Aigis-sig方案的门限数字签名协议研究  

A New Threshold Digital Signature Protocol for Aigis-sig

作　　者：赵秀凤 付雨 ZHAO Xiu-Feng;FU Yu(College of Cryptography Engineering,Information Engineering University,Zhenzhou 450001,China)

机构地区：[1]信息工程大学密码工程学院,郑州450001

出　　处：《密码学报》2022年第5期872-882,共11页Journal of Cryptologic Research

基　　金：国家自然科学基金(61902428);军事类研究生资助课题(JY2019C226)。

摘　　要：本文利用全同态加密技术和基于多项式环的Shamir门限秘密分享方案,设计了Aigis-sig方案的门限签名协议. Aigis-sig等基于格的数字签名方案,利用拒绝采样技术确保签名不泄露私钥信息,但是拒绝采样也给设计门限签名协议带来困难,在拒绝采样步骤完成前,需要对加密的中间值进行运算.因此,本文引入全同态加密技术密态计算协议中间值.此外,由于Aigis-sig方案使用的主要代数结构为多项式环,为适应协议构造,本文引入了基于多项式环的Shamir门限秘密分享方案,并证明了秘密分享方案在不同模约化操作下的正确性.分析结果表明该协议满足正确性和可行性,在两个参与者都是诚实的情况下,生成的门限数字签名满足适应性选择消息攻击下的存在不可伪造性.Threshold digital signature protocol for Aigis-sig scheme is designed by using the fully homomorphic encryption technology and Shamir secret sharing scheme based on a polynomial ring.Lattice-based digital signature protocol for Aigis-sig scheme uses rejection sampling in their design to ensure that the signature does not reveal any information about the private key, while rejection sampling brings difficulty for designing threshold signature protocol, i.e., the encrypted intermediate value needs to be calculated before rejection sampling. Therefore, a fully homomorphic encryption technique is proposed to compute the intermediate value. Because the main algebraic structure applied in the Aigis-sig is the polynomial ring, to accommodate the construction, the Shamir secret sharing scheme on the polynomial ring is introduced, and the correctness of the secret sharing scheme under different modular reduction operations is proved. The evaluation analysis demonstrates that the proposed protocol is correct and feasible. In the scenario that both parties are honest, the threshold signature is unforgeable against adaptive chosen-message attack.

关 键 词：Aigis-sig方案 同态加密 门限签名协议 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]