Double-signature and multi-signature method
Through the dual signature and multi-signature method, the private key B and proxy digital certificate C are used to solve the compatibility and signature authorization problems during the transition of the cryptographic algorithm, and the compatibility of the old algorithm and the authenticity verification of the signature are realized.
Patent Information
- Application Number
- CN202510619437.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-14
- Publication Date
- 2025-08-05
AI Technical Summary
It is difficult for existing digital signature technologies to support the compatibility of old and new algorithms at the same time during the transition of cryptographic algorithms, and it is difficult to ensure the authenticity and authorization of signatures.
The dual signature method and the multi-signature method are adopted to generate the digital signature sB by using the private key B, and a new key pair C is generated using the digital signature sB and the key pair A. Combined with the proxy digital certificate C, the compatibility and authorization of the signature are ensured.
It realizes compatibility and authenticity verification of signatures during the transition of cryptographic algorithms, ensures the validity and authorization of signatures, and is suitable for systems and applications of different cryptographic algorithms.
Smart Images
Figure CN120433925A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of cryptography technology, and particularly relates to a method for dual signature and multi-signature of messages. Background Art
[0002] At present, the application of digital signature technology faces two problems: First, the transition of cryptographic algorithms. For example, the transition from foreign cryptographic algorithms to domestic cryptographic algorithms, and the transition from non-quantum-resistant cryptographic algorithms to quantum-resistant cryptographic algorithms (i.e., PQC algorithms, Post Quantum Cryptography algorithms). The corresponding problems are: How to enable cryptographic technologies and cryptographic applications using existing cryptographic algorithms to continue to be used during the transition period, and at the same time enable the target cryptographic algorithms and new cryptographic algorithms to be transitioned to be applied; Second, during the application process of digital signature, how to ensure that the digital signature is recognized and authorized by the signer (the owner of the signature private key), that is, the digital signature is an expression of the true intention of the signer and is not forged. Summary of the Invention
[0003] The purpose of the present invention is to propose a solution to the problems of cryptographic algorithm transition and user authorization faced by digital signature technology.
[0004] For the purpose of the present invention, the technical solutions proposed by the present invention include a dual signature method and a multi-signature method. The dual signature method is as follows.
[0005] (For example, a user) has key pairs A and B. Key pair A corresponds to public key A and private key A, and key pair B corresponds to public key B and private key B; Key pair A corresponds to a digital certificate A; The cryptographic algorithms corresponding to key pair A and key pair B are the same or different; When it is necessary to use the private key (such as that of a user) to digitally sign message M, the cryptographic component or system (such as that of a user) first uses private key B to digitally sign message M, generating digital signature s B , and then uses digital signature s B and key pair A (private key A) to generate or (derive) a new key pair C (new private key C). Among them, key pair C corresponds to public key C and private key C, and the cryptographic algorithm corresponding to key pair C is the same as that of key pair A; Then the cryptographic component or system uses private key C to digitally sign message M, generating digital signature s C , and then uses private key A to sign and generate a proxy digital certificate C. The subject public key of proxy digital certificate C is public key C, and proxy digital certificate C contains digital signature s Band the public key B or the identification information of the public key B (such as the user name of the FIDO key, the distinguished name of the public key certificate, the serial number of the public key certificate) (for example, storing this information in the custom or extended defined extension field of the proxy digital certificate), the proxy digital certificate C is transmitted and saved together with the signed message M, and the signed message M contains / includes the digital signature s C (The proxy digital certificate C is usually transmitted and saved together with the signed message M as part of the formatted signed message M, and the formatted signed message M, such as the message in the Cryptographic Message Syntax format, that is, CMS); The digital signature is a signature value or a composite data composed of multiple data containing the signature value; The cryptographic component or system is a software or hardware or a combination of software and hardware component or system that provides cryptographic functions (such as cryptographic operations, key generation).
