{'fraction_non_alphanumeric': 0.032520325203252036, 'fraction_numerical': 0.008744961399193825, 'mean_word_length': 4.634334103156274, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 2, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
COLLECTIVE SIGNATURE PROTOCOLS FOR SIGNING GROUPS BASED ON PROBLEM OF FINDING ROOTS MODULO LARGE PRIME NUMBER

Generally, digital signature algorithms are based on a single difficult computational problem like prime factorization problem, discrete logarithm problem, elliptic curve problem. There are also many other algorithms which are based on the hybrid combination of prime factorization problem and discrete logarithm problem. Both are true for different types of digital signatures like single digital signature, group digital signature, collective digital signature etc. In this paper we propose collective signature protocols for signing groups based on difficulty of problem of finding roots modulo large prime number. The proposed collective signatures protocols have significant merits one of which is connected with possibility of their practical using on the base of the existing public key infrastructures.


INTRODUCTION
Digital signature (DS) protocols are widely used in information technologies to process electronic legal messages and documents. The DS protocols are based on DS schemes that represent a mathematical technique applied in public-key cryptography to validate the authenticity of digital messages or documents. Such validation is connected with the fact that DS as some redundant information can be computed only with using the private key that is known only to one person, i.e. to the signer. Verification of the signature validity is performed with signer's public key that is known publicly. To solve a variety of different practical tasks, different types of signatures are proposed: Individual signature [1,8]; Blind signature [2,3]; Collective signature [4,7]; Group signature [5,10].
The group signature refers to a signature formed on behalf of a group of signers (signing group) headed by a person called group manager or leader [11].The group digital signature (GDS) to an electronic message is generated by a group member. To verify the group signature, group public key needs to be used. Except the group manager, nobody can disclose which particular group member signed the document. The group signature has the following important properties: Only group members can sign a document; Group manager, who has both document and valid group signature can reveal the group members signed the document; And, non-group members could not reveal the original signers, who generate the group signature [14].
The collective signature refers to a signature generated with participation of each of the individual signers included in some declared set of signers. Validity of collective signature to some electronic document M means that M is signed by each of them. To generate a collective digital signature (CDS) it is needed each of the mentioned individual signers use his private key. The procedure of the verification of CDS is performed using public keys of each signer. The CDS protocols can be practically used on the base of the public key infrastructure (PKI) existing on practice to support the widely used individual DS protocols. In addition, another merit of the CDS protocols relates to possibility to implement them using many official DS standards [12], for example the Russian standard GOST R 34.10-2012 [13].
Combining the main properties of CDS and GDS in the frame of some single DS protocol [15] is very actual in the following cases: when an electronic document is to be processed and signed by several different signing groups; when an electronic document is to be processed and signed by several different signing groups and by several different individual signers. In this paper we propose the collective signature protocol for both cases, namely: Collective digital signature protocol for signing groups and Protocol of collective digital signature for group and individual signers.
Generally, digital signature algorithms are based on a single difficult computational problem like prime factorization problem, discrete logarithm problem, elliptic curve problem or are based on the hybrid combination of prime factorization problem and discrete logarithm problem. We based on difficulty of the problem of finding roots modulo large prime number [16] to design our proposed collective signature protocols.

COLLECTIVE DIGITAL SIGNATURE BASED ON PROBLEM OF FINDING
ROOTS MODULO LARGE PRIME NUMBER

Digital Signature Protocol
New hard computational problem described in [16] is used in the digital signature scheme (DSS) described below. It uses the prime modulus having the structure p = Nk 2 + 1, where k is a large prime (|k|  160 bits) and N is such even number that the size of p satisfies the condition |p|  1024 bits.
A random value x is selected as a private key. The public key y is computed using the formula y = x k mod p. The signature represents a pair of the numbers S and E. The size of S is equal to |p|  1024 bits and size of E is equal to ||  160 bits, where  is some specified prime number.
Suppose a message M is given.
The signature generation procedure is performed as follows: 1. Select at random a value t < p  1 and calculate: 2. Using some specified hash function FH(M) calculate the hash value H corresponding to the message M and compute the first element of the signature where  is a large prime that is a parameter of the signature generation algorithm. For example, it is acceptable to use a randomly selected prime  such that||= 160. The function FH(M) is also a part of the DSS. For example, one can use the hash function SHA-1 recommended by US National Institute of Standards and technology (NIST).
3. Calculate the second element of the signature: The signature verification procedure is performed as follows: 1. Using the signature (E, S) compute: 2. Calculate: The signature length is equal to The random value t plays the role of one-time secret key. It is unacceptable to use the same value t for the formation of signatures to two different documents, since in this case the private key can be calculated. Indeed, let (R, S1) and (R, S2) are the signature to the messages M1 and M2, respectively. We have and 2 = ( , 2 ) . (3b)

Collective Signature Protocol
Using the previously described digital signature scheme one can propose the following collective signature protocol.
Suppose the j-th user owns the public key yj depending on his private key xj< p as follows: = mod p, where j = 1,2,…, s.
Suppose an electronic document M is given and m(m < s) users owning the public keys y1, y2, …, ym should sign it simultaneously.
The following protocol produces the collective digital signature: 1. Each jth user selects at random a value α < and computes the public value: where j = 1,2, …, m.
2. Some of the users (or one of them) calculate the common randomization value: and then calculate the first part of the CDS: where f is a specified compression function. For example, we will use the following function: where  is a large prime having length ||= 160 bit and H is a hash value computed from the message M.
3. Using the values R and α each jth user computes its share in the CDS: that is supposed to be available to all users of the group.
4. Calculate the second element of the CDS: Thus, the CDS is computed with 2m modulo exponentiations. The CDS length is fixed and equals to| | + | |.
The CDS verification procedure is performed as follows.
1. Compute the collective public key y:  If E= E, then the signature is valid. Otherwise the signature is false.

