A quantum-safe digital signature verification method and system

Abstract

The present application relates to the field of network information security technology, and specifically to a quantum-safe digital signature verification method and system. Specifically, the digital signature verification method introduces a one-time identity associated with the privacy identity of the user unit, thereby adding a new variable each time a signature is made, and then a one-time one-key signature is performed through a hash function based on a linear shift register, and further relies on an irreducible polynomial of a first quantum random number and a second quantum random number to jointly ensure the security of the signature, so that the security of the digital signature process reaches a quantum security level, and can resist increasingly powerful classical computing attacks and future disruptive quantum computing attacks. In the signature verification link, on the one hand, the integrity of the business information is verified based on the hash function of the linear shift register; on the other hand, the relevance and legitimacy are verified based on the one-time identity to ensure the non-repudiation of the user's digital signature.

Description

Technical Field

[0001] The present application relates to the field of network information security technology, and in particular to a quantum-secure digital signature verification method and system. Background Art

[0002] With the rapid development of network technology, network security issues are becoming increasingly important, and information encryption technology is the core technology in network security technology. Digital signatures are widely used in many information encryption technologies. It is an effective solution to ensure the confidentiality of information transmission, the integrity of data exchange, the non-repudiation of sent information, and the certainty of the identity of traders. It is an important part of network information security.

[0003] Simply put, a digital signature is some data attached to a data unit, or a cryptographic transformation of a data unit. This data or transformation allows the receiver of the data unit to confirm the source of the data unit, preventing the sender from denying the signature and making it impossible to deny; at the same time, it ensures the integrity of the data unit, protects the data, and prevents tampering and implantation.

[0004] At present, digital signatures mainly use asymmetric cryptographic systems (public key cryptographic systems), that is, the sender uses a private key to encrypt data, and the receiver uses the corresponding public key to decrypt data. The public key cryptographic system is generally divided into three categories according to the problems it is based on: large prime factorization problems, discrete logarithm problems, and elliptic curves. The Sixth International Conference on Cryptography recommended two encryption algorithms for public key cryptographic systems: the RSA algorithm based on the large integer factorization problem (IFP) and the ECC algorithm based on the discrete logarithm calculation problem on the elliptic curve (ECDLP). Among them, the mathematical principle of the RSA algorithm is simple and relatively easy to implement in engineering applications, but its unit security strength is relatively low. The general number field sieve (NFS) method, which is internationally recognized as the most effective attack method for the RSA algorithm, is used to decipher and attack the RSA algorithm. Its deciphering or solving difficulty is sub-exponential. The mathematical principle of the ECC algorithm is relatively complex, which is difficult to implement in engineering applications, and its unit security strength is relatively high. The Pollard rho method, which is internationally recognized as the most effective attack method for the ECC algorithm, is used to decipher and attack the ECC algorithm. The difficulty of deciphering or solving it is exponential.

[0005] The security of digital signatures that rely on public key cryptography is based on unproven mathematical computational problems. With the rapid improvement of classical computing power and the explosive development of quantum algorithms, various signcryption algorithms are gradually being cracked. For example, in 1994, Peter Shor proposed the quantum Shor algorithm, which can quickly crack public key algorithms based on prime factorization and discrete logarithm problems. The RSA algorithm RSA512 based on large number factorization was cracked in 1999, RSA768 was cracked in 2009, and RSA795 was cracked in 2019. All of the above are constantly warning us that the current classical digital signature scheme will no longer be absolutely secure.

[0006] In order to solve this problem, the applicant previously submitted a Chinese patent application entitled: A quantum key negotiation method, system, quantum digital signature method, system, publication number: CN114244500A, which proposed a quantum digital signature method: sender A sends a message and a digital signature to receiver B, and receiver B sends the message and digital signature received from sender A together with its own key S1 to verifier C; after receiving the message from receiver B, verifier C sends key S2 to receiver B, and receiver B and verifier C jointly perform signature verification. This method does not rely on an asymmetric cryptographic system, and is verified by receiver B and verifier C, which greatly improves the integrity, authenticity, and non-repudiation of signature verification, and ensures the security of signature verification.

[0007] However, in the above-mentioned quantum digital signature method, the receiver B needs to send the message and signature to the verifier C, and the verifier C needs to receive a large amount of message data each time it verifies the signature, which will cause a large amount of memory resources of the verifier C to be consumed, which not only increases the storage burden of the verifier C, but also reduces the verification efficiency of the verifier C. Summary of the invention

[0008] Based on this, it is necessary to provide a quantum-secure digital signature verification method and system to address the above technical issues.

[0009] In a first aspect, a quantum-safe digital signature verification method is provided, comprising:

[0010] S11: The user unit and the quantum CA generate a shared one-time identity OTCA;

[0011] S12: The user unit generates service information Mess including a one-time identity identifier OTCA;

[0012] S13: The user unit generates a hash function Hash, and generates a signature Sign about the service information Mess based on the hash function Hash, and then sends the service information Mess and the signature Sign to the receiving unit;

[0013] S14: The receiving unit obtains the service information and signature sent by the user unit, which are recorded as service information Mess′ and signature Sign′ respectively, and performs file verification based on the obtained service information Mess′ and signature Sign′: if the file verification passes, the receiving unit sends the one-time identity identifier OTCA′ in the service information Mess′ to the quantum CA; otherwise, the receiving unit rejects the digital signature;

[0014] S15: The quantum CA obtains the one-time identity sent by the receiving unit and records it as the one-time identity OTCA″, and then performs identity authentication based on the one-time identity OTCA″: if the result of the identity authentication is verification passed, the receiving unit accepts the digital signature and stores the business information Mess′; otherwise, the receiving unit rejects the digital signature.

[0015] In a further embodiment, the process of the user unit and the quantum CA sharing the one-time identity OTCA includes:

[0016] S21: The user unit submits an application for obtaining an identity to the quantum CA;

[0017] S22: The quantum CA generates a public identity Pub and a private identity Pri based on the application, and then provides them to the user unit;

[0018] S23: The user unit and the quantum CA locally store the public identity Pub and the private identity Pri respectively;

[0019] S24: The user unit and the quantum CA generate a one-time identity OTCA based on the locally stored privacy identity Pri using the same preset rules.

[0020] In a further embodiment, the process in which the user unit and the quantum CA generate a one-time identity identifier OTCA based on the locally stored privacy identity identifier Pri using the same preset rules includes:

[0021] S31: The user unit and the quantum CA share an m-bit binary random number S1 and a 2m-bit binary random number T1, where the random number T1 is expressed as T1=[u, v], where u and v are both m-bit binary random numbers, and m is a positive integer greater than 0;

[0022] S32: The user unit locally generates an m-bit random number P1, and generates an irreducible polynomial P1(x) based on the random number P1, and then uses the random number S1 as an input random number and the irreducible polynomial P1(x) to generate a hash function Hash1 based on a linear shift register;

[0023] S33: The user unit substitutes the private identity Pri obtained from the quantum CA into a hash function Hash1 to generate a hash value H1(Pri) of the private identity Pri;

[0024] S34: The user unit generates a privacy authentication code Mac based on the hash value H1(Pri), wherein the privacy authentication code Mac is expressed as Mac=[H1(Pri), P1]⊕T1, and sends the privacy authentication code Mac to the quantum CA;

[0025] S35: The quantum CA receives the privacy authentication code, recorded as the privacy authentication code Mac′, and performs privacy verification: if the verification is successful, the user unit and the quantum CA obtain the same one-time identity OTCA=H1(Pri)⊕u; otherwise, the user unit and the quantum CA re-execute the process of generating the one-time identity OTCA using the same preset rules.