[0006] For the double-signature method described above, the digital signature s C is transmitted and saved together with the message M as the normal digital signature of the message M, while the digital signature s B is included in the proxy digital certificate C as the auxiliary signature of the message M; the so-called normal digital signature here is the digital signature accepted by the application / system without or regardless of the key pair B; the auxiliary signature is only used when needed.
[0007] For the double-signature method described above, if the key pair B is a FIDO (Fast Identity Online) key pair, the private key B (that is, the FIDO private key) digitally signs the hash value of the message M, that is, the hash value of the message M is used as the FIDO hash value / challenge code (such as the clientDataHash of FIDO2, the Challenge of FIDO1, and the hash value is also called the hash value, the hash value) and is digitally signed by the FIDO Authenticator using the private key B (that is, the FIDO private key) in the FIDO manner.
[0008] For the double-signature method described above, further, in order to bind the key pair B and the key pair C, the proxy digital certificate C also contains the digital signature s of the information in the proxy digital certificate C using the private key B BP (for example, storing the digital signature s BP in the custom or extended defined extension field of the proxy digital certificate C), and the content covered by digitally signing the information in the proxy digital certificate C using the private key B does not include the digital signature s of the proxy digital certificate C by the private key A in the proxy digital certificate C A(i.e., excluding the signature field of the certificate), and before the signature verification program of the signature verification party verifies the validity of the digital signature s B using the public key B, it first verifies the validity of the digital signature s BP using the public key B.
[0009] For the double-signature method described above, if the digital signature for data using the private key A is performed in a password collaborative computing manner (e.g., sharing the private key A or the secret of the private key A based on secret sharing, and the holders of the secret shares generate the digital signature through password collaborative computing, and the present invention does not directly use the private key A to digitally sign the message M), then when digitally signing the message M, the private key A and the digital signature s B are not directly used to generate or (derive) the private key C, and the private key C is not directly used for digital signature. Instead, the private key C is generated or derived implicitly using the digital signature s B , and then the private key C is used to perform digital signature calculation for the message M in a password collaborative computing manner to generate the digital signature s C ; the implicit generation or derivation of the private key C means that a calculation or derivation formula for the private key C is predetermined, but the private key C is not directly calculated (because the private key C cannot be directly calculated, such as due to secret sharing; this calculation or derivation formula for the private key C is the basis for password collaborative computing).
[0010] For the double-signature method described above, if the signature verification party only needs to verify the digital signature of the private key C for the message M (e.g., the verification party's program only supports the cryptographic algorithm of the key pair C, i.e., the key pair A, or there has not been a signature permission or authorization dispute), then the signature verification program of the signature verification party (after completing the verification of the validity of the certificate trust chain and the proxy digital certificate C) obtains the public key C from the proxy digital certificate C, and then uses the public key C to verify the validity of the digital signature s C for the message M (at this time, the application does not care about or know the key pair B, nor does it care about or know how the key pair C is generated. The application / signature verification program processes the proxy digital certificate C and the digital signature s C generated by the private key C in the usual manner); [[ID= to verify the digital signature of the private key B for the message M (e.g., the signature verification program of the verification party supports the cryptographic algorithm of the key pair B and only cares about the digital signature generated by the private key B), then the signature verification program of the signature verification party obtains the digital signature s B from the proxy digital certificate C, obtains the public key B from the proxy digital certificate C, or obtains the public key B using the identification information of the public key B in the proxy digital certificate C, and then uses the public key B to verify the validity of the digital signature s B for the message M; If the signature verification party needs to verify the digital signature s of the private key C for the message M C and the digital signature s of the private key B for the message M B as valid associated digital signatures (for example, to confirm the digital signature s for the message M C obtained the authorization of the user through the private key B), then the signature verification program of the signature verification party performs the following operations (the order is irrelevant): Obtain the digital signature s from the proxy digital certificate C B , obtain the public key B from the proxy digital certificate C or obtain the public key B using the identification information of the public key B in the proxy digital certificate C, and verify the validity of the digital signature s using the public key B B ; Obtain the public key C from the proxy digital certificate C, and verify the validity of the digital signature s using the public key C C ; Generate or (derive) the public key C using the public key A and the digital signature s B (generate the public key C corresponding to the private key C in the case of unknown private key C), check whether the generated public key C is consistent with the subject public key C in the proxy digital certificate C, if consistent, the public key C passes the verification, otherwise it fails; If all three verifications mentioned above pass, the digital signature verification passes, otherwise it fails.
