGC, and calculate P _pub =sP as its corresponding public key;

Step S140, disclose system parameters {G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub }, and store s as the master key value.

Further, the step S200 specifically includes:

并把部分私钥

发送给签名者；Step S210, input system parameters params, signer's identity ID _B , KGC calculation

and put part of the private key

sent to the signer;

作为其秘密值；Step S220, according to the system parameter params and the identity ID _B of the signer, the signer randomly selects

as its secret value;

和秘密值

得到签名者的私钥为

Step S230, according to the system parameter params, the identity ID _B of the signer, and part of the private key

and secret value

Get the signer's private key as

得到签名者的公钥

Step S240, according to the system parameter params, the signer's identity ID _B and the secret value

Get the signer's public key

Further, in the step S700, it specifically includes:

Step S710, the verifier receives the signer's message-signature pair (m,c,σ=(y,h',S'));

Step S720, calculate z=H ₀ (c),

Step S730, verify whether the equation h'=H ₂ (m, z, y') holds, if so, the verifier believes that (m, c, σ=(y, h', S')) is signed by the signer Make a valid blind signature;

Otherwise invalid.

中，其中z＝H₀(c)，通过证明签名方案的正确性时，发现签名者插入协商信息z＝H₀(c)不仅对应到签名请求者进行盲化签名插入的协商信息

同时也与验证等式中用到的插入协商协商信息

相对应。故本方案可以防公共协商信息篡改攻击。Since the signer inserts negotiation information into the computation

, where z=H ₀ (c), by proving the correctness of the signature scheme, it is found that the signer inserts the negotiation information z=H ₀ (c) not only corresponds to the negotiation information that the signature requester performs blinded signature insertion

It also negotiates with the insertion negotiation information used in the verification equation.

Corresponding. Therefore, this scheme can prevent public negotiation information tampering attacks.

As shown in FIG. 3, an embodiment of the present invention further provides a certificateless partial blind signature device, including:

A system parameter establishment unit 100, configured to establish public system parameters params={G ₁ , G ₂ , P, e, g, H ₀ , H ₁ , H ₂ , P _pub };

The extraction unit 200 is used for the signer to extract the private key and the public key;

Commitment unit 300 for random selection And calculate z=H ₀ (c) and R=rP, and send R to the signature requester;

并计算z＝H₀(c)、

h′＝H₂(m,z,y),h＝α^-1(β-h′)，并把h发送给签名者；The blinding unit 400 is used to randomly select a blinding factor after receiving R

and calculate z=H ₀ (c),

h'=H ₂ (m,z,y),h=α ^-1 (β-h'), and send h to the signer;

并把S发送给签名请求者；The partially blind signature unit 500 is used for calculating h after receiving h

And send S to the signature requester;

The deblinding unit 600 is used for deblinding work, calculates S′=αS, and obtains the signature of message m and negotiation message c as σ=(y,h′,S′);

The verification unit 700 is used for signature verification.

As shown in FIG. 4 , further, the system parameter establishing unit 100 includes:

The building block 101 is used to determine the size of the safety factor l and the prime number q, and utilize elliptic curves to construct a cyclic addition group {G ₁ ,+} and a cyclic multiplication group { that satisfy the bilinear mapping e: G ₁ ×G ₁ →G ₂ G ₂ ,·};

H₁:{0,1}^*→G₁，

A function selection module 102 for selecting a collision-free hash function

H ₁ :{0,1} ^* →G ₁ ,

The key module 103 is used to randomly select an integer s from the integer multiplication group of mod q as the master key of the private key generation center KGC, and calculate P _pub =sP as its corresponding public key, and disclose the system parameter {G ₁ ,G ₂ ,P,e,g,H ₀ ,H ₁ ,H ₂ ,P _pub }, and save s as the master key value.