[0026] By adopting the above technical solution: obtaining the one-time identity OTCA based on the private identity Pri, the private identity Pri can be hidden to avoid exposure of the private identity, thereby improving the security of the signature Sign; and even if the private identity Pri does not change, the one-time identity OTCA obtained each time is different, thereby ensuring that the one-time identity OTCA changes once, further improving the security of the signature Sign; and facilitating subsequent identity authentication.

[0027] In a further embodiment, the quantum CA receives a privacy authentication code, recorded as a privacy authentication code Mac′, and performs privacy verification, including:

[0028] S41: The quantum CA receives the privacy authentication code, recorded as the privacy authentication code Mac′, and performs an XOR operation on the privacy authentication code Mac′ through the random number T1 to obtain a hash value H1(Pri)′ and a random number P′1;

[0029] S42: Quantum CA generates an irreducible polynomial P′1(x) according to the random number P′1, and then generates a new linear shift register-based hash function Hash′1 based on the irreducible polynomial P′1(x) and the random number S1;

[0030] S43: The quantum CA substitutes the locally stored private identity Pri into the hash function Hash′1 to obtain a new hash value H′1(Pri) of the private identity Pri; if the new hash value H′1(Pri) is equal to the hash value H1(Pri)′, the privacy verification passes; otherwise, the privacy verification fails.

[0031] By adopting the above technical solution: the private identity of the sending unit can be verified while sharing the one-time identity OTCA, thereby ensuring the association between the one-time identity and the private identity.

[0032] In a further embodiment, the one-time identity tag OTCA is configured to start timing after it is generated, and if the timing exceeds a preset time threshold, the one-time identity tag OTCA becomes invalid.

[0033] By adopting the above technical solution: by setting an expiration time limit for the one-time identity tag OTCA, when the receiving unit does not authenticate the identity of the quantum CA for a long time, the one-time identity tag OTCA automatically becomes invalid, thereby reducing the security risk of signature verification.

[0034] In a further embodiment, the service information Mess includes service data Data and a public identity Pub of the user unit.

[0035] By adopting the above technical solution: the public identity Pub of the user unit is used to mark the object generating the business data Data, so as to perform identity authentication during signature verification.

[0036] In a further embodiment, the service information Mess includes a timestamp Time and / or a service number O.

[0037] By adopting the above technical solution: the timestamp Time can identify the occurrence time of the business data Data, which is convenient for authenticating the time of the business data Data, thereby verifying whether the business data Data is tampered with; the business number O is used to identify the occurrence order or number of the business data, which is convenient for quickly indexing the business data Data.

[0038] In a further embodiment, the user unit generates a hash function, generates a signature Sign about the service information Mess based on the hash function, and then sends the service information Mess and the signature Sign to the receiving unit in the following process:

[0039] S81: The user unit locally generates a first quantum random number P2 of n bits, and shares a second quantum random number S2 of n bits and a third quantum random number T2 of 2n bits with the receiving unit;

[0040] S82: The user unit generates an irreducible polynomial P2(x) based on the first quantum random number P2, and generates a hash function Hash2 based on a linear shift register by using the irreducible polynomial P2(x) and the second quantum random number S2;

[0041] S83: The user unit generates an information digest Dig about the service information Mess based on the second hash function Hash2, and the information digest Dig is expressed as: Dig = [Hash2 (Mess), P2], where Hash2 (Mess) represents a hash value 2 obtained by performing a hash operation on the service information Mess through the second hash function Hash2;

[0042] S84: The user unit uses the third quantum random number T2 to perform an XOR operation on the information summary Dig to generate a signature Sign, and then sends the service information Mess and the signature Sign to the receiving unit.

[0043] By adopting the above technical solution: the hash function 2 based on the linear shift register can greatly improve the security of the digital signature based on the one-time pad technology, and can resist classical computing attacks and future quantum technology attacks; the security of the hash function 2 Hash2 is ensured by the irreducible polynomial P2(x) and the second quantum random number S2 on the one hand, and the irreducible polynomial P2(x) depends on the first quantum random number P2; on the other hand, it is ensured by introducing a one-time identity identifier OTCA in the business information Mess; therefore, when the hash function of the linear shift register is used for hash operation, the security of the signature process is guaranteed.

[0044] In a further embodiment, the receiving unit obtains the service information and signature sent by the user unit, which are recorded as service information Mess′ and signature Sign′ respectively, and performs file verification based on the obtained service information Mess′ and signature Sign′, including:

[0045] S91: The receiving unit obtains the service information and signature sent by the user unit, which are recorded as service information Mess′ and signature Sign′ respectively;

[0046] S92: The receiving unit performs an XOR operation on the signature Sign′ through the third quantum random number T2 to obtain the information digest Dig′, and then obtains the hash value Hash2(Mess)′ and the first quantum random number P′2;

[0047] S93: Generate a new hash function Hash′2 based on a linear shift register based on the first quantum random number P′2 and the second quantum random number S2, and then perform a hash operation on the business information Mess′ to obtain a new hash value Hash′2(Mess′);

[0048] S94: Compare the new hash value Hash′2(Mess′) with the hash value Hash2(Mess)′: If the two are equal, the file verification is successful, and the receiving unit sends the one-time identity identifier OTCA′ and the public identity identifier Pub′ in the business information Mess′ to the quantum CA through the classical authentication channel; otherwise, the file verification fails, and the receiving unit rejects the digital signature.

[0049] By adopting the above technical solution: the receiving unit can verify the integrity of the received service information Mess′ by verifying whether the new hash value Hash′2(Mess′) is equal to the hash value Hash2(Mess)′.

[0050] In a further embodiment, the process of the quantum CA performing identity authentication includes:

[0051] S101: The quantum CA obtains the public identity and the one-time identity sent by the receiving unit, which are recorded as the public identity Pub″ and the one-time identity OTCA″ respectively;

[0052] S102: The quantum CA queries the local storage based on the public identity Pub″ whether the corresponding public identity Pub and one-time identity OTCA exist, and when the public identity Pub″ is equal to the public identity Pub, the one-time identity OTCA″ is also equal to the one-time identity OTCA corresponding to the public identity Pub: if they exist, the identity authentication is passed; otherwise, the identity authentication fails;

[0053] S103: The quantum CA sends the verification result of the identity authentication to the receiving unit through the classical authentication channel. If the verification result of the identity authentication is passed, the receiving unit accepts the digital signature and stores the business information Mess′; otherwise, the receiving unit rejects the digital signature.

[0054] By adopting the above technical solution: when verifying the integrity of the business information Mess′ obtained by the receiving unit, the one-time identity identifier OTCA′ in the business information Mess′ is further verified for relevance and legitimacy, the legality of the user unit identity of the signature is clarified, and the user's non-repudiation of the digital signature is ensured.

[0055] In a further embodiment, the digital signature verification method further includes:

[0056] S111: The user unit sends the hash value Hash2(Mess) of the service information Mess to the quantum CA;

[0057] S112: Quantum CA obtains the hash value 2 sent by the user unit, recorded as hash value 2 Hash2(Mess)′ A , and store.

