【作者】 李国文；

【导师】 李大兴；

【作者基本信息】 山东大学 ， 计算机软件与理论， 2007， 博士

【摘要】 随着计算机和计算机网络的快速发展，数字签名在现实生活中扮演着越来越重要的角色，提出了越来越多的新需求。门限签名是对普通数字签名的推广，不同之处在于：普通数字签名的签名是由一个个体生成的，而门限签名的签名是由多个成员合作生成的，例如在(t，n)门限签名方案中，需要t个以上合作者才能生成签名。门限签名和普通数字签名的验证都是由单个个体完成的。门限签名是门限密码学的重要组成部分。秘密共享是门限密码学的基础。门限秘密共享的主要思想是将一个密钥分割成若干子密钥分散存储于多个服务器成员，当需要重构密钥或使用它进行某种密码运算时，必须多于特定数量(门限值)的成员才能共同完成，少于特定数量的任何成员组都不能计算得到此密钥。这个领域中一个重要的研究内容是秘密共享新成员的加入，它解决的是为新加入的成员分发子密钥，同时满足：在加入过程中不能有可信中心存在，也不能重构密钥。在第三章中提出了一个实用的秘密共享新成员加入协议。一般秘密共享方案存在两个问题：一是分发者的诚实性问题，分发者故意将错误的子密钥发给某个成员，成员如何验证子密钥是否正确；二是成员的诚实性问题，若某些恶意成员提供了假的子密钥，其他成员能否鉴别。对这两个问题的研究，导致出现了可验证秘密共享。一般来说，成员要想知道持有的子密钥是否有效，唯一的办法是尝试重构密钥，可验证秘密共享允许成员验证他们是否有一个有效的子密钥，而不用重构密钥。第三章中也对可验证的门限签名进行了研究。前向安全签名不能保证密钥泄漏以后时间段签名的安全性，密钥隔离签名能够解决这个问题。在密钥隔离签名中需要两个模块，一个是签名者，另一个是基地。签名者使用他持有的当前时间段的密钥进行签名，但在每个时间段结束进行密钥演化时，需要基地的演化信息来计算新的密钥。因此假定基地是安全的，即使入侵者得到当前的密钥，没有基地的帮助也无法计算密钥泄漏后时间段的密钥。在第三章中提出了一个密钥隔离的门限签名方案。1984年，Shamir首先提出了基于身份的公钥密码系统(identity-based public keycryptosystem)。在这个密码系统中，用户的公钥可由他公开的唯一身份信息(如邮件地址、IP地址等)来确定，而用户的私钥由一个可信的私钥生成中心PKG产生。这样，任何一对用户都可以安全地通讯，而不需要交换他们的公钥证书，不需要使用公钥字典，也不需要使用第三方的在线服务。之后许多基于身份的签名方案相继被提出，利用双线性对能够设计简单实用的基于身份的签名方案。本文对基于身份的门限签名进行了研究，文中所涉及的基于身份的方案都是基于双线性对的。Mambo等人于1996年首次提出了代理签名的概念。在代理签名方案中，原始签名者将自己的签名权委托给可靠的代理签名者，代理签名者能够代表原始签名者进行签名。随着代理签名的发展，门限代理签名也受到了广泛的关注。在第四章中对门限代理签名进行了研究，首先对一个基于身份的门限代理签名方案进行了分析，然后提出了一个实用的基于证书的门限代理签名方案。盲签名使用户能将给定的消息让签名者签发，而又不泄漏消息或签名给签名者。盲签名常用于电子现金和电子投票系统。结合门限签名和盲签名的思想，形成了门限盲签名。第五章对门限盲签名进行了研究，首先提出了一个基于身份的盲签名方案，随后在此基础上提出了一个基于身份的门限盲签名方案。在门限签名方案中，任意t个成员合谋可以冒充其他成员产生签名，事后无法追查是哪t个成员参与了签名，这意味着恶意成员集可以不负责任的产生签名。为了解决这个问题，提出了门限多签名方案。门限多签名结合了门限签名和多重签名的思想，防止了恶意成员集合的冒充。在第六章中，我们提出了两个来自双线性对的门限多签名方案。群签名允许一个群成员匿名地代表整个群体签发消息，签名者的身份是保密的，当发生争执时，由一个指定的群管理员来揭示其身份。群签名与门限签名结合形成了门限群签名。在第七章中，我们分析了两个门限群签名方案，并提出一个新的门限群签名方案和一个把门限签名转换为门限群签名的一般方法。环签名可以被视为一种简化的群签名，它没有中心，没有群的建立过程。在环签名中，对于验证者来说签名者是完全匿名的，他只能确定签名来自于某一个环，而不能确定具体的签名者是谁。即使环签名出现争议，也没有人能确定签名者究竟是谁。环签名与门限签名相结合形成了门限环签名。第八章提出了一个高效的可证安全的基于身份的门限环签名方案。本文的主要工作是对秘密共享新成员加入和上述门限签名体制进行研究，取得的主要研究成果归纳如下：●提出了一个实用的秘密共享新成员加入协议，门限个旧成员不需要重构秘密就可以给新成员分发子秘密，并且只有新成员能够得到这个子秘密，然后与相关工作进行了比较。●对一个无可信中心的门限签名方案进行了分析，指出方案存在密钥冗余问题，同时给出了一个简化方案，证明两个方案是等价的，从而说明密钥冗余问题。●改进Shoup的门限RSA签名方案，使用可验证秘密共享技术，提出了一个可验证的门限RSA签名方案，解决了可信中心不诚实的问题。●针对一般门限签名和前向安全门限签名中存在的密钥泄漏问题，提出了一个密钥隔离的门限签名方案，即使某一时间段的密钥泄漏，也不影响其他时间段密钥的安全。●对一个基于身份的门限代理签名方案进行了分析，指出它是不安全的且效率不高，随后设计了一个高效的基于证书的门限代理签名方案，并证明其安全性。●提出一个新的基于身份的盲签名方案，并分析方案的正确性、盲性和不可伪造性，在提出的盲签名方案基础上，设计了一个高效的基于身份的门限盲签名方案，不需要管理用户证书，从而节省了管理开销。●针对门限签名中的合谋问题，结合多签名的思想，提出了两个基于双线性对的门限多签名方案，一个是基于证书的，另一个是基于身份的。●首先分析了一个门限群签名方案和一个矢量空间秘密共享群签名方案，指出方案中存在的不足；然后，提出了一个新的矢量空间秘密共享群签名方案；最后，给出了一个转换门限签名到门限群签名的一般方法。●提出了一个基于身份的门限环签名方案，与同类方案相比效率更高，并且在随机预言模型下证明了安全性。下一步的研究工作包括：研究如何移去门限RSA签名方案中的可信中心，构建高效的无可信中心的门限RSA签名方案；研究设计更加高效的门限群签名方案和门限环签名方案；研究设计标准模型(不使用随机预言)下可证明安全的门限签名方案。更多还原

【Abstract】 With the quick development of computer and network, digital signature plays an important role in real life, and more and more new requirements are presented. Threshold signature is the popularization of ordinary digital signature, and the difference lies in: Ordinary digital signature is generated by one individual, while threshold signature is generated by multi-members’ cooperation. For example, in a (t, n) threshold signature scheme, we need t or more cooperators to produce a signature. But their verifications are both finished by an individual. Threshold signature is one main research content of threshold cryptography.Secret sharing is the basis of threshold cryptosystem. The main idea of threshold secret sharing is to divide the secret key into several shares and store them in multiple severs respectively. When we need to reconstruct this secret key or do some cryptological operation related to this secret key, only no fewer than a certain number of severs can complete this work. Any severs group less than the certain number can’t compute this secret key. One of the important research objects is new member enrollment