As shown in FIG. 5, further, the extraction unit 200 further includes:

并把部分私钥发送给签名者；Part of the private key generation module 201 is used to calculate according to the system parameters params, the signer's identity ID _B , and KGC

and put part of the private key sent to the signer;

The secret value generation module 202 is used for randomly selecting according to the system parameter params and the identity ID _B of the signer as its secret value;

和秘密值

得到签名者的私钥为

The private key module 203 is used for according to the system parameter params, the identity ID _B of the signer, the partial private key

and secret value

Get the signer's private key as

得到签名者的公钥

The public key module 204 is used for according to the system parameter params, the signer's identity ID _B and the secret value

Get the signer's public key

As shown in Figure 6, further, the verification unit 700 includes:

A receiving module 701, configured to receive a message-signature pair (m,c,σ=(y,h',S')) sent by a signature requester;

a calculation module 702 for calculating z=H ₀ (c),

Verification module 702, for verifying whether the equation h'=H ₂ (m,z,y') holds, if so, the verifier believes that (m,c,σ=(y,h',S')) is Valid blind signature by the signer, otherwise invalid.

Next, the computational efficiency of the technical solution in the present invention is compared with the existing CL-PBS solution above, including the solutions in Document 2 and Document 3, where Document 2 is an improvement to the public key substitution attack in Document 3. Program. Using a supersingular elliptic curve E(F _P ) with an embedding degree of 2: y ² =x ³ +x, where q=2 ¹⁵⁹ +2 ¹⁷ +1 is a 160-bit prime number, and p is 512 satisfying the condition p+1=12qr Bit prime. Hardware platform: CPU is CPIV 3-GHZ, 512MB memory and WindowsXP operating system. Table 1 lists the computational efficiency of the basic unit that is time-consuming in the cryptographic scheme.

Operational efficiency of the basic unit in the scheme in Table 1 (unit: milliseconds)

Table 2 lists the calculation amount of specific time-consuming operations in each scheme, mainly comparing the calculation amount of signer, signature requester and verifier in the process of scheme construction.

Table 2 Computational performance comparison of various schemes (unit: milliseconds)

To sum up, it can be obviously obtained that the solution constructed by the present invention has higher efficiency.

The above descriptions are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention shall be included in the protection of the present invention. within the range.

Claims (8)

1. A certificateless partial blind signature method, comprising:

establishing a public system parameter params ═ G₁,G₂,P,e,g,H₀,H₁,H₂,P_pub}; wherein l is a safety parameter and satisfies a prime number q>2^l，{G₁, + } is a cyclic addition group of order q, P is a group G₁Any generator of (1); { G₂V is a cyclic multiplicative group of order q, g is a generator; bilinear pairwise mappings e G₁×G₁→G₂，g＝e(P,P)∈G₂(ii) a A hash function:

H₁:{0,1}^*→G₁，

the private key generation center KGC selects s as a main key P_pubsP is a public key;

the signer extracts its private key as

The public key is

Signer random selection

And calculating z ═ H₀(c) And R ═ rP, and sends R to the signature requestor;

after the signature requester receives R, a blinding factor is randomly selected

And calculating z ═ H₀(c)、R′＝αR,

h′＝H₂(m,z,y),h＝α^-1(β -h') and sending h to the signer;

after the signer receives h, the signer calculates

And sends S to the signature requestor;

the signature requester performs blind removal work, calculates S ' ═ α S, and obtains the signature of the message m and the negotiation message c as σ ═ y, h ', S ');

and the verifier verifies the signature.

2. The certificateless partial blind signature method of claim 1, wherein the establishing a public system parameter params ═ G₁,G₂,P,e,g,H₀,H₁,H₂,P_pubThe concrete steps are as follows:

according to the safety requirement, the safety factor l and the prime number q are determined, and the bilinear mapping e: G is satisfied by an elliptic curve structure₁×G₁→G₂Cyclic addition group of (G)₁, + } and a cyclic multiplicative group G₂,·}；

Selecting a hash function

H₁:{0,1}^*→G₁，

Randomly selecting an integer s from the integer multiplication group of mod q as a master key of a private key generation center KGC, and calculating P_pubsP as its corresponding public key;

publishing System parameters G₁,G₂,P,e,g,H₀,H₁,H₂,P_pubAnd s is saved as the primary key value.