[0058] In a further embodiment, the receiving unit obtains the service information and signature sent by the user unit, which are recorded as service information Mess′ and signature Sign′ respectively, and performs file verification based on the obtained service information Mess′ and signature Sign′, including:

[0059] S121: The receiving unit obtains the service information and signature sent by the user unit, which are recorded as service information Mess′ and signature Sign′ respectively;

[0060] S122: The receiving unit performs an XOR operation on the signature Sign′ through the third quantum random number T2 to obtain the information digest Dig′, and then obtains the hash value Hash2(Mess)′ and the first quantum random number P′2;

[0061] S123: Generate a new hash function Hash′2 based on a linear shift register based on the first quantum random number P′2 and the second quantum random number S2, and then perform a hash operation on the business information Mess′ to obtain a new hash value Hash′2(Mess′);

[0062] S124: Compare the new hash value Hash′2(Mess′) with the hash value Hash2(Mess)′: If the two are equal, the file verification is successful, and the receiving unit sends the one-time identity identifier OTCA′ in the business information Mess′ and the hash value Hash2(Mess)′ to the quantum CA through the classical authentication channel; otherwise, the file verification fails, and the receiving unit rejects the digital signature.

[0063] In a further embodiment, the process of the quantum CA performing identity authentication includes:

[0064] S131: The quantum CA obtains the one-time identity and hash value 2 sent by the receiving unit, which are recorded as the one-time identity OTCA″ and hash value 2 Hash2(Mess)″ respectively. B ;

[0065] S132: Quantum CA is based on one-time identity OTCA″ and hash value 2 Hash2(Mess)″ B Check whether the one-time identifier OTCA and hash value 2 Hash2(Mess)′ exist in the local storage respectively A The one-time identity identifier OTCA" is equal to the one-time identity identifier OTCA, and the hash value is Hash2(Mess)" BEqual to hash value Hash2(Mess)′ A : If it exists, the authentication succeeds; otherwise, the authentication fails;

[0066] S133: The quantum CA sends the verification result of the identity authentication to the receiving unit through the classical authentication channel. If the verification result of the identity authentication is passed, the receiving unit accepts the digital signature and stores the business information Mess′; otherwise, the receiving unit rejects the digital signature.

[0067] By adopting the above technical solution: performing identity authentication based on the one-time identity and the hash value of the service information, the risk of the receiving unit impersonating the public identity and the one-time identity of the user unit can be avoided.

[0068] In a second aspect, a quantum-safe digital signature verification system is provided, comprising:

[0069] User unit, quantum CA and receiving unit; the user unit and quantum CA generate and share a one-time identification OTCA;

[0070] The user unit is configured to generate service information Mess including a one-time identity identifier OTCA and a hash function, and generate a signature Sign about the service information Mess based on the hash function, and then send the service information Mess and the signature Sign to a receiving unit;

[0071] The receiving unit is configured to obtain the service information and signature sent by the user unit, which are recorded as service information Mess′ and signature Sign′, respectively, and perform file verification based on the obtained service information Mess′ and signature Sign′: if the file verification passes, the receiving unit sends the one-time identity identifier OTCA′ in the service information Mess′ to the quantum CA; otherwise, the receiving unit rejects the digital signature;

[0072] The quantum CA is configured to obtain a one-time identity sent by a receiving unit and record it as a one-time identity OTCA″, and then perform identity authentication based on the one-time identity OTCA″: if the result of the identity authentication is that the verification is passed, the receiving unit accepts the digital signature and stores the business information Mess′; otherwise, the receiving unit rejects the digital signature.

[0073] According to a third aspect, a computer device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the digital signature verification method provided in the first aspect when executing the computer program.

[0074] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the digital signature verification method provided in the first aspect is implemented.

[0075] In a fifth aspect, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the digital signature verification method provided in the first aspect.

[0076] Beneficial effects: The quantum-safe digital signature verification method provided by the present application introduces a one-time identity associated with the privacy identity of the user unit, thereby adding a new variable each time the signature is signed, and then a one-time one-key signature is performed through a hash function based on a linear shift register, and further relies on the irreducible polynomial of the first quantum random number and the second quantum random number to jointly ensure the confidentiality of the signature, so that the security of the digital signature process reaches the quantum security level, and can resist the increasingly powerful classical computing attacks and future disruptive quantum computing attacks. In the signature verification link, on the one hand, the integrity of the business information is verified based on the hash function of the linear shift register; on the other hand, the association and legality are verified based on the one-time identity to ensure the non-repudiation of the digital signature by the user. Compared with the prior art, the digital signature verification method provided by the present application can greatly improve the security and integrity of data transmission, resist attacks and cracking, prevent data from being tampered with or implanted, and ensure the non-repudiation of the signature. At the same time, the signature verification process is simple, and when the identity is authenticated through the quantum CA, there is no need to receive business information, which reduces the memory usage of the quantum CA, reduces the storage burden of the quantum CA, and improves the efficiency of signature verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 This is a schematic diagram of the structure of a quantum-secure digital signature verification system.

[0078] Figure 2 It is a flowchart of the quantum-secure digital signature verification method.

[0079] Figure 3 It is a flow chart of the user unit and quantum CA generating a one-time identity OTCA.

[0080] Figure 4 The present invention is a flowchart of an embodiment of generating a one-time identity OTCA by a user unit and a quantum CA.

[0081] Figure 5 This is a flowchart of the privacy verification process performed by Quantum CA.

[0082] Figure 6 It is a flowchart of the user unit generating a signature.

[0083] Figure 7 It is a flowchart of the receiving unit performing signature verification.

[0084] Figure 8 This is a schematic diagram of the process of Quantum CA identity authentication. DETAILED DESCRIPTION

[0085] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0086] Researchers have found that digital signatures can ensure the confidentiality of information transmission, the integrity of data exchange, the non-repudiation of sent information, and the certainty of the identity of the trader. The existing classical digital signature method mainly uses an asymmetric cryptographic system whose security is based on unproven mathematical calculation problems. With the rapid improvement of classical computing power and the explosive development of quantum algorithms, various signcryption algorithms are gradually being cracked, which means that the classical digital signature method is no longer absolutely safe.

[0087] In order to solve this problem, the applicant previously submitted a Chinese patent application entitled: A quantum key negotiation method, system, quantum digital signature method, system, publication number: CN114244500A, which proposed a quantum digital signature method. However, in this quantum digital signature method, the receiver B needs to send the message and signature to the verifier C, and the verifier C needs to receive a message with a large file size each time it verifies the signature, which will cause the memory resources of the verifier C to be consumed in large quantities, increase the storage burden of the verifier C, and also reduce the verification efficiency of the verifier C.

[0088] To this end, the present application provides a quantum-secure digital signature verification method and system to improve the existing digital signature verification technology.

[0089] Example 1

[0090] This embodiment provides a quantum-safe digital signature verification method. Figure 1 As shown, the implementation of the digital signature verification method relies on a quantum-secure digital signature verification system. The digital signature verification system includes user units, quantum CAs, and receiving units that are interconnected in pairs. User units, quantum CAs, and receiving units are preferably interconnected through a quantum secure network. The quantum secure network mentioned here is a secure communication network constructed by using a quantum communication network and a classical communication network. Among them, the quantum communication network is a secure communication network that uses quantum cryptography. Figure 2In this embodiment, the specific process of digital signature verification will be described in detail in conjunction with the digital signature verification system:

[0091] S11: The user unit and the quantum CA share a one-time identity OTCA.