COLLECTIVE DIGITAL SIGNATURE FOR SIGNING GROUPS BASED ON PROBLEM OF FINDING ROOTS MODULO LARGE PRIME NUMBER
The GDS protocol presupposes the formation of a digital signature to some electronic document on behalf of some collegial body (group of signers, i.e. signing group), which is headed by a group manager. Each representative of a group of signers generates his private key x and his public key = . The public key Y of the group manager is a public key of the group and is calculated as follows = , where X is manager's private key. The value Y is also the public key of the group, i.e. the value Y is used to verify authenticity of the GDS. and where is a large prime having length ||= 160 bit,E is the second element of the group signature. Then he sends value E to all group members who have initiated the protocol.
6. Each i-th group member (i = 1, 2, …, m) computes his signature share and sends it to the group manager.

Compares the values E and E.
If E* = E, then the verifier concludes that the group signature is valid. Otherwise, he rejects the signature.

 Proof of correctness:
Let us show that the proposed protocol generating the CDS (U, e, s) works correctly. Substituting the value: in the right part of the verification equation (25): It is easy to see that the value: can be considered as a "group pre-signature" approving of which is performed by the group manager with adding his signature share S'. The value is actually calculated analogously to the computation of the collective signature in the protocols [5,6]. The main difference between the described GDS protocol and collective DS protocols [5,6] is using the masking coefficients i at time of generating the collective public key U, which is used as the first element of the GDS. The value U conserves the information about all group members who participated in the process of generating the GDS. It is easy to see that only the group manager can open the GDS, using the value U, since only he can compute the masking values i.
In the protocol developed in this paper it is also used the mechanism of the formation of the collective DS. Namely, this mechanism is used in the following two ways: i) to form a presignature and ii) to form a collective signature shared by several signing groups.
Let g signing groups with public keys = , where j = 1,2, …, g; Xj is the secret key of the j-th group manager, have intention to sign the document M.
Suppose also the j-th signing group includes mj active individual signers (persons appointed to act on behalf of the j-th signing group). The protocol of collective signature for group signers is described as follows.
The signature generation procedure relating to the proposed collective DS protocol for signing groups: 1. Within the framework of the GDS protocol described above, the manager of each j-group of signers (j = 1, 2,.., g) generates masking parameters ji for the signers of his group and computes the value: (where i = 1,2,…, mj) as the j-th share in the first element of the collective group signature and the randomizing parameter: Then he sends values Uj and Rj to all other managers.
2. Each j-th group manager (j = 1, 2, …, g) computes values where  is a large prime having length ||= 160 bit, E and U are the first and second elements of the group signature.
3. Each j-th group manager (j = 1, 2, …, g) computes signature share of his group where Sji is the signature share of the ith individual signer in the ith signing group, and sends it to other group managers.
4. Each j-th group manager can verify the correctness of each share Sj by checking equality 5.
If all shares Sj satisfy the last verification equation, then the third element S of the collective signature is computed: The tuple (U, E, S) generated by the above procedure presents the collective signature (to the document M) shared by g signing groups.
 Signature Verification: The signature verification procedure relating to the proposed collective DS protocol for signing groups: 1. Compute the collective public key shared by all signing groups: If E* = E, then one concludes that the group signature is valid. Otherwise, the signature is rejected.

 Proof of correctness:
Substituting the value: in the right part of the verification equation (36): The first element U of the collective signature contains information about all group members of each signing group who signed the document M. The identification procedure (the disclosure of the group signature) is carried out by analogy with the procedure for disclosing the group signature described in [9]. It should be noted that the procedure for identifying individual signers requires the participation of the group managers of each group that share the collective signature. At the same time, the computational complexity of this procedure is relatively high and rapidly increases with the growth of number of the signing groups that share collective signature.
In the proposed collective DS scheme the signature verification procedure includes the steps of the verification procedure in the group signature scheme and an additional initial step for computing the collective public key (step 1). In the signature verification equation it is used the collective public key Ycol instead of the group public key.

PROTOCOL OF COLLECTIVE DIGITAL SIGNATURE FOR GROUP AND INDIVIDUAL SIGNERS
Another important practical scenario relates to the processing document M by several individual signers and by several group signers. Construction of the collective signature protocol (in Section 2) for such case can be implemented in full correspondence with the collective signature protocol for group signers described in Section 3, if it is accepted an agreement that for individual signers the value Uj is equal to 1.
It is evident that only all group managers act in the procedure of disclosing the collective group signature (identification of the individual signers acted in the frame of each group signer).

CONCLUSION
In paper [16], Nicolay A. Moldovyan based on difficulty of finding the k th roots in the finite fields GF(p) such that p = Nk 2 + 1, where k is sufficiently large prime having the size |k|> 160 bits and N is even number such that the size of p is |p|> 1024 bits, to propose a collective digital signature scheme. This is the basis for us design collective signature protocols for signing groups based on problem of finding roots modulo large prime numbers: Collective digital signature for signing groups and Collective digital signature for group and individual signers. Both are extensions of collective digital signatures that combine the advantages of group digital signatures and collective digital signatures. Their size does not depend on the number of members involved in the formation of the final signature. In each turn, we presented the signature generation process, the signature verification process, as well as demonstrate the correctness of this verification process.
We also set all our hope on our future work to develop the collective signature schemes of the proposed types, in which the signature contains only two elements E and S.