[0011] By expanding the above-mentioned dual-signature method, the following multi-signature method can be obtained.
[0012] (such as a user) has key pairs A and B1,.., B m , where the key pair A corresponds to the public key A and the private key A, and the key pair B i corresponds to the public key B i and the private key B i , i = 1,..., m, m is an integer greater than 1; the key pair A corresponds to a digital certificate A; the key pairs A, B1,.., B m correspond to the same or different cryptographic algorithms; When it is necessary to use the private key (such as the user's) to digitally sign the message M, the cryptographic component or system (such as the user's) first uses the private keys B1,..., B m to digitally sign the message M, and respectively generate digital signatures s B1 ,.., s Bm , and then use the digital signatures s B1 ,.., s BmGenerate or (derive) a new key pair C (or private key C) from the combined data (such as the hash value of the combined data) and the key pair A (or private key A), where the key pair C corresponds to a public key C and a private key C, and the cryptographic algorithm corresponding to the key pair C is the same as that of the key pair A; then use the private key C to digitally sign the message M to generate a digital signature s C , and then use the private key A to sign and generate a proxy digital certificate C. The subject public key of the proxy digital certificate C is the public key C, and the proxy digital certificate C contains the digital signature s B1 ,.., s Bm and the public key B i or the public key B i The identification information (such as the user name of the FIDO key, the alias of the public key certificate, the serial number of the public key certificate) (for example, store these information in the custom or extended defined extension field of the proxy digital certificate C), i = 1,..., n; the proxy digital certificate C is transmitted and saved together with the signed message M, and the signed message M contains / includes the digital signature s C (The proxy digital certificate C is usually transmitted and saved together with the signed message M as part of the formatted signed message M. The formatted signed message M, such as the Cryptographic Message Syntax message, i.e., CMS); The digital signature is a signature value or a composite data composed of multiple data including the signature value; The cryptographic component or system is a software or hardware or a combination of software and hardware component or system that provides cryptographic functions (such as cryptographic operations, key generation).
[0013] For the multi-signature method described above, the digital signature s C is transmitted and saved together with the message M as the normal digital signature of the message M, and the digital signature s B1 ,.., s B1 is included in the proxy digital certificate C as the auxiliary signature of the message M; the so-called normal digital signature here is the digital signature when the application / system accepts without considering the key pair B1,..., the key pair B m ; the auxiliary signature is only used when needed.
[0014] For the multi-signature method described above, if the key pair B i is a FIDO (Fast Identity Online) key pair, then the private key B i (i.e., the FIDO private key B iPerform a digital signature on the hash value of message M, that is, the hash value of message M is used as the FIDO hash value / challenge code (such as the clientDataHash of FIDO2, the Challenge of FIDO1, and the hash value is also called the hash value or digest value), and the FIIDO Authenticator uses the private key B i (i.e., the FIDO private key) to sign in the FIDO manner, where i = 1, …, or m.
[0015] Furthermore, for the multi-signature method described above, the proxy digital certificate C also contains a digital signature s i of the information in the proxy digital certificate C using the private key B BPi , where i = 1, …, m, and the content covered by the digital signature of the information in the proxy digital certificate C using the private key B i does not include the digital signature s A of the proxy digital certificate C by the private key A in the proxy digital certificate C (i.e., the certificate signature); before the signature verification program of the signature verification party uses the public key B i to verify the validity of the digital signature s Bi , it first uses the public key B i to verify the validity of s BPi , where i = 1, …, m.