[0092] Specific, combined Figure 3 First, the user unit submits an application to the quantum CA to obtain an identity. After receiving the application, the quantum CA generates a public identity Pub and a private identity Pri applicable to the user unit, and then provides them to the user unit. In this embodiment, the private identity Pri can be expressed as Pri = [Pub, R]. Wherein, R represents a binary random number, which is generated locally by the quantum CA; [Pub, R] represents the combination of the public identity Pub and the random number R, that is, the splicing of two sets of binary numbers. The process of the quantum CA providing the public identity Pub and the private identity Pri to the user unit can be carried out by online encrypted transmission or by offline copying and duplication. After the user unit obtains the public identity Pub and the private identity Pri, they are stored locally. Correspondingly, the quantum CA also stores the public identity Pub and the private identity Pri locally. It should be emphasized here that in order to ensure security, the private identity Pri must be stored securely to avoid leakage. If leakage occurs, a new private identity Pri should be regenerated immediately. Since the public identity Pub and the private identity Pri are generated based on the same application, the public identity Pub and the private identity Pri naturally construct an index relationship when they are stored. The public identity Pub and the private identity Pri can be binary strings with limited bits. Finally, the user unit generates a one-time identity OTCA based on the locally stored private identity Pri according to preset rules. Among them, the preset rules can be generated by evaluating the private identity Pri using a certain function. In order to ensure that the one-time identity OTCA is different each time the user unit signs, the preset rules used in this embodiment can be identified as: OTCA = F (Pri + Y); in the formula, OTCA is a one-time identity; F () is a hash function; Pri is a private identity; Y is a variable, for example, Y can be a service number, or a random number shared by the user unit and the quantum CA. The sharing of random numbers between the user unit and the quantum CA can be achieved by transmission through a quantum communication network.

[0093] Specifically, in this embodiment, first, the user unit and the quantum CA share an m-bit binary random number S1 and a 2m-bit binary random number T1. The random number T1 is expressed as T1 = [u, v]. In the formula, u and v are both m-bit binary quantum random numbers. And m is a positive integer greater than 0. A preferred solution is that m takes a value of 128.

[0094] Secondly, the user unit locally generates an m-bit binary quantum random number P1, and generates an irreducible polynomial P1(x) based on the random number P1, and then uses the random number S1 as an input random number and the irreducible polynomial P1(x) to generate a hash function Hash1 based on a linear shift register. The generation process of the irreducible polynomial P1(x) is as follows: first, each bit of the m-bit random number P1 is used as the coefficient of each term of the m-order polynomial except the highest term. At this time, the random number P1 can be expressed as (a m-1 ,a m-2 ,···,a1,a0). Further set the highest term coefficient of the polynomial to 1. Then the generated polynomial can be expressed as P1(x)=x m +a m-1 x m-1 +a m-2 x m-2 +···+a1x 1 +a0. It should be noted here that only when a0=1, the generated polynomial can be an irreducible polynomial. Therefore, the last bit of the m-bit random number P1 is 1. The polynomial is further expressed as P1(x)=x m +a m-1 x m-1 +a m-2 x m-2 +···+a1x 1 +1. In addition, the generated polynomial needs to be verified, and the verification process is expressed as verification Is it true? In the formula, the function gcd(a,b) means finding the greatest common divisor of a and b on the GF(2) field, a and b represent any two polynomials; [n / 2] represents the integer of n / 2. If the verification is true, it means that the polynomial P1(x) is an irreducible polynomial. Otherwise, it means that the obtained polynomial P1(x) is not an irreducible polynomial, and it is necessary to regenerate the random number P1 to construct the irreducible polynomial P1(x). After generating the irreducible polynomial P1(x), the user unit uses the random number S1 as the input random number and the irreducible polynomial P1(x) to generate a hash function Hash1 based on a linear feedback shift register.

[0095] Then, the user unit substitutes the privacy identity Pri obtained from the quantum CA into the hash function Hash1 to generate a hash value H1(Pri) about the privacy identity Pri. After obtaining the hash value H1(Pri), the user unit generates a privacy identity verification code Mac based on the hash value H1(Pri). The privacy identity verification code Mac is specifically expressed as Mac=[H1(Pri),P1]⊕T1; where "⊕" represents an exclusive OR operation. Finally, the user unit sends the privacy identity verification code Mac to the quantum CA. The quantum CA receives the privacy identity verification code sent by the user unit and records it as the privacy identity verification code Mac′. In order to better illustrate this embodiment, this embodiment briefly describes the marking of file transmission and reception: it is assumed that unit I transmits file K to unit J, and the file received by unit J may not be exactly the same as that sent by unit I. Therefore, the file received by unit J is set to K′. If the file has not been tampered with or implanted during the transmission process, file K′ is equal to file K; if the file has been tampered with or implanted, file K′ is not equal to file K. Then the quantum CA obtains the privacy authentication code Mac′ and performs privacy verification: if the privacy verification passes, the user unit and the quantum CA obtain the same one-time identity OTCA=H1(Pri)⊕u; if the privacy verification fails, the user unit and the quantum CA re-execute the process of generating the one-time identity OTCA according to the same preset rules as needed.

[0096] Furthermore, the process of privacy verification by quantum CA is described. First, quantum CA receives the privacy authentication code, recorded as the privacy authentication code Mac′, and performs an XOR operation on the privacy authentication code Mac′ through the random number T1 shared with the user unit to obtain a hash value H1(Pri)′ and a random number P′1. The operation process is expressed as: Mac′⊕T1=[H1(Pri)′,P′1]. Then, quantum CA generates an irreducible polynomial P′1(x) based on the random number P′1, and uses the random number S1 shared with the user unit as the input random number and the irreducible polynomial P′1(x) to generate a new hash function based on a linear shift register, Hash′1. Finally, the quantum CA substitutes the locally stored private identity Pri into the hash function Hash′1 to obtain a new hash value H′1(Pri) of the private identity Pri; if the new hash value H′1(Pri) is equal to the hash value H1(Pri)′, the privacy verification passes; if the new hash value H′1(Pri) is not equal to the hash value H1(Pri)′, the privacy verification fails.

[0097] Since the one-time identity OTCA is obtained by performing a hash operation on the private identity Pri through a hash function Hash1 based on a linear feedback shift register. On the one hand, the private identity Pri can be hidden to avoid exposure of the private identity Pri, thereby improving the security of the signature Sign. On the other hand, even if the private identity Pri does not change, the one-time identity OTCA obtained each time is different, thereby ensuring that the one-time identity OTCA changes once, further improving the security of the signature Sign, and facilitating subsequent identity authentication. In addition, while sharing the one-time identity OTCA, the private identity of the sending unit can be verified to ensure the association between the one-time identity and the private identity.

[0098] S12: The user unit generates service information Mess including the one-time identity identifier OTCA.

[0099] Specifically, the user unit generates business information Mess according to the actual business content. The content of business information Mess should include business data Data and the public identity identifier Pub of the user unit. For example, the actual business content sent is that user Alice transfers 100 yuan to user Bob. Then the content of business data Data can be simply expressed as Data = [from: Pub A ;To:Pub B ; Value: 100]; where Pub A Represents the public identity of user Alice; Pub BRepresents the public identity of user Bob. The business information Mess in this embodiment also includes a timestamp Time and / or a business number O. Among them, the timestamp Time identifies the occurrence time of the business data Data, so as to facilitate the authentication of the time of the business data Data to verify whether the business data Data has been tampered with. The business number O is used to identify the occurrence order or number of the business data Data, so as to facilitate the rapid indexing of the business data Data. The business number O here can be the same as the above-mentioned business number Y. In summary, the business information Mess can be expressed as Mess = [Data, PubA, Time, O, OTCA]. The public identity Pub of the user unit is used to mark the generation object of the business data Data, so as to facilitate identity authentication during signature verification. The business information Mess contains a one-time identity OTCA. The one-time identity OTCA is random, so the business information Mess is also random, thereby improving the confidentiality of the business information Mess and improving the security of information transmission. Moreover, even for the same business content, if the subsequent signature verification fails, the business information Mess formed again will be different, and the one-time identity identifier OTCA is associated with the identity information of the user unit, thereby avoiding the possibility of impersonation and improving the authenticity of the digital signature.

