基于SM2数字签名算法的可否认环签名  

Deniable Ring Signature Scheme Based on SM2 Digital Signature Algorithm

作　　者：包子健 何德彪 彭聪 罗敏[1] 黄欣沂 BAO Zi-Jian;HE De-Biao;PENG Cong;LUO Min;HUANG Xin-Yi(Key Laboratory of Aerospace Information Security and Trusted Computing,Ministry of Education,School of Cyber Science and Engineering,Wuhan University,Wuhan 430072,China;Artificial Intelligence Thrust,Information Hub,The Hong Kong University of Science and Technology(Guangzhou),Guangzhou 511455,China)

机构地区：[1]武汉大学国家网络安全学院,空天信息安全与可信计算教育部重点实验室,武汉430072 [2]香港科技大学(广州)信息枢纽人工智能学域,广州511455

出　　处：《密码学报》2023年第2期264-275,共12页Journal of Cryptologic Research

基　　金：国家重点研发计划(2021YFA1000600);国家自然科学基金(U21A20466,62172307,62032005)。

摘　　要：可否认环签名,允许环成员能在无可信第三方的情况下确认或者否认自己是该签名的签名者,较好平衡了隐私保护与可控监管,有广泛的应用场景.为了完善和丰富国产商用密码体系,本文提出基于SM2数字签名的可否认环签名方案,能够实现对签名的确认与否认功能.本文形式化证明所提出的方案满足正确性、不可伪造性、匿名性、可追踪性、不可诽谤性.通过通信和计算开销对比,可以得出本文方案通信开销与SM2环签名相当,计算开销略高于Komano等人的方案,具有良好的实用性.A deniable ring signature scheme allows a ring member to confirm or disavow that he is the signer of the ring signature via a protocol without a trusted third party.It balances privacy protection and controllable supervision,which has a wide range of applications.In order to improve and enrich commercial cryptosystems,this paper proposes a deniable ring signature scheme based on SM2,a standard digital signature algorithm,which realizes the functions of confirmation and disavowal of a signature.This paper formally proves that the proposed scheme satisfies a number of properties,including correctness,unforgeability,anonymity,traceability and non-frameability.The comparisons of communication and computation costs show that the communication cost of the designed scheme is equivalent to that of SM2-based ring signature,and the computation cost is slightly higher than that of Komano et al.,which indicates the applicability of the proposed scheme.

关 键 词：SM2签名 环签名 可否认环签名 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]