[0016] For the multi-signature method described above, if the digital signature of data using the private key A adopts a password collaborative computing method (such as sharing the private key A or the secret of the private key A based on secret sharing, and the secret share holders generate the digital signature through password collaborative computing), then when performing the digital signature on message M, the combined data of the digital signatures s B1 ,.., s Bm is not directly used to generate or (derive) the private key C together with the private key A, and the private key C is not directly used for digital signature. Instead, the combined data of the digital signatures s B1 ,.., s Bm is used to implicitly generate or derive the private key C, and then the private key C is used to perform digital signature calculation on message M in a password collaborative computing manner to generate the digital signature s C . The implicit generation or derivation of the private key C means that there is a calculation or derivation formula for the private key C determined in advance, but the private key C is not directly calculated (because the private key C cannot be directly calculated, such as due to secret sharing, and this calculation or derivation formula of the private key C is the basis of password collaborative computing).
[0017] For the multi-signature method described above, if the signature verification party only needs to verify the digital signature of the private key C for the message M (for example, the verification party's program only supports the cryptographic algorithm of the key pair C, that is, the key pair A, or there is no signature authorization dispute), then the signature verification program of the signature verification party (after completing the verification of the certificate trust chain and the validity of the proxy digital certificate C) obtains the public key C from the proxy digital certificate C, and then uses the public key C to verify the digital signature s of the message M C for validity (at this time, the application does not care about or know the key pair B, nor does it care about or know how the key pair C is generated. The application / signature verification program processes the proxy digital certificate C and the digital signature generated by the private key C in the usual way); If the signature verification party only needs to verify the private key B i for the digital signature of the message M (for example, the signature verification program of the verification party supports the cryptographic algorithm of the key pair B i and only cares about the signature generated by the private key B i ), i = 1,..., or m, then the signature verification program of the signature verification party obtains the digital signature s Bi from the proxy digital certificate C, obtains the public key B i from the proxy digital certificate C, or obtains the public key B i using the identification information of the public key B in the proxy digital certificate C i , and then uses the public key B i to verify the validity of the digital signature s of the message M Bi ; If the signature verification party needs to verify that the digital signature s of the private key C for the message M C and the digital signature s of the private key B i for the message M Bi are valid associated digital signatures (for example, to confirm that the digital signature s of the message M C has obtained the authorization of a certain / all users through the private key B i ), i = 1,..., m, then the signature verification program of the signature verification party performs the following operations (the order is irrelevant): Obtain the digital signature s Bi from the proxy digital certificate C, obtain the public key B i from the proxy digital certificate C or obtain the public key B i using the identification information of the public key B in the proxy digital certificate C i , use the public key B i to verify the validity of the digital signature s Bi , i = 1,..., m; Obtain the public key C from the proxy digital certificate C, and use the public key C to verify the validity of the digital signature s C ; Using the digital signature sB1 , …, s B1 Generate public key C using the combined data of B1 and public key A (generate the public key C corresponding to private key C without knowing private key C), and check whether the generated public key C is consistent with the subject public key C in the proxy digital certificate C. If it is consistent, the public key C passes the verification; otherwise, it fails. If all the above three verifications pass, the digital signature verification passes; otherwise, it fails.