[0100] S13: The user unit generates a hash function, and generates a signature Sign about the service information Mess based on the hash function, and then sends the service information Mess and the signature Sign to the receiving unit.

[0101] Specific, combined Figure 4 First, the user unit locally generates a first quantum random number P2 of n bits, and shares a second quantum random number S2 of n bits and a third quantum random number T2 of 2n bits with the receiving unit. The first quantum random number P2, the second quantum random number S2 and the third quantum random number T2 are all in binary. Moreover, n is a positive integer greater than 0, and in this embodiment, n is 128. The sharing of random numbers between the user unit and the receiving unit is also achieved by transmitting through the quantum communication network.

[0102] Then, the user unit generates an irreducible polynomial P2(x) based on the first quantum random number P2. The generation process of the irreducible polynomial P2(x) refers to the process of the irreducible polynomial P1(x), which will not be described here. After generating the irreducible polynomial P2(x), the user unit uses the second quantum random number S2 as the input random number and the irreducible polynomial P2(x) to generate a hash function Hash2 based on a linear feedback shift register. Then the business information Mess is input into the hash function Hash2 to generate a hash value Hash2(Mess). The hash value Hash2(Mess) and the first quantum random number P2 together constitute the information summary Dig. The information summary Dig is expressed as: Dig = [Hash2(Mess), P2]. The information summary Dig is in the form of string concatenation, which can be Hash2(Mess)+P2 or P2+Hash2(Mess), and the signature value of the signature finally obtained is 2n bits.

[0103] Furthermore, the user unit performs an XOR operation on the 2n-bit third quantum random number T2 and the 2n-bit information summary Dig to encrypt the information summary Dig and form a signature Sign: Sign = Dig ⊕ T = [Hash2 (Mess), P2] ⊕ T2; where "⊕" represents an XOR operation. The user unit then sends the service information Mess and the signature Sign to the receiving unit together.

[0104] In the above process, the hash function based on the linear shift register is based on the one-time pad technology, which can greatly improve the security of the digital signature and resist classical computing attacks and future quantum technology attacks. The security of the hash function is ensured by the irreducible polynomial P2(x) and the second quantum random number S2, and the irreducible polynomial S2 depends on the first quantum random number P2; on the other hand, it is guaranteed by introducing a one-time identity identifier OTCA in the business information Mess. That is, at least two variables must be introduced for each signature, one is the first quantum random number P2, and the other is the one-time identity identifier OTCA. Therefore, when the hash function of the linear shift register is used for hash operation, the security of the signature process is guaranteed. Even for the same business data Data, the business information Mess formed twice is different. At the same time, based on the randomness of the first quantum random number P2 and the second quantum random number S2, the attacker cannot know it, thereby improving the confidentiality of the signature. In addition, n in this embodiment is 128. Under the current computer computing power, the probability of a collision is k / (2 128 ), that is, the possibility of cracking exists only at the theoretical level. Wherein, k is the character length of the business information Mess.

[0105] S14: The receiving unit obtains the business information and signature sent by the user unit, recorded as business information Mess′ and signature Sign′ respectively, and performs file verification based on the obtained business information Mess′ and signature Sign′: if the file verification passes, the receiving unit sends the one-time identity identifier OTCA′ in the business information Mess′ to the quantum CA; otherwise, the receiving unit rejects the digital signature.

[0106] Specific, combined Figure 5 First, the receiving unit obtains the business information and signature sent by the user unit, which are recorded as business information Mess′ and signature Sign′ respectively. Secondly, the receiving unit performs an XOR operation on the signature Sign′ through the third quantum random number T2 to obtain the information summary Dig′. The specific operation process is expressed as: Dig′=Sign′⊕T2. This process can be regarded as a process of decrypting the encrypted information summary Dig′. This process can be obtained by XORing the shared third quantum random number T2. There is no need to obtain it through a complex operation process like the prior art, which greatly improves the efficiency of the digital signature verification system for signature verification. After obtaining the information summary Dig′, the hash value Hash2(Mess)′ and the first quantum random number P′2 are obtained.

[0107] Then, the receiving unit generates a new linear shift register-based hash function 2 Hash′2 based on the first quantum random number P′2 and the shared second quantum random number S2. The process of generating the new linear shift register-based hash function 2 Hash′2 can refer to the generation process of the linear shift register-based hash function 1 Hash1, which will not be repeated here. After generating the new linear shift register-based hash function 2 Hash′2, the new hash function 2 Hash′2 is used to perform a hash operation on the business information Mess′ obtained by the receiving unit to obtain a new hash value 2 Hash′2 (Mess′).

[0108] Finally, the receiving unit compares the new hash value Hash′2(Mess′) with the hash value Hash2(Mess)′ in the information digest Dig′ to see if they are equal. If the new hash value Hash′2(Mess′) is equal to the hash value Hash2(Mess)′, it is determined that the file verification of the receiving unit has passed, and the receiving unit sends the one-time identity OTCA′ and the public identity Pub′ in the business information Mess′ to the quantum CA through the classical authentication channel. Since the hash value 2 is obtained by performing a hash operation on the business information, if the verification result shows that the new hash value Hash′2(Mess′) is equal to the hash value Hash2(Mess)′, it can be shown that the received business information Mess` has not been tampered with or implanted with new content, and its integrity is guaranteed, thereby further verifying the integrity of the business data Data. If the new hash value Hash′2(Mess′) is not equal to the hash value Hash2(Mess)′, it is determined that the file verification of the receiving unit has failed, that is, the business information Mess′ received by the receiving unit is not equal to the Mess sent by the user unit, the business information Mess′ has been tampered with, the file is lost or new content is implanted, then the receiving unit directly rejects the digital signature and ends the signature verification process, or re-executes the signature verification process.

[0109] S15: The quantum CA obtains the one-time identity sent by the receiving unit and records it as the one-time identity OTCA″, and then performs identity authentication based on the one-time identity OTCA″: if the result of the identity authentication is verification passed, the receiving unit accepts the digital signature and stores the business information Mess′; otherwise, the receiving unit rejects the digital signature.

[0110] Combination Figure 6,First, the quantum CA obtains the public identity and the one-time identity sent by the ,receiving unit, which are recorded as the public identity Pub″ and the one-time identity OTCA″ respectively. Then, the quantum CA queries whether the corresponding public identity Pub and one-time identity OTCA exist in the local storage based on the public identity Pub″, and when the public identity Pub″ is equal to the public identity Pub, the one-time identity OTCA″ is also equal to the one-time identity OTCA corresponding to the public identity Pub. That is, it is determined whether the quantum CA stores the public identity Pub and the one-time identity OTCA with an index relationship based on the private identity Pri, and the public identity Pub stored by the quantum CA and the received public identity Pub″; at the same time, the stored one-time identity OTCA is also equal to the received one-time identity OTCA″. If it exists, the identity authentication passes; if it does not exist, the identity authentication fails. Finally, the quantum CA sends the verification result of the identity authentication to the receiving unit through the classical authentication channel. If the verification result of the identity authentication is verification passed, the receiving unit accepts the digital signature and stores the business information Mess′; if the verification result of the identity authentication is verification failure, the receiving unit rejects the digital signature and ends the signature verification process, or re-executes the signature verification process.