protocol, which deals with the problem of how to distribute new member’s secret share correctly. Enrollment protocol must be run without any trusted dealer and reconstruction of the secret. A practical enrollment protocol for new member is presented in chapter 3.There are two problems in an ordinary secret sharing scheme: one is the honesty of dealer, the dealer give false subkey to some player on purpose, and how do the player verify the subkey; the other is the honesty of players, when some malicious player provides false subkey, how do other players distinguish. Study of the two problems brings on verifiable secret sharing. Generally, members want to know whether their shares are valid, the only method is to try to reconstruct the key, and verifiable secret sharing allows members to verify whether their shares are valid instead of reconstructing the secret. Verifiable threshold signature is studied in chapter 3.Forward secure signature scheme can not guarantee the safety of signature after key exposure. To solve the problem, key-insulated signature is put forward. There are two modules in key-insulated signature, one is the signer and the other is the base. The signer signs a message with the key of current period, and computes his new key with the information of the base at the end of each period. Assume the base to be secure, there are no methods to compute the key of the period after key exposure without help of the base, even the inbreaker has the current key. A key-insulated threshold signature scheme is proposed in chapter 3.Shamir first presented identity-based public key cryptosystem in 1984. In this cryptosystem, public key of user can be determined by his public identity information (such as email or IP address), and private key of user can be generated by private key generator. Thus any pair of users can communicate securely without exchanging public key certificates, keeping a public key directory, or using online service of a third party. Since then, many identity-based signature schemes have been proposed. Bilinear pairings can be used to devise practical identity-based signature scheme. Identity-based threshold signature is studied in this dissertation, and all identity-based schemes in this dissertation are based on bilinear pairings.In 1996, Mambo et al. first introduced the concept of proxy signatures. In the proxy signature scheme, an original signer is allowed to delegate his signing authority to a reliable proxy signer. Then the proxy signer is able to sign on behalf of the original signer. With the development of proxy signature, threshold proxy signature is also widely studied. Threshold proxy signature is studied in chapter 4. Firstly we analyze an identity-based threshold proxy signature scheme, and then propose a certificate-based threshold proxy signature scheme.Blind signature allows the user to obtain a signature of a message in a way that the signer learns neither the message nor the resulting signature. Blind signature is frequently used in e-cash or e-voting systems. Combining threshold signature with blind signature, threshold blind signature is proposed. Threshold blind signature is studied in chapter 5, first an identity-based blind signature is proposed, then an identity-based threshold blind signature scheme is proposed based on the proposed blind signature scheme. In threshold signature scheme, if t or more users collude, they can impersonate any other set of users to generate signatures, which implies that a malicious subgroup of users can generate signatures without taking any responsibility. To solve this problem, the method of threshold multisignature is presented, which combines the idea of threshold signature with the idea of multisignature. It can prevent a group of malicious users from impersonating other users through the generation of