[0018] As can be seen from the above, based on the double-signature method of the present invention, there are at least two signatures for a message M: digital signature s C and digital signature s B , and s C is associated with s B , and s C is generated based on s B (the private key C for generating s C is generated based on s B ). When used for cryptographic algorithm transition, the cryptographic algorithms corresponding to key pair A and key pair C are existing cryptographic algorithms (old algorithms, existing algorithms), and the cryptographic algorithm corresponding to key pair B is the target cryptographic algorithm to be transitioned (new algorithm); for cryptographic applications, cryptographic components or systems that only support existing cryptographic algorithms, only digital signature s C can be verified; for cryptographic applications, cryptographic components or systems that support the target cryptographic algorithm, digital signature s B can be verified (of course, s C can also be verified simultaneously). When used for signature authorization, private key B represents the authorization private key, which is strictly protected. Its use requires user participation and user permission (such as FIDO private key). At this time, digital signature s C is the digital signature recognizable by the cryptographic application program, and digital signature s B represents user authorization permission. Usually, only digital signature s C needs to be verified, and digital signature s B needs to be verified only when there is an authorization dispute.
[0019] Based on the multi-signature method of the present invention, multiple key pairs B1, …, key pair B m can be key pairs corresponding to different target cryptographic algorithms for cryptographic algorithm transition, that is, for cryptographic algorithm transition. At this time, digital signatures s B1 , …, s Bm represent the digital signatures of the target cryptographic algorithm, or they can all be key pairs for authorization (for example, authorization key pairs from different users). At this time, digital signatures s B1 , …, s Bm represent private keys B1, …, private key B mThe signature authorization of the owner can also be the target transition algorithm for the transition of the corresponding cryptographic algorithm of some of the key pairs, and some correspond to the authorized key pairs. At this time, the digital signature s B1 , …, s Bm Some represent the digital signatures of the target cryptographic algorithm, and some represent the private keys B1, …, private key B m The signature authorization of the owner.
[0020] In addition to being used for algorithm transition and signature authorization, another use of the present invention is joint signature by two or more parties: The key pair A is the key pair of one signature party, the key pair B is another signature party, or the key pairs B1, …, key pairs B m Are the key pairs of several other signature parties. These key pairs (private keys) from different signature parties cooperate to generate a digital signature s for the message M C . BRIEF DESCRIPTION OF THE DRAWINGS
[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.
[0022] Figure 1 Flowchart of the dual-signature method; Figure 2 Flowchart of the multi-signature method. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0023] The following will describe the specific embodiments of the present invention. The following content is only an illustration of the possible embodiments of the present invention, and does not represent all possible embodiments, and does not limit the protection scope of the present invention.
[0024] The present invention does not particularly limit the cryptographic algorithms corresponding to various key pairs in the specific implementation.
[0025] If the implementation of the dual-signature method of the present invention is for cryptographic algorithm transition, the cryptographic algorithms corresponding to key pair A and key pair B are different. Among them, the cryptographic algorithm corresponding to key pair A is the currently used cryptographic algorithm (such as foreign cryptographic algorithms, non-PQC cryptographic algorithms), and the cryptographic algorithm corresponding to key pair B is the target cryptographic algorithm to be transitioned (such as domestic cryptographic algorithms, PQC cryptographic algorithms). If the implementation of the dual-signature method of the present invention is for signature authorization (i.e., authorization for using the signature private key), the cryptographic algorithms corresponding to key pair A and key pair B can be the same or different. Among them, the private key of key pair B is used for signature authorization, and the private key B is strictly protected. Its use requires user confirmation (authorization) (such as key pair B being the user's FIDO key pair), and the private key C generated or derived from private key A and digital signature s B is the private key for signing the message. If the implementation of the dual-signature of the present invention is for two-party joint signature, key pair A is the key pair of one signatory, and key pair B is the key pair of the other signatory. The process of the dual-signature method is as Figure 1 shown.