[0111] The above steps are to further verify the relevance and legitimacy of the one-time identity identifier OTCA′ in the business information Mess′, when the integrity of the business information Mess′ obtained by the receiving unit has been verified. The legitimacy verification is used to verify the accuracy of the one-time identity identifier and the public identity identifier, and the relevance verification is used to verify the association relationship between the one-time identity identifier and the public identity identifier. Through the above verification, it can be clear whether the identity of the user unit that signed is legal, thereby ensuring the user's non-repudiation of the digital signature. In addition, in the above verification process, the receiving unit only needs to send and receive the public identity identifier and the one-time identity identifier OTCA′ to the quantum CA, unlike the existing three-party signature verification, which requires sending the business information to the quantum CA, greatly reducing the memory usage of the quantum CA and alleviating the storage burden of the quantum CA; and, there is no need for three-party key sharing between the user unit, the quantum CA and the receiving unit, which simplifies the steps of digital signature verification, further reduces resource consumption, and improves the efficiency of digital signature verification.

[0112] During the transmission of the business information Mess, the business information Mess may be intercepted, which may lead to the disclosure of the public identity Pub and the one-time identity OTCA in the business information Mess, and the intercepting party may impersonate the public identity Pub and the one-time identity OTCA.

[0113] In order to solve this problem, this scheme proposes two solutions: First, the one-time identity identifier OTCA is set to be able to perform only one successful identity authentication. That is, when the quantum CA passes the identity authentication of the verification business information Mess′ and the one-time identity identifier OTCA′ sent by the receiving unit, it is prohibited to call the stored one-time identity identifier OTCA again for identity authentication, or directly erase the stored one-time identity identifier OTCA. Even if other users use the public identity identifier Pub and the one-time identity identifier OTCA in the future, they cannot be verified, thus avoiding the situation of misappropriation. Second, the one-time identity identifier OTCA is set to start timing after it is generated. If the timing exceeds the preset time threshold, the one-time identity identifier OTCA will become invalid. By setting a time limit for the expiration of the one-time identity identifier OTCA, it is ensured that the one-time identity identifier OTCA stored by the quantum CA can only be authenticated within the preset time threshold. Thereby, the receiving unit is prompted to send the one-time identity identifier OTCA′ for identity authentication even if the quantum CA sends the one-time identity identifier OTCA′, reducing the risk of other users intercepting and impersonating the public identity identifier Pub and the one-time identity identifier OTCA to forge business information Mess for signature verification, thereby improving the security of signature verification. Of course, these two schemes can be used separately or together.

[0114] Example 2

[0115] The specific technical solution of Example 1 is based on the fact that the receiving unit can perform file verification and identity verification in a timely manner after obtaining the business information. Therefore, as long as the receiving unit is honest, the efficiency of signature verification can be improved while ensuring the security of the signature verification process. Of course, although we have ensured the security of the signature process through various technical means, as long as the receiving unit has subjective malice, it is very likely to cause security risks in signature verification.

[0116] For example, after receiving the service information Mess' sent by the user unit A, the receiving unit B directly obtains the one-time identity identifier OTCA' and the public identity Pub' in the service information Mess'. However, at this time, the receiving unit B does not authenticate the identity of the quantum CA, but instead reconstructs a new service information Mess by impersonating the identity of the user unit. B Then, it is sent to another receiving unit C. At this time, receiving unit B becomes the new sender and sends the service message Mess in the name of user unit A. B The receiving unit C receives the service information Mess BAfter that, it will think that it is sent by user unit A; and even if receiving unit C authenticates the identity of quantum CA, quantum CA will misjudge, which will lead to security risks of signature verification and ultimately security loopholes in the entire business process. Therefore, it is necessary to optimize the technical solution of embodiment 1.

[0117] This embodiment provides a quantum-safe digital signature verification method. Figure 1 As shown, the implementation of the digital signature verification method relies on a quantum-safe digital signature verification system. The digital signature verification system includes user units, quantum CAs, and receiving units that are interconnected in pairs. The user units, quantum CAs, and receiving units are preferably interconnected through a quantum-safe network. For details, please refer to the technical solution of Example 1. Below, this embodiment will describe in detail the specific process of digital signature verification in conjunction with the digital signature verification system:

[0118] S11: The user unit and the quantum CA share a one-time identity OTCA.

[0119] The same as the technical solution of Example 1, before the user unit and the quantum CA generate a shared one-time identity OTCA, the user unit submits an application for obtaining an identity to the quantum CA. After receiving the application, the quantum CA generates a public identity Pub and a private identity Pri applicable to the user unit. The specific process is referred to Example 1. Then, a one-time identity OTCA is generated based on the private identity Pri.

[0120] First, the user unit and quantum CA share an m-bit binary random number S1 and a 2m-bit binary random number T1. The random number T1 is expressed as T1 = [u, v]. In the formula, u and v are both m-bit binary quantum random numbers. And m is a positive integer greater than 0. A preferred solution is that m takes the value of 128.

[0121] Secondly, the user unit locally generates an m-bit binary quantum random number P1, and generates an irreducible polynomial P1(x) based on the random number P1, and then uses the random number S1 as an input random number and the irreducible polynomial P1(x) to generate a hash function Hash1 based on a linear shift register. For the specific process, refer to the technical solution of Example 1.

[0122] Then, the user unit substitutes the private identity Pri obtained from the quantum CA into the hash function Hash1 to generate a hash value H1(Pri) about the private identity Pri. After obtaining the hash value H1(Pri), the user unit generates a private identity verification code Mac based on the hash value H1(Pri). The private identity verification code Mac is specifically expressed as Mac=[H1(Pri),P1]⊕T1; where “⊕” represents an exclusive OR operation. Finally, the user unit sends the private identity verification code Mac to the quantum CA. The quantum CA receives the private identity verification code sent by the user unit and records it as the private identity verification code Mac′.

[0123] Then, the quantum CA performs an XOR operation on the privacy authentication code Mac′ through the random number T1 shared with the user unit to obtain a hash value H1(Pri)′ and a random number P1′. The operation process is expressed as: Mac′⊕T1=[H1(Pri)′,P′1]. Then, the quantum CA generates an irreducible polynomial P′1(x) based on the random number P′1, and uses the random number S1 shared with the user unit as the input random number and the irreducible polynomial P′1(x) to generate a new hash function Hash′1 based on a linear shift register. Finally, the quantum CA substitutes the locally stored privacy identity Pri into the hash function Hash′1 to obtain a new hash value H′1(Pri) about the privacy identity Pri; if the new hash value H′1(Pri) is equal to the hash value H1(Pri)′, the privacy verification is passed, and the user unit and the quantum CA obtain the same one-time identity OTCA=H1(Pri)⊕u. In addition, the user unit and the quantum CA securely store the one-time identity OTCA respectively. If the new hash value H′1(Pri) is not equal to the hash value H1(Pri)′, the privacy verification fails. Then, as needed, the user unit and the quantum CA re-execute the process of generating a one-time identity OTCA using the same preset rules.

[0124] S12: The user unit generates service information Mess including the one-time identity identifier OTCA.

[0125] Specifically, the user unit generates business information Mess according to the actual business content to be sent. The content of business information Mess should include business data Data and the public identity Pub of the user unit. Of course, business information Mess can also include timestamp Time and / or business number O, as well as other necessary or unnecessary business information, to ensure the details of the information in business information Mess as much as possible. Of course, the most important thing is that the business information Mess must contain a one-time identity OTCA. On the one hand, the one-time identity OTCA is obtained based on the private identity Pri, so it has the function of identifying the identity, avoiding the possibility of impersonation, and preparing for subsequent signatures. On the other hand, the generation of the one-time identity OTCA is random, that is, the OTCA generated each time is different, so the business information Mess is also random, that is, for the same business content, if the subsequent signature verification fails, the business information Mess formed again is also different, thereby improving the confidentiality of the business information Mess and improving the security of information transmission.

[0126] S13: The user unit generates a hash function, and generates a signature Sign about the service information Mess based on the hash function, and then sends the service information Mess and the signature Sign to the receiving unit.

