论文部分内容阅读
2008年,Hofheinz和Kiltz在美密会(CRYPTO)上提出了可编程杂凑函数的概念.作为刻画了分割证明技术的密码原语,可编程杂凑函数是构造标准模型下可证明安全密码方案的有力工具.受到传统可编程杂凑函数的启发,Zhang等人在2016年美密会上提出了格上可编程杂凑函数的概念,并给出多个在标准模型下可证明安全密码方案的通用构造.本文继续研究基于格的可编程杂凑函数,并利用格上的伪交换性给出新的可编程杂凑函数的实例化构造.进一步,通过将新的可编程杂凑函数与传统有限猜测证明技术的结合,本文构造了基于格上困难问题可证明安全的数字签名方案.在技术上,本文的签名方案突破了Ducas和Micciancio基于理想格的签名方案(CRYPTO 2014)对于底层代数结构可交换性的依赖,并揭示了Ducas和Micciancio的证明技术可以无缝地平移到一般格上用于构造在标准模型下可证明安全的高效数字签名方案,从而在某种程度上解决了Ducas和Micciancio遗留的公开问题.在效率上,本文的签名方案实现了对数的验证密钥长度和常数的签名长度,即验证密钥和签名分别只包含O(log■)个矩阵和一个格向量,其中■是签名消息的长度.
In 2008, Hofheinz and Kiltz proposed the concept of programmable hash functions at the CRYPTO. As a cryptographic primitive that characterizes split proofing, programmable hash functions are powerful tools for constructing proof-of-concept cryptographic schemes under the standard model Inspired by the traditional programmable hash functions, Zhang et al proposed the notion of programmable hash functions on the grid at the 2016 Miyamuni meeting and provided several general constructs that could prove the security cryptosystems under the standard model. In this paper, we study the lattice-based programmable hash function and use the pseudo-commutativity on the lattice to give the instantiation of a new programmable hash function.Furthermore, by combining the new programmable hash function with the traditional finite guess theory, A digital signature scheme that can prove security based on the lattice difficult problem is constructed.Technically, the signature scheme of this paper breaks the dependence of Ducas and Micciancio’s ideal lattice-based signature scheme (CRYPTO 2014) on the interchangeability of the underlying algebraic structure and reveals The proven techniques of Ducas and Micciancio can be seamlessly panned to the general grid for constructing a provably safe Efficient digital signature scheme, to a certain extent, solved the open problems left by Ducas and Micciancio.In the efficiency, the signature scheme of this paper realizes the length of the logarithmic verification key and the signature length of the constant, namely, the verification key and the signature Contains only O (log ■) matrices and a lattice vector, where ■ is the length of the signature message.