[0026] If the implementation of the multi-signature method of the present invention is for the transition of multiple possible target cryptographic algorithms, the cryptographic algorithm corresponding to key pair A is the currently used cryptographic algorithm, and key pairs B1, …, key pair B m correspond to different target cryptographic algorithms for transition respectively. If the implementation of the multi-signature method of the present invention is for signature authorization (authorization for using the signature private key), key pairs B1, …, key pair B m are multiple authorization key pairs (such as for multiple parties). The key pair C generated or (derived) from the combined data of key pair A and digital signatures s B1 、…、s Bm is the signature private key. If the implementation of the multi-signature method of the present invention is for both cryptographic algorithm transition and signature authorization (authorization for using the private key) simultaneously, some of the key pairs B1, …, key pair B m are key pairs for cryptographic algorithm transition (such as key pairs for PQC cryptographic algorithms), and some are key pairs for signature authorization. If the implementation of the multi-signature method of the present invention is for multi-party joint signature, key pair A is the key pair of one signatory, and key pairs B1, …, key pair B m are the key pairs of multiple other signatories. The process of the multi-signature method is as Figure 2 shown.
[0027] In specific implementation, the entity owning / using key pair A and key pair B, or key pair A and key pairs B1, …, key pair B m , can be a person, a component institution, or a system respectively.
[0028] Using key pair A and digital signature sB or s B1 ,..., s Bm For the specific implementation of generating or exporting the key pair C from the combined data of s or s,..., s (including directly using the private key A to export the private key C and implicitly determining the private key C by means of password collaborative calculation), reference can be made to CN202410603183X and CN2024106279303. At this time, the digital signature s B or s B1 ,..., s Bm in the present invention is the parameter for dynamically changing the key pair, that is, the key usage information corresponding to CN202410603183X and CN2024106279303 (when necessary, the hash value of the combined data of s or s,..., s can be taken as the parameter for changing the key pair). B or s B1 ,..., s Bm Bm
[0029] The implementation of the proxy digital certificate C can be carried out on the basis of extending the ordinary proxy digital certificate. For example, the public key B or the identification information of the public key B is stored in the proxy digital certificate C through a custom or extended defined extension field, and the digital signature s B and the digital signature s of the information in the proxy digital certificate by the private key B are stored. BP , or the public keys B1,..., B m or the public keys B1,..., B m are stored in the proxy digital certificate C through a custom or extended defined extension field, and the digital signature s B1 ,..., s Bm and s BP1 ,..., s BPm .
[0030] For the dual-signature method, if the key pair B corresponds to a digital certificate and the proxy digital certificate contains the digital signature s BP of the information in the proxy digital certificate by the private key B, then the proxy digital certificate can adopt the structure of a dual-public-key digital certificate, such as the integrated digital certificate in CN2023101592829 (only at this time the integrated digital certificate is the proxy digital certificate, and the digital certificates corresponding to the key pair A and the key pair B are equivalent to the CA digital certificates for signing the integrated digital certificate).
[0031] For the multi-signature method, if the proxy digital certificate contains the digital signatures s m of the information in the proxy digital certificate by the private keys B1,..., B BP1 ,..., s BPm, the proxy digital certificate can adopt the structure of a multi-public-key digital certificate, such as the integrated digital certificate in CN2023101592829 (only at this time, the dual-integrated digital certificate is the proxy digital certificate. For example, the key pair A and the key pairs B1, …, key pairs B m The corresponding digital certificate is equivalent to the CA digital certificate that issues the integrated digital certificate).
[0032] Other specific technical implementations not described belong to the prior art or public knowledge and are well-known and self-evident to those skilled in the relevant fields.
Claims
1. A dual signature method, characterized by: There are key pair A and key pair B, key pair A corresponds to public key A and private key A, key pair B corresponds to public key B and private key B; key pair A corresponds to a digital certificate A; the cryptographic algorithms corresponding to key pair A and key pair B are the same or different; When a private key is needed to digitally sign a message M, the cryptographic component or system first uses the private key B to digitally sign the message M, generating a digital signature s B , and then use the digital signature s B A new key pair C is generated or derived from key pair A, where key pair C corresponds to public key C and private key C. The cryptographic algorithm corresponding to key pair C is the same as that of key pair A. The cryptographic component or system then uses private key C to digitally sign message M and generate a digital signature s. C , and then use the private key A to sign and generate a proxy digital certificate C. The subject public key of the proxy digital certificate C is public key C. The proxy digital certificate C contains the digital signature s B and public key B or identification information of public key B, the proxy digital certificate C is transmitted and stored together with the signed message M, and the signed message M contains / includes the digital signature s C ; The digital signature is a signature value or composite data consisting of multiple data including a signature value; The cryptographic component or system is a component or system that provides cryptographic functions, such as software or hardware or a combination of software and hardware.