[0127] First, the user unit locally generates a first quantum random number P2 of n bits, and shares a second quantum random number S2 of n bits and a third quantum random number T2 of 2n bits with the receiving unit. The first quantum random number P2, the second quantum random number S2 and the third quantum random number T2 are all in binary. In addition, n is a positive integer greater than 0, and in this embodiment, n is 128. The sharing of random numbers between the user unit and the receiving unit is also achieved by transmitting through the quantum communication network.

[0128] Then, the user unit generates an irreducible polynomial P2(x) based on the first quantum random number P2. After generating the irreducible polynomial P2(x), the user unit uses the second quantum random number S2 as an input random number together with the irreducible polynomial P2(x) to generate a hash function Hash2 based on a linear feedback shift register. Then the business information Mess is input into the hash function Hash2 to generate a hash value Hash2(Mess). The hash value Hash2(Mess) and the first quantum random number P2 together constitute the information summary Dig. The information summary Dig is expressed as: Dig = [Hash2(Mess), P2].

[0129] Furthermore, the user unit performs an XOR operation on the 2n-bit third quantum random number T2 and the 2n-bit information summary Dig to encrypt the information summary Dig and form a signature Sign: Sign = Dig ⊕ T2 = [Hash2 (Mess), P2] ⊕ T2; where "⊕" represents an XOR operation. The user unit then sends the service information Mess and the signature Sign to the receiving unit together.

[0130] S14: The user unit sends the hash value Hash2(Mess) of the service information Mess to the quantum CA through the classical authentication channel; the quantum CA obtains the hash value Hash2 sent by the user unit, which is recorded as the hash value Hash2(Mess)′ A , and store.

[0131] S15: The receiving unit obtains the business information and signature sent by the user unit, recorded as business information Mess′ and signature Sign′ respectively, and performs file verification based on the obtained business information Mess′ and signature Sign′: if the file verification passes, the receiving unit sends the one-time identity identifier OTCA′ in the business information Mess′ to the quantum CA; otherwise, the receiving unit rejects the digital signature.

[0132] Specific, combined Figure 5First, the receiving unit obtains the service information and signature sent by the user unit, which are recorded as service information Mess′ and signature Sign′ respectively. Secondly, the receiving unit performs an XOR operation on the signature Sign′ through the third quantum random number T2 to obtain the information summary Dig′. The specific operation process is expressed as: Dig′=Sign′⊕T2. After obtaining the information summary Dig′, the hash value Hash2(Mess)′ and the first quantum random number P′2 are obtained. Then, the receiving unit generates a new hash function Hash′2 based on a linear shift register based on the first quantum random number P′2 and the shared second quantum random number S2. The new hash function Hash′2 is used to perform a hash operation on the service information Mess′ obtained by the receiving unit to obtain a new hash value Hash′2(Mess′). Finally, the receiving unit compares whether the new hash value Hash′2(Mess′) is equal to the hash value Hash2(Mess)′ in the information summary Dig′. If the new hash value Hash′2(Mess′) is equal to the hash value Hash2(Mess)′, it is determined that the file verification of the receiving unit is passed, and the receiving unit sends the one-time identity identifier OTCA′ in the business information Mess′ and the hash value Hash2(Mess)′ to the quantum CA through the classical authentication channel. If the new hash value Hash′2(Mess′) is not equal to the hash value Hash2(Mess)′, it is determined that the file verification of the receiving unit has failed, and the receiving unit directly rejects the digital signature and ends the signature verification process, or re-executes the signature verification process.

[0133] S16: The quantum CA obtains the one-time identity sent by the receiving unit and records it as the one-time identity OTCA″, and then performs identity authentication based on the one-time identity OTCA″: if the result of the identity authentication is verification passed, the receiving unit accepts the digital signature and stores the business information Mess′; otherwise, the receiving unit rejects the digital signature.

[0134] Specifically, the quantum CA obtains the one-time identity and hash value 2 sent by the receiving unit, which are recorded as the one-time identity OTCA″ and hash value 2 Hash2(Mess)″ respectively. B Then, the quantum CA is based on the one-time identity OTCA″ and the hash value Hash2(Mess)″ B Check whether the one-time identifier OTCA and hash value 2 Hash2(Mess)′ exist in the local storage respectively A The one-time identity identifier OTCA" is equal to the one-time identity identifier OTCA, and the hash value is Hash2(Mess)" B Equal to hash value Hash2(Mess)′ A:If it exists, the identity authentication is passed; otherwise, the identity authentication fails. The quantum CA sends the identity authentication result to the receiving unit through the classical authentication channel. If the identity authentication result is passed, the receiving unit accepts the digital signature and stores the business information Mess′; otherwise, the receiving unit rejects the digital signature.

[0135] In this embodiment, compared with the technical solution of embodiment 1, the technical solution of this embodiment performs identity authentication based on a one-time identity and a hash value 2 of the service information. When the user unit sends the service information Mess containing the one-time identity identifier OTCA to the receiving unit, the hash value Hash2(Mess) of the service information Mess is sent to the quantum CA. Even if the receiving unit maliciously uses the identity of the user unit to construct a new service information Mess B , but it is impossible to impersonate the hash value Hash2(Mess) of the original business information Mess. Therefore, the new receiving unit receives the business information Mess sent by the original receiving unit. B After that, when the identity is authenticated to the quantum CA again, it will fail to pass the verification, thus effectively avoiding the risk of the receiving unit impersonating the public identity and one-time identity of the user unit. In addition, since the hash value obtained by hashing different input values ​​using the hash function based on the linear shift register is sent with a collision probability no greater than k / (2 128 ), k is the character length of the business information Mess. Therefore, when the quantum CA stores the one-time identity identifier OTCA and the hash value Hash2(Mess) of the business information Mess, they can be stored separately without considering the mapping relationship between the two, thereby further simplifying the comparison process of subsequent identity authentication.

[0136] Example 3

[0137] This embodiment provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the digital signature verification method in the above-mentioned embodiment 1 or 2 when executing the computer program.

[0138] Example 4

[0139] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the digital signature verification method in the above-mentioned embodiment 1 or 2 is implemented.

[0140] Example 5

[0141] This embodiment provides a computer program product, including a computer program, which implements the digital signature verification method in the above-mentioned embodiment 1 or 2 when executed by a processor.