signatures. Two threshold multisignature schemes from bilinear pairings are proposed in chapter 6.Group signature allows a group member to sign messages anonymously on behalf of the group. However, in the case of a dispute, the identity of a signer can be revealed by the group manager. Combining group signature with threshold signature brings to threshold group signature. In chapter 7, we analyze two threshold group signature schemes and propose a new one and an approach to convert any threshold signature into a threshold group signature.A ring signature is considered to be a simplified group signature, which consists of only users without managers and has not a setup procedure of the group. It protects the anonymity of a signer since the verifier knows that the signature comes from a member of a ring, but does not know exactly who the signer is. There is no way to revoke the anonymity of the signer in the case of a dispute, either. Combining ring signature with threshold signature brings to threshold ring signature. An efficient identity-based threshold ring signature scheme with provable security in random oracle model is proposed in chapter 8.The main work in this paper is to research on the threshold signature scheme above-mentioned. The main results are as follows:We put forward a new member enrollment protocol for secret sharing scheme. Threshold old members can distribute secret share for new member without reconstructing the secret, and only the new member can get the secret share. At last, we compare proposed protocol with related work.Analyze a threshold signature scheme without a trusted party and point out the keys are redundant. At the same time, a simplified scheme is proposed, of which the security is equal to the one of redundant scheme.We improve Shoup’s threshold RSA signature scheme, and present a verifiable threshold RSA signature scheme by using verifiable secret sharing, which solves the problem of honesty of the dealer.To solve the exposure of secret key in ordinary threshold signature and forward secure threshold signature, a key-insulated threshold signature scheme is presented. Even if the secret key is exposed in some period, the secret keys of other periods are still secure.Analyze an identity-based threshold proxy signature scheme, then point out it is insecure and inefficient, at last propose an efficient certificate-based threshold proxy signature scheme and give security proof.Propose a new identity-based blind signature scheme and analyze its correctness, blindness and unforgeability. Then put forward an efficient identity-based threshold blind signature scheme based on the proposed blind signature scheme. It saves management costs for it need not manage user certificates.To solve collusion problem of threshold signature, combining with the idea of multisignature, two threshold multisignature schemes from bilinear pairings are proposed. One is based on certificate and the other is based on identity.Analyze a threshold group signature scheme and a group signature scheme based on vector space secret sharing, point out their disadvantages, then propose a new group signature scheme based on vector space secret sharing, finally give an approach to convert any threshold signature into a threshold group signature.An identity-based threshold ring signature scheme is presented. It is more efficient compared with this type of scheme, and give a security proof in random oracle model.Our next works include: researching on how to remove the trusted party of threshold RSA signature scheme, and building up efficient threshold RSA signature scheme without a trusted party; researching on more efficient threshold group signature scheme and threshold ring signature scheme; building up provably secure threshold signature scheme in standard model (without random oracle).更多还原