2. The dual signature method according to claim 1, wherein: If key pair B is a FIDO key pair, private key B digitally signs the hash value of message M. That is, the hash value of message M is digitally signed by the FIDO authenticator using private key B in a FIDO manner as the FIDO hash value / challenge code.
3. The dual signature method according to claim 2, wherein: The proxy digital certificate C also contains the digital signature of the information in the proxy digital certificate C using the private key B. BP The content covered by the digital signature of the information in the proxy digital certificate C using the private key B does not include the digital signature of the proxy digital certificate C by the private key A in the proxy digital certificate C. A , and the signature verification procedure of the signature verifier uses the public key B to verify the digital signature s B Before verifying the validity of the digital signature s, first use the public key B to verify the validity of the digital signature s BP to verify its effectiveness.
4. The dual signature method according to claim 1, wherein: If the private key A is used to digitally sign the data using a cryptographic collaborative computation method, then when digitally signing the message M, the private key A and the digital signature s are not directly used. B Generate or export private key C, do not use private key C directly for digital signature, but use digital signature s B Generate or derive the private key C implicitly, and then use the cryptographic collaborative calculation method to use the private key C to perform digital signature calculation on the message M to generate the digital signature s C The implicit generation or derivation of the private key C refers to a method of predetermining the calculation or derivation formula of the private key C, but not directly calculating the private key C.
5. The dual signature method according to any one of claims 1 to 4, characterized in that: If the signature verifier only needs to verify the digital signature of the private key C on the message M, the signature verification program of the signature verifier obtains the public key C from the proxy digital certificate C, and then uses the public key C to verify the digital signature s for the message M. C effectiveness; If the signature verifier only needs to verify the digital signature of private key B on message M, the signature verification procedure of the signature verifier obtains the digital signature s from the proxy digital certificate C. B , obtain the public key B from the proxy digital certificate C, or use the identification information of the public key B in the proxy digital certificate C to obtain the public key B, and then use the public key B to verify the digital signature s for the message M B effectiveness; If the signature verifier needs to verify the digital signature s of the private key C on the message M C The digital signature s of message M with private key B B If the associated digital signature is valid, the signature verification procedure of the signature verifier performs the following operations: Get digital signature s from proxy digital certificate C B , obtain public key B from proxy digital certificate C or use the identification information of public key B in proxy digital certificate C to obtain public key B, and use public key B to verify digital signature s B effectiveness; Obtain public key C from proxy digital certificate C and use public key C to verify digital signature s C effectiveness; Using public key A and digital signature s B Generate or export a public key C, and check whether the generated public key C is consistent with the subject public key C in the proxy digital certificate C. If they are consistent, the public key C verification passes, otherwise it fails; If all three of the above verifications are passed, the digital signature verification is passed, otherwise it fails.
6. A multi-signature method, characterized by: There are key pair A and key pair B1, .., key pair B m , where key pair A corresponds to public key A and private key A, key pair B i Corresponding to public key B i and private key B i , i=1,…,m, where m is an integer greater than 1; key pair A corresponds to a digital certificate A; key pair A, key pair B1,…, key pair B m The corresponding cryptographic algorithms are the same or different; When a private key is needed to digitally sign a message M, the cryptographic component or system first uses private keys B1, ..., private keys B m Digitally sign the message M and generate digital signature s B1 ,..,s Bm , and then use the digital signature s B1 ,..,s Bm The combined data and key pair A generate or derive a new key pair C, where the key pair C corresponds to the public key C and the private key C. The cryptographic algorithm corresponding to the key pair C is the same as that of the key pair A. Then, the private key C is used to digitally sign the message M to generate a digital signature s C , and then use the private key A to sign and generate a proxy digital certificate C. The subject public key of the proxy digital certificate C is public key C. The proxy digital certificate C contains the digital signature s B1 ,..,s Bm and public key B i or public key B i Identification information, i=1,…,n; The proxy digital certificate C is transmitted and stored together with the signed message M, and the signed message M contains / includes the digital signature s C ; The digital signature is a signature value or composite data consisting of multiple data including the signature value; The cryptographic component or system is a component or system that provides cryptographic functions, such as software or hardware or a combination of software and hardware.
7. The multi-signature method according to claim 6, wherein: If the key pair B i For a FIDO key pair, the private key B i Digitally sign the hash value of message M, that is, the hash value of message M is used as the FIDO hash value / challenge code by the FIIDO authenticator using the private key B i Signed in FIDO format, i = 1, ..., or m.
8. The multi-signature method according to claim 7, wherein: The proxy digital certificate C also contains the private key B i Digital signature s of the information in the proxy digital certificate C BPi , i=1,…,m, and use the private key B i The content covered by the digital signature of the information in the proxy digital certificate C does not include the digital signature of the private key A in the proxy digital certificate C on the proxy digital certificate C. A ; The signature verification procedure of the signature verifier uses the public key B i Digital signatures Bi Before verifying the validity of i to s BPi The validity of is verified, i=1,…,m.
9. The multi-signature method according to claim 6, wherein: If the private key A is used to digitally sign the data using a cryptographic collaborative calculation method, then when digitally signing the message M, the digital signature s is not directly used. B1 ,..,s Bm The combined data and private key A generate or derive the private key C. Instead of using the private key C directly for digital signature, the digital signature s B1 ,..,s Bm The combined data of is implicitly generated or derived from the private key C, and then the private key C is used to perform digital signature calculation on the message M using the cryptographic collaborative calculation method to generate the digital signature s C The implicit generation or derivation of the private key C refers to predetermining the calculation or derivation formula of the private key C, but not directly calculating the private key C.
10. The multi-signature method according to any one of claims 6 to 9, characterized in that: If the signature verifier only needs to verify the digital signature of the private key C on the message M, the signature verification program of the signature verifier obtains the public key C from the proxy digital certificate C, and then uses the public key C to verify the digital signature s for the message M. C effectiveness; If the signature verifier only needs to verify the private key B i For the digital signature of message M, i = 1, ..., or m, the signature verification procedure of the signature verifier obtains the digital signature s from the proxy digital certificate C Bi , obtain the public key B from the proxy digital certificate C i , or use the public key B in the proxy digital certificate C i Obtain public key B using the identification information i , then use public key B i Verify the digital signature s for message M Bi effectiveness; If the signature verifier needs to verify the digital signature s of the private key C on the message M C and private key B i Digital signature s of message M Bi For a valid associated digital signature, i=1,…,m, the signature verification procedure of the signature verifier performs the following operations: Get digital signature s from proxy digital certificate C Bi , obtain the public key B from the proxy digital certificate C i Or use the public key B in the proxy digital certificate C i Obtain public key B using the identification information i , using public key B i Verify digital signatures Bi Validity, i=1,…,m; Obtain public key C from proxy digital certificate C and use public key C to verify digital signature s C effectiveness; Using digital signatures B1 ,…,s B1 The public key C is generated by combining the data and the public key A, and the generated public key C is checked to see if it is consistent with the subject public key C in the proxy digital certificate C. If they are consistent, the public key C verification passes, otherwise it fails; If all three of the above verifications are passed, the digital signature verification is passed, otherwise it fails.