[0142] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A quantum-safe digital signature verification method, characterized in that: include: S11: The user unit and the quantum CA share a one-time identity OTCA; S12: The user unit generates service information Mess including a one-time identity identifier OTCA; S13: The user unit generates a hash function, and generates a signature Sign about the service information Mess based on the hash function, and then sends the service information Mess and the signature Sign to the receiving unit; S14: The receiving unit obtains the service information and signature sent by the user unit, which are respectively recorded as service information Mess ′ and signature Sign′, and based on the acquired business information Mess ′ and signature Sign′ for file verification: If the file verification passes, the receiving unit will send the business information Mess ′ One-time ID in OTCA ′ Send to quantum CA; otherwise, the receiving unit rejects the digital signature; S15: Quantum CA obtains the one-time identity sent by the receiving unit and records it as the one-time identity OTCA″, and then performs identity authentication based on the one-time identity OTCA″: If the result of the identity authentication is verification passed, the receiving unit accepts the digital signature and stores the business information Mess ′ ; Otherwise, the receiving unit rejects the digital signature; The process of generating a shared one-time identity OTCA by the user unit and the quantum CA includes: S21: The user unit submits an application for obtaining an identity to the quantum CA; S22: The quantum CA generates a public identity Pub and a private identity Pri based on the application, and then provides them to the user unit; S23: The user unit and the quantum CA locally store the public identity Pub and the private identity Pri respectively; S24: The user unit and the quantum CA generate a one-time identity OTCA based on the locally stored privacy identity Pri using the same preset rules; The process in which the user unit and the quantum CA generate a one-time identity identifier OTCA based on the locally stored privacy identity identifier Pri using the same preset rules includes: S31: The user unit and the quantum CA share an m-bit binary random number S1 and a 2m-bit binary random number T1, where the random number T1 is expressed as T1=[u, v], where u and v are both m-bit binary random numbers, and m is a positive integer greater than 0; S32: The user unit locally generates an m-bit random number P1, and generates an irreducible polynomial P1(x) based on the random number P1, and then uses the random number S1 as an input random number and the irreducible polynomial P1(x) to generate a hash function Hash1 based on a linear shift register; S33: The user unit substitutes the private identity Pri obtained from the quantum CA into a hash function Hash1 to generate a hash value H1(Pri) of the private identity Pri; S34: The user unit generates a privacy authentication code Mac based on the hash value H1(Pri), wherein the privacy authentication code Mac is expressed as Mac=[H1(Pri), P1]⊕T1, and sends the privacy authentication code Mac to the quantum CA; S35: The quantum CA receives the privacy authentication code, recorded as the privacy authentication code Mac′, and performs privacy verification: if the verification is successful, the user unit and the quantum CA obtain the same one-time identity OTCA=H1(Pri)⊕u; otherwise, the user unit and the quantum CA re-execute the process of generating the one-time identity OTCA with the same preset rules; The user unit generates a hash function, generates a signature Sign about the service information Mess based on the hash function, and then sends the service information Mess and the signature Sign to the receiving unit. The process is as follows: S81: The user unit locally generates a first quantum random number P2 of n bits, and shares a second quantum random number S2 of n bits and a third quantum random number T2 of 2n bits with the receiving unit; S82: The user unit generates an irreducible polynomial P2(x) based on the first quantum random number P2, and generates a hash function Hash2 based on a linear shift register by using the irreducible polynomial P2(x) and the second quantum random number S2; S83: The user unit generates an information digest Dig about the service information Mess based on the second hash function Hash2, and the information digest Dig is expressed as: Dig = [Hash2 (Mess), P2], where Hash2 (Mess) represents a hash value 2 obtained by performing a hash operation on the service information Mess through the second hash function Hash2; S84: The user unit uses the third quantum random number T2 to perform an XOR operation on the information summary Dig to generate a signature Sign, and then sends the service information Mess and the signature Sign to the receiving unit; The digital signature verification method further comprises: S111: The user unit sends the hash value Hash2(Mess) of the service information Mess to the quantum CA; S112: Quantum CA obtains the hash value 2 sent by the user unit, recorded as hash value 2 Hash2 (Mess) ′ A , and store; The receiving unit obtains the service information and signature sent by the user unit, which are respectively recorded as service information Mess ′ and signature Sign′, and based on the acquired business information Mess ′ The process of document verification with signature Sign′ includes: S121: The receiving unit obtains the service information and signature sent by the user unit, which are respectively recorded as service information Mess ′ and signature Sign′; S122: The receiving unit performs an XOR operation on the signature Sign′ through the third quantum random number T2 to obtain the information summary Dig′, and then obtains the hash value Hash2(Mess)′ and the first quantum random number P2 ′ ; S123: Based on the first quantum random number P2 ′ And the second quantum random number S2 generates a new hash function based on linear shift register ′ 2. Then Mess the business information ′ Perform hash operation to obtain a new hash value ′ 2(Mess ′ ); S124: The newest hash value Hash ′ 2(Mess ′ ) and hash value Hash2(Mess)′: If the two are equal, the file verification is passed, and the receiving unit sends the business information Mess ′ One-time ID in OTCA ′ And the hash value Hash2(Mess)′ is sent to the quantum CA through the classical authentication channel; otherwise, the file verification fails and the receiving unit rejects the digital signature; The process of identity authentication based on the one-time identity identifier OTCA″ includes: S131: Quantum CA obtains the one-time identity and hash value 2 sent by the receiving unit, which are recorded as one-time identity OTCA″ and hash value 2 Hash2(Mess) respectively. ′ B ′ ; S132: Quantum CA based on one-time identity OTCA″ and hash value Hash2(Mess) ′ B ′ Check whether the one-time identifier OTCA and hash value 2 Hash2(Mess) exist in the local storage respectively ′ A The one-time identity identifier OTCA″ is equal to the one-time identity identifier OTCA, and the hash value is Hash2(Mess) ′ B ′ Equal to hash value Hash2(Mess) ′ A : If it exists, the authentication succeeds; otherwise, the authentication fails; S133: The quantum CA sends the verification result of the identity authentication to the receiving unit through the classical authentication channel. If the verification result of the identity authentication is passed, the receiving unit accepts the digital signature and stores the business information Mess ′ ; Otherwise, the receiving unit rejects the digital signature.

2. The quantum-safe digital signature verification method according to claim 1, characterized in that: The quantum CA receives the privacy authentication code, recorded as the privacy authentication code Mac′, and performs privacy verification, including: S41: The quantum CA receives the privacy authentication code, recorded as the privacy authentication code Mac′, and performs an XOR operation on the privacy authentication code Mac′ through the random number T1 to obtain the hash value H1(Pri)′ and the random number P1 ′ ; S42: Quantum CA based on random number three P1 ′ Generate irreducible polynomial P1 ′ (x), then based on the irreducible polynomial P1 ′ (x) and a random number S1 generate a new hash function based on a linear shift register, Hash ′ 1; S43: Quantum CA substitutes the locally stored private identity Pri into the hash function Hash ′ 1 Obtain a new hash value H for the private identity Pri ′ 1(Pri); if the new hash value is H ′ 1(Pri) is equal to the hash value -H1(Pri)′, the privacy verification passes; otherwise, the privacy verification fails.

3. The quantum-safe digital signature verification method according to claim 1, characterized in that: The one-time identity tag OTCA is configured to start timing after it is generated. If the timing exceeds a preset time threshold, the one-time identity tag OTCA becomes invalid.

4. The quantum-safe digital signature verification method according to claim 1, characterized in that: The service information Mess includes service data Data and a public identity Pub of the user unit.

5. The quantum-safe digital signature verification method according to claim 1, characterized in that: The service information Mess includes a timestamp Time and / or a service number O.

6. A system based on the quantum-safe digital signature verification method according to claim 1, characterized in that: include: User unit, quantum CA and receiving unit; the user unit and quantum CA generate and share a one-time identification OTCA; The user unit is configured to generate service information Mess including a one-time identity identifier OTCA and a hash function Hash, and generate a signature Sign about the service information Mess based on the hash function Hash, and then send the service information Mess and the signature Sign to a receiving unit; The receiving unit is configured to obtain the service information and signature sent by the user unit, which are respectively recorded as service information Mess ′ and signature Sign′, and based on the acquired business information Mess ′ and signature Sign′ for file verification: If the file verification passes, the receiving unit will send the business information Mess ′ One-time ID in OTCA ′ Send to quantum CA; otherwise, the receiving unit rejects the digital signature; The quantum CA is configured to obtain a one-time identity sent by a receiving unit and record it as a one-time identity OTCA″, and then perform identity authentication based on the one-time identity OTCA″: if the result of the identity authentication is that the authentication is passed, the receiving unit accepts the digital signature and stores the business information Mess ′ ; Otherwise, the receiving unit rejects the digital signature.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the digital signature verification method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the digital signature verification method according to any one of claims 1 to 5 is implemented.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the digital signature verification method described in any one of claims 1 to 5 is implemented.

Images