3. The certificateless partial blind signature method of claim 1, wherein the signer extracts its private key as

The public key is

The method comprises the following specific steps:

enter system parameter params, signer ID_BKGC calculation

And to make part of the private key

Sending the signature to the signer;

according to the system parameters params and the identity ID of the signer_BRandom selection by signer

As its secret value;

according to the system parameter params and the ID of the signer_BPart of the private key

And a secret value

Obtain the private key of the signer as

According to the system parameter params and the ID of the signer_BAnd a secret valueObtaining the public key of the signer

4. The certificateless partial blind signature method of claim 1, wherein the specific steps of the verifier performing signature verification comprise:

the verifier receives the signer ' S message-signature pair (m, c, σ ═ y, h ', S '));

calculating z as H₀(c)，

Verify equation H ═ H₂(m, z, y ') if true, and if so, the verifier believes (m, c, σ ═ y, h ', S ')) is a valid blind signature by the signer;

otherwise it is not valid.

5. A certificateless partial blind signature apparatus, comprising:

a system parameter establishing unit for establishing an open system parameter params ═ G₁,G₂,P,e,g,H₀,H₁,H₂,P_pub}；

Wherein l is a safety parameter and satisfies a prime number q>2^l，{G₁, + } is a cyclic addition group of order q, P is a group G₁Any generator of (1); { G₂V is a cyclic multiplicative group of order q, g is a generator; bilinear pairwise mappings e G₁×G₁→G₂，g＝e(P,P)∈G₂(ii) a A hash function:

H₁:{0,1}^*→G₁，

KGC selects s as the master key, P_pubsP is a public key; the extraction unit is used for extracting the private key and the public key by the signer;

a commitment unit for randomly selectingAnd calculating z ═ H₀(c) And R ═ rP, and sends R to the signature requestor;

a blinding unit for randomly selecting a blinding factor after receiving RAnd calculating z ═ H₀(c)、R′＝αR,

h′＝H₂(m,z,y),h＝α^-1(β -h') and sending h to the signer;

a partial blind signature unit for calculating after receiving hAnd sends S to the signature requestor;

a blind removing unit, configured to perform blind removing work, calculate S ═ α S, and obtain a signature σ ═ y, h ', and S' of the message m and the negotiation message c;

and the verification unit is used for verifying the signature.

6. The certificateless partial blind signature apparatus according to claim 5, wherein the system parameter establishing unit comprises:

building block for determiningThe safety coefficient l and the prime number q are determined, and bilinear mapping e: G is satisfied by an elliptic curve structure₁×G₁→G₂Cyclic addition group of (G)₁, + } and a cyclic multiplicative group G₂,·}；

A function selection module for selecting a collision-free hash function

H₁:{0,1}^*→G₁，

A key module for randomly selecting an integer s from the integer multiplication group of mod q as a master key of a private key generation center KGC and calculating P_pubsP as its corresponding public key and discloses the system parameter G₁,G₂,P,e,g,H₀,H₁,H₂,P_pubAnd s is saved as the primary key value.

7. The certificateless partial blind signature apparatus according to claim 5, wherein the extraction unit comprises:

a partial private key generation module for generating the ID of the signer according to the system parameter params_BKGC calculation

And to make part of the private keySending the signature to the signer;

a secret value generation module for generating a secret value according to the system parameter params and the ID of the signer_BRandom selection of

As its secret value;

a private key module for signing the identity of the signer according to the system parameters paramsID_BPart of the private keyAnd a secret value

Obtain the private key of the signer as

A public key module for generating a public key according to the system parameters params and the ID of the signer_BAnd a secret value

Obtaining the public key of the signer

8. The certificateless partial blind signature apparatus according to claim 5, wherein the verification unit comprises:

a receiving module, configured to receive a message-signature pair (m, c, σ ═ y, h ', S')) sent by a signature requester;

a calculation module for calculating z ═ H₀(c)，

A verification module for verifying the equation H ═ H₂If (m, z, y ') is true, the verifier believes (m, c, σ ═ y, h ', S ')) is a valid blind signature by the signer, otherwise it is invalid.

Images