We introduce a novel post-quantum sanitizable signature scheme constructed upon a chameleon hash function derived from the McEliece cryptosystem. In this design, the designated sanitizer possesses the inherent trapdoor of a Goppa code, which facilitates controlled collision-finding via Patterson decoding. This mechanism enables authorized modification of specific message blocks while ensuring all other content remains immutably bound. We provide formal security definitions and rigorous proofs of existential unforgeability and immutability, grounded in the hardness of syndrome decoding in the random-oracle model, where a robust random oracle thwarts trivial linear hash collisions. A key innovation lies in our precise characterization of the transparency property: by imposing a specific weight constraint on the randomizers generated by the signer, we achieve perfect transparency, rendering sanitized signatures indistinguishable from freshly signed ones. This work establishes the first transparent, code-based, post-quantum sanitizable signature scheme, offering strong theoretical guarantees and a pathway for practical deployment in long-term secure applications.

翻译：我们提出了一种新颖的后量子可净化签名方案，该方案构建于源自McEliece密码系统的变色龙哈希函数之上。在此设计中，指定的净化者拥有Goppa码的固有陷门，这通过Patterson解码促进了受控的碰撞查找。该机制允许对特定消息块进行授权修改，同时确保所有其他内容保持不可变绑定。我们提供了形式化的安全定义以及存在性不可伪造性和不可变性的严格证明，其基础在于随机预言机模型中伴随解码的困难性，其中强健的随机预言机阻止了平凡的线性哈希碰撞。一个关键创新在于我们对透明性属性的精确刻画：通过对签名者生成的随机化器施加特定的权重约束，我们实现了完美的透明性，使得净化后的签名与新鲜签名的签名无法区分。这项工作建立了首个透明的、基于编码的、后量子的可净化签名方案，为长期安全应用提供了强有力的理论保证和